Add support for managing Shingled Magnetic Recording (SMR) drives.

This change includes support for SCSI SMR drives (which conform to the
Zoned Block Commands or ZBC spec) and ATA SMR drives (which conform to
the Zoned ATA Command Set or ZAC spec) behind SAS expanders.

This includes full management support through the GEOM BIO interface, and
through a new userland utility, zonectl(8), and through camcontrol(8).

This is now ready for filesystems to use to detect and manage zoned drives.
(There is no work in progress that I know of to use this for ZFS or UFS, if
anyone is interested, let me know and I may have some suggestions.)

Also, improve ATA command passthrough and dispatch support, both via ATA
and ATA passthrough over SCSI.

Also, add support to camcontrol(8) for the ATA Extended Power Conditions
feature set.  You can now manage ATA device power states, and set various
idle time thresholds for a drive to enter lower power states.

Note that this change cannot be MFCed in full, because it depends on
changes to the struct bio API that break compatilibity.  In order to
avoid breaking the stable API, only changes that don't touch or depend on
the struct bio changes can be merged.  For example, the camcontrol(8)
changes don't depend on the new bio API, but zonectl(8) and the probe
changes to the da(4) and ada(4) drivers do depend on it.

Also note that the SMR changes have not yet been tested with an actual
SCSI ZBC device, or a SCSI to ATA translation layer (SAT) that supports
ZBC to ZAC translation.  I have not yet gotten a suitable drive or SAT
layer, so any testing help would be appreciated.  These changes have been
tested with Seagate Host Aware SATA drives attached to both SAS and SATA
controllers.  Also, I do not have any SATA Host Managed devices, and I
suspect that it may take additional (hopefully minor) changes to support
them.

Thanks to Seagate for supplying the test hardware and answering questions.

sbin/camcontrol/Makefile:
	Add epc.c and zone.c.

sbin/camcontrol/camcontrol.8:
	Document the zone and epc subcommands.

sbin/camcontrol/camcontrol.c:
	Add the zone and epc subcommands.

	Add auxiliary register support to build_ata_cmd().  Make sure to
	set the CAM_ATAIO_NEEDRESULT, CAM_ATAIO_DMA, and CAM_ATAIO_FPDMA
	flags as appropriate for ATA commands.

	Add a new get_ata_status() function to parse ATA result from SCSI
	sense descriptors (for ATA passthrough over SCSI) and ATA I/O
	requests.

sbin/camcontrol/camcontrol.h:
	Update the build_ata_cmd() prototype

	Add get_ata_status(), zone(), and epc().

sbin/camcontrol/epc.c:
	Support for ATA Extended Power Conditions features.  This includes
	support for all features documented in the ACS-4 Revision 12
	specification from t13.org (dated February 18, 2016).

	The EPC feature set allows putting a drive into a power power mode
	immediately, or setting timeouts so that the drive will
	automatically enter progressively lower power states after various
	idle times.

sbin/camcontrol/fwdownload.c:
	Update the firmware download code for the new build_ata_cmd()
	arguments.

sbin/camcontrol/zone.c:
	Implement support for Shingled Magnetic Recording (SMR) drives
	via SCSI Zoned Block Commands (ZBC) and ATA Zoned Device ATA
	Command Set (ZAC).

	These specs were developed in concert, and are functionally
	identical.  The primary differences are due to SCSI and ATA
	differences.  (SCSI is big endian, ATA is little endian, for
	example.)

	This includes support for all commands defined in the ZBC and
	ZAC specs.

sys/cam/ata/ata_all.c:
	Decode a number of additional ATA command names in ata_op_string().

	Add a new CCB building function, ata_read_log().

	Add ata_zac_mgmt_in() and ata_zac_mgmt_out() CCB building
	functions.  These support both DMA and NCQ encapsulation.

sys/cam/ata/ata_all.h:
	Add prototypes for ata_read_log(), ata_zac_mgmt_out(), and
	ata_zac_mgmt_in().

sys/cam/ata/ata_da.c:
	Revamp the ada(4) driver to support zoned devices.

	Add four new probe states to gather information needed for zone
	support.

	Add a new adasetflags() function to avoid duplication of large
	blocks of flag setting between the async handler and register
	functions.

	Add new sysctl variables that describe zone support and paramters.

	Add support for the new BIO_ZONE bio, and all of its subcommands:
	DISK_ZONE_OPEN, DISK_ZONE_CLOSE, DISK_ZONE_FINISH, DISK_ZONE_RWP,
	DISK_ZONE_REPORT_ZONES, and DISK_ZONE_GET_PARAMS.

sys/cam/scsi/scsi_all.c:
	Add command descriptions for the ZBC IN/OUT commands.

	Add descriptions for ZBC Host Managed devices.

	Add a new function, scsi_ata_pass() to do ATA passthrough over
	SCSI.  This will eventually replace scsi_ata_pass_16() -- it
	can create the 12, 16, and 32-byte variants of the ATA
	PASS-THROUGH command, and supports setting all of the
	registers defined as of SAT-4, Revision 5 (March 11, 2016).

	Change scsi_ata_identify() to use scsi_ata_pass() instead of
	scsi_ata_pass_16().

	Add a new scsi_ata_read_log() function to facilitate reading
	ATA logs via SCSI.

sys/cam/scsi/scsi_all.h:
	Add the new ATA PASS-THROUGH(32) command CDB.  Add extended and
	variable CDB opcodes.

	Add Zoned Block Device Characteristics VPD page.

	Add ATA Return SCSI sense descriptor.

	Add prototypes for scsi_ata_read_log() and scsi_ata_pass().

sys/cam/scsi/scsi_da.c:
	Revamp the da(4) driver to support zoned devices.

	Add five new probe states, four of which are needed for ATA
	devices.

	Add five new sysctl variables that describe zone support and
	parameters.

	The da(4) driver supports SCSI ZBC devices, as well as ATA ZAC
	devices when they are attached via a SCSI to ATA Translation (SAT)
	layer.  Since ZBC -> ZAC translation is a new feature in the T10
	SAT-4 spec, most SATA drives will be supported via ATA commands
	sent via the SCSI ATA PASS-THROUGH command.  The da(4) driver will
	prefer the ZBC interface, if it is available, for performance
	reasons, but will use the ATA PASS-THROUGH interface to the ZAC
	command set if the SAT layer doesn't support translation yet.
	As I mentioned above, ZBC command support is untested.

	Add support for the new BIO_ZONE bio, and all of its subcommands:
	DISK_ZONE_OPEN, DISK_ZONE_CLOSE, DISK_ZONE_FINISH, DISK_ZONE_RWP,
	DISK_ZONE_REPORT_ZONES, and DISK_ZONE_GET_PARAMS.

	Add scsi_zbc_in() and scsi_zbc_out() CCB building functions.

	Add scsi_ata_zac_mgmt_out() and scsi_ata_zac_mgmt_in() CCB/CDB
	building functions.  Note that these have return values, unlike
	almost all other CCB building functions in CAM.  The reason is
	that they can fail, depending upon the particular combination
	of input parameters.  The primary failure case is if the user
	wants NCQ, but fails to specify additional CDB storage.  NCQ
	requires using the 32-byte version of the SCSI ATA PASS-THROUGH
	command, and the current CAM CDB size is 16 bytes.

sys/cam/scsi/scsi_da.h:
	Add ZBC IN and ZBC OUT CDBs and opcodes.

	Add SCSI Report Zones data structures.

	Add scsi_zbc_in(), scsi_zbc_out(), scsi_ata_zac_mgmt_out(), and
	scsi_ata_zac_mgmt_in() prototypes.

sys/dev/ahci/ahci.c:
	Fix SEND / RECEIVE FPDMA QUEUED in the ahci(4) driver.

	ahci_setup_fis() previously set the top bits of the sector count
	register in the FIS to 0 for FPDMA commands.  This is okay for
	read and write, because the PRIO field is in the only thing in
	those bits, and we don't implement that further up the stack.

	But, for SEND and RECEIVE FPDMA QUEUED, the subcommand is in that
	byte, so it needs to be transmitted to the drive.

	In ahci_setup_fis(), always set the the top 8 bits of the
	sector count register.  We need it in both the standard
	and NCQ / FPDMA cases.

sys/geom/eli/g_eli.c:
	Pass BIO_ZONE commands through the GELI class.

sys/geom/geom.h:
	Add g_io_zonecmd() prototype.

sys/geom/geom_dev.c:
	Add new DIOCZONECMD ioctl, which allows sending zone commands to
	disks.

sys/geom/geom_disk.c:
	Add support for BIO_ZONE commands.

sys/geom/geom_disk.h:
	Add a new flag, DISKFLAG_CANZONE, that indicates that a given
	GEOM disk client can handle BIO_ZONE commands.

sys/geom/geom_io.c:
	Add a new function, g_io_zonecmd(), that handles execution of
	BIO_ZONE commands.

	Add permissions check for BIO_ZONE commands.

	Add command decoding for BIO_ZONE commands.

sys/geom/geom_subr.c:
	Add DDB command decoding for BIO_ZONE commands.

sys/kern/subr_devstat.c:
	Record statistics for REPORT ZONES commands.  Note that the
	number of bytes transferred for REPORT ZONES won't quite match
	what is received from the harware.  This is because we're
	necessarily counting bytes coming from the da(4) / ada(4) drivers,
	which are using the disk_zone.h interface to communicate up
	the stack.  The structure sizes it uses are slightly different
	than the SCSI and ATA structure sizes.

sys/sys/ata.h:
	Add many bit and structure definitions for ZAC, NCQ, and EPC
	command support.

sys/sys/bio.h:
	Convert the bio_cmd field to a straight enumeration.  This will
	yield more space for additional commands in the future.  After
	change r297955 and other related changes, this is now possible.
	Converting to an enumeration will also prevent use as a bitmask
	in the future.

sys/sys/disk.h:
	Define the DIOCZONECMD ioctl.

sys/sys/disk_zone.h:
	Add a new API for managing zoned disks.  This is very close to
	the SCSI ZBC and ATA ZAC standards, but uses integers in native
	byte order instead of big endian (SCSI) or little endian (ATA)
	byte arrays.

	This is intended to offer to the complete feature set of the ZBC
	and ZAC disk management without requiring the application developer
	to include SCSI or ATA headers.  We also use one set of headers
	for ioctl consumers and kernel bio-level consumers.

sys/sys/param.h:
	Bump __FreeBSD_version for sys/bio.h command changes, and inclusion
	of SMR support.

usr.sbin/Makefile:
	Add the zonectl utility.

usr.sbin/diskinfo/diskinfo.c
	Add disk zoning capability to the 'diskinfo -v' output.

usr.sbin/zonectl/Makefile:
	Add zonectl makefile.

usr.sbin/zonectl/zonectl.8
	zonectl(8) man page.

usr.sbin/zonectl/zonectl.c
	The zonectl(8) utility.  This allows managing SCSI or ATA zoned
	disks via the disk_zone.h API.  You can report zones, reset write
	pointers, get parameters, etc.

Sponsored by:	Spectra Logic
Differential Revision:	https://reviews.freebsd.org/D6147
Reviewed by:	wblock (documentation)

7 files changed, 2169 insertions, 17 deletions

diff --git a/sbin/camcontrol/Makefile b/sbin/camcontrol/Makefile
index f1101d3..dc9320a 100644
--- a/sbin/camcontrol/Makefile
+++ b/sbin/camcontrol/Makefile
@@ -4,7 +4,7 @@ PACKAGE=runtime
 PROG=	camcontrol
 SRCS=	camcontrol.c util.c
 .if !defined(RELEASE_CRUNCH)
-SRCS+=	attrib.c fwdownload.c modeedit.c persist.c progress.c
+SRCS+=	attrib.c epc.c fwdownload.c modeedit.c persist.c progress.c zone.c
 .else
 CFLAGS+= -DMINIMALISTIC
 .endif
diff --git a/sbin/camcontrol/camcontrol.8 b/sbin/camcontrol/camcontrol.8
index 607145e..5997e1f 100644
--- a/sbin/camcontrol/camcontrol.8
+++ b/sbin/camcontrol/camcontrol.8
@@ -27,7 +27,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd April 26, 2016
+.Dd May 16, 2016
 .Dt CAMCONTROL 8
 .Os
 .Sh NAME
@@ -323,6 +323,26 @@
 .Op Fl N
 .Op Fl T
 .Nm
+.Ic zone
+.Aq Fl c Ar cmd
+.Op Fl a
+.Op Fl l Ar lba
+.Op Fl o Ar rep_opts
+.Op Fl P Ar print_opts
+.Nm
+.Ic epc
+.Aq Fl c Ar cmd
+.Op Fl d
+.Op Fl D
+.Op Fl e
+.Op Fl H
+.Op Fl p Ar power_cond
+.Op Fl P
+.Op Fl r Ar restore_src
+.Op Fl s
+.Op Fl S Ar power_src
+.Op Fl T Ar timer
+.Nm
 .Ic help
 .Sh DESCRIPTION
 The
@@ -2052,11 +2072,11 @@ Valid types are:
 .Dq portal ,
 and
 .Dq drive .
-.El
 .It Fl V Ar vol_num
 Specify the number of the logical volume to operate on.
 If the media has multiple logical volumes, this will allow displaying
 or writing attributes on the given logical volume.
+.El
 .It Ic opcodes
 Issue the REPORT SUPPORTED OPCODES service action of the
 .Tn SCSI
@@ -2103,6 +2123,300 @@ for the given command or commands.
 The timeout values are in seconds.
 The timeout descriptor also includes a command-specific 
 .El
+.It Ic zone
+Manage
+.Tn SCSI
+and
+.Tn ATA
+Zoned Block devices.
+This allows managing devices that conform to the
+.Tn SCSI
+Zoned Block Commands (ZBC) and
+.Tn ATA
+Zoned ATA Command Set (ZAC)
+specifications.
+Devices using these command sets are usually hard drives using Shingled
+Magnetic Recording (SMR).
+There are three types of SMR drives:
+.Bl -tag -width 13n
+.It Drive Managed
+Drive Managed drives look and act just like a standard random access block
+device, but underneath, the drive reads and writes the bulk of its capacity
+using SMR zones.
+Sequential writes will yield better performance, but writing sequentially
+is not required.
+.It Host Aware
+Host Aware drives expose the underlying zone layout via
+.Tn SCSI
+or
+.Tn ATA
+commands and allow the host to manage the zone conditions.
+The host is not required to manage the zones on the drive, though.
+Sequential writes will yield better performance in Sequential Write
+Preferred zones, but the host can write randomly in those zones.
+.It Host Managed
+Host Managed drives expose the underlying zone layout via
+.Tn SCSI
+or
+.Tn ATA
+commands.
+The host is required to access the zones according to the rules described
+by the zone layout.
+Any commands that violate the rules will be returned with an error.
+.El
+.Pp
+SMR drives are divided into zones (typically in the range of 256MB each)
+that fall into three general categories:
+.Bl -tag -width 20n
+.It Conventional
+These are also known as Non Write Pointer zones.
+These zones can be randomly written without an unexpected performance penalty.
+.It Sequential Preferred
+These zones should be written sequentially starting at the write pointer
+for the zone.
+They may be written randomly.
+Writes that do not conform to the zone layout may be significantly slower
+than expected.
+.It Sequential Required
+These zones must be written sequentially.
+If they are not written sequentially, starting at the write pointer, the
+command will fail.
+.El
+.Pp
+.Bl -tag -width 12n
+.It Fl c Ar cmd
+Specify the zone subcommand:
+.Bl -tag -width 6n
+.It rz
+Issue the Report Zones command.
+All zones are returned by default.
+Specify report options with
+.Fl o
+and printing options with
+.Fl P .
+Specify the starting LBA with
+.Fl l .
+Note that
+.Dq reportzones
+is also accepted as a command argument.
+.It open
+Explicitly open the zone specified by the starting LBA.
+.It close
+Close the zone specified by starting LBA.
+.It finish
+Finish the zone specified by the starting LBA.
+.It rwp
+Reset the write pointer for the zone specified by the starting LBA.
+.El
+.It Fl a
+For the Open, Close, Finish, and Reset Write Pointer operations, apply the
+operation to all zones on the drive.
+.It Fl l Ar lba
+Specify the starting LBA.
+For the Report Zones command, this tells the drive to report starting with
+the zone that starts at the given LBA.
+For the other commands, this allows the user to identify the zone requested
+by its starting LBA.
+The LBA may be specified in decimal, hexadecimal or octal notation.
+.It Fl o Ar rep_opt
+For the Report Zones command, specify a subset of zones to report.
+.Bl -tag -width 8n
+.It all
+Report all zones.
+This is the default.
+.It emtpy
+Report only empty zones.
+.It imp_open
+Report zones that are implicitly open.
+This means that the host has sent a write to the zone without explicitly
+opening the zone.
+.It exp_open
+Report zones that are explicitly open.
+.It closed
+Report zones that have been closed by the host.
+.It full
+Report zones that are full.
+.It ro
+Report zones that are in the read only state.
+Note that
+.Dq readonly
+is also accepted as an argument.
+.It offline
+Report zones that are in the offline state.
+.It reset
+Report zones where the device recommends resetting write pointers.
+.It nonseq
+Report zones that have the Non Sequential Resources Active flag set.
+These are zones that are Sequential Write Preferred, but have been written
+non-sequentially.
+.It nonwp
+Report Non Write Pointer zones, also known as Conventional zones.
+.El
+.It Fl P Ar print_opt
+Specify a printing option for Report Zones:
+.Bl -tag -width 7n
+.It normal
+Normal Report Zones output.
+This is the default.
+The summary and column headings are printed, fields are separated by spaces
+and the fields themselves may contain spaces.
+.It summary
+Just print the summary:  the number of zones, the maximum LBA (LBA of the
+last logical block on the drive), and the value of the 
+.Dq same 
+field.
+The
+.Dq same
+field describes whether the zones on the drive are all identical, all
+different, or whether they are the same except for the last zone, etc.
+.It script
+Print the zones in a script friendly format.
+The summary and column headings are omitted, the fields are separated by
+commas, and the fields do not contain spaces.
+The fields contain underscores where spaces would normally be used.
+.El
+.El
+.It Ic epc
+Issue
+.Tn ATA
+Extended Power Conditions (EPC) feature set commands.
+This only works on
+.Tn ATA
+protocol drives, and will not work on
+.Tn SCSI
+protocol drives.
+It will work on
+.Tn SATA
+drives behind a
+.Tn SCSI
+to
+.Tn ATA
+translation layer (SAT).
+It may be helpful to read the ATA Command Set - 4 (ACS-4) description of
+the Extended Power Conditions feature set, available at t13.org, to
+understand the details of this particular 
+.Nm
+subcommand.
+.Bl -tag -width 6n
+.It Fl c Ar cmd
+Specify the epc subcommand
+.Bl -tag -width 7n
+.It restore
+Restore drive power condition settings.
+.Bl -tag -width 6n
+.It Fl r Ar src
+Specify the source for the restored power settings, either
+.Dq default
+or
+.Dq saved .
+This argument is required.
+.It Fl s
+Save the settings.
+This only makes sense to specify when restoring from defaults.
+.El
+.It goto
+Go to the specified power condition.
+.Bl -tag -width 7n
+.It Fl p Ar cond
+Specify the power condition: Idle_a, Idle_b, Idle_c, Standby_y, Standby_z.
+This argument is required.
+.It Fl D
+Specify delayed entry to the power condition.
+The drive, if it supports this, can enter the power condition after the
+command completes.
+.It Fl H
+Hold the power condition.
+If the drive supports this option, it will hold the power condition and
+reject all commands that would normally cause it to exit that power
+condition.
+.El
+.It timer
+Set the timer value for a power condition and enable or disable the
+condition.
+See the
+.Dq list
+display described below to see what the current timer settings are for each
+Idle and Standby mode supported by the drive.
+.Bl -tag -width 8n
+.It Fl e
+Enable the power condition.
+One of 
+.Fl e
+or
+.Fl d
+is required.
+.It Fl d
+Disable the power condition.
+One of
+.Fl d
+or
+.Fl e
+is required.
+.It Fl T Ar timer
+Specify the timer in seconds.
+The user may specify a timer as a floating point number with a maximum
+supported resolution of tenths of a second.
+Drives may or may not support sub-second timer values.
+.It Fl p Ar cond
+Specify the power condition: Idle_a, Idle_b, Idle_c, Standby_y, Standby_z.
+This argument is required.
+.It Fl s
+Save the timer and power condition enable/disable state.
+By default, if this option is not specified, only the current values for
+this power condition will be affected.
+.El
+.It state
+Enable or disable a particular power condition.
+.Bl -tag -width 7n
+.It Fl p Ar cond
+Specify the power condition: Idle_a, Idle_b, Idle_c, Standby_y, Standby_z.
+This argument is required.
+.It Fl s
+Save the power condition enable/disable state.
+By default, if this option is not specified, only the current values for
+this power condition will be affected.
+.El
+.It enable
+Enable the Extended Power Condition (EPC) feature set.
+.It disable
+Disable the Extended Power Condition (EPC) feature set.
+.It source
+Specify the EPC power source.
+.Bl -tag -width 6n
+.It Fl S Ar src
+Specify the power source, either
+.Dq battery
+or
+.Dq nonbattery .
+.El
+.It status
+Get the current status of several parameters related to the Extended Power
+Condition (EPC) feature set, including whether APM and EPC are supported
+and enabled, whether Low Power Standby is supported, whether setting the
+EPC power source is supported, whether Low Power Standby is supported and
+the current power condition.
+.Bl -tag -width 3n
+.It Fl P
+Only report the current power condition.
+Some drives will exit their current power condition if a command other than
+the
+.Tn ATA
+CHECK POWER MODE command is received.
+If this flag is specified,
+.Nm
+will only issue the
+.Tn ATA
+CHECK POWER MODE command to the drive.
+.El
+.It list
+Display the
+.Tn ATA
+Power Conditions log (Log Address 0x08).
+This shows the list of Idle and Standby power conditions the drive
+supports, and a number of parameters about each condition, including
+whether it is enabled and what the timer value is.
+.El
+.El
 .It Ic help
 Print out verbose usage information.
 .El
@@ -2336,6 +2650,86 @@ This will read and decode the attribute values from partition 1 on the tape
 in tape drive sa0, and will display any
 .Tn SCSI
 errors that result.
+.Pp
+.Bd -literal -offset indent
+camcontrol zone da0 -v -c rz -P summary
+.Ed
+.Pp
+This will request the SMR zone list from disk da0, and print out a
+summary of the zone parameters, and display any
+.Tn SCSI
+or
+.Tn ATA
+errors that result.
+.Pp
+.Bd -literal -offset indent
+camcontrol zone da0 -v -c rz -o reset
+.Ed
+.Pp
+This will request the list of SMR zones that should have their write
+pointer reset from the disk da0, and display any
+.Tn SCSI
+or
+.Tn ATA
+errors that result.
+.Pp
+.Bd -literal -offset indent
+camcontrol zone da0 -v -c rwp -l 0x2c80000
+.Ed
+.Pp
+This will issue the Reset Write Pointer command to disk da0 for the zone
+that starts at LBA 0x2c80000 and display any
+.Tn SCSI
+or
+.Tn ATA
+errors that result.
+.Pp
+.Bd -literal -offset indent
+camcontrol epc ada0 -c timer -T 60.1 -p Idle_a -e -s
+.Ed
+.Pp
+Set the timer for the Idle_a power condition on drive
+.Pa ada0
+to 60.1 seconds, enable that particular power condition, and save the timer
+value and the enabled state of the power condition.
+.Pp
+.Bd -literal -offset indent
+camcontrol epc da4 -c goto -p Standby_z -H
+.Ed
+.Pp
+Tell drive
+.Pa da4
+to go to the Standby_z power state (which is
+the drive's lowest power state) and hold in that state until it is 
+explicitly released by another
+.Cm goto
+command.
+.Pp
+.Bd -literal -offset indent
+camcontrol epc da2 -c status -P
+.Ed
+.Pp
+Report only the power state of
+drive
+.Pa da2 .
+Some drives will power up in response to the commands sent by the 
+.Pa status
+subcommand, and the
+.Fl P
+option causes
+.Nm
+to only send the
+.Tn ATA 
+CHECK POWER MODE command, which should not trigger a change in the drive's
+power state.
+.Pp
+.Bd -literal -offset indent
+camcontrol epc ada0 -c list
+.Ed
+.Pp
+Display the ATA Power Conditions log (Log Address 0x08) for
+drive
+.Pa ada0 .
 .Sh SEE ALSO
 .Xr cam 3 ,
 .Xr cam_cdbparse 3 ,
diff --git a/sbin/camcontrol/camcontrol.c b/sbin/camcontrol/camcontrol.c
index 7afd641..90a6a52 100644
--- a/sbin/camcontrol/camcontrol.c
+++ b/sbin/camcontrol/camcontrol.c
@@ -101,7 +101,9 @@ typedef enum {
 	CAM_CMD_AAM		= 0x00000022,
 	CAM_CMD_ATTRIB		= 0x00000023,
 	CAM_CMD_OPCODES		= 0x00000024,
-	CAM_CMD_REPROBE		= 0x00000025
+	CAM_CMD_REPROBE		= 0x00000025,
+	CAM_CMD_ZONE		= 0x00000026,
+	CAM_CMD_EPC		= 0x00000027
 } cam_cmdmask;
 
 typedef enum {
@@ -230,6 +232,8 @@ static struct camcontrol_opts option_table[] = {
 	{"persist", CAM_CMD_PERSIST, CAM_ARG_NONE, "ai:I:k:K:o:ps:ST:U"},
 	{"attrib", CAM_CMD_ATTRIB, CAM_ARG_NONE, "a:ce:F:p:r:s:T:w:V:"},
 	{"opcodes", CAM_CMD_OPCODES, CAM_ARG_NONE, "No:s:T"},
+	{"zone", CAM_CMD_ZONE, CAM_ARG_NONE, "ac:l:No:P:"},
+	{"epc", CAM_CMD_EPC, CAM_ARG_NONE, "c:dDeHp:Pr:sS:T:"},
 #endif /* MINIMALISTIC */
 	{"help", CAM_CMD_USAGE, CAM_ARG_NONE, NULL},
 	{"-?", CAM_CMD_USAGE, CAM_ARG_NONE, NULL},
@@ -5071,13 +5075,16 @@ bailout:
 	return (retval);
 }
 
-void
+int
 build_ata_cmd(union ccb *ccb, uint32_t retry_count, uint32_t flags,
     uint8_t tag_action, uint8_t protocol, uint8_t ata_flags, uint16_t features,
-    uint16_t sector_count, uint64_t lba, uint8_t command, uint8_t *data_ptr,
-    uint16_t dxfer_len, uint8_t sense_len, uint32_t timeout,
+    uint16_t sector_count, uint64_t lba, uint8_t command, uint32_t auxiliary,
+    uint8_t *data_ptr, uint32_t dxfer_len, uint8_t *cdb_storage,
+    size_t cdb_storage_len, uint8_t sense_len, uint32_t timeout,
     int is48bit, camcontrol_devtype devtype)
 {
+	int retval = 0;
+
 	if (devtype == CC_DT_ATA) {
 		cam_fill_ataio(&ccb->ataio,
 		    /*retries*/ retry_count,
@@ -5093,11 +5100,24 @@ build_ata_cmd(union ccb *ccb, uint32_t retry_count, uint32_t flags,
 		else
 			ata_28bit_cmd(&ccb->ataio, command, features, lba,
 			    sector_count);
+
+		if (auxiliary != 0) {
+			ccb->ataio.ata_flags |= ATA_FLAG_AUX;
+			ccb->ataio.aux = auxiliary;
+		}
+
+		if (ata_flags & AP_FLAG_CHK_COND)
+			ccb->ataio.cmd.flags |= CAM_ATAIO_NEEDRESULT;
+
+		if ((protocol & AP_PROTO_MASK) == AP_PROTO_DMA)
+			ccb->ataio.cmd.flags |= CAM_ATAIO_DMA;
+		else if ((protocol & AP_PROTO_MASK) == AP_PROTO_FPDMA)
+			ccb->ataio.cmd.flags |= CAM_ATAIO_FPDMA;
 	} else {
 		if (is48bit || lba > ATA_MAX_28BIT_LBA)
 			protocol |= AP_EXTEND;
 
-		scsi_ata_pass_16(&ccb->csio,
+		retval = scsi_ata_pass(&ccb->csio,
 		    /*retries*/ retry_count,
 		    /*cbfcnp*/ NULL,
 		    /*flags*/ flags,
@@ -5108,14 +5128,158 @@ build_ata_cmd(union ccb *ccb, uint32_t retry_count, uint32_t flags,
 		    /*sector_count*/ sector_count, 
 		    /*lba*/ lba,
 		    /*command*/ command,
+		    /*device*/ 0,
+		    /*icc*/ 0,
+		    /*auxiliary*/ auxiliary,
 		    /*control*/ 0,
 		    /*data_ptr*/ data_ptr,
 		    /*dxfer_len*/ dxfer_len,
+		    /*cdb_storage*/ cdb_storage,
+		    /*cdb_storage_len*/ cdb_storage_len,
+		    /*minimum_cmd_size*/ 0,
 		    /*sense_len*/ sense_len,
 		    /*timeout*/ timeout);
 	}
+
+	return (retval);
 }
 
+int
+get_ata_status(struct cam_device *dev, union ccb *ccb, uint8_t *error,
+	       uint16_t *count, uint64_t *lba, uint8_t *device, uint8_t *status)
+{
+	int retval = 0;
+
+	switch (ccb->ccb_h.func_code) {
+	case XPT_SCSI_IO: {
+		uint8_t opcode;
+		int error_code = 0, sense_key = 0, asc = 0, ascq = 0;
+
+		/*
+		 * In this case, we have SCSI ATA PASS-THROUGH command, 12
+		 * or 16 byte, and need to see what 
+		 */
+		if (ccb->ccb_h.flags & CAM_CDB_POINTER)
+			opcode = ccb->csio.cdb_io.cdb_ptr[0];
+		else
+			opcode = ccb->csio.cdb_io.cdb_bytes[0];
+		if ((opcode != ATA_PASS_12)
+		 && (opcode != ATA_PASS_16)) {
+			retval = 1;
+			warnx("%s: unsupported opcode %02x", __func__, opcode);
+			goto bailout;
+		}
+
+		retval = scsi_extract_sense_ccb(ccb, &error_code, &sense_key,
+						&asc, &ascq);
+		/* Note: the _ccb() variant returns 0 for an error */
+		if (retval == 0) {
+			retval = 1;
+			goto bailout;
+		} else
+			retval = 0;
+
+		switch (error_code) {
+		case SSD_DESC_CURRENT_ERROR:
+		case SSD_DESC_DEFERRED_ERROR: {
+			struct scsi_sense_data_desc *sense;
+			struct scsi_sense_ata_ret_desc *desc;
+			uint8_t *desc_ptr;
+
+			sense = (struct scsi_sense_data_desc *)
+			    &ccb->csio.sense_data;
+
+			desc_ptr = scsi_find_desc(sense, ccb->csio.sense_len -
+			    ccb->csio.sense_resid, SSD_DESC_ATA);
+			if (desc_ptr == NULL) {
+				cam_error_print(dev, ccb, CAM_ESF_ALL,
+				    CAM_EPF_ALL, stderr);
+				retval = 1;
+				goto bailout;
+			}
+			desc = (struct scsi_sense_ata_ret_desc *)desc_ptr;
+
+			*error = desc->error;
+			*count = (desc->count_15_8 << 8) |
+				  desc->count_7_0;
+			*lba = ((uint64_t)desc->lba_47_40 << 40) |
+			       ((uint64_t)desc->lba_39_32 << 32) |
+			       (desc->lba_31_24 << 24) |
+			       (desc->lba_23_16 << 16) |
+			       (desc->lba_15_8  <<  8) |
+			        desc->lba_7_0;
+			*device = desc->device;
+			*status = desc->status;
+
+			/*
+			 * If the extend bit isn't set, the result is for a
+			 * 12-byte ATA PASS-THROUGH command or a 16 or 32 byte
+			 * command without the extend bit set.  This means
+			 * that the device is supposed to return 28-bit
+			 * status.  The count field is only 8 bits, and the
+			 * LBA field is only 8 bits.
+			 */
+			if ((desc->flags & SSD_DESC_ATA_FLAG_EXTEND) == 0){
+				*count &= 0xff;
+				*lba &= 0x0fffffff;
+			}
+			break;
+		}
+		case SSD_CURRENT_ERROR:
+		case SSD_DEFERRED_ERROR: {
+#if 0
+			struct scsi_sense_data_fixed *sense;
+#endif
+			/*
+			 * XXX KDM need to support fixed sense data.
+			 */
+			warnx("%s: Fixed sense data not supported yet",
+			    __func__);
+			retval = 1;
+			goto bailout;
+			break; /*NOTREACHED*/
+		}
+		default:
+			retval = 1;
+			goto bailout;
+			break;
+		}
+
+		break;
+	}
+	case XPT_ATA_IO: {
+		struct ata_res *res;
+
+		/*
+		 * In this case, we have an ATA command, and we need to
+		 * fill in the requested values from the result register
+		 * set.
+		 */
+		res = &ccb->ataio.res;
+		*error = res->error;
+		*status = res->status;
+		*device = res->device; 
+		*count = res->sector_count;
+		*lba = (res->lba_high << 16) |
+		       (res->lba_mid << 8) |
+		       (res->lba_low);
+		if (res->flags & CAM_ATAIO_48BIT) {
+			*count |= (res->sector_count_exp << 8);
+			*lba |= (res->lba_low_exp << 24) |
+				((uint64_t)res->lba_mid_exp << 32) |
+				((uint64_t)res->lba_high_exp << 40);
+		} else {
+			*lba |= (res->device & 0xf) << 24;
+		}
+		break;
+	}
+	default:
+		retval = 1;
+		break;
+	}
+bailout:
+	return (retval);
+}
 
 static void
 cpi_print(struct ccb_pathinq *cpi)
@@ -8774,6 +8938,11 @@ usage(int printlong)
 "                              [-p part][-s start][-T type][-V vol]\n"
 "        camcontrol opcodes    [dev_id][generic args][-o opcode][-s SA]\n"
 "                              [-N][-T]\n"
+"        camcontrol zone       [dev_id][generic args]<-c cmd> [-a] [-l LBA]\n"
+"                              [-o rep_opts] [-P print_opts]\n"
+"        camcontrol epc        [dev_id][generic_args]<-c cmd> [-d] [-D] [-e]\n"
+"                              [-H] [-p power_cond] [-P] [-r rst_src] [-s]\n"
+"                              [-S power_src] [-T timer]\n"
 #endif /* MINIMALISTIC */
 "        camcontrol help\n");
 	if (!printlong)
@@ -8816,6 +8985,8 @@ usage(int printlong)
 "persist     send the SCSI PERSISTENT RESERVE IN or OUT commands\n"
 "attrib      send the SCSI READ or WRITE ATTRIBUTE commands\n"
 "opcodes     send the SCSI REPORT SUPPORTED OPCODES command\n"
+"zone        manage Zoned Block (Shingled) devices\n"
+"epc         send ATA Extended Power Conditions commands\n"
 "help        this message\n"
 "Device Identifiers:\n"
 "bus:target        specify the bus and target, lun defaults to 0\n"
@@ -8986,6 +9157,27 @@ usage(int printlong)
 "-s service_action specify the service action for the opcode\n"
 "-N                do not return SCSI error for unsupported SA\n"
 "-T                request nominal and recommended timeout values\n"
+"zone arguments:\n"
+"-c cmd            required: rz, open, close, finish, or rwp\n"
+"-a                apply the action to all zones\n"
+"-l LBA            specify the zone starting LBA\n"
+"-o rep_opts       report zones options: all, empty, imp_open, exp_open,\n"
+"                  closed, full, ro, offline, reset, nonseq, nonwp\n"
+"-P print_opt      report zones printing:  normal, summary, script\n"
+"epc arguments:\n"
+"-c cmd            required: restore, goto, timer, state, enable, disable,\n"
+"                  source, status, list\n"
+"-d                disable power mode (timer, state)\n"
+"-D                delayed entry (goto)\n"
+"-e                enable power mode (timer, state)\n"
+"-H                hold power mode (goto)\n"
+"-p power_cond     Idle_a, Idle_b, Idle_c, Standby_y, Standby_z (timer,\n"
+"                  state, goto)\n"
+"-P                only display power mode (status)\n"
+"-r rst_src        restore settings from: default, saved (restore)\n"
+"-s                save mode (timer, state, restore)\n"
+"-S power_src      set power source: battery, nonbattery (source)\n"
+"-T timer          set timer, seconds, .1 sec resolution (timer)\n"
 );
 #endif /* MINIMALISTIC */
 }
@@ -9341,7 +9533,14 @@ main(int argc, char **argv)
 		case CAM_CMD_REPROBE:
 			error = scsireprobe(cam_dev);
 			break;
-
+		case CAM_CMD_ZONE:
+			error = zone(cam_dev, argc, argv, combinedopt,
+			    retry_count, timeout, arglist & CAM_ARG_VERBOSE);
+			break;
+		case CAM_CMD_EPC:
+			error = epc(cam_dev, argc, argv, combinedopt,
+			    retry_count, timeout, arglist & CAM_ARG_VERBOSE);
+			break;
 #endif /* MINIMALISTIC */
 		case CAM_CMD_USAGE:
 			usage(1);
diff --git a/sbin/camcontrol/camcontrol.h b/sbin/camcontrol/camcontrol.h
index bb2fe4f..76b7f9b 100644
--- a/sbin/camcontrol/camcontrol.h
+++ b/sbin/camcontrol/camcontrol.h
@@ -63,16 +63,24 @@ int dev_has_vpd_page(struct cam_device *dev, uint8_t page_id, int retry_count,
 		     int timeout, int verbosemode);
 int get_device_type(struct cam_device *dev, int retry_count, int timeout,
 		    int verbosemode, camcontrol_devtype *devtype);
-void build_ata_cmd(union ccb *ccb, uint32_t retry_count, uint32_t flags,
-		   uint8_t tag_action, uint8_t protocol, uint8_t ata_flags,
-		   uint16_t features, uint16_t sector_count, uint64_t lba,
-		   uint8_t command, uint8_t *data_ptr, uint16_t dxfer_len,
-		   uint8_t sense_len, uint32_t timeout, int is48bit,
-		   camcontrol_devtype devtype);
+int build_ata_cmd(union ccb *ccb, uint32_t retry_count, uint32_t flags,
+		  uint8_t tag_action, uint8_t protocol, uint8_t ata_flags,
+		  uint16_t features, uint16_t sector_count, uint64_t lba,
+		  uint8_t command, uint32_t auxiliary, uint8_t *data_ptr,
+		  uint32_t dxfer_len, uint8_t *cdb_storage,
+		  size_t cdb_storage_len, uint8_t sense_len, uint32_t timeout,
+		  int is48bit, camcontrol_devtype devtype);
+int get_ata_status(struct cam_device *dev, union ccb *ccb, uint8_t *error,
+		   uint16_t *count, uint64_t *lba, uint8_t *device,
+		   uint8_t *status);
 int camxferrate(struct cam_device *device);
 int fwdownload(struct cam_device *device, int argc, char **argv,
 	       char *combinedopt, int printerrors, int retry_count,
 	       int timeout);
+int zone(struct cam_device *device, int argc, char **argv, char *combinedopt,
+	 int retry_count, int timeout, int verbosemode);
+int epc(struct cam_device *device, int argc, char **argv, char *combinedopt,
+	int retry_count, int timeout, int verbosemode);
 void mode_sense(struct cam_device *device, int mode_page, int page_control,
 		int dbd, int retry_count, int timeout, u_int8_t *data,
 		int datalen);
diff --git a/sbin/camcontrol/epc.c b/sbin/camcontrol/epc.c
new file mode 100644
index 0000000..10d76f6
--- /dev/null
+++ b/sbin/camcontrol/epc.c
@@ -0,0 +1,857 @@
+/*-
+ * Copyright (c) 2016 Spectra Logic Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * Authors: Ken Merry           (Spectra Logic Corporation)
+ */
+/*
+ * ATA Extended Power Conditions (EPC) support
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/ioctl.h>
+#include <sys/stdint.h>
+#include <sys/types.h>
+#include <sys/endian.h>
+#include <sys/sbuf.h>
+#include <sys/queue.h>
+#include <sys/ata.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <inttypes.h>
+#include <unistd.h>
+#include <string.h>
+#include <strings.h>
+#include <fcntl.h>
+#include <ctype.h>
+#include <limits.h>
+#include <err.h>
+#include <locale.h>
+
+#include <cam/cam.h>
+#include <cam/cam_debug.h>
+#include <cam/cam_ccb.h>
+#include <cam/scsi/scsi_all.h>
+#include <cam/scsi/scsi_da.h>
+#include <cam/scsi/scsi_pass.h>
+#include <cam/scsi/scsi_message.h>
+#include <camlib.h>
+#include "camcontrol.h"
+
+typedef enum {
+	EPC_ACTION_NONE		= 0x00,
+	EPC_ACTION_LIST		= 0x01,
+	EPC_ACTION_TIMER_SET	= 0x02,
+	EPC_ACTION_IMMEDIATE	= 0x03,
+	EPC_ACTION_GETMODE	= 0x04
+} epc_action;
+
+static struct scsi_nv epc_flags[] = {
+	{ "Supported", ATA_PCL_COND_SUPPORTED },
+	{ "Saveable", ATA_PCL_COND_SUPPORTED },
+	{ "Changeable", ATA_PCL_COND_CHANGEABLE },
+	{ "Default Timer Enabled", ATA_PCL_DEFAULT_TIMER_EN },
+	{ "Saved Timer Enabled", ATA_PCL_SAVED_TIMER_EN },
+	{ "Current Timer Enabled", ATA_PCL_CURRENT_TIMER_EN },
+	{ "Hold Power Condition Not Supported", ATA_PCL_HOLD_PC_NOT_SUP }
+};
+
+static struct scsi_nv epc_power_cond_map[] = {
+	{ "Standby_z", ATA_EPC_STANDBY_Z },
+	{ "z", ATA_EPC_STANDBY_Z },
+	{ "Standby_y", ATA_EPC_STANDBY_Y },
+	{ "y", ATA_EPC_STANDBY_Y },
+	{ "Idle_a", ATA_EPC_IDLE_A },
+	{ "a", ATA_EPC_IDLE_A },
+	{ "Idle_b", ATA_EPC_IDLE_B },
+	{ "b", ATA_EPC_IDLE_B },
+	{ "Idle_c", ATA_EPC_IDLE_C },
+	{ "c", ATA_EPC_IDLE_C }
+};
+
+static struct scsi_nv epc_rst_val[] = {
+	{ "default", ATA_SF_EPC_RST_DFLT },
+	{ "saved", 0}
+};
+
+static struct scsi_nv epc_ps_map[] = {
+	{ "unknown", ATA_SF_EPC_SRC_UNKNOWN },
+	{ "battery", ATA_SF_EPC_SRC_BAT },
+	{ "notbattery", ATA_SF_EPC_SRC_NOT_BAT }
+};
+
+/*
+ * These aren't subcommands of the EPC SET FEATURES subcommand, but rather
+ * commands that determine the current capabilities and status of the drive.
+ * The EPC subcommands are limited to 4 bits, so we won't collide with any
+ * future values.
+ */
+#define	CCTL_EPC_GET_STATUS	0x8001
+#define	CCTL_EPC_LIST		0x8002
+
+static struct scsi_nv epc_cmd_map[] = {
+	{ "restore", ATA_SF_EPC_RESTORE },
+	{ "goto", ATA_SF_EPC_GOTO },
+	{ "timer", ATA_SF_EPC_SET_TIMER },
+	{ "state", ATA_SF_EPC_SET_STATE },
+	{ "enable", ATA_SF_EPC_ENABLE },
+	{ "disable", ATA_SF_EPC_DISABLE },
+	{ "source", ATA_SF_EPC_SET_SOURCE },
+	{ "status", CCTL_EPC_GET_STATUS },
+	{ "list", CCTL_EPC_LIST }
+};
+
+static int epc_list(struct cam_device *device, camcontrol_devtype devtype,
+		    union ccb *ccb, int retry_count, int timeout);
+static void epc_print_pcl_desc(struct ata_power_cond_log_desc *desc,
+			       const char *prefix);
+static int epc_getmode(struct cam_device *device, camcontrol_devtype devtype,
+		       union ccb *ccb, int retry_count, int timeout,
+		       int power_only);
+static int epc_set_features(struct cam_device *device,
+			    camcontrol_devtype devtype, union ccb *ccb,
+			    int retry_count, int timeout, int action,
+			    int power_cond, int timer, int enable, int save,
+			    int delayed_entry, int hold, int power_src,
+			    int restore_src);
+
+static void
+epc_print_pcl_desc(struct ata_power_cond_log_desc *desc, const char *prefix)
+{
+	int first;
+	unsigned int i,	num_printed, max_chars;
+
+	first = 1;
+	max_chars = 75;
+
+	num_printed = printf("%sFlags: ", prefix);
+	for (i = 0; i < (sizeof(epc_flags) / sizeof(epc_flags[0])); i++) {
+		if ((desc->flags & epc_flags[i].value) == 0)
+			continue;
+		if (first == 0) {
+			num_printed += printf(", ");
+		}
+		if ((num_printed + strlen(epc_flags[i].name)) > max_chars) {
+			printf("\n");
+			num_printed = printf("%s       ", prefix);
+		}
+		num_printed += printf("%s", epc_flags[i].name);
+		first = 0;
+	}
+	if (first != 0)
+		printf("None");
+	printf("\n");
+
+	printf("%sDefault timer setting: %.1f sec\n", prefix,
+	    (double)(le32dec(desc->default_timer) / 10));
+	printf("%sSaved timer setting: %.1f sec\n", prefix,
+	    (double)(le32dec(desc->saved_timer) / 10));
+	printf("%sCurrent timer setting: %.1f sec\n", prefix,
+	    (double)(le32dec(desc->current_timer) / 10));
+	printf("%sNominal time to active: %.1f sec\n", prefix,
+	    (double)(le32dec(desc->nom_time_to_active) / 10));
+	printf("%sMinimum timer: %.1f sec\n", prefix,
+	    (double)(le32dec(desc->min_timer) / 10));
+	printf("%sMaximum timer: %.1f sec\n", prefix,
+	    (double)(le32dec(desc->max_timer) / 10));
+	printf("%sNumber of transitions to power condition: %u\n", prefix,
+	    le32dec(desc->num_transitions_to_pc));
+	printf("%sHours in power condition: %u\n", prefix,
+	    le32dec(desc->hours_in_pc));
+}
+
+static int
+epc_list(struct cam_device *device, camcontrol_devtype devtype, union ccb *ccb,
+	 int retry_count, int timeout)
+{
+	struct ata_power_cond_log_idle *idle_log;
+	struct ata_power_cond_log_standby *standby_log;
+	uint8_t log_buf[sizeof(*idle_log) + sizeof(*standby_log)];
+	uint16_t log_addr = ATA_POWER_COND_LOG;
+	uint16_t page_number = ATA_PCL_IDLE;
+	uint64_t lba;
+	int error = 0;
+
+	lba = (((uint64_t)page_number & 0xff00) << 32) |
+	      ((page_number & 0x00ff) << 8) |
+	      (log_addr & 0xff);
+
+	error = build_ata_cmd(ccb,
+	    /*retry_count*/ retry_count,
+	    /*flags*/ CAM_DIR_IN | CAM_DEV_QFRZDIS,
+	    /*tag_action*/ MSG_SIMPLE_Q_TAG,
+	    /*protocol*/ AP_PROTO_DMA | AP_EXTEND,
+	    /*ata_flags*/ AP_FLAG_BYT_BLOK_BLOCKS |
+			  AP_FLAG_TLEN_SECT_CNT |
+			  AP_FLAG_TDIR_FROM_DEV,
+	    /*features*/ 0,
+	    /*sector_count*/ 2,
+	    /*lba*/ lba,
+	    /*command*/ ATA_READ_LOG_DMA_EXT,
+	    /*auxiliary*/ 0,
+	    /*data_ptr*/ log_buf,
+	    /*dxfer_len*/ sizeof(log_buf),
+	    /*cdb_storage*/ NULL,
+	    /*cdb_storage_len*/ 0,
+	    /*sense_len*/ SSD_FULL_SIZE,
+	    /*timeout*/ timeout ? timeout : 60000,
+	    /*is48bit*/ 1,
+	    /*devtype*/ devtype);
+
+	if (error != 0) {
+		warnx("%s: build_ata_cmd() failed, likely programmer error",
+		    __func__);
+		goto bailout;
+	}
+
+	if (retry_count > 0)
+		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
+
+	error = cam_send_ccb(device, ccb);
+	if (error != 0) {
+		warn("error sending ATA READ LOG EXT CCB");
+		error = 1;
+		goto bailout;
+	}
+
+	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
+		cam_error_print(device, ccb, CAM_ESF_ALL, CAM_EPF_ALL,stderr);
+		error = 1;
+		goto bailout;
+	}
+
+	idle_log = (struct ata_power_cond_log_idle *)log_buf;
+	standby_log =
+	    (struct ata_power_cond_log_standby *)&log_buf[sizeof(*idle_log)];
+
+	printf("ATA Power Conditions Log:\n");
+	printf("  Idle power conditions page:\n");
+	printf("    Idle A condition:\n");
+	epc_print_pcl_desc(&idle_log->idle_a_desc, "      ");
+	printf("    Idle B condition:\n");
+	epc_print_pcl_desc(&idle_log->idle_b_desc, "      ");
+	printf("    Idle C condition:\n");
+	epc_print_pcl_desc(&idle_log->idle_c_desc, "      ");
+	printf("  Standby power conditions page:\n");
+	printf("    Standby Y condition:\n");
+	epc_print_pcl_desc(&standby_log->standby_y_desc, "      ");
+	printf("    Standby Z condition:\n");
+	epc_print_pcl_desc(&standby_log->standby_z_desc, "      ");
+bailout:
+	return (error);
+}
+
+static int
+epc_getmode(struct cam_device *device, camcontrol_devtype devtype,
+	    union ccb *ccb, int retry_count, int timeout, int power_only)
+{
+	struct ata_params *ident = NULL;
+	struct ata_identify_log_sup_cap sup_cap;
+	const char *mode_name = NULL;
+	uint8_t error = 0, ata_device = 0, status = 0;
+	uint16_t count = 0;
+	uint64_t lba = 0;
+	uint32_t page_number, log_address;
+	uint64_t caps = 0;
+	int avail_bytes = 0;
+	int res_available = 0;
+	int retval;
+
+	retval = 0;
+
+	if (power_only != 0)
+		goto check_power_mode;
+
+	/*
+	 * Get standard ATA Identify data.
+	 */
+	retval = ata_do_identify(device, retry_count, timeout, ccb, &ident);
+	if (retval != 0) {
+		warnx("Couldn't get identify data");
+		goto bailout;
+	}
+
+	/*
+	 * Get the ATA Identify Data Log (0x30),
+	 * Supported Capabilities Page (0x03).
+	 */
+	log_address = ATA_IDENTIFY_DATA_LOG;
+	page_number = ATA_IDL_SUP_CAP;
+	lba = (((uint64_t)page_number & 0xff00) << 32) |
+	       ((page_number & 0x00ff) << 8) |
+	       (log_address & 0xff);
+
+	bzero(&sup_cap, sizeof(sup_cap));
+	/*
+	 * XXX KDM check the supported protocol.
+	 */
+	retval = build_ata_cmd(ccb,
+	    /*retry_count*/ retry_count,
+	    /*flags*/ CAM_DIR_IN | CAM_DEV_QFRZDIS,
+	    /*tag_action*/ MSG_SIMPLE_Q_TAG,
+	    /*protocol*/ AP_PROTO_DMA |
+			 AP_EXTEND,
+	    /*ata_flags*/ AP_FLAG_BYT_BLOK_BLOCKS |
+			  AP_FLAG_TLEN_SECT_CNT |
+			  AP_FLAG_TDIR_FROM_DEV,
+	    /*features*/ 0,
+	    /*sector_count*/ 1,
+	    /*lba*/ lba,
+	    /*command*/ ATA_READ_LOG_DMA_EXT,
+	    /*auxiliary*/ 0,
+	    /*data_ptr*/ (uint8_t *)&sup_cap,
+	    /*dxfer_len*/ sizeof(sup_cap), 
+	    /*cdb_storage*/ NULL,
+	    /*cdb_storage_len*/ 0,
+	    /*sense_len*/ SSD_FULL_SIZE,
+	    /*timeout*/ timeout ? timeout : 60000,
+	    /*is48bit*/ 1,
+	    /*devtype*/ devtype);
+
+	if (retval != 0) {
+		warnx("%s: build_ata_cmd() failed, likely a programmer error",
+		    __func__);
+		goto bailout;
+	}
+
+	if (retry_count > 0)
+		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
+
+	retval = cam_send_ccb(device, ccb);
+	if (retval != 0) {
+		warn("error sending ATA READ LOG CCB");
+		retval = 1;
+		goto bailout;
+	}
+
+	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
+		cam_error_print(device, ccb, CAM_ESF_ALL, CAM_EPF_ALL,stderr);
+		retval = 1;
+		goto bailout;
+	}
+
+	if (ccb->ccb_h.func_code == XPT_SCSI_IO) {
+		avail_bytes = ccb->csio.dxfer_len - ccb->csio.resid;
+	} else {
+		avail_bytes = ccb->ataio.dxfer_len - ccb->ataio.resid;
+	}
+	if (avail_bytes < (int)sizeof(sup_cap)) {
+		warnx("Couldn't get enough of the ATA Supported "
+		    "Capabilities log, %d bytes returned", avail_bytes);
+		retval = 1;
+		goto bailout;
+	}
+	caps = le64dec(sup_cap.sup_cap);
+	if ((caps & ATA_SUP_CAP_VALID) == 0) {
+		warnx("Supported capabilities bits are not valid");
+		retval = 1;
+		goto bailout;
+	}
+
+	printf("APM: %sSupported, %sEnabled\n",
+	    (ident->support.command2 & ATA_SUPPORT_APM) ? "" : "NOT ",
+	    (ident->enabled.command2 & ATA_SUPPORT_APM) ? "" : "NOT ");
+	printf("EPC: %sSupported, %sEnabled\n",
+	    (ident->support2 & ATA_SUPPORT_EPC) ? "" : "NOT ",
+	    (ident->enabled2 & ATA_ENABLED_EPC) ? "" : "NOT ");
+	printf("Low Power Standby %sSupported\n",
+	    (caps & ATA_SC_LP_STANDBY_SUP) ? "" : "NOT ");
+	printf("Set EPC Power Source %sSupported\n",
+	    (caps & ATA_SC_SET_EPC_PS_SUP) ? "" : "NOT ");
+	
+
+check_power_mode:
+
+	retval = build_ata_cmd(ccb,
+	    /*retry_count*/ retry_count,
+	    /*flags*/ CAM_DIR_NONE | CAM_DEV_QFRZDIS,
+	    /*tag_action*/ MSG_SIMPLE_Q_TAG,
+	    /*protocol*/ AP_PROTO_NON_DATA |
+			 AP_EXTEND,
+	    /*ata_flags*/ AP_FLAG_BYT_BLOK_BLOCKS |
+			  AP_FLAG_TLEN_NO_DATA |
+			  AP_FLAG_CHK_COND,
+	    /*features*/ ATA_SF_EPC,
+	    /*sector_count*/ 0,
+	    /*lba*/ 0,
+	    /*command*/ ATA_CHECK_POWER_MODE,
+	    /*auxiliary*/ 0,
+	    /*data_ptr*/ NULL,
+	    /*dxfer_len*/ 0, 
+	    /*cdb_storage*/ NULL,
+	    /*cdb_storage_len*/ 0,
+	    /*sense_len*/ SSD_FULL_SIZE,
+	    /*timeout*/ timeout ? timeout : 60000,
+	    /*is48bit*/ 0,
+	    /*devtype*/ devtype);
+
+	if (retval != 0) {
+		warnx("%s: build_ata_cmd() failed, likely a programmer error",
+		    __func__);
+		goto bailout;
+	}
+
+	if (retry_count > 0)
+		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
+
+	retval = cam_send_ccb(device, ccb);
+	if (retval != 0) {
+		warn("error sending ATA CHECK POWER MODE CCB");
+		retval = 1;
+		goto bailout;
+	}
+
+	/*
+	 * Check to see whether we got the requested ATA result if this
+	 * is an SCSI ATA PASS-THROUGH command.
+	 */
+	if (((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_SCSI_STATUS_ERROR)
+	 && (ccb->csio.scsi_status == SCSI_STATUS_CHECK_COND)) {
+		int error_code, sense_key, asc, ascq;
+
+		retval = scsi_extract_sense_ccb(ccb, &error_code,
+		    &sense_key, &asc, &ascq);
+		if (retval == 0) {
+			cam_error_print(device, ccb, CAM_ESF_ALL, CAM_EPF_ALL,
+			    stderr);
+			retval = 1;
+			goto bailout;
+		}
+		if ((sense_key == SSD_KEY_RECOVERED_ERROR)
+		 && (asc == 0x00)
+		 && (ascq == 0x1d)) {
+			res_available = 1;
+		}
+		
+	}
+	if (((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP)
+	 && (res_available == 0)) {
+		cam_error_print(device, ccb, CAM_ESF_ALL, CAM_EPF_ALL,stderr);
+		retval = 1;
+		goto bailout;
+	}
+
+	retval = get_ata_status(device, ccb, &error, &count, &lba, &ata_device,
+	    &status);
+	if (retval != 0) {
+		warnx("Unable to get ATA CHECK POWER MODE result");
+		retval = 1;
+		goto bailout;
+	}
+
+	mode_name = scsi_nv_to_str(epc_power_cond_map,
+	    sizeof(epc_power_cond_map) / sizeof(epc_power_cond_map[0]), count);
+	printf("Current power state: ");
+	/* Note: ident can be null in power_only mode */
+	if ((ident == NULL)
+	 || (ident->enabled2 & ATA_ENABLED_EPC)) {
+		if (mode_name != NULL)
+			printf("%s", mode_name);
+		else if (count == 0xff) {
+			printf("PM0:Active or PM1:Idle");
+		}
+	} else {
+		switch (count) {
+		case 0x00:
+			printf("PM2:Standby");
+			break;
+		case 0x80:
+			printf("PM1:Idle");
+			break;
+		case 0xff:
+			printf("PM0:Active or PM1:Idle");
+			break;
+		}
+	}
+	printf("(0x%02x)\n", count);
+
+	if (power_only != 0)
+		goto bailout;
+
+	if (caps & ATA_SC_LP_STANDBY_SUP) {
+		uint32_t wait_mode;
+
+		wait_mode = (lba >> 20) & 0xff;
+		if (wait_mode == 0xff) {
+			printf("Device not waiting to enter lower power "
+			    "condition");
+		} else {
+			mode_name = scsi_nv_to_str(epc_power_cond_map,
+			    sizeof(epc_power_cond_map) /
+			    sizeof(epc_power_cond_map[0]), wait_mode);
+			printf("Device waiting to enter mode %s (0x%02x)\n",
+			    (mode_name != NULL) ? mode_name : "Unknown",
+			    wait_mode);
+		}
+		printf("Device is %sheld in the current power condition\n",
+		    (lba & 0x80000) ? "" : "NOT ");
+	}
+bailout:
+	return (retval);
+
+}
+
+static int
+epc_set_features(struct cam_device *device, camcontrol_devtype devtype,
+		 union ccb *ccb, int retry_count, int timeout, int action,
+		 int power_cond, int timer, int enable, int save,
+		 int delayed_entry, int hold, int power_src, int restore_src)
+{
+	uint64_t lba;
+	uint16_t count = 0;
+	int error;
+
+	error = 0;
+
+	lba = action;
+
+	switch (action) {
+	case ATA_SF_EPC_SET_TIMER:
+		lba |= ((timer << ATA_SF_EPC_TIMER_SHIFT) &
+			 ATA_SF_EPC_TIMER_MASK);
+		/* FALLTHROUGH */
+	case ATA_SF_EPC_SET_STATE:
+		lba |= (enable ? ATA_SF_EPC_TIMER_EN : 0) |
+		       (save ? ATA_SF_EPC_TIMER_SAVE : 0);
+		count = power_cond;
+		break;
+	case ATA_SF_EPC_GOTO:
+		count = power_cond;
+		lba |= (delayed_entry ? ATA_SF_EPC_GOTO_DELAY : 0) |
+		       (hold ? ATA_SF_EPC_GOTO_HOLD : 0);
+		break;
+	case ATA_SF_EPC_RESTORE:
+		lba |= restore_src |
+		       (save ? ATA_SF_EPC_RST_SAVE : 0);
+		break;
+	case ATA_SF_EPC_ENABLE:
+	case ATA_SF_EPC_DISABLE:
+		break;
+	case ATA_SF_EPC_SET_SOURCE:
+		count = power_src;
+		break;
+	}
+
+	error = build_ata_cmd(ccb,
+	    /*retry_count*/ retry_count,
+	    /*flags*/ CAM_DIR_NONE | CAM_DEV_QFRZDIS,
+	    /*tag_action*/ MSG_SIMPLE_Q_TAG,
+	    /*protocol*/ AP_PROTO_NON_DATA | AP_EXTEND,
+	    /*ata_flags*/ AP_FLAG_BYT_BLOK_BLOCKS |
+			  AP_FLAG_TLEN_NO_DATA |
+			  AP_FLAG_TDIR_FROM_DEV,
+	    /*features*/ ATA_SF_EPC,
+	    /*sector_count*/ count,
+	    /*lba*/ lba,
+	    /*command*/ ATA_SETFEATURES,
+	    /*auxiliary*/ 0,
+	    /*data_ptr*/ NULL,
+	    /*dxfer_len*/ 0, 
+	    /*cdb_storage*/ NULL,
+	    /*cdb_storage_len*/ 0,
+	    /*sense_len*/ SSD_FULL_SIZE,
+	    /*timeout*/ timeout ? timeout : 60000,
+	    /*is48bit*/ 1,
+	    /*devtype*/ devtype);
+
+	if (error != 0) {
+		warnx("%s: build_ata_cmd() failed, likely a programmer error",
+		    __func__);
+		goto bailout;
+	}
+
+	if (retry_count > 0)
+		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
+
+	error = cam_send_ccb(device, ccb);
+	if (error != 0) {
+		warn("error sending ATA SET FEATURES CCB");
+		error = 1;
+		goto bailout;
+	}
+
+	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
+		cam_error_print(device, ccb, CAM_ESF_ALL, CAM_EPF_ALL,stderr);
+		error = 1;
+		goto bailout;
+	}
+
+bailout:
+	return (error);
+}
+
+int
+epc(struct cam_device *device, int argc, char **argv, char *combinedopt,
+    int retry_count, int timeout, int verbosemode __unused)
+{
+	union ccb *ccb = NULL;
+	int error = 0;
+	int c;
+	int action = -1;
+	camcontrol_devtype devtype;
+	double timer_val = -1;
+	int timer_tenths = 0, power_cond = -1;
+	int delayed_entry = 0, hold = 0;
+	int enable = -1, save = 0;
+	int restore_src = -1;
+	int power_src = -1;
+	int power_only = 0;
+
+
+	ccb = cam_getccb(device);
+	if (ccb == NULL) {
+		warnx("%s: error allocating CCB", __func__);
+		error = 1;
+		goto bailout;
+	}
+
+	bzero(&(&ccb->ccb_h)[1],
+	      sizeof(union ccb) - sizeof(struct ccb_hdr));
+
+	while ((c = getopt(argc, argv, combinedopt)) != -1) {
+		switch (c) {
+		case 'c': {
+			scsi_nv_status status;
+			int entry_num;
+
+			status = scsi_get_nv(epc_cmd_map,
+			    (sizeof(epc_cmd_map) / sizeof(epc_cmd_map[0])),
+			    optarg, &entry_num, SCSI_NV_FLAG_IG_CASE);
+			if (status == SCSI_NV_FOUND)
+				action = epc_cmd_map[entry_num].value;
+			else {
+				warnx("%s: %s: %s option %s", __func__,
+				    (status == SCSI_NV_AMBIGUOUS) ?
+				    "ambiguous" : "invalid", "epc command",
+				    optarg);
+				error = 1;
+				goto bailout;
+			}
+			break;
+		}
+		case 'd':
+			enable = 0;
+			break;
+		case 'D':
+			delayed_entry = 1;
+			break;
+		case 'e':
+			enable = 1;
+			break;
+		case 'H':
+			hold = 1;
+			break;
+		case 'p': {
+			scsi_nv_status status;
+			int entry_num;
+
+			status = scsi_get_nv(epc_power_cond_map,
+			    (sizeof(epc_power_cond_map) /
+			     sizeof(epc_power_cond_map[0])), optarg,
+			     &entry_num, SCSI_NV_FLAG_IG_CASE);
+			if (status == SCSI_NV_FOUND)
+				power_cond =epc_power_cond_map[entry_num].value;
+			else {
+				warnx("%s: %s: %s option %s", __func__,
+				    (status == SCSI_NV_AMBIGUOUS) ?
+				    "ambiguous" : "invalid", "power condition",
+				    optarg);
+				error = 1;
+				goto bailout;
+			}
+			break;
+		}
+		case 'P':
+			power_only = 1;
+			break;
+		case 'r': {
+			scsi_nv_status status;
+			int entry_num;
+
+			status = scsi_get_nv(epc_rst_val,
+			    (sizeof(epc_rst_val) /
+			     sizeof(epc_rst_val[0])), optarg,
+			     &entry_num, SCSI_NV_FLAG_IG_CASE);
+			if (status == SCSI_NV_FOUND)
+				restore_src = epc_rst_val[entry_num].value;
+			else {
+				warnx("%s: %s: %s option %s", __func__,
+				    (status == SCSI_NV_AMBIGUOUS) ?
+				    "ambiguous" : "invalid",
+				    "restore value source", optarg);
+				error = 1;
+				goto bailout;
+			}
+			break;
+		}
+		case 's':
+			save = 1;
+			break;
+		case 'S': {
+			scsi_nv_status status;
+			int entry_num;
+			
+			status = scsi_get_nv(epc_ps_map,
+			    (sizeof(epc_ps_map) / sizeof(epc_ps_map[0])),
+			    optarg, &entry_num, SCSI_NV_FLAG_IG_CASE);
+			if (status == SCSI_NV_FOUND)
+				power_src = epc_ps_map[entry_num].value;
+			else {
+				warnx("%s: %s: %s option %s", __func__,
+				    (status == SCSI_NV_AMBIGUOUS) ?
+				    "ambiguous" : "invalid", "power source",
+				    optarg);
+				error = 1;
+				goto bailout;
+			}
+			break;
+		}
+		case 'T': {
+			char *endptr;
+
+			timer_val = strtod(optarg, &endptr);
+			if (timer_val < 0) {
+				warnx("Invalid timer value %f", timer_val);
+				error = 1;
+				goto bailout;
+			} else if (*endptr != '\0') {
+				warnx("Invalid timer value %s", optarg);
+				error = 1;
+				goto bailout;
+			}
+			timer_tenths = timer_val * 10;
+			break;
+		}
+		default:
+			break;
+		}
+	}
+
+	if (action == -1) {
+		warnx("Must specify an action");
+		error = 1;
+		goto bailout;
+	}
+	
+	error = get_device_type(device, retry_count, timeout,
+	    /*printerrors*/ 1, &devtype);
+	if (error != 0)
+		errx(1, "Unable to determine device type");
+
+	switch (devtype) {
+	case CC_DT_ATA:
+	case CC_DT_ATA_BEHIND_SCSI:
+		break;
+	default:
+		warnx("The epc subcommand only works with ATA protocol "
+		    "devices");
+		error = 1;
+		goto bailout;
+		break; /*NOTREACHED*/
+	}
+
+	switch (action) {
+	case ATA_SF_EPC_SET_TIMER:
+		if (timer_val == -1) {
+			warnx("Must specify a timer value (-T time)");
+			error = 1;
+		}
+	case ATA_SF_EPC_SET_STATE:
+		if (enable == -1) {
+			warnx("Must specify enable (-e) or disable (-d)");
+			error = 1;
+		}
+		/* FALLTHROUGH */
+	case ATA_SF_EPC_GOTO:
+		if (power_cond == -1) {
+			warnx("Must specify a power condition with -p");
+			error = 1;
+		}
+		if (error != 0)
+			goto bailout;
+		break;
+	case ATA_SF_EPC_SET_SOURCE:
+		if (power_src == -1) {
+			warnx("Must specify a power source (-S battery or "
+			    "-S notbattery) value");
+			error = 1;
+			goto bailout;
+		}
+		break;
+	case ATA_SF_EPC_RESTORE:
+		if (restore_src == -1) {
+			warnx("Must specify a source for restored value, "
+			    "-r default or -r saved");
+			error = 1;
+			goto bailout;
+		}
+		break;
+	case ATA_SF_EPC_ENABLE:
+	case ATA_SF_EPC_DISABLE:
+	case CCTL_EPC_GET_STATUS:
+	case CCTL_EPC_LIST:
+	default:
+		break;
+	}
+
+	switch (action) {
+	case CCTL_EPC_GET_STATUS:
+		error = epc_getmode(device, devtype, ccb, retry_count, timeout,
+		    power_only);
+		break;
+	case CCTL_EPC_LIST:
+		error = epc_list(device, devtype, ccb, retry_count, timeout);
+		break;
+	case ATA_SF_EPC_RESTORE:
+	case ATA_SF_EPC_GOTO:
+	case ATA_SF_EPC_SET_TIMER:
+	case ATA_SF_EPC_SET_STATE:
+	case ATA_SF_EPC_ENABLE:
+	case ATA_SF_EPC_DISABLE:
+	case ATA_SF_EPC_SET_SOURCE:
+		error = epc_set_features(device, devtype, ccb, retry_count,
+		    timeout, action, power_cond, timer_tenths, enable, save,
+		    delayed_entry, hold, power_src, restore_src);
+		break;
+	default:
+		warnx("Not implemented yet");
+		error = 1;
+		goto bailout;
+		break;
+	}
+
+
+bailout:
+	if (ccb != NULL)
+		cam_freeccb(ccb);
+
+	return (error);
+}
diff --git a/sbin/camcontrol/fwdownload.c b/sbin/camcontrol/fwdownload.c
index a676370..0a678af 100644
--- a/sbin/camcontrol/fwdownload.c
+++ b/sbin/camcontrol/fwdownload.c
@@ -692,7 +692,7 @@ fw_check_device_ready(struct cam_device *dev, camcontrol_devtype devtype,
 		break;
 	case CC_DT_ATA_BEHIND_SCSI:
 	case CC_DT_ATA: {
-		build_ata_cmd(ccb,
+		retval = build_ata_cmd(ccb,
 			     /*retries*/ 1,
 			     /*flags*/ CAM_DIR_IN,
 			     /*tag_action*/ MSG_SIMPLE_Q_TAG,
@@ -704,12 +704,21 @@ fw_check_device_ready(struct cam_device *dev, camcontrol_devtype devtype,
 			     /*sector_count*/ (uint8_t) dxfer_len,
 			     /*lba*/ 0,
 			     /*command*/ ATA_ATA_IDENTIFY,
+			     /*auxiliary*/ 0,
 			     /*data_ptr*/ (uint8_t *)ptr,
 			     /*dxfer_len*/ dxfer_len,
+			     /*cdb_storage*/ NULL,
+			     /*cdb_storage_len*/ 0,
 			     /*sense_len*/ SSD_FULL_SIZE,
 			     /*timeout*/ timeout ? timeout : 30 * 1000,
 			     /*is48bit*/ 0,
 			     /*devtype*/ devtype);
+		if (retval != 0) {
+			retval = -1;
+			warnx("%s: build_ata_cmd() failed, likely "
+			    "programmer error", __func__);
+			goto bailout;
+		}
 		break;
 	}
 	default:
@@ -847,7 +856,7 @@ fw_download_img(struct cam_device *cam_dev, struct fw_vendor *vp,
 
 			off = (uint32_t)(pkt_ptr - buf);
 
-			build_ata_cmd(ccb,
+			retval = build_ata_cmd(ccb,
 			    /*retry_count*/ retry_count,
 			    /*flags*/ CAM_DIR_OUT | CAM_DEV_QFRZDIS,
 			    /*tag_action*/ CAM_TAG_ACTION_NONE,
@@ -859,12 +868,21 @@ fw_download_img(struct cam_device *cam_dev, struct fw_vendor *vp,
 			    /*sector_count*/ ATA_MAKE_SECTORS(pkt_size),
 			    /*lba*/ ATA_MAKE_LBA(off, pkt_size),
 			    /*command*/ ATA_DOWNLOAD_MICROCODE,
+			    /*auxiliary*/ 0,
 			    /*data_ptr*/ (uint8_t *)pkt_ptr,
 			    /*dxfer_len*/ pkt_size,
+			    /*cdb_storage*/ NULL,
+			    /*cdb_storage_len*/ 0,
 			    /*sense_len*/ SSD_FULL_SIZE,
 			    /*timeout*/ timeout ? timeout : WB_TIMEOUT,
 			    /*is48bit*/ 0,
 			    /*devtype*/ devtype);
+
+			if (retval != 0) {
+				warnx("%s: build_ata_cmd() failed, likely "
+				    "programmer error", __func__);
+				goto bailout;
+			}
 			break;
 		}
 		default:
diff --git a/sbin/camcontrol/zone.c b/sbin/camcontrol/zone.c
new file mode 100644
index 0000000..aaf172e
--- /dev/null
+++ b/sbin/camcontrol/zone.c
@@ -0,0 +1,676 @@
+/*-
+ * Copyright (c) 2015, 2016 Spectra Logic Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * Authors: Ken Merry           (Spectra Logic Corporation)
+ */
+/*
+ * SCSI and ATA Shingled Media Recording (SMR) support for camcontrol(8).
+ * This is an implementation of the SCSI ZBC and ATA ZAC specs.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/ioctl.h>
+#include <sys/stdint.h>
+#include <sys/types.h>
+#include <sys/endian.h>
+#include <sys/sbuf.h>
+#include <sys/queue.h>
+#include <sys/chio.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <inttypes.h>
+#include <unistd.h>
+#include <string.h>
+#include <strings.h>
+#include <fcntl.h>
+#include <ctype.h>
+#include <limits.h>
+#include <err.h>
+#include <locale.h>
+
+#include <cam/cam.h>
+#include <cam/cam_debug.h>
+#include <cam/cam_ccb.h>
+#include <cam/scsi/scsi_all.h>
+#include <cam/scsi/scsi_da.h>
+#include <cam/scsi/scsi_pass.h>
+#include <cam/scsi/scsi_ch.h>
+#include <cam/scsi/scsi_message.h>
+#include <camlib.h>
+#include "camcontrol.h"
+
+static struct scsi_nv zone_cmd_map[] = {
+	{ "rz", ZBC_IN_SA_REPORT_ZONES },
+	{ "reportzones", ZBC_IN_SA_REPORT_ZONES },
+	{ "close", ZBC_OUT_SA_CLOSE },
+	{ "finish", ZBC_OUT_SA_FINISH },
+	{ "open", ZBC_OUT_SA_OPEN },
+	{ "rwp", ZBC_OUT_SA_RWP }
+};
+
+static struct scsi_nv zone_rep_opts[] = {
+	{ "all", ZBC_IN_REP_ALL_ZONES },
+	{ "empty", ZBC_IN_REP_EMPTY },
+	{ "imp_open", ZBC_IN_REP_IMP_OPEN },
+	{ "exp_open", ZBC_IN_REP_EXP_OPEN },
+	{ "closed", ZBC_IN_REP_CLOSED },
+	{ "full", ZBC_IN_REP_FULL },
+	{ "readonly", ZBC_IN_REP_READONLY },
+	{ "ro", ZBC_IN_REP_READONLY },
+	{ "offline", ZBC_IN_REP_OFFLINE },
+	{ "rwp", ZBC_IN_REP_RESET },
+	{ "reset", ZBC_IN_REP_RESET },
+	{ "nonseq", ZBC_IN_REP_NON_SEQ },
+	{ "nonwp", ZBC_IN_REP_NON_WP }
+};
+
+typedef enum {
+	ZONE_OF_NORMAL	= 0x00,
+	ZONE_OF_SUMMARY	= 0x01,
+	ZONE_OF_SCRIPT	= 0x02
+} zone_output_flags;
+
+static struct scsi_nv zone_print_opts[] = {
+	{ "normal", ZONE_OF_NORMAL },
+	{ "summary", ZONE_OF_SUMMARY },
+	{ "script", ZONE_OF_SCRIPT }
+};
+
+#define	ZAC_ATA_SECTOR_COUNT(bcount)	(((bcount) / 512) & 0xffff)
+
+typedef enum {
+	ZONE_PRINT_OK,
+	ZONE_PRINT_MORE_DATA,
+	ZONE_PRINT_ERROR
+} zone_print_status;
+
+typedef enum {
+	ZONE_FW_START,
+	ZONE_FW_LEN,
+	ZONE_FW_WP,
+	ZONE_FW_TYPE,
+	ZONE_FW_COND,
+	ZONE_FW_SEQ,
+	ZONE_FW_RESET,
+	ZONE_NUM_FIELDS
+} zone_field_widths;
+
+zone_print_status zone_rz_print(uint8_t *data_ptr, uint32_t valid_len,
+				int ata_format, zone_output_flags out_flags,
+				int first_pass, uint64_t *next_start_lba);
+
+
+zone_print_status
+zone_rz_print(uint8_t *data_ptr, uint32_t valid_len, int ata_format,
+	      zone_output_flags out_flags, int first_pass,
+	      uint64_t *next_start_lba)
+{
+	struct scsi_report_zones_hdr *hdr = NULL;
+	struct scsi_report_zones_desc *desc = NULL;
+	uint32_t hdr_len, len;
+	uint64_t max_lba, next_lba = 0;
+	int more_data = 0;
+	zone_print_status status = ZONE_PRINT_OK;
+	char tmpstr[80];
+	int field_widths[ZONE_NUM_FIELDS];
+	char word_sep;
+
+	if (valid_len < sizeof(*hdr)) {
+		status = ZONE_PRINT_ERROR;
+		goto bailout;
+	}
+
+	hdr = (struct scsi_report_zones_hdr *)data_ptr;
+
+	field_widths[ZONE_FW_START] = 11;
+	field_widths[ZONE_FW_LEN] = 6;
+	field_widths[ZONE_FW_WP] = 11;
+	field_widths[ZONE_FW_TYPE] = 13;
+	field_widths[ZONE_FW_COND] = 13;
+	field_widths[ZONE_FW_SEQ] = 14;
+	field_widths[ZONE_FW_RESET] = 16;
+
+	if (ata_format == 0) {
+		hdr_len = scsi_4btoul(hdr->length);
+		max_lba = scsi_8btou64(hdr->maximum_lba);
+	} else {
+		hdr_len = le32dec(hdr->length);
+		max_lba = le64dec(hdr->maximum_lba);
+	}
+
+	if (hdr_len > (valid_len + sizeof(*hdr))) {
+		more_data = 1;
+		status = ZONE_PRINT_MORE_DATA;
+	}
+
+	len = MIN(valid_len - sizeof(*hdr), hdr_len);
+
+	if (out_flags == ZONE_OF_SCRIPT)
+		word_sep = '_';
+	else
+		word_sep = ' ';
+
+	if ((out_flags != ZONE_OF_SCRIPT)
+	 && (first_pass != 0)) {
+		printf("%zu zones, Maximum LBA %#jx (%ju)\n",
+		    hdr_len / sizeof(*desc), (uintmax_t)max_lba,
+		    (uintmax_t)max_lba);
+
+		switch (hdr->byte4 & SRZ_SAME_MASK) {
+		case SRZ_SAME_ALL_DIFFERENT:
+			printf("Zone lengths and types may vary\n");
+			break;
+		case SRZ_SAME_ALL_SAME:
+			printf("Zone lengths and types are all the same\n");
+			break;
+		case SRZ_SAME_LAST_DIFFERENT:
+			printf("Zone types are the same, last zone length "
+			    "differs\n");
+			break;
+		case SRZ_SAME_TYPES_DIFFERENT:
+			printf("Zone lengths are the same, types vary\n");
+			break;
+		default:
+			printf("Unknown SAME field value %#x\n",
+			    hdr->byte4 & SRZ_SAME_MASK);
+			break;
+		}
+	}
+	if (out_flags == ZONE_OF_SUMMARY) {
+		status = ZONE_PRINT_OK;
+		goto bailout;
+	}
+
+	if ((out_flags == ZONE_OF_NORMAL)
+	 && (first_pass != 0)) {
+		printf("%*s  %*s  %*s  %*s  %*s  %*s  %*s\n",
+		    field_widths[ZONE_FW_START], "Start LBA",
+		    field_widths[ZONE_FW_LEN], "Length",
+		    field_widths[ZONE_FW_WP], "WP LBA",
+		    field_widths[ZONE_FW_TYPE], "Zone Type",
+		    field_widths[ZONE_FW_COND], "Condition",
+		    field_widths[ZONE_FW_SEQ], "Sequential",
+		    field_widths[ZONE_FW_RESET], "Reset");
+	}
+
+	for (desc = &hdr->desc_list[0]; len >= sizeof(*desc);
+	     len -= sizeof(*desc), desc++) {
+		uint64_t length, start_lba, wp_lba;
+
+		if (ata_format == 0) {
+			length = scsi_8btou64(desc->zone_length);
+			start_lba = scsi_8btou64(desc->zone_start_lba);
+			wp_lba = scsi_8btou64(desc->write_pointer_lba);
+		} else {
+			length = le64dec(desc->zone_length);
+			start_lba = le64dec(desc->zone_start_lba);
+			wp_lba = le64dec(desc->write_pointer_lba);
+		}
+
+		printf("%#*jx, %*ju, %#*jx, ", field_widths[ZONE_FW_START],
+		    (uintmax_t)start_lba, field_widths[ZONE_FW_LEN],
+		    (uintmax_t)length, field_widths[ZONE_FW_WP],
+		    (uintmax_t)wp_lba);
+
+		switch (desc->zone_type & SRZ_TYPE_MASK) {
+		case SRZ_TYPE_CONVENTIONAL:
+			snprintf(tmpstr, sizeof(tmpstr), "Conventional");
+			break;
+		case SRZ_TYPE_SEQ_PREFERRED:
+		case SRZ_TYPE_SEQ_REQUIRED:
+			snprintf(tmpstr, sizeof(tmpstr), "Seq%c%s",
+			    word_sep, ((desc->zone_type & SRZ_TYPE_MASK) ==
+			    SRZ_TYPE_SEQ_PREFERRED) ? "Preferred" :
+			    "Required");
+			break;
+		default:
+			snprintf(tmpstr, sizeof(tmpstr), "Zone%ctype%c%#x",
+			    word_sep, word_sep,desc->zone_type &
+			    SRZ_TYPE_MASK);
+			break;
+		}
+		printf("%*s, ", field_widths[ZONE_FW_TYPE], tmpstr);
+
+		switch (desc->zone_flags & SRZ_ZONE_COND_MASK) {
+		case SRZ_ZONE_COND_NWP:
+			snprintf(tmpstr, sizeof(tmpstr), "NWP");
+			break;
+		case SRZ_ZONE_COND_EMPTY:
+			snprintf(tmpstr, sizeof(tmpstr), "Empty");
+			break;
+		case SRZ_ZONE_COND_IMP_OPEN:
+			snprintf(tmpstr, sizeof(tmpstr), "Implicit%cOpen", 
+			    word_sep);
+			break;
+		case SRZ_ZONE_COND_EXP_OPEN:
+			snprintf(tmpstr, sizeof(tmpstr), "Explicit%cOpen",
+			    word_sep);
+			break;
+		case SRZ_ZONE_COND_CLOSED:
+			snprintf(tmpstr, sizeof(tmpstr), "Closed");
+			break;
+		case SRZ_ZONE_COND_READONLY:
+			snprintf(tmpstr, sizeof(tmpstr), "Readonly");
+			break;
+		case SRZ_ZONE_COND_FULL:
+			snprintf(tmpstr, sizeof(tmpstr), "Full");
+			break;
+		case SRZ_ZONE_COND_OFFLINE:
+			snprintf(tmpstr, sizeof(tmpstr), "Offline");
+			break;
+		default:
+			snprintf(tmpstr, sizeof(tmpstr), "%#x",
+			    desc->zone_flags & SRZ_ZONE_COND_MASK);
+			break;
+		}
+
+		printf("%*s, ", field_widths[ZONE_FW_COND], tmpstr);
+
+		if (desc->zone_flags & SRZ_ZONE_NON_SEQ)
+			snprintf(tmpstr, sizeof(tmpstr), "Non%cSequential",
+			    word_sep);
+		else
+			snprintf(tmpstr, sizeof(tmpstr), "Sequential");
+
+		printf("%*s, ", field_widths[ZONE_FW_SEQ], tmpstr);
+
+		if (desc->zone_flags & SRZ_ZONE_RESET)
+			snprintf(tmpstr, sizeof(tmpstr), "Reset%cNeeded",
+			    word_sep);
+		else
+			snprintf(tmpstr, sizeof(tmpstr), "No%cReset%cNeeded",
+			    word_sep, word_sep);
+
+		printf("%*s\n", field_widths[ZONE_FW_RESET], tmpstr);
+		
+		next_lba = start_lba + length;
+	}
+bailout:
+	*next_start_lba = next_lba;
+
+	return (status);
+}
+
+int
+zone(struct cam_device *device, int argc, char **argv, char *combinedopt,
+     int retry_count, int timeout, int verbosemode __unused)
+{
+	union ccb *ccb = NULL;
+	int action = -1, rep_option = -1;
+	int all_zones = 0;
+	uint64_t lba = 0;
+	int error = 0;
+	uint8_t *data_ptr = NULL;
+	uint32_t alloc_len = 65536, valid_len = 0;
+	camcontrol_devtype devtype;
+	int ata_format = 0, use_ncq = 0;
+	int first_pass = 1;
+	zone_print_status zp_status;
+	zone_output_flags out_flags = ZONE_OF_NORMAL;
+	uint8_t *cdb_storage = NULL;
+	int cdb_storage_len = 32;
+	int c;
+
+	ccb = cam_getccb(device);
+	if (ccb == NULL) {
+		warnx("%s: error allocating CCB", __func__);
+		error = 1;
+		goto bailout;
+	}
+
+	bzero(&(&ccb->ccb_h)[1],
+	      sizeof(union ccb) - sizeof(struct ccb_hdr));
+
+	while ((c = getopt(argc, argv, combinedopt)) != -1) {
+		switch (c) {
+		case 'a':
+			all_zones = 1;
+			break;
+		case 'c': {
+			scsi_nv_status status;
+			int entry_num;
+
+			status = scsi_get_nv(zone_cmd_map,
+			    (sizeof(zone_cmd_map) / sizeof(zone_cmd_map[0])),
+			    optarg, &entry_num, SCSI_NV_FLAG_IG_CASE);
+			if (status == SCSI_NV_FOUND)
+				action = zone_cmd_map[entry_num].value;
+			else {
+				warnx("%s: %s: %s option %s", __func__,
+				    (status == SCSI_NV_AMBIGUOUS) ?
+				    "ambiguous" : "invalid", "zone command",
+				    optarg);
+				error = 1;
+				goto bailout;
+			}
+			break;
+		}
+		case 'l': {
+			char *endptr;
+
+			lba = strtoull(optarg, &endptr, 0);
+			if (*endptr != '\0') {
+				warnx("%s: invalid lba argument %s", __func__,
+				    optarg);
+				error = 1;
+				goto bailout;
+			}
+			break;
+		}
+		case 'N':
+			use_ncq = 1;
+			break;
+		case 'o': {
+			scsi_nv_status status;
+			int entry_num;
+
+			status = scsi_get_nv(zone_rep_opts,
+			    (sizeof(zone_rep_opts) /sizeof(zone_rep_opts[0])),
+			    optarg, &entry_num, SCSI_NV_FLAG_IG_CASE);
+			if (status == SCSI_NV_FOUND)
+				rep_option = zone_rep_opts[entry_num].value;
+			else {
+				warnx("%s: %s: %s option %s", __func__,
+				    (status == SCSI_NV_AMBIGUOUS) ?
+				    "ambiguous" : "invalid", "report zones",
+				    optarg);
+				error = 1;
+				goto bailout;
+			}
+			break;
+		}
+		case 'P': {
+			scsi_nv_status status;
+			int entry_num;
+
+			status = scsi_get_nv(zone_print_opts,
+			    (sizeof(zone_print_opts) /
+			    sizeof(zone_print_opts[0])), optarg, &entry_num,
+			    SCSI_NV_FLAG_IG_CASE);
+			if (status == SCSI_NV_FOUND)
+				out_flags = zone_print_opts[entry_num].value;
+			else {
+				warnx("%s: %s: %s option %s", __func__,
+				    (status == SCSI_NV_AMBIGUOUS) ?
+				    "ambiguous" : "invalid", "print",
+				    optarg);
+				error = 1;
+				goto bailout;
+			}
+			break;
+		}
+		default:
+			break;
+		}
+	}
+	if (action == -1) {
+		warnx("%s: must specify -c <zone_cmd>", __func__);
+		error = 1;
+		goto bailout;
+	}
+	error = get_device_type(device, retry_count, timeout,
+	    /*printerrors*/ 1, &devtype);
+	if (error != 0)
+		errx(1, "Unable to determine device type");
+
+	if (action == ZBC_IN_SA_REPORT_ZONES) {
+
+		data_ptr = malloc(alloc_len);
+		if (data_ptr == NULL)
+			err(1, "unable to allocate %u bytes", alloc_len);
+
+restart_report:
+		bzero(data_ptr, alloc_len);
+		
+		switch (devtype) {
+		case CC_DT_SCSI:
+			scsi_zbc_in(&ccb->csio,
+			    /*retries*/ retry_count,
+			    /*cbfcnp*/ NULL,
+			    /*tag_action*/ MSG_SIMPLE_Q_TAG,
+			    /*service_action*/ action,
+			    /*zone_start_lba*/ lba,
+			    /*zone_options*/ (rep_option != -1) ?
+					      rep_option : 0,
+			    /*data_ptr*/ data_ptr,
+			    /*dxfer_len*/ alloc_len,
+			    /*sense_len*/ SSD_FULL_SIZE,
+			    /*timeout*/ timeout ? timeout : 60000);
+			break;
+		case CC_DT_ATA:
+		case CC_DT_ATA_BEHIND_SCSI: {
+			uint8_t command = 0;
+			uint8_t protocol = 0;
+			uint16_t features = 0, sector_count = 0;
+			uint32_t auxiliary = 0;
+
+			/*
+			 * XXX KDM support the partial bit?
+			 */
+			if (use_ncq == 0) {
+				command = ATA_ZAC_MANAGEMENT_IN;
+				features = action;
+				if (rep_option != -1)
+					features |= (rep_option << 8);	
+				sector_count = ZAC_ATA_SECTOR_COUNT(alloc_len);
+				protocol = AP_PROTO_DMA;
+			} else {
+				cdb_storage = calloc(cdb_storage_len, 1);
+				if (cdb_storage == NULL)
+					err(1, "couldn't allocate memory");
+
+				command = ATA_RECV_FPDMA_QUEUED;
+				features = ZAC_ATA_SECTOR_COUNT(alloc_len);
+				sector_count = ATA_RFPDMA_ZAC_MGMT_IN << 8;
+				auxiliary = action & 0xf;
+				if (rep_option != -1)
+					auxiliary |= rep_option << 8;
+				protocol = AP_PROTO_FPDMA;
+			}
+
+			error = build_ata_cmd(ccb,
+			    /*retry_count*/ retry_count,
+			    /*flags*/ CAM_DIR_IN | CAM_DEV_QFRZDIS,
+			    /*tag_action*/ MSG_SIMPLE_Q_TAG,
+			    /*protocol*/ protocol,
+			    /*ata_flags*/ AP_FLAG_BYT_BLOK_BLOCKS |
+					  AP_FLAG_TLEN_SECT_CNT |
+					  AP_FLAG_TDIR_FROM_DEV,
+			    /*features*/ features,
+			    /*sector_count*/ sector_count,
+			    /*lba*/ lba,
+			    /*command*/ command,
+			    /*auxiliary*/ auxiliary,
+			    /*data_ptr*/ data_ptr,
+			    /*dxfer_len*/ ZAC_ATA_SECTOR_COUNT(alloc_len)*512,
+			    /*cdb_storage*/ cdb_storage,
+			    /*cdb_storage_len*/ cdb_storage_len,
+			    /*sense_len*/ SSD_FULL_SIZE,
+			    /*timeout*/ timeout ? timeout : 60000,
+			    /*is48bit*/ 1,
+			    /*devtype*/ devtype);
+
+			if (error != 0) {
+				warnx("%s: build_ata_cmd() failed, likely "
+				    "programmer error", __func__);
+				goto bailout;
+			}
+
+			ata_format = 1;
+
+			break;
+		}
+		default:
+			warnx("%s: Unknown device type %d", __func__,devtype);
+			error = 1;
+			goto bailout;
+			break; /*NOTREACHED*/
+		}
+	} else {
+		/*
+		 * XXX KDM the current methodology is to always send ATA
+		 * commands to ATA devices.  Need to figure out how to
+		 * detect whether a SCSI to ATA translation layer will
+		 * translate ZBC IN/OUT commands to the appropriate ZAC
+		 * command.
+		 */
+		switch (devtype) {
+		case CC_DT_SCSI:
+			scsi_zbc_out(&ccb->csio,
+			    /*retries*/ retry_count,
+			    /*cbfcnp*/ NULL,
+			    /*tag_action*/ MSG_SIMPLE_Q_TAG,
+			    /*service_action*/ action,
+			    /*zone_id*/ lba,
+			    /*zone_flags*/ (all_zones != 0) ? ZBC_OUT_ALL : 0,
+			    /*data_ptr*/ NULL,
+			    /*dxfer_len*/ 0,
+			    /*sense_len*/ SSD_FULL_SIZE,
+			    /*timeout*/ timeout ? timeout : 60000);
+			break;
+		case CC_DT_ATA:
+		case CC_DT_ATA_BEHIND_SCSI: {
+			uint8_t command = 0;
+			uint8_t protocol = 0;
+			uint16_t features = 0, sector_count = 0;
+			uint32_t auxiliary = 0;
+
+			/*
+			 * Note that we're taking advantage of the fact
+			 * that the action numbers are the same between the
+			 * ZBC and ZAC specs.
+			 */
+
+			if (use_ncq == 0) {
+				protocol = AP_PROTO_NON_DATA;
+				command = ATA_ZAC_MANAGEMENT_OUT;
+				features = action & 0xf;
+				if (all_zones != 0)
+					features |= (ZBC_OUT_ALL << 8);
+			} else {
+				cdb_storage = calloc(cdb_storage_len, 1);
+				if (cdb_storage == NULL)
+					err(1, "couldn't allocate memory");
+
+				protocol = AP_PROTO_FPDMA;
+				command = ATA_NCQ_NON_DATA;
+				features = ATA_NCQ_ZAC_MGMT_OUT;
+				auxiliary = action & 0xf;
+				if (all_zones != 0)
+					auxiliary |= (ZBC_OUT_ALL << 8);
+			}
+
+
+			error = build_ata_cmd(ccb,
+			    /*retry_count*/ retry_count,
+			    /*flags*/ CAM_DIR_NONE | CAM_DEV_QFRZDIS,
+			    /*tag_action*/ MSG_SIMPLE_Q_TAG,
+			    /*protocol*/ AP_PROTO_NON_DATA,
+			    /*ata_flags*/ AP_FLAG_BYT_BLOK_BYTES |
+					  AP_FLAG_TLEN_NO_DATA,
+			    /*features*/ features,
+			    /*sector_count*/ sector_count,
+			    /*lba*/ lba,
+			    /*command*/ command,
+			    /*auxiliary*/ auxiliary,
+			    /*data_ptr*/ NULL,
+			    /*dxfer_len*/ 0,
+			    /*cdb_storage*/ cdb_storage,
+			    /*cdb_storage_len*/ cdb_storage_len,
+			    /*sense_len*/ SSD_FULL_SIZE,
+			    /*timeout*/ timeout ? timeout : 60000,
+			    /*is48bit*/ 1,
+			    /*devtype*/ devtype);
+			if (error != 0) {
+				warnx("%s: build_ata_cmd() failed, likely "
+				    "programmer error", __func__);
+				goto bailout;
+			}
+			ata_format = 1;
+			break;
+		}
+		default:
+			warnx("%s: Unknown device type %d", __func__,devtype);
+			error = 1;
+			goto bailout;
+			break; /*NOTREACHED*/
+		}
+	}
+
+	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
+	if (retry_count > 0)
+		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
+
+	error = cam_send_ccb(device, ccb);
+	if (error != 0) {
+		warn("error sending %s %s CCB", (devtype == CC_DT_SCSI) ?
+		     "ZBC" : "ZAC Management",
+		     (action == ZBC_IN_SA_REPORT_ZONES) ? "In" : "Out");
+		error = -1;
+		goto bailout;
+	}
+
+	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
+		cam_error_print(device, ccb, CAM_ESF_ALL, CAM_EPF_ALL,stderr);
+		error = 1;
+		goto bailout;
+	}
+
+	/*
+	 * If we aren't reading the list of zones, we're done.
+	 */
+	if (action != ZBC_IN_SA_REPORT_ZONES)
+		goto bailout;
+
+	if (ccb->ccb_h.func_code == XPT_SCSI_IO)
+		valid_len = ccb->csio.dxfer_len - ccb->csio.resid;
+	else
+		valid_len = ccb->ataio.dxfer_len - ccb->ataio.resid;
+
+	zp_status = zone_rz_print(data_ptr, valid_len, ata_format, out_flags,
+	    first_pass, &lba);
+
+	if (zp_status == ZONE_PRINT_MORE_DATA) {
+		bzero(ccb, sizeof(*ccb));
+		first_pass = 0;
+		goto restart_report;
+	} else if (zp_status == ZONE_PRINT_ERROR)
+		error = 1;
+bailout:
+	if (ccb != NULL)
+		cam_freeccb(ccb);
+
+	free(data_ptr);
+	free(cdb_storage);
+
+	return (error);
+}