xref: /freebsd/sbin/camcontrol/camcontrol.c (revision 13d826ff947d9026f98e317e7385b22abfc0eace)
1 /*
2  * Copyright (c) 1997-2007 Kenneth D. Merry
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. The name of the author may not be used to endorse or promote products
14  *    derived from this software without specific prior written permission.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 #include <sys/ioctl.h>
31 #include <sys/stdint.h>
32 #include <sys/types.h>
33 #include <sys/stat.h>
34 #include <sys/endian.h>
35 #include <sys/sbuf.h>
36 
37 #include <stdbool.h>
38 #include <stdio.h>
39 #include <stdlib.h>
40 #include <string.h>
41 #include <unistd.h>
42 #include <inttypes.h>
43 #include <limits.h>
44 #include <fcntl.h>
45 #include <ctype.h>
46 #include <err.h>
47 #include <libutil.h>
48 #include <limits.h>
49 #include <inttypes.h>
50 
51 #include <cam/cam.h>
52 #include <cam/cam_debug.h>
53 #include <cam/cam_ccb.h>
54 #include <cam/scsi/scsi_all.h>
55 #include <cam/scsi/scsi_da.h>
56 #include <cam/scsi/scsi_pass.h>
57 #include <cam/scsi/scsi_message.h>
58 #include <cam/scsi/smp_all.h>
59 #include <cam/ata/ata_all.h>
60 #include <cam/mmc/mmc_all.h>
61 #include <camlib.h>
62 #include "camcontrol.h"
63 #include "nvmecontrol_ext.h"
64 
65 typedef enum {
66 	CAM_CMD_NONE,
67 	CAM_CMD_DEVLIST,
68 	CAM_CMD_TUR,
69 	CAM_CMD_INQUIRY,
70 	CAM_CMD_STARTSTOP,
71 	CAM_CMD_RESCAN,
72 	CAM_CMD_READ_DEFECTS,
73 	CAM_CMD_MODE_PAGE,
74 	CAM_CMD_SCSI_CMD,
75 	CAM_CMD_DEVTREE,
76 	CAM_CMD_USAGE,
77 	CAM_CMD_DEBUG,
78 	CAM_CMD_RESET,
79 	CAM_CMD_FORMAT,
80 	CAM_CMD_TAG,
81 	CAM_CMD_RATE,
82 	CAM_CMD_DETACH,
83 	CAM_CMD_REPORTLUNS,
84 	CAM_CMD_READCAP,
85 	CAM_CMD_IDENTIFY,
86 	CAM_CMD_IDLE,
87 	CAM_CMD_STANDBY,
88 	CAM_CMD_SLEEP,
89 	CAM_CMD_SMP_CMD,
90 	CAM_CMD_SMP_RG,
91 	CAM_CMD_SMP_PC,
92 	CAM_CMD_SMP_PHYLIST,
93 	CAM_CMD_SMP_MANINFO,
94 	CAM_CMD_DOWNLOAD_FW,
95 	CAM_CMD_SECURITY,
96 	CAM_CMD_HPA,
97 	CAM_CMD_SANITIZE,
98 	CAM_CMD_PERSIST,
99 	CAM_CMD_APM,
100 	CAM_CMD_AAM,
101 	CAM_CMD_ATTRIB,
102 	CAM_CMD_OPCODES,
103 	CAM_CMD_REPROBE,
104 	CAM_CMD_ZONE,
105 	CAM_CMD_EPC,
106 	CAM_CMD_TIMESTAMP,
107 	CAM_CMD_MMCSD_CMD,
108 	CAM_CMD_POWER_MODE,
109 	CAM_CMD_DEVTYPE,
110 	CAM_CMD_AMA,
111 	CAM_CMD_DEPOP,
112 	CAM_CMD_REQSENSE
113 } cam_cmd;
114 
115 typedef enum {
116 	CAM_ARG_NONE		= 0x00000000,
117 	CAM_ARG_VERBOSE		= 0x00000001,
118 	CAM_ARG_DEVICE		= 0x00000002,
119 	CAM_ARG_BUS		= 0x00000004,
120 	CAM_ARG_TARGET		= 0x00000008,
121 	CAM_ARG_LUN		= 0x00000010,
122 	CAM_ARG_EJECT		= 0x00000020,
123 	CAM_ARG_UNIT		= 0x00000040,
124 			/* unused 0x00000080 */
125 			/* unused 0x00000100 */
126 			/* unused 0x00000200 */
127 			/* unused 0x00000400 */
128 			/* unused 0x00000800 */
129 	CAM_ARG_GET_SERIAL	= 0x00001000,
130 	CAM_ARG_GET_STDINQ	= 0x00002000,
131 	CAM_ARG_GET_XFERRATE	= 0x00004000,
132 	CAM_ARG_INQ_MASK	= 0x00007000,
133 			/* unused 0x00008000 */
134 			/* unused 0x00010000 */
135 	CAM_ARG_TIMEOUT		= 0x00020000,
136 	CAM_ARG_CMD_IN		= 0x00040000,
137 	CAM_ARG_CMD_OUT		= 0x00080000,
138 			/* unused 0x00100000 */
139 	CAM_ARG_ERR_RECOVER	= 0x00200000,
140 	CAM_ARG_RETRIES		= 0x00400000,
141 	CAM_ARG_START_UNIT	= 0x00800000,
142 	CAM_ARG_DEBUG_INFO	= 0x01000000,
143 	CAM_ARG_DEBUG_TRACE	= 0x02000000,
144 	CAM_ARG_DEBUG_SUBTRACE	= 0x04000000,
145 	CAM_ARG_DEBUG_CDB	= 0x08000000,
146 	CAM_ARG_DEBUG_XPT	= 0x10000000,
147 	CAM_ARG_DEBUG_PERIPH	= 0x20000000,
148 	CAM_ARG_DEBUG_PROBE	= 0x40000000,
149 			/* unused 0x80000000 */
150 } cam_argmask;
151 
152 struct camcontrol_opts {
153 	const char	*optname;
154 	uint32_t	cmdnum;
155 	cam_argmask	argnum;
156 	const char	*subopt;
157 };
158 
159 struct ata_set_max_pwd
160 {
161 	uint16_t reserved1;
162 	uint8_t password[32];
163 	uint16_t reserved2[239];
164 };
165 
166 static struct scsi_nv task_attrs[] = {
167 	{ "simple", MSG_SIMPLE_Q_TAG },
168 	{ "head", MSG_HEAD_OF_Q_TAG },
169 	{ "ordered", MSG_ORDERED_Q_TAG },
170 	{ "iwr", MSG_IGN_WIDE_RESIDUE },
171 	{ "aca", MSG_ACA_TASK }
172 };
173 
174 static const char scsicmd_opts[] = "a:c:dfi:o:r";
175 static const char readdefect_opts[] = "f:GPqsS:X";
176 static const char negotiate_opts[] = "acD:M:O:qR:T:UW:";
177 static const char smprg_opts[] = "l";
178 static const char smppc_opts[] = "a:A:d:lm:M:o:p:s:S:T:";
179 static const char smpphylist_opts[] = "lq";
180 static char pwd_opt;
181 
182 static struct camcontrol_opts option_table[] = {
183 	{"tur", CAM_CMD_TUR, CAM_ARG_NONE, NULL},
184 	{"inquiry", CAM_CMD_INQUIRY, CAM_ARG_NONE, "DSR"},
185 	{"identify", CAM_CMD_IDENTIFY, CAM_ARG_NONE, NULL},
186 	{"start", CAM_CMD_STARTSTOP, CAM_ARG_START_UNIT, NULL},
187 	{"stop", CAM_CMD_STARTSTOP, CAM_ARG_NONE, NULL},
188 	{"load", CAM_CMD_STARTSTOP, CAM_ARG_START_UNIT | CAM_ARG_EJECT, NULL},
189 	{"eject", CAM_CMD_STARTSTOP, CAM_ARG_EJECT, NULL},
190 	{"reportluns", CAM_CMD_REPORTLUNS, CAM_ARG_NONE, "clr:"},
191 	{"readcapacity", CAM_CMD_READCAP, CAM_ARG_NONE, "bhHlNqs"},
192 	{"reprobe", CAM_CMD_REPROBE, CAM_ARG_NONE, NULL},
193 	{"rescan", CAM_CMD_RESCAN, CAM_ARG_NONE, NULL},
194 	{"reset", CAM_CMD_RESET, CAM_ARG_NONE, NULL},
195 	{"cmd", CAM_CMD_SCSI_CMD, CAM_ARG_NONE, scsicmd_opts},
196 	{"mmcsdcmd", CAM_CMD_MMCSD_CMD, CAM_ARG_NONE, "c:a:F:f:Wb:l:41S:I"},
197 	{"command", CAM_CMD_SCSI_CMD, CAM_ARG_NONE, scsicmd_opts},
198 	{"smpcmd", CAM_CMD_SMP_CMD, CAM_ARG_NONE, "r:R:"},
199 	{"smprg", CAM_CMD_SMP_RG, CAM_ARG_NONE, smprg_opts},
200 	{"smpreportgeneral", CAM_CMD_SMP_RG, CAM_ARG_NONE, smprg_opts},
201 	{"smppc", CAM_CMD_SMP_PC, CAM_ARG_NONE, smppc_opts},
202 	{"smpphycontrol", CAM_CMD_SMP_PC, CAM_ARG_NONE, smppc_opts},
203 	{"smpplist", CAM_CMD_SMP_PHYLIST, CAM_ARG_NONE, smpphylist_opts},
204 	{"smpphylist", CAM_CMD_SMP_PHYLIST, CAM_ARG_NONE, smpphylist_opts},
205 	{"smpmaninfo", CAM_CMD_SMP_MANINFO, CAM_ARG_NONE, "l"},
206 	{"defects", CAM_CMD_READ_DEFECTS, CAM_ARG_NONE, readdefect_opts},
207 	{"defectlist", CAM_CMD_READ_DEFECTS, CAM_ARG_NONE, readdefect_opts},
208 	{"devlist", CAM_CMD_DEVTREE, CAM_ARG_NONE, "-b"},
209 	{"devtype", CAM_CMD_DEVTYPE, CAM_ARG_NONE, ""},
210 	{"periphlist", CAM_CMD_DEVLIST, CAM_ARG_NONE, NULL},
211 	{"modepage", CAM_CMD_MODE_PAGE, CAM_ARG_NONE, "6bdelm:DLP:"},
212 	{"tags", CAM_CMD_TAG, CAM_ARG_NONE, "N:q"},
213 	{"negotiate", CAM_CMD_RATE, CAM_ARG_NONE, negotiate_opts},
214 	{"rate", CAM_CMD_RATE, CAM_ARG_NONE, negotiate_opts},
215 	{"debug", CAM_CMD_DEBUG, CAM_ARG_NONE, "IPTSXcp"},
216 	{"format", CAM_CMD_FORMAT, CAM_ARG_NONE, "qrwy"},
217 	{"sanitize", CAM_CMD_SANITIZE, CAM_ARG_NONE, "a:c:IP:qrUwy"},
218 	{"idle", CAM_CMD_IDLE, CAM_ARG_NONE, "t:"},
219 	{"standby", CAM_CMD_STANDBY, CAM_ARG_NONE, "t:"},
220 	{"sleep", CAM_CMD_SLEEP, CAM_ARG_NONE, ""},
221 	{"powermode", CAM_CMD_POWER_MODE, CAM_ARG_NONE, ""},
222 	{"apm", CAM_CMD_APM, CAM_ARG_NONE, "l:"},
223 	{"aam", CAM_CMD_AAM, CAM_ARG_NONE, "l:"},
224 	{"fwdownload", CAM_CMD_DOWNLOAD_FW, CAM_ARG_NONE, "f:qsy"},
225 	{"security", CAM_CMD_SECURITY, CAM_ARG_NONE, "d:e:fh:k:l:qs:T:U:y"},
226 	{"hpa", CAM_CMD_HPA, CAM_ARG_NONE, "Pflp:qs:U:y"},
227 	{"ama", CAM_CMD_AMA, CAM_ARG_NONE, "fqs:"},
228 	{"persist", CAM_CMD_PERSIST, CAM_ARG_NONE, "ai:I:k:K:o:ps:ST:U"},
229 	{"attrib", CAM_CMD_ATTRIB, CAM_ARG_NONE, "a:ce:F:p:r:s:T:w:V:"},
230 	{"opcodes", CAM_CMD_OPCODES, CAM_ARG_NONE, "No:s:T"},
231 	{"zone", CAM_CMD_ZONE, CAM_ARG_NONE, "ac:l:No:P:"},
232 	{"epc", CAM_CMD_EPC, CAM_ARG_NONE, "c:dDeHp:Pr:sS:T:"},
233 	{"timestamp", CAM_CMD_TIMESTAMP, CAM_ARG_NONE, "f:mrsUT:"},
234 	{"depop", CAM_CMD_DEPOP, CAM_ARG_NONE, "ac:de:ls"},
235 	{"sense", CAM_CMD_REQSENSE, CAM_ARG_NONE, "Dx"},
236 	{"help", CAM_CMD_USAGE, CAM_ARG_NONE, NULL},
237 	{"-?", CAM_CMD_USAGE, CAM_ARG_NONE, NULL},
238 	{"-h", CAM_CMD_USAGE, CAM_ARG_NONE, NULL},
239 	{NULL, 0, 0, NULL}
240 };
241 
242 struct cam_devitem {
243 	struct device_match_result dev_match;
244 	int num_periphs;
245 	struct periph_match_result *periph_matches;
246 	struct scsi_vpd_device_id *device_id;
247 	int device_id_len;
248 	STAILQ_ENTRY(cam_devitem) links;
249 };
250 
251 struct cam_devlist {
252 	STAILQ_HEAD(, cam_devitem) dev_queue;
253 	path_id_t path_id;
254 };
255 
256 static cam_argmask arglist;
257 
258 static const char *devtype_names[] = {
259 	"none",
260 	"scsi",
261 	"satl",
262 	"ata",
263 	"nvme",
264 	"mmcsd",
265 	"unknown",
266 };
267 
268 camcontrol_optret getoption(struct camcontrol_opts *table, char *arg,
269 			    uint32_t *cmdnum, cam_argmask *argnum,
270 			    const char **subopt);
271 static int getdevlist(struct cam_device *device);
272 static int getdevtree(int argc, char **argv, char *combinedopt);
273 static int getdevtype(struct cam_device *device);
274 static int print_dev_scsi(struct device_match_result *dev_result, char *tmpstr);
275 static int print_dev_ata(struct device_match_result *dev_result, char *tmpstr);
276 static int print_dev_semb(struct device_match_result *dev_result, char *tmpstr);
277 static int print_dev_mmcsd(struct device_match_result *dev_result,
278     char *tmpstr);
279 static int print_dev_nvme(struct device_match_result *dev_result, char *tmpstr);
280 static int requestsense(struct cam_device *device, int argc, char **argv,
281 			char *combinedopt, int task_attr, int retry_count,
282 			int timeout);
283 static int testunitready(struct cam_device *device, int task_attr,
284 			 int retry_count, int timeout, int quiet);
285 static int scsistart(struct cam_device *device, int startstop, int loadeject,
286 		     int task_attr, int retry_count, int timeout);
287 static int scsiinquiry(struct cam_device *device, int task_attr,
288 		       int retry_count, int timeout);
289 static int scsiserial(struct cam_device *device, int task_attr,
290 		      int retry_count, int timeout);
291 static int parse_btl(char *tstr, path_id_t *bus, target_id_t *target,
292 		     lun_id_t *lun, cam_argmask *arglst);
293 static int reprobe(struct cam_device *device);
294 static int dorescan_or_reset(int argc, char **argv, int rescan);
295 static int rescan_or_reset_bus(path_id_t bus, int rescan);
296 static int scanlun_or_reset_dev(path_id_t bus, target_id_t target,
297     lun_id_t lun, int scan);
298 static int readdefects(struct cam_device *device, int argc, char **argv,
299 		       char *combinedopt, int task_attr, int retry_count,
300 		       int timeout);
301 static void modepage(struct cam_device *device, int argc, char **argv,
302 		     char *combinedopt, int task_attr, int retry_count,
303 		     int timeout);
304 static int scsicmd(struct cam_device *device, int argc, char **argv,
305 		   char *combinedopt, int task_attr, int retry_count,
306 		   int timeout);
307 static int smpcmd(struct cam_device *device, int argc, char **argv,
308 		  char *combinedopt, int retry_count, int timeout);
309 static int mmcsdcmd(struct cam_device *device, int argc, char **argv,
310 		  char *combinedopt, int retry_count, int timeout);
311 static int smpreportgeneral(struct cam_device *device, int argc, char **argv,
312 			    char *combinedopt, int retry_count, int timeout);
313 static int smpphycontrol(struct cam_device *device, int argc, char **argv,
314 			 char *combinedopt, int retry_count, int timeout);
315 static int smpmaninfo(struct cam_device *device, int argc, char **argv,
316 		      char *combinedopt, int retry_count, int timeout);
317 static int getdevid(struct cam_devitem *item);
318 static int buildbusdevlist(struct cam_devlist *devlist);
319 static void freebusdevlist(struct cam_devlist *devlist);
320 static struct cam_devitem *findsasdevice(struct cam_devlist *devlist,
321 					 uint64_t sasaddr);
322 static int smpphylist(struct cam_device *device, int argc, char **argv,
323 		      char *combinedopt, int retry_count, int timeout);
324 static int tagcontrol(struct cam_device *device, int argc, char **argv,
325 		      char *combinedopt);
326 static void cts_print(struct cam_device *device,
327 		      struct ccb_trans_settings *cts);
328 static void cpi_print(struct ccb_pathinq *cpi);
329 static int get_cpi(struct cam_device *device, struct ccb_pathinq *cpi);
330 static int get_cgd(struct cam_device *device, struct ccb_getdev *cgd);
331 static int get_print_cts(struct cam_device *device, int user_settings,
332 			 int quiet, struct ccb_trans_settings *cts);
333 static int ratecontrol(struct cam_device *device, int task_attr,
334 		       int retry_count, int timeout, int argc, char **argv,
335 		       char *combinedopt);
336 static int scsiformat(struct cam_device *device, int argc, char **argv,
337 		      char *combinedopt, int task_attr, int retry_count,
338 		      int timeout);
339 static int sanitize(struct cam_device *device, int argc, char **argv,
340 			char *combinedopt, int task_attr, int retry_count,
341 			int timeout);
342 static int scsireportluns(struct cam_device *device, int argc, char **argv,
343 			  char *combinedopt, int task_attr, int retry_count,
344 			  int timeout);
345 static int scsireadcapacity(struct cam_device *device, int argc, char **argv,
346 			    char *combinedopt, int task_attr, int retry_count,
347 			    int timeout);
348 static int atapm(struct cam_device *device, int argc, char **argv,
349 		 char *combinedopt, int retry_count, int timeout);
350 static int atasecurity(struct cam_device *device, int retry_count, int timeout,
351 		       int argc, char **argv, char *combinedopt);
352 static int atahpa(struct cam_device *device, int retry_count, int timeout,
353 		  int argc, char **argv, char *combinedopt);
354 static int ataama(struct cam_device *device, int retry_count, int timeout,
355 		  int argc, char **argv, char *combinedopt);
356 static int scsiprintoneopcode(struct cam_device *device, int req_opcode,
357 			      int sa_set, int req_sa, uint8_t *buf,
358 			      uint32_t valid_len);
359 static int scsiprintopcodes(struct cam_device *device, int td_req, uint8_t *buf,
360 			    uint32_t valid_len);
361 static int scsiopcodes(struct cam_device *device, int argc, char **argv,
362 		       char *combinedopt, int task_attr, int retry_count,
363 		       int timeout, int verbose);
364 
365 #ifndef min
366 #define min(a,b) (((a)<(b))?(a):(b))
367 #endif
368 #ifndef max
369 #define max(a,b) (((a)>(b))?(a):(b))
370 #endif
371 
372 camcontrol_optret
373 getoption(struct camcontrol_opts *table, char *arg, uint32_t *cmdnum,
374 	  cam_argmask *argnum, const char **subopt)
375 {
376 	struct camcontrol_opts *opts;
377 	int num_matches = 0;
378 
379 	for (opts = table; (opts != NULL) && (opts->optname != NULL);
380 	     opts++) {
381 		if (strncmp(opts->optname, arg, strlen(arg)) == 0) {
382 			*cmdnum = opts->cmdnum;
383 			*argnum = opts->argnum;
384 			*subopt = opts->subopt;
385 			if (++num_matches > 1)
386 				return (CC_OR_AMBIGUOUS);
387 		}
388 	}
389 
390 	if (num_matches > 0)
391 		return (CC_OR_FOUND);
392 	else
393 		return (CC_OR_NOT_FOUND);
394 }
395 
396 static int
397 getdevlist(struct cam_device *device)
398 {
399 	union ccb *ccb;
400 	char status[32];
401 	int error = 0;
402 
403 	ccb = cam_getccb(device);
404 
405 	ccb->ccb_h.func_code = XPT_GDEVLIST;
406 	ccb->ccb_h.flags = CAM_DIR_NONE;
407 	ccb->ccb_h.retry_count = 1;
408 	ccb->cgdl.index = 0;
409 	ccb->cgdl.status = CAM_GDEVLIST_MORE_DEVS;
410 	while (ccb->cgdl.status == CAM_GDEVLIST_MORE_DEVS) {
411 		if (cam_send_ccb(device, ccb) < 0) {
412 			warn("error getting device list");
413 			cam_freeccb(ccb);
414 			return (1);
415 		}
416 
417 		status[0] = '\0';
418 
419 		switch (ccb->cgdl.status) {
420 			case CAM_GDEVLIST_MORE_DEVS:
421 				strcpy(status, "MORE");
422 				break;
423 			case CAM_GDEVLIST_LAST_DEVICE:
424 				strcpy(status, "LAST");
425 				break;
426 			case CAM_GDEVLIST_LIST_CHANGED:
427 				strcpy(status, "CHANGED");
428 				break;
429 			case CAM_GDEVLIST_ERROR:
430 				strcpy(status, "ERROR");
431 				error = 1;
432 				break;
433 		}
434 
435 		fprintf(stdout, "%s%d:  generation: %d index: %d status: %s\n",
436 			ccb->cgdl.periph_name,
437 			ccb->cgdl.unit_number,
438 			ccb->cgdl.generation,
439 			ccb->cgdl.index,
440 			status);
441 
442 		/*
443 		 * If the list has changed, we need to start over from the
444 		 * beginning.
445 		 */
446 		if (ccb->cgdl.status == CAM_GDEVLIST_LIST_CHANGED)
447 			ccb->cgdl.index = 0;
448 	}
449 
450 	cam_freeccb(ccb);
451 
452 	return (error);
453 }
454 
455 static int
456 getdevtree(int argc, char **argv, char *combinedopt)
457 {
458 	union ccb ccb;
459 	int bufsize, fd;
460 	unsigned int i;
461 	int need_close = 0;
462 	int error = 0;
463 	int skip_device = 0;
464 	int busonly = 0;
465 	int c;
466 
467 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
468 		switch(c) {
469 		case 'b':
470 			if ((arglist & CAM_ARG_VERBOSE) == 0)
471 				busonly = 1;
472 			break;
473 		default:
474 			break;
475 		}
476 	}
477 
478 	if ((fd = open(XPT_DEVICE, O_RDWR)) == -1) {
479 		warn("couldn't open %s", XPT_DEVICE);
480 		return (1);
481 	}
482 
483 	bzero(&ccb, sizeof(union ccb));
484 
485 	ccb.ccb_h.path_id = CAM_XPT_PATH_ID;
486 	ccb.ccb_h.target_id = CAM_TARGET_WILDCARD;
487 	ccb.ccb_h.target_lun = CAM_LUN_WILDCARD;
488 
489 	ccb.ccb_h.func_code = XPT_DEV_MATCH;
490 	bufsize = sizeof(struct dev_match_result) * 100;
491 	ccb.cdm.match_buf_len = bufsize;
492 	ccb.cdm.matches = (struct dev_match_result *)malloc(bufsize);
493 	if (ccb.cdm.matches == NULL) {
494 		warnx("can't malloc memory for matches");
495 		close(fd);
496 		return (1);
497 	}
498 	ccb.cdm.num_matches = 0;
499 
500 	/*
501 	 * We fetch all nodes, since we display most of them in the default
502 	 * case, and all in the verbose case.
503 	 */
504 	ccb.cdm.num_patterns = 0;
505 	ccb.cdm.pattern_buf_len = 0;
506 
507 	/*
508 	 * We do the ioctl multiple times if necessary, in case there are
509 	 * more than 100 nodes in the EDT.
510 	 */
511 	do {
512 		if (ioctl(fd, CAMIOCOMMAND, &ccb) == -1) {
513 			warn("error sending CAMIOCOMMAND ioctl");
514 			error = 1;
515 			break;
516 		}
517 
518 		if ((ccb.ccb_h.status != CAM_REQ_CMP)
519 		 || ((ccb.cdm.status != CAM_DEV_MATCH_LAST)
520 		    && (ccb.cdm.status != CAM_DEV_MATCH_MORE))) {
521 			warnx("got CAM error %#x, CDM error %d\n",
522 			      ccb.ccb_h.status, ccb.cdm.status);
523 			error = 1;
524 			break;
525 		}
526 
527 		for (i = 0; i < ccb.cdm.num_matches; i++) {
528 			switch (ccb.cdm.matches[i].type) {
529 			case DEV_MATCH_BUS: {
530 				struct bus_match_result *bus_result;
531 
532 				/*
533 				 * Only print the bus information if the
534 				 * user turns on the verbose flag.
535 				 */
536 				if ((busonly == 0) &&
537 				    (arglist & CAM_ARG_VERBOSE) == 0)
538 					break;
539 
540 				bus_result =
541 					&ccb.cdm.matches[i].result.bus_result;
542 
543 				if (need_close) {
544 					fprintf(stdout, ")\n");
545 					need_close = 0;
546 				}
547 
548 				fprintf(stdout, "scbus%d on %s%d bus %d%s\n",
549 					bus_result->path_id,
550 					bus_result->dev_name,
551 					bus_result->unit_number,
552 					bus_result->bus_id,
553 					(busonly ? "" : ":"));
554 				break;
555 			}
556 			case DEV_MATCH_DEVICE: {
557 				struct device_match_result *dev_result;
558 				char tmpstr[256];
559 
560 				if (busonly == 1)
561 					break;
562 
563 				dev_result =
564 				     &ccb.cdm.matches[i].result.device_result;
565 
566 				if ((dev_result->flags
567 				     & DEV_RESULT_UNCONFIGURED)
568 				 && ((arglist & CAM_ARG_VERBOSE) == 0)) {
569 					skip_device = 1;
570 					break;
571 				} else
572 					skip_device = 0;
573 
574 				if (dev_result->protocol == PROTO_SCSI) {
575 					if (print_dev_scsi(dev_result,
576 					    &tmpstr[0]) != 0) {
577 						skip_device = 1;
578 						break;
579 					}
580 				} else if (dev_result->protocol == PROTO_ATA ||
581 				    dev_result->protocol == PROTO_SATAPM) {
582 					if (print_dev_ata(dev_result,
583 					    &tmpstr[0]) != 0) {
584 						skip_device = 1;
585 						break;
586 					}
587 				} else if (dev_result->protocol == PROTO_MMCSD){
588 					if (print_dev_mmcsd(dev_result,
589 					    &tmpstr[0]) != 0) {
590 						skip_device = 1;
591 						break;
592 					}
593 				} else if (dev_result->protocol == PROTO_SEMB) {
594 					if (print_dev_semb(dev_result,
595 					    &tmpstr[0]) != 0) {
596 						skip_device = 1;
597 						break;
598 					}
599 				} else if (dev_result->protocol == PROTO_NVME) {
600 					if (print_dev_nvme(dev_result,
601 					    &tmpstr[0]) != 0) {
602 						skip_device = 1;
603 						break;
604 					}
605 				} else {
606 				    sprintf(tmpstr, "<>");
607 				}
608 				if (need_close) {
609 					fprintf(stdout, ")\n");
610 					need_close = 0;
611 				}
612 
613 				fprintf(stdout, "%-33s  at scbus%d "
614 					"target %d lun %jx (",
615 					tmpstr,
616 					dev_result->path_id,
617 					dev_result->target_id,
618 					(uintmax_t)dev_result->target_lun);
619 
620 				need_close = 1;
621 
622 				break;
623 			}
624 			case DEV_MATCH_PERIPH: {
625 				struct periph_match_result *periph_result;
626 
627 				periph_result =
628 				      &ccb.cdm.matches[i].result.periph_result;
629 
630 				if (busonly || skip_device != 0)
631 					break;
632 
633 				if (need_close > 1)
634 					fprintf(stdout, ",");
635 
636 				fprintf(stdout, "%s%d",
637 					periph_result->periph_name,
638 					periph_result->unit_number);
639 
640 				need_close++;
641 				break;
642 			}
643 			default:
644 				fprintf(stdout, "unknown match type\n");
645 				break;
646 			}
647 		}
648 
649 	} while ((ccb.ccb_h.status == CAM_REQ_CMP)
650 		&& (ccb.cdm.status == CAM_DEV_MATCH_MORE));
651 
652 	if (need_close)
653 		fprintf(stdout, ")\n");
654 
655 	close(fd);
656 
657 	return (error);
658 }
659 
660 static int
661 getdevtype(struct cam_device *cam_dev)
662 {
663 	camcontrol_devtype dt;
664 	int error;
665 
666 	/*
667 	 * Get the device type and report it, request no I/O be done to do this.
668 	 */
669 	error = get_device_type(cam_dev, -1, 0, 0, &dt);
670 	if (error != 0 || (unsigned)dt > CC_DT_UNKNOWN) {
671 		fprintf(stdout, "illegal\n");
672 		return (1);
673 	}
674 	fprintf(stdout, "%s\n", devtype_names[dt]);
675 	return (0);
676 }
677 
678 static int
679 print_dev_scsi(struct device_match_result *dev_result, char *tmpstr)
680 {
681 	char vendor[16], product[48], revision[16];
682 
683 	cam_strvis(vendor, dev_result->inq_data.vendor,
684 	    sizeof(dev_result->inq_data.vendor), sizeof(vendor));
685 	cam_strvis(product, dev_result->inq_data.product,
686 	    sizeof(dev_result->inq_data.product), sizeof(product));
687 	cam_strvis(revision, dev_result->inq_data.revision,
688 	    sizeof(dev_result->inq_data.revision), sizeof(revision));
689 	sprintf(tmpstr, "<%s %s %s>", vendor, product, revision);
690 
691 	return (0);
692 }
693 
694 static int
695 print_dev_ata(struct device_match_result *dev_result, char *tmpstr)
696 {
697 	char product[48], revision[16];
698 
699 	cam_strvis(product, dev_result->ident_data.model,
700 	    sizeof(dev_result->ident_data.model), sizeof(product));
701 	cam_strvis(revision, dev_result->ident_data.revision,
702 	    sizeof(dev_result->ident_data.revision), sizeof(revision));
703 	sprintf(tmpstr, "<%s %s>", product, revision);
704 
705 	return (0);
706 }
707 
708 static int
709 print_dev_semb(struct device_match_result *dev_result, char *tmpstr)
710 {
711 	struct sep_identify_data *sid;
712 	char vendor[16], product[48], revision[16], fw[5];
713 
714 	sid = (struct sep_identify_data *)&dev_result->ident_data;
715 	cam_strvis(vendor, sid->vendor_id,
716 	    sizeof(sid->vendor_id), sizeof(vendor));
717 	cam_strvis(product, sid->product_id,
718 	    sizeof(sid->product_id), sizeof(product));
719 	cam_strvis(revision, sid->product_rev,
720 	    sizeof(sid->product_rev), sizeof(revision));
721 	cam_strvis(fw, sid->firmware_rev,
722 	    sizeof(sid->firmware_rev), sizeof(fw));
723 	sprintf(tmpstr, "<%s %s %s %s>", vendor, product, revision, fw);
724 
725 	return (0);
726 }
727 
728 static int
729 print_dev_mmcsd(struct device_match_result *dev_result, char *tmpstr)
730 {
731 	union ccb *ccb;
732 	struct ccb_dev_advinfo *advi;
733 	struct cam_device *dev;
734 	struct mmc_params mmc_ident_data;
735 
736 	dev = cam_open_btl(dev_result->path_id, dev_result->target_id,
737 	    dev_result->target_lun, O_RDWR, NULL);
738 	if (dev == NULL) {
739 		warnx("%s", cam_errbuf);
740 		return (1);
741 	}
742 
743 	ccb = cam_getccb(dev);
744 	if (ccb == NULL) {
745 		warnx("couldn't allocate CCB");
746 		cam_close_device(dev);
747 		return (1);
748 	}
749 
750 	advi = &ccb->cdai;
751 	advi->ccb_h.flags = CAM_DIR_IN;
752 	advi->ccb_h.func_code = XPT_DEV_ADVINFO;
753 	advi->flags = CDAI_FLAG_NONE;
754 	advi->buftype = CDAI_TYPE_MMC_PARAMS;
755 	advi->bufsiz = sizeof(struct mmc_params);
756 	advi->buf = (uint8_t *)&mmc_ident_data;
757 
758 	if (cam_send_ccb(dev, ccb) < 0) {
759 		warn("error sending XPT_DEV_ADVINFO CCB");
760 		cam_freeccb(ccb);
761 		cam_close_device(dev);
762 		return (1);
763 	}
764 
765 	if (strlen(mmc_ident_data.model) > 0) {
766 		sprintf(tmpstr, "<%s>", mmc_ident_data.model);
767 	} else {
768 		sprintf(tmpstr, "<%s card>",
769 		    mmc_ident_data.card_features &
770 		    CARD_FEATURE_SDIO ? "SDIO" : "unknown");
771 	}
772 
773 	cam_freeccb(ccb);
774 	cam_close_device(dev);
775 	return (0);
776 }
777 
778 static int
779 nvme_get_cdata(struct cam_device *dev, struct nvme_controller_data *cdata)
780 {
781 	union ccb *ccb;
782 	struct ccb_dev_advinfo *advi;
783 
784 	ccb = cam_getccb(dev);
785 	if (ccb == NULL) {
786 		warnx("couldn't allocate CCB");
787 		cam_close_device(dev);
788 		return (1);
789 	}
790 
791 	advi = &ccb->cdai;
792 	advi->ccb_h.flags = CAM_DIR_IN;
793 	advi->ccb_h.func_code = XPT_DEV_ADVINFO;
794 	advi->flags = CDAI_FLAG_NONE;
795 	advi->buftype = CDAI_TYPE_NVME_CNTRL;
796 	advi->bufsiz = sizeof(struct nvme_controller_data);
797 	advi->buf = (uint8_t *)cdata;
798 
799 	if (cam_send_ccb(dev, ccb) < 0) {
800 		warn("error sending XPT_DEV_ADVINFO CCB");
801 		cam_freeccb(ccb);
802 		cam_close_device(dev);
803 		return(1);
804 	}
805 	if (advi->ccb_h.status != CAM_REQ_CMP) {
806 		warnx("got CAM error %#x", advi->ccb_h.status);
807 		cam_freeccb(ccb);
808 		cam_close_device(dev);
809 		return(1);
810 	}
811 	cam_freeccb(ccb);
812 	return 0;
813 }
814 
815 static int
816 print_dev_nvme(struct device_match_result *dev_result, char *tmpstr)
817 {
818 	struct cam_device *dev;
819 	struct nvme_controller_data cdata;
820 	char vendor[64], product[64];
821 
822 	dev = cam_open_btl(dev_result->path_id, dev_result->target_id,
823 	    dev_result->target_lun, O_RDWR, NULL);
824 	if (dev == NULL) {
825 		warnx("%s", cam_errbuf);
826 		return (1);
827 	}
828 
829 	if (nvme_get_cdata(dev, &cdata))
830 		return (1);
831 
832 	cam_strvis(vendor, cdata.mn, sizeof(cdata.mn), sizeof(vendor));
833 	cam_strvis(product, cdata.fr, sizeof(cdata.fr), sizeof(product));
834 	sprintf(tmpstr, "<%s %s>", vendor, product);
835 
836 	cam_close_device(dev);
837 	return (0);
838 }
839 
840 static int
841 requestsense(struct cam_device *device, int argc, char **argv,
842 	     char *combinedopt, int task_attr, int retry_count, int timeout)
843 {
844 	int c;
845 	int descriptor_sense = 0;
846 	int do_hexdump = 0;
847 	struct scsi_sense_data sense;
848 	union ccb *ccb = NULL;
849 	int error = 0;
850 	size_t returned_bytes;
851 
852 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
853 		switch (c) {
854 		case 'D':
855 			descriptor_sense = 1;
856 			break;
857 		case 'x':
858 			do_hexdump = 1;
859 			break;
860 		default:
861 			break;
862 		}
863 	}
864 
865 	ccb = cam_getccb(device);
866 	if (ccb == NULL) {
867 		warnx("couldn't allocate CCB");
868 		return (1);
869 	}
870 
871 	/* cam_getccb cleans up the header, caller has to zero the payload */
872 	CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
873 
874 	bzero(&sense, sizeof(sense));
875 
876 	scsi_request_sense(&ccb->csio,
877 			   /*retries*/ retry_count,
878 			   /*cbfcnp*/ NULL,
879 			   /*data_ptr*/ (void *)&sense,
880 			   /*dxfer_len*/ sizeof(sense),
881 			   /*tag_action*/ task_attr,
882 			   /*sense_len*/ SSD_FULL_SIZE,
883 			   /*timeout*/ timeout ? timeout : 60000);
884 
885 	if (descriptor_sense != 0) {
886 		struct scsi_request_sense *cdb;
887 
888 		cdb = (struct scsi_request_sense *)&ccb->csio.cdb_io.cdb_bytes;
889 		cdb->byte2 |= SRS_DESC;
890 	}
891 
892 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
893 
894 	if (arglist & CAM_ARG_ERR_RECOVER)
895 		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
896 
897 	if (cam_send_ccb(device, ccb) < 0) {
898 		warn("error sending REQUEST SENSE command");
899 		cam_freeccb(ccb);
900 		error = 1;
901 		goto bailout;
902 	}
903 
904 	/*
905 	 * REQUEST SENSE is not generally supposed to fail.  But there can
906 	 * be transport or other errors that might cause it to fail.  It
907 	 * may also fail if the user asks for descriptor sense and the
908 	 * device doesn't support it.  So we check the CCB status here to see.
909 	 */
910 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
911 		warnx("REQUEST SENSE failed");
912 		cam_error_print(device, ccb, CAM_ESF_ALL, CAM_EPF_ALL, stderr);
913 		error = 1;
914 		goto bailout;
915 	}
916 
917 	returned_bytes = ccb->csio.dxfer_len - ccb->csio.resid;
918 
919 	if (do_hexdump != 0) {
920 		hexdump(&sense, returned_bytes, NULL, 0);
921 	} else {
922 		char path_str[80];
923 		struct sbuf *sb;
924 
925 		cam_path_string(device, path_str, sizeof(path_str));
926 		sb = sbuf_new_auto();
927 		if (sb == NULL) {
928 			warnx("%s: cannot allocate sbuf", __func__);
929 			error = 1;
930 			goto bailout;
931 		}
932 
933 		scsi_sense_only_sbuf(&sense, returned_bytes, sb, path_str,
934 		    &device->inq_data, scsiio_cdb_ptr(&ccb->csio),
935 		    ccb->csio.cdb_len);
936 
937 		sbuf_finish(sb);
938 		printf("%s", sbuf_data(sb));
939 		sbuf_delete(sb);
940 	}
941 bailout:
942 	if (ccb != NULL)
943 		cam_freeccb(ccb);
944 
945 	return (error);
946 }
947 
948 static int
949 testunitready(struct cam_device *device, int task_attr, int retry_count,
950 	      int timeout, int quiet)
951 {
952 	int error = 0;
953 	union ccb *ccb;
954 
955 	ccb = cam_getccb(device);
956 
957 	scsi_test_unit_ready(&ccb->csio,
958 			     /* retries */ retry_count,
959 			     /* cbfcnp */ NULL,
960 			     /* tag_action */ task_attr,
961 			     /* sense_len */ SSD_FULL_SIZE,
962 			     /* timeout */ timeout ? timeout : 5000);
963 
964 	/* Disable freezing the device queue */
965 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
966 
967 	if (arglist & CAM_ARG_ERR_RECOVER)
968 		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
969 
970 	if (cam_send_ccb(device, ccb) < 0) {
971 		if (quiet == 0)
972 			warn("error sending TEST UNIT READY command");
973 		cam_freeccb(ccb);
974 		return (1);
975 	}
976 
977 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP) {
978 		if (quiet == 0)
979 			fprintf(stdout, "Unit is ready\n");
980 	} else {
981 		if (quiet == 0)
982 			fprintf(stdout, "Unit is not ready\n");
983 		error = 1;
984 
985 		if (arglist & CAM_ARG_VERBOSE) {
986 			cam_error_print(device, ccb, CAM_ESF_ALL,
987 					CAM_EPF_ALL, stderr);
988 		}
989 	}
990 
991 	cam_freeccb(ccb);
992 
993 	return (error);
994 }
995 
996 static int
997 scsistart(struct cam_device *device, int startstop, int loadeject,
998 	  int task_attr, int retry_count, int timeout)
999 {
1000 	union ccb *ccb;
1001 	int error = 0;
1002 
1003 	ccb = cam_getccb(device);
1004 
1005 	/*
1006 	 * If we're stopping, send an ordered tag so the drive in question
1007 	 * will finish any previously queued writes before stopping.  If
1008 	 * the device isn't capable of tagged queueing, or if tagged
1009 	 * queueing is turned off, the tag action is a no-op.  We override
1010 	 * the default simple tag, although this also has the effect of
1011 	 * overriding the user's wishes if he wanted to specify a simple
1012 	 * tag.
1013 	 */
1014 	if ((startstop == 0)
1015 	 && (task_attr == MSG_SIMPLE_Q_TAG))
1016 		task_attr = MSG_ORDERED_Q_TAG;
1017 
1018 	scsi_start_stop(&ccb->csio,
1019 			/* retries */ retry_count,
1020 			/* cbfcnp */ NULL,
1021 			/* tag_action */ task_attr,
1022 			/* start/stop */ startstop,
1023 			/* load_eject */ loadeject,
1024 			/* immediate */ 0,
1025 			/* sense_len */ SSD_FULL_SIZE,
1026 			/* timeout */ timeout ? timeout : 120000);
1027 
1028 	/* Disable freezing the device queue */
1029 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
1030 
1031 	if (arglist & CAM_ARG_ERR_RECOVER)
1032 		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
1033 
1034 	if (cam_send_ccb(device, ccb) < 0) {
1035 		warn("error sending START STOP UNIT command");
1036 		cam_freeccb(ccb);
1037 		return (1);
1038 	}
1039 
1040 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP)
1041 		if (startstop) {
1042 			fprintf(stdout, "Unit started successfully");
1043 			if (loadeject)
1044 				fprintf(stdout,", Media loaded\n");
1045 			else
1046 				fprintf(stdout,"\n");
1047 		} else {
1048 			fprintf(stdout, "Unit stopped successfully");
1049 			if (loadeject)
1050 				fprintf(stdout, ", Media ejected\n");
1051 			else
1052 				fprintf(stdout, "\n");
1053 		}
1054 	else {
1055 		error = 1;
1056 		if (startstop)
1057 			fprintf(stdout,
1058 				"Error received from start unit command\n");
1059 		else
1060 			fprintf(stdout,
1061 				"Error received from stop unit command\n");
1062 
1063 		if (arglist & CAM_ARG_VERBOSE) {
1064 			cam_error_print(device, ccb, CAM_ESF_ALL,
1065 					CAM_EPF_ALL, stderr);
1066 		}
1067 	}
1068 
1069 	cam_freeccb(ccb);
1070 
1071 	return (error);
1072 }
1073 
1074 int
1075 scsidoinquiry(struct cam_device *device, int argc, char **argv,
1076 	      char *combinedopt, int task_attr, int retry_count, int timeout)
1077 {
1078 	int c;
1079 	int error = 0;
1080 
1081 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
1082 		switch(c) {
1083 		case 'D':
1084 			arglist |= CAM_ARG_GET_STDINQ;
1085 			break;
1086 		case 'R':
1087 			arglist |= CAM_ARG_GET_XFERRATE;
1088 			break;
1089 		case 'S':
1090 			arglist |= CAM_ARG_GET_SERIAL;
1091 			break;
1092 		default:
1093 			break;
1094 		}
1095 	}
1096 
1097 	/*
1098 	 * If the user didn't specify any inquiry options, he wants all of
1099 	 * them.
1100 	 */
1101 	if ((arglist & CAM_ARG_INQ_MASK) == 0)
1102 		arglist |= CAM_ARG_INQ_MASK;
1103 
1104 	if (arglist & CAM_ARG_GET_STDINQ)
1105 		error = scsiinquiry(device, task_attr, retry_count, timeout);
1106 
1107 	if (error != 0)
1108 		return (error);
1109 
1110 	if (arglist & CAM_ARG_GET_SERIAL)
1111 		scsiserial(device, task_attr, retry_count, timeout);
1112 
1113 	if (arglist & CAM_ARG_GET_XFERRATE)
1114 		error = camxferrate(device);
1115 
1116 	return (error);
1117 }
1118 
1119 static int
1120 scsiinquiry(struct cam_device *device, int task_attr, int retry_count,
1121 	    int timeout)
1122 {
1123 	union ccb *ccb;
1124 	struct scsi_inquiry_data *inq_buf;
1125 	int error = 0;
1126 
1127 	ccb = cam_getccb(device);
1128 
1129 	if (ccb == NULL) {
1130 		warnx("couldn't allocate CCB");
1131 		return (1);
1132 	}
1133 
1134 	inq_buf = (struct scsi_inquiry_data *)malloc(
1135 		sizeof(struct scsi_inquiry_data));
1136 
1137 	if (inq_buf == NULL) {
1138 		cam_freeccb(ccb);
1139 		warnx("can't malloc memory for inquiry\n");
1140 		return (1);
1141 	}
1142 	bzero(inq_buf, sizeof(*inq_buf));
1143 
1144 	/*
1145 	 * Note that although the size of the inquiry buffer is the full
1146 	 * 256 bytes specified in the SCSI spec, we only tell the device
1147 	 * that we have allocated SHORT_INQUIRY_LENGTH bytes.  There are
1148 	 * two reasons for this:
1149 	 *
1150 	 *  - The SCSI spec says that when a length field is only 1 byte,
1151 	 *    a value of 0 will be interpreted as 256.  Therefore
1152 	 *    scsi_inquiry() will convert an inq_len (which is passed in as
1153 	 *    a uint32_t, but the field in the CDB is only 1 byte) of 256
1154 	 *    to 0.  Evidently, very few devices meet the spec in that
1155 	 *    regard.  Some devices, like many Seagate disks, take the 0 as
1156 	 *    0, and don't return any data.  One Pioneer DVD-R drive
1157 	 *    returns more data than the command asked for.
1158 	 *
1159 	 *    So, since there are numerous devices that just don't work
1160 	 *    right with the full inquiry size, we don't send the full size.
1161 	 *
1162 	 *  - The second reason not to use the full inquiry data length is
1163 	 *    that we don't need it here.  The only reason we issue a
1164 	 *    standard inquiry is to get the vendor name, device name,
1165 	 *    and revision so scsi_print_inquiry() can print them.
1166 	 *
1167 	 * If, at some point in the future, more inquiry data is needed for
1168 	 * some reason, this code should use a procedure similar to the
1169 	 * probe code.  i.e., issue a short inquiry, and determine from
1170 	 * the additional length passed back from the device how much
1171 	 * inquiry data the device supports.  Once the amount the device
1172 	 * supports is determined, issue an inquiry for that amount and no
1173 	 * more.
1174 	 *
1175 	 * KDM, 2/18/2000
1176 	 */
1177 	scsi_inquiry(&ccb->csio,
1178 		     /* retries */ retry_count,
1179 		     /* cbfcnp */ NULL,
1180 		     /* tag_action */ task_attr,
1181 		     /* inq_buf */ (uint8_t *)inq_buf,
1182 		     /* inq_len */ SHORT_INQUIRY_LENGTH,
1183 		     /* evpd */ 0,
1184 		     /* page_code */ 0,
1185 		     /* sense_len */ SSD_FULL_SIZE,
1186 		     /* timeout */ timeout ? timeout : 5000);
1187 
1188 	/* Disable freezing the device queue */
1189 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
1190 
1191 	if (arglist & CAM_ARG_ERR_RECOVER)
1192 		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
1193 
1194 	if (cam_send_ccb(device, ccb) < 0) {
1195 		warn("error sending INQUIRY command");
1196 		cam_freeccb(ccb);
1197 		return (1);
1198 	}
1199 
1200 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
1201 		error = 1;
1202 
1203 		if (arglist & CAM_ARG_VERBOSE) {
1204 			cam_error_print(device, ccb, CAM_ESF_ALL,
1205 					CAM_EPF_ALL, stderr);
1206 		}
1207 	}
1208 
1209 	cam_freeccb(ccb);
1210 
1211 	if (error != 0) {
1212 		free(inq_buf);
1213 		return (error);
1214 	}
1215 
1216 	fprintf(stdout, "%s%d: ", device->device_name,
1217 		device->dev_unit_num);
1218 	scsi_print_inquiry(inq_buf);
1219 
1220 	free(inq_buf);
1221 
1222 	return (0);
1223 }
1224 
1225 static int
1226 scsiserial(struct cam_device *device, int task_attr, int retry_count,
1227 	   int timeout)
1228 {
1229 	union ccb *ccb;
1230 	struct scsi_vpd_unit_serial_number *serial_buf;
1231 	char serial_num[SVPD_SERIAL_NUM_SIZE + 1];
1232 	int error = 0;
1233 
1234 	ccb = cam_getccb(device);
1235 
1236 	if (ccb == NULL) {
1237 		warnx("couldn't allocate CCB");
1238 		return (1);
1239 	}
1240 
1241 	serial_buf = (struct scsi_vpd_unit_serial_number *)
1242 		malloc(sizeof(*serial_buf));
1243 
1244 	if (serial_buf == NULL) {
1245 		cam_freeccb(ccb);
1246 		warnx("can't malloc memory for serial number");
1247 		return (1);
1248 	}
1249 
1250 	scsi_inquiry(&ccb->csio,
1251 		     /*retries*/ retry_count,
1252 		     /*cbfcnp*/ NULL,
1253 		     /* tag_action */ task_attr,
1254 		     /* inq_buf */ (uint8_t *)serial_buf,
1255 		     /* inq_len */ sizeof(*serial_buf),
1256 		     /* evpd */ 1,
1257 		     /* page_code */ SVPD_UNIT_SERIAL_NUMBER,
1258 		     /* sense_len */ SSD_FULL_SIZE,
1259 		     /* timeout */ timeout ? timeout : 5000);
1260 
1261 	/* Disable freezing the device queue */
1262 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
1263 
1264 	if (arglist & CAM_ARG_ERR_RECOVER)
1265 		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
1266 
1267 	if (cam_send_ccb(device, ccb) < 0) {
1268 		warn("error sending INQUIRY command");
1269 		cam_freeccb(ccb);
1270 		free(serial_buf);
1271 		return (1);
1272 	}
1273 
1274 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
1275 		error = 1;
1276 
1277 		if (arglist & CAM_ARG_VERBOSE) {
1278 			cam_error_print(device, ccb, CAM_ESF_ALL,
1279 					CAM_EPF_ALL, stderr);
1280 		}
1281 	}
1282 
1283 	cam_freeccb(ccb);
1284 
1285 	if (error != 0) {
1286 		free(serial_buf);
1287 		return (error);
1288 	}
1289 
1290 	bcopy(serial_buf->serial_num, serial_num, serial_buf->length);
1291 	serial_num[serial_buf->length] = '\0';
1292 
1293 	if ((arglist & CAM_ARG_GET_STDINQ)
1294 	 || (arglist & CAM_ARG_GET_XFERRATE))
1295 		fprintf(stdout, "%s%d: Serial Number ",
1296 			device->device_name, device->dev_unit_num);
1297 
1298 	fprintf(stdout, "%.60s\n", serial_num);
1299 
1300 	free(serial_buf);
1301 
1302 	return (0);
1303 }
1304 
1305 int
1306 camxferrate(struct cam_device *device)
1307 {
1308 	struct ccb_pathinq cpi;
1309 	uint32_t freq = 0;
1310 	uint32_t speed = 0;
1311 	union ccb *ccb;
1312 	u_int mb;
1313 	int retval = 0;
1314 
1315 	if ((retval = get_cpi(device, &cpi)) != 0)
1316 		return (1);
1317 
1318 	ccb = cam_getccb(device);
1319 
1320 	if (ccb == NULL) {
1321 		warnx("couldn't allocate CCB");
1322 		return (1);
1323 	}
1324 
1325 	ccb->ccb_h.func_code = XPT_GET_TRAN_SETTINGS;
1326 	ccb->cts.type = CTS_TYPE_CURRENT_SETTINGS;
1327 
1328 	if (((retval = cam_send_ccb(device, ccb)) < 0)
1329 	 || ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP)) {
1330 		const char error_string[] = "error getting transfer settings";
1331 
1332 		if (retval < 0)
1333 			warn(error_string);
1334 		else
1335 			warnx(error_string);
1336 
1337 		if (arglist & CAM_ARG_VERBOSE)
1338 			cam_error_print(device, ccb, CAM_ESF_ALL,
1339 					CAM_EPF_ALL, stderr);
1340 
1341 		retval = 1;
1342 
1343 		goto xferrate_bailout;
1344 
1345 	}
1346 
1347 	speed = cpi.base_transfer_speed;
1348 	freq = 0;
1349 	if (ccb->cts.transport == XPORT_SPI) {
1350 		struct ccb_trans_settings_spi *spi =
1351 		    &ccb->cts.xport_specific.spi;
1352 
1353 		if ((spi->valid & CTS_SPI_VALID_SYNC_RATE) != 0) {
1354 			freq = scsi_calc_syncsrate(spi->sync_period);
1355 			speed = freq;
1356 		}
1357 		if ((spi->valid & CTS_SPI_VALID_BUS_WIDTH) != 0) {
1358 			speed *= (0x01 << spi->bus_width);
1359 		}
1360 	} else if (ccb->cts.transport == XPORT_FC) {
1361 		struct ccb_trans_settings_fc *fc =
1362 		    &ccb->cts.xport_specific.fc;
1363 
1364 		if (fc->valid & CTS_FC_VALID_SPEED)
1365 			speed = fc->bitrate;
1366 	} else if (ccb->cts.transport == XPORT_SAS) {
1367 		struct ccb_trans_settings_sas *sas =
1368 		    &ccb->cts.xport_specific.sas;
1369 
1370 		if (sas->valid & CTS_SAS_VALID_SPEED)
1371 			speed = sas->bitrate;
1372 	} else if (ccb->cts.transport == XPORT_ATA) {
1373 		struct ccb_trans_settings_pata *pata =
1374 		    &ccb->cts.xport_specific.ata;
1375 
1376 		if (pata->valid & CTS_ATA_VALID_MODE)
1377 			speed = ata_mode2speed(pata->mode);
1378 	} else if (ccb->cts.transport == XPORT_SATA) {
1379 		struct	ccb_trans_settings_sata *sata =
1380 		    &ccb->cts.xport_specific.sata;
1381 
1382 		if (sata->valid & CTS_SATA_VALID_REVISION)
1383 			speed = ata_revision2speed(sata->revision);
1384 	}
1385 
1386 	mb = speed / 1000;
1387 	if (mb > 0) {
1388 		fprintf(stdout, "%s%d: %d.%03dMB/s transfers",
1389 			device->device_name, device->dev_unit_num,
1390 			mb, speed % 1000);
1391 	} else {
1392 		fprintf(stdout, "%s%d: %dKB/s transfers",
1393 			device->device_name, device->dev_unit_num,
1394 			speed);
1395 	}
1396 
1397 	if (ccb->cts.transport == XPORT_SPI) {
1398 		struct ccb_trans_settings_spi *spi =
1399 		    &ccb->cts.xport_specific.spi;
1400 
1401 		if (((spi->valid & CTS_SPI_VALID_SYNC_OFFSET) != 0)
1402 		 && (spi->sync_offset != 0))
1403 			fprintf(stdout, " (%d.%03dMHz, offset %d", freq / 1000,
1404 				freq % 1000, spi->sync_offset);
1405 
1406 		if (((spi->valid & CTS_SPI_VALID_BUS_WIDTH) != 0)
1407 		 && (spi->bus_width > 0)) {
1408 			if (((spi->valid & CTS_SPI_VALID_SYNC_OFFSET) != 0)
1409 			 && (spi->sync_offset != 0)) {
1410 				fprintf(stdout, ", ");
1411 			} else {
1412 				fprintf(stdout, " (");
1413 			}
1414 			fprintf(stdout, "%dbit)", 8 * (0x01 << spi->bus_width));
1415 		} else if (((spi->valid & CTS_SPI_VALID_SYNC_OFFSET) != 0)
1416 		 && (spi->sync_offset != 0)) {
1417 			fprintf(stdout, ")");
1418 		}
1419 	} else if (ccb->cts.transport == XPORT_ATA) {
1420 		struct ccb_trans_settings_pata *pata =
1421 		    &ccb->cts.xport_specific.ata;
1422 
1423 		printf(" (");
1424 		if (pata->valid & CTS_ATA_VALID_MODE)
1425 			printf("%s, ", ata_mode2string(pata->mode));
1426 		if ((pata->valid & CTS_ATA_VALID_ATAPI) && pata->atapi != 0)
1427 			printf("ATAPI %dbytes, ", pata->atapi);
1428 		if (pata->valid & CTS_ATA_VALID_BYTECOUNT)
1429 			printf("PIO %dbytes", pata->bytecount);
1430 		printf(")");
1431 	} else if (ccb->cts.transport == XPORT_SATA) {
1432 		struct ccb_trans_settings_sata *sata =
1433 		    &ccb->cts.xport_specific.sata;
1434 
1435 		printf(" (");
1436 		if (sata->valid & CTS_SATA_VALID_REVISION)
1437 			printf("SATA %d.x, ", sata->revision);
1438 		else
1439 			printf("SATA, ");
1440 		if (sata->valid & CTS_SATA_VALID_MODE)
1441 			printf("%s, ", ata_mode2string(sata->mode));
1442 		if ((sata->valid & CTS_SATA_VALID_ATAPI) && sata->atapi != 0)
1443 			printf("ATAPI %dbytes, ", sata->atapi);
1444 		if (sata->valid & CTS_SATA_VALID_BYTECOUNT)
1445 			printf("PIO %dbytes", sata->bytecount);
1446 		printf(")");
1447 	}
1448 
1449 	if (ccb->cts.protocol == PROTO_SCSI) {
1450 		struct ccb_trans_settings_scsi *scsi =
1451 		    &ccb->cts.proto_specific.scsi;
1452 		if (scsi->valid & CTS_SCSI_VALID_TQ) {
1453 			if (scsi->flags & CTS_SCSI_FLAGS_TAG_ENB) {
1454 				fprintf(stdout, ", Command Queueing Enabled");
1455 			}
1456 		}
1457 	}
1458 
1459 	fprintf(stdout, "\n");
1460 
1461 xferrate_bailout:
1462 
1463 	cam_freeccb(ccb);
1464 
1465 	return (retval);
1466 }
1467 
1468 static void
1469 atahpa_print(struct ata_params *parm, u_int64_t hpasize, int header)
1470 {
1471 	uint32_t lbasize = (uint32_t)parm->lba_size_1 |
1472 				((uint32_t)parm->lba_size_2 << 16);
1473 
1474 	u_int64_t lbasize48 = ((u_int64_t)parm->lba_size48_1) |
1475 				((u_int64_t)parm->lba_size48_2 << 16) |
1476 				((u_int64_t)parm->lba_size48_3 << 32) |
1477 				((u_int64_t)parm->lba_size48_4 << 48);
1478 
1479 	if (header) {
1480 		printf("\nFeature                      "
1481 		       "Support  Enabled   Value\n");
1482 	}
1483 
1484 	printf("Host Protected Area (HPA)      ");
1485 	if (parm->support.command1 & ATA_SUPPORT_PROTECTED) {
1486 		u_int64_t lba = lbasize48 ? lbasize48 : lbasize;
1487 		printf("yes      %s     %ju/%ju\n", (hpasize > lba) ? "yes" : "no ",
1488 			lba, hpasize);
1489 
1490 		printf("HPA - Security                 ");
1491 		if (parm->support.command2 & ATA_SUPPORT_MAXSECURITY)
1492 			printf("yes      %s\n", (parm->enabled.command2 &
1493 			    ATA_SUPPORT_MAXSECURITY) ? "yes" : "no ");
1494 		else
1495 			printf("no\n");
1496 	} else {
1497 		printf("no\n");
1498 	}
1499 }
1500 
1501 static void
1502 ataama_print(struct ata_params *parm, u_int64_t nativesize, int header)
1503 {
1504 	uint32_t lbasize = (uint32_t)parm->lba_size_1 |
1505 				((uint32_t)parm->lba_size_2 << 16);
1506 
1507 	u_int64_t lbasize48 = ((u_int64_t)parm->lba_size48_1) |
1508 				((u_int64_t)parm->lba_size48_2 << 16) |
1509 				((u_int64_t)parm->lba_size48_3 << 32) |
1510 				((u_int64_t)parm->lba_size48_4 << 48);
1511 
1512 	if (header) {
1513 		printf("\nFeature                      "
1514 		       "Support  Enabled   Value\n");
1515 	}
1516 
1517 	printf("Accessible Max Address Config  ");
1518 	if (parm->support2 & ATA_SUPPORT_AMAX_ADDR) {
1519 		u_int64_t lba = lbasize48 ? lbasize48 : lbasize;
1520 		printf("yes      %s     %ju/%ju\n",
1521 		    (nativesize > lba) ? "yes" : "no ", lba, nativesize);
1522 	} else {
1523 		printf("no\n");
1524 	}
1525 }
1526 
1527 static int
1528 atasata(struct ata_params *parm)
1529 {
1530 
1531 
1532 	if (parm->satacapabilities != 0xffff &&
1533 	    parm->satacapabilities != 0x0000)
1534 		return 1;
1535 
1536 	return 0;
1537 }
1538 
1539 static void
1540 atacapprint(struct ata_params *parm)
1541 {
1542 	const char *proto;
1543 	uint32_t lbasize = (uint32_t)parm->lba_size_1 |
1544 				((uint32_t)parm->lba_size_2 << 16);
1545 
1546 	u_int64_t lbasize48 = ((u_int64_t)parm->lba_size48_1) |
1547 				((u_int64_t)parm->lba_size48_2 << 16) |
1548 				((u_int64_t)parm->lba_size48_3 << 32) |
1549 				((u_int64_t)parm->lba_size48_4 << 48);
1550 
1551 	printf("\n");
1552 	printf("protocol              ");
1553 	proto = (parm->config == ATA_PROTO_CFA) ? "CFA" :
1554 		(parm->config & ATA_PROTO_ATAPI) ? "ATAPI" : "ATA";
1555 	if (ata_version(parm->version_major) == 0) {
1556 		printf("%s", proto);
1557 	} else if (ata_version(parm->version_major) <= 7) {
1558 		printf("%s-%d", proto,
1559 		    ata_version(parm->version_major));
1560 	} else if (ata_version(parm->version_major) == 8) {
1561 		printf("%s8-ACS", proto);
1562 	} else {
1563 		printf("ACS-%d %s",
1564 		    ata_version(parm->version_major) - 7, proto);
1565 	}
1566 	if (parm->satacapabilities && parm->satacapabilities != 0xffff) {
1567 		if (parm->satacapabilities & ATA_SATA_GEN3)
1568 			printf(" SATA 3.x\n");
1569 		else if (parm->satacapabilities & ATA_SATA_GEN2)
1570 			printf(" SATA 2.x\n");
1571 		else if (parm->satacapabilities & ATA_SATA_GEN1)
1572 			printf(" SATA 1.x\n");
1573 		else
1574 			printf(" SATA\n");
1575 	}
1576 	else
1577 		printf("\n");
1578 	printf("device model          %.40s\n", parm->model);
1579 	printf("firmware revision     %.8s\n", parm->revision);
1580 	printf("serial number         %.20s\n", parm->serial);
1581 	if (parm->enabled.extension & ATA_SUPPORT_64BITWWN) {
1582 		printf("WWN                   %04x%04x%04x%04x\n",
1583 		    parm->wwn[0], parm->wwn[1], parm->wwn[2], parm->wwn[3]);
1584 	}
1585 	printf("additional product id %.8s\n", parm->product_id);
1586 	if (parm->enabled.extension & ATA_SUPPORT_MEDIASN) {
1587 		printf("media serial number   %.30s\n",
1588 		    parm->media_serial);
1589 	}
1590 
1591 	printf("cylinders             %d\n", parm->cylinders);
1592 	printf("heads                 %d\n", parm->heads);
1593 	printf("sectors/track         %d\n", parm->sectors);
1594 	printf("sector size           logical %u, physical %lu, offset %lu\n",
1595 	    ata_logical_sector_size(parm),
1596 	    (unsigned long)ata_physical_sector_size(parm),
1597 	    (unsigned long)ata_logical_sector_offset(parm));
1598 
1599 	if (parm->config == ATA_PROTO_CFA ||
1600 	    (parm->support.command2 & ATA_SUPPORT_CFA))
1601 		printf("CFA supported\n");
1602 
1603 	printf("LBA%ssupported         ",
1604 		parm->capabilities1 & ATA_SUPPORT_LBA ? " " : " not ");
1605 	if (lbasize)
1606 		printf("%d sectors\n", lbasize);
1607 	else
1608 		printf("\n");
1609 
1610 	printf("LBA48%ssupported       ",
1611 		parm->support.command2 & ATA_SUPPORT_ADDRESS48 ? " " : " not ");
1612 	if (lbasize48)
1613 		printf("%ju sectors\n", (uintmax_t)lbasize48);
1614 	else
1615 		printf("\n");
1616 
1617 	printf("PIO supported         PIO");
1618 	switch (ata_max_pmode(parm)) {
1619 	case ATA_PIO4:
1620 		printf("4");
1621 		break;
1622 	case ATA_PIO3:
1623 		printf("3");
1624 		break;
1625 	case ATA_PIO2:
1626 		printf("2");
1627 		break;
1628 	case ATA_PIO1:
1629 		printf("1");
1630 		break;
1631 	default:
1632 		printf("0");
1633 	}
1634 	if ((parm->capabilities1 & ATA_SUPPORT_IORDY) == 0)
1635 		printf(" w/o IORDY");
1636 	printf("\n");
1637 
1638 	printf("DMA%ssupported         ",
1639 		parm->capabilities1 & ATA_SUPPORT_DMA ? " " : " not ");
1640 	if (parm->capabilities1 & ATA_SUPPORT_DMA) {
1641 		if (parm->mwdmamodes & 0xff) {
1642 			printf("WDMA");
1643 			if (parm->mwdmamodes & 0x04)
1644 				printf("2");
1645 			else if (parm->mwdmamodes & 0x02)
1646 				printf("1");
1647 			else if (parm->mwdmamodes & 0x01)
1648 				printf("0");
1649 			printf(" ");
1650 		}
1651 		if ((parm->atavalid & ATA_FLAG_88) &&
1652 		    (parm->udmamodes & 0xff)) {
1653 			printf("UDMA");
1654 			if (parm->udmamodes & 0x40)
1655 				printf("6");
1656 			else if (parm->udmamodes & 0x20)
1657 				printf("5");
1658 			else if (parm->udmamodes & 0x10)
1659 				printf("4");
1660 			else if (parm->udmamodes & 0x08)
1661 				printf("3");
1662 			else if (parm->udmamodes & 0x04)
1663 				printf("2");
1664 			else if (parm->udmamodes & 0x02)
1665 				printf("1");
1666 			else if (parm->udmamodes & 0x01)
1667 				printf("0");
1668 			printf(" ");
1669 		}
1670 	}
1671 	printf("\n");
1672 
1673 	if (parm->media_rotation_rate == 1) {
1674 		printf("media RPM             non-rotating\n");
1675 	} else if (parm->media_rotation_rate >= 0x0401 &&
1676 	    parm->media_rotation_rate <= 0xFFFE) {
1677 		printf("media RPM             %d\n",
1678 			parm->media_rotation_rate);
1679 	}
1680 
1681 	printf("Zoned-Device Commands ");
1682 	switch (parm->support3 & ATA_SUPPORT_ZONE_MASK) {
1683 		case ATA_SUPPORT_ZONE_DEV_MANAGED:
1684 			printf("device managed\n");
1685 			break;
1686 		case ATA_SUPPORT_ZONE_HOST_AWARE:
1687 			printf("host aware\n");
1688 			break;
1689 		default:
1690 			printf("no\n");
1691 	}
1692 
1693 	printf("\nFeature                      "
1694 		"Support  Enabled   Value           Vendor\n");
1695 	printf("read ahead                     %s	%s\n",
1696 		parm->support.command1 & ATA_SUPPORT_LOOKAHEAD ? "yes" : "no",
1697 		parm->enabled.command1 & ATA_SUPPORT_LOOKAHEAD ? "yes" : "no");
1698 	printf("write cache                    %s	%s\n",
1699 		parm->support.command1 & ATA_SUPPORT_WRITECACHE ? "yes" : "no",
1700 		parm->enabled.command1 & ATA_SUPPORT_WRITECACHE ? "yes" : "no");
1701 	printf("flush cache                    %s	%s\n",
1702 		parm->support.command2 & ATA_SUPPORT_FLUSHCACHE ? "yes" : "no",
1703 		parm->enabled.command2 & ATA_SUPPORT_FLUSHCACHE ? "yes" : "no");
1704 	printf("Native Command Queuing (NCQ)   ");
1705 	if (atasata(parm) && (parm->satacapabilities & ATA_SUPPORT_NCQ)) {
1706 		printf("yes		%d tags\n",
1707 		    ATA_QUEUE_LEN(parm->queue) + 1);
1708 		printf("NCQ Priority Information       %s\n",
1709 		    parm->satacapabilities & ATA_SUPPORT_NCQ_PRIO ?
1710 		    "yes" : "no");
1711 		printf("NCQ Non-Data Command           %s\n",
1712 		    parm->satacapabilities2 & ATA_SUPPORT_NCQ_NON_DATA ?
1713 		    "yes" : "no");
1714 		printf("NCQ Streaming                  %s\n",
1715 		    parm->satacapabilities2 & ATA_SUPPORT_NCQ_STREAM ?
1716 		    "yes" : "no");
1717 		printf("Receive & Send FPDMA Queued    %s\n",
1718 		    parm->satacapabilities2 & ATA_SUPPORT_RCVSND_FPDMA_QUEUED ?
1719 		    "yes" : "no");
1720 		printf("NCQ Autosense                  %s\n",
1721 		    parm->satasupport & ATA_SUPPORT_NCQ_AUTOSENSE ?
1722 		    "yes" : "no");
1723 	} else
1724 		printf("no\n");
1725 
1726 	printf("SMART                          %s	%s\n",
1727 		parm->support.command1 & ATA_SUPPORT_SMART ? "yes" : "no",
1728 		parm->enabled.command1 & ATA_SUPPORT_SMART ? "yes" : "no");
1729 	printf("security                       %s	%s\n",
1730 		parm->support.command1 & ATA_SUPPORT_SECURITY ? "yes" : "no",
1731 		parm->enabled.command1 & ATA_SUPPORT_SECURITY ? "yes" : "no");
1732 	printf("power management               %s	%s\n",
1733 		parm->support.command1 & ATA_SUPPORT_POWERMGT ? "yes" : "no",
1734 		parm->enabled.command1 & ATA_SUPPORT_POWERMGT ? "yes" : "no");
1735 	printf("microcode download             %s	%s\n",
1736 		parm->support.command2 & ATA_SUPPORT_MICROCODE ? "yes" : "no",
1737 		parm->enabled.command2 & ATA_SUPPORT_MICROCODE ? "yes" : "no");
1738 	printf("advanced power management      %s	%s",
1739 		parm->support.command2 & ATA_SUPPORT_APM ? "yes" : "no",
1740 		parm->enabled.command2 & ATA_SUPPORT_APM ? "yes" : "no");
1741 		if (parm->support.command2 & ATA_SUPPORT_APM) {
1742 			printf("	%d/0x%02X\n",
1743 			    parm->apm_value & 0xff, parm->apm_value & 0xff);
1744 		} else
1745 			printf("\n");
1746 	printf("automatic acoustic management  %s	%s",
1747 		parm->support.command2 & ATA_SUPPORT_AUTOACOUSTIC ? "yes" :"no",
1748 		parm->enabled.command2 & ATA_SUPPORT_AUTOACOUSTIC ? "yes" :"no");
1749 		if (parm->support.command2 & ATA_SUPPORT_AUTOACOUSTIC) {
1750 			printf("	%d/0x%02X	%d/0x%02X\n",
1751 			    ATA_ACOUSTIC_CURRENT(parm->acoustic),
1752 			    ATA_ACOUSTIC_CURRENT(parm->acoustic),
1753 			    ATA_ACOUSTIC_VENDOR(parm->acoustic),
1754 			    ATA_ACOUSTIC_VENDOR(parm->acoustic));
1755 		} else
1756 			printf("\n");
1757 	printf("media status notification      %s	%s\n",
1758 		parm->support.command2 & ATA_SUPPORT_NOTIFY ? "yes" : "no",
1759 		parm->enabled.command2 & ATA_SUPPORT_NOTIFY ? "yes" : "no");
1760 	printf("power-up in Standby            %s	%s\n",
1761 		parm->support.command2 & ATA_SUPPORT_STANDBY ? "yes" : "no",
1762 		parm->enabled.command2 & ATA_SUPPORT_STANDBY ? "yes" : "no");
1763 	printf("write-read-verify              %s	%s",
1764 		parm->support2 & ATA_SUPPORT_WRITEREADVERIFY ? "yes" : "no",
1765 		parm->enabled2 & ATA_SUPPORT_WRITEREADVERIFY ? "yes" : "no");
1766 		if (parm->support2 & ATA_SUPPORT_WRITEREADVERIFY) {
1767 			printf("	%d/0x%x\n",
1768 			    parm->wrv_mode, parm->wrv_mode);
1769 		} else
1770 			printf("\n");
1771 	printf("unload                         %s	%s\n",
1772 		parm->support.extension & ATA_SUPPORT_UNLOAD ? "yes" : "no",
1773 		parm->enabled.extension & ATA_SUPPORT_UNLOAD ? "yes" : "no");
1774 	printf("general purpose logging        %s	%s\n",
1775 		parm->support.extension & ATA_SUPPORT_GENLOG ? "yes" : "no",
1776 		parm->enabled.extension & ATA_SUPPORT_GENLOG ? "yes" : "no");
1777 	printf("free-fall                      %s	%s\n",
1778 		parm->support2 & ATA_SUPPORT_FREEFALL ? "yes" : "no",
1779 		parm->enabled2 & ATA_SUPPORT_FREEFALL ? "yes" : "no");
1780 	printf("sense data reporting           %s	%s\n",
1781 		parm->support2 & ATA_SUPPORT_SENSE_REPORT ? "yes" : "no",
1782 		parm->enabled2 & ATA_SUPPORT_SENSE_REPORT ? "yes" : "no");
1783 	printf("extended power conditions      %s	%s\n",
1784 		parm->support2 & ATA_SUPPORT_EPC ? "yes" : "no",
1785 		parm->enabled2 & ATA_SUPPORT_EPC ? "yes" : "no");
1786 	printf("device statistics notification %s	%s\n",
1787 		parm->support2 & ATA_SUPPORT_DSN ? "yes" : "no",
1788 		parm->enabled2 & ATA_SUPPORT_DSN ? "yes" : "no");
1789 	printf("Data Set Management (DSM/TRIM) ");
1790 	if (parm->support_dsm & ATA_SUPPORT_DSM_TRIM) {
1791 		printf("yes\n");
1792 		printf("DSM - max 512byte blocks       ");
1793 		if (parm->max_dsm_blocks == 0x00)
1794 			printf("yes              not specified\n");
1795 		else
1796 			printf("yes              %d\n",
1797 				parm->max_dsm_blocks);
1798 
1799 		printf("DSM - deterministic read       ");
1800 		if (parm->support3 & ATA_SUPPORT_DRAT) {
1801 			if (parm->support3 & ATA_SUPPORT_RZAT)
1802 				printf("yes              zeroed\n");
1803 			else
1804 				printf("yes              any value\n");
1805 		} else {
1806 			printf("no\n");
1807 		}
1808 	} else {
1809 		printf("no\n");
1810 	}
1811 	printf("Trusted Computing              %s\n",
1812 	    ((parm->tcg & 0xc000) == 0x4000) && (parm->tcg & ATA_SUPPORT_TCG) ?
1813 	    "yes" : "no");
1814 	printf("encrypts all user data         %s\n",
1815 		parm->support3 & ATA_ENCRYPTS_ALL_USER_DATA ? "yes" : "no");
1816 	printf("Sanitize                       ");
1817 	if (parm->multi & ATA_SUPPORT_SANITIZE) {
1818 		printf("yes\t\t%s%s%s\n",
1819 		    parm->multi & ATA_SUPPORT_BLOCK_ERASE_EXT ? "block, " : "",
1820 		    parm->multi & ATA_SUPPORT_OVERWRITE_EXT ? "overwrite, " : "",
1821 		    parm->multi & ATA_SUPPORT_CRYPTO_SCRAMBLE_EXT ? "crypto" : "");
1822 		printf("Sanitize - commands allowed    %s\n",
1823 		    parm->multi & ATA_SUPPORT_SANITIZE_ALLOWED ? "yes" : "no");
1824 		printf("Sanitize - antifreeze lock     %s\n",
1825 		    parm->multi & ATA_SUPPORT_ANTIFREEZE_LOCK_EXT ? "yes" : "no");
1826 	} else {
1827 		printf("no\n");
1828 	}
1829 }
1830 
1831 static int
1832 scsi_cam_pass_16_send(struct cam_device *device, union ccb *ccb)
1833 {
1834 	struct ata_pass_16 *ata_pass_16;
1835 	struct ata_cmd ata_cmd;
1836 
1837 	ata_pass_16 = (struct ata_pass_16 *)ccb->csio.cdb_io.cdb_bytes;
1838 	ata_cmd.command = ata_pass_16->command;
1839 	ata_cmd.control = ata_pass_16->control;
1840 	ata_cmd.features = ata_pass_16->features;
1841 
1842 	if (arglist & CAM_ARG_VERBOSE) {
1843 		warnx("sending ATA %s via pass_16 with timeout of %u msecs",
1844 		      ata_op_string(&ata_cmd),
1845 		      ccb->csio.ccb_h.timeout);
1846 	}
1847 
1848 	/* Disable freezing the device queue */
1849 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
1850 
1851 	if (arglist & CAM_ARG_ERR_RECOVER)
1852 		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
1853 
1854 	if (cam_send_ccb(device, ccb) < 0) {
1855 		warn("error sending ATA %s via pass_16", ata_op_string(&ata_cmd));
1856 		return (1);
1857 	}
1858 
1859 	/*
1860 	 * Consider any non-CAM_REQ_CMP status as error and report it here,
1861 	 * unless caller set AP_FLAG_CHK_COND, in which case it is responsible.
1862 	 */
1863 	if (!(ata_pass_16->flags & AP_FLAG_CHK_COND) &&
1864 	    (ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
1865 		warnx("ATA %s via pass_16 failed", ata_op_string(&ata_cmd));
1866 		if (arglist & CAM_ARG_VERBOSE) {
1867 			cam_error_print(device, ccb, CAM_ESF_ALL,
1868 					CAM_EPF_ALL, stderr);
1869 		}
1870 		return (1);
1871 	}
1872 
1873 	return (0);
1874 }
1875 
1876 
1877 static int
1878 ata_cam_send(struct cam_device *device, union ccb *ccb)
1879 {
1880 	if (arglist & CAM_ARG_VERBOSE) {
1881 		warnx("sending ATA %s with timeout of %u msecs",
1882 		      ata_op_string(&(ccb->ataio.cmd)),
1883 		      ccb->ataio.ccb_h.timeout);
1884 	}
1885 
1886 	/* Disable freezing the device queue */
1887 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
1888 
1889 	if (arglist & CAM_ARG_ERR_RECOVER)
1890 		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
1891 
1892 	if (cam_send_ccb(device, ccb) < 0) {
1893 		warn("error sending ATA %s", ata_op_string(&(ccb->ataio.cmd)));
1894 		return (1);
1895 	}
1896 
1897 	/*
1898 	 * Consider any non-CAM_REQ_CMP status as error and report it here,
1899 	 * unless caller set AP_FLAG_CHK_COND, in which case it is responsible.
1900 	 */
1901 	if (!(ccb->ataio.cmd.flags & CAM_ATAIO_NEEDRESULT) &&
1902 	    (ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
1903 		warnx("ATA %s failed", ata_op_string(&(ccb->ataio.cmd)));
1904 		if (arglist & CAM_ARG_VERBOSE) {
1905 			cam_error_print(device, ccb, CAM_ESF_ALL,
1906 					CAM_EPF_ALL, stderr);
1907 		}
1908 		return (1);
1909 	}
1910 
1911 	return (0);
1912 }
1913 
1914 static int
1915 ata_do_pass_16(struct cam_device *device, union ccb *ccb, int retries,
1916 	       uint32_t flags, uint8_t protocol, uint8_t ata_flags,
1917 	       uint8_t tag_action, uint8_t command, uint16_t features,
1918 	       u_int64_t lba, uint16_t sector_count, uint8_t *data_ptr,
1919 	       uint16_t dxfer_len, int timeout)
1920 {
1921 	if (data_ptr != NULL) {
1922 		if (flags & CAM_DIR_OUT)
1923 			ata_flags |= AP_FLAG_TDIR_TO_DEV;
1924 		else
1925 			ata_flags |= AP_FLAG_TDIR_FROM_DEV;
1926 	} else {
1927 		ata_flags |= AP_FLAG_TLEN_NO_DATA;
1928 	}
1929 
1930 	CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
1931 
1932 	scsi_ata_pass_16(&ccb->csio,
1933 			 retries,
1934 			 NULL,
1935 			 flags,
1936 			 tag_action,
1937 			 protocol,
1938 			 ata_flags,
1939 			 features,
1940 			 sector_count,
1941 			 lba,
1942 			 command,
1943 			 /*control*/0,
1944 			 data_ptr,
1945 			 dxfer_len,
1946 			 /*sense_len*/SSD_FULL_SIZE,
1947 			 timeout);
1948 
1949 	return scsi_cam_pass_16_send(device, ccb);
1950 }
1951 
1952 static int
1953 ata_try_pass_16(struct cam_device *device)
1954 {
1955 	struct ccb_pathinq cpi;
1956 
1957 	if (get_cpi(device, &cpi) != 0) {
1958 		warnx("couldn't get CPI");
1959 		return (-1);
1960 	}
1961 
1962 	if (cpi.protocol == PROTO_SCSI) {
1963 		/* possibly compatible with pass_16 */
1964 		return (1);
1965 	}
1966 
1967 	/* likely not compatible with pass_16 */
1968 	return (0);
1969 }
1970 
1971 static int
1972 ata_do_cmd(struct cam_device *device, union ccb *ccb, int retries,
1973 	   uint32_t flags, uint8_t protocol, uint8_t ata_flags,
1974 	   uint8_t tag_action, uint8_t command, uint16_t features,
1975 	   u_int64_t lba, uint16_t sector_count, uint8_t *data_ptr,
1976 	   uint16_t dxfer_len, int timeout, int force48bit)
1977 {
1978 	int retval;
1979 
1980 	retval = ata_try_pass_16(device);
1981 	if (retval == -1)
1982 		return (1);
1983 
1984 	if (retval == 1) {
1985 		return (ata_do_pass_16(device, ccb, retries, flags, protocol,
1986 				      ata_flags, tag_action, command, features,
1987 				      lba, sector_count, data_ptr, dxfer_len,
1988 				      timeout));
1989 	}
1990 
1991 	CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->ataio);
1992 	cam_fill_ataio(&ccb->ataio,
1993 		       retries,
1994 		       NULL,
1995 		       flags,
1996 		       tag_action,
1997 		       data_ptr,
1998 		       dxfer_len,
1999 		       timeout);
2000 
2001 	if (force48bit || lba > ATA_MAX_28BIT_LBA)
2002 		ata_48bit_cmd(&ccb->ataio, command, features, lba, sector_count);
2003 	else
2004 		ata_28bit_cmd(&ccb->ataio, command, features, lba, sector_count);
2005 
2006 	if (ata_flags & AP_FLAG_CHK_COND)
2007 		ccb->ataio.cmd.flags |= CAM_ATAIO_NEEDRESULT;
2008 
2009 	return ata_cam_send(device, ccb);
2010 }
2011 
2012 static void
2013 dump_data(uint16_t *ptr, uint32_t len)
2014 {
2015 	u_int i;
2016 
2017 	for (i = 0; i < len / 2; i++) {
2018 		if ((i % 8) == 0)
2019 			printf(" %3d: ", i);
2020 		printf("%04hx ", ptr[i]);
2021 		if ((i % 8) == 7)
2022 			printf("\n");
2023 	}
2024 	if ((i % 8) != 7)
2025 		printf("\n");
2026 }
2027 
2028 static int
2029 atahpa_proc_resp(struct cam_device *device, union ccb *ccb, u_int64_t *hpasize)
2030 {
2031 	uint8_t error = 0, ata_device = 0, status = 0;
2032 	uint16_t count = 0;
2033 	uint64_t lba = 0;
2034 	int retval;
2035 
2036 	retval = get_ata_status(device, ccb, &error, &count, &lba, &ata_device,
2037 	    &status);
2038 	if (retval == 1) {
2039 		if (arglist & CAM_ARG_VERBOSE) {
2040 			cam_error_print(device, ccb, CAM_ESF_ALL,
2041 					CAM_EPF_ALL, stderr);
2042 		}
2043 		warnx("Can't get ATA command status");
2044 		return (retval);
2045 	}
2046 
2047 	if (status & ATA_STATUS_ERROR) {
2048 		if (arglist & CAM_ARG_VERBOSE) {
2049 			cam_error_print(device, ccb, CAM_ESF_ALL,
2050 					CAM_EPF_ALL, stderr);
2051 		}
2052 
2053 		if (error & ATA_ERROR_ID_NOT_FOUND) {
2054 			warnx("Max address has already been set since "
2055 			      "last power-on or hardware reset");
2056 		} else if (hpasize == NULL)
2057 			warnx("Command failed with ATA error");
2058 
2059 		return (1);
2060 	}
2061 
2062 	if (hpasize != NULL) {
2063 		if (retval == 2 || retval == 6)
2064 			return (1);
2065 		*hpasize = lba + 1;
2066 	}
2067 
2068 	return (0);
2069 }
2070 
2071 static int
2072 ata_read_native_max(struct cam_device *device, int retry_count,
2073 		      uint32_t timeout, union ccb *ccb,
2074 		      struct ata_params *parm, u_int64_t *hpasize)
2075 {
2076 	int error;
2077 	u_int cmd, is48bit;
2078 	uint8_t protocol;
2079 
2080 	is48bit = parm->support.command2 & ATA_SUPPORT_ADDRESS48;
2081 	protocol = AP_PROTO_NON_DATA;
2082 
2083 	if (is48bit) {
2084 		cmd = ATA_READ_NATIVE_MAX_ADDRESS48;
2085 		protocol |= AP_EXTEND;
2086 	} else {
2087 		cmd = ATA_READ_NATIVE_MAX_ADDRESS;
2088 	}
2089 
2090 	error = ata_do_cmd(device,
2091 			   ccb,
2092 			   retry_count,
2093 			   /*flags*/CAM_DIR_NONE,
2094 			   /*protocol*/protocol,
2095 			   /*ata_flags*/AP_FLAG_CHK_COND,
2096 			   /*tag_action*/MSG_SIMPLE_Q_TAG,
2097 			   /*command*/cmd,
2098 			   /*features*/0,
2099 			   /*lba*/0,
2100 			   /*sector_count*/0,
2101 			   /*data_ptr*/NULL,
2102 			   /*dxfer_len*/0,
2103 			   timeout ? timeout : 5000,
2104 			   is48bit);
2105 
2106 	if (error)
2107 		return (error);
2108 
2109 	return atahpa_proc_resp(device, ccb, hpasize);
2110 }
2111 
2112 static int
2113 atahpa_set_max(struct cam_device *device, int retry_count,
2114 	      uint32_t timeout, union ccb *ccb,
2115 	      int is48bit, u_int64_t maxsize, int persist)
2116 {
2117 	int error;
2118 	u_int cmd;
2119 	uint8_t protocol;
2120 
2121 	protocol = AP_PROTO_NON_DATA;
2122 
2123 	if (is48bit) {
2124 		cmd = ATA_SET_MAX_ADDRESS48;
2125 		protocol |= AP_EXTEND;
2126 	} else {
2127 		cmd = ATA_SET_MAX_ADDRESS;
2128 	}
2129 
2130 	/* lba's are zero indexed so the max lba is requested max - 1 */
2131 	if (maxsize)
2132 		maxsize--;
2133 
2134 	error = ata_do_cmd(device,
2135 			   ccb,
2136 			   retry_count,
2137 			   /*flags*/CAM_DIR_NONE,
2138 			   /*protocol*/protocol,
2139 			   /*ata_flags*/AP_FLAG_CHK_COND,
2140 			   /*tag_action*/MSG_SIMPLE_Q_TAG,
2141 			   /*command*/cmd,
2142 			   /*features*/ATA_HPA_FEAT_MAX_ADDR,
2143 			   /*lba*/maxsize,
2144 			   /*sector_count*/persist,
2145 			   /*data_ptr*/NULL,
2146 			   /*dxfer_len*/0,
2147 			   timeout ? timeout : 1000,
2148 			   is48bit);
2149 
2150 	if (error)
2151 		return (error);
2152 
2153 	return atahpa_proc_resp(device, ccb, NULL);
2154 }
2155 
2156 static int
2157 atahpa_password(struct cam_device *device, int retry_count,
2158 		uint32_t timeout, union ccb *ccb,
2159 		int is48bit, struct ata_set_max_pwd *pwd)
2160 {
2161 	u_int cmd;
2162 	uint8_t protocol;
2163 
2164 	protocol = AP_PROTO_PIO_OUT;
2165 	cmd = (is48bit) ? ATA_SET_MAX_ADDRESS48 : ATA_SET_MAX_ADDRESS;
2166 
2167 	return (ata_do_cmd(device,
2168 			   ccb,
2169 			   retry_count,
2170 			   /*flags*/CAM_DIR_OUT,
2171 			   /*protocol*/protocol,
2172 			   /*ata_flags*/AP_FLAG_BYT_BLOK_BLOCKS |
2173 			    AP_FLAG_TLEN_SECT_CNT,
2174 			   /*tag_action*/MSG_SIMPLE_Q_TAG,
2175 			   /*command*/cmd,
2176 			   /*features*/ATA_HPA_FEAT_SET_PWD,
2177 			   /*lba*/0,
2178 			   /*sector_count*/sizeof(*pwd) / 512,
2179 			   /*data_ptr*/(uint8_t*)pwd,
2180 			   /*dxfer_len*/sizeof(*pwd),
2181 			   timeout ? timeout : 1000,
2182 			   is48bit));
2183 }
2184 
2185 static int
2186 atahpa_lock(struct cam_device *device, int retry_count,
2187 	    uint32_t timeout, union ccb *ccb, int is48bit)
2188 {
2189 	u_int cmd;
2190 	uint8_t protocol;
2191 
2192 	protocol = AP_PROTO_NON_DATA;
2193 	cmd = (is48bit) ? ATA_SET_MAX_ADDRESS48 : ATA_SET_MAX_ADDRESS;
2194 
2195 	return (ata_do_cmd(device,
2196 			   ccb,
2197 			   retry_count,
2198 			   /*flags*/CAM_DIR_NONE,
2199 			   /*protocol*/protocol,
2200 			   /*ata_flags*/0,
2201 			   /*tag_action*/MSG_SIMPLE_Q_TAG,
2202 			   /*command*/cmd,
2203 			   /*features*/ATA_HPA_FEAT_LOCK,
2204 			   /*lba*/0,
2205 			   /*sector_count*/0,
2206 			   /*data_ptr*/NULL,
2207 			   /*dxfer_len*/0,
2208 			   timeout ? timeout : 1000,
2209 			   is48bit));
2210 }
2211 
2212 static int
2213 atahpa_unlock(struct cam_device *device, int retry_count,
2214 	      uint32_t timeout, union ccb *ccb,
2215 	      int is48bit, struct ata_set_max_pwd *pwd)
2216 {
2217 	u_int cmd;
2218 	uint8_t protocol;
2219 
2220 	protocol = AP_PROTO_PIO_OUT;
2221 	cmd = (is48bit) ? ATA_SET_MAX_ADDRESS48 : ATA_SET_MAX_ADDRESS;
2222 
2223 	return (ata_do_cmd(device,
2224 			   ccb,
2225 			   retry_count,
2226 			   /*flags*/CAM_DIR_OUT,
2227 			   /*protocol*/protocol,
2228 			   /*ata_flags*/AP_FLAG_BYT_BLOK_BLOCKS |
2229 			    AP_FLAG_TLEN_SECT_CNT,
2230 			   /*tag_action*/MSG_SIMPLE_Q_TAG,
2231 			   /*command*/cmd,
2232 			   /*features*/ATA_HPA_FEAT_UNLOCK,
2233 			   /*lba*/0,
2234 			   /*sector_count*/sizeof(*pwd) / 512,
2235 			   /*data_ptr*/(uint8_t*)pwd,
2236 			   /*dxfer_len*/sizeof(*pwd),
2237 			   timeout ? timeout : 1000,
2238 			   is48bit));
2239 }
2240 
2241 static int
2242 atahpa_freeze_lock(struct cam_device *device, int retry_count,
2243 		   uint32_t timeout, union ccb *ccb, int is48bit)
2244 {
2245 	u_int cmd;
2246 	uint8_t protocol;
2247 
2248 	protocol = AP_PROTO_NON_DATA;
2249 	cmd = (is48bit) ? ATA_SET_MAX_ADDRESS48 : ATA_SET_MAX_ADDRESS;
2250 
2251 	return (ata_do_cmd(device,
2252 			   ccb,
2253 			   retry_count,
2254 			   /*flags*/CAM_DIR_NONE,
2255 			   /*protocol*/protocol,
2256 			   /*ata_flags*/0,
2257 			   /*tag_action*/MSG_SIMPLE_Q_TAG,
2258 			   /*command*/cmd,
2259 			   /*features*/ATA_HPA_FEAT_FREEZE,
2260 			   /*lba*/0,
2261 			   /*sector_count*/0,
2262 			   /*data_ptr*/NULL,
2263 			   /*dxfer_len*/0,
2264 			   timeout ? timeout : 1000,
2265 			   is48bit));
2266 }
2267 
2268 static int
2269 ata_get_native_max(struct cam_device *device, int retry_count,
2270 		      uint32_t timeout, union ccb *ccb,
2271 		      u_int64_t *nativesize)
2272 {
2273 	int error;
2274 
2275 	error = ata_do_cmd(device,
2276 			   ccb,
2277 			   retry_count,
2278 			   /*flags*/CAM_DIR_NONE,
2279 			   /*protocol*/AP_PROTO_NON_DATA | AP_EXTEND,
2280 			   /*ata_flags*/AP_FLAG_CHK_COND,
2281 			   /*tag_action*/MSG_SIMPLE_Q_TAG,
2282 			   /*command*/ATA_AMAX_ADDR,
2283 			   /*features*/ATA_AMAX_ADDR_GET,
2284 			   /*lba*/0,
2285 			   /*sector_count*/0,
2286 			   /*data_ptr*/NULL,
2287 			   /*dxfer_len*/0,
2288 			   timeout ? timeout : 30 * 1000,
2289 			   /*force48bit*/1);
2290 
2291 	if (error)
2292 		return (error);
2293 
2294 	return atahpa_proc_resp(device, ccb, nativesize);
2295 }
2296 
2297 static int
2298 ataama_set(struct cam_device *device, int retry_count,
2299 	      uint32_t timeout, union ccb *ccb, u_int64_t maxsize)
2300 {
2301 	int error;
2302 
2303 	/* lba's are zero indexed so the max lba is requested max - 1 */
2304 	if (maxsize)
2305 		maxsize--;
2306 
2307 	error = ata_do_cmd(device,
2308 			   ccb,
2309 			   retry_count,
2310 			   /*flags*/CAM_DIR_NONE,
2311 			   /*protocol*/AP_PROTO_NON_DATA | AP_EXTEND,
2312 			   /*ata_flags*/AP_FLAG_CHK_COND,
2313 			   /*tag_action*/MSG_SIMPLE_Q_TAG,
2314 			   /*command*/ATA_AMAX_ADDR,
2315 			   /*features*/ATA_AMAX_ADDR_SET,
2316 			   /*lba*/maxsize,
2317 			   /*sector_count*/0,
2318 			   /*data_ptr*/NULL,
2319 			   /*dxfer_len*/0,
2320 			   timeout ? timeout : 30 * 1000,
2321 			   /*force48bit*/1);
2322 
2323 	if (error)
2324 		return (error);
2325 
2326 	return atahpa_proc_resp(device, ccb, NULL);
2327 }
2328 
2329 static int
2330 ataama_freeze(struct cam_device *device, int retry_count,
2331 		   uint32_t timeout, union ccb *ccb)
2332 {
2333 
2334 	return (ata_do_cmd(device,
2335 			   ccb,
2336 			   retry_count,
2337 			   /*flags*/CAM_DIR_NONE,
2338 			   /*protocol*/AP_PROTO_NON_DATA | AP_EXTEND,
2339 			   /*ata_flags*/0,
2340 			   /*tag_action*/MSG_SIMPLE_Q_TAG,
2341 			   /*command*/ATA_AMAX_ADDR,
2342 			   /*features*/ATA_AMAX_ADDR_FREEZE,
2343 			   /*lba*/0,
2344 			   /*sector_count*/0,
2345 			   /*data_ptr*/NULL,
2346 			   /*dxfer_len*/0,
2347 			   timeout ? timeout : 30 * 1000,
2348 			   /*force48bit*/1));
2349 }
2350 
2351 int
2352 ata_do_identify(struct cam_device *device, int retry_count, int timeout,
2353 		union ccb *ccb, struct ata_params** ident_bufp)
2354 {
2355 	struct ata_params *ident_buf;
2356 	struct ccb_pathinq cpi;
2357 	struct ccb_getdev cgd;
2358 	u_int i, error;
2359 	int16_t *ptr;
2360 	uint8_t command, retry_command;
2361 
2362 	if (get_cpi(device, &cpi) != 0) {
2363 		warnx("couldn't get CPI");
2364 		return (-1);
2365 	}
2366 
2367 	/* Neither PROTO_ATAPI or PROTO_SATAPM are used in cpi.protocol */
2368 	if (cpi.protocol == PROTO_ATA) {
2369 		if (get_cgd(device, &cgd) != 0) {
2370 			warnx("couldn't get CGD");
2371 			return (-1);
2372 		}
2373 
2374 		command = (cgd.protocol == PROTO_ATA) ?
2375 		    ATA_ATA_IDENTIFY : ATA_ATAPI_IDENTIFY;
2376 		retry_command = 0;
2377 	} else {
2378 		/* We don't know which for sure so try both */
2379 		command = ATA_ATA_IDENTIFY;
2380 		retry_command = ATA_ATAPI_IDENTIFY;
2381 	}
2382 
2383 	ptr = (uint16_t *)calloc(1, sizeof(struct ata_params));
2384 	if (ptr == NULL) {
2385 		warnx("can't calloc memory for identify\n");
2386 		return (1);
2387 	}
2388 
2389 retry:
2390 	error = ata_do_cmd(device,
2391 			   ccb,
2392 			   /*retries*/retry_count,
2393 			   /*flags*/CAM_DIR_IN,
2394 			   /*protocol*/AP_PROTO_PIO_IN,
2395 			   /*ata_flags*/AP_FLAG_BYT_BLOK_BLOCKS |
2396 			    AP_FLAG_TLEN_SECT_CNT,
2397 			   /*tag_action*/MSG_SIMPLE_Q_TAG,
2398 			   /*command*/command,
2399 			   /*features*/0,
2400 			   /*lba*/0,
2401 			   /*sector_count*/sizeof(struct ata_params) / 512,
2402 			   /*data_ptr*/(uint8_t *)ptr,
2403 			   /*dxfer_len*/sizeof(struct ata_params),
2404 			   /*timeout*/timeout ? timeout : 30 * 1000,
2405 			   /*force48bit*/0);
2406 
2407 	if (error != 0) {
2408 		if (retry_command != 0) {
2409 			command = retry_command;
2410 			retry_command = 0;
2411 			goto retry;
2412 		}
2413 		free(ptr);
2414 		return (1);
2415 	}
2416 
2417 	ident_buf = (struct ata_params *)ptr;
2418 	ata_param_fixup(ident_buf);
2419 
2420 	error = 1;
2421 	for (i = 0; i < sizeof(struct ata_params) / 2; i++) {
2422 		if (ptr[i] != 0)
2423 			error = 0;
2424 	}
2425 
2426 	/* check for invalid (all zero) response */
2427 	if (error != 0) {
2428 		warnx("Invalid identify response detected");
2429 		free(ptr);
2430 		return (error);
2431 	}
2432 
2433 	*ident_bufp = ident_buf;
2434 
2435 	return (0);
2436 }
2437 
2438 
2439 static int
2440 ataidentify(struct cam_device *device, int retry_count, int timeout)
2441 {
2442 	union ccb *ccb;
2443 	struct ata_params *ident_buf;
2444 	u_int64_t hpasize = 0, nativesize = 0;
2445 
2446 	if ((ccb = cam_getccb(device)) == NULL) {
2447 		warnx("couldn't allocate CCB");
2448 		return (1);
2449 	}
2450 
2451 	if (ata_do_identify(device, retry_count, timeout, ccb, &ident_buf) != 0) {
2452 		cam_freeccb(ccb);
2453 		return (1);
2454 	}
2455 
2456 	if (arglist & CAM_ARG_VERBOSE) {
2457 		printf("%s%d: Raw identify data:\n",
2458 		    device->device_name, device->dev_unit_num);
2459 		dump_data((uint16_t *)ident_buf, sizeof(struct ata_params));
2460 	}
2461 
2462 	if (ident_buf->support.command1 & ATA_SUPPORT_PROTECTED) {
2463 		ata_read_native_max(device, retry_count, timeout, ccb,
2464 				    ident_buf, &hpasize);
2465 	}
2466 	if (ident_buf->support2 & ATA_SUPPORT_AMAX_ADDR) {
2467 		ata_get_native_max(device, retry_count, timeout, ccb,
2468 				   &nativesize);
2469 	}
2470 
2471 	printf("%s%d: ", device->device_name, device->dev_unit_num);
2472 	ata_print_ident(ident_buf);
2473 	camxferrate(device);
2474 	atacapprint(ident_buf);
2475 	atahpa_print(ident_buf, hpasize, 0);
2476 	ataama_print(ident_buf, nativesize, 0);
2477 
2478 	free(ident_buf);
2479 	cam_freeccb(ccb);
2480 
2481 	return (0);
2482 }
2483 
2484 static int
2485 nvmeidentify(struct cam_device *device, int retry_count __unused, int timeout __unused)
2486 {
2487 	struct nvme_controller_data cdata;
2488 
2489 	if (nvme_get_cdata(device, &cdata))
2490 		return (1);
2491 	nvme_print_controller(&cdata);
2492 
2493 	return (0);
2494 }
2495 
2496 static int
2497 identify(struct cam_device *device, int retry_count, int timeout)
2498 {
2499 	struct ccb_pathinq cpi;
2500 
2501 	if (get_cpi(device, &cpi) != 0) {
2502 		warnx("couldn't get CPI");
2503 		return (-1);
2504 	}
2505 
2506 	if (cpi.protocol == PROTO_NVME) {
2507 		return (nvmeidentify(device, retry_count, timeout));
2508 	}
2509 	return (ataidentify(device, retry_count, timeout));
2510 }
2511 
2512 
2513 enum {
2514 	ATA_SECURITY_ACTION_PRINT,
2515 	ATA_SECURITY_ACTION_FREEZE,
2516 	ATA_SECURITY_ACTION_UNLOCK,
2517 	ATA_SECURITY_ACTION_DISABLE,
2518 	ATA_SECURITY_ACTION_ERASE,
2519 	ATA_SECURITY_ACTION_ERASE_ENHANCED,
2520 	ATA_SECURITY_ACTION_SET_PASSWORD
2521 };
2522 
2523 static void
2524 atasecurity_print_time(uint16_t tw)
2525 {
2526 
2527 	if (tw == 0)
2528 		printf("unspecified");
2529 	else if (tw >= 255)
2530 		printf("> 508 min");
2531 	else
2532 		printf("%i min", 2 * tw);
2533 }
2534 
2535 static uint32_t
2536 atasecurity_erase_timeout_msecs(uint16_t timeout)
2537 {
2538 
2539 	if (timeout == 0)
2540 		return 2 * 3600 * 1000; /* default: two hours */
2541 	else if (timeout > 255)
2542 		return (508 + 60) * 60 * 1000; /* spec says > 508 minutes */
2543 
2544 	return ((2 * timeout) + 5) * 60 * 1000; /* add a 5min margin */
2545 }
2546 
2547 
2548 static void
2549 atasecurity_notify(uint8_t command, struct ata_security_password *pwd)
2550 {
2551 	struct ata_cmd cmd;
2552 
2553 	bzero(&cmd, sizeof(cmd));
2554 	cmd.command = command;
2555 	printf("Issuing %s", ata_op_string(&cmd));
2556 
2557 	if (pwd != NULL) {
2558 		/* pwd->password may not be null terminated */
2559 		char pass[sizeof(pwd->password)+1];
2560 
2561 		strlcpy(pass, pwd->password, sizeof(pass));
2562 		printf(" password='%s', user='%s'",
2563 			pass,
2564 			(pwd->ctrl & ATA_SECURITY_PASSWORD_MASTER) ?
2565 			"master" : "user");
2566 
2567 		if (command == ATA_SECURITY_SET_PASSWORD) {
2568 			printf(", mode='%s'",
2569 			       (pwd->ctrl & ATA_SECURITY_LEVEL_MAXIMUM) ?
2570 			       "maximum" : "high");
2571 		}
2572 	}
2573 
2574 	printf("\n");
2575 }
2576 
2577 static int
2578 atasecurity_freeze(struct cam_device *device, union ccb *ccb,
2579 		   int retry_count, uint32_t timeout, int quiet)
2580 {
2581 
2582 	if (quiet == 0)
2583 		atasecurity_notify(ATA_SECURITY_FREEZE_LOCK, NULL);
2584 
2585 	return ata_do_cmd(device,
2586 			  ccb,
2587 			  retry_count,
2588 			  /*flags*/CAM_DIR_NONE,
2589 			  /*protocol*/AP_PROTO_NON_DATA,
2590 			  /*ata_flags*/0,
2591 			  /*tag_action*/MSG_SIMPLE_Q_TAG,
2592 			  /*command*/ATA_SECURITY_FREEZE_LOCK,
2593 			  /*features*/0,
2594 			  /*lba*/0,
2595 			  /*sector_count*/0,
2596 			  /*data_ptr*/NULL,
2597 			  /*dxfer_len*/0,
2598 			  /*timeout*/timeout,
2599 			  /*force48bit*/0);
2600 }
2601 
2602 static int
2603 atasecurity_unlock(struct cam_device *device, union ccb *ccb,
2604 		   int retry_count, uint32_t timeout,
2605 		   struct ata_security_password *pwd, int quiet)
2606 {
2607 
2608 	if (quiet == 0)
2609 		atasecurity_notify(ATA_SECURITY_UNLOCK, pwd);
2610 
2611 	return ata_do_cmd(device,
2612 			  ccb,
2613 			  retry_count,
2614 			  /*flags*/CAM_DIR_OUT,
2615 			  /*protocol*/AP_PROTO_PIO_OUT,
2616 			  /*ata_flags*/AP_FLAG_BYT_BLOK_BLOCKS |
2617 			    AP_FLAG_TLEN_SECT_CNT,
2618 			  /*tag_action*/MSG_SIMPLE_Q_TAG,
2619 			  /*command*/ATA_SECURITY_UNLOCK,
2620 			  /*features*/0,
2621 			  /*lba*/0,
2622 			  /*sector_count*/sizeof(*pwd) / 512,
2623 			  /*data_ptr*/(uint8_t *)pwd,
2624 			  /*dxfer_len*/sizeof(*pwd),
2625 			  /*timeout*/timeout,
2626 			  /*force48bit*/0);
2627 }
2628 
2629 static int
2630 atasecurity_disable(struct cam_device *device, union ccb *ccb,
2631 		    int retry_count, uint32_t timeout,
2632 		    struct ata_security_password *pwd, int quiet)
2633 {
2634 
2635 	if (quiet == 0)
2636 		atasecurity_notify(ATA_SECURITY_DISABLE_PASSWORD, pwd);
2637 	return ata_do_cmd(device,
2638 			  ccb,
2639 			  retry_count,
2640 			  /*flags*/CAM_DIR_OUT,
2641 			  /*protocol*/AP_PROTO_PIO_OUT,
2642 			  /*ata_flags*/AP_FLAG_BYT_BLOK_BLOCKS |
2643 			    AP_FLAG_TLEN_SECT_CNT,
2644 			  /*tag_action*/MSG_SIMPLE_Q_TAG,
2645 			  /*command*/ATA_SECURITY_DISABLE_PASSWORD,
2646 			  /*features*/0,
2647 			  /*lba*/0,
2648 			  /*sector_count*/sizeof(*pwd) / 512,
2649 			  /*data_ptr*/(uint8_t *)pwd,
2650 			  /*dxfer_len*/sizeof(*pwd),
2651 			  /*timeout*/timeout,
2652 			  /*force48bit*/0);
2653 }
2654 
2655 
2656 static int
2657 atasecurity_erase_confirm(struct cam_device *device,
2658 			  struct ata_params* ident_buf)
2659 {
2660 
2661 	printf("\nYou are about to ERASE ALL DATA from the following"
2662 	       " device:\n%s%d,%s%d: ", device->device_name,
2663 	       device->dev_unit_num, device->given_dev_name,
2664 	       device->given_unit_number);
2665 	ata_print_ident(ident_buf);
2666 
2667 	for(;;) {
2668 		char str[50];
2669 		printf("\nAre you SURE you want to ERASE ALL DATA? (yes/no) ");
2670 
2671 		if (fgets(str, sizeof(str), stdin) != NULL) {
2672 			if (strncasecmp(str, "yes", 3) == 0) {
2673 				return (1);
2674 			} else if (strncasecmp(str, "no", 2) == 0) {
2675 				return (0);
2676 			} else {
2677 				printf("Please answer \"yes\" or "
2678 				       "\"no\"\n");
2679 			}
2680 		}
2681 	}
2682 
2683 	/* NOTREACHED */
2684 	return (0);
2685 }
2686 
2687 static int
2688 atasecurity_erase(struct cam_device *device, union ccb *ccb,
2689 		  int retry_count, uint32_t timeout,
2690 		  uint32_t erase_timeout,
2691 		  struct ata_security_password *pwd, int quiet)
2692 {
2693 	int error;
2694 
2695 	if (quiet == 0)
2696 		atasecurity_notify(ATA_SECURITY_ERASE_PREPARE, NULL);
2697 
2698 	error = ata_do_cmd(device,
2699 			   ccb,
2700 			   retry_count,
2701 			   /*flags*/CAM_DIR_NONE,
2702 			   /*protocol*/AP_PROTO_NON_DATA,
2703 			   /*ata_flags*/0,
2704 			   /*tag_action*/MSG_SIMPLE_Q_TAG,
2705 			   /*command*/ATA_SECURITY_ERASE_PREPARE,
2706 			   /*features*/0,
2707 			   /*lba*/0,
2708 			   /*sector_count*/0,
2709 			   /*data_ptr*/NULL,
2710 			   /*dxfer_len*/0,
2711 			   /*timeout*/timeout,
2712 			   /*force48bit*/0);
2713 
2714 	if (error != 0)
2715 		return error;
2716 
2717 	if (quiet == 0)
2718 		atasecurity_notify(ATA_SECURITY_ERASE_UNIT, pwd);
2719 
2720 	error = ata_do_cmd(device,
2721 			   ccb,
2722 			   retry_count,
2723 			   /*flags*/CAM_DIR_OUT,
2724 			   /*protocol*/AP_PROTO_PIO_OUT,
2725 			   /*ata_flags*/AP_FLAG_BYT_BLOK_BLOCKS |
2726 			    AP_FLAG_TLEN_SECT_CNT,
2727 			   /*tag_action*/MSG_SIMPLE_Q_TAG,
2728 			   /*command*/ATA_SECURITY_ERASE_UNIT,
2729 			   /*features*/0,
2730 			   /*lba*/0,
2731 			   /*sector_count*/sizeof(*pwd) / 512,
2732 			   /*data_ptr*/(uint8_t *)pwd,
2733 			   /*dxfer_len*/sizeof(*pwd),
2734 			   /*timeout*/erase_timeout,
2735 			   /*force48bit*/0);
2736 
2737 	if (error == 0 && quiet == 0)
2738 		printf("\nErase Complete\n");
2739 
2740 	return error;
2741 }
2742 
2743 static int
2744 atasecurity_set_password(struct cam_device *device, union ccb *ccb,
2745 			 int retry_count, uint32_t timeout,
2746 			 struct ata_security_password *pwd, int quiet)
2747 {
2748 
2749 	if (quiet == 0)
2750 		atasecurity_notify(ATA_SECURITY_SET_PASSWORD, pwd);
2751 
2752 	return ata_do_cmd(device,
2753 			  ccb,
2754 			  retry_count,
2755 			  /*flags*/CAM_DIR_OUT,
2756 			  /*protocol*/AP_PROTO_PIO_OUT,
2757 			  /*ata_flags*/AP_FLAG_BYT_BLOK_BLOCKS |
2758 			   AP_FLAG_TLEN_SECT_CNT,
2759 			  /*tag_action*/MSG_SIMPLE_Q_TAG,
2760 			  /*command*/ATA_SECURITY_SET_PASSWORD,
2761 			  /*features*/0,
2762 			  /*lba*/0,
2763 			  /*sector_count*/sizeof(*pwd) / 512,
2764 			  /*data_ptr*/(uint8_t *)pwd,
2765 			  /*dxfer_len*/sizeof(*pwd),
2766 			  /*timeout*/timeout,
2767 			  /*force48bit*/0);
2768 }
2769 
2770 static void
2771 atasecurity_print(struct ata_params *parm)
2772 {
2773 
2774 	printf("\nSecurity Option           Value\n");
2775 	if (arglist & CAM_ARG_VERBOSE) {
2776 		printf("status                    %04x\n",
2777 		       parm->security_status);
2778 	}
2779 	printf("supported                 %s\n",
2780 		parm->security_status & ATA_SECURITY_SUPPORTED ? "yes" : "no");
2781 	if (!(parm->security_status & ATA_SECURITY_SUPPORTED))
2782 		return;
2783 	printf("enabled                   %s\n",
2784 		parm->security_status & ATA_SECURITY_ENABLED ? "yes" : "no");
2785 	printf("drive locked              %s\n",
2786 		parm->security_status & ATA_SECURITY_LOCKED ? "yes" : "no");
2787 	printf("security config frozen    %s\n",
2788 		parm->security_status & ATA_SECURITY_FROZEN ? "yes" : "no");
2789 	printf("count expired             %s\n",
2790 		parm->security_status & ATA_SECURITY_COUNT_EXP ? "yes" : "no");
2791 	printf("security level            %s\n",
2792 		parm->security_status & ATA_SECURITY_LEVEL ? "maximum" : "high");
2793 	printf("enhanced erase supported  %s\n",
2794 		parm->security_status & ATA_SECURITY_ENH_SUPP ? "yes" : "no");
2795 	printf("erase time                ");
2796 	atasecurity_print_time(parm->erase_time);
2797 	printf("\n");
2798 	printf("enhanced erase time       ");
2799 	atasecurity_print_time(parm->enhanced_erase_time);
2800 	printf("\n");
2801 	printf("master password rev       %04x%s\n",
2802 		parm->master_passwd_revision,
2803 		parm->master_passwd_revision == 0x0000 ||
2804 		parm->master_passwd_revision == 0xFFFF ?  " (unsupported)" : "");
2805 }
2806 
2807 /*
2808  * Validates and copies the password in optarg to the passed buffer.
2809  * If the password in optarg is the same length as the buffer then
2810  * the data will still be copied but no null termination will occur.
2811  */
2812 static int
2813 ata_getpwd(uint8_t *passwd, int max, char opt)
2814 {
2815 	int len;
2816 
2817 	len = strlen(optarg);
2818 	if (len > max) {
2819 		warnx("-%c password is too long", opt);
2820 		return (1);
2821 	} else if (len == 0) {
2822 		warnx("-%c password is missing", opt);
2823 		return (1);
2824 	} else if (optarg[0] == '-'){
2825 		warnx("-%c password starts with '-' (generic arg?)", opt);
2826 		return (1);
2827 	} else if (strlen(passwd) != 0 && strcmp(passwd, optarg) != 0) {
2828 		warnx("-%c password conflicts with existing password from -%c",
2829 		      opt, pwd_opt);
2830 		return (1);
2831 	}
2832 
2833 	/* Callers pass in a buffer which does NOT need to be terminated */
2834 	strncpy(passwd, optarg, max);
2835 	pwd_opt = opt;
2836 
2837 	return (0);
2838 }
2839 
2840 enum {
2841 	ATA_HPA_ACTION_PRINT,
2842 	ATA_HPA_ACTION_SET_MAX,
2843 	ATA_HPA_ACTION_SET_PWD,
2844 	ATA_HPA_ACTION_LOCK,
2845 	ATA_HPA_ACTION_UNLOCK,
2846 	ATA_HPA_ACTION_FREEZE_LOCK
2847 };
2848 
2849 static int
2850 atahpa_set_confirm(struct cam_device *device, struct ata_params* ident_buf,
2851 		   u_int64_t maxsize, int persist)
2852 {
2853 	printf("\nYou are about to configure HPA to limit the user accessible\n"
2854 	       "sectors to %ju %s on the device:\n%s%d,%s%d: ", maxsize,
2855 	       persist ? "persistently" : "temporarily",
2856 	       device->device_name, device->dev_unit_num,
2857 	       device->given_dev_name, device->given_unit_number);
2858 	ata_print_ident(ident_buf);
2859 
2860 	for(;;) {
2861 		char str[50];
2862 		printf("\nAre you SURE you want to configure HPA? (yes/no) ");
2863 
2864 		if (NULL != fgets(str, sizeof(str), stdin)) {
2865 			if (0 == strncasecmp(str, "yes", 3)) {
2866 				return (1);
2867 			} else if (0 == strncasecmp(str, "no", 2)) {
2868 				return (0);
2869 			} else {
2870 				printf("Please answer \"yes\" or "
2871 				       "\"no\"\n");
2872 			}
2873 		}
2874 	}
2875 
2876 	/* NOTREACHED */
2877 	return (0);
2878 }
2879 
2880 static int
2881 atahpa(struct cam_device *device, int retry_count, int timeout,
2882        int argc, char **argv, char *combinedopt)
2883 {
2884 	union ccb *ccb;
2885 	struct ata_params *ident_buf;
2886 	struct ccb_getdev cgd;
2887 	struct ata_set_max_pwd pwd;
2888 	int error, confirm, quiet, c, action, actions, persist;
2889 	int security, is48bit, pwdsize;
2890 	u_int64_t hpasize, maxsize;
2891 
2892 	actions = 0;
2893 	confirm = 0;
2894 	quiet = 0;
2895 	maxsize = 0;
2896 	persist = 0;
2897 	security = 0;
2898 
2899 	memset(&pwd, 0, sizeof(pwd));
2900 
2901 	/* default action is to print hpa information */
2902 	action = ATA_HPA_ACTION_PRINT;
2903 	pwdsize = sizeof(pwd.password);
2904 
2905 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
2906 		switch(c){
2907 		case 's':
2908 			action = ATA_HPA_ACTION_SET_MAX;
2909 			maxsize = strtoumax(optarg, NULL, 0);
2910 			actions++;
2911 			break;
2912 
2913 		case 'p':
2914 			if (ata_getpwd(pwd.password, pwdsize, c) != 0)
2915 				return (1);
2916 			action = ATA_HPA_ACTION_SET_PWD;
2917 			security = 1;
2918 			actions++;
2919 			break;
2920 
2921 		case 'l':
2922 			action = ATA_HPA_ACTION_LOCK;
2923 			security = 1;
2924 			actions++;
2925 			break;
2926 
2927 		case 'U':
2928 			if (ata_getpwd(pwd.password, pwdsize, c) != 0)
2929 				return (1);
2930 			action = ATA_HPA_ACTION_UNLOCK;
2931 			security = 1;
2932 			actions++;
2933 			break;
2934 
2935 		case 'f':
2936 			action = ATA_HPA_ACTION_FREEZE_LOCK;
2937 			security = 1;
2938 			actions++;
2939 			break;
2940 
2941 		case 'P':
2942 			persist = 1;
2943 			break;
2944 
2945 		case 'y':
2946 			confirm++;
2947 			break;
2948 
2949 		case 'q':
2950 			quiet++;
2951 			break;
2952 		}
2953 	}
2954 
2955 	if (actions > 1) {
2956 		warnx("too many hpa actions specified");
2957 		return (1);
2958 	}
2959 
2960 	if (get_cgd(device, &cgd) != 0) {
2961 		warnx("couldn't get CGD");
2962 		return (1);
2963 	}
2964 
2965 	ccb = cam_getccb(device);
2966 	if (ccb == NULL) {
2967 		warnx("couldn't allocate CCB");
2968 		return (1);
2969 	}
2970 
2971 	error = ata_do_identify(device, retry_count, timeout, ccb, &ident_buf);
2972 	if (error != 0) {
2973 		cam_freeccb(ccb);
2974 		return (1);
2975 	}
2976 
2977 	if (quiet == 0) {
2978 		printf("%s%d: ", device->device_name, device->dev_unit_num);
2979 		ata_print_ident(ident_buf);
2980 		camxferrate(device);
2981 	}
2982 
2983 	if (action == ATA_HPA_ACTION_PRINT) {
2984 		hpasize = 0;
2985 		if (ident_buf->support.command1 & ATA_SUPPORT_PROTECTED)
2986 			ata_read_native_max(device, retry_count, timeout, ccb,
2987 				    ident_buf, &hpasize);
2988 		atahpa_print(ident_buf, hpasize, 1);
2989 
2990 		cam_freeccb(ccb);
2991 		free(ident_buf);
2992 		return (error);
2993 	}
2994 
2995 	if (!(ident_buf->support.command1 & ATA_SUPPORT_PROTECTED)) {
2996 		warnx("HPA is not supported by this device");
2997 		cam_freeccb(ccb);
2998 		free(ident_buf);
2999 		return (1);
3000 	}
3001 
3002 	if (security && !(ident_buf->support.command2 & ATA_SUPPORT_MAXSECURITY)) {
3003 		warnx("HPA Security is not supported by this device");
3004 		cam_freeccb(ccb);
3005 		free(ident_buf);
3006 		return (1);
3007 	}
3008 
3009 	is48bit = ident_buf->support.command2 & ATA_SUPPORT_ADDRESS48;
3010 
3011 	/*
3012 	 * The ATA spec requires:
3013 	 * 1. Read native max addr is called directly before set max addr
3014 	 * 2. Read native max addr is NOT called before any other set max call
3015 	 */
3016 	switch(action) {
3017 	case ATA_HPA_ACTION_SET_MAX:
3018 		if (confirm == 0 &&
3019 		    atahpa_set_confirm(device, ident_buf, maxsize,
3020 		    persist) == 0) {
3021 			cam_freeccb(ccb);
3022 			free(ident_buf);
3023 			return (1);
3024 		}
3025 
3026 		error = ata_read_native_max(device, retry_count, timeout,
3027 					    ccb, ident_buf, &hpasize);
3028 		if (error == 0) {
3029 			error = atahpa_set_max(device, retry_count, timeout,
3030 					       ccb, is48bit, maxsize, persist);
3031 			if (error == 0) {
3032 				if (quiet == 0) {
3033 					/* redo identify to get new values */
3034 					error = ata_do_identify(device,
3035 					    retry_count, timeout, ccb,
3036 					    &ident_buf);
3037 					atahpa_print(ident_buf, hpasize, 1);
3038 				}
3039 				/* Hint CAM to reprobe the device. */
3040 				reprobe(device);
3041 			}
3042 		}
3043 		break;
3044 
3045 	case ATA_HPA_ACTION_SET_PWD:
3046 		error = atahpa_password(device, retry_count, timeout,
3047 					ccb, is48bit, &pwd);
3048 		if (error == 0 && quiet == 0)
3049 			printf("HPA password has been set\n");
3050 		break;
3051 
3052 	case ATA_HPA_ACTION_LOCK:
3053 		error = atahpa_lock(device, retry_count, timeout,
3054 				    ccb, is48bit);
3055 		if (error == 0 && quiet == 0)
3056 			printf("HPA has been locked\n");
3057 		break;
3058 
3059 	case ATA_HPA_ACTION_UNLOCK:
3060 		error = atahpa_unlock(device, retry_count, timeout,
3061 				      ccb, is48bit, &pwd);
3062 		if (error == 0 && quiet == 0)
3063 			printf("HPA has been unlocked\n");
3064 		break;
3065 
3066 	case ATA_HPA_ACTION_FREEZE_LOCK:
3067 		error = atahpa_freeze_lock(device, retry_count, timeout,
3068 					   ccb, is48bit);
3069 		if (error == 0 && quiet == 0)
3070 			printf("HPA has been frozen\n");
3071 		break;
3072 
3073 	default:
3074 		errx(1, "Option currently not supported");
3075 	}
3076 
3077 	cam_freeccb(ccb);
3078 	free(ident_buf);
3079 
3080 	return (error);
3081 }
3082 
3083 enum {
3084 	ATA_AMA_ACTION_PRINT,
3085 	ATA_AMA_ACTION_SET_MAX,
3086 	ATA_AMA_ACTION_FREEZE_LOCK
3087 };
3088 
3089 static int
3090 ataama(struct cam_device *device, int retry_count, int timeout,
3091        int argc, char **argv, char *combinedopt)
3092 {
3093 	union ccb *ccb;
3094 	struct ata_params *ident_buf;
3095 	struct ccb_getdev cgd;
3096 	int error, quiet, c, action, actions;
3097 	u_int64_t nativesize, maxsize;
3098 
3099 	actions = 0;
3100 	quiet = 0;
3101 	maxsize = 0;
3102 
3103 	/* default action is to print AMA information */
3104 	action = ATA_AMA_ACTION_PRINT;
3105 
3106 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
3107 		switch(c){
3108 		case 's':
3109 			action = ATA_AMA_ACTION_SET_MAX;
3110 			maxsize = strtoumax(optarg, NULL, 0);
3111 			actions++;
3112 			break;
3113 
3114 		case 'f':
3115 			action = ATA_AMA_ACTION_FREEZE_LOCK;
3116 			actions++;
3117 			break;
3118 
3119 		case 'q':
3120 			quiet++;
3121 			break;
3122 		}
3123 	}
3124 
3125 	if (actions > 1) {
3126 		warnx("too many AMA actions specified");
3127 		return (1);
3128 	}
3129 
3130 	if (get_cgd(device, &cgd) != 0) {
3131 		warnx("couldn't get CGD");
3132 		return (1);
3133 	}
3134 
3135 	ccb = cam_getccb(device);
3136 	if (ccb == NULL) {
3137 		warnx("couldn't allocate CCB");
3138 		return (1);
3139 	}
3140 
3141 	error = ata_do_identify(device, retry_count, timeout, ccb, &ident_buf);
3142 	if (error != 0) {
3143 		cam_freeccb(ccb);
3144 		return (1);
3145 	}
3146 
3147 	if (quiet == 0) {
3148 		printf("%s%d: ", device->device_name, device->dev_unit_num);
3149 		ata_print_ident(ident_buf);
3150 		camxferrate(device);
3151 	}
3152 
3153 	if (action == ATA_AMA_ACTION_PRINT) {
3154 		nativesize = 0;
3155 		if (ident_buf->support2 & ATA_SUPPORT_AMAX_ADDR)
3156 			ata_get_native_max(device, retry_count, timeout, ccb,
3157 					   &nativesize);
3158 		ataama_print(ident_buf, nativesize, 1);
3159 
3160 		cam_freeccb(ccb);
3161 		free(ident_buf);
3162 		return (error);
3163 	}
3164 
3165 	if (!(ident_buf->support2 & ATA_SUPPORT_AMAX_ADDR)) {
3166 		warnx("Accessible Max Address is not supported by this device");
3167 		cam_freeccb(ccb);
3168 		free(ident_buf);
3169 		return (1);
3170 	}
3171 
3172 	switch(action) {
3173 	case ATA_AMA_ACTION_SET_MAX:
3174 		error = ata_get_native_max(device, retry_count, timeout, ccb,
3175 					   &nativesize);
3176 		if (error == 0) {
3177 			error = ataama_set(device, retry_count, timeout,
3178 				       ccb, maxsize);
3179 			if (error == 0) {
3180 				if (quiet == 0) {
3181 					/* redo identify to get new values */
3182 					error = ata_do_identify(device,
3183 					    retry_count, timeout, ccb,
3184 					    &ident_buf);
3185 					ataama_print(ident_buf, nativesize, 1);
3186 				}
3187 				/* Hint CAM to reprobe the device. */
3188 				reprobe(device);
3189 			}
3190 		}
3191 		break;
3192 
3193 	case ATA_AMA_ACTION_FREEZE_LOCK:
3194 		error = ataama_freeze(device, retry_count, timeout,
3195 					   ccb);
3196 		if (error == 0 && quiet == 0)
3197 			printf("Accessible Max Address has been frozen\n");
3198 		break;
3199 
3200 	default:
3201 		errx(1, "Option currently not supported");
3202 	}
3203 
3204 	cam_freeccb(ccb);
3205 	free(ident_buf);
3206 
3207 	return (error);
3208 }
3209 
3210 static int
3211 atasecurity(struct cam_device *device, int retry_count, int timeout,
3212 	    int argc, char **argv, char *combinedopt)
3213 {
3214 	union ccb *ccb;
3215 	struct ata_params *ident_buf;
3216 	int error, confirm, quiet, c, action, actions, setpwd;
3217 	int security_enabled, erase_timeout, pwdsize;
3218 	struct ata_security_password pwd;
3219 
3220 	actions = 0;
3221 	setpwd = 0;
3222 	erase_timeout = 0;
3223 	confirm = 0;
3224 	quiet = 0;
3225 
3226 	memset(&pwd, 0, sizeof(pwd));
3227 
3228 	/* default action is to print security information */
3229 	action = ATA_SECURITY_ACTION_PRINT;
3230 
3231 	/* user is master by default as its safer that way */
3232 	pwd.ctrl |= ATA_SECURITY_PASSWORD_MASTER;
3233 	pwdsize = sizeof(pwd.password);
3234 
3235 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
3236 		switch(c){
3237 		case 'f':
3238 			action = ATA_SECURITY_ACTION_FREEZE;
3239 			actions++;
3240 			break;
3241 
3242 		case 'U':
3243 			if (strcasecmp(optarg, "user") == 0) {
3244 				pwd.ctrl |= ATA_SECURITY_PASSWORD_USER;
3245 				pwd.ctrl &= ~ATA_SECURITY_PASSWORD_MASTER;
3246 			} else if (strcasecmp(optarg, "master") == 0) {
3247 				pwd.ctrl |= ATA_SECURITY_PASSWORD_MASTER;
3248 				pwd.ctrl &= ~ATA_SECURITY_PASSWORD_USER;
3249 			} else {
3250 				warnx("-U argument '%s' is invalid (must be "
3251 				      "'user' or 'master')", optarg);
3252 				return (1);
3253 			}
3254 			break;
3255 
3256 		case 'l':
3257 			if (strcasecmp(optarg, "high") == 0) {
3258 				pwd.ctrl |= ATA_SECURITY_LEVEL_HIGH;
3259 				pwd.ctrl &= ~ATA_SECURITY_LEVEL_MAXIMUM;
3260 			} else if (strcasecmp(optarg, "maximum") == 0) {
3261 				pwd.ctrl |= ATA_SECURITY_LEVEL_MAXIMUM;
3262 				pwd.ctrl &= ~ATA_SECURITY_LEVEL_HIGH;
3263 			} else {
3264 				warnx("-l argument '%s' is unknown (must be "
3265 				      "'high' or 'maximum')", optarg);
3266 				return (1);
3267 			}
3268 			break;
3269 
3270 		case 'k':
3271 			if (ata_getpwd(pwd.password, pwdsize, c) != 0)
3272 				return (1);
3273 			action = ATA_SECURITY_ACTION_UNLOCK;
3274 			actions++;
3275 			break;
3276 
3277 		case 'd':
3278 			if (ata_getpwd(pwd.password, pwdsize, c) != 0)
3279 				return (1);
3280 			action = ATA_SECURITY_ACTION_DISABLE;
3281 			actions++;
3282 			break;
3283 
3284 		case 'e':
3285 			if (ata_getpwd(pwd.password, pwdsize, c) != 0)
3286 				return (1);
3287 			action = ATA_SECURITY_ACTION_ERASE;
3288 			actions++;
3289 			break;
3290 
3291 		case 'h':
3292 			if (ata_getpwd(pwd.password, pwdsize, c) != 0)
3293 				return (1);
3294 			pwd.ctrl |= ATA_SECURITY_ERASE_ENHANCED;
3295 			action = ATA_SECURITY_ACTION_ERASE_ENHANCED;
3296 			actions++;
3297 			break;
3298 
3299 		case 's':
3300 			if (ata_getpwd(pwd.password, pwdsize, c) != 0)
3301 				return (1);
3302 			setpwd = 1;
3303 			if (action == ATA_SECURITY_ACTION_PRINT)
3304 				action = ATA_SECURITY_ACTION_SET_PASSWORD;
3305 			/*
3306 			 * Don't increment action as this can be combined
3307 			 * with other actions.
3308 			 */
3309 			break;
3310 
3311 		case 'y':
3312 			confirm++;
3313 			break;
3314 
3315 		case 'q':
3316 			quiet++;
3317 			break;
3318 
3319 		case 'T':
3320 			erase_timeout = atoi(optarg) * 1000;
3321 			break;
3322 		}
3323 	}
3324 
3325 	if (actions > 1) {
3326 		warnx("too many security actions specified");
3327 		return (1);
3328 	}
3329 
3330 	if ((ccb = cam_getccb(device)) == NULL) {
3331 		warnx("couldn't allocate CCB");
3332 		return (1);
3333 	}
3334 
3335 	error = ata_do_identify(device, retry_count, timeout, ccb, &ident_buf);
3336 	if (error != 0) {
3337 		cam_freeccb(ccb);
3338 		return (1);
3339 	}
3340 
3341 	if (quiet == 0) {
3342 		printf("%s%d: ", device->device_name, device->dev_unit_num);
3343 		ata_print_ident(ident_buf);
3344 		camxferrate(device);
3345 	}
3346 
3347 	if (action == ATA_SECURITY_ACTION_PRINT) {
3348 		atasecurity_print(ident_buf);
3349 		free(ident_buf);
3350 		cam_freeccb(ccb);
3351 		return (0);
3352 	}
3353 
3354 	if ((ident_buf->support.command1 & ATA_SUPPORT_SECURITY) == 0) {
3355 		warnx("Security not supported");
3356 		free(ident_buf);
3357 		cam_freeccb(ccb);
3358 		return (1);
3359 	}
3360 
3361 	/* default timeout 15 seconds the same as linux hdparm */
3362 	timeout = timeout ? timeout : 15 * 1000;
3363 
3364 	security_enabled = ident_buf->security_status & ATA_SECURITY_ENABLED;
3365 
3366 	/* first set the password if requested */
3367 	if (setpwd == 1) {
3368 		/* confirm we can erase before setting the password if erasing */
3369 		if (confirm == 0 &&
3370 		    (action == ATA_SECURITY_ACTION_ERASE_ENHANCED ||
3371 		    action == ATA_SECURITY_ACTION_ERASE) &&
3372 		    atasecurity_erase_confirm(device, ident_buf) == 0) {
3373 			cam_freeccb(ccb);
3374 			free(ident_buf);
3375 			return (error);
3376 		}
3377 
3378 		if (pwd.ctrl & ATA_SECURITY_PASSWORD_MASTER) {
3379 			pwd.revision = ident_buf->master_passwd_revision;
3380 			if (pwd.revision != 0 && pwd.revision != 0xfff &&
3381 			    --pwd.revision == 0) {
3382 				pwd.revision = 0xfffe;
3383 			}
3384 		}
3385 		error = atasecurity_set_password(device, ccb, retry_count,
3386 						 timeout, &pwd, quiet);
3387 		if (error != 0) {
3388 			cam_freeccb(ccb);
3389 			free(ident_buf);
3390 			return (error);
3391 		}
3392 		security_enabled = 1;
3393 	}
3394 
3395 	switch(action) {
3396 	case ATA_SECURITY_ACTION_FREEZE:
3397 		error = atasecurity_freeze(device, ccb, retry_count,
3398 					   timeout, quiet);
3399 		break;
3400 
3401 	case ATA_SECURITY_ACTION_UNLOCK:
3402 		if (security_enabled) {
3403 			if (ident_buf->security_status & ATA_SECURITY_LOCKED) {
3404 				error = atasecurity_unlock(device, ccb,
3405 					retry_count, timeout, &pwd, quiet);
3406 			} else {
3407 				warnx("Can't unlock, drive is not locked");
3408 				error = 1;
3409 			}
3410 		} else {
3411 			warnx("Can't unlock, security is disabled");
3412 			error = 1;
3413 		}
3414 		break;
3415 
3416 	case ATA_SECURITY_ACTION_DISABLE:
3417 		if (security_enabled) {
3418 			/* First unlock the drive if its locked */
3419 			if (ident_buf->security_status & ATA_SECURITY_LOCKED) {
3420 				error = atasecurity_unlock(device, ccb,
3421 							   retry_count,
3422 							   timeout,
3423 							   &pwd,
3424 							   quiet);
3425 			}
3426 
3427 			if (error == 0) {
3428 				error = atasecurity_disable(device,
3429 							    ccb,
3430 							    retry_count,
3431 							    timeout,
3432 							    &pwd,
3433 							    quiet);
3434 			}
3435 		} else {
3436 			warnx("Can't disable security (already disabled)");
3437 			error = 1;
3438 		}
3439 		break;
3440 
3441 	case ATA_SECURITY_ACTION_ERASE:
3442 		if (security_enabled) {
3443 			if (erase_timeout == 0) {
3444 				erase_timeout = atasecurity_erase_timeout_msecs(
3445 				    ident_buf->erase_time);
3446 			}
3447 
3448 			error = atasecurity_erase(device, ccb, retry_count,
3449 			    timeout, erase_timeout, &pwd, quiet);
3450 		} else {
3451 			warnx("Can't secure erase (security is disabled)");
3452 			error = 1;
3453 		}
3454 		break;
3455 
3456 	case ATA_SECURITY_ACTION_ERASE_ENHANCED:
3457 		if (security_enabled) {
3458 			if (ident_buf->security_status & ATA_SECURITY_ENH_SUPP) {
3459 				if (erase_timeout == 0) {
3460 					erase_timeout =
3461 					    atasecurity_erase_timeout_msecs(
3462 						ident_buf->enhanced_erase_time);
3463 				}
3464 
3465 				error = atasecurity_erase(device, ccb,
3466 							  retry_count, timeout,
3467 							  erase_timeout, &pwd,
3468 							  quiet);
3469 			} else {
3470 				warnx("Enhanced erase is not supported");
3471 				error = 1;
3472 			}
3473 		} else {
3474 			warnx("Can't secure erase (enhanced), "
3475 			      "(security is disabled)");
3476 			error = 1;
3477 		}
3478 		break;
3479 	}
3480 
3481 	cam_freeccb(ccb);
3482 	free(ident_buf);
3483 
3484 	return (error);
3485 }
3486 
3487 /*
3488  * Convert periph name into a bus, target and lun.
3489  *
3490  * Returns the number of parsed components, or 0.
3491  */
3492 static int
3493 parse_btl_name(char *tstr, path_id_t *bus, target_id_t *target, lun_id_t *lun,
3494     cam_argmask *arglst)
3495 {
3496 	int fd;
3497 	union ccb ccb;
3498 
3499 	bzero(&ccb, sizeof(ccb));
3500 	ccb.ccb_h.func_code = XPT_GDEVLIST;
3501 	if (cam_get_device(tstr, ccb.cgdl.periph_name,
3502 	    sizeof(ccb.cgdl.periph_name), &ccb.cgdl.unit_number) == -1) {
3503 		warnx("%s", cam_errbuf);
3504 		return (0);
3505 	}
3506 
3507 	/*
3508 	 * Attempt to get the passthrough device.  This ioctl will
3509 	 * fail if the device name is null, if the device doesn't
3510 	 * exist, or if the passthrough driver isn't in the kernel.
3511 	 */
3512 	if ((fd = open(XPT_DEVICE, O_RDWR)) == -1) {
3513 		warn("Unable to open %s", XPT_DEVICE);
3514 		return (0);
3515 	}
3516 	if (ioctl(fd, CAMGETPASSTHRU, &ccb) == -1) {
3517 		warn("Unable to find bus:target:lun for device %s%d",
3518 		    ccb.cgdl.periph_name, ccb.cgdl.unit_number);
3519 		close(fd);
3520 		return (0);
3521 	}
3522 	close(fd);
3523 	if ((ccb.ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
3524 		const struct cam_status_entry *entry;
3525 
3526 		entry = cam_fetch_status_entry(ccb.ccb_h.status);
3527 		warnx("Unable to find bus:target_lun for device %s%d, "
3528 		    "CAM status: %s (%#x)",
3529 		    ccb.cgdl.periph_name, ccb.cgdl.unit_number,
3530 		    entry ? entry->status_text : "Unknown",
3531 		    ccb.ccb_h.status);
3532 		return (0);
3533 	}
3534 
3535 	/*
3536 	 * The kernel fills in the bus/target/lun.  We don't
3537 	 * need the passthrough device name and unit number since
3538 	 * we aren't going to open it.
3539 	 */
3540 	*bus = ccb.ccb_h.path_id;
3541 	*target = ccb.ccb_h.target_id;
3542 	*lun = ccb.ccb_h.target_lun;
3543 	*arglst |= CAM_ARG_BUS | CAM_ARG_TARGET | CAM_ARG_LUN;
3544 	return (3);
3545 }
3546 
3547 /*
3548  * Parse out a bus, or a bus, target and lun in the following
3549  * format:
3550  * bus
3551  * bus:target
3552  * bus:target:lun
3553  *
3554  * Returns the number of parsed components, or 0.
3555  */
3556 static int
3557 parse_btl(char *tstr, path_id_t *bus, target_id_t *target, lun_id_t *lun,
3558     cam_argmask *arglst)
3559 {
3560 	char *tmpstr, *end;
3561 	int convs = 0;
3562 
3563 	*bus = CAM_BUS_WILDCARD;
3564 	*target = CAM_TARGET_WILDCARD;
3565 	*lun = CAM_LUN_WILDCARD;
3566 
3567 	while (isspace(*tstr) && (*tstr != '\0'))
3568 		tstr++;
3569 
3570 	if (strncasecmp(tstr, "all", strlen("all")) == 0) {
3571 		arglist |= CAM_ARG_BUS;
3572 		return (1);
3573 	}
3574 
3575 	if (!isdigit(*tstr))
3576 		return (parse_btl_name(tstr, bus, target, lun, arglst));
3577 
3578 	tmpstr = strsep(&tstr, ":");
3579 	if ((tmpstr != NULL) && (*tmpstr != '\0')) {
3580 		*bus = strtol(tmpstr, &end, 0);
3581 		if (*end != '\0')
3582 			return (0);
3583 		*arglst |= CAM_ARG_BUS;
3584 		convs++;
3585 		tmpstr = strsep(&tstr, ":");
3586 		if ((tmpstr != NULL) && (*tmpstr != '\0')) {
3587 			*target = strtol(tmpstr, &end, 0);
3588 			if (*end != '\0')
3589 				return (0);
3590 			*arglst |= CAM_ARG_TARGET;
3591 			convs++;
3592 			tmpstr = strsep(&tstr, ":");
3593 			if ((tmpstr != NULL) && (*tmpstr != '\0')) {
3594 				*lun = strtoll(tmpstr, &end, 0);
3595 				if (*end != '\0')
3596 					return (0);
3597 				*arglst |= CAM_ARG_LUN;
3598 				convs++;
3599 			}
3600 		}
3601 	}
3602 
3603 	return convs;
3604 }
3605 
3606 static int
3607 dorescan_or_reset(int argc, char **argv, int rescan)
3608 {
3609 	static const char must[] =
3610 	    "you must specify \"all\", a bus, a bus:target:lun or periph to %s";
3611 	int rv, error = 0;
3612 	path_id_t bus = CAM_BUS_WILDCARD;
3613 	target_id_t target = CAM_TARGET_WILDCARD;
3614 	lun_id_t lun = CAM_LUN_WILDCARD;
3615 	char *tstr;
3616 
3617 	if (argc < 3) {
3618 		warnx(must, rescan? "rescan" : "reset");
3619 		return (1);
3620 	}
3621 
3622 	tstr = argv[optind];
3623 	while (isspace(*tstr) && (*tstr != '\0'))
3624 		tstr++;
3625 	if (strncasecmp(tstr, "all", strlen("all")) == 0)
3626 		arglist |= CAM_ARG_BUS;
3627 	else {
3628 		rv = parse_btl(argv[optind], &bus, &target, &lun, &arglist);
3629 		if (rv != 1 && rv != 3) {
3630 			warnx(must, rescan ? "rescan" : "reset");
3631 			return (1);
3632 		}
3633 	}
3634 
3635 	if (arglist & CAM_ARG_LUN)
3636 		error = scanlun_or_reset_dev(bus, target, lun, rescan);
3637 	else
3638 		error = rescan_or_reset_bus(bus, rescan);
3639 
3640 	return (error);
3641 }
3642 
3643 static int
3644 rescan_or_reset_bus(path_id_t bus, int rescan)
3645 {
3646 	union ccb *ccb = NULL, *matchccb = NULL;
3647 	int fd = -1, retval;
3648 	int bufsize;
3649 
3650 	retval = 0;
3651 
3652 	if ((fd = open(XPT_DEVICE, O_RDWR)) < 0) {
3653 		warnx("error opening transport layer device %s", XPT_DEVICE);
3654 		warn("%s", XPT_DEVICE);
3655 		return (1);
3656 	}
3657 
3658 	ccb = malloc(sizeof(*ccb));
3659 	if (ccb == NULL) {
3660 		warn("failed to allocate CCB");
3661 		retval = 1;
3662 		goto bailout;
3663 	}
3664 	bzero(ccb, sizeof(*ccb));
3665 
3666 	if (bus != CAM_BUS_WILDCARD) {
3667 		ccb->ccb_h.func_code = rescan ? XPT_SCAN_BUS : XPT_RESET_BUS;
3668 		ccb->ccb_h.path_id = bus;
3669 		ccb->ccb_h.target_id = CAM_TARGET_WILDCARD;
3670 		ccb->ccb_h.target_lun = CAM_LUN_WILDCARD;
3671 		ccb->crcn.flags = CAM_FLAG_NONE;
3672 
3673 		/* run this at a low priority */
3674 		ccb->ccb_h.pinfo.priority = 5;
3675 
3676 		if (ioctl(fd, CAMIOCOMMAND, ccb) == -1) {
3677 			warn("CAMIOCOMMAND ioctl failed");
3678 			retval = 1;
3679 			goto bailout;
3680 		}
3681 
3682 		if ((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP) {
3683 			fprintf(stdout, "%s of bus %d was successful\n",
3684 			    rescan ? "Re-scan" : "Reset", bus);
3685 		} else {
3686 			fprintf(stdout, "%s of bus %d returned error %#x\n",
3687 				rescan ? "Re-scan" : "Reset", bus,
3688 				ccb->ccb_h.status & CAM_STATUS_MASK);
3689 			retval = 1;
3690 		}
3691 
3692 		goto bailout;
3693 	}
3694 
3695 
3696 	/*
3697 	 * The right way to handle this is to modify the xpt so that it can
3698 	 * handle a wildcarded bus in a rescan or reset CCB.  At the moment
3699 	 * that isn't implemented, so instead we enumerate the buses and
3700 	 * send the rescan or reset to those buses in the case where the
3701 	 * given bus is -1 (wildcard).  We don't send a rescan or reset
3702 	 * to the xpt bus; sending a rescan to the xpt bus is effectively a
3703 	 * no-op, sending a rescan to the xpt bus would result in a status of
3704 	 * CAM_REQ_INVALID.
3705 	 */
3706 	matchccb = malloc(sizeof(*matchccb));
3707 	if (matchccb == NULL) {
3708 		warn("failed to allocate CCB");
3709 		retval = 1;
3710 		goto bailout;
3711 	}
3712 	bzero(matchccb, sizeof(*matchccb));
3713 	matchccb->ccb_h.func_code = XPT_DEV_MATCH;
3714 	matchccb->ccb_h.path_id = CAM_BUS_WILDCARD;
3715 	bufsize = sizeof(struct dev_match_result) * 20;
3716 	matchccb->cdm.match_buf_len = bufsize;
3717 	matchccb->cdm.matches=(struct dev_match_result *)malloc(bufsize);
3718 	if (matchccb->cdm.matches == NULL) {
3719 		warnx("can't malloc memory for matches");
3720 		retval = 1;
3721 		goto bailout;
3722 	}
3723 	matchccb->cdm.num_matches = 0;
3724 
3725 	matchccb->cdm.num_patterns = 1;
3726 	matchccb->cdm.pattern_buf_len = sizeof(struct dev_match_pattern);
3727 
3728 	matchccb->cdm.patterns = (struct dev_match_pattern *)malloc(
3729 		matchccb->cdm.pattern_buf_len);
3730 	if (matchccb->cdm.patterns == NULL) {
3731 		warnx("can't malloc memory for patterns");
3732 		retval = 1;
3733 		goto bailout;
3734 	}
3735 	matchccb->cdm.patterns[0].type = DEV_MATCH_BUS;
3736 	matchccb->cdm.patterns[0].pattern.bus_pattern.flags = BUS_MATCH_ANY;
3737 
3738 	do {
3739 		unsigned int i;
3740 
3741 		if (ioctl(fd, CAMIOCOMMAND, matchccb) == -1) {
3742 			warn("CAMIOCOMMAND ioctl failed");
3743 			retval = 1;
3744 			goto bailout;
3745 		}
3746 
3747 		if ((matchccb->ccb_h.status != CAM_REQ_CMP)
3748 		 || ((matchccb->cdm.status != CAM_DEV_MATCH_LAST)
3749 		   && (matchccb->cdm.status != CAM_DEV_MATCH_MORE))) {
3750 			warnx("got CAM error %#x, CDM error %d\n",
3751 			      matchccb->ccb_h.status, matchccb->cdm.status);
3752 			retval = 1;
3753 			goto bailout;
3754 		}
3755 
3756 		for (i = 0; i < matchccb->cdm.num_matches; i++) {
3757 			struct bus_match_result *bus_result;
3758 
3759 			/* This shouldn't happen. */
3760 			if (matchccb->cdm.matches[i].type != DEV_MATCH_BUS)
3761 				continue;
3762 
3763 			bus_result =&matchccb->cdm.matches[i].result.bus_result;
3764 
3765 			/*
3766 			 * We don't want to rescan or reset the xpt bus.
3767 			 * See above.
3768 			 */
3769 			if (bus_result->path_id == CAM_XPT_PATH_ID)
3770 				continue;
3771 
3772 			ccb->ccb_h.func_code = rescan ? XPT_SCAN_BUS :
3773 						       XPT_RESET_BUS;
3774 			ccb->ccb_h.path_id = bus_result->path_id;
3775 			ccb->ccb_h.target_id = CAM_TARGET_WILDCARD;
3776 			ccb->ccb_h.target_lun = CAM_LUN_WILDCARD;
3777 			ccb->crcn.flags = CAM_FLAG_NONE;
3778 
3779 			/* run this at a low priority */
3780 			ccb->ccb_h.pinfo.priority = 5;
3781 
3782 			if (ioctl(fd, CAMIOCOMMAND, ccb) == -1) {
3783 				warn("CAMIOCOMMAND ioctl failed");
3784 				retval = 1;
3785 				goto bailout;
3786 			}
3787 
3788 			if ((ccb->ccb_h.status & CAM_STATUS_MASK)==CAM_REQ_CMP){
3789 				fprintf(stdout, "%s of bus %d was successful\n",
3790 					rescan? "Re-scan" : "Reset",
3791 					bus_result->path_id);
3792 			} else {
3793 				/*
3794 				 * Don't bail out just yet, maybe the other
3795 				 * rescan or reset commands will complete
3796 				 * successfully.
3797 				 */
3798 				fprintf(stderr, "%s of bus %d returned error "
3799 					"%#x\n", rescan? "Re-scan" : "Reset",
3800 					bus_result->path_id,
3801 					ccb->ccb_h.status & CAM_STATUS_MASK);
3802 				retval = 1;
3803 			}
3804 		}
3805 	} while ((matchccb->ccb_h.status == CAM_REQ_CMP)
3806 		 && (matchccb->cdm.status == CAM_DEV_MATCH_MORE));
3807 
3808 bailout:
3809 
3810 	if (fd != -1)
3811 		close(fd);
3812 
3813 	if (matchccb != NULL) {
3814 		free(matchccb->cdm.patterns);
3815 		free(matchccb->cdm.matches);
3816 		free(matchccb);
3817 	}
3818 	free(ccb);
3819 
3820 	return (retval);
3821 }
3822 
3823 static int
3824 scanlun_or_reset_dev(path_id_t bus, target_id_t target, lun_id_t lun, int scan)
3825 {
3826 	union ccb ccb;
3827 	struct cam_device *device;
3828 	int fd;
3829 
3830 	device = NULL;
3831 
3832 	if (bus == CAM_BUS_WILDCARD) {
3833 		warnx("invalid bus number %d", bus);
3834 		return (1);
3835 	}
3836 
3837 	if (target == CAM_TARGET_WILDCARD) {
3838 		warnx("invalid target number %d", target);
3839 		return (1);
3840 	}
3841 
3842 	if (lun == CAM_LUN_WILDCARD) {
3843 		warnx("invalid lun number %jx", (uintmax_t)lun);
3844 		return (1);
3845 	}
3846 
3847 	fd = -1;
3848 
3849 	bzero(&ccb, sizeof(union ccb));
3850 
3851 	if (scan) {
3852 		if ((fd = open(XPT_DEVICE, O_RDWR)) < 0) {
3853 			warnx("error opening transport layer device %s\n",
3854 			    XPT_DEVICE);
3855 			warn("%s", XPT_DEVICE);
3856 			return (1);
3857 		}
3858 	} else {
3859 		device = cam_open_btl(bus, target, lun, O_RDWR, NULL);
3860 		if (device == NULL) {
3861 			warnx("%s", cam_errbuf);
3862 			return (1);
3863 		}
3864 	}
3865 
3866 	ccb.ccb_h.func_code = (scan)? XPT_SCAN_LUN : XPT_RESET_DEV;
3867 	ccb.ccb_h.path_id = bus;
3868 	ccb.ccb_h.target_id = target;
3869 	ccb.ccb_h.target_lun = lun;
3870 	ccb.ccb_h.timeout = 5000;
3871 	ccb.crcn.flags = CAM_FLAG_NONE;
3872 
3873 	/* run this at a low priority */
3874 	ccb.ccb_h.pinfo.priority = 5;
3875 
3876 	if (scan) {
3877 		if (ioctl(fd, CAMIOCOMMAND, &ccb) < 0) {
3878 			warn("CAMIOCOMMAND ioctl failed");
3879 			close(fd);
3880 			return (1);
3881 		}
3882 	} else {
3883 		if (cam_send_ccb(device, &ccb) < 0) {
3884 			warn("error sending XPT_RESET_DEV CCB");
3885 			cam_close_device(device);
3886 			return (1);
3887 		}
3888 	}
3889 
3890 	if (scan)
3891 		close(fd);
3892 	else
3893 		cam_close_device(device);
3894 
3895 	/*
3896 	 * An error code of CAM_BDR_SENT is normal for a BDR request.
3897 	 */
3898 	if (((ccb.ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP)
3899 	 || ((!scan)
3900 	  && ((ccb.ccb_h.status & CAM_STATUS_MASK) == CAM_BDR_SENT))) {
3901 		fprintf(stdout, "%s of %d:%d:%jx was successful\n",
3902 		    scan? "Re-scan" : "Reset", bus, target, (uintmax_t)lun);
3903 		return (0);
3904 	} else {
3905 		fprintf(stdout, "%s of %d:%d:%jx returned error %#x\n",
3906 		    scan? "Re-scan" : "Reset", bus, target, (uintmax_t)lun,
3907 		    ccb.ccb_h.status & CAM_STATUS_MASK);
3908 		return (1);
3909 	}
3910 }
3911 
3912 
3913 static struct scsi_nv defect_list_type_map[] = {
3914 	{ "block", SRDD10_BLOCK_FORMAT },
3915 	{ "extbfi", SRDD10_EXT_BFI_FORMAT },
3916 	{ "extphys", SRDD10_EXT_PHYS_FORMAT },
3917 	{ "longblock", SRDD10_LONG_BLOCK_FORMAT },
3918 	{ "bfi", SRDD10_BYTES_FROM_INDEX_FORMAT },
3919 	{ "phys", SRDD10_PHYSICAL_SECTOR_FORMAT }
3920 };
3921 
3922 static int
3923 readdefects(struct cam_device *device, int argc, char **argv,
3924 	    char *combinedopt, int task_attr, int retry_count, int timeout)
3925 {
3926 	union ccb *ccb = NULL;
3927 	struct scsi_read_defect_data_hdr_10 *hdr10 = NULL;
3928 	struct scsi_read_defect_data_hdr_12 *hdr12 = NULL;
3929 	size_t hdr_size = 0, entry_size = 0;
3930 	uint8_t *defect_list = NULL;
3931 	uint8_t list_format = 0;
3932 	uint32_t dlist_length = 0;
3933 	uint32_t returned_length = 0, valid_len = 0;
3934 	uint32_t num_returned = 0, num_valid = 0;
3935 	uint32_t max_possible_size = 0, hdr_max = 0;
3936 	uint32_t starting_offset = 0;
3937 	uint8_t returned_format, returned_type;
3938 	unsigned int i;
3939 	int c, error = 0;
3940 	int mads = 0;
3941 	bool summary = false, quiet = false, list_type_set = false;
3942 	bool get_length = true, use_12byte = false, first_pass = true;
3943 	bool hex_format = false;
3944 
3945 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
3946 		switch(c){
3947 		case 'f':
3948 		{
3949 			scsi_nv_status status;
3950 			int entry_num = 0;
3951 
3952 			if (list_type_set) {
3953 				warnx("%s: -f specified twice", __func__);
3954 				error = 1;
3955 				goto defect_bailout;
3956 			}
3957 
3958 			status = scsi_get_nv(defect_list_type_map,
3959 			    sizeof(defect_list_type_map) /
3960 			    sizeof(defect_list_type_map[0]), optarg,
3961 			    &entry_num, SCSI_NV_FLAG_IG_CASE);
3962 
3963 			if (status == SCSI_NV_FOUND) {
3964 				list_format |= defect_list_type_map[
3965 				    entry_num].value;
3966 				list_type_set = true;
3967 			} else {
3968 				warnx("%s: %s %s option %s", __func__,
3969 				    (status == SCSI_NV_AMBIGUOUS) ?
3970 				    "ambiguous" : "invalid", "defect list type",
3971 				    optarg);
3972 				error = 1;
3973 				goto defect_bailout;
3974 			}
3975 			break;
3976 		}
3977 		case 'G':
3978 			list_format |= SRDD10_GLIST;
3979 			break;
3980 		case 'P':
3981 			list_format |= SRDD10_PLIST;
3982 			break;
3983 		case 'q':
3984 			quiet = true;
3985 			break;
3986 		case 's':
3987 			summary = true;
3988 			break;
3989 		case 'S': {
3990 			char *endptr;
3991 
3992 			starting_offset = strtoul(optarg, &endptr, 0);
3993 			if (*endptr != '\0') {
3994 				error = 1;
3995 				warnx("invalid starting offset %s", optarg);
3996 				goto defect_bailout;
3997 			}
3998 			use_12byte = true;
3999 			break;
4000 		}
4001 		case 'X':
4002 			hex_format = true;
4003 			break;
4004 		default:
4005 			break;
4006 		}
4007 	}
4008 
4009 	if (!list_type_set) {
4010 		error = 1;
4011 		warnx("no defect list format specified");
4012 		goto defect_bailout;
4013 	}
4014 
4015 	/*
4016 	 * This implies a summary, and was the previous behavior.
4017 	 */
4018 	if ((list_format & ~SRDD10_DLIST_FORMAT_MASK) == 0)
4019 		summary = true;
4020 
4021 	ccb = cam_getccb(device);
4022 
4023 	/*
4024 	 * We start off asking for just the header to determine how much defect
4025 	 * data is available.  Some Hitachi drives return an error if you ask
4026 	 * for more data than the drive has.  Once we know the length, we retry
4027 	 * the command with the returned length.  When we're retrying the with
4028 	 * 12-byte command, we're always changing to the 12-byte command and
4029 	 * need to get the length. Simplify the logic below by always setting
4030 	 * use_12byte in this case with this slightly more complex logic here.
4031 	 */
4032 	if (!use_12byte) {
4033 		dlist_length = sizeof(*hdr10);
4034 	} else  {
4035 retry_12byte:
4036 		get_length = true;
4037 		use_12byte = true;
4038 		dlist_length = sizeof(*hdr12);
4039 	}
4040 
4041 retry:
4042 	if (defect_list != NULL) {
4043 		free(defect_list);
4044 		defect_list = NULL;
4045 	}
4046 	defect_list = malloc(dlist_length);
4047 	if (defect_list == NULL) {
4048 		warnx("can't malloc memory for defect list");
4049 		error = 1;
4050 		goto defect_bailout;
4051 	}
4052 
4053 next_batch:
4054 	bzero(defect_list, dlist_length);
4055 
4056 	/*
4057 	 * cam_getccb() zeros the CCB header only.  So we need to zero the
4058 	 * payload portion of the ccb.
4059 	 */
4060 	CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
4061 
4062 	scsi_read_defects(&ccb->csio,
4063 			  /*retries*/ retry_count,
4064 			  /*cbfcnp*/ NULL,
4065 			  /*tag_action*/ task_attr,
4066 			  /*list_format*/ list_format,
4067 			  /*addr_desc_index*/ starting_offset,
4068 			  /*data_ptr*/ defect_list,
4069 			  /*dxfer_len*/ dlist_length,
4070 			  /*minimum_cmd_size*/ use_12byte ? 12 : 0,
4071 			  /*sense_len*/ SSD_FULL_SIZE,
4072 			  /*timeout*/ timeout ? timeout : 5000);
4073 
4074 	/* Disable freezing the device queue */
4075 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
4076 
4077 	if (cam_send_ccb(device, ccb) < 0) {
4078 		warn("error sending READ DEFECT DATA command");
4079 		error = 1;
4080 		goto defect_bailout;
4081 	}
4082 
4083 	valid_len = ccb->csio.dxfer_len - ccb->csio.resid;
4084 
4085 	if (!use_12byte) {
4086 		hdr10 = (struct scsi_read_defect_data_hdr_10 *)defect_list;
4087 		hdr_size = sizeof(*hdr10);
4088 		hdr_max = SRDDH10_MAX_LENGTH;
4089 
4090 		if (valid_len >= hdr_size) {
4091 			returned_length = scsi_2btoul(hdr10->length);
4092 			returned_format = hdr10->format;
4093 		} else {
4094 			returned_length = 0;
4095 			returned_format = 0;
4096 		}
4097 	} else {
4098 		hdr12 = (struct scsi_read_defect_data_hdr_12 *)defect_list;
4099 		hdr_size = sizeof(*hdr12);
4100 		hdr_max = SRDDH12_MAX_LENGTH;
4101 
4102 		if (valid_len >= hdr_size) {
4103 			returned_length = scsi_4btoul(hdr12->length);
4104 			returned_format = hdr12->format;
4105 		} else {
4106 			returned_length = 0;
4107 			returned_format = 0;
4108 		}
4109 	}
4110 
4111 	returned_type = returned_format & SRDDH10_DLIST_FORMAT_MASK;
4112 	switch (returned_type) {
4113 	case SRDD10_BLOCK_FORMAT:
4114 		entry_size = sizeof(struct scsi_defect_desc_block);
4115 		break;
4116 	case SRDD10_LONG_BLOCK_FORMAT:
4117 		entry_size = sizeof(struct scsi_defect_desc_long_block);
4118 		break;
4119 	case SRDD10_EXT_PHYS_FORMAT:
4120 	case SRDD10_PHYSICAL_SECTOR_FORMAT:
4121 		entry_size = sizeof(struct scsi_defect_desc_phys_sector);
4122 		break;
4123 	case SRDD10_EXT_BFI_FORMAT:
4124 	case SRDD10_BYTES_FROM_INDEX_FORMAT:
4125 		entry_size = sizeof(struct scsi_defect_desc_bytes_from_index);
4126 		break;
4127 	default:
4128 		warnx("Unknown defect format 0x%x\n", returned_type);
4129 		error = 1;
4130 		goto defect_bailout;
4131 		break;
4132 	}
4133 
4134 	max_possible_size = (hdr_max / entry_size) * entry_size;
4135 	num_returned = returned_length / entry_size;
4136 	num_valid = min(returned_length, valid_len - hdr_size);
4137 	num_valid /= entry_size;
4138 
4139 	if (get_length) {
4140 		get_length = false;
4141 
4142 		if ((ccb->ccb_h.status & CAM_STATUS_MASK) ==
4143 		     CAM_SCSI_STATUS_ERROR) {
4144 			struct scsi_sense_data *sense;
4145 			int error_code, sense_key, asc, ascq;
4146 
4147 			sense = &ccb->csio.sense_data;
4148 			scsi_extract_sense_len(sense, ccb->csio.sense_len -
4149 			    ccb->csio.sense_resid, &error_code, &sense_key,
4150 			    &asc, &ascq, /*show_errors*/ 1);
4151 
4152 			/*
4153 			 * If the drive is reporting that it just doesn't
4154 			 * support the defect list format, go ahead and use
4155 			 * the length it reported.  Otherwise, the length
4156 			 * may not be valid, so use the maximum.
4157 			 */
4158 			if ((sense_key == SSD_KEY_RECOVERED_ERROR)
4159 			 && (asc == 0x1c) && (ascq == 0x00)
4160 			 && (returned_length > 0)) {
4161 				if (!use_12byte
4162 				 && (returned_length >= max_possible_size)) {
4163 					goto retry_12byte;
4164 				}
4165 				dlist_length = returned_length + hdr_size;
4166 			} else if ((sense_key == SSD_KEY_RECOVERED_ERROR)
4167 				&& (asc == 0x1f) && (ascq == 0x00)
4168 				&& (returned_length > 0)) {
4169 				/* Partial defect list transfer */
4170 				/*
4171 				 * Hitachi drives return this error
4172 				 * along with a partial defect list if they
4173 				 * have more defects than the 10 byte
4174 				 * command can support.  Retry with the 12
4175 				 * byte command.
4176 				 */
4177 				if (!use_12byte) {
4178 					goto retry_12byte;
4179 				}
4180 				dlist_length = returned_length + hdr_size;
4181 			} else if ((sense_key == SSD_KEY_ILLEGAL_REQUEST)
4182 				&& (asc == 0x24) && (ascq == 0x00)) {
4183 				/* Invalid field in CDB */
4184 				/*
4185 				 * SBC-3 says that if the drive has more
4186 				 * defects than can be reported with the
4187 				 * 10 byte command, it should return this
4188 	 			 * error and no data.  Retry with the 12
4189 				 * byte command.
4190 				 */
4191 				if (!use_12byte) {
4192 					goto retry_12byte;
4193 				}
4194 				dlist_length = returned_length + hdr_size;
4195 			} else {
4196 				/*
4197 				 * If we got a SCSI error and no valid length,
4198 				 * just use the 10 byte maximum.  The 12
4199 				 * byte maximum is too large.
4200 				 */
4201 				if (returned_length == 0)
4202 					dlist_length = SRDD10_MAX_LENGTH;
4203 				else {
4204 					if (!use_12byte
4205 					 && (returned_length >=
4206 					     max_possible_size)) {
4207 						goto retry_12byte;
4208 					}
4209 					dlist_length = returned_length +
4210 					    hdr_size;
4211 				}
4212 			}
4213 		} else if ((ccb->ccb_h.status & CAM_STATUS_MASK) !=
4214 			    CAM_REQ_CMP){
4215 			error = 1;
4216 			warnx("Error reading defect header");
4217 			if (arglist & CAM_ARG_VERBOSE)
4218 				cam_error_print(device, ccb, CAM_ESF_ALL,
4219 						CAM_EPF_ALL, stderr);
4220 			goto defect_bailout;
4221 		} else {
4222 			if (!use_12byte
4223 			 && (returned_length >= max_possible_size)) {
4224 				goto retry_12byte;
4225 			}
4226 			dlist_length = returned_length + hdr_size;
4227 		}
4228 		if (summary) {
4229 			fprintf(stdout, "%u", num_returned);
4230 			if (!quiet) {
4231 				fprintf(stdout, " defect%s",
4232 					(num_returned != 1) ? "s" : "");
4233 			}
4234 			fprintf(stdout, "\n");
4235 
4236 			goto defect_bailout;
4237 		}
4238 
4239 		/*
4240 		 * We always limit the list length to the 10-byte maximum
4241 		 * length (0xffff).  The reason is that some controllers
4242 		 * can't handle larger I/Os, and we can transfer the entire
4243 		 * 10 byte list in one shot.  For drives that support the 12
4244 		 * byte read defects command, we'll step through the list
4245 		 * by specifying a starting offset.  For drives that don't
4246 		 * support the 12 byte command's starting offset, we'll
4247 		 * just display the first 64K.
4248 		 */
4249 		dlist_length = min(dlist_length, SRDD10_MAX_LENGTH);
4250 
4251 		goto retry;
4252 	}
4253 
4254 
4255 	if (((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_SCSI_STATUS_ERROR)
4256 	 && (ccb->csio.scsi_status == SCSI_STATUS_CHECK_COND)
4257 	 && ((ccb->ccb_h.status & CAM_AUTOSNS_VALID) != 0)) {
4258 		struct scsi_sense_data *sense;
4259 		int error_code, sense_key, asc, ascq;
4260 
4261 		sense = &ccb->csio.sense_data;
4262 		scsi_extract_sense_len(sense, ccb->csio.sense_len -
4263 		    ccb->csio.sense_resid, &error_code, &sense_key, &asc,
4264 		    &ascq, /*show_errors*/ 1);
4265 
4266 		/*
4267 		 * According to the SCSI spec, if the disk doesn't support
4268 		 * the requested format, it will generally return a sense
4269 		 * key of RECOVERED ERROR, and an additional sense code
4270 		 * of "DEFECT LIST NOT FOUND".  HGST drives also return
4271 		 * Primary/Grown defect list not found errors.  So just
4272 		 * check for an ASC of 0x1c.
4273 		 */
4274 		if ((sense_key == SSD_KEY_RECOVERED_ERROR)
4275 		 && (asc == 0x1c)) {
4276 			const char *format_str;
4277 
4278 			format_str = scsi_nv_to_str(defect_list_type_map,
4279 			    sizeof(defect_list_type_map) /
4280 			    sizeof(defect_list_type_map[0]),
4281 			    list_format & SRDD10_DLIST_FORMAT_MASK);
4282 			warnx("requested defect format %s not available",
4283 			    format_str ? format_str : "unknown");
4284 
4285 			format_str = scsi_nv_to_str(defect_list_type_map,
4286 			    sizeof(defect_list_type_map) /
4287 			    sizeof(defect_list_type_map[0]), returned_type);
4288 			if (format_str != NULL) {
4289 				warnx("Device returned %s format",
4290 				    format_str);
4291 			} else {
4292 				error = 1;
4293 				warnx("Device returned unknown defect"
4294 				     " data format %#x", returned_type);
4295 				goto defect_bailout;
4296 			}
4297 		} else {
4298 			error = 1;
4299 			warnx("Error returned from read defect data command");
4300 			if (arglist & CAM_ARG_VERBOSE)
4301 				cam_error_print(device, ccb, CAM_ESF_ALL,
4302 						CAM_EPF_ALL, stderr);
4303 			goto defect_bailout;
4304 		}
4305 	} else if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
4306 		error = 1;
4307 		warnx("Error returned from read defect data command");
4308 		if (arglist & CAM_ARG_VERBOSE)
4309 			cam_error_print(device, ccb, CAM_ESF_ALL,
4310 					CAM_EPF_ALL, stderr);
4311 		goto defect_bailout;
4312 	}
4313 
4314 	if (first_pass) {
4315 		fprintf(stderr, "Got %d defect", num_returned);
4316 
4317 		if (!summary || (num_returned == 0)) {
4318 			fprintf(stderr, "s.\n");
4319 			goto defect_bailout;
4320 		} else if (num_returned == 1)
4321 			fprintf(stderr, ":\n");
4322 		else
4323 			fprintf(stderr, "s:\n");
4324 
4325 		first_pass = false;
4326 	}
4327 
4328 	/*
4329 	 * XXX KDM  I should probably clean up the printout format for the
4330 	 * disk defects.
4331 	 */
4332 	switch (returned_type) {
4333 	case SRDD10_PHYSICAL_SECTOR_FORMAT:
4334 	case SRDD10_EXT_PHYS_FORMAT:
4335 	{
4336 		struct scsi_defect_desc_phys_sector *dlist;
4337 
4338 		dlist = (struct scsi_defect_desc_phys_sector *)
4339 			(defect_list + hdr_size);
4340 
4341 		for (i = 0; i < num_valid; i++) {
4342 			uint32_t sector;
4343 
4344 			sector = scsi_4btoul(dlist[i].sector);
4345 			if (returned_type == SRDD10_EXT_PHYS_FORMAT) {
4346 				mads = (sector & SDD_EXT_PHYS_MADS) ?
4347 				       0 : 1;
4348 				sector &= ~SDD_EXT_PHYS_FLAG_MASK;
4349 			}
4350 			if (!hex_format)
4351 				fprintf(stdout, "%d:%d:%d%s",
4352 					scsi_3btoul(dlist[i].cylinder),
4353 					dlist[i].head,
4354 					scsi_4btoul(dlist[i].sector),
4355 					mads ? " - " : "\n");
4356 			else
4357 				fprintf(stdout, "0x%x:0x%x:0x%x%s",
4358 					scsi_3btoul(dlist[i].cylinder),
4359 					dlist[i].head,
4360 					scsi_4btoul(dlist[i].sector),
4361 					mads ? " - " : "\n");
4362 			mads = 0;
4363 		}
4364 		if (num_valid < num_returned) {
4365 			starting_offset += num_valid;
4366 			goto next_batch;
4367 		}
4368 		break;
4369 	}
4370 	case SRDD10_BYTES_FROM_INDEX_FORMAT:
4371 	case SRDD10_EXT_BFI_FORMAT:
4372 	{
4373 		struct scsi_defect_desc_bytes_from_index *dlist;
4374 
4375 		dlist = (struct scsi_defect_desc_bytes_from_index *)
4376 			(defect_list + hdr_size);
4377 
4378 		for (i = 0; i < num_valid; i++) {
4379 			uint32_t bfi;
4380 
4381 			bfi = scsi_4btoul(dlist[i].bytes_from_index);
4382 			if (returned_type == SRDD10_EXT_BFI_FORMAT) {
4383 				mads = (bfi & SDD_EXT_BFI_MADS) ? 1 : 0;
4384 				bfi &= ~SDD_EXT_BFI_FLAG_MASK;
4385 			}
4386 			if (!hex_format)
4387 				fprintf(stdout, "%d:%d:%d%s",
4388 					scsi_3btoul(dlist[i].cylinder),
4389 					dlist[i].head,
4390 					scsi_4btoul(dlist[i].bytes_from_index),
4391 					mads ? " - " : "\n");
4392 			else
4393 				fprintf(stdout, "0x%x:0x%x:0x%x%s",
4394 					scsi_3btoul(dlist[i].cylinder),
4395 					dlist[i].head,
4396 					scsi_4btoul(dlist[i].bytes_from_index),
4397 					mads ? " - " : "\n");
4398 
4399 			mads = 0;
4400 		}
4401 		if (num_valid < num_returned) {
4402 			starting_offset += num_valid;
4403 			goto next_batch;
4404 		}
4405 		break;
4406 	}
4407 	case SRDDH10_BLOCK_FORMAT:
4408 	{
4409 		struct scsi_defect_desc_block *dlist;
4410 
4411 		dlist = (struct scsi_defect_desc_block *)
4412 			(defect_list + hdr_size);
4413 
4414 		for (i = 0; i < num_valid; i++) {
4415 			if (!hex_format)
4416 				fprintf(stdout, "%u\n",
4417 					scsi_4btoul(dlist[i].address));
4418 			else
4419 				fprintf(stdout, "0x%x\n",
4420 					scsi_4btoul(dlist[i].address));
4421 		}
4422 
4423 		if (num_valid < num_returned) {
4424 			starting_offset += num_valid;
4425 			goto next_batch;
4426 		}
4427 
4428 		break;
4429 	}
4430 	case SRDD10_LONG_BLOCK_FORMAT:
4431 	{
4432 		struct scsi_defect_desc_long_block *dlist;
4433 
4434 		dlist = (struct scsi_defect_desc_long_block *)
4435 			(defect_list + hdr_size);
4436 
4437 		for (i = 0; i < num_valid; i++) {
4438 			if (!hex_format)
4439 				fprintf(stdout, "%ju\n",
4440 					(uintmax_t)scsi_8btou64(
4441 					dlist[i].address));
4442 			else
4443 				fprintf(stdout, "0x%jx\n",
4444 					(uintmax_t)scsi_8btou64(
4445 					dlist[i].address));
4446 		}
4447 
4448 		if (num_valid < num_returned) {
4449 			starting_offset += num_valid;
4450 			goto next_batch;
4451 		}
4452 		break;
4453 	}
4454 	default:
4455 		fprintf(stderr, "Unknown defect format 0x%x\n",
4456 			returned_type);
4457 		error = 1;
4458 		break;
4459 	}
4460 defect_bailout:
4461 
4462 	if (defect_list != NULL)
4463 		free(defect_list);
4464 
4465 	if (ccb != NULL)
4466 		cam_freeccb(ccb);
4467 
4468 	return (error);
4469 }
4470 
4471 #if 0
4472 void
4473 reassignblocks(struct cam_device *device, uint32_t *blocks, int num_blocks)
4474 {
4475 	union ccb *ccb;
4476 
4477 	ccb = cam_getccb(device);
4478 
4479 	cam_freeccb(ccb);
4480 }
4481 #endif
4482 
4483 void
4484 mode_sense(struct cam_device *device, int *cdb_len, int dbd, int llbaa, int pc,
4485     int page, int subpage, int task_attr, int retry_count, int timeout,
4486     uint8_t *data, int datalen)
4487 {
4488 	union ccb *ccb;
4489 	int error_code, sense_key, asc, ascq;
4490 
4491 	ccb = cam_getccb(device);
4492 	if (ccb == NULL)
4493 		errx(1, "mode_sense: couldn't allocate CCB");
4494 
4495 retry:
4496 	/*
4497 	 * MODE SENSE(6) can't handle more then 255 bytes.  If there are more,
4498 	 * device must return error, so we should not get truncated data.
4499 	 */
4500 	if (*cdb_len == 6 && datalen > 255)
4501 		datalen = 255;
4502 
4503 	CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
4504 
4505 	scsi_mode_sense_subpage(&ccb->csio,
4506 			/* retries */ retry_count,
4507 			/* cbfcnp */ NULL,
4508 			/* tag_action */ task_attr,
4509 			/* dbd */ dbd,
4510 			/* pc */ pc << 6,
4511 			/* page */ page,
4512 			/* subpage */ subpage,
4513 			/* param_buf */ data,
4514 			/* param_len */ datalen,
4515 			/* minimum_cmd_size */ *cdb_len,
4516 			/* sense_len */ SSD_FULL_SIZE,
4517 			/* timeout */ timeout ? timeout : 5000);
4518 	if (llbaa && ccb->csio.cdb_len == 10) {
4519 		struct scsi_mode_sense_10 *cdb =
4520 		    (struct scsi_mode_sense_10 *)ccb->csio.cdb_io.cdb_bytes;
4521 		cdb->byte2 |= SMS10_LLBAA;
4522 	}
4523 
4524 	/* Record what CDB size the above function really set. */
4525 	*cdb_len = ccb->csio.cdb_len;
4526 
4527 	if (arglist & CAM_ARG_ERR_RECOVER)
4528 		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
4529 
4530 	/* Disable freezing the device queue */
4531 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
4532 
4533 	if (cam_send_ccb(device, ccb) < 0)
4534 		err(1, "error sending mode sense command");
4535 
4536 	/* In case of ILLEGEL REQUEST try to fall back to 6-byte command. */
4537 	if (*cdb_len != 6 &&
4538 	    ((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_INVALID ||
4539 	     (scsi_extract_sense_ccb(ccb, &error_code, &sense_key, &asc, &ascq)
4540 	      && sense_key == SSD_KEY_ILLEGAL_REQUEST))) {
4541 		*cdb_len = 6;
4542 		goto retry;
4543 	}
4544 
4545 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
4546 		if (arglist & CAM_ARG_VERBOSE) {
4547 			cam_error_print(device, ccb, CAM_ESF_ALL,
4548 					CAM_EPF_ALL, stderr);
4549 		}
4550 		cam_freeccb(ccb);
4551 		cam_close_device(device);
4552 		errx(1, "mode sense command returned error");
4553 	}
4554 
4555 	cam_freeccb(ccb);
4556 }
4557 
4558 void
4559 mode_select(struct cam_device *device, int cdb_len, int save_pages,
4560     int task_attr, int retry_count, int timeout, uint8_t *data, int datalen)
4561 {
4562 	union ccb *ccb;
4563 	int retval;
4564 
4565 	ccb = cam_getccb(device);
4566 
4567 	if (ccb == NULL)
4568 		errx(1, "mode_select: couldn't allocate CCB");
4569 
4570 	scsi_mode_select_len(&ccb->csio,
4571 			 /* retries */ retry_count,
4572 			 /* cbfcnp */ NULL,
4573 			 /* tag_action */ task_attr,
4574 			 /* scsi_page_fmt */ 1,
4575 			 /* save_pages */ save_pages,
4576 			 /* param_buf */ data,
4577 			 /* param_len */ datalen,
4578 			 /* minimum_cmd_size */ cdb_len,
4579 			 /* sense_len */ SSD_FULL_SIZE,
4580 			 /* timeout */ timeout ? timeout : 5000);
4581 
4582 	if (arglist & CAM_ARG_ERR_RECOVER)
4583 		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
4584 
4585 	/* Disable freezing the device queue */
4586 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
4587 
4588 	if (((retval = cam_send_ccb(device, ccb)) < 0)
4589 	 || ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP)) {
4590 		if (arglist & CAM_ARG_VERBOSE) {
4591 			cam_error_print(device, ccb, CAM_ESF_ALL,
4592 					CAM_EPF_ALL, stderr);
4593 		}
4594 		cam_freeccb(ccb);
4595 		cam_close_device(device);
4596 
4597 		if (retval < 0)
4598 			err(1, "error sending mode select command");
4599 		else
4600 			errx(1, "error sending mode select command");
4601 
4602 	}
4603 
4604 	cam_freeccb(ccb);
4605 }
4606 
4607 void
4608 modepage(struct cam_device *device, int argc, char **argv, char *combinedopt,
4609 	 int task_attr, int retry_count, int timeout)
4610 {
4611 	char *str_subpage;
4612 	int c, page = -1, subpage = 0, pc = 0, llbaa = 0;
4613 	int binary = 0, cdb_len = 10, dbd = 0, desc = 0, edit = 0, list = 0;
4614 
4615 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
4616 		switch(c) {
4617 		case '6':
4618 			cdb_len = 6;
4619 			break;
4620 		case 'b':
4621 			binary = 1;
4622 			break;
4623 		case 'd':
4624 			dbd = 1;
4625 			break;
4626 		case 'e':
4627 			edit = 1;
4628 			break;
4629 		case 'l':
4630 			list++;
4631 			break;
4632 		case 'm':
4633 			str_subpage = optarg;
4634 			strsep(&str_subpage, ",");
4635 			page = strtol(optarg, NULL, 0);
4636 			if (str_subpage)
4637 			    subpage = strtol(str_subpage, NULL, 0);
4638 			if (page < 0 || page > 0x3f)
4639 				errx(1, "invalid mode page %d", page);
4640 			if (subpage < 0 || subpage > 0xff)
4641 				errx(1, "invalid mode subpage %d", subpage);
4642 			break;
4643 		case 'D':
4644 			desc = 1;
4645 			break;
4646 		case 'L':
4647 			llbaa = 1;
4648 			break;
4649 		case 'P':
4650 			pc = strtol(optarg, NULL, 0);
4651 			if ((pc < 0) || (pc > 3))
4652 				errx(1, "invalid page control field %d", pc);
4653 			break;
4654 		default:
4655 			break;
4656 		}
4657 	}
4658 
4659 	if (desc && page == -1)
4660 		page = SMS_ALL_PAGES_PAGE;
4661 
4662 	if (page == -1 && list == 0)
4663 		errx(1, "you must specify a mode page!");
4664 
4665 	if (dbd && desc)
4666 		errx(1, "-d and -D are incompatible!");
4667 
4668 	if (llbaa && cdb_len != 10)
4669 		errx(1, "LLBAA bit is not present in MODE SENSE(6)!");
4670 
4671 	if (list != 0) {
4672 		mode_list(device, cdb_len, dbd, pc, list > 1, task_attr,
4673 		    retry_count, timeout);
4674 	} else {
4675 		mode_edit(device, cdb_len, desc, dbd, llbaa, pc, page, subpage,
4676 		    edit, binary, task_attr, retry_count, timeout);
4677 	}
4678 }
4679 
4680 static int
4681 scsicmd(struct cam_device *device, int argc, char **argv, char *combinedopt,
4682 	int task_attr, int retry_count, int timeout)
4683 {
4684 	union ccb *ccb;
4685 	uint32_t flags = CAM_DIR_NONE;
4686 	uint8_t *data_ptr = NULL;
4687 	uint8_t cdb[20];
4688 	uint8_t atacmd[12];
4689 	struct get_hook hook;
4690 	int c, data_bytes = 0, valid_bytes;
4691 	int cdb_len = 0;
4692 	int atacmd_len = 0;
4693 	int dmacmd = 0;
4694 	int fpdmacmd = 0;
4695 	int need_res = 0;
4696 	char *datastr = NULL, *tstr, *resstr = NULL;
4697 	int error = 0;
4698 	int fd_data = 0, fd_res = 0;
4699 	int retval;
4700 
4701 	ccb = cam_getccb(device);
4702 
4703 	if (ccb == NULL) {
4704 		warnx("scsicmd: error allocating ccb");
4705 		return (1);
4706 	}
4707 
4708 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
4709 		switch(c) {
4710 		case 'a':
4711 			tstr = optarg;
4712 			while (isspace(*tstr) && (*tstr != '\0'))
4713 				tstr++;
4714 			hook.argc = argc - optind;
4715 			hook.argv = argv + optind;
4716 			hook.got = 0;
4717 			atacmd_len = buff_encode_visit(atacmd, sizeof(atacmd), tstr,
4718 						    iget, &hook);
4719 			/*
4720 			 * Increment optind by the number of arguments the
4721 			 * encoding routine processed.  After each call to
4722 			 * getopt(3), optind points to the argument that
4723 			 * getopt should process _next_.  In this case,
4724 			 * that means it points to the first command string
4725 			 * argument, if there is one.  Once we increment
4726 			 * this, it should point to either the next command
4727 			 * line argument, or it should be past the end of
4728 			 * the list.
4729 			 */
4730 			optind += hook.got;
4731 			break;
4732 		case 'c':
4733 			tstr = optarg;
4734 			while (isspace(*tstr) && (*tstr != '\0'))
4735 				tstr++;
4736 			hook.argc = argc - optind;
4737 			hook.argv = argv + optind;
4738 			hook.got = 0;
4739 			cdb_len = buff_encode_visit(cdb, sizeof(cdb), tstr,
4740 						    iget, &hook);
4741 			/*
4742 			 * Increment optind by the number of arguments the
4743 			 * encoding routine processed.  After each call to
4744 			 * getopt(3), optind points to the argument that
4745 			 * getopt should process _next_.  In this case,
4746 			 * that means it points to the first command string
4747 			 * argument, if there is one.  Once we increment
4748 			 * this, it should point to either the next command
4749 			 * line argument, or it should be past the end of
4750 			 * the list.
4751 			 */
4752 			optind += hook.got;
4753 			break;
4754 		case 'd':
4755 			dmacmd = 1;
4756 			break;
4757 		case 'f':
4758 			fpdmacmd = 1;
4759 			break;
4760 		case 'i':
4761 			if (arglist & CAM_ARG_CMD_OUT) {
4762 				warnx("command must either be "
4763 				      "read or write, not both");
4764 				error = 1;
4765 				goto scsicmd_bailout;
4766 			}
4767 			arglist |= CAM_ARG_CMD_IN;
4768 			flags = CAM_DIR_IN;
4769 			data_bytes = strtol(optarg, NULL, 0);
4770 			if (data_bytes <= 0) {
4771 				warnx("invalid number of input bytes %d",
4772 				      data_bytes);
4773 				error = 1;
4774 				goto scsicmd_bailout;
4775 			}
4776 			hook.argc = argc - optind;
4777 			hook.argv = argv + optind;
4778 			hook.got = 0;
4779 			optind++;
4780 			datastr = cget(&hook, NULL);
4781 			/*
4782 			 * If the user supplied "-" instead of a format, he
4783 			 * wants the data to be written to stdout.
4784 			 */
4785 			if ((datastr != NULL)
4786 			 && (datastr[0] == '-'))
4787 				fd_data = 1;
4788 
4789 			data_ptr = (uint8_t *)malloc(data_bytes);
4790 			if (data_ptr == NULL) {
4791 				warnx("can't malloc memory for data_ptr");
4792 				error = 1;
4793 				goto scsicmd_bailout;
4794 			}
4795 			break;
4796 		case 'o':
4797 			if (arglist & CAM_ARG_CMD_IN) {
4798 				warnx("command must either be "
4799 				      "read or write, not both");
4800 				error = 1;
4801 				goto scsicmd_bailout;
4802 			}
4803 			arglist |= CAM_ARG_CMD_OUT;
4804 			flags = CAM_DIR_OUT;
4805 			data_bytes = strtol(optarg, NULL, 0);
4806 			if (data_bytes <= 0) {
4807 				warnx("invalid number of output bytes %d",
4808 				      data_bytes);
4809 				error = 1;
4810 				goto scsicmd_bailout;
4811 			}
4812 			hook.argc = argc - optind;
4813 			hook.argv = argv + optind;
4814 			hook.got = 0;
4815 			datastr = cget(&hook, NULL);
4816 			data_ptr = (uint8_t *)malloc(data_bytes);
4817 			if (data_ptr == NULL) {
4818 				warnx("can't malloc memory for data_ptr");
4819 				error = 1;
4820 				goto scsicmd_bailout;
4821 			}
4822 			bzero(data_ptr, data_bytes);
4823 			/*
4824 			 * If the user supplied "-" instead of a format, he
4825 			 * wants the data to be read from stdin.
4826 			 */
4827 			if ((datastr != NULL)
4828 			 && (datastr[0] == '-'))
4829 				fd_data = 1;
4830 			else
4831 				buff_encode_visit(data_ptr, data_bytes, datastr,
4832 						  iget, &hook);
4833 			optind += hook.got;
4834 			break;
4835 		case 'r':
4836 			need_res = 1;
4837 			hook.argc = argc - optind;
4838 			hook.argv = argv + optind;
4839 			hook.got = 0;
4840 			resstr = cget(&hook, NULL);
4841 			if ((resstr != NULL) && (resstr[0] == '-'))
4842 				fd_res = 1;
4843 			optind += hook.got;
4844 			break;
4845 		default:
4846 			break;
4847 		}
4848 	}
4849 
4850 	/*
4851 	 * If fd_data is set, and we're writing to the device, we need to
4852 	 * read the data the user wants written from stdin.
4853 	 */
4854 	if ((fd_data == 1) && (arglist & CAM_ARG_CMD_OUT)) {
4855 		ssize_t amt_read;
4856 		int amt_to_read = data_bytes;
4857 		uint8_t *buf_ptr = data_ptr;
4858 
4859 		for (amt_read = 0; amt_to_read > 0;
4860 		     amt_read = read(STDIN_FILENO, buf_ptr, amt_to_read)) {
4861 			if (amt_read == -1) {
4862 				warn("error reading data from stdin");
4863 				error = 1;
4864 				goto scsicmd_bailout;
4865 			}
4866 			amt_to_read -= amt_read;
4867 			buf_ptr += amt_read;
4868 		}
4869 	}
4870 
4871 	if (arglist & CAM_ARG_ERR_RECOVER)
4872 		flags |= CAM_PASS_ERR_RECOVER;
4873 
4874 	/* Disable freezing the device queue */
4875 	flags |= CAM_DEV_QFRZDIS;
4876 
4877 	if (cdb_len) {
4878 		/*
4879 		 * This is taken from the SCSI-3 draft spec.
4880 		 * (T10/1157D revision 0.3)
4881 		 * The top 3 bits of an opcode are the group code.
4882 		 * The next 5 bits are the command code.
4883 		 * Group 0:  six byte commands
4884 		 * Group 1:  ten byte commands
4885 		 * Group 2:  ten byte commands
4886 		 * Group 3:  reserved
4887 		 * Group 4:  sixteen byte commands
4888 		 * Group 5:  twelve byte commands
4889 		 * Group 6:  vendor specific
4890 		 * Group 7:  vendor specific
4891 		 */
4892 		switch((cdb[0] >> 5) & 0x7) {
4893 			case 0:
4894 				cdb_len = 6;
4895 				break;
4896 			case 1:
4897 			case 2:
4898 				cdb_len = 10;
4899 				break;
4900 			case 3:
4901 			case 6:
4902 			case 7:
4903 				/* computed by buff_encode_visit */
4904 				break;
4905 			case 4:
4906 				cdb_len = 16;
4907 				break;
4908 			case 5:
4909 				cdb_len = 12;
4910 				break;
4911 		}
4912 
4913 		/*
4914 		 * We should probably use csio_build_visit or something like that
4915 		 * here, but it's easier to encode arguments as you go.  The
4916 		 * alternative would be skipping the CDB argument and then encoding
4917 		 * it here, since we've got the data buffer argument by now.
4918 		 */
4919 		bcopy(cdb, &ccb->csio.cdb_io.cdb_bytes, cdb_len);
4920 
4921 		cam_fill_csio(&ccb->csio,
4922 		      /*retries*/ retry_count,
4923 		      /*cbfcnp*/ NULL,
4924 		      /*flags*/ flags,
4925 		      /*tag_action*/ task_attr,
4926 		      /*data_ptr*/ data_ptr,
4927 		      /*dxfer_len*/ data_bytes,
4928 		      /*sense_len*/ SSD_FULL_SIZE,
4929 		      /*cdb_len*/ cdb_len,
4930 		      /*timeout*/ timeout ? timeout : 5000);
4931 	} else {
4932 		atacmd_len = 12;
4933 		bcopy(atacmd, &ccb->ataio.cmd.command, atacmd_len);
4934 		if (need_res)
4935 			ccb->ataio.cmd.flags |= CAM_ATAIO_NEEDRESULT;
4936 		if (dmacmd)
4937 			ccb->ataio.cmd.flags |= CAM_ATAIO_DMA;
4938 		if (fpdmacmd)
4939 			ccb->ataio.cmd.flags |= CAM_ATAIO_FPDMA;
4940 
4941 		cam_fill_ataio(&ccb->ataio,
4942 		      /*retries*/ retry_count,
4943 		      /*cbfcnp*/ NULL,
4944 		      /*flags*/ flags,
4945 		      /*tag_action*/ 0,
4946 		      /*data_ptr*/ data_ptr,
4947 		      /*dxfer_len*/ data_bytes,
4948 		      /*timeout*/ timeout ? timeout : 5000);
4949 	}
4950 
4951 	if (((retval = cam_send_ccb(device, ccb)) < 0)
4952 	 || ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP)) {
4953 		const char warnstr[] = "error sending command";
4954 
4955 		if (retval < 0)
4956 			warn(warnstr);
4957 		else
4958 			warnx(warnstr);
4959 
4960 		if (arglist & CAM_ARG_VERBOSE) {
4961 			cam_error_print(device, ccb, CAM_ESF_ALL,
4962 					CAM_EPF_ALL, stderr);
4963 		}
4964 
4965 		error = 1;
4966 		goto scsicmd_bailout;
4967 	}
4968 
4969 	if (atacmd_len && need_res) {
4970 		if (fd_res == 0) {
4971 			buff_decode_visit(&ccb->ataio.res.status, 11, resstr,
4972 					  arg_put, NULL);
4973 			fprintf(stdout, "\n");
4974 		} else {
4975 			fprintf(stdout,
4976 			    "%02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X\n",
4977 			    ccb->ataio.res.status,
4978 			    ccb->ataio.res.error,
4979 			    ccb->ataio.res.lba_low,
4980 			    ccb->ataio.res.lba_mid,
4981 			    ccb->ataio.res.lba_high,
4982 			    ccb->ataio.res.device,
4983 			    ccb->ataio.res.lba_low_exp,
4984 			    ccb->ataio.res.lba_mid_exp,
4985 			    ccb->ataio.res.lba_high_exp,
4986 			    ccb->ataio.res.sector_count,
4987 			    ccb->ataio.res.sector_count_exp);
4988 			fflush(stdout);
4989 		}
4990 	}
4991 
4992 	if (cdb_len)
4993 		valid_bytes = ccb->csio.dxfer_len - ccb->csio.resid;
4994 	else
4995 		valid_bytes = ccb->ataio.dxfer_len - ccb->ataio.resid;
4996 	if (((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP)
4997 	 && (arglist & CAM_ARG_CMD_IN)
4998 	 && (valid_bytes > 0)) {
4999 		if (fd_data == 0) {
5000 			buff_decode_visit(data_ptr, valid_bytes, datastr,
5001 					  arg_put, NULL);
5002 			fprintf(stdout, "\n");
5003 		} else {
5004 			ssize_t amt_written;
5005 			int amt_to_write = valid_bytes;
5006 			uint8_t *buf_ptr = data_ptr;
5007 
5008 			for (amt_written = 0; (amt_to_write > 0) &&
5009 			     (amt_written =write(1, buf_ptr,amt_to_write))> 0;){
5010 				amt_to_write -= amt_written;
5011 				buf_ptr += amt_written;
5012 			}
5013 			if (amt_written == -1) {
5014 				warn("error writing data to stdout");
5015 				error = 1;
5016 				goto scsicmd_bailout;
5017 			} else if ((amt_written == 0)
5018 				&& (amt_to_write > 0)) {
5019 				warnx("only wrote %u bytes out of %u",
5020 				      valid_bytes - amt_to_write, valid_bytes);
5021 			}
5022 		}
5023 	}
5024 
5025 scsicmd_bailout:
5026 
5027 	if ((data_bytes > 0) && (data_ptr != NULL))
5028 		free(data_ptr);
5029 
5030 	cam_freeccb(ccb);
5031 
5032 	return (error);
5033 }
5034 
5035 static int
5036 camdebug(int argc, char **argv, char *combinedopt)
5037 {
5038 	int c, fd;
5039 	path_id_t bus = CAM_BUS_WILDCARD;
5040 	target_id_t target = CAM_TARGET_WILDCARD;
5041 	lun_id_t lun = CAM_LUN_WILDCARD;
5042 	char *tstr;
5043 	union ccb ccb;
5044 	int error = 0, rv;
5045 
5046 	bzero(&ccb, sizeof(union ccb));
5047 
5048 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
5049 		switch(c) {
5050 		case 'I':
5051 			arglist |= CAM_ARG_DEBUG_INFO;
5052 			ccb.cdbg.flags |= CAM_DEBUG_INFO;
5053 			break;
5054 		case 'P':
5055 			arglist |= CAM_ARG_DEBUG_PERIPH;
5056 			ccb.cdbg.flags |= CAM_DEBUG_PERIPH;
5057 			break;
5058 		case 'S':
5059 			arglist |= CAM_ARG_DEBUG_SUBTRACE;
5060 			ccb.cdbg.flags |= CAM_DEBUG_SUBTRACE;
5061 			break;
5062 		case 'T':
5063 			arglist |= CAM_ARG_DEBUG_TRACE;
5064 			ccb.cdbg.flags |= CAM_DEBUG_TRACE;
5065 			break;
5066 		case 'X':
5067 			arglist |= CAM_ARG_DEBUG_XPT;
5068 			ccb.cdbg.flags |= CAM_DEBUG_XPT;
5069 			break;
5070 		case 'c':
5071 			arglist |= CAM_ARG_DEBUG_CDB;
5072 			ccb.cdbg.flags |= CAM_DEBUG_CDB;
5073 			break;
5074 		case 'p':
5075 			arglist |= CAM_ARG_DEBUG_PROBE;
5076 			ccb.cdbg.flags |= CAM_DEBUG_PROBE;
5077 			break;
5078 		default:
5079 			break;
5080 		}
5081 	}
5082 
5083 	argc -= optind;
5084 	argv += optind;
5085 
5086 	if (argc <= 0) {
5087 		warnx("you must specify \"off\", \"all\" or a bus,");
5088 		warnx("bus:target, bus:target:lun or periph");
5089 		return (1);
5090 	}
5091 
5092 	tstr = *argv;
5093 	while (isspace(*tstr) && (*tstr != '\0'))
5094 		tstr++;
5095 
5096 	if (strncmp(tstr, "off", 3) == 0) {
5097 		ccb.cdbg.flags = CAM_DEBUG_NONE;
5098 		arglist &= ~(CAM_ARG_DEBUG_INFO|CAM_ARG_DEBUG_PERIPH|
5099 			     CAM_ARG_DEBUG_TRACE|CAM_ARG_DEBUG_SUBTRACE|
5100 			     CAM_ARG_DEBUG_XPT|CAM_ARG_DEBUG_PROBE);
5101 	} else {
5102 		rv = parse_btl(tstr, &bus, &target, &lun, &arglist);
5103 		if (rv < 1) {
5104 			warnx("you must specify \"all\", \"off\", or a bus,");
5105 			warnx("bus:target, bus:target:lun or periph to debug");
5106 			return (1);
5107 		}
5108 	}
5109 
5110 	if ((fd = open(XPT_DEVICE, O_RDWR)) < 0) {
5111 		warnx("error opening transport layer device %s", XPT_DEVICE);
5112 		warn("%s", XPT_DEVICE);
5113 		return (1);
5114 	}
5115 
5116 	ccb.ccb_h.func_code = XPT_DEBUG;
5117 	ccb.ccb_h.path_id = bus;
5118 	ccb.ccb_h.target_id = target;
5119 	ccb.ccb_h.target_lun = lun;
5120 
5121 	if (ioctl(fd, CAMIOCOMMAND, &ccb) == -1) {
5122 		warn("CAMIOCOMMAND ioctl failed");
5123 		error = 1;
5124 	} else {
5125 		if ((ccb.ccb_h.status & CAM_STATUS_MASK) ==
5126 		     CAM_FUNC_NOTAVAIL) {
5127 			warnx("CAM debugging not available");
5128 			warnx("you need to put options CAMDEBUG in"
5129 			      " your kernel config file!");
5130 			error = 1;
5131 		} else if ((ccb.ccb_h.status & CAM_STATUS_MASK) !=
5132 			    CAM_REQ_CMP) {
5133 			warnx("XPT_DEBUG CCB failed with status %#x",
5134 			      ccb.ccb_h.status);
5135 			error = 1;
5136 		} else {
5137 			if (ccb.cdbg.flags == CAM_DEBUG_NONE) {
5138 				fprintf(stderr,
5139 					"Debugging turned off\n");
5140 			} else {
5141 				fprintf(stderr,
5142 					"Debugging enabled for "
5143 					"%d:%d:%jx\n",
5144 					bus, target, (uintmax_t)lun);
5145 			}
5146 		}
5147 	}
5148 	close(fd);
5149 
5150 	return (error);
5151 }
5152 
5153 static int
5154 tagcontrol(struct cam_device *device, int argc, char **argv,
5155 	   char *combinedopt)
5156 {
5157 	int c;
5158 	union ccb *ccb;
5159 	int numtags = -1;
5160 	int retval = 0;
5161 	int quiet = 0;
5162 	char pathstr[1024];
5163 
5164 	ccb = cam_getccb(device);
5165 
5166 	if (ccb == NULL) {
5167 		warnx("tagcontrol: error allocating ccb");
5168 		return (1);
5169 	}
5170 
5171 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
5172 		switch(c) {
5173 		case 'N':
5174 			numtags = strtol(optarg, NULL, 0);
5175 			if (numtags < 0) {
5176 				warnx("tag count %d is < 0", numtags);
5177 				retval = 1;
5178 				goto tagcontrol_bailout;
5179 			}
5180 			break;
5181 		case 'q':
5182 			quiet++;
5183 			break;
5184 		default:
5185 			break;
5186 		}
5187 	}
5188 
5189 	cam_path_string(device, pathstr, sizeof(pathstr));
5190 
5191 	if (numtags >= 0) {
5192 		ccb->ccb_h.func_code = XPT_REL_SIMQ;
5193 		ccb->ccb_h.flags = CAM_DEV_QFREEZE;
5194 		ccb->crs.release_flags = RELSIM_ADJUST_OPENINGS;
5195 		ccb->crs.openings = numtags;
5196 
5197 
5198 		if (cam_send_ccb(device, ccb) < 0) {
5199 			warn("error sending XPT_REL_SIMQ CCB");
5200 			retval = 1;
5201 			goto tagcontrol_bailout;
5202 		}
5203 
5204 		if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
5205 			warnx("XPT_REL_SIMQ CCB failed");
5206 			cam_error_print(device, ccb, CAM_ESF_ALL,
5207 					CAM_EPF_ALL, stderr);
5208 			retval = 1;
5209 			goto tagcontrol_bailout;
5210 		}
5211 
5212 
5213 		if (quiet == 0)
5214 			fprintf(stdout, "%stagged openings now %d\n",
5215 				pathstr, ccb->crs.openings);
5216 	}
5217 
5218 	CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->cgds);
5219 
5220 	ccb->ccb_h.func_code = XPT_GDEV_STATS;
5221 
5222 	if (cam_send_ccb(device, ccb) < 0) {
5223 		warn("error sending XPT_GDEV_STATS CCB");
5224 		retval = 1;
5225 		goto tagcontrol_bailout;
5226 	}
5227 
5228 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
5229 		warnx("XPT_GDEV_STATS CCB failed");
5230 		cam_error_print(device, ccb, CAM_ESF_ALL,
5231 				CAM_EPF_ALL, stderr);
5232 		retval = 1;
5233 		goto tagcontrol_bailout;
5234 	}
5235 
5236 	if (arglist & CAM_ARG_VERBOSE) {
5237 		fprintf(stdout, "%s", pathstr);
5238 		fprintf(stdout, "dev_openings  %d\n", ccb->cgds.dev_openings);
5239 		fprintf(stdout, "%s", pathstr);
5240 		fprintf(stdout, "dev_active    %d\n", ccb->cgds.dev_active);
5241 		fprintf(stdout, "%s", pathstr);
5242 		fprintf(stdout, "allocated     %d\n", ccb->cgds.allocated);
5243 		fprintf(stdout, "%s", pathstr);
5244 		fprintf(stdout, "queued        %d\n", ccb->cgds.queued);
5245 		fprintf(stdout, "%s", pathstr);
5246 		fprintf(stdout, "held          %d\n", ccb->cgds.held);
5247 		fprintf(stdout, "%s", pathstr);
5248 		fprintf(stdout, "mintags       %d\n", ccb->cgds.mintags);
5249 		fprintf(stdout, "%s", pathstr);
5250 		fprintf(stdout, "maxtags       %d\n", ccb->cgds.maxtags);
5251 	} else {
5252 		if (quiet == 0) {
5253 			fprintf(stdout, "%s", pathstr);
5254 			fprintf(stdout, "device openings: ");
5255 		}
5256 		fprintf(stdout, "%d\n", ccb->cgds.dev_openings +
5257 			ccb->cgds.dev_active);
5258 	}
5259 
5260 tagcontrol_bailout:
5261 
5262 	cam_freeccb(ccb);
5263 	return (retval);
5264 }
5265 
5266 static void
5267 cts_print(struct cam_device *device, struct ccb_trans_settings *cts)
5268 {
5269 	char pathstr[1024];
5270 
5271 	cam_path_string(device, pathstr, sizeof(pathstr));
5272 
5273 	if (cts->transport == XPORT_SPI) {
5274 		struct ccb_trans_settings_spi *spi =
5275 		    &cts->xport_specific.spi;
5276 
5277 		if ((spi->valid & CTS_SPI_VALID_SYNC_RATE) != 0) {
5278 
5279 			fprintf(stdout, "%ssync parameter: %d\n", pathstr,
5280 				spi->sync_period);
5281 
5282 			if (spi->sync_offset != 0) {
5283 				u_int freq;
5284 
5285 				freq = scsi_calc_syncsrate(spi->sync_period);
5286 				fprintf(stdout, "%sfrequency: %d.%03dMHz\n",
5287 					pathstr, freq / 1000, freq % 1000);
5288 			}
5289 		}
5290 
5291 		if (spi->valid & CTS_SPI_VALID_SYNC_OFFSET) {
5292 			fprintf(stdout, "%soffset: %d\n", pathstr,
5293 			    spi->sync_offset);
5294 		}
5295 
5296 		if (spi->valid & CTS_SPI_VALID_BUS_WIDTH) {
5297 			fprintf(stdout, "%sbus width: %d bits\n", pathstr,
5298 				(0x01 << spi->bus_width) * 8);
5299 		}
5300 
5301 		if (spi->valid & CTS_SPI_VALID_DISC) {
5302 			fprintf(stdout, "%sdisconnection is %s\n", pathstr,
5303 				(spi->flags & CTS_SPI_FLAGS_DISC_ENB) ?
5304 				"enabled" : "disabled");
5305 		}
5306 	}
5307 	if (cts->transport == XPORT_FC) {
5308 		struct ccb_trans_settings_fc *fc =
5309 		    &cts->xport_specific.fc;
5310 
5311 		if (fc->valid & CTS_FC_VALID_WWNN)
5312 			fprintf(stdout, "%sWWNN: 0x%llx\n", pathstr,
5313 			    (long long) fc->wwnn);
5314 		if (fc->valid & CTS_FC_VALID_WWPN)
5315 			fprintf(stdout, "%sWWPN: 0x%llx\n", pathstr,
5316 			    (long long) fc->wwpn);
5317 		if (fc->valid & CTS_FC_VALID_PORT)
5318 			fprintf(stdout, "%sPortID: 0x%x\n", pathstr, fc->port);
5319 		if (fc->valid & CTS_FC_VALID_SPEED)
5320 			fprintf(stdout, "%stransfer speed: %d.%03dMB/s\n",
5321 			    pathstr, fc->bitrate / 1000, fc->bitrate % 1000);
5322 	}
5323 	if (cts->transport == XPORT_SAS) {
5324 		struct ccb_trans_settings_sas *sas =
5325 		    &cts->xport_specific.sas;
5326 
5327 		if (sas->valid & CTS_SAS_VALID_SPEED)
5328 			fprintf(stdout, "%stransfer speed: %d.%03dMB/s\n",
5329 			    pathstr, sas->bitrate / 1000, sas->bitrate % 1000);
5330 	}
5331 	if (cts->transport == XPORT_ATA) {
5332 		struct ccb_trans_settings_pata *pata =
5333 		    &cts->xport_specific.ata;
5334 
5335 		if ((pata->valid & CTS_ATA_VALID_MODE) != 0) {
5336 			fprintf(stdout, "%sATA mode: %s\n", pathstr,
5337 				ata_mode2string(pata->mode));
5338 		}
5339 		if ((pata->valid & CTS_ATA_VALID_ATAPI) != 0) {
5340 			fprintf(stdout, "%sATAPI packet length: %d\n", pathstr,
5341 				pata->atapi);
5342 		}
5343 		if ((pata->valid & CTS_ATA_VALID_BYTECOUNT) != 0) {
5344 			fprintf(stdout, "%sPIO transaction length: %d\n",
5345 				pathstr, pata->bytecount);
5346 		}
5347 	}
5348 	if (cts->transport == XPORT_SATA) {
5349 		struct ccb_trans_settings_sata *sata =
5350 		    &cts->xport_specific.sata;
5351 
5352 		if ((sata->valid & CTS_SATA_VALID_REVISION) != 0) {
5353 			fprintf(stdout, "%sSATA revision: %d.x\n", pathstr,
5354 				sata->revision);
5355 		}
5356 		if ((sata->valid & CTS_SATA_VALID_MODE) != 0) {
5357 			fprintf(stdout, "%sATA mode: %s\n", pathstr,
5358 				ata_mode2string(sata->mode));
5359 		}
5360 		if ((sata->valid & CTS_SATA_VALID_ATAPI) != 0) {
5361 			fprintf(stdout, "%sATAPI packet length: %d\n", pathstr,
5362 				sata->atapi);
5363 		}
5364 		if ((sata->valid & CTS_SATA_VALID_BYTECOUNT) != 0) {
5365 			fprintf(stdout, "%sPIO transaction length: %d\n",
5366 				pathstr, sata->bytecount);
5367 		}
5368 		if ((sata->valid & CTS_SATA_VALID_PM) != 0) {
5369 			fprintf(stdout, "%sPMP presence: %d\n", pathstr,
5370 				sata->pm_present);
5371 		}
5372 		if ((sata->valid & CTS_SATA_VALID_TAGS) != 0) {
5373 			fprintf(stdout, "%sNumber of tags: %d\n", pathstr,
5374 				sata->tags);
5375 		}
5376 		if ((sata->valid & CTS_SATA_VALID_CAPS) != 0) {
5377 			fprintf(stdout, "%sSATA capabilities: %08x\n", pathstr,
5378 				sata->caps);
5379 		}
5380 	}
5381 	if (cts->protocol == PROTO_ATA) {
5382 		struct ccb_trans_settings_ata *ata=
5383 		    &cts->proto_specific.ata;
5384 
5385 		if (ata->valid & CTS_ATA_VALID_TQ) {
5386 			fprintf(stdout, "%stagged queueing: %s\n", pathstr,
5387 				(ata->flags & CTS_ATA_FLAGS_TAG_ENB) ?
5388 				"enabled" : "disabled");
5389 		}
5390 	}
5391 	if (cts->protocol == PROTO_SCSI) {
5392 		struct ccb_trans_settings_scsi *scsi=
5393 		    &cts->proto_specific.scsi;
5394 
5395 		if (scsi->valid & CTS_SCSI_VALID_TQ) {
5396 			fprintf(stdout, "%stagged queueing: %s\n", pathstr,
5397 				(scsi->flags & CTS_SCSI_FLAGS_TAG_ENB) ?
5398 				"enabled" : "disabled");
5399 		}
5400 	}
5401 	if (cts->protocol == PROTO_NVME) {
5402 		struct ccb_trans_settings_nvme *nvmex =
5403 		    &cts->xport_specific.nvme;
5404 
5405 		if (nvmex->valid & CTS_NVME_VALID_SPEC) {
5406 			fprintf(stdout, "%sNVMe Spec: %d.%d\n", pathstr,
5407 			    NVME_MAJOR(nvmex->spec),
5408 			    NVME_MINOR(nvmex->spec));
5409 		}
5410 		if (nvmex->valid & CTS_NVME_VALID_LINK) {
5411 			fprintf(stdout, "%sPCIe lanes: %d (%d max)\n", pathstr,
5412 			    nvmex->lanes, nvmex->max_lanes);
5413 			fprintf(stdout, "%sPCIe Generation: %d (%d max)\n", pathstr,
5414 			    nvmex->speed, nvmex->max_speed);
5415 		}
5416 	}
5417 }
5418 
5419 /*
5420  * Get a path inquiry CCB for the specified device.
5421  */
5422 static int
5423 get_cpi(struct cam_device *device, struct ccb_pathinq *cpi)
5424 {
5425 	union ccb *ccb;
5426 	int retval = 0;
5427 
5428 	ccb = cam_getccb(device);
5429 	if (ccb == NULL) {
5430 		warnx("get_cpi: couldn't allocate CCB");
5431 		return (1);
5432 	}
5433 	ccb->ccb_h.func_code = XPT_PATH_INQ;
5434 	if (cam_send_ccb(device, ccb) < 0) {
5435 		warn("get_cpi: error sending Path Inquiry CCB");
5436 		retval = 1;
5437 		goto get_cpi_bailout;
5438 	}
5439 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
5440 		if (arglist & CAM_ARG_VERBOSE)
5441 			cam_error_print(device, ccb, CAM_ESF_ALL,
5442 					CAM_EPF_ALL, stderr);
5443 		retval = 1;
5444 		goto get_cpi_bailout;
5445 	}
5446 	bcopy(&ccb->cpi, cpi, sizeof(struct ccb_pathinq));
5447 
5448 get_cpi_bailout:
5449 	cam_freeccb(ccb);
5450 	return (retval);
5451 }
5452 
5453 /*
5454  * Get a get device CCB for the specified device.
5455  */
5456 static int
5457 get_cgd(struct cam_device *device, struct ccb_getdev *cgd)
5458 {
5459 	union ccb *ccb;
5460 	int retval = 0;
5461 
5462 	ccb = cam_getccb(device);
5463 	if (ccb == NULL) {
5464 		warnx("get_cgd: couldn't allocate CCB");
5465 		return (1);
5466 	}
5467 	ccb->ccb_h.func_code = XPT_GDEV_TYPE;
5468 	if (cam_send_ccb(device, ccb) < 0) {
5469 		warn("get_cgd: error sending Get type information CCB");
5470 		retval = 1;
5471 		goto get_cgd_bailout;
5472 	}
5473 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
5474 		if (arglist & CAM_ARG_VERBOSE)
5475 			cam_error_print(device, ccb, CAM_ESF_ALL,
5476 					CAM_EPF_ALL, stderr);
5477 		retval = 1;
5478 		goto get_cgd_bailout;
5479 	}
5480 	bcopy(&ccb->cgd, cgd, sizeof(struct ccb_getdev));
5481 
5482 get_cgd_bailout:
5483 	cam_freeccb(ccb);
5484 	return (retval);
5485 }
5486 
5487 /*
5488  * Returns 1 if the device has the VPD page, 0 if it does not, and -1 on an
5489  * error.
5490  */
5491 int
5492 dev_has_vpd_page(struct cam_device *dev, uint8_t page_id, int retry_count,
5493 		 int timeout, int verbosemode)
5494 {
5495 	union ccb *ccb = NULL;
5496 	struct scsi_vpd_supported_page_list sup_pages;
5497 	int i;
5498 	int retval = 0;
5499 
5500 	ccb = cam_getccb(dev);
5501 	if (ccb == NULL) {
5502 		warn("Unable to allocate CCB");
5503 		retval = -1;
5504 		goto bailout;
5505 	}
5506 
5507 	bzero(&sup_pages, sizeof(sup_pages));
5508 
5509 	scsi_inquiry(&ccb->csio,
5510 		     /*retries*/ retry_count,
5511 		     /*cbfcnp*/ NULL,
5512 		     /* tag_action */ MSG_SIMPLE_Q_TAG,
5513 		     /* inq_buf */ (uint8_t *)&sup_pages,
5514 		     /* inq_len */ sizeof(sup_pages),
5515 		     /* evpd */ 1,
5516 		     /* page_code */ SVPD_SUPPORTED_PAGE_LIST,
5517 		     /* sense_len */ SSD_FULL_SIZE,
5518 		     /* timeout */ timeout ? timeout : 5000);
5519 
5520 	/* Disable freezing the device queue */
5521 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
5522 
5523 	if (retry_count != 0)
5524 		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
5525 
5526 	if (cam_send_ccb(dev, ccb) < 0) {
5527 		cam_freeccb(ccb);
5528 		ccb = NULL;
5529 		retval = -1;
5530 		goto bailout;
5531 	}
5532 
5533 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
5534 		if (verbosemode != 0)
5535 			cam_error_print(dev, ccb, CAM_ESF_ALL,
5536 					CAM_EPF_ALL, stderr);
5537 		retval = -1;
5538 		goto bailout;
5539 	}
5540 
5541 	for (i = 0; i < sup_pages.length; i++) {
5542 		if (sup_pages.list[i] == page_id) {
5543 			retval = 1;
5544 			goto bailout;
5545 		}
5546 	}
5547 bailout:
5548 	if (ccb != NULL)
5549 		cam_freeccb(ccb);
5550 
5551 	return (retval);
5552 }
5553 
5554 /*
5555  * devtype is filled in with the type of device.
5556  * Returns 0 for success, non-zero for failure.
5557  */
5558 int
5559 get_device_type(struct cam_device *dev, int retry_count, int timeout,
5560 		    int verbosemode, camcontrol_devtype *devtype)
5561 {
5562 	struct ccb_getdev cgd;
5563 	int retval;
5564 
5565 	retval = get_cgd(dev, &cgd);
5566 	if (retval != 0)
5567 		goto bailout;
5568 
5569 	switch (cgd.protocol) {
5570 	case PROTO_SCSI:
5571 		break;
5572 	case PROTO_ATA:
5573 	case PROTO_ATAPI:
5574 	case PROTO_SATAPM:
5575 		*devtype = CC_DT_ATA;
5576 		goto bailout;
5577 		break; /*NOTREACHED*/
5578 	case PROTO_NVME:
5579 		*devtype = CC_DT_NVME;
5580 		goto bailout;
5581 		break; /*NOTREACHED*/
5582 	case PROTO_MMCSD:
5583 		*devtype = CC_DT_MMCSD;
5584 		goto bailout;
5585 		break; /*NOTREACHED*/
5586 	default:
5587 		*devtype = CC_DT_UNKNOWN;
5588 		goto bailout;
5589 		break; /*NOTREACHED*/
5590 	}
5591 
5592 	if (retry_count == -1) {
5593 		/*
5594 		 * For a retry count of -1, used only the cached data to avoid
5595 		 * I/O to the drive. Sending the identify command to the drive
5596 		 * can cause issues for SATL attachaed drives since identify is
5597 		 * not an NCQ command. We check for the strings that windows
5598 		 * displays since those will not be NULs (they are supposed
5599 		 * to be space padded). We could check other bits, but anything
5600 		 * non-zero implies SATL.
5601 		 */
5602 		if (cgd.ident_data.serial[0] != 0 ||
5603 		    cgd.ident_data.revision[0] != 0 ||
5604 		    cgd.ident_data.model[0] != 0)
5605 			*devtype = CC_DT_SATL;
5606 		else
5607 			*devtype = CC_DT_SCSI;
5608 	} else {
5609 		/*
5610 		 * Check for the ATA Information VPD page (0x89).  If this is an
5611 		 * ATA device behind a SCSI to ATA translation layer (SATL),
5612 		 * this VPD page should be present.
5613 		 *
5614 		 * If that VPD page isn't present, or we get an error back from
5615 		 * the INQUIRY command, we'll just treat it as a normal SCSI
5616 		 * device.
5617 		 */
5618 		retval = dev_has_vpd_page(dev, SVPD_ATA_INFORMATION, retry_count,
5619 		    timeout, verbosemode);
5620 		if (retval == 1)
5621 			*devtype = CC_DT_SATL;
5622 		else
5623 			*devtype = CC_DT_SCSI;
5624 	}
5625 	retval = 0;
5626 
5627 bailout:
5628 	return (retval);
5629 }
5630 
5631 int
5632 build_ata_cmd(union ccb *ccb, uint32_t retry_count, uint32_t flags,
5633     uint8_t tag_action, uint8_t protocol, uint8_t ata_flags, uint16_t features,
5634     uint16_t sector_count, uint64_t lba, uint8_t command, uint32_t auxiliary,
5635     uint8_t *data_ptr, uint32_t dxfer_len, uint8_t *cdb_storage,
5636     size_t cdb_storage_len, uint8_t sense_len, uint32_t timeout,
5637     int is48bit, camcontrol_devtype devtype)
5638 {
5639 	int retval = 0;
5640 
5641 	if (devtype == CC_DT_ATA) {
5642 		cam_fill_ataio(&ccb->ataio,
5643 		    /*retries*/ retry_count,
5644 		    /*cbfcnp*/ NULL,
5645 		    /*flags*/ flags,
5646 		    /*tag_action*/ tag_action,
5647 		    /*data_ptr*/ data_ptr,
5648 		    /*dxfer_len*/ dxfer_len,
5649 		    /*timeout*/ timeout);
5650 		if (is48bit || lba > ATA_MAX_28BIT_LBA)
5651 			ata_48bit_cmd(&ccb->ataio, command, features, lba,
5652 			    sector_count);
5653 		else
5654 			ata_28bit_cmd(&ccb->ataio, command, features, lba,
5655 			    sector_count);
5656 
5657 		if (auxiliary != 0) {
5658 			ccb->ataio.ata_flags |= ATA_FLAG_AUX;
5659 			ccb->ataio.aux = auxiliary;
5660 		}
5661 
5662 		if (ata_flags & AP_FLAG_CHK_COND)
5663 			ccb->ataio.cmd.flags |= CAM_ATAIO_NEEDRESULT;
5664 
5665 		if ((protocol & AP_PROTO_MASK) == AP_PROTO_DMA)
5666 			ccb->ataio.cmd.flags |= CAM_ATAIO_DMA;
5667 		else if ((protocol & AP_PROTO_MASK) == AP_PROTO_FPDMA)
5668 			ccb->ataio.cmd.flags |= CAM_ATAIO_FPDMA;
5669 	} else {
5670 		if (is48bit || lba > ATA_MAX_28BIT_LBA)
5671 			protocol |= AP_EXTEND;
5672 
5673 		retval = scsi_ata_pass(&ccb->csio,
5674 		    /*retries*/ retry_count,
5675 		    /*cbfcnp*/ NULL,
5676 		    /*flags*/ flags,
5677 		    /*tag_action*/ tag_action,
5678 		    /*protocol*/ protocol,
5679 		    /*ata_flags*/ ata_flags,
5680 		    /*features*/ features,
5681 		    /*sector_count*/ sector_count,
5682 		    /*lba*/ lba,
5683 		    /*command*/ command,
5684 		    /*device*/ 0,
5685 		    /*icc*/ 0,
5686 		    /*auxiliary*/ auxiliary,
5687 		    /*control*/ 0,
5688 		    /*data_ptr*/ data_ptr,
5689 		    /*dxfer_len*/ dxfer_len,
5690 		    /*cdb_storage*/ cdb_storage,
5691 		    /*cdb_storage_len*/ cdb_storage_len,
5692 		    /*minimum_cmd_size*/ 0,
5693 		    /*sense_len*/ sense_len,
5694 		    /*timeout*/ timeout);
5695 	}
5696 
5697 	return (retval);
5698 }
5699 
5700 /*
5701  * Returns: 0 -- success, 1 -- error, 2 -- lba truncated,
5702  *	    4 -- count truncated, 6 -- lba and count truncated.
5703  */
5704 int
5705 get_ata_status(struct cam_device *dev, union ccb *ccb, uint8_t *error,
5706 	       uint16_t *count, uint64_t *lba, uint8_t *device, uint8_t *status)
5707 {
5708 	int retval;
5709 
5710 	switch (ccb->ccb_h.func_code) {
5711 	case XPT_SCSI_IO: {
5712 		uint8_t opcode;
5713 		int error_code = 0, sense_key = 0, asc = 0, ascq = 0;
5714 		u_int sense_len;
5715 
5716 		/*
5717 		 * In this case, we have SCSI ATA PASS-THROUGH command, 12
5718 		 * or 16 byte, and need to see what
5719 		 */
5720 		if (ccb->ccb_h.flags & CAM_CDB_POINTER)
5721 			opcode = ccb->csio.cdb_io.cdb_ptr[0];
5722 		else
5723 			opcode = ccb->csio.cdb_io.cdb_bytes[0];
5724 		if ((opcode != ATA_PASS_12)
5725 		 && (opcode != ATA_PASS_16)) {
5726 			warnx("%s: unsupported opcode %02x", __func__, opcode);
5727 			return (1);
5728 		}
5729 
5730 		retval = scsi_extract_sense_ccb(ccb, &error_code, &sense_key,
5731 						&asc, &ascq);
5732 		/* Note: the _ccb() variant returns 0 for an error */
5733 		if (retval == 0)
5734 			return (1);
5735 
5736 		sense_len = ccb->csio.sense_len - ccb->csio.sense_resid;
5737 		switch (error_code) {
5738 		case SSD_DESC_CURRENT_ERROR:
5739 		case SSD_DESC_DEFERRED_ERROR: {
5740 			struct scsi_sense_data_desc *sense;
5741 			struct scsi_sense_ata_ret_desc *desc;
5742 			uint8_t *desc_ptr;
5743 
5744 			sense = (struct scsi_sense_data_desc *)
5745 			    &ccb->csio.sense_data;
5746 
5747 			desc_ptr = scsi_find_desc(sense, sense_len,
5748 			    SSD_DESC_ATA);
5749 			if (desc_ptr == NULL) {
5750 				cam_error_print(dev, ccb, CAM_ESF_ALL,
5751 				    CAM_EPF_ALL, stderr);
5752 				return (1);
5753 			}
5754 			desc = (struct scsi_sense_ata_ret_desc *)desc_ptr;
5755 
5756 			*error = desc->error;
5757 			*count = (desc->count_15_8 << 8) |
5758 				  desc->count_7_0;
5759 			*lba = ((uint64_t)desc->lba_47_40 << 40) |
5760 			       ((uint64_t)desc->lba_39_32 << 32) |
5761 			       ((uint64_t)desc->lba_31_24 << 24) |
5762 			       (desc->lba_23_16 << 16) |
5763 			       (desc->lba_15_8  <<  8) |
5764 				desc->lba_7_0;
5765 			*device = desc->device;
5766 			*status = desc->status;
5767 
5768 			/*
5769 			 * If the extend bit isn't set, the result is for a
5770 			 * 12-byte ATA PASS-THROUGH command or a 16 or 32 byte
5771 			 * command without the extend bit set.  This means
5772 			 * that the device is supposed to return 28-bit
5773 			 * status.  The count field is only 8 bits, and the
5774 			 * LBA field is only 8 bits.
5775 			 */
5776 			if ((desc->flags & SSD_DESC_ATA_FLAG_EXTEND) == 0){
5777 				*count &= 0xff;
5778 				*lba &= 0x0fffffff;
5779 			}
5780 			break;
5781 		}
5782 		case SSD_CURRENT_ERROR:
5783 		case SSD_DEFERRED_ERROR: {
5784 			uint64_t val;
5785 
5786 			/*
5787 			 * In my understanding of SAT-5 specification, saying:
5788 			 * "without interpreting the contents of the STATUS",
5789 			 * this should not happen if CK_COND was set, but it
5790 			 * does at least for some devices, so try to revert.
5791 			 */
5792 			if ((sense_key == SSD_KEY_ABORTED_COMMAND) &&
5793 			    (asc == 0) && (ascq == 0)) {
5794 				*status = ATA_STATUS_ERROR;
5795 				*error = ATA_ERROR_ABORT;
5796 				*device = 0;
5797 				*count = 0;
5798 				*lba = 0;
5799 				return (0);
5800 			}
5801 
5802 			if ((sense_key != SSD_KEY_RECOVERED_ERROR) ||
5803 			    (asc != 0x00) || (ascq != 0x1d))
5804 				return (1);
5805 
5806 			val = 0;
5807 			scsi_get_sense_info(&ccb->csio.sense_data, sense_len,
5808 			    SSD_DESC_INFO, &val, NULL);
5809 			*error = (val >> 24) & 0xff;
5810 			*status = (val >> 16) & 0xff;
5811 			*device = (val >> 8) & 0xff;
5812 			*count = val & 0xff;
5813 
5814 			val = 0;
5815 			scsi_get_sense_info(&ccb->csio.sense_data, sense_len,
5816 			    SSD_DESC_COMMAND, &val, NULL);
5817 			*lba = ((val >> 16) & 0xff) | (val & 0xff00) |
5818 				((val & 0xff) << 16);
5819 
5820 			/* Report UPPER NONZERO bits as errors 2, 4 and 6. */
5821 			return ((val >> 28) & 0x06);
5822 		}
5823 		default:
5824 			return (1);
5825 		}
5826 
5827 		break;
5828 	}
5829 	case XPT_ATA_IO: {
5830 		struct ata_res *res;
5831 
5832 		/* Only some statuses return ATA result register set. */
5833 		if (cam_ccb_status(ccb) != CAM_REQ_CMP &&
5834 		    cam_ccb_status(ccb) != CAM_ATA_STATUS_ERROR)
5835 			return (1);
5836 
5837 		res = &ccb->ataio.res;
5838 		*error = res->error;
5839 		*status = res->status;
5840 		*device = res->device;
5841 		*count = res->sector_count;
5842 		*lba = (res->lba_high << 16) |
5843 		       (res->lba_mid << 8) |
5844 		       (res->lba_low);
5845 		if (ccb->ataio.cmd.flags & CAM_ATAIO_48BIT) {
5846 			*count |= (res->sector_count_exp << 8);
5847 			*lba |= ((uint64_t)res->lba_low_exp << 24) |
5848 				((uint64_t)res->lba_mid_exp << 32) |
5849 				((uint64_t)res->lba_high_exp << 40);
5850 		} else {
5851 			*lba |= (res->device & 0xf) << 24;
5852 		}
5853 		break;
5854 	}
5855 	default:
5856 		return (1);
5857 	}
5858 	return (0);
5859 }
5860 
5861 static void
5862 cpi_print(struct ccb_pathinq *cpi)
5863 {
5864 	char adapter_str[1024];
5865 	uint64_t i;
5866 
5867 	snprintf(adapter_str, sizeof(adapter_str),
5868 		 "%s%d:", cpi->dev_name, cpi->unit_number);
5869 
5870 	fprintf(stdout, "%s SIM/HBA version: %d\n", adapter_str,
5871 		cpi->version_num);
5872 
5873 	for (i = 1; i < UINT8_MAX; i = i << 1) {
5874 		const char *str;
5875 
5876 		if ((i & cpi->hba_inquiry) == 0)
5877 			continue;
5878 
5879 		fprintf(stdout, "%s supports ", adapter_str);
5880 
5881 		switch(i) {
5882 		case PI_MDP_ABLE:
5883 			str = "MDP message";
5884 			break;
5885 		case PI_WIDE_32:
5886 			str = "32 bit wide SCSI";
5887 			break;
5888 		case PI_WIDE_16:
5889 			str = "16 bit wide SCSI";
5890 			break;
5891 		case PI_SDTR_ABLE:
5892 			str = "SDTR message";
5893 			break;
5894 		case PI_LINKED_CDB:
5895 			str = "linked CDBs";
5896 			break;
5897 		case PI_TAG_ABLE:
5898 			str = "tag queue messages";
5899 			break;
5900 		case PI_SOFT_RST:
5901 			str = "soft reset alternative";
5902 			break;
5903 		case PI_SATAPM:
5904 			str = "SATA Port Multiplier";
5905 			break;
5906 		default:
5907 			str = "unknown PI bit set";
5908 			break;
5909 		}
5910 		fprintf(stdout, "%s\n", str);
5911 	}
5912 
5913 	for (i = 1; i < UINT32_MAX; i = i << 1) {
5914 		const char *str;
5915 
5916 		if ((i & cpi->hba_misc) == 0)
5917 			continue;
5918 
5919 		fprintf(stdout, "%s ", adapter_str);
5920 
5921 		switch(i) {
5922 		case PIM_ATA_EXT:
5923 			str = "can understand ata_ext requests";
5924 			break;
5925 		case PIM_EXTLUNS:
5926 			str = "64bit extended LUNs supported";
5927 			break;
5928 		case PIM_SCANHILO:
5929 			str = "bus scans from high ID to low ID";
5930 			break;
5931 		case PIM_NOREMOVE:
5932 			str = "removable devices not included in scan";
5933 			break;
5934 		case PIM_NOINITIATOR:
5935 			str = "initiator role not supported";
5936 			break;
5937 		case PIM_NOBUSRESET:
5938 			str = "user has disabled initial BUS RESET or"
5939 			      " controller is in target/mixed mode";
5940 			break;
5941 		case PIM_NO_6_BYTE:
5942 			str = "do not send 6-byte commands";
5943 			break;
5944 		case PIM_SEQSCAN:
5945 			str = "scan bus sequentially";
5946 			break;
5947 		case PIM_UNMAPPED:
5948 			str = "unmapped I/O supported";
5949 			break;
5950 		case PIM_NOSCAN:
5951 			str = "does its own scanning";
5952 			break;
5953 		default:
5954 			str = "unknown PIM bit set";
5955 			break;
5956 		}
5957 		fprintf(stdout, "%s\n", str);
5958 	}
5959 
5960 	for (i = 1; i < UINT16_MAX; i = i << 1) {
5961 		const char *str;
5962 
5963 		if ((i & cpi->target_sprt) == 0)
5964 			continue;
5965 
5966 		fprintf(stdout, "%s supports ", adapter_str);
5967 		switch(i) {
5968 		case PIT_PROCESSOR:
5969 			str = "target mode processor mode";
5970 			break;
5971 		case PIT_PHASE:
5972 			str = "target mode phase cog. mode";
5973 			break;
5974 		case PIT_DISCONNECT:
5975 			str = "disconnects in target mode";
5976 			break;
5977 		case PIT_TERM_IO:
5978 			str = "terminate I/O message in target mode";
5979 			break;
5980 		case PIT_GRP_6:
5981 			str = "group 6 commands in target mode";
5982 			break;
5983 		case PIT_GRP_7:
5984 			str = "group 7 commands in target mode";
5985 			break;
5986 		default:
5987 			str = "unknown PIT bit set";
5988 			break;
5989 		}
5990 
5991 		fprintf(stdout, "%s\n", str);
5992 	}
5993 	fprintf(stdout, "%s HBA engine count: %d\n", adapter_str,
5994 		cpi->hba_eng_cnt);
5995 	fprintf(stdout, "%s maximum target: %d\n", adapter_str,
5996 		cpi->max_target);
5997 	fprintf(stdout, "%s maximum LUN: %d\n", adapter_str,
5998 		cpi->max_lun);
5999 	fprintf(stdout, "%s highest path ID in subsystem: %d\n",
6000 		adapter_str, cpi->hpath_id);
6001 	fprintf(stdout, "%s initiator ID: %d\n", adapter_str,
6002 		cpi->initiator_id);
6003 	fprintf(stdout, "%s SIM vendor: %s\n", adapter_str, cpi->sim_vid);
6004 	fprintf(stdout, "%s HBA vendor: %s\n", adapter_str, cpi->hba_vid);
6005 	fprintf(stdout, "%s HBA vendor ID: 0x%04x\n",
6006 	    adapter_str, cpi->hba_vendor);
6007 	fprintf(stdout, "%s HBA device ID: 0x%04x\n",
6008 	    adapter_str, cpi->hba_device);
6009 	fprintf(stdout, "%s HBA subvendor ID: 0x%04x\n",
6010 	    adapter_str, cpi->hba_subvendor);
6011 	fprintf(stdout, "%s HBA subdevice ID: 0x%04x\n",
6012 	    adapter_str, cpi->hba_subdevice);
6013 	fprintf(stdout, "%s bus ID: %d\n", adapter_str, cpi->bus_id);
6014 	fprintf(stdout, "%s base transfer speed: ", adapter_str);
6015 	if (cpi->base_transfer_speed > 1000)
6016 		fprintf(stdout, "%d.%03dMB/sec\n",
6017 			cpi->base_transfer_speed / 1000,
6018 			cpi->base_transfer_speed % 1000);
6019 	else
6020 		fprintf(stdout, "%dKB/sec\n",
6021 			(cpi->base_transfer_speed % 1000) * 1000);
6022 	fprintf(stdout, "%s maximum transfer size: %u bytes\n",
6023 	    adapter_str, cpi->maxio);
6024 }
6025 
6026 static int
6027 get_print_cts(struct cam_device *device, int user_settings, int quiet,
6028 	      struct ccb_trans_settings *cts)
6029 {
6030 	int retval;
6031 	union ccb *ccb;
6032 
6033 	retval = 0;
6034 	ccb = cam_getccb(device);
6035 
6036 	if (ccb == NULL) {
6037 		warnx("get_print_cts: error allocating ccb");
6038 		return (1);
6039 	}
6040 
6041 	ccb->ccb_h.func_code = XPT_GET_TRAN_SETTINGS;
6042 
6043 	if (user_settings == 0)
6044 		ccb->cts.type = CTS_TYPE_CURRENT_SETTINGS;
6045 	else
6046 		ccb->cts.type = CTS_TYPE_USER_SETTINGS;
6047 
6048 	if (cam_send_ccb(device, ccb) < 0) {
6049 		warn("error sending XPT_GET_TRAN_SETTINGS CCB");
6050 		retval = 1;
6051 		goto get_print_cts_bailout;
6052 	}
6053 
6054 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
6055 		warnx("XPT_GET_TRANS_SETTINGS CCB failed");
6056 		if (arglist & CAM_ARG_VERBOSE)
6057 			cam_error_print(device, ccb, CAM_ESF_ALL,
6058 					CAM_EPF_ALL, stderr);
6059 		retval = 1;
6060 		goto get_print_cts_bailout;
6061 	}
6062 
6063 	if (quiet == 0)
6064 		cts_print(device, &ccb->cts);
6065 
6066 	if (cts != NULL)
6067 		bcopy(&ccb->cts, cts, sizeof(struct ccb_trans_settings));
6068 
6069 get_print_cts_bailout:
6070 
6071 	cam_freeccb(ccb);
6072 
6073 	return (retval);
6074 }
6075 
6076 static int
6077 ratecontrol(struct cam_device *device, int task_attr, int retry_count,
6078 	    int timeout, int argc, char **argv, char *combinedopt)
6079 {
6080 	int c;
6081 	union ccb *ccb;
6082 	int user_settings = 0;
6083 	int retval = 0;
6084 	int disc_enable = -1, tag_enable = -1;
6085 	int mode = -1;
6086 	int offset = -1;
6087 	double syncrate = -1;
6088 	int bus_width = -1;
6089 	int quiet = 0;
6090 	int change_settings = 0, send_tur = 0;
6091 	struct ccb_pathinq cpi;
6092 
6093 	ccb = cam_getccb(device);
6094 	if (ccb == NULL) {
6095 		warnx("ratecontrol: error allocating ccb");
6096 		return (1);
6097 	}
6098 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
6099 		switch(c){
6100 		case 'a':
6101 			send_tur = 1;
6102 			break;
6103 		case 'c':
6104 			user_settings = 0;
6105 			break;
6106 		case 'D':
6107 			if (strncasecmp(optarg, "enable", 6) == 0)
6108 				disc_enable = 1;
6109 			else if (strncasecmp(optarg, "disable", 7) == 0)
6110 				disc_enable = 0;
6111 			else {
6112 				warnx("-D argument \"%s\" is unknown", optarg);
6113 				retval = 1;
6114 				goto ratecontrol_bailout;
6115 			}
6116 			change_settings = 1;
6117 			break;
6118 		case 'M':
6119 			mode = ata_string2mode(optarg);
6120 			if (mode < 0) {
6121 				warnx("unknown mode '%s'", optarg);
6122 				retval = 1;
6123 				goto ratecontrol_bailout;
6124 			}
6125 			change_settings = 1;
6126 			break;
6127 		case 'O':
6128 			offset = strtol(optarg, NULL, 0);
6129 			if (offset < 0) {
6130 				warnx("offset value %d is < 0", offset);
6131 				retval = 1;
6132 				goto ratecontrol_bailout;
6133 			}
6134 			change_settings = 1;
6135 			break;
6136 		case 'q':
6137 			quiet++;
6138 			break;
6139 		case 'R':
6140 			syncrate = atof(optarg);
6141 			if (syncrate < 0) {
6142 				warnx("sync rate %f is < 0", syncrate);
6143 				retval = 1;
6144 				goto ratecontrol_bailout;
6145 			}
6146 			change_settings = 1;
6147 			break;
6148 		case 'T':
6149 			if (strncasecmp(optarg, "enable", 6) == 0)
6150 				tag_enable = 1;
6151 			else if (strncasecmp(optarg, "disable", 7) == 0)
6152 				tag_enable = 0;
6153 			else {
6154 				warnx("-T argument \"%s\" is unknown", optarg);
6155 				retval = 1;
6156 				goto ratecontrol_bailout;
6157 			}
6158 			change_settings = 1;
6159 			break;
6160 		case 'U':
6161 			user_settings = 1;
6162 			break;
6163 		case 'W':
6164 			bus_width = strtol(optarg, NULL, 0);
6165 			if (bus_width < 0) {
6166 				warnx("bus width %d is < 0", bus_width);
6167 				retval = 1;
6168 				goto ratecontrol_bailout;
6169 			}
6170 			change_settings = 1;
6171 			break;
6172 		default:
6173 			break;
6174 		}
6175 	}
6176 	/*
6177 	 * Grab path inquiry information, so we can determine whether
6178 	 * or not the initiator is capable of the things that the user
6179 	 * requests.
6180 	 */
6181 	if ((retval = get_cpi(device, &cpi)) != 0)
6182 		goto ratecontrol_bailout;
6183 	if (quiet == 0) {
6184 		fprintf(stdout, "%s parameters:\n",
6185 		    user_settings ? "User" : "Current");
6186 	}
6187 	retval = get_print_cts(device, user_settings, quiet, &ccb->cts);
6188 	if (retval != 0)
6189 		goto ratecontrol_bailout;
6190 
6191 	if (arglist & CAM_ARG_VERBOSE)
6192 		cpi_print(&cpi);
6193 
6194 	if (change_settings) {
6195 		int didsettings = 0;
6196 		struct ccb_trans_settings_spi *spi = NULL;
6197 		struct ccb_trans_settings_pata *pata = NULL;
6198 		struct ccb_trans_settings_sata *sata = NULL;
6199 		struct ccb_trans_settings_ata *ata = NULL;
6200 		struct ccb_trans_settings_scsi *scsi = NULL;
6201 
6202 		if (ccb->cts.transport == XPORT_SPI)
6203 			spi = &ccb->cts.xport_specific.spi;
6204 		if (ccb->cts.transport == XPORT_ATA)
6205 			pata = &ccb->cts.xport_specific.ata;
6206 		if (ccb->cts.transport == XPORT_SATA)
6207 			sata = &ccb->cts.xport_specific.sata;
6208 		if (ccb->cts.protocol == PROTO_ATA)
6209 			ata = &ccb->cts.proto_specific.ata;
6210 		if (ccb->cts.protocol == PROTO_SCSI)
6211 			scsi = &ccb->cts.proto_specific.scsi;
6212 		ccb->cts.xport_specific.valid = 0;
6213 		ccb->cts.proto_specific.valid = 0;
6214 		if (spi && disc_enable != -1) {
6215 			spi->valid |= CTS_SPI_VALID_DISC;
6216 			if (disc_enable == 0)
6217 				spi->flags &= ~CTS_SPI_FLAGS_DISC_ENB;
6218 			else
6219 				spi->flags |= CTS_SPI_FLAGS_DISC_ENB;
6220 			didsettings++;
6221 		}
6222 		if (tag_enable != -1) {
6223 			if ((cpi.hba_inquiry & PI_TAG_ABLE) == 0) {
6224 				warnx("HBA does not support tagged queueing, "
6225 				      "so you cannot modify tag settings");
6226 				retval = 1;
6227 				goto ratecontrol_bailout;
6228 			}
6229 			if (ata) {
6230 				ata->valid |= CTS_SCSI_VALID_TQ;
6231 				if (tag_enable == 0)
6232 					ata->flags &= ~CTS_ATA_FLAGS_TAG_ENB;
6233 				else
6234 					ata->flags |= CTS_ATA_FLAGS_TAG_ENB;
6235 				didsettings++;
6236 			} else if (scsi) {
6237 				scsi->valid |= CTS_SCSI_VALID_TQ;
6238 				if (tag_enable == 0)
6239 					scsi->flags &= ~CTS_SCSI_FLAGS_TAG_ENB;
6240 				else
6241 					scsi->flags |= CTS_SCSI_FLAGS_TAG_ENB;
6242 				didsettings++;
6243 			}
6244 		}
6245 		if (spi && offset != -1) {
6246 			if ((cpi.hba_inquiry & PI_SDTR_ABLE) == 0) {
6247 				warnx("HBA is not capable of changing offset");
6248 				retval = 1;
6249 				goto ratecontrol_bailout;
6250 			}
6251 			spi->valid |= CTS_SPI_VALID_SYNC_OFFSET;
6252 			spi->sync_offset = offset;
6253 			didsettings++;
6254 		}
6255 		if (spi && syncrate != -1) {
6256 			int prelim_sync_period;
6257 
6258 			if ((cpi.hba_inquiry & PI_SDTR_ABLE) == 0) {
6259 				warnx("HBA is not capable of changing "
6260 				      "transfer rates");
6261 				retval = 1;
6262 				goto ratecontrol_bailout;
6263 			}
6264 			spi->valid |= CTS_SPI_VALID_SYNC_RATE;
6265 			/*
6266 			 * The sync rate the user gives us is in MHz.
6267 			 * We need to translate it into KHz for this
6268 			 * calculation.
6269 			 */
6270 			syncrate *= 1000;
6271 			/*
6272 			 * Next, we calculate a "preliminary" sync period
6273 			 * in tenths of a nanosecond.
6274 			 */
6275 			if (syncrate == 0)
6276 				prelim_sync_period = 0;
6277 			else
6278 				prelim_sync_period = 10000000 / syncrate;
6279 			spi->sync_period =
6280 				scsi_calc_syncparam(prelim_sync_period);
6281 			didsettings++;
6282 		}
6283 		if (sata && syncrate != -1) {
6284 			if ((cpi.hba_inquiry & PI_SDTR_ABLE) == 0) {
6285 				warnx("HBA is not capable of changing "
6286 				      "transfer rates");
6287 				retval = 1;
6288 				goto ratecontrol_bailout;
6289 			}
6290 			if  (!user_settings) {
6291 				warnx("You can modify only user rate "
6292 				    "settings for SATA");
6293 				retval = 1;
6294 				goto ratecontrol_bailout;
6295 			}
6296 			sata->revision = ata_speed2revision(syncrate * 100);
6297 			if (sata->revision < 0) {
6298 				warnx("Invalid rate %f", syncrate);
6299 				retval = 1;
6300 				goto ratecontrol_bailout;
6301 			}
6302 			sata->valid |= CTS_SATA_VALID_REVISION;
6303 			didsettings++;
6304 		}
6305 		if ((pata || sata) && mode != -1) {
6306 			if ((cpi.hba_inquiry & PI_SDTR_ABLE) == 0) {
6307 				warnx("HBA is not capable of changing "
6308 				      "transfer rates");
6309 				retval = 1;
6310 				goto ratecontrol_bailout;
6311 			}
6312 			if  (!user_settings) {
6313 				warnx("You can modify only user mode "
6314 				    "settings for ATA/SATA");
6315 				retval = 1;
6316 				goto ratecontrol_bailout;
6317 			}
6318 			if (pata) {
6319 				pata->mode = mode;
6320 				pata->valid |= CTS_ATA_VALID_MODE;
6321 			} else {
6322 				sata->mode = mode;
6323 				sata->valid |= CTS_SATA_VALID_MODE;
6324 			}
6325 			didsettings++;
6326 		}
6327 		/*
6328 		 * The bus_width argument goes like this:
6329 		 * 0 == 8 bit
6330 		 * 1 == 16 bit
6331 		 * 2 == 32 bit
6332 		 * Therefore, if you shift the number of bits given on the
6333 		 * command line right by 4, you should get the correct
6334 		 * number.
6335 		 */
6336 		if (spi && bus_width != -1) {
6337 			/*
6338 			 * We might as well validate things here with a
6339 			 * decipherable error message, rather than what
6340 			 * will probably be an indecipherable error message
6341 			 * by the time it gets back to us.
6342 			 */
6343 			if ((bus_width == 16)
6344 			 && ((cpi.hba_inquiry & PI_WIDE_16) == 0)) {
6345 				warnx("HBA does not support 16 bit bus width");
6346 				retval = 1;
6347 				goto ratecontrol_bailout;
6348 			} else if ((bus_width == 32)
6349 				&& ((cpi.hba_inquiry & PI_WIDE_32) == 0)) {
6350 				warnx("HBA does not support 32 bit bus width");
6351 				retval = 1;
6352 				goto ratecontrol_bailout;
6353 			} else if ((bus_width != 8)
6354 				&& (bus_width != 16)
6355 				&& (bus_width != 32)) {
6356 				warnx("Invalid bus width %d", bus_width);
6357 				retval = 1;
6358 				goto ratecontrol_bailout;
6359 			}
6360 			spi->valid |= CTS_SPI_VALID_BUS_WIDTH;
6361 			spi->bus_width = bus_width >> 4;
6362 			didsettings++;
6363 		}
6364 		if  (didsettings == 0) {
6365 			goto ratecontrol_bailout;
6366 		}
6367 		ccb->ccb_h.func_code = XPT_SET_TRAN_SETTINGS;
6368 		if (cam_send_ccb(device, ccb) < 0) {
6369 			warn("error sending XPT_SET_TRAN_SETTINGS CCB");
6370 			retval = 1;
6371 			goto ratecontrol_bailout;
6372 		}
6373 		if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
6374 			warnx("XPT_SET_TRANS_SETTINGS CCB failed");
6375 			if (arglist & CAM_ARG_VERBOSE) {
6376 				cam_error_print(device, ccb, CAM_ESF_ALL,
6377 						CAM_EPF_ALL, stderr);
6378 			}
6379 			retval = 1;
6380 			goto ratecontrol_bailout;
6381 		}
6382 	}
6383 	if (send_tur) {
6384 		retval = testunitready(device, task_attr, retry_count, timeout,
6385 				       (arglist & CAM_ARG_VERBOSE) ? 0 : 1);
6386 		/*
6387 		 * If the TUR didn't succeed, just bail.
6388 		 */
6389 		if (retval != 0) {
6390 			if (quiet == 0)
6391 				fprintf(stderr, "Test Unit Ready failed\n");
6392 			goto ratecontrol_bailout;
6393 		}
6394 	}
6395 	if ((change_settings || send_tur) && !quiet &&
6396 	    (ccb->cts.transport == XPORT_ATA ||
6397 	     ccb->cts.transport == XPORT_SATA || send_tur)) {
6398 		fprintf(stdout, "New parameters:\n");
6399 		retval = get_print_cts(device, user_settings, 0, NULL);
6400 	}
6401 
6402 ratecontrol_bailout:
6403 	cam_freeccb(ccb);
6404 	return (retval);
6405 }
6406 
6407 static int
6408 scsiformat(struct cam_device *device, int argc, char **argv,
6409 	   char *combinedopt, int task_attr, int retry_count, int timeout)
6410 {
6411 	union ccb *ccb;
6412 	int c;
6413 	int ycount = 0, quiet = 0;
6414 	int error = 0, retval = 0;
6415 	int use_timeout = 10800 * 1000;
6416 	int immediate = 1;
6417 	struct format_defect_list_header fh;
6418 	uint8_t *data_ptr = NULL;
6419 	uint32_t dxfer_len = 0;
6420 	uint8_t byte2 = 0;
6421 	int num_warnings = 0;
6422 	int reportonly = 0;
6423 
6424 	ccb = cam_getccb(device);
6425 
6426 	if (ccb == NULL) {
6427 		warnx("scsiformat: error allocating ccb");
6428 		return (1);
6429 	}
6430 
6431 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
6432 		switch(c) {
6433 		case 'q':
6434 			quiet++;
6435 			break;
6436 		case 'r':
6437 			reportonly = 1;
6438 			break;
6439 		case 'w':
6440 			immediate = 0;
6441 			break;
6442 		case 'y':
6443 			ycount++;
6444 			break;
6445 		}
6446 	}
6447 
6448 	if (reportonly)
6449 		goto doreport;
6450 
6451 	if (quiet == 0 && ycount == 0) {
6452 		fprintf(stdout, "You are about to REMOVE ALL DATA from the "
6453 			"following device:\n");
6454 
6455 		error = scsidoinquiry(device, argc, argv, combinedopt,
6456 				      task_attr, retry_count, timeout);
6457 
6458 		if (error != 0) {
6459 			warnx("scsiformat: error sending inquiry");
6460 			goto scsiformat_bailout;
6461 		}
6462 	}
6463 
6464 	if (ycount == 0) {
6465 		if (!get_confirmation()) {
6466 			error = 1;
6467 			goto scsiformat_bailout;
6468 		}
6469 	}
6470 
6471 	if (timeout != 0)
6472 		use_timeout = timeout;
6473 
6474 	if (quiet == 0) {
6475 		fprintf(stdout, "Current format timeout is %d seconds\n",
6476 			use_timeout / 1000);
6477 	}
6478 
6479 	/*
6480 	 * If the user hasn't disabled questions and didn't specify a
6481 	 * timeout on the command line, ask them if they want the current
6482 	 * timeout.
6483 	 */
6484 	if ((ycount == 0)
6485 	 && (timeout == 0)) {
6486 		char str[1024];
6487 		int new_timeout = 0;
6488 
6489 		fprintf(stdout, "Enter new timeout in seconds or press\n"
6490 			"return to keep the current timeout [%d] ",
6491 			use_timeout / 1000);
6492 
6493 		if (fgets(str, sizeof(str), stdin) != NULL) {
6494 			if (str[0] != '\0')
6495 				new_timeout = atoi(str);
6496 		}
6497 
6498 		if (new_timeout != 0) {
6499 			use_timeout = new_timeout * 1000;
6500 			fprintf(stdout, "Using new timeout value %d\n",
6501 				use_timeout / 1000);
6502 		}
6503 	}
6504 
6505 	/*
6506 	 * Keep this outside the if block below to silence any unused
6507 	 * variable warnings.
6508 	 */
6509 	bzero(&fh, sizeof(fh));
6510 
6511 	/*
6512 	 * If we're in immediate mode, we've got to include the format
6513 	 * header
6514 	 */
6515 	if (immediate != 0) {
6516 		fh.byte2 = FU_DLH_IMMED;
6517 		data_ptr = (uint8_t *)&fh;
6518 		dxfer_len = sizeof(fh);
6519 		byte2 = FU_FMT_DATA;
6520 	} else if (quiet == 0) {
6521 		fprintf(stdout, "Formatting...");
6522 		fflush(stdout);
6523 	}
6524 
6525 	scsi_format_unit(&ccb->csio,
6526 			 /* retries */ retry_count,
6527 			 /* cbfcnp */ NULL,
6528 			 /* tag_action */ task_attr,
6529 			 /* byte2 */ byte2,
6530 			 /* ileave */ 0,
6531 			 /* data_ptr */ data_ptr,
6532 			 /* dxfer_len */ dxfer_len,
6533 			 /* sense_len */ SSD_FULL_SIZE,
6534 			 /* timeout */ use_timeout);
6535 
6536 	/* Disable freezing the device queue */
6537 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
6538 
6539 	if (arglist & CAM_ARG_ERR_RECOVER)
6540 		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
6541 
6542 	if (((retval = cam_send_ccb(device, ccb)) < 0)
6543 	 || ((immediate == 0)
6544 	   && ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP))) {
6545 		const char errstr[] = "error sending format command";
6546 
6547 		if (retval < 0)
6548 			warn(errstr);
6549 		else
6550 			warnx(errstr);
6551 
6552 		if (arglist & CAM_ARG_VERBOSE) {
6553 			cam_error_print(device, ccb, CAM_ESF_ALL,
6554 					CAM_EPF_ALL, stderr);
6555 		}
6556 		error = 1;
6557 		goto scsiformat_bailout;
6558 	}
6559 
6560 	/*
6561 	 * If we ran in non-immediate mode, we already checked for errors
6562 	 * above and printed out any necessary information.  If we're in
6563 	 * immediate mode, we need to loop through and get status
6564 	 * information periodically.
6565 	 */
6566 	if (immediate == 0) {
6567 		if (quiet == 0) {
6568 			fprintf(stdout, "Format Complete\n");
6569 		}
6570 		goto scsiformat_bailout;
6571 	}
6572 
6573 doreport:
6574 	do {
6575 		cam_status status;
6576 
6577 		CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
6578 
6579 		/*
6580 		 * There's really no need to do error recovery or
6581 		 * retries here, since we're just going to sit in a
6582 		 * loop and wait for the device to finish formatting.
6583 		 */
6584 		scsi_test_unit_ready(&ccb->csio,
6585 				     /* retries */ 0,
6586 				     /* cbfcnp */ NULL,
6587 				     /* tag_action */ task_attr,
6588 				     /* sense_len */ SSD_FULL_SIZE,
6589 				     /* timeout */ 5000);
6590 
6591 		/* Disable freezing the device queue */
6592 		ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
6593 
6594 		retval = cam_send_ccb(device, ccb);
6595 
6596 		/*
6597 		 * If we get an error from the ioctl, bail out.  SCSI
6598 		 * errors are expected.
6599 		 */
6600 		if (retval < 0) {
6601 			warn("error sending TEST UNIT READY command");
6602 			error = 1;
6603 			goto scsiformat_bailout;
6604 		}
6605 
6606 		status = ccb->ccb_h.status & CAM_STATUS_MASK;
6607 
6608 		if ((status != CAM_REQ_CMP)
6609 		 && (status == CAM_SCSI_STATUS_ERROR)
6610 		 && ((ccb->ccb_h.status & CAM_AUTOSNS_VALID) != 0)) {
6611 			struct scsi_sense_data *sense;
6612 			int error_code, sense_key, asc, ascq;
6613 
6614 			sense = &ccb->csio.sense_data;
6615 			scsi_extract_sense_len(sense, ccb->csio.sense_len -
6616 			    ccb->csio.sense_resid, &error_code, &sense_key,
6617 			    &asc, &ascq, /*show_errors*/ 1);
6618 
6619 			/*
6620 			 * According to the SCSI-2 and SCSI-3 specs, a
6621 			 * drive that is in the middle of a format should
6622 			 * return NOT READY with an ASC of "logical unit
6623 			 * not ready, format in progress".  The sense key
6624 			 * specific bytes will then be a progress indicator.
6625 			 */
6626 			if ((sense_key == SSD_KEY_NOT_READY)
6627 			 && (asc == 0x04) && (ascq == 0x04)) {
6628 				uint8_t sks[3];
6629 
6630 				if ((scsi_get_sks(sense, ccb->csio.sense_len -
6631 				     ccb->csio.sense_resid, sks) == 0)
6632 				 && (quiet == 0)) {
6633 					uint32_t val;
6634 					u_int64_t percentage;
6635 
6636 					val = scsi_2btoul(&sks[1]);
6637 					percentage = 10000ull * val;
6638 
6639 					fprintf(stdout,
6640 						"\rFormatting:  %ju.%02u %% "
6641 						"(%u/%d) done",
6642 						(uintmax_t)(percentage /
6643 						(0x10000 * 100)),
6644 						(unsigned)((percentage /
6645 						0x10000) % 100),
6646 						val, 0x10000);
6647 					fflush(stdout);
6648 				} else if ((quiet == 0)
6649 					&& (++num_warnings <= 1)) {
6650 					warnx("Unexpected SCSI Sense Key "
6651 					      "Specific value returned "
6652 					      "during format:");
6653 					scsi_sense_print(device, &ccb->csio,
6654 							 stderr);
6655 					warnx("Unable to print status "
6656 					      "information, but format will "
6657 					      "proceed.");
6658 					warnx("will exit when format is "
6659 					      "complete");
6660 				}
6661 				sleep(1);
6662 			} else {
6663 				warnx("Unexpected SCSI error during format");
6664 				cam_error_print(device, ccb, CAM_ESF_ALL,
6665 						CAM_EPF_ALL, stderr);
6666 				error = 1;
6667 				goto scsiformat_bailout;
6668 			}
6669 
6670 		} else if (status != CAM_REQ_CMP) {
6671 			warnx("Unexpected CAM status %#x", status);
6672 			if (arglist & CAM_ARG_VERBOSE)
6673 				cam_error_print(device, ccb, CAM_ESF_ALL,
6674 						CAM_EPF_ALL, stderr);
6675 			error = 1;
6676 			goto scsiformat_bailout;
6677 		}
6678 
6679 	} while((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP);
6680 
6681 	if (quiet == 0)
6682 		fprintf(stdout, "\nFormat Complete\n");
6683 
6684 scsiformat_bailout:
6685 
6686 	cam_freeccb(ccb);
6687 
6688 	return (error);
6689 }
6690 
6691 static int
6692 sanitize_wait_ata(struct cam_device *device, union ccb *ccb, int quiet,
6693     camcontrol_devtype devtype)
6694 {
6695 	int retval;
6696 	uint8_t error = 0, ata_device = 0, status = 0;
6697 	uint16_t count = 0;
6698 	uint64_t lba = 0;
6699 	u_int val, perc;
6700 
6701 	do {
6702 		retval = build_ata_cmd(ccb,
6703 			     /*retries*/ 0,
6704 			     /*flags*/ CAM_DIR_NONE,
6705 			     /*tag_action*/ MSG_SIMPLE_Q_TAG,
6706 			     /*protocol*/ AP_PROTO_NON_DATA,
6707 			     /*ata_flags*/ AP_FLAG_CHK_COND,
6708 			     /*features*/ 0x00, /* SANITIZE STATUS EXT */
6709 			     /*sector_count*/ 0,
6710 			     /*lba*/ 0,
6711 			     /*command*/ ATA_SANITIZE,
6712 			     /*auxiliary*/ 0,
6713 			     /*data_ptr*/ NULL,
6714 			     /*dxfer_len*/ 0,
6715 			     /*cdb_storage*/ NULL,
6716 			     /*cdb_storage_len*/ 0,
6717 			     /*sense_len*/ SSD_FULL_SIZE,
6718 			     /*timeout*/ 10000,
6719 			     /*is48bit*/ 1,
6720 			     /*devtype*/ devtype);
6721 		if (retval != 0) {
6722 			warnx("%s: build_ata_cmd() failed, likely "
6723 			    "programmer error", __func__);
6724 			return (1);
6725 		}
6726 
6727 		ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
6728 		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
6729 		retval = cam_send_ccb(device, ccb);
6730 		if (retval != 0) {
6731 			warn("error sending SANITIZE STATUS EXT command");
6732 			return (1);
6733 		}
6734 
6735 		retval = get_ata_status(device, ccb, &error, &count, &lba,
6736 		    &ata_device, &status);
6737 		if (retval != 0) {
6738 			warnx("Can't get SANITIZE STATUS EXT status, "
6739 			    "sanitize may still run.");
6740 			return (retval);
6741 		}
6742 		if (status & ATA_STATUS_ERROR) {
6743 			if (error & ATA_ERROR_ABORT) {
6744 				switch (lba & 0xff) {
6745 				case 0x00:
6746 					warnx("Reason not reported or sanitize failed.");
6747 					return (1);
6748 				case 0x01:
6749 					warnx("Sanitize command unsuccessful.       ");
6750 					return (1);
6751 				case 0x02:
6752 					warnx("Unsupported sanitize device command. ");
6753 					return (1);
6754 				case 0x03:
6755 					warnx("Device is in sanitize frozen state.  ");
6756 					return (1);
6757 				case 0x04:
6758 					warnx("Sanitize antifreeze lock is enabled. ");
6759 					return (1);
6760 				}
6761 			}
6762 			warnx("SANITIZE STATUS EXT failed, "
6763 			    "sanitize may still run.");
6764 			return (1);
6765 		}
6766 		if (count & 0x4000) {
6767 			if (quiet == 0) {
6768 				val = lba & 0xffff;
6769 				perc = 10000 * val;
6770 				fprintf(stdout,
6771 				    "Sanitizing: %u.%02u%% (%d/%d)\r",
6772 				    (perc / (0x10000 * 100)),
6773 				    ((perc / 0x10000) % 100),
6774 				    val, 0x10000);
6775 				fflush(stdout);
6776 			}
6777 			sleep(1);
6778 		} else
6779 			break;
6780 	} while (1);
6781 	return (0);
6782 }
6783 
6784 static int
6785 sanitize_wait_scsi(struct cam_device *device, union ccb *ccb, int task_attr, int quiet)
6786 {
6787 	int warnings = 0, retval;
6788 	cam_status status;
6789 	u_int val, perc;
6790 
6791 	do {
6792 		CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
6793 
6794 		/*
6795 		 * There's really no need to do error recovery or
6796 		 * retries here, since we're just going to sit in a
6797 		 * loop and wait for the device to finish sanitizing.
6798 		 */
6799 		scsi_test_unit_ready(&ccb->csio,
6800 				     /* retries */ 0,
6801 				     /* cbfcnp */ NULL,
6802 				     /* tag_action */ task_attr,
6803 				     /* sense_len */ SSD_FULL_SIZE,
6804 				     /* timeout */ 5000);
6805 
6806 		/* Disable freezing the device queue */
6807 		ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
6808 
6809 		retval = cam_send_ccb(device, ccb);
6810 
6811 		/*
6812 		 * If we get an error from the ioctl, bail out.  SCSI
6813 		 * errors are expected.
6814 		 */
6815 		if (retval < 0) {
6816 			warn("error sending TEST UNIT READY command");
6817 			return (1);
6818 		}
6819 
6820 		status = ccb->ccb_h.status & CAM_STATUS_MASK;
6821 		if ((status == CAM_SCSI_STATUS_ERROR) &&
6822 		    ((ccb->ccb_h.status & CAM_AUTOSNS_VALID) != 0)) {
6823 			struct scsi_sense_data *sense;
6824 			int error_code, sense_key, asc, ascq;
6825 
6826 			sense = &ccb->csio.sense_data;
6827 			scsi_extract_sense_len(sense, ccb->csio.sense_len -
6828 			    ccb->csio.sense_resid, &error_code, &sense_key,
6829 			    &asc, &ascq, /*show_errors*/ 1);
6830 
6831 			/*
6832 			 * According to the SCSI-3 spec, a drive that is in the
6833 			 * middle of a sanitize should return NOT READY with an
6834 			 * ASC of "logical unit not ready, sanitize in
6835 			 * progress". The sense key specific bytes will then
6836 			 * be a progress indicator.
6837 			 */
6838 			if ((sense_key == SSD_KEY_NOT_READY)
6839 			 && (asc == 0x04) && (ascq == 0x1b)) {
6840 				uint8_t sks[3];
6841 
6842 				if ((scsi_get_sks(sense, ccb->csio.sense_len -
6843 				     ccb->csio.sense_resid, sks) == 0)
6844 				 && (quiet == 0)) {
6845 					val = scsi_2btoul(&sks[1]);
6846 					perc = 10000 * val;
6847 					fprintf(stdout,
6848 					    "Sanitizing: %u.%02u%% (%d/%d)\r",
6849 					    (perc / (0x10000 * 100)),
6850 					    ((perc / 0x10000) % 100),
6851 					    val, 0x10000);
6852 					fflush(stdout);
6853 				} else if ((quiet == 0) && (++warnings <= 1)) {
6854 					warnx("Unexpected SCSI Sense Key "
6855 					      "Specific value returned "
6856 					      "during sanitize:");
6857 					scsi_sense_print(device, &ccb->csio,
6858 							 stderr);
6859 					warnx("Unable to print status "
6860 					      "information, but sanitze will "
6861 					      "proceed.");
6862 					warnx("will exit when sanitize is "
6863 					      "complete");
6864 				}
6865 				sleep(1);
6866 			} else {
6867 				warnx("Unexpected SCSI error during sanitize");
6868 				cam_error_print(device, ccb, CAM_ESF_ALL,
6869 						CAM_EPF_ALL, stderr);
6870 				return (1);
6871 			}
6872 
6873 		} else if (status != CAM_REQ_CMP && status != CAM_REQUEUE_REQ) {
6874 			warnx("Unexpected CAM status %#x", status);
6875 			if (arglist & CAM_ARG_VERBOSE)
6876 				cam_error_print(device, ccb, CAM_ESF_ALL,
6877 						CAM_EPF_ALL, stderr);
6878 			return (1);
6879 		}
6880 	} while ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP);
6881 	return (0);
6882 }
6883 
6884 static int
6885 sanitize(struct cam_device *device, int argc, char **argv,
6886 	     char *combinedopt, int task_attr, int retry_count, int timeout)
6887 {
6888 	union ccb *ccb;
6889 	uint8_t action = 0;
6890 	int c;
6891 	int ycount = 0, quiet = 0;
6892 	int error = 0;
6893 	int use_timeout;
6894 	int immediate = 1;
6895 	int invert = 0;
6896 	int passes = 0;
6897 	int ause = 0;
6898 	int fd = -1;
6899 	const char *pattern = NULL;
6900 	uint8_t *data_ptr = NULL;
6901 	uint32_t dxfer_len = 0;
6902 	uint8_t byte2;
6903 	uint16_t feature, count;
6904 	uint64_t lba;
6905 	int reportonly = 0;
6906 	camcontrol_devtype dt;
6907 
6908 	/*
6909 	 * Get the device type, request no I/O be done to do this.
6910 	 */
6911 	error = get_device_type(device, -1, 0, 0, &dt);
6912 	if (error != 0 || (unsigned)dt > CC_DT_UNKNOWN) {
6913 		warnx("sanitize: can't get device type");
6914 		return (1);
6915 	}
6916 
6917 	ccb = cam_getccb(device);
6918 
6919 	if (ccb == NULL) {
6920 		warnx("sanitize: error allocating ccb");
6921 		return (1);
6922 	}
6923 
6924 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
6925 		switch(c) {
6926 		case 'a':
6927 			if (strcasecmp(optarg, "overwrite") == 0)
6928 				action = SSZ_SERVICE_ACTION_OVERWRITE;
6929 			else if (strcasecmp(optarg, "block") == 0)
6930 				action = SSZ_SERVICE_ACTION_BLOCK_ERASE;
6931 			else if (strcasecmp(optarg, "crypto") == 0)
6932 				action = SSZ_SERVICE_ACTION_CRYPTO_ERASE;
6933 			else if (strcasecmp(optarg, "exitfailure") == 0)
6934 				action = SSZ_SERVICE_ACTION_EXIT_MODE_FAILURE;
6935 			else {
6936 				warnx("invalid service operation \"%s\"",
6937 				      optarg);
6938 				error = 1;
6939 				goto sanitize_bailout;
6940 			}
6941 			break;
6942 		case 'c':
6943 			passes = strtol(optarg, NULL, 0);
6944 			if (passes < 1 || passes > 31) {
6945 				warnx("invalid passes value %d", passes);
6946 				error = 1;
6947 				goto sanitize_bailout;
6948 			}
6949 			break;
6950 		case 'I':
6951 			invert = 1;
6952 			break;
6953 		case 'P':
6954 			pattern = optarg;
6955 			break;
6956 		case 'q':
6957 			quiet++;
6958 			break;
6959 		case 'U':
6960 			ause = 1;
6961 			break;
6962 		case 'r':
6963 			reportonly = 1;
6964 			break;
6965 		case 'w':
6966 			/* ATA supports only immediate commands. */
6967 			if (dt == CC_DT_SCSI)
6968 				immediate = 0;
6969 			break;
6970 		case 'y':
6971 			ycount++;
6972 			break;
6973 		}
6974 	}
6975 
6976 	if (reportonly)
6977 		goto doreport;
6978 
6979 	if (action == 0) {
6980 		warnx("an action is required");
6981 		error = 1;
6982 		goto sanitize_bailout;
6983 	} else if (action == SSZ_SERVICE_ACTION_OVERWRITE) {
6984 		struct scsi_sanitize_parameter_list *pl;
6985 		struct stat sb;
6986 		ssize_t sz, amt;
6987 
6988 		if (pattern == NULL) {
6989 			warnx("overwrite action requires -P argument");
6990 			error = 1;
6991 			goto sanitize_bailout;
6992 		}
6993 		fd = open(pattern, O_RDONLY);
6994 		if (fd < 0) {
6995 			warn("cannot open pattern file %s", pattern);
6996 			error = 1;
6997 			goto sanitize_bailout;
6998 		}
6999 		if (fstat(fd, &sb) < 0) {
7000 			warn("cannot stat pattern file %s", pattern);
7001 			error = 1;
7002 			goto sanitize_bailout;
7003 		}
7004 		sz = sb.st_size;
7005 		if (sz > SSZPL_MAX_PATTERN_LENGTH) {
7006 			warnx("pattern file size exceeds maximum value %d",
7007 			      SSZPL_MAX_PATTERN_LENGTH);
7008 			error = 1;
7009 			goto sanitize_bailout;
7010 		}
7011 		dxfer_len = sizeof(*pl) + sz;
7012 		data_ptr = calloc(1, dxfer_len);
7013 		if (data_ptr == NULL) {
7014 			warnx("cannot allocate parameter list buffer");
7015 			error = 1;
7016 			goto sanitize_bailout;
7017 		}
7018 
7019 		amt = read(fd, data_ptr + sizeof(*pl), sz);
7020 		if (amt < 0) {
7021 			warn("cannot read pattern file");
7022 			error = 1;
7023 			goto sanitize_bailout;
7024 		} else if (amt != sz) {
7025 			warnx("short pattern file read");
7026 			error = 1;
7027 			goto sanitize_bailout;
7028 		}
7029 
7030 		pl = (struct scsi_sanitize_parameter_list *)data_ptr;
7031 		if (passes == 0)
7032 			pl->byte1 = 1;
7033 		else
7034 			pl->byte1 = passes;
7035 		if (invert != 0)
7036 			pl->byte1 |= SSZPL_INVERT;
7037 		scsi_ulto2b(sz, pl->length);
7038 	} else {
7039 		const char *arg;
7040 
7041 		if (passes != 0)
7042 			arg = "-c";
7043 		else if (invert != 0)
7044 			arg = "-I";
7045 		else if (pattern != NULL)
7046 			arg = "-P";
7047 		else
7048 			arg = NULL;
7049 		if (arg != NULL) {
7050 			warnx("%s argument only valid with overwrite "
7051 			      "operation", arg);
7052 			error = 1;
7053 			goto sanitize_bailout;
7054 		}
7055 	}
7056 
7057 	if (quiet == 0 && ycount == 0) {
7058 		fprintf(stdout, "You are about to REMOVE ALL DATA from the "
7059 			"following device:\n");
7060 
7061 		if (dt == CC_DT_SCSI) {
7062 			error = scsidoinquiry(device, argc, argv, combinedopt,
7063 					      task_attr, retry_count, timeout);
7064 		} else if (dt == CC_DT_ATA || dt == CC_DT_SATL) {
7065 			struct ata_params *ident_buf;
7066 			error = ata_do_identify(device, retry_count, timeout,
7067 						ccb, &ident_buf);
7068 			if (error == 0) {
7069 				printf("%s%d: ", device->device_name,
7070 				    device->dev_unit_num);
7071 				ata_print_ident(ident_buf);
7072 				free(ident_buf);
7073 			}
7074 		} else
7075 			error = 1;
7076 
7077 		if (error != 0) {
7078 			warnx("sanitize: error sending inquiry");
7079 			goto sanitize_bailout;
7080 		}
7081 	}
7082 
7083 	if (ycount == 0) {
7084 		if (!get_confirmation()) {
7085 			error = 1;
7086 			goto sanitize_bailout;
7087 		}
7088 	}
7089 
7090 	if (timeout != 0)
7091 		use_timeout = timeout;
7092 	else
7093 		use_timeout = (immediate ? 10 : 10800) * 1000;
7094 
7095 	if (immediate == 0 && quiet == 0) {
7096 		fprintf(stdout, "Current sanitize timeout is %d seconds\n",
7097 			use_timeout / 1000);
7098 	}
7099 
7100 	/*
7101 	 * If the user hasn't disabled questions and didn't specify a
7102 	 * timeout on the command line, ask them if they want the current
7103 	 * timeout.
7104 	 */
7105 	if (immediate == 0 && ycount == 0 && timeout == 0) {
7106 		char str[1024];
7107 		int new_timeout = 0;
7108 
7109 		fprintf(stdout, "Enter new timeout in seconds or press\n"
7110 			"return to keep the current timeout [%d] ",
7111 			use_timeout / 1000);
7112 
7113 		if (fgets(str, sizeof(str), stdin) != NULL) {
7114 			if (str[0] != '\0')
7115 				new_timeout = atoi(str);
7116 		}
7117 
7118 		if (new_timeout != 0) {
7119 			use_timeout = new_timeout * 1000;
7120 			fprintf(stdout, "Using new timeout value %d\n",
7121 				use_timeout / 1000);
7122 		}
7123 	}
7124 
7125 	if (dt == CC_DT_SCSI) {
7126 		byte2 = action;
7127 		if (ause != 0)
7128 			byte2 |= SSZ_UNRESTRICTED_EXIT;
7129 		if (immediate != 0)
7130 			byte2 |= SSZ_IMMED;
7131 		scsi_sanitize(&ccb->csio,
7132 			      /* retries */ retry_count,
7133 			      /* cbfcnp */ NULL,
7134 			      /* tag_action */ task_attr,
7135 			      /* byte2 */ byte2,
7136 			      /* control */ 0,
7137 			      /* data_ptr */ data_ptr,
7138 			      /* dxfer_len */ dxfer_len,
7139 			      /* sense_len */ SSD_FULL_SIZE,
7140 			      /* timeout */ use_timeout);
7141 
7142 		ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
7143 		if (arglist & CAM_ARG_ERR_RECOVER)
7144 			ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
7145 		if (cam_send_ccb(device, ccb) < 0) {
7146 			warn("error sending sanitize command");
7147 			error = 1;
7148 			goto sanitize_bailout;
7149 		}
7150 	} else if (dt == CC_DT_ATA || dt == CC_DT_SATL) {
7151 		if (action == SSZ_SERVICE_ACTION_OVERWRITE) {
7152 			feature = 0x14; /* OVERWRITE EXT */
7153 			lba = 0x4F5700000000 | scsi_4btoul(data_ptr + 4);
7154 			count = (passes == 0) ? 1 : (passes >= 16) ? 0 : passes;
7155 			if (invert)
7156 				count |= 0x80; /* INVERT PATTERN */
7157 			if (ause)
7158 				count |= 0x10; /* FAILURE MODE */
7159 		} else if (action == SSZ_SERVICE_ACTION_BLOCK_ERASE) {
7160 			feature = 0x12; /* BLOCK ERASE EXT */
7161 			lba = 0x0000426B4572;
7162 			count = 0;
7163 			if (ause)
7164 				count |= 0x10; /* FAILURE MODE */
7165 		} else if (action == SSZ_SERVICE_ACTION_CRYPTO_ERASE) {
7166 			feature = 0x11; /* CRYPTO SCRAMBLE EXT */
7167 			lba = 0x000043727970;
7168 			count = 0;
7169 			if (ause)
7170 				count |= 0x10; /* FAILURE MODE */
7171 		} else if (action == SSZ_SERVICE_ACTION_EXIT_MODE_FAILURE) {
7172 			feature = 0x00; /* SANITIZE STATUS EXT */
7173 			lba = 0;
7174 			count = 1; /* CLEAR SANITIZE OPERATION FAILED */
7175 		} else {
7176 			error = 1;
7177 			goto sanitize_bailout;
7178 		}
7179 
7180 		error = ata_do_cmd(device,
7181 				   ccb,
7182 				   retry_count,
7183 				   /*flags*/CAM_DIR_NONE,
7184 				   /*protocol*/AP_PROTO_NON_DATA | AP_EXTEND,
7185 				   /*ata_flags*/0,
7186 				   /*tag_action*/MSG_SIMPLE_Q_TAG,
7187 				   /*command*/ATA_SANITIZE,
7188 				   /*features*/feature,
7189 				   /*lba*/lba,
7190 				   /*sector_count*/count,
7191 				   /*data_ptr*/NULL,
7192 				   /*dxfer_len*/0,
7193 				   /*timeout*/ use_timeout,
7194 				   /*is48bit*/1);
7195 	}
7196 
7197 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
7198 		struct scsi_sense_data *sense;
7199 		int error_code, sense_key, asc, ascq;
7200 
7201 		if ((ccb->ccb_h.status & CAM_STATUS_MASK) ==
7202 		    CAM_SCSI_STATUS_ERROR) {
7203 			sense = &ccb->csio.sense_data;
7204 			scsi_extract_sense_len(sense, ccb->csio.sense_len -
7205 			    ccb->csio.sense_resid, &error_code, &sense_key,
7206 			    &asc, &ascq, /*show_errors*/ 1);
7207 
7208 			if (sense_key == SSD_KEY_ILLEGAL_REQUEST &&
7209 			    asc == 0x20 && ascq == 0x00)
7210 				warnx("sanitize is not supported by "
7211 				      "this device");
7212 			else
7213 				warnx("error sanitizing this device");
7214 		} else
7215 			warnx("error sanitizing this device");
7216 
7217 		if (arglist & CAM_ARG_VERBOSE) {
7218 			cam_error_print(device, ccb, CAM_ESF_ALL,
7219 					CAM_EPF_ALL, stderr);
7220 		}
7221 		error = 1;
7222 		goto sanitize_bailout;
7223 	}
7224 
7225 	/*
7226 	 * If we ran in non-immediate mode, we already checked for errors
7227 	 * above and printed out any necessary information.  If we're in
7228 	 * immediate mode, we need to loop through and get status
7229 	 * information periodically.
7230 	 */
7231 	if (immediate == 0) {
7232 		if (quiet == 0) {
7233 			fprintf(stdout, "Sanitize Complete\n");
7234 		}
7235 		goto sanitize_bailout;
7236 	}
7237 
7238 doreport:
7239 	if (dt == CC_DT_SCSI) {
7240 		error = sanitize_wait_scsi(device, ccb, task_attr, quiet);
7241 	} else if (dt == CC_DT_ATA || dt == CC_DT_SATL) {
7242 		error = sanitize_wait_ata(device, ccb, quiet, dt);
7243 	} else
7244 		error = 1;
7245 	if (error == 0 && quiet == 0)
7246 		fprintf(stdout, "Sanitize Complete                      \n");
7247 
7248 sanitize_bailout:
7249 	if (fd >= 0)
7250 		close(fd);
7251 	if (data_ptr != NULL)
7252 		free(data_ptr);
7253 	cam_freeccb(ccb);
7254 
7255 	return (error);
7256 }
7257 
7258 static int
7259 scsireportluns(struct cam_device *device, int argc, char **argv,
7260 	       char *combinedopt, int task_attr, int retry_count, int timeout)
7261 {
7262 	union ccb *ccb;
7263 	int c, countonly, lunsonly;
7264 	struct scsi_report_luns_data *lundata;
7265 	int alloc_len;
7266 	uint8_t report_type;
7267 	uint32_t list_len, i, j;
7268 	int retval;
7269 
7270 	retval = 0;
7271 	lundata = NULL;
7272 	report_type = RPL_REPORT_DEFAULT;
7273 	ccb = cam_getccb(device);
7274 
7275 	if (ccb == NULL) {
7276 		warnx("%s: error allocating ccb", __func__);
7277 		return (1);
7278 	}
7279 
7280 	countonly = 0;
7281 	lunsonly = 0;
7282 
7283 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
7284 		switch (c) {
7285 		case 'c':
7286 			countonly++;
7287 			break;
7288 		case 'l':
7289 			lunsonly++;
7290 			break;
7291 		case 'r':
7292 			if (strcasecmp(optarg, "default") == 0)
7293 				report_type = RPL_REPORT_DEFAULT;
7294 			else if (strcasecmp(optarg, "wellknown") == 0)
7295 				report_type = RPL_REPORT_WELLKNOWN;
7296 			else if (strcasecmp(optarg, "all") == 0)
7297 				report_type = RPL_REPORT_ALL;
7298 			else {
7299 				warnx("%s: invalid report type \"%s\"",
7300 				      __func__, optarg);
7301 				retval = 1;
7302 				goto bailout;
7303 			}
7304 			break;
7305 		default:
7306 			break;
7307 		}
7308 	}
7309 
7310 	if ((countonly != 0)
7311 	 && (lunsonly != 0)) {
7312 		warnx("%s: you can only specify one of -c or -l", __func__);
7313 		retval = 1;
7314 		goto bailout;
7315 	}
7316 	/*
7317 	 * According to SPC-4, the allocation length must be at least 16
7318 	 * bytes -- enough for the header and one LUN.
7319 	 */
7320 	alloc_len = sizeof(*lundata) + 8;
7321 
7322 retry:
7323 
7324 	lundata = malloc(alloc_len);
7325 
7326 	if (lundata == NULL) {
7327 		warn("%s: error mallocing %d bytes", __func__, alloc_len);
7328 		retval = 1;
7329 		goto bailout;
7330 	}
7331 
7332 	scsi_report_luns(&ccb->csio,
7333 			 /*retries*/ retry_count,
7334 			 /*cbfcnp*/ NULL,
7335 			 /*tag_action*/ task_attr,
7336 			 /*select_report*/ report_type,
7337 			 /*rpl_buf*/ lundata,
7338 			 /*alloc_len*/ alloc_len,
7339 			 /*sense_len*/ SSD_FULL_SIZE,
7340 			 /*timeout*/ timeout ? timeout : 5000);
7341 
7342 	/* Disable freezing the device queue */
7343 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
7344 
7345 	if (arglist & CAM_ARG_ERR_RECOVER)
7346 		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
7347 
7348 	if (cam_send_ccb(device, ccb) < 0) {
7349 		warn("error sending REPORT LUNS command");
7350 		retval = 1;
7351 		goto bailout;
7352 	}
7353 
7354 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
7355 		cam_error_print(device, ccb, CAM_ESF_ALL, CAM_EPF_ALL, stderr);
7356 		retval = 1;
7357 		goto bailout;
7358 	}
7359 
7360 
7361 	list_len = scsi_4btoul(lundata->length);
7362 
7363 	/*
7364 	 * If we need to list the LUNs, and our allocation
7365 	 * length was too short, reallocate and retry.
7366 	 */
7367 	if ((countonly == 0)
7368 	 && (list_len > (alloc_len - sizeof(*lundata)))) {
7369 		alloc_len = list_len + sizeof(*lundata);
7370 		free(lundata);
7371 		goto retry;
7372 	}
7373 
7374 	if (lunsonly == 0)
7375 		fprintf(stdout, "%u LUN%s found\n", list_len / 8,
7376 			((list_len / 8) > 1) ? "s" : "");
7377 
7378 	if (countonly != 0)
7379 		goto bailout;
7380 
7381 	for (i = 0; i < (list_len / 8); i++) {
7382 		int no_more;
7383 
7384 		no_more = 0;
7385 		for (j = 0; j < sizeof(lundata->luns[i].lundata); j += 2) {
7386 			if (j != 0)
7387 				fprintf(stdout, ",");
7388 			switch (lundata->luns[i].lundata[j] &
7389 				RPL_LUNDATA_ATYP_MASK) {
7390 			case RPL_LUNDATA_ATYP_PERIPH:
7391 				if ((lundata->luns[i].lundata[j] &
7392 				    RPL_LUNDATA_PERIPH_BUS_MASK) != 0)
7393 					fprintf(stdout, "%d:",
7394 						lundata->luns[i].lundata[j] &
7395 						RPL_LUNDATA_PERIPH_BUS_MASK);
7396 				else if ((j == 0)
7397 				      && ((lundata->luns[i].lundata[j+2] &
7398 					  RPL_LUNDATA_PERIPH_BUS_MASK) == 0))
7399 					no_more = 1;
7400 
7401 				fprintf(stdout, "%d",
7402 					lundata->luns[i].lundata[j+1]);
7403 				break;
7404 			case RPL_LUNDATA_ATYP_FLAT: {
7405 				uint8_t tmplun[2];
7406 				tmplun[0] = lundata->luns[i].lundata[j] &
7407 					RPL_LUNDATA_FLAT_LUN_MASK;
7408 				tmplun[1] = lundata->luns[i].lundata[j+1];
7409 
7410 				fprintf(stdout, "%d", scsi_2btoul(tmplun));
7411 				no_more = 1;
7412 				break;
7413 			}
7414 			case RPL_LUNDATA_ATYP_LUN:
7415 				fprintf(stdout, "%d:%d:%d",
7416 					(lundata->luns[i].lundata[j+1] &
7417 					RPL_LUNDATA_LUN_BUS_MASK) >> 5,
7418 					lundata->luns[i].lundata[j] &
7419 					RPL_LUNDATA_LUN_TARG_MASK,
7420 					lundata->luns[i].lundata[j+1] &
7421 					RPL_LUNDATA_LUN_LUN_MASK);
7422 				break;
7423 			case RPL_LUNDATA_ATYP_EXTLUN: {
7424 				int field_len_code, eam_code;
7425 
7426 				eam_code = lundata->luns[i].lundata[j] &
7427 					RPL_LUNDATA_EXT_EAM_MASK;
7428 				field_len_code = (lundata->luns[i].lundata[j] &
7429 					RPL_LUNDATA_EXT_LEN_MASK) >> 4;
7430 
7431 				if ((eam_code == RPL_LUNDATA_EXT_EAM_WK)
7432 				 && (field_len_code == 0x00)) {
7433 					fprintf(stdout, "%d",
7434 						lundata->luns[i].lundata[j+1]);
7435 				} else if ((eam_code ==
7436 					    RPL_LUNDATA_EXT_EAM_NOT_SPEC)
7437 					&& (field_len_code == 0x03)) {
7438 					uint8_t tmp_lun[8];
7439 
7440 					/*
7441 					 * This format takes up all 8 bytes.
7442 					 * If we aren't starting at offset 0,
7443 					 * that's a bug.
7444 					 */
7445 					if (j != 0) {
7446 						fprintf(stdout, "Invalid "
7447 							"offset %d for "
7448 							"Extended LUN not "
7449 							"specified format", j);
7450 						no_more = 1;
7451 						break;
7452 					}
7453 					bzero(tmp_lun, sizeof(tmp_lun));
7454 					bcopy(&lundata->luns[i].lundata[j+1],
7455 					      &tmp_lun[1], sizeof(tmp_lun) - 1);
7456 					fprintf(stdout, "%#jx",
7457 					       (intmax_t)scsi_8btou64(tmp_lun));
7458 					no_more = 1;
7459 				} else {
7460 					fprintf(stderr, "Unknown Extended LUN"
7461 						"Address method %#x, length "
7462 						"code %#x", eam_code,
7463 						field_len_code);
7464 					no_more = 1;
7465 				}
7466 				break;
7467 			}
7468 			default:
7469 				fprintf(stderr, "Unknown LUN address method "
7470 					"%#x\n", lundata->luns[i].lundata[0] &
7471 					RPL_LUNDATA_ATYP_MASK);
7472 				break;
7473 			}
7474 			/*
7475 			 * For the flat addressing method, there are no
7476 			 * other levels after it.
7477 			 */
7478 			if (no_more != 0)
7479 				break;
7480 		}
7481 		fprintf(stdout, "\n");
7482 	}
7483 
7484 bailout:
7485 
7486 	cam_freeccb(ccb);
7487 
7488 	free(lundata);
7489 
7490 	return (retval);
7491 }
7492 
7493 static int
7494 scsireadcapacity(struct cam_device *device, int argc, char **argv,
7495 		 char *combinedopt, int task_attr, int retry_count, int timeout)
7496 {
7497 	union ccb *ccb;
7498 	int blocksizeonly, humanize, numblocks, quiet, sizeonly, baseten, longonly;
7499 	struct scsi_read_capacity_data rcap;
7500 	struct scsi_read_capacity_data_long rcaplong;
7501 	uint64_t maxsector;
7502 	uint32_t block_len;
7503 	int retval;
7504 	int c;
7505 
7506 	blocksizeonly = 0;
7507 	humanize = 0;
7508 	longonly = 0;
7509 	numblocks = 0;
7510 	quiet = 0;
7511 	sizeonly = 0;
7512 	baseten = 0;
7513 	retval = 0;
7514 
7515 	ccb = cam_getccb(device);
7516 
7517 	if (ccb == NULL) {
7518 		warnx("%s: error allocating ccb", __func__);
7519 		return (1);
7520 	}
7521 
7522 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
7523 		switch (c) {
7524 		case 'b':
7525 			blocksizeonly++;
7526 			break;
7527 		case 'h':
7528 			humanize++;
7529 			baseten = 0;
7530 			break;
7531 		case 'H':
7532 			humanize++;
7533 			baseten++;
7534 			break;
7535 		case 'l':
7536 			longonly++;
7537 			break;
7538 		case 'N':
7539 			numblocks++;
7540 			break;
7541 		case 'q':
7542 			quiet++;
7543 			break;
7544 		case 's':
7545 			sizeonly++;
7546 			break;
7547 		default:
7548 			break;
7549 		}
7550 	}
7551 
7552 	if ((blocksizeonly != 0)
7553 	 && (numblocks != 0)) {
7554 		warnx("%s: you can only specify one of -b or -N", __func__);
7555 		retval = 1;
7556 		goto bailout;
7557 	}
7558 
7559 	if ((blocksizeonly != 0)
7560 	 && (sizeonly != 0)) {
7561 		warnx("%s: you can only specify one of -b or -s", __func__);
7562 		retval = 1;
7563 		goto bailout;
7564 	}
7565 
7566 	if ((humanize != 0)
7567 	 && (quiet != 0)) {
7568 		warnx("%s: you can only specify one of -h/-H or -q", __func__);
7569 		retval = 1;
7570 		goto bailout;
7571 	}
7572 
7573 	if ((humanize != 0)
7574 	 && (blocksizeonly != 0)) {
7575 		warnx("%s: you can only specify one of -h/-H or -b", __func__);
7576 		retval = 1;
7577 		goto bailout;
7578 	}
7579 
7580 	if (longonly != 0)
7581 		goto long_only;
7582 
7583 	scsi_read_capacity(&ccb->csio,
7584 			   /*retries*/ retry_count,
7585 			   /*cbfcnp*/ NULL,
7586 			   /*tag_action*/ task_attr,
7587 			   &rcap,
7588 			   SSD_FULL_SIZE,
7589 			   /*timeout*/ timeout ? timeout : 5000);
7590 
7591 	/* Disable freezing the device queue */
7592 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
7593 
7594 	if (arglist & CAM_ARG_ERR_RECOVER)
7595 		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
7596 
7597 	if (cam_send_ccb(device, ccb) < 0) {
7598 		warn("error sending READ CAPACITY command");
7599 		retval = 1;
7600 		goto bailout;
7601 	}
7602 
7603 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
7604 		cam_error_print(device, ccb, CAM_ESF_ALL, CAM_EPF_ALL, stderr);
7605 		retval = 1;
7606 		goto bailout;
7607 	}
7608 
7609 	maxsector = scsi_4btoul(rcap.addr);
7610 	block_len = scsi_4btoul(rcap.length);
7611 
7612 	/*
7613 	 * A last block of 2^32-1 means that the true capacity is over 2TB,
7614 	 * and we need to issue the long READ CAPACITY to get the real
7615 	 * capacity.  Otherwise, we're all set.
7616 	 */
7617 	if (maxsector != 0xffffffff)
7618 		goto do_print;
7619 
7620 long_only:
7621 	scsi_read_capacity_16(&ccb->csio,
7622 			      /*retries*/ retry_count,
7623 			      /*cbfcnp*/ NULL,
7624 			      /*tag_action*/ task_attr,
7625 			      /*lba*/ 0,
7626 			      /*reladdr*/ 0,
7627 			      /*pmi*/ 0,
7628 			      /*rcap_buf*/ (uint8_t *)&rcaplong,
7629 			      /*rcap_buf_len*/ sizeof(rcaplong),
7630 			      /*sense_len*/ SSD_FULL_SIZE,
7631 			      /*timeout*/ timeout ? timeout : 5000);
7632 
7633 	/* Disable freezing the device queue */
7634 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
7635 
7636 	if (arglist & CAM_ARG_ERR_RECOVER)
7637 		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
7638 
7639 	if (cam_send_ccb(device, ccb) < 0) {
7640 		warn("error sending READ CAPACITY (16) command");
7641 		retval = 1;
7642 		goto bailout;
7643 	}
7644 
7645 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
7646 		cam_error_print(device, ccb, CAM_ESF_ALL, CAM_EPF_ALL, stderr);
7647 		retval = 1;
7648 		goto bailout;
7649 	}
7650 
7651 	maxsector = scsi_8btou64(rcaplong.addr);
7652 	block_len = scsi_4btoul(rcaplong.length);
7653 
7654 do_print:
7655 	if (blocksizeonly == 0) {
7656 		/*
7657 		 * Humanize implies !quiet, and also implies numblocks.
7658 		 */
7659 		if (humanize != 0) {
7660 			char tmpstr[6];
7661 			int64_t tmpbytes;
7662 			int ret;
7663 
7664 			tmpbytes = (maxsector + 1) * block_len;
7665 			ret = humanize_number(tmpstr, sizeof(tmpstr),
7666 					      tmpbytes, "", HN_AUTOSCALE,
7667 					      HN_B | HN_DECIMAL |
7668 					      ((baseten != 0) ?
7669 					      HN_DIVISOR_1000 : 0));
7670 			if (ret == -1) {
7671 				warnx("%s: humanize_number failed!", __func__);
7672 				retval = 1;
7673 				goto bailout;
7674 			}
7675 			fprintf(stdout, "Device Size: %s%s", tmpstr,
7676 				(sizeonly == 0) ?  ", " : "\n");
7677 		} else if (numblocks != 0) {
7678 			fprintf(stdout, "%s%ju%s", (quiet == 0) ?
7679 				"Blocks: " : "", (uintmax_t)maxsector + 1,
7680 				(sizeonly == 0) ? ", " : "\n");
7681 		} else {
7682 			fprintf(stdout, "%s%ju%s", (quiet == 0) ?
7683 				"Last Block: " : "", (uintmax_t)maxsector,
7684 				(sizeonly == 0) ? ", " : "\n");
7685 		}
7686 	}
7687 	if (sizeonly == 0)
7688 		fprintf(stdout, "%s%u%s\n", (quiet == 0) ?
7689 			"Block Length: " : "", block_len, (quiet == 0) ?
7690 			" bytes" : "");
7691 bailout:
7692 	cam_freeccb(ccb);
7693 
7694 	return (retval);
7695 }
7696 
7697 static int
7698 smpcmd(struct cam_device *device, int argc, char **argv, char *combinedopt,
7699        int retry_count, int timeout)
7700 {
7701 	int c, error = 0;
7702 	union ccb *ccb;
7703 	uint8_t *smp_request = NULL, *smp_response = NULL;
7704 	int request_size = 0, response_size = 0;
7705 	int fd_request = 0, fd_response = 0;
7706 	char *datastr = NULL;
7707 	struct get_hook hook;
7708 	int retval;
7709 	int flags = 0;
7710 
7711 	/*
7712 	 * Note that at the moment we don't support sending SMP CCBs to
7713 	 * devices that aren't probed by CAM.
7714 	 */
7715 	ccb = cam_getccb(device);
7716 	if (ccb == NULL) {
7717 		warnx("%s: error allocating CCB", __func__);
7718 		return (1);
7719 	}
7720 
7721 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
7722 		switch (c) {
7723 		case 'R':
7724 			arglist |= CAM_ARG_CMD_IN;
7725 			response_size = strtol(optarg, NULL, 0);
7726 			if (response_size <= 0) {
7727 				warnx("invalid number of response bytes %d",
7728 				      response_size);
7729 				error = 1;
7730 				goto smpcmd_bailout;
7731 			}
7732 			hook.argc = argc - optind;
7733 			hook.argv = argv + optind;
7734 			hook.got = 0;
7735 			optind++;
7736 			datastr = cget(&hook, NULL);
7737 			/*
7738 			 * If the user supplied "-" instead of a format, he
7739 			 * wants the data to be written to stdout.
7740 			 */
7741 			if ((datastr != NULL)
7742 			 && (datastr[0] == '-'))
7743 				fd_response = 1;
7744 
7745 			smp_response = (uint8_t *)malloc(response_size);
7746 			if (smp_response == NULL) {
7747 				warn("can't malloc memory for SMP response");
7748 				error = 1;
7749 				goto smpcmd_bailout;
7750 			}
7751 			break;
7752 		case 'r':
7753 			arglist |= CAM_ARG_CMD_OUT;
7754 			request_size = strtol(optarg, NULL, 0);
7755 			if (request_size <= 0) {
7756 				warnx("invalid number of request bytes %d",
7757 				      request_size);
7758 				error = 1;
7759 				goto smpcmd_bailout;
7760 			}
7761 			hook.argc = argc - optind;
7762 			hook.argv = argv + optind;
7763 			hook.got = 0;
7764 			datastr = cget(&hook, NULL);
7765 			smp_request = (uint8_t *)malloc(request_size);
7766 			if (smp_request == NULL) {
7767 				warn("can't malloc memory for SMP request");
7768 				error = 1;
7769 				goto smpcmd_bailout;
7770 			}
7771 			bzero(smp_request, request_size);
7772 			/*
7773 			 * If the user supplied "-" instead of a format, he
7774 			 * wants the data to be read from stdin.
7775 			 */
7776 			if ((datastr != NULL)
7777 			 && (datastr[0] == '-'))
7778 				fd_request = 1;
7779 			else
7780 				buff_encode_visit(smp_request, request_size,
7781 						  datastr,
7782 						  iget, &hook);
7783 			optind += hook.got;
7784 			break;
7785 		default:
7786 			break;
7787 		}
7788 	}
7789 
7790 	/*
7791 	 * If fd_data is set, and we're writing to the device, we need to
7792 	 * read the data the user wants written from stdin.
7793 	 */
7794 	if ((fd_request == 1) && (arglist & CAM_ARG_CMD_OUT)) {
7795 		ssize_t amt_read;
7796 		int amt_to_read = request_size;
7797 		uint8_t *buf_ptr = smp_request;
7798 
7799 		for (amt_read = 0; amt_to_read > 0;
7800 		     amt_read = read(STDIN_FILENO, buf_ptr, amt_to_read)) {
7801 			if (amt_read == -1) {
7802 				warn("error reading data from stdin");
7803 				error = 1;
7804 				goto smpcmd_bailout;
7805 			}
7806 			amt_to_read -= amt_read;
7807 			buf_ptr += amt_read;
7808 		}
7809 	}
7810 
7811 	if (((arglist & CAM_ARG_CMD_IN) == 0)
7812 	 || ((arglist & CAM_ARG_CMD_OUT) == 0)) {
7813 		warnx("%s: need both the request (-r) and response (-R) "
7814 		      "arguments", __func__);
7815 		error = 1;
7816 		goto smpcmd_bailout;
7817 	}
7818 
7819 	flags |= CAM_DEV_QFRZDIS;
7820 
7821 	cam_fill_smpio(&ccb->smpio,
7822 		       /*retries*/ retry_count,
7823 		       /*cbfcnp*/ NULL,
7824 		       /*flags*/ flags,
7825 		       /*smp_request*/ smp_request,
7826 		       /*smp_request_len*/ request_size,
7827 		       /*smp_response*/ smp_response,
7828 		       /*smp_response_len*/ response_size,
7829 		       /*timeout*/ timeout ? timeout : 5000);
7830 
7831 	ccb->smpio.flags = SMP_FLAG_NONE;
7832 
7833 	if (((retval = cam_send_ccb(device, ccb)) < 0)
7834 	 || ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP)) {
7835 		const char warnstr[] = "error sending command";
7836 
7837 		if (retval < 0)
7838 			warn(warnstr);
7839 		else
7840 			warnx(warnstr);
7841 
7842 		if (arglist & CAM_ARG_VERBOSE) {
7843 			cam_error_print(device, ccb, CAM_ESF_ALL,
7844 					CAM_EPF_ALL, stderr);
7845 		}
7846 	}
7847 
7848 	if (((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP)
7849 	 && (response_size > 0)) {
7850 		if (fd_response == 0) {
7851 			buff_decode_visit(smp_response, response_size,
7852 					  datastr, arg_put, NULL);
7853 			fprintf(stdout, "\n");
7854 		} else {
7855 			ssize_t amt_written;
7856 			int amt_to_write = response_size;
7857 			uint8_t *buf_ptr = smp_response;
7858 
7859 			for (amt_written = 0; (amt_to_write > 0) &&
7860 			     (amt_written = write(STDOUT_FILENO, buf_ptr,
7861 						  amt_to_write)) > 0;){
7862 				amt_to_write -= amt_written;
7863 				buf_ptr += amt_written;
7864 			}
7865 			if (amt_written == -1) {
7866 				warn("error writing data to stdout");
7867 				error = 1;
7868 				goto smpcmd_bailout;
7869 			} else if ((amt_written == 0)
7870 				&& (amt_to_write > 0)) {
7871 				warnx("only wrote %u bytes out of %u",
7872 				      response_size - amt_to_write,
7873 				      response_size);
7874 			}
7875 		}
7876 	}
7877 smpcmd_bailout:
7878 	if (ccb != NULL)
7879 		cam_freeccb(ccb);
7880 
7881 	if (smp_request != NULL)
7882 		free(smp_request);
7883 
7884 	if (smp_response != NULL)
7885 		free(smp_response);
7886 
7887 	return (error);
7888 }
7889 
7890 static int
7891 mmcsdcmd(struct cam_device *device, int argc, char **argv, char *combinedopt,
7892        int retry_count, int timeout)
7893 {
7894 	int c, error = 0;
7895 	union ccb *ccb;
7896 	int32_t mmc_opcode = 0, mmc_arg = 0;
7897 	int32_t mmc_flags = -1;
7898 	int retval;
7899 	int is_write = 0;
7900 	int is_bw_4 = 0, is_bw_1 = 0;
7901 	int is_frequency = 0;
7902 	int is_highspeed = 0, is_stdspeed = 0;
7903 	int is_info_request = 0;
7904 	int flags = 0;
7905 	uint8_t mmc_data_byte = 0;
7906 	uint32_t mmc_frequency = 0;
7907 
7908 	/* For IO_RW_EXTENDED command */
7909 	uint8_t *mmc_data = NULL;
7910 	struct mmc_data mmc_d;
7911 	int mmc_data_len = 0;
7912 
7913 	/*
7914 	 * Note that at the moment we don't support sending SMP CCBs to
7915 	 * devices that aren't probed by CAM.
7916 	 */
7917 	ccb = cam_getccb(device);
7918 	if (ccb == NULL) {
7919 		warnx("%s: error allocating CCB", __func__);
7920 		return (1);
7921 	}
7922 
7923 	bzero(&(&ccb->ccb_h)[1],
7924 	      sizeof(union ccb) - sizeof(struct ccb_hdr));
7925 
7926 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
7927 		switch (c) {
7928 		case '4':
7929 			is_bw_4 = 1;
7930 			break;
7931 		case '1':
7932 			is_bw_1 = 1;
7933 			break;
7934 		case 'S':
7935 			if (!strcmp(optarg, "high"))
7936 				is_highspeed = 1;
7937 			else
7938 				is_stdspeed = 1;
7939 			break;
7940 		case 'I':
7941 			is_info_request = 1;
7942 			break;
7943 		case 'F':
7944 			is_frequency = 1;
7945 			mmc_frequency = strtol(optarg, NULL, 0);
7946 			break;
7947 		case 'c':
7948 			mmc_opcode = strtol(optarg, NULL, 0);
7949 			if (mmc_opcode < 0) {
7950 				warnx("invalid MMC opcode %d",
7951 				      mmc_opcode);
7952 				error = 1;
7953 				goto mmccmd_bailout;
7954 			}
7955 			break;
7956 		case 'a':
7957 			mmc_arg = strtol(optarg, NULL, 0);
7958 			if (mmc_arg < 0) {
7959 				warnx("invalid MMC arg %d",
7960 				      mmc_arg);
7961 				error = 1;
7962 				goto mmccmd_bailout;
7963 			}
7964 			break;
7965 		case 'f':
7966 			mmc_flags = strtol(optarg, NULL, 0);
7967 			if (mmc_flags < 0) {
7968 				warnx("invalid MMC flags %d",
7969 				      mmc_flags);
7970 				error = 1;
7971 				goto mmccmd_bailout;
7972 			}
7973 			break;
7974 		case 'l':
7975 			mmc_data_len = strtol(optarg, NULL, 0);
7976 			if (mmc_data_len <= 0) {
7977 				warnx("invalid MMC data len %d",
7978 				      mmc_data_len);
7979 				error = 1;
7980 				goto mmccmd_bailout;
7981 			}
7982 			break;
7983 		case 'W':
7984 			is_write = 1;
7985 			break;
7986 		case 'b':
7987 			mmc_data_byte = strtol(optarg, NULL, 0);
7988 			break;
7989 		default:
7990 			break;
7991 		}
7992 	}
7993 	flags |= CAM_DEV_QFRZDIS; /* masks are broken?! */
7994 
7995 	/* If flags are left default, supply the right flags */
7996 	if (mmc_flags < 0)
7997 		switch (mmc_opcode) {
7998 		case MMC_GO_IDLE_STATE:
7999 			mmc_flags = MMC_RSP_NONE | MMC_CMD_BC;
8000 			break;
8001 		case IO_SEND_OP_COND:
8002 			mmc_flags = MMC_RSP_R4;
8003 			break;
8004 		case SD_SEND_RELATIVE_ADDR:
8005 			mmc_flags = MMC_RSP_R6 | MMC_CMD_BCR;
8006 			break;
8007 		case MMC_SELECT_CARD:
8008 			mmc_flags = MMC_RSP_R1B | MMC_CMD_AC;
8009 			mmc_arg = mmc_arg << 16;
8010 			break;
8011 		case SD_IO_RW_DIRECT:
8012 			mmc_flags = MMC_RSP_R5 | MMC_CMD_AC;
8013 			mmc_arg = SD_IO_RW_ADR(mmc_arg);
8014 			if (is_write)
8015 				mmc_arg |= SD_IO_RW_WR | SD_IO_RW_RAW | SD_IO_RW_DAT(mmc_data_byte);
8016 			break;
8017 		case SD_IO_RW_EXTENDED:
8018 			mmc_flags = MMC_RSP_R5 | MMC_CMD_ADTC;
8019 			mmc_arg = SD_IO_RW_ADR(mmc_arg);
8020 			int len_arg = mmc_data_len;
8021 			if (mmc_data_len == 512)
8022 				len_arg = 0;
8023 
8024 			// Byte mode
8025 			mmc_arg |= SD_IOE_RW_LEN(len_arg) | SD_IO_RW_INCR;
8026 			// Block mode
8027 //                        mmc_arg |= SD_IOE_RW_BLK | SD_IOE_RW_LEN(len_arg) | SD_IO_RW_INCR;
8028 			break;
8029 		default:
8030 			mmc_flags = MMC_RSP_R1;
8031 			break;
8032 		}
8033 
8034 	// Switch bus width instead of sending IO command
8035 	if (is_bw_4 || is_bw_1) {
8036 		struct ccb_trans_settings_mmc *cts;
8037 		ccb->ccb_h.func_code = XPT_SET_TRAN_SETTINGS;
8038 		ccb->ccb_h.flags = 0;
8039 		cts = &ccb->cts.proto_specific.mmc;
8040 		cts->ios.bus_width = is_bw_4 == 1 ? bus_width_4 : bus_width_1;
8041 		cts->ios_valid = MMC_BW;
8042 		if (((retval = cam_send_ccb(device, ccb)) < 0)
8043 		    || ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP)) {
8044 			warn("Error sending command");
8045 		} else {
8046 			printf("Parameters set OK\n");
8047 		}
8048 		cam_freeccb(ccb);
8049 		return (retval);
8050 	}
8051 
8052 	if (is_frequency) {
8053 		struct ccb_trans_settings_mmc *cts;
8054 		ccb->ccb_h.func_code = XPT_SET_TRAN_SETTINGS;
8055 		ccb->ccb_h.flags = 0;
8056 		cts = &ccb->cts.proto_specific.mmc;
8057 		cts->ios.clock = mmc_frequency;
8058 		cts->ios_valid = MMC_CLK;
8059 		if (((retval = cam_send_ccb(device, ccb)) < 0)
8060 		    || ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP)) {
8061 			warn("Error sending command");
8062 		} else {
8063 			printf("Parameters set OK\n");
8064 		}
8065 		cam_freeccb(ccb);
8066 		return (retval);
8067 	}
8068 
8069 	// Switch bus speed instead of sending IO command
8070 	if (is_stdspeed || is_highspeed) {
8071 		struct ccb_trans_settings_mmc *cts;
8072 		ccb->ccb_h.func_code = XPT_SET_TRAN_SETTINGS;
8073 		ccb->ccb_h.flags = 0;
8074 		cts = &ccb->cts.proto_specific.mmc;
8075 		cts->ios.timing = is_highspeed == 1 ? bus_timing_hs : bus_timing_normal;
8076 		cts->ios_valid = MMC_BT;
8077 		if (((retval = cam_send_ccb(device, ccb)) < 0)
8078 		    || ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP)) {
8079 			warn("Error sending command");
8080 		} else {
8081 			printf("Speed set OK (HS: %d)\n", is_highspeed);
8082 		}
8083 		cam_freeccb(ccb);
8084 		return (retval);
8085 	}
8086 
8087 	// Get information about controller and its settings
8088 	if (is_info_request) {
8089 		ccb->ccb_h.func_code = XPT_GET_TRAN_SETTINGS;
8090 		ccb->ccb_h.flags = 0;
8091 		struct ccb_trans_settings_mmc *cts;
8092 		cts = &ccb->cts.proto_specific.mmc;
8093 		if (((retval = cam_send_ccb(device, ccb)) < 0)
8094 		    || ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP)) {
8095 			warn("Error sending command");
8096 			return (retval);
8097 		}
8098 		printf("Host controller information\n");
8099 		printf("Host OCR: 0x%x\n", cts->host_ocr);
8100 		printf("Min frequency: %u KHz\n", cts->host_f_min / 1000);
8101 		printf("Max frequency: %u MHz\n", cts->host_f_max / 1000000);
8102 		printf("Supported bus width:\n");
8103 		if (cts->host_caps & MMC_CAP_4_BIT_DATA)
8104 			printf(" 4 bit\n");
8105 		if (cts->host_caps & MMC_CAP_8_BIT_DATA)
8106 			printf(" 8 bit\n");
8107 
8108 		printf("Supported operating modes:\n");
8109 		if (cts->host_caps & MMC_CAP_HSPEED)
8110 			printf(" Can do High Speed transfers\n");
8111 		if (cts->host_caps & MMC_CAP_UHS_SDR12)
8112 			printf(" Can do UHS SDR12\n");
8113 		if (cts->host_caps & MMC_CAP_UHS_SDR25)
8114 			printf(" Can do UHS SDR25\n");
8115 		if (cts->host_caps & MMC_CAP_UHS_SDR50)
8116 			printf(" Can do UHS SDR50\n");
8117 		if (cts->host_caps & MMC_CAP_UHS_SDR104)
8118 			printf(" Can do UHS SDR104\n");
8119 		if (cts->host_caps & MMC_CAP_UHS_DDR50)
8120 			printf(" Can do UHS DDR50\n");
8121 		if (cts->host_caps & MMC_CAP_MMC_DDR52_120)
8122 			printf(" Can do eMMC DDR52 at 1.2V\n");
8123 		if (cts->host_caps & MMC_CAP_MMC_DDR52_180)
8124 			printf(" Can do eMMC DDR52 at 1.8V\n");
8125 		if (cts->host_caps & MMC_CAP_MMC_HS200_120)
8126 			printf(" Can do eMMC HS200 at 1.2V\n");
8127 		if (cts->host_caps & MMC_CAP_MMC_HS200_180)
8128 			printf(" Can do eMMC HS200 at 1.8V\n");
8129 		if (cts->host_caps & MMC_CAP_MMC_HS400_120)
8130 			printf(" Can do eMMC HS400 at 1.2V\n");
8131 		if (cts->host_caps & MMC_CAP_MMC_HS400_180)
8132 			printf(" Can do eMMC HS400 at 1.8V\n");
8133 
8134 		printf("Supported VCCQ voltages:\n");
8135 		if (cts->host_caps & MMC_CAP_SIGNALING_120)
8136 			printf(" 1.2V\n");
8137 		if (cts->host_caps & MMC_CAP_SIGNALING_180)
8138 			printf(" 1.8V\n");
8139 		if (cts->host_caps & MMC_CAP_SIGNALING_330)
8140 			printf(" 3.3V\n");
8141 
8142 		printf("Current settings:\n");
8143 		printf(" Bus width: ");
8144 		switch (cts->ios.bus_width) {
8145 		case bus_width_1:
8146 			printf("1 bit\n");
8147 			break;
8148 		case bus_width_4:
8149 			printf("4 bit\n");
8150 			break;
8151 		case bus_width_8:
8152 			printf("8 bit\n");
8153 			break;
8154 		}
8155 		printf(" Freq: %d.%03d MHz%s\n",
8156 		       cts->ios.clock / 1000000,
8157 		       (cts->ios.clock / 1000) % 1000,
8158 		       cts->ios.timing == bus_timing_hs ? " (high-speed timing)" : "");
8159 
8160 		printf(" VCCQ: ");
8161 		switch (cts->ios.vccq) {
8162 		case vccq_330:
8163 			printf("3.3V\n");
8164 			break;
8165 		case vccq_180:
8166 			printf("1.8V\n");
8167 			break;
8168 		case vccq_120:
8169 			printf("1.2V\n");
8170 			break;
8171 		}
8172 		return (0);
8173 	}
8174 
8175 	printf("CMD %d arg %d flags %02x\n", mmc_opcode, mmc_arg, mmc_flags);
8176 
8177 	if (mmc_data_len > 0) {
8178 		flags |= CAM_DIR_IN;
8179 		mmc_data = malloc(mmc_data_len);
8180 		memset(mmc_data, 0, mmc_data_len);
8181 		memset(&mmc_d, 0, sizeof(mmc_d));
8182 		mmc_d.len = mmc_data_len;
8183 		mmc_d.data = mmc_data;
8184 		mmc_d.flags = MMC_DATA_READ;
8185 	} else flags |= CAM_DIR_NONE;
8186 
8187 	cam_fill_mmcio(&ccb->mmcio,
8188 		       /*retries*/ retry_count,
8189 		       /*cbfcnp*/ NULL,
8190 		       /*flags*/ flags,
8191 		       /*mmc_opcode*/ mmc_opcode,
8192 		       /*mmc_arg*/ mmc_arg,
8193 		       /*mmc_flags*/ mmc_flags,
8194 		       /*mmc_data*/ mmc_data_len > 0 ? &mmc_d : NULL,
8195 		       /*timeout*/ timeout ? timeout : 5000);
8196 
8197 	if (((retval = cam_send_ccb(device, ccb)) < 0)
8198 	 || ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP)) {
8199 		const char warnstr[] = "error sending command";
8200 
8201 		if (retval < 0)
8202 			warn(warnstr);
8203 		else
8204 			warnx(warnstr);
8205 
8206 		if (arglist & CAM_ARG_VERBOSE) {
8207 			cam_error_print(device, ccb, CAM_ESF_ALL,
8208 					CAM_EPF_ALL, stderr);
8209 		}
8210 	}
8211 
8212 	if (((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP)) {
8213 		printf("MMCIO: error %d, %08x %08x %08x %08x\n",
8214 		       ccb->mmcio.cmd.error, ccb->mmcio.cmd.resp[0],
8215 		       ccb->mmcio.cmd.resp[1],
8216 		       ccb->mmcio.cmd.resp[2],
8217 		       ccb->mmcio.cmd.resp[3]);
8218 
8219 		switch (mmc_opcode) {
8220 		case SD_IO_RW_DIRECT:
8221 			printf("IO_RW_DIRECT: resp byte %02x, cur state %d\n",
8222 			       SD_R5_DATA(ccb->mmcio.cmd.resp),
8223 			       (ccb->mmcio.cmd.resp[0] >> 12) & 0x3);
8224 			break;
8225 		case SD_IO_RW_EXTENDED:
8226 			printf("IO_RW_EXTENDED: read %d bytes w/o error:\n", mmc_data_len);
8227 			hexdump(mmc_data, mmc_data_len, NULL, 0);
8228 			break;
8229 		case SD_SEND_RELATIVE_ADDR:
8230 			printf("SEND_RELATIVE_ADDR: published RCA %02x\n", ccb->mmcio.cmd.resp[0] >> 16);
8231 			break;
8232 		default:
8233 			printf("No command-specific decoder for CMD %d\n", mmc_opcode);
8234 			if (mmc_data_len > 0)
8235 				hexdump(mmc_data, mmc_data_len, NULL, 0);
8236 		}
8237 	}
8238 mmccmd_bailout:
8239 	if (ccb != NULL)
8240 		cam_freeccb(ccb);
8241 
8242 	if (mmc_data_len > 0 && mmc_data != NULL)
8243 		free(mmc_data);
8244 
8245 	return (error);
8246 }
8247 
8248 static int
8249 smpreportgeneral(struct cam_device *device, int argc, char **argv,
8250 		 char *combinedopt, int retry_count, int timeout)
8251 {
8252 	union ccb *ccb;
8253 	struct smp_report_general_request *request = NULL;
8254 	struct smp_report_general_response *response = NULL;
8255 	struct sbuf *sb = NULL;
8256 	int error = 0;
8257 	int c, long_response = 0;
8258 	int retval;
8259 
8260 	/*
8261 	 * Note that at the moment we don't support sending SMP CCBs to
8262 	 * devices that aren't probed by CAM.
8263 	 */
8264 	ccb = cam_getccb(device);
8265 	if (ccb == NULL) {
8266 		warnx("%s: error allocating CCB", __func__);
8267 		return (1);
8268 	}
8269 
8270 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
8271 		switch (c) {
8272 		case 'l':
8273 			long_response = 1;
8274 			break;
8275 		default:
8276 			break;
8277 		}
8278 	}
8279 	request = malloc(sizeof(*request));
8280 	if (request == NULL) {
8281 		warn("%s: unable to allocate %zd bytes", __func__,
8282 		     sizeof(*request));
8283 		error = 1;
8284 		goto bailout;
8285 	}
8286 
8287 	response = malloc(sizeof(*response));
8288 	if (response == NULL) {
8289 		warn("%s: unable to allocate %zd bytes", __func__,
8290 		     sizeof(*response));
8291 		error = 1;
8292 		goto bailout;
8293 	}
8294 
8295 try_long:
8296 	smp_report_general(&ccb->smpio,
8297 			   retry_count,
8298 			   /*cbfcnp*/ NULL,
8299 			   request,
8300 			   /*request_len*/ sizeof(*request),
8301 			   (uint8_t *)response,
8302 			   /*response_len*/ sizeof(*response),
8303 			   /*long_response*/ long_response,
8304 			   timeout);
8305 
8306 	if (((retval = cam_send_ccb(device, ccb)) < 0)
8307 	 || ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP)) {
8308 		const char warnstr[] = "error sending command";
8309 
8310 		if (retval < 0)
8311 			warn(warnstr);
8312 		else
8313 			warnx(warnstr);
8314 
8315 		if (arglist & CAM_ARG_VERBOSE) {
8316 			cam_error_print(device, ccb, CAM_ESF_ALL,
8317 					CAM_EPF_ALL, stderr);
8318 		}
8319 		error = 1;
8320 		goto bailout;
8321 	}
8322 
8323 	/*
8324 	 * If the device supports the long response bit, try again and see
8325 	 * if we can get all of the data.
8326 	 */
8327 	if ((response->long_response & SMP_RG_LONG_RESPONSE)
8328 	 && (long_response == 0)) {
8329 		ccb->ccb_h.status = CAM_REQ_INPROG;
8330 		CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->smpio);
8331 		long_response = 1;
8332 		goto try_long;
8333 	}
8334 
8335 	/*
8336 	 * XXX KDM detect and decode SMP errors here.
8337 	 */
8338 	sb = sbuf_new_auto();
8339 	if (sb == NULL) {
8340 		warnx("%s: error allocating sbuf", __func__);
8341 		goto bailout;
8342 	}
8343 
8344 	smp_report_general_sbuf(response, sizeof(*response), sb);
8345 
8346 	if (sbuf_finish(sb) != 0) {
8347 		warnx("%s: sbuf_finish", __func__);
8348 		goto bailout;
8349 	}
8350 
8351 	printf("%s", sbuf_data(sb));
8352 
8353 bailout:
8354 	if (ccb != NULL)
8355 		cam_freeccb(ccb);
8356 
8357 	if (request != NULL)
8358 		free(request);
8359 
8360 	if (response != NULL)
8361 		free(response);
8362 
8363 	if (sb != NULL)
8364 		sbuf_delete(sb);
8365 
8366 	return (error);
8367 }
8368 
8369 static struct camcontrol_opts phy_ops[] = {
8370 	{"nop", SMP_PC_PHY_OP_NOP, CAM_ARG_NONE, NULL},
8371 	{"linkreset", SMP_PC_PHY_OP_LINK_RESET, CAM_ARG_NONE, NULL},
8372 	{"hardreset", SMP_PC_PHY_OP_HARD_RESET, CAM_ARG_NONE, NULL},
8373 	{"disable", SMP_PC_PHY_OP_DISABLE, CAM_ARG_NONE, NULL},
8374 	{"clearerrlog", SMP_PC_PHY_OP_CLEAR_ERR_LOG, CAM_ARG_NONE, NULL},
8375 	{"clearaffiliation", SMP_PC_PHY_OP_CLEAR_AFFILIATON, CAM_ARG_NONE,NULL},
8376 	{"sataportsel", SMP_PC_PHY_OP_TRANS_SATA_PSS, CAM_ARG_NONE, NULL},
8377 	{"clearitnl", SMP_PC_PHY_OP_CLEAR_STP_ITN_LS, CAM_ARG_NONE, NULL},
8378 	{"setdevname", SMP_PC_PHY_OP_SET_ATT_DEV_NAME, CAM_ARG_NONE, NULL},
8379 	{NULL, 0, 0, NULL}
8380 };
8381 
8382 static int
8383 smpphycontrol(struct cam_device *device, int argc, char **argv,
8384 	      char *combinedopt, int retry_count, int timeout)
8385 {
8386 	union ccb *ccb;
8387 	struct smp_phy_control_request *request = NULL;
8388 	struct smp_phy_control_response *response = NULL;
8389 	int long_response = 0;
8390 	int retval = 0;
8391 	int phy = -1;
8392 	uint32_t phy_operation = SMP_PC_PHY_OP_NOP;
8393 	int phy_op_set = 0;
8394 	uint64_t attached_dev_name = 0;
8395 	int dev_name_set = 0;
8396 	uint32_t min_plr = 0, max_plr = 0;
8397 	uint32_t pp_timeout_val = 0;
8398 	int slumber_partial = 0;
8399 	int set_pp_timeout_val = 0;
8400 	int c;
8401 
8402 	/*
8403 	 * Note that at the moment we don't support sending SMP CCBs to
8404 	 * devices that aren't probed by CAM.
8405 	 */
8406 	ccb = cam_getccb(device);
8407 	if (ccb == NULL) {
8408 		warnx("%s: error allocating CCB", __func__);
8409 		return (1);
8410 	}
8411 
8412 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
8413 		switch (c) {
8414 		case 'a':
8415 		case 'A':
8416 		case 's':
8417 		case 'S': {
8418 			int enable = -1;
8419 
8420 			if (strcasecmp(optarg, "enable") == 0)
8421 				enable = 1;
8422 			else if (strcasecmp(optarg, "disable") == 0)
8423 				enable = 2;
8424 			else {
8425 				warnx("%s: Invalid argument %s", __func__,
8426 				      optarg);
8427 				retval = 1;
8428 				goto bailout;
8429 			}
8430 			switch (c) {
8431 			case 's':
8432 				slumber_partial |= enable <<
8433 						   SMP_PC_SAS_SLUMBER_SHIFT;
8434 				break;
8435 			case 'S':
8436 				slumber_partial |= enable <<
8437 						   SMP_PC_SAS_PARTIAL_SHIFT;
8438 				break;
8439 			case 'a':
8440 				slumber_partial |= enable <<
8441 						   SMP_PC_SATA_SLUMBER_SHIFT;
8442 				break;
8443 			case 'A':
8444 				slumber_partial |= enable <<
8445 						   SMP_PC_SATA_PARTIAL_SHIFT;
8446 				break;
8447 			default:
8448 				warnx("%s: programmer error", __func__);
8449 				retval = 1;
8450 				goto bailout;
8451 				break; /*NOTREACHED*/
8452 			}
8453 			break;
8454 		}
8455 		case 'd':
8456 			attached_dev_name = (uintmax_t)strtoumax(optarg,
8457 								 NULL,0);
8458 			dev_name_set = 1;
8459 			break;
8460 		case 'l':
8461 			long_response = 1;
8462 			break;
8463 		case 'm':
8464 			/*
8465 			 * We don't do extensive checking here, so this
8466 			 * will continue to work when new speeds come out.
8467 			 */
8468 			min_plr = strtoul(optarg, NULL, 0);
8469 			if ((min_plr == 0)
8470 			 || (min_plr > 0xf)) {
8471 				warnx("%s: invalid link rate %x",
8472 				      __func__, min_plr);
8473 				retval = 1;
8474 				goto bailout;
8475 			}
8476 			break;
8477 		case 'M':
8478 			/*
8479 			 * We don't do extensive checking here, so this
8480 			 * will continue to work when new speeds come out.
8481 			 */
8482 			max_plr = strtoul(optarg, NULL, 0);
8483 			if ((max_plr == 0)
8484 			 || (max_plr > 0xf)) {
8485 				warnx("%s: invalid link rate %x",
8486 				      __func__, max_plr);
8487 				retval = 1;
8488 				goto bailout;
8489 			}
8490 			break;
8491 		case 'o': {
8492 			camcontrol_optret optreturn;
8493 			cam_argmask argnums;
8494 			const char *subopt;
8495 
8496 			if (phy_op_set != 0) {
8497 				warnx("%s: only one phy operation argument "
8498 				      "(-o) allowed", __func__);
8499 				retval = 1;
8500 				goto bailout;
8501 			}
8502 
8503 			phy_op_set = 1;
8504 
8505 			/*
8506 			 * Allow the user to specify the phy operation
8507 			 * numerically, as well as with a name.  This will
8508 			 * future-proof it a bit, so options that are added
8509 			 * in future specs can be used.
8510 			 */
8511 			if (isdigit(optarg[0])) {
8512 				phy_operation = strtoul(optarg, NULL, 0);
8513 				if ((phy_operation == 0)
8514 				 || (phy_operation > 0xff)) {
8515 					warnx("%s: invalid phy operation %#x",
8516 					      __func__, phy_operation);
8517 					retval = 1;
8518 					goto bailout;
8519 				}
8520 				break;
8521 			}
8522 			optreturn = getoption(phy_ops, optarg, &phy_operation,
8523 					      &argnums, &subopt);
8524 
8525 			if (optreturn == CC_OR_AMBIGUOUS) {
8526 				warnx("%s: ambiguous option %s", __func__,
8527 				      optarg);
8528 				usage(0);
8529 				retval = 1;
8530 				goto bailout;
8531 			} else if (optreturn == CC_OR_NOT_FOUND) {
8532 				warnx("%s: option %s not found", __func__,
8533 				      optarg);
8534 				usage(0);
8535 				retval = 1;
8536 				goto bailout;
8537 			}
8538 			break;
8539 		}
8540 		case 'p':
8541 			phy = atoi(optarg);
8542 			break;
8543 		case 'T':
8544 			pp_timeout_val = strtoul(optarg, NULL, 0);
8545 			if (pp_timeout_val > 15) {
8546 				warnx("%s: invalid partial pathway timeout "
8547 				      "value %u, need a value less than 16",
8548 				      __func__, pp_timeout_val);
8549 				retval = 1;
8550 				goto bailout;
8551 			}
8552 			set_pp_timeout_val = 1;
8553 			break;
8554 		default:
8555 			break;
8556 		}
8557 	}
8558 
8559 	if (phy == -1) {
8560 		warnx("%s: a PHY (-p phy) argument is required",__func__);
8561 		retval = 1;
8562 		goto bailout;
8563 	}
8564 
8565 	if (((dev_name_set != 0)
8566 	  && (phy_operation != SMP_PC_PHY_OP_SET_ATT_DEV_NAME))
8567 	 || ((phy_operation == SMP_PC_PHY_OP_SET_ATT_DEV_NAME)
8568 	  && (dev_name_set == 0))) {
8569 		warnx("%s: -d name and -o setdevname arguments both "
8570 		      "required to set device name", __func__);
8571 		retval = 1;
8572 		goto bailout;
8573 	}
8574 
8575 	request = malloc(sizeof(*request));
8576 	if (request == NULL) {
8577 		warn("%s: unable to allocate %zd bytes", __func__,
8578 		     sizeof(*request));
8579 		retval = 1;
8580 		goto bailout;
8581 	}
8582 
8583 	response = malloc(sizeof(*response));
8584 	if (response == NULL) {
8585 		warn("%s: unable to allocate %zd bytes", __func__,
8586 		     sizeof(*response));
8587 		retval = 1;
8588 		goto bailout;
8589 	}
8590 
8591 	smp_phy_control(&ccb->smpio,
8592 			retry_count,
8593 			/*cbfcnp*/ NULL,
8594 			request,
8595 			sizeof(*request),
8596 			(uint8_t *)response,
8597 			sizeof(*response),
8598 			long_response,
8599 			/*expected_exp_change_count*/ 0,
8600 			phy,
8601 			phy_operation,
8602 			(set_pp_timeout_val != 0) ? 1 : 0,
8603 			attached_dev_name,
8604 			min_plr,
8605 			max_plr,
8606 			slumber_partial,
8607 			pp_timeout_val,
8608 			timeout);
8609 
8610 	if (((retval = cam_send_ccb(device, ccb)) < 0)
8611 	 || ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP)) {
8612 		const char warnstr[] = "error sending command";
8613 
8614 		if (retval < 0)
8615 			warn(warnstr);
8616 		else
8617 			warnx(warnstr);
8618 
8619 		if (arglist & CAM_ARG_VERBOSE) {
8620 			/*
8621 			 * Use CAM_EPF_NORMAL so we only get one line of
8622 			 * SMP command decoding.
8623 			 */
8624 			cam_error_print(device, ccb, CAM_ESF_ALL,
8625 					CAM_EPF_NORMAL, stderr);
8626 		}
8627 		retval = 1;
8628 		goto bailout;
8629 	}
8630 
8631 	/* XXX KDM print out something here for success? */
8632 bailout:
8633 	if (ccb != NULL)
8634 		cam_freeccb(ccb);
8635 
8636 	if (request != NULL)
8637 		free(request);
8638 
8639 	if (response != NULL)
8640 		free(response);
8641 
8642 	return (retval);
8643 }
8644 
8645 static int
8646 smpmaninfo(struct cam_device *device, int argc, char **argv,
8647 	   char *combinedopt, int retry_count, int timeout)
8648 {
8649 	union ccb *ccb;
8650 	struct smp_report_manuf_info_request request;
8651 	struct smp_report_manuf_info_response response;
8652 	struct sbuf *sb = NULL;
8653 	int long_response = 0;
8654 	int retval = 0;
8655 	int c;
8656 
8657 	/*
8658 	 * Note that at the moment we don't support sending SMP CCBs to
8659 	 * devices that aren't probed by CAM.
8660 	 */
8661 	ccb = cam_getccb(device);
8662 	if (ccb == NULL) {
8663 		warnx("%s: error allocating CCB", __func__);
8664 		return (1);
8665 	}
8666 
8667 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
8668 		switch (c) {
8669 		case 'l':
8670 			long_response = 1;
8671 			break;
8672 		default:
8673 			break;
8674 		}
8675 	}
8676 	bzero(&request, sizeof(request));
8677 	bzero(&response, sizeof(response));
8678 
8679 	smp_report_manuf_info(&ccb->smpio,
8680 			      retry_count,
8681 			      /*cbfcnp*/ NULL,
8682 			      &request,
8683 			      sizeof(request),
8684 			      (uint8_t *)&response,
8685 			      sizeof(response),
8686 			      long_response,
8687 			      timeout);
8688 
8689 	if (((retval = cam_send_ccb(device, ccb)) < 0)
8690 	 || ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP)) {
8691 		const char warnstr[] = "error sending command";
8692 
8693 		if (retval < 0)
8694 			warn(warnstr);
8695 		else
8696 			warnx(warnstr);
8697 
8698 		if (arglist & CAM_ARG_VERBOSE) {
8699 			cam_error_print(device, ccb, CAM_ESF_ALL,
8700 					CAM_EPF_ALL, stderr);
8701 		}
8702 		retval = 1;
8703 		goto bailout;
8704 	}
8705 
8706 	sb = sbuf_new_auto();
8707 	if (sb == NULL) {
8708 		warnx("%s: error allocating sbuf", __func__);
8709 		goto bailout;
8710 	}
8711 
8712 	smp_report_manuf_info_sbuf(&response, sizeof(response), sb);
8713 
8714 	if (sbuf_finish(sb) != 0) {
8715 		warnx("%s: sbuf_finish", __func__);
8716 		goto bailout;
8717 	}
8718 
8719 	printf("%s", sbuf_data(sb));
8720 
8721 bailout:
8722 
8723 	if (ccb != NULL)
8724 		cam_freeccb(ccb);
8725 
8726 	if (sb != NULL)
8727 		sbuf_delete(sb);
8728 
8729 	return (retval);
8730 }
8731 
8732 static int
8733 getdevid(struct cam_devitem *item)
8734 {
8735 	int retval = 0;
8736 	union ccb *ccb = NULL;
8737 
8738 	struct cam_device *dev;
8739 
8740 	dev = cam_open_btl(item->dev_match.path_id,
8741 			   item->dev_match.target_id,
8742 			   item->dev_match.target_lun, O_RDWR, NULL);
8743 
8744 	if (dev == NULL) {
8745 		warnx("%s", cam_errbuf);
8746 		retval = 1;
8747 		goto bailout;
8748 	}
8749 
8750 	item->device_id_len = 0;
8751 
8752 	ccb = cam_getccb(dev);
8753 	if (ccb == NULL) {
8754 		warnx("%s: error allocating CCB", __func__);
8755 		retval = 1;
8756 		goto bailout;
8757 	}
8758 
8759 	/*
8760 	 * On the first try, we just probe for the size of the data, and
8761 	 * then allocate that much memory and try again.
8762 	 */
8763 retry:
8764 	ccb->ccb_h.func_code = XPT_DEV_ADVINFO;
8765 	ccb->ccb_h.flags = CAM_DIR_IN;
8766 	ccb->cdai.flags = CDAI_FLAG_NONE;
8767 	ccb->cdai.buftype = CDAI_TYPE_SCSI_DEVID;
8768 	ccb->cdai.bufsiz = item->device_id_len;
8769 	if (item->device_id_len != 0)
8770 		ccb->cdai.buf = (uint8_t *)item->device_id;
8771 
8772 	if (cam_send_ccb(dev, ccb) < 0) {
8773 		warn("%s: error sending XPT_GDEV_ADVINFO CCB", __func__);
8774 		retval = 1;
8775 		goto bailout;
8776 	}
8777 
8778 	if (ccb->ccb_h.status != CAM_REQ_CMP) {
8779 		warnx("%s: CAM status %#x", __func__, ccb->ccb_h.status);
8780 		retval = 1;
8781 		goto bailout;
8782 	}
8783 
8784 	if (item->device_id_len == 0) {
8785 		/*
8786 		 * This is our first time through.  Allocate the buffer,
8787 		 * and then go back to get the data.
8788 		 */
8789 		if (ccb->cdai.provsiz == 0) {
8790 			warnx("%s: invalid .provsiz field returned with "
8791 			     "XPT_GDEV_ADVINFO CCB", __func__);
8792 			retval = 1;
8793 			goto bailout;
8794 		}
8795 		item->device_id_len = ccb->cdai.provsiz;
8796 		item->device_id = malloc(item->device_id_len);
8797 		if (item->device_id == NULL) {
8798 			warn("%s: unable to allocate %d bytes", __func__,
8799 			     item->device_id_len);
8800 			retval = 1;
8801 			goto bailout;
8802 		}
8803 		ccb->ccb_h.status = CAM_REQ_INPROG;
8804 		goto retry;
8805 	}
8806 
8807 bailout:
8808 	if (dev != NULL)
8809 		cam_close_device(dev);
8810 
8811 	if (ccb != NULL)
8812 		cam_freeccb(ccb);
8813 
8814 	return (retval);
8815 }
8816 
8817 /*
8818  * XXX KDM merge this code with getdevtree()?
8819  */
8820 static int
8821 buildbusdevlist(struct cam_devlist *devlist)
8822 {
8823 	union ccb ccb;
8824 	int bufsize, fd = -1;
8825 	struct dev_match_pattern *patterns;
8826 	struct cam_devitem *item = NULL;
8827 	int skip_device = 0;
8828 	int retval = 0;
8829 
8830 	if ((fd = open(XPT_DEVICE, O_RDWR)) == -1) {
8831 		warn("couldn't open %s", XPT_DEVICE);
8832 		return (1);
8833 	}
8834 
8835 	bzero(&ccb, sizeof(union ccb));
8836 
8837 	ccb.ccb_h.path_id = CAM_XPT_PATH_ID;
8838 	ccb.ccb_h.target_id = CAM_TARGET_WILDCARD;
8839 	ccb.ccb_h.target_lun = CAM_LUN_WILDCARD;
8840 
8841 	ccb.ccb_h.func_code = XPT_DEV_MATCH;
8842 	bufsize = sizeof(struct dev_match_result) * 100;
8843 	ccb.cdm.match_buf_len = bufsize;
8844 	ccb.cdm.matches = (struct dev_match_result *)malloc(bufsize);
8845 	if (ccb.cdm.matches == NULL) {
8846 		warnx("can't malloc memory for matches");
8847 		close(fd);
8848 		return (1);
8849 	}
8850 	ccb.cdm.num_matches = 0;
8851 	ccb.cdm.num_patterns = 2;
8852 	ccb.cdm.pattern_buf_len = sizeof(struct dev_match_pattern) *
8853 		ccb.cdm.num_patterns;
8854 
8855 	patterns = (struct dev_match_pattern *)malloc(ccb.cdm.pattern_buf_len);
8856 	if (patterns == NULL) {
8857 		warnx("can't malloc memory for patterns");
8858 		retval = 1;
8859 		goto bailout;
8860 	}
8861 
8862 	ccb.cdm.patterns = patterns;
8863 	bzero(patterns, ccb.cdm.pattern_buf_len);
8864 
8865 	patterns[0].type = DEV_MATCH_DEVICE;
8866 	patterns[0].pattern.device_pattern.flags = DEV_MATCH_PATH;
8867 	patterns[0].pattern.device_pattern.path_id = devlist->path_id;
8868 	patterns[1].type = DEV_MATCH_PERIPH;
8869 	patterns[1].pattern.periph_pattern.flags = PERIPH_MATCH_PATH;
8870 	patterns[1].pattern.periph_pattern.path_id = devlist->path_id;
8871 
8872 	/*
8873 	 * We do the ioctl multiple times if necessary, in case there are
8874 	 * more than 100 nodes in the EDT.
8875 	 */
8876 	do {
8877 		unsigned int i;
8878 
8879 		if (ioctl(fd, CAMIOCOMMAND, &ccb) == -1) {
8880 			warn("error sending CAMIOCOMMAND ioctl");
8881 			retval = 1;
8882 			goto bailout;
8883 		}
8884 
8885 		if ((ccb.ccb_h.status != CAM_REQ_CMP)
8886 		 || ((ccb.cdm.status != CAM_DEV_MATCH_LAST)
8887 		    && (ccb.cdm.status != CAM_DEV_MATCH_MORE))) {
8888 			warnx("got CAM error %#x, CDM error %d\n",
8889 			      ccb.ccb_h.status, ccb.cdm.status);
8890 			retval = 1;
8891 			goto bailout;
8892 		}
8893 
8894 		for (i = 0; i < ccb.cdm.num_matches; i++) {
8895 			switch (ccb.cdm.matches[i].type) {
8896 			case DEV_MATCH_DEVICE: {
8897 				struct device_match_result *dev_result;
8898 
8899 				dev_result =
8900 				     &ccb.cdm.matches[i].result.device_result;
8901 
8902 				if (dev_result->flags &
8903 				    DEV_RESULT_UNCONFIGURED) {
8904 					skip_device = 1;
8905 					break;
8906 				} else
8907 					skip_device = 0;
8908 
8909 				item = malloc(sizeof(*item));
8910 				if (item == NULL) {
8911 					warn("%s: unable to allocate %zd bytes",
8912 					     __func__, sizeof(*item));
8913 					retval = 1;
8914 					goto bailout;
8915 				}
8916 				bzero(item, sizeof(*item));
8917 				bcopy(dev_result, &item->dev_match,
8918 				      sizeof(*dev_result));
8919 				STAILQ_INSERT_TAIL(&devlist->dev_queue, item,
8920 						   links);
8921 
8922 				if (getdevid(item) != 0) {
8923 					retval = 1;
8924 					goto bailout;
8925 				}
8926 				break;
8927 			}
8928 			case DEV_MATCH_PERIPH: {
8929 				struct periph_match_result *periph_result;
8930 
8931 				periph_result =
8932 				      &ccb.cdm.matches[i].result.periph_result;
8933 
8934 				if (skip_device != 0)
8935 					break;
8936 				item->num_periphs++;
8937 				item->periph_matches = realloc(
8938 					item->periph_matches,
8939 					item->num_periphs *
8940 					sizeof(struct periph_match_result));
8941 				if (item->periph_matches == NULL) {
8942 					warn("%s: error allocating periph "
8943 					     "list", __func__);
8944 					retval = 1;
8945 					goto bailout;
8946 				}
8947 				bcopy(periph_result, &item->periph_matches[
8948 				      item->num_periphs - 1],
8949 				      sizeof(*periph_result));
8950 				break;
8951 			}
8952 			default:
8953 				fprintf(stderr, "%s: unexpected match "
8954 					"type %d\n", __func__,
8955 					ccb.cdm.matches[i].type);
8956 				retval = 1;
8957 				goto bailout;
8958 				break; /*NOTREACHED*/
8959 			}
8960 		}
8961 	} while ((ccb.ccb_h.status == CAM_REQ_CMP)
8962 		&& (ccb.cdm.status == CAM_DEV_MATCH_MORE));
8963 bailout:
8964 
8965 	if (fd != -1)
8966 		close(fd);
8967 
8968 	free(patterns);
8969 
8970 	free(ccb.cdm.matches);
8971 
8972 	if (retval != 0)
8973 		freebusdevlist(devlist);
8974 
8975 	return (retval);
8976 }
8977 
8978 static void
8979 freebusdevlist(struct cam_devlist *devlist)
8980 {
8981 	struct cam_devitem *item, *item2;
8982 
8983 	STAILQ_FOREACH_SAFE(item, &devlist->dev_queue, links, item2) {
8984 		STAILQ_REMOVE(&devlist->dev_queue, item, cam_devitem,
8985 			      links);
8986 		free(item->device_id);
8987 		free(item->periph_matches);
8988 		free(item);
8989 	}
8990 }
8991 
8992 static struct cam_devitem *
8993 findsasdevice(struct cam_devlist *devlist, uint64_t sasaddr)
8994 {
8995 	struct cam_devitem *item;
8996 
8997 	STAILQ_FOREACH(item, &devlist->dev_queue, links) {
8998 		struct scsi_vpd_id_descriptor *idd;
8999 
9000 		/*
9001 		 * XXX KDM look for LUN IDs as well?
9002 		 */
9003 		idd = scsi_get_devid(item->device_id,
9004 					   item->device_id_len,
9005 					   scsi_devid_is_sas_target);
9006 		if (idd == NULL)
9007 			continue;
9008 
9009 		if (scsi_8btou64(idd->identifier) == sasaddr)
9010 			return (item);
9011 	}
9012 
9013 	return (NULL);
9014 }
9015 
9016 static int
9017 smpphylist(struct cam_device *device, int argc, char **argv,
9018 	   char *combinedopt, int retry_count, int timeout)
9019 {
9020 	struct smp_report_general_request *rgrequest = NULL;
9021 	struct smp_report_general_response *rgresponse = NULL;
9022 	struct smp_discover_request *disrequest = NULL;
9023 	struct smp_discover_response *disresponse = NULL;
9024 	struct cam_devlist devlist;
9025 	union ccb *ccb;
9026 	int long_response = 0;
9027 	int num_phys = 0;
9028 	int quiet = 0;
9029 	int retval;
9030 	int i, c;
9031 
9032 	/*
9033 	 * Note that at the moment we don't support sending SMP CCBs to
9034 	 * devices that aren't probed by CAM.
9035 	 */
9036 	ccb = cam_getccb(device);
9037 	if (ccb == NULL) {
9038 		warnx("%s: error allocating CCB", __func__);
9039 		return (1);
9040 	}
9041 
9042 	STAILQ_INIT(&devlist.dev_queue);
9043 
9044 	rgrequest = malloc(sizeof(*rgrequest));
9045 	if (rgrequest == NULL) {
9046 		warn("%s: unable to allocate %zd bytes", __func__,
9047 		     sizeof(*rgrequest));
9048 		retval = 1;
9049 		goto bailout;
9050 	}
9051 
9052 	rgresponse = malloc(sizeof(*rgresponse));
9053 	if (rgresponse == NULL) {
9054 		warn("%s: unable to allocate %zd bytes", __func__,
9055 		     sizeof(*rgresponse));
9056 		retval = 1;
9057 		goto bailout;
9058 	}
9059 
9060 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
9061 		switch (c) {
9062 		case 'l':
9063 			long_response = 1;
9064 			break;
9065 		case 'q':
9066 			quiet = 1;
9067 			break;
9068 		default:
9069 			break;
9070 		}
9071 	}
9072 
9073 	smp_report_general(&ccb->smpio,
9074 			   retry_count,
9075 			   /*cbfcnp*/ NULL,
9076 			   rgrequest,
9077 			   /*request_len*/ sizeof(*rgrequest),
9078 			   (uint8_t *)rgresponse,
9079 			   /*response_len*/ sizeof(*rgresponse),
9080 			   /*long_response*/ long_response,
9081 			   timeout);
9082 
9083 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
9084 
9085 	if (((retval = cam_send_ccb(device, ccb)) < 0)
9086 	 || ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP)) {
9087 		const char warnstr[] = "error sending command";
9088 
9089 		if (retval < 0)
9090 			warn(warnstr);
9091 		else
9092 			warnx(warnstr);
9093 
9094 		if (arglist & CAM_ARG_VERBOSE) {
9095 			cam_error_print(device, ccb, CAM_ESF_ALL,
9096 					CAM_EPF_ALL, stderr);
9097 		}
9098 		retval = 1;
9099 		goto bailout;
9100 	}
9101 
9102 	num_phys = rgresponse->num_phys;
9103 
9104 	if (num_phys == 0) {
9105 		if (quiet == 0)
9106 			fprintf(stdout, "%s: No Phys reported\n", __func__);
9107 		retval = 1;
9108 		goto bailout;
9109 	}
9110 
9111 	devlist.path_id = device->path_id;
9112 
9113 	retval = buildbusdevlist(&devlist);
9114 	if (retval != 0)
9115 		goto bailout;
9116 
9117 	if (quiet == 0) {
9118 		fprintf(stdout, "%d PHYs:\n", num_phys);
9119 		fprintf(stdout, "PHY  Attached SAS Address\n");
9120 	}
9121 
9122 	disrequest = malloc(sizeof(*disrequest));
9123 	if (disrequest == NULL) {
9124 		warn("%s: unable to allocate %zd bytes", __func__,
9125 		     sizeof(*disrequest));
9126 		retval = 1;
9127 		goto bailout;
9128 	}
9129 
9130 	disresponse = malloc(sizeof(*disresponse));
9131 	if (disresponse == NULL) {
9132 		warn("%s: unable to allocate %zd bytes", __func__,
9133 		     sizeof(*disresponse));
9134 		retval = 1;
9135 		goto bailout;
9136 	}
9137 
9138 	for (i = 0; i < num_phys; i++) {
9139 		struct cam_devitem *item;
9140 		struct device_match_result *dev_match;
9141 		char vendor[16], product[48], revision[16];
9142 		char tmpstr[256];
9143 		int j;
9144 
9145 		CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->smpio);
9146 
9147 		ccb->ccb_h.status = CAM_REQ_INPROG;
9148 		ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
9149 
9150 		smp_discover(&ccb->smpio,
9151 			     retry_count,
9152 			     /*cbfcnp*/ NULL,
9153 			     disrequest,
9154 			     sizeof(*disrequest),
9155 			     (uint8_t *)disresponse,
9156 			     sizeof(*disresponse),
9157 			     long_response,
9158 			     /*ignore_zone_group*/ 0,
9159 			     /*phy*/ i,
9160 			     timeout);
9161 
9162 		if (((retval = cam_send_ccb(device, ccb)) < 0)
9163 		 || (((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP)
9164 		  && (disresponse->function_result != SMP_FR_PHY_VACANT))) {
9165 			const char warnstr[] = "error sending command";
9166 
9167 			if (retval < 0)
9168 				warn(warnstr);
9169 			else
9170 				warnx(warnstr);
9171 
9172 			if (arglist & CAM_ARG_VERBOSE) {
9173 				cam_error_print(device, ccb, CAM_ESF_ALL,
9174 						CAM_EPF_ALL, stderr);
9175 			}
9176 			retval = 1;
9177 			goto bailout;
9178 		}
9179 
9180 		if (disresponse->function_result == SMP_FR_PHY_VACANT) {
9181 			if (quiet == 0)
9182 				fprintf(stdout, "%3d  <vacant>\n", i);
9183 			continue;
9184 		}
9185 
9186 		if (disresponse->attached_device == SMP_DIS_AD_TYPE_NONE) {
9187 			item = NULL;
9188 		} else {
9189 			item = findsasdevice(&devlist,
9190 			    scsi_8btou64(disresponse->attached_sas_address));
9191 		}
9192 
9193 		if ((quiet == 0)
9194 		 || (item != NULL)) {
9195 			fprintf(stdout, "%3d  0x%016jx", i,
9196 				(uintmax_t)scsi_8btou64(
9197 				disresponse->attached_sas_address));
9198 			if (item == NULL) {
9199 				fprintf(stdout, "\n");
9200 				continue;
9201 			}
9202 		} else if (quiet != 0)
9203 			continue;
9204 
9205 		dev_match = &item->dev_match;
9206 
9207 		if (dev_match->protocol == PROTO_SCSI) {
9208 			cam_strvis(vendor, dev_match->inq_data.vendor,
9209 				   sizeof(dev_match->inq_data.vendor),
9210 				   sizeof(vendor));
9211 			cam_strvis(product, dev_match->inq_data.product,
9212 				   sizeof(dev_match->inq_data.product),
9213 				   sizeof(product));
9214 			cam_strvis(revision, dev_match->inq_data.revision,
9215 				   sizeof(dev_match->inq_data.revision),
9216 				   sizeof(revision));
9217 			sprintf(tmpstr, "<%s %s %s>", vendor, product,
9218 				revision);
9219 		} else if ((dev_match->protocol == PROTO_ATA)
9220 			|| (dev_match->protocol == PROTO_SATAPM)) {
9221 			cam_strvis(product, dev_match->ident_data.model,
9222 				   sizeof(dev_match->ident_data.model),
9223 				   sizeof(product));
9224 			cam_strvis(revision, dev_match->ident_data.revision,
9225 				   sizeof(dev_match->ident_data.revision),
9226 				   sizeof(revision));
9227 			sprintf(tmpstr, "<%s %s>", product, revision);
9228 		} else {
9229 			sprintf(tmpstr, "<>");
9230 		}
9231 		fprintf(stdout, "   %-33s ", tmpstr);
9232 
9233 		/*
9234 		 * If we have 0 periphs, that's a bug...
9235 		 */
9236 		if (item->num_periphs == 0) {
9237 			fprintf(stdout, "\n");
9238 			continue;
9239 		}
9240 
9241 		fprintf(stdout, "(");
9242 		for (j = 0; j < item->num_periphs; j++) {
9243 			if (j > 0)
9244 				fprintf(stdout, ",");
9245 
9246 			fprintf(stdout, "%s%d",
9247 				item->periph_matches[j].periph_name,
9248 				item->periph_matches[j].unit_number);
9249 
9250 		}
9251 		fprintf(stdout, ")\n");
9252 	}
9253 bailout:
9254 	if (ccb != NULL)
9255 		cam_freeccb(ccb);
9256 
9257 	free(rgrequest);
9258 
9259 	free(rgresponse);
9260 
9261 	free(disrequest);
9262 
9263 	free(disresponse);
9264 
9265 	freebusdevlist(&devlist);
9266 
9267 	return (retval);
9268 }
9269 
9270 static int
9271 atapm_proc_resp(struct cam_device *device, union ccb *ccb)
9272 {
9273 	uint8_t error = 0, ata_device = 0, status = 0;
9274 	uint16_t count = 0;
9275 	uint64_t lba = 0;
9276 	int retval;
9277 
9278 	retval = get_ata_status(device, ccb, &error, &count, &lba, &ata_device,
9279 	    &status);
9280 	if (retval == 1) {
9281 		if (arglist & CAM_ARG_VERBOSE) {
9282 			cam_error_print(device, ccb, CAM_ESF_ALL,
9283 					CAM_EPF_ALL, stderr);
9284 		}
9285 		warnx("Can't get ATA command status");
9286 		return (retval);
9287 	}
9288 
9289 	if (status & ATA_STATUS_ERROR) {
9290 		cam_error_print(device, ccb, CAM_ESF_ALL,
9291 		    CAM_EPF_ALL, stderr);
9292 	        return (1);
9293 	}
9294 
9295 	printf("%s%d: ", device->device_name, device->dev_unit_num);
9296 	switch (count) {
9297 	case ATA_PM_STANDBY:
9298 		printf("Standby mode\n");
9299 		break;
9300 	case ATA_PM_STANDBY_Y:
9301 		printf("Standby_y mode\n");
9302 		break;
9303 	case 0x40:	/* obsolete since ACS-3 */
9304 		printf("NV Cache Power Mode and the spindle is spun down or spinning down\n");
9305 		break;
9306 	case 0x41:	/* obsolete since ACS-3 */
9307 		printf("NV Cache Power Mode and the spindle is spun up or spinning up\n");
9308 		break;
9309 	case ATA_PM_IDLE:
9310 		printf("Idle mode\n");
9311 		break;
9312 	case ATA_PM_IDLE_A:
9313 		printf("Idle_a mode\n");
9314 		break;
9315 	case ATA_PM_IDLE_B:
9316 		printf("Idle_b mode\n");
9317 		break;
9318 	case ATA_PM_IDLE_C:
9319 		printf("Idle_c mode\n");
9320 		break;
9321 	case ATA_PM_ACTIVE_IDLE:
9322 		printf("Active or Idle mode\n");
9323 		break;
9324 	default:
9325 		printf("Unknown mode 0x%02x\n", count);
9326 		break;
9327 	}
9328 
9329 	return (0);
9330 }
9331 
9332 static int
9333 atapm(struct cam_device *device, int argc, char **argv,
9334 		 char *combinedopt, int retry_count, int timeout)
9335 {
9336 	union ccb *ccb;
9337 	int retval = 0;
9338 	int t = -1;
9339 	int c;
9340 	uint8_t ata_flags = 0;
9341 	u_char cmd, sc;
9342 
9343 	ccb = cam_getccb(device);
9344 
9345 	if (ccb == NULL) {
9346 		warnx("%s: error allocating ccb", __func__);
9347 		return (1);
9348 	}
9349 
9350 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
9351 		switch (c) {
9352 		case 't':
9353 			t = atoi(optarg);
9354 			break;
9355 		default:
9356 			break;
9357 		}
9358 	}
9359 	if (strcmp(argv[1], "idle") == 0) {
9360 		if (t == -1)
9361 			cmd = ATA_IDLE_IMMEDIATE;
9362 		else
9363 			cmd = ATA_IDLE_CMD;
9364 	} else if (strcmp(argv[1], "standby") == 0) {
9365 		if (t == -1)
9366 			cmd = ATA_STANDBY_IMMEDIATE;
9367 		else
9368 			cmd = ATA_STANDBY_CMD;
9369 	} else if (strcmp(argv[1], "powermode") == 0) {
9370 		cmd = ATA_CHECK_POWER_MODE;
9371 		ata_flags = AP_FLAG_CHK_COND;
9372 		t = -1;
9373 	} else {
9374 		cmd = ATA_SLEEP;
9375 		t = -1;
9376 	}
9377 
9378 	if (t < 0)
9379 		sc = 0;
9380 	else if (t <= (240 * 5))
9381 		sc = (t + 4) / 5;
9382 	else if (t <= (252 * 5))
9383 		/* special encoding for 21 minutes */
9384 		sc = 252;
9385 	else if (t <= (11 * 30 * 60))
9386 		sc = (t - 1) / (30 * 60) + 241;
9387 	else
9388 		sc = 253;
9389 
9390 	retval = ata_do_cmd(device,
9391 	    ccb,
9392 	    /*retries*/retry_count,
9393 	    /*flags*/CAM_DIR_NONE,
9394 	    /*protocol*/AP_PROTO_NON_DATA,
9395 	    /*ata_flags*/ata_flags,
9396 	    /*tag_action*/MSG_SIMPLE_Q_TAG,
9397 	    /*command*/cmd,
9398 	    /*features*/0,
9399 	    /*lba*/0,
9400 	    /*sector_count*/sc,
9401 	    /*data_ptr*/NULL,
9402 	    /*dxfer_len*/0,
9403 	    /*timeout*/timeout ? timeout : 30 * 1000,
9404 	    /*force48bit*/0);
9405 
9406 	if (retval == 0 && cmd == ATA_CHECK_POWER_MODE)
9407 		retval = atapm_proc_resp(device, ccb);
9408 
9409 	cam_freeccb(ccb);
9410 	return (retval);
9411 }
9412 
9413 static int
9414 ataaxm(struct cam_device *device, int argc, char **argv,
9415 		 char *combinedopt, int retry_count, int timeout)
9416 {
9417 	union ccb *ccb;
9418 	int retval = 0;
9419 	int l = -1;
9420 	int c;
9421 	u_char cmd, sc;
9422 
9423 	ccb = cam_getccb(device);
9424 
9425 	if (ccb == NULL) {
9426 		warnx("%s: error allocating ccb", __func__);
9427 		return (1);
9428 	}
9429 
9430 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
9431 		switch (c) {
9432 		case 'l':
9433 			l = atoi(optarg);
9434 			break;
9435 		default:
9436 			break;
9437 		}
9438 	}
9439 	sc = 0;
9440 	if (strcmp(argv[1], "apm") == 0) {
9441 		if (l == -1)
9442 			cmd = 0x85;
9443 		else {
9444 			cmd = 0x05;
9445 			sc = l;
9446 		}
9447 	} else /* aam */ {
9448 		if (l == -1)
9449 			cmd = 0xC2;
9450 		else {
9451 			cmd = 0x42;
9452 			sc = l;
9453 		}
9454 	}
9455 
9456 	retval = ata_do_cmd(device,
9457 	    ccb,
9458 	    /*retries*/retry_count,
9459 	    /*flags*/CAM_DIR_NONE,
9460 	    /*protocol*/AP_PROTO_NON_DATA,
9461 	    /*ata_flags*/0,
9462 	    /*tag_action*/MSG_SIMPLE_Q_TAG,
9463 	    /*command*/ATA_SETFEATURES,
9464 	    /*features*/cmd,
9465 	    /*lba*/0,
9466 	    /*sector_count*/sc,
9467 	    /*data_ptr*/NULL,
9468 	    /*dxfer_len*/0,
9469 	    /*timeout*/timeout ? timeout : 30 * 1000,
9470 	    /*force48bit*/0);
9471 
9472 	cam_freeccb(ccb);
9473 	return (retval);
9474 }
9475 
9476 int
9477 scsigetopcodes(struct cam_device *device, int opcode_set, int opcode,
9478 	       int show_sa_errors, int sa_set, int service_action,
9479 	       int timeout_desc, int task_attr, int retry_count, int timeout,
9480 	       int verbosemode, uint32_t *fill_len, uint8_t **data_ptr)
9481 {
9482 	union ccb *ccb = NULL;
9483 	uint8_t *buf = NULL;
9484 	uint32_t alloc_len = 0, num_opcodes;
9485 	uint32_t valid_len = 0;
9486 	uint32_t avail_len = 0;
9487 	struct scsi_report_supported_opcodes_all *all_hdr;
9488 	struct scsi_report_supported_opcodes_one *one;
9489 	int options = 0;
9490 	int retval = 0;
9491 
9492 	/*
9493 	 * Make it clear that we haven't yet allocated or filled anything.
9494 	 */
9495 	*fill_len = 0;
9496 	*data_ptr = NULL;
9497 
9498 	ccb = cam_getccb(device);
9499 	if (ccb == NULL) {
9500 		warnx("couldn't allocate CCB");
9501 		retval = 1;
9502 		goto bailout;
9503 	}
9504 
9505 	if (opcode_set != 0) {
9506 		options |= RSO_OPTIONS_OC;
9507 		num_opcodes = 1;
9508 		alloc_len = sizeof(*one) + CAM_MAX_CDBLEN;
9509 	} else {
9510 		num_opcodes = 256;
9511 		alloc_len = sizeof(*all_hdr) + (num_opcodes *
9512 		    sizeof(struct scsi_report_supported_opcodes_descr));
9513 	}
9514 
9515 	if (timeout_desc != 0) {
9516 		options |= RSO_RCTD;
9517 		alloc_len += num_opcodes *
9518 		    sizeof(struct scsi_report_supported_opcodes_timeout);
9519 	}
9520 
9521 	if (sa_set != 0) {
9522 		options |= RSO_OPTIONS_OC_SA;
9523 		if (show_sa_errors != 0)
9524 			options &= ~RSO_OPTIONS_OC;
9525 	}
9526 
9527 retry_alloc:
9528 	if (buf != NULL) {
9529 		free(buf);
9530 		buf = NULL;
9531 	}
9532 
9533 	buf = malloc(alloc_len);
9534 	if (buf == NULL) {
9535 		warn("Unable to allocate %u bytes", alloc_len);
9536 		retval = 1;
9537 		goto bailout;
9538 	}
9539 	bzero(buf, alloc_len);
9540 
9541 	scsi_report_supported_opcodes(&ccb->csio,
9542 				      /*retries*/ retry_count,
9543 				      /*cbfcnp*/ NULL,
9544 				      /*tag_action*/ task_attr,
9545 				      /*options*/ options,
9546 				      /*req_opcode*/ opcode,
9547 				      /*req_service_action*/ service_action,
9548 				      /*data_ptr*/ buf,
9549 				      /*dxfer_len*/ alloc_len,
9550 				      /*sense_len*/ SSD_FULL_SIZE,
9551 				      /*timeout*/ timeout ? timeout : 10000);
9552 
9553 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
9554 
9555 	if (retry_count != 0)
9556 		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
9557 
9558 	if (cam_send_ccb(device, ccb) < 0) {
9559 		warn("error sending REPORT SUPPORTED OPERATION CODES command");
9560 		retval = 1;
9561 		goto bailout;
9562 	}
9563 
9564 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
9565 		if (verbosemode != 0)
9566 			cam_error_print(device, ccb, CAM_ESF_ALL,
9567 					CAM_EPF_ALL, stderr);
9568 		retval = 1;
9569 		goto bailout;
9570 	}
9571 
9572 	valid_len = ccb->csio.dxfer_len - ccb->csio.resid;
9573 
9574 	if (((options & RSO_OPTIONS_MASK) == RSO_OPTIONS_ALL)
9575 	 && (valid_len >= sizeof(*all_hdr))) {
9576 		all_hdr = (struct scsi_report_supported_opcodes_all *)buf;
9577 		avail_len = scsi_4btoul(all_hdr->length) + sizeof(*all_hdr);
9578 	} else if (((options & RSO_OPTIONS_MASK) != RSO_OPTIONS_ALL)
9579 		&& (valid_len >= sizeof(*one))) {
9580 		uint32_t cdb_length;
9581 
9582 		one = (struct scsi_report_supported_opcodes_one *)buf;
9583 		cdb_length = scsi_2btoul(one->cdb_length);
9584 		avail_len = sizeof(*one) + cdb_length;
9585 		if (one->support & RSO_ONE_CTDP) {
9586 			struct scsi_report_supported_opcodes_timeout *td;
9587 
9588 			td = (struct scsi_report_supported_opcodes_timeout *)
9589 			    &buf[avail_len];
9590 			if (valid_len >= (avail_len + sizeof(td->length))) {
9591 				avail_len += scsi_2btoul(td->length) +
9592 				    sizeof(td->length);
9593 			} else {
9594 				avail_len += sizeof(*td);
9595 			}
9596 		}
9597 	}
9598 
9599 	/*
9600 	 * avail_len could be zero if we didn't get enough data back from
9601 	 * thet target to determine
9602 	 */
9603 	if ((avail_len != 0)
9604 	 && (avail_len > valid_len)) {
9605 		alloc_len = avail_len;
9606 		goto retry_alloc;
9607 	}
9608 
9609 	*fill_len = valid_len;
9610 	*data_ptr = buf;
9611 bailout:
9612 	if (retval != 0)
9613 		free(buf);
9614 
9615 	cam_freeccb(ccb);
9616 
9617 	return (retval);
9618 }
9619 
9620 static int
9621 scsiprintoneopcode(struct cam_device *device, int req_opcode, int sa_set,
9622 		   int req_sa, uint8_t *buf, uint32_t valid_len)
9623 {
9624 	struct scsi_report_supported_opcodes_one *one;
9625 	struct scsi_report_supported_opcodes_timeout *td;
9626 	uint32_t cdb_len = 0, td_len = 0;
9627 	const char *op_desc = NULL;
9628 	unsigned int i;
9629 	int retval = 0;
9630 
9631 	one = (struct scsi_report_supported_opcodes_one *)buf;
9632 
9633 	/*
9634 	 * If we don't have the full single opcode descriptor, no point in
9635 	 * continuing.
9636 	 */
9637 	if (valid_len < __offsetof(struct scsi_report_supported_opcodes_one,
9638 	    cdb_length)) {
9639 		warnx("Only %u bytes returned, not enough to verify support",
9640 		      valid_len);
9641 		retval = 1;
9642 		goto bailout;
9643 	}
9644 
9645 	op_desc = scsi_op_desc(req_opcode, &device->inq_data);
9646 
9647 	printf("%s (0x%02x)", op_desc != NULL ? op_desc : "UNKNOWN",
9648 	       req_opcode);
9649 	if (sa_set != 0)
9650 		printf(", SA 0x%x", req_sa);
9651 	printf(": ");
9652 
9653 	switch (one->support & RSO_ONE_SUP_MASK) {
9654 	case RSO_ONE_SUP_UNAVAIL:
9655 		printf("No command support information currently available\n");
9656 		break;
9657 	case RSO_ONE_SUP_NOT_SUP:
9658 		printf("Command not supported\n");
9659 		retval = 1;
9660 		goto bailout;
9661 		break; /*NOTREACHED*/
9662 	case RSO_ONE_SUP_AVAIL:
9663 		printf("Command is supported, complies with a SCSI standard\n");
9664 		break;
9665 	case RSO_ONE_SUP_VENDOR:
9666 		printf("Command is supported, vendor-specific "
9667 		       "implementation\n");
9668 		break;
9669 	default:
9670 		printf("Unknown command support flags 0x%#x\n",
9671 		       one->support & RSO_ONE_SUP_MASK);
9672 		break;
9673 	}
9674 
9675 	/*
9676 	 * If we don't have the CDB length, it isn't exactly an error, the
9677 	 * command probably isn't supported.
9678 	 */
9679 	if (valid_len < __offsetof(struct scsi_report_supported_opcodes_one,
9680 	    cdb_usage))
9681 		goto bailout;
9682 
9683 	cdb_len = scsi_2btoul(one->cdb_length);
9684 
9685 	/*
9686 	 * If our valid data doesn't include the full reported length,
9687 	 * return.  The caller should have detected this and adjusted his
9688 	 * allocation length to get all of the available data.
9689 	 */
9690 	if (valid_len < sizeof(*one) + cdb_len) {
9691 		retval = 1;
9692 		goto bailout;
9693 	}
9694 
9695 	/*
9696 	 * If all we have is the opcode, there is no point in printing out
9697 	 * the usage bitmap.
9698 	 */
9699 	if (cdb_len <= 1) {
9700 		retval = 1;
9701 		goto bailout;
9702 	}
9703 
9704 	printf("CDB usage bitmap:");
9705 	for (i = 0; i < cdb_len; i++) {
9706 		printf(" %02x", one->cdb_usage[i]);
9707 	}
9708 	printf("\n");
9709 
9710 	/*
9711 	 * If we don't have a timeout descriptor, we're done.
9712 	 */
9713 	if ((one->support & RSO_ONE_CTDP) == 0)
9714 		goto bailout;
9715 
9716 	/*
9717 	 * If we don't have enough valid length to include the timeout
9718 	 * descriptor length, we're done.
9719 	 */
9720 	if (valid_len < (sizeof(*one) + cdb_len + sizeof(td->length)))
9721 		goto bailout;
9722 
9723 	td = (struct scsi_report_supported_opcodes_timeout *)
9724 	    &buf[sizeof(*one) + cdb_len];
9725 	td_len = scsi_2btoul(td->length);
9726 	td_len += sizeof(td->length);
9727 
9728 	/*
9729 	 * If we don't have the full timeout descriptor, we're done.
9730 	 */
9731 	if (td_len < sizeof(*td))
9732 		goto bailout;
9733 
9734 	/*
9735 	 * If we don't have enough valid length to contain the full timeout
9736 	 * descriptor, we're done.
9737 	 */
9738 	if (valid_len < (sizeof(*one) + cdb_len + td_len))
9739 		goto bailout;
9740 
9741 	printf("Timeout information:\n");
9742 	printf("Command-specific:    0x%02x\n", td->cmd_specific);
9743 	printf("Nominal timeout:     %u seconds\n",
9744 	       scsi_4btoul(td->nominal_time));
9745 	printf("Recommended timeout: %u seconds\n",
9746 	       scsi_4btoul(td->recommended_time));
9747 
9748 bailout:
9749 	return (retval);
9750 }
9751 
9752 static int
9753 scsiprintopcodes(struct cam_device *device, int td_req, uint8_t *buf,
9754 		 uint32_t valid_len)
9755 {
9756 	struct scsi_report_supported_opcodes_all *hdr;
9757 	struct scsi_report_supported_opcodes_descr *desc;
9758 	uint32_t avail_len = 0, used_len = 0;
9759 	uint8_t *cur_ptr;
9760 	int retval = 0;
9761 
9762 	if (valid_len < sizeof(*hdr)) {
9763 		warnx("%s: not enough returned data (%u bytes) opcode list",
9764 		      __func__, valid_len);
9765 		retval = 1;
9766 		goto bailout;
9767 	}
9768 	hdr = (struct scsi_report_supported_opcodes_all *)buf;
9769 	avail_len = scsi_4btoul(hdr->length);
9770 	avail_len += sizeof(hdr->length);
9771 	/*
9772 	 * Take the lesser of the amount of data the drive claims is
9773 	 * available, and the amount of data the HBA says was returned.
9774 	 */
9775 	avail_len = MIN(avail_len, valid_len);
9776 
9777 	used_len = sizeof(hdr->length);
9778 
9779 	printf("%-6s %4s %8s ",
9780 	       "Opcode", "SA", "CDB len" );
9781 
9782 	if (td_req != 0)
9783 		printf("%5s %6s %6s ", "CS", "Nom", "Rec");
9784 	printf(" Description\n");
9785 
9786 	while ((avail_len - used_len) > sizeof(*desc)) {
9787 		struct scsi_report_supported_opcodes_timeout *td;
9788 		uint32_t td_len;
9789 		const char *op_desc = NULL;
9790 
9791 		cur_ptr = &buf[used_len];
9792 		desc = (struct scsi_report_supported_opcodes_descr *)cur_ptr;
9793 
9794 		op_desc = scsi_op_desc(desc->opcode, &device->inq_data);
9795 		if (op_desc == NULL)
9796 			op_desc = "UNKNOWN";
9797 
9798 		printf("0x%02x   %#4x %8u ", desc->opcode,
9799 		       scsi_2btoul(desc->service_action),
9800 		       scsi_2btoul(desc->cdb_length));
9801 
9802 		used_len += sizeof(*desc);
9803 
9804 		if ((desc->flags & RSO_CTDP) == 0) {
9805 			printf(" %s\n", op_desc);
9806 			continue;
9807 		}
9808 
9809 		/*
9810 		 * If we don't have enough space to fit a timeout
9811 		 * descriptor, then we're done.
9812 		 */
9813 		if (avail_len - used_len < sizeof(*td)) {
9814 			used_len = avail_len;
9815 			printf(" %s\n", op_desc);
9816 			continue;
9817 		}
9818 		cur_ptr = &buf[used_len];
9819 		td = (struct scsi_report_supported_opcodes_timeout *)cur_ptr;
9820 		td_len = scsi_2btoul(td->length);
9821 		td_len += sizeof(td->length);
9822 
9823 		used_len += td_len;
9824 		/*
9825 		 * If the given timeout descriptor length is less than what
9826 		 * we understand, skip it.
9827 		 */
9828 		if (td_len < sizeof(*td)) {
9829 			printf(" %s\n", op_desc);
9830 			continue;
9831 		}
9832 
9833 		printf(" 0x%02x %6u %6u  %s\n", td->cmd_specific,
9834 		       scsi_4btoul(td->nominal_time),
9835 		       scsi_4btoul(td->recommended_time), op_desc);
9836 	}
9837 bailout:
9838 	return (retval);
9839 }
9840 
9841 static int
9842 scsiopcodes(struct cam_device *device, int argc, char **argv,
9843 	    char *combinedopt, int task_attr, int retry_count, int timeout,
9844 	    int verbosemode)
9845 {
9846 	int c;
9847 	uint32_t opcode = 0, service_action = 0;
9848 	int td_set = 0, opcode_set = 0, sa_set = 0;
9849 	int show_sa_errors = 1;
9850 	uint32_t valid_len = 0;
9851 	uint8_t *buf = NULL;
9852 	char *endptr;
9853 	int retval = 0;
9854 
9855 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
9856 		switch (c) {
9857 		case 'N':
9858 			show_sa_errors = 0;
9859 			break;
9860 		case 'o':
9861 			opcode = strtoul(optarg, &endptr, 0);
9862 			if (*endptr != '\0') {
9863 				warnx("Invalid opcode \"%s\", must be a number",
9864 				      optarg);
9865 				retval = 1;
9866 				goto bailout;
9867 			}
9868 			if (opcode > 0xff) {
9869 				warnx("Invalid opcode 0x%#x, must be between"
9870 				      "0 and 0xff inclusive", opcode);
9871 				retval = 1;
9872 				goto bailout;
9873 			}
9874 			opcode_set = 1;
9875 			break;
9876 		case 's':
9877 			service_action = strtoul(optarg, &endptr, 0);
9878 			if (*endptr != '\0') {
9879 				warnx("Invalid service action \"%s\", must "
9880 				      "be a number", optarg);
9881 				retval = 1;
9882 				goto bailout;
9883 			}
9884 			if (service_action > 0xffff) {
9885 				warnx("Invalid service action 0x%#x, must "
9886 				      "be between 0 and 0xffff inclusive",
9887 				      service_action);
9888 				retval = 1;
9889 			}
9890 			sa_set = 1;
9891 			break;
9892 		case 'T':
9893 			td_set = 1;
9894 			break;
9895 		default:
9896 			break;
9897 		}
9898 	}
9899 
9900 	if ((sa_set != 0)
9901 	 && (opcode_set == 0)) {
9902 		warnx("You must specify an opcode with -o if a service "
9903 		      "action is given");
9904 		retval = 1;
9905 		goto bailout;
9906 	}
9907 	retval = scsigetopcodes(device, opcode_set, opcode, show_sa_errors,
9908 				sa_set, service_action, td_set, task_attr,
9909 				retry_count, timeout, verbosemode, &valid_len,
9910 				&buf);
9911 	if (retval != 0)
9912 		goto bailout;
9913 
9914 	if ((opcode_set != 0)
9915 	 || (sa_set != 0)) {
9916 		retval = scsiprintoneopcode(device, opcode, sa_set,
9917 					    service_action, buf, valid_len);
9918 	} else {
9919 		retval = scsiprintopcodes(device, td_set, buf, valid_len);
9920 	}
9921 
9922 bailout:
9923 	free(buf);
9924 
9925 	return (retval);
9926 }
9927 
9928 
9929 static int
9930 reprobe(struct cam_device *device)
9931 {
9932 	union ccb *ccb;
9933 	int retval = 0;
9934 
9935 	ccb = cam_getccb(device);
9936 
9937 	if (ccb == NULL) {
9938 		warnx("%s: error allocating ccb", __func__);
9939 		return (1);
9940 	}
9941 
9942 	ccb->ccb_h.func_code = XPT_REPROBE_LUN;
9943 
9944 	if (cam_send_ccb(device, ccb) < 0) {
9945 		warn("error sending XPT_REPROBE_LUN CCB");
9946 		retval = 1;
9947 		goto bailout;
9948 	}
9949 
9950 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
9951 		cam_error_print(device, ccb, CAM_ESF_ALL, CAM_EPF_ALL, stderr);
9952 		retval = 1;
9953 		goto bailout;
9954 	}
9955 
9956 bailout:
9957 	cam_freeccb(ccb);
9958 
9959 	return (retval);
9960 }
9961 
9962 void
9963 usage(int printlong)
9964 {
9965 
9966 	fprintf(printlong ? stdout : stderr,
9967 "usage:  camcontrol <command>  [device id][generic args][command args]\n"
9968 "        camcontrol devlist    [-b] [-v]\n"
9969 "        camcontrol periphlist [dev_id][-n dev_name] [-u unit]\n"
9970 "        camcontrol tur        [dev_id][generic args]\n"
9971 "        camcontrol sense      [dev_id][generic args][-D][-x]\n"
9972 "        camcontrol inquiry    [dev_id][generic args] [-D] [-S] [-R]\n"
9973 "        camcontrol identify   [dev_id][generic args] [-v]\n"
9974 "        camcontrol reportluns [dev_id][generic args] [-c] [-l] [-r report]\n"
9975 "        camcontrol readcap    [dev_id][generic args] [-b] [-h] [-H] [-N]\n"
9976 "                              [-q] [-s] [-l]\n"
9977 "        camcontrol start      [dev_id][generic args]\n"
9978 "        camcontrol stop       [dev_id][generic args]\n"
9979 "        camcontrol load       [dev_id][generic args]\n"
9980 "        camcontrol eject      [dev_id][generic args]\n"
9981 "        camcontrol reprobe    [dev_id][generic args]\n"
9982 "        camcontrol rescan     <all | bus[:target:lun] | dev_id>\n"
9983 "        camcontrol reset      <all | bus[:target:lun] | dev_id>\n"
9984 "        camcontrol defects    [dev_id][generic args] <-f format> [-P][-G]\n"
9985 "                              [-q][-s][-S offset][-X]\n"
9986 "        camcontrol modepage   [dev_id][generic args] <-m page | -l>\n"
9987 "                              [-P pagectl][-e | -b][-d]\n"
9988 "        camcontrol cmd        [dev_id][generic args]\n"
9989 "                              <-a cmd [args] | -c cmd [args]>\n"
9990 "                              [-d] [-f] [-i len fmt|-o len fmt [args]] [-r fmt]\n"
9991 "        camcontrol smpcmd     [dev_id][generic args]\n"
9992 "                              <-r len fmt [args]> <-R len fmt [args]>\n"
9993 "        camcontrol smprg      [dev_id][generic args][-l]\n"
9994 "        camcontrol smppc      [dev_id][generic args] <-p phy> [-l]\n"
9995 "                              [-o operation][-d name][-m rate][-M rate]\n"
9996 "                              [-T pp_timeout][-a enable|disable]\n"
9997 "                              [-A enable|disable][-s enable|disable]\n"
9998 "                              [-S enable|disable]\n"
9999 "        camcontrol smpphylist [dev_id][generic args][-l][-q]\n"
10000 "        camcontrol smpmaninfo [dev_id][generic args][-l]\n"
10001 "        camcontrol debug      [-I][-P][-T][-S][-X][-c]\n"
10002 "                              <all|dev_id|bus[:target[:lun]]|off>\n"
10003 "        camcontrol tags       [dev_id][generic args] [-N tags] [-q] [-v]\n"
10004 "        camcontrol negotiate  [dev_id][generic args] [-a][-c]\n"
10005 "                              [-D <enable|disable>][-M mode][-O offset]\n"
10006 "                              [-q][-R syncrate][-v][-T <enable|disable>]\n"
10007 "                              [-U][-W bus_width]\n"
10008 "        camcontrol format     [dev_id][generic args][-q][-r][-w][-y]\n"
10009 "        camcontrol sanitize   [dev_id][generic args]\n"
10010 "                              [-a overwrite|block|crypto|exitfailure]\n"
10011 "                              [-c passes][-I][-P pattern][-q][-U][-r][-w]\n"
10012 "                              [-y]\n"
10013 "        camcontrol idle       [dev_id][generic args][-t time]\n"
10014 "        camcontrol standby    [dev_id][generic args][-t time]\n"
10015 "        camcontrol sleep      [dev_id][generic args]\n"
10016 "        camcontrol powermode  [dev_id][generic args]\n"
10017 "        camcontrol apm        [dev_id][generic args][-l level]\n"
10018 "        camcontrol aam        [dev_id][generic args][-l level]\n"
10019 "        camcontrol fwdownload [dev_id][generic args] <-f fw_image> [-q]\n"
10020 "                              [-s][-y]\n"
10021 "        camcontrol security   [dev_id][generic args]\n"
10022 "                              <-d pwd | -e pwd | -f | -h pwd | -k pwd>\n"
10023 "                              [-l <high|maximum>] [-q] [-s pwd] [-T timeout]\n"
10024 "                              [-U <user|master>] [-y]\n"
10025 "        camcontrol hpa        [dev_id][generic args] [-f] [-l] [-P] [-p pwd]\n"
10026 "                              [-q] [-s max_sectors] [-U pwd] [-y]\n"
10027 "        camcontrol ama        [dev_id][generic args] [-f] [-q] [-s max_sectors]\n"
10028 "        camcontrol persist    [dev_id][generic args] <-i action|-o action>\n"
10029 "                              [-a][-I tid][-k key][-K sa_key][-p][-R rtp]\n"
10030 "                              [-s scope][-S][-T type][-U]\n"
10031 "        camcontrol attrib     [dev_id][generic args] <-r action|-w attr>\n"
10032 "                              [-a attr_num][-c][-e elem][-F form1,form1]\n"
10033 "                              [-p part][-s start][-T type][-V vol]\n"
10034 "        camcontrol opcodes    [dev_id][generic args][-o opcode][-s SA]\n"
10035 "                              [-N][-T]\n"
10036 "        camcontrol zone       [dev_id][generic args]<-c cmd> [-a] [-l LBA]\n"
10037 "                              [-o rep_opts] [-P print_opts]\n"
10038 "        camcontrol epc        [dev_id][generic_args]<-c cmd> [-d] [-D] [-e]\n"
10039 "                              [-H] [-p power_cond] [-P] [-r rst_src] [-s]\n"
10040 "                              [-S power_src] [-T timer]\n"
10041 "        camcontrol timestamp  [dev_id][generic_args] <-r [-f format|-m|-U]>|\n"
10042 "                              <-s <-f format -T time | -U >>\n"
10043 "        camcontrol devtype    [dev_id]\n"
10044 "        camcontrol depop      [dev_id] [-d | -l | -r] [-e element] [-c capacity]\n"
10045 "        camcontrol mmcsdcmd   [dev_id] [[-c mmc_opcode] [-a mmc_arg]\n"
10046 "                                  [-f mmc_flags] [-l data_len]\n"
10047 "                                  [-W [-b data_byte]]] |\n"
10048 "                              [-F frequency] |\n"
10049 "                              [-I]\n"
10050 "                              [-1 | -4]\n"
10051 "                              [-S high|normal]\n"
10052 "                              \n"
10053 "        camcontrol help\n");
10054 	if (!printlong)
10055 		return;
10056 	fprintf(stdout,
10057 "Specify one of the following options:\n"
10058 "devlist     list all CAM devices\n"
10059 "periphlist  list all CAM peripheral drivers attached to a device\n"
10060 "sense       send a request sense command to the named device\n"
10061 "tur         send a test unit ready to the named device\n"
10062 "inquiry     send a SCSI inquiry command to the named device\n"
10063 "identify    send a ATA identify command to the named device\n"
10064 "reportluns  send a SCSI report luns command to the device\n"
10065 "readcap     send a SCSI read capacity command to the device\n"
10066 "start       send a Start Unit command to the device\n"
10067 "stop        send a Stop Unit command to the device\n"
10068 "load        send a Start Unit command to the device with the load bit set\n"
10069 "eject       send a Stop Unit command to the device with the eject bit set\n"
10070 "reprobe     update capacity information of the given device\n"
10071 "rescan      rescan all buses, the given bus, bus:target:lun or device\n"
10072 "reset       reset all buses, the given bus, bus:target:lun or device\n"
10073 "defects     read the defect list of the specified device\n"
10074 "modepage    display or edit (-e) the given mode page\n"
10075 "cmd         send the given SCSI command, may need -i or -o as well\n"
10076 "smpcmd      send the given SMP command, requires -o and -i\n"
10077 "smprg       send the SMP Report General command\n"
10078 "smppc       send the SMP PHY Control command, requires -p\n"
10079 "smpphylist  display phys attached to a SAS expander\n"
10080 "smpmaninfo  send the SMP Report Manufacturer Info command\n"
10081 "debug       turn debugging on/off for a bus, target, or lun, or all devices\n"
10082 "tags        report or set the number of transaction slots for a device\n"
10083 "negotiate   report or set device negotiation parameters\n"
10084 "format      send the SCSI FORMAT UNIT command to the named device\n"
10085 "sanitize    send the SCSI SANITIZE command to the named device\n"
10086 "idle        send the ATA IDLE command to the named device\n"
10087 "standby     send the ATA STANDBY command to the named device\n"
10088 "sleep       send the ATA SLEEP command to the named device\n"
10089 "powermode   send the ATA CHECK POWER MODE command to the named device\n"
10090 "fwdownload  program firmware of the named device with the given image\n"
10091 "security    report or send ATA security commands to the named device\n"
10092 "persist     send the SCSI PERSISTENT RESERVE IN or OUT commands\n"
10093 "attrib      send the SCSI READ or WRITE ATTRIBUTE commands\n"
10094 "opcodes     send the SCSI REPORT SUPPORTED OPCODES command\n"
10095 "zone        manage Zoned Block (Shingled) devices\n"
10096 "epc         send ATA Extended Power Conditions commands\n"
10097 "timestamp   report or set the device's timestamp\n"
10098 "devtype     report the type of device\n"
10099 "depop       manage drive storage elements\n"
10100 "mmcsdcmd    send the given MMC command, needs -c and -a as well\n"
10101 "help        this message\n"
10102 "Device Identifiers:\n"
10103 "bus:target        specify the bus and target, lun defaults to 0\n"
10104 "bus:target:lun    specify the bus, target and lun\n"
10105 "deviceUNIT        specify the device name, like \"da4\" or \"cd2\"\n"
10106 "Generic arguments:\n"
10107 "-v                be verbose, print out sense information\n"
10108 "-t timeout        command timeout in seconds, overrides default timeout\n"
10109 "-n dev_name       specify device name, e.g. \"da\", \"cd\"\n"
10110 "-u unit           specify unit number, e.g. \"0\", \"5\"\n"
10111 "-E                have the kernel attempt to perform SCSI error recovery\n"
10112 "-C count          specify the SCSI command retry count (needs -E to work)\n"
10113 "-Q task_attr      specify ordered, simple or head tag type for SCSI cmds\n"
10114 "modepage arguments:\n"
10115 "-l                list all available mode pages\n"
10116 "-m page           specify the mode page to view or edit\n"
10117 "-e                edit the specified mode page\n"
10118 "-b                force view to binary mode\n"
10119 "-d                disable block descriptors for mode sense\n"
10120 "-P pgctl          page control field 0-3\n"
10121 "defects arguments:\n"
10122 "-f format         specify defect list format (block, bfi or phys)\n"
10123 "-G                get the grown defect list\n"
10124 "-P                get the permanent defect list\n"
10125 "sense arguments:\n"
10126 "-D                request descriptor sense data\n"
10127 "-x                do a hexdump of the sense data\n"
10128 "inquiry arguments:\n"
10129 "-D                get the standard inquiry data\n"
10130 "-S                get the serial number\n"
10131 "-R                get the transfer rate, etc.\n"
10132 "reportluns arguments:\n"
10133 "-c                only report a count of available LUNs\n"
10134 "-l                only print out luns, and not a count\n"
10135 "-r <reporttype>   specify \"default\", \"wellknown\" or \"all\"\n"
10136 "readcap arguments\n"
10137 "-b                only report the blocksize\n"
10138 "-h                human readable device size, base 2\n"
10139 "-H                human readable device size, base 10\n"
10140 "-N                print the number of blocks instead of last block\n"
10141 "-q                quiet, print numbers only\n"
10142 "-s                only report the last block/device size\n"
10143 "cmd arguments:\n"
10144 "-c cdb [args]     specify the SCSI CDB\n"
10145 "-i len fmt        specify input data and input data format\n"
10146 "-o len fmt [args] specify output data and output data fmt\n"
10147 "smpcmd arguments:\n"
10148 "-r len fmt [args] specify the SMP command to be sent\n"
10149 "-R len fmt [args] specify SMP response format\n"
10150 "smprg arguments:\n"
10151 "-l                specify the long response format\n"
10152 "smppc arguments:\n"
10153 "-p phy            specify the PHY to operate on\n"
10154 "-l                specify the long request/response format\n"
10155 "-o operation      specify the phy control operation\n"
10156 "-d name           set the attached device name\n"
10157 "-m rate           set the minimum physical link rate\n"
10158 "-M rate           set the maximum physical link rate\n"
10159 "-T pp_timeout     set the partial pathway timeout value\n"
10160 "-a enable|disable enable or disable SATA slumber\n"
10161 "-A enable|disable enable or disable SATA partial phy power\n"
10162 "-s enable|disable enable or disable SAS slumber\n"
10163 "-S enable|disable enable or disable SAS partial phy power\n"
10164 "smpphylist arguments:\n"
10165 "-l                specify the long response format\n"
10166 "-q                only print phys with attached devices\n"
10167 "smpmaninfo arguments:\n"
10168 "-l                specify the long response format\n"
10169 "debug arguments:\n"
10170 "-I                CAM_DEBUG_INFO -- scsi commands, errors, data\n"
10171 "-T                CAM_DEBUG_TRACE -- routine flow tracking\n"
10172 "-S                CAM_DEBUG_SUBTRACE -- internal routine command flow\n"
10173 "-c                CAM_DEBUG_CDB -- print out SCSI CDBs only\n"
10174 "tags arguments:\n"
10175 "-N tags           specify the number of tags to use for this device\n"
10176 "-q                be quiet, don't report the number of tags\n"
10177 "-v                report a number of tag-related parameters\n"
10178 "negotiate arguments:\n"
10179 "-a                send a test unit ready after negotiation\n"
10180 "-c                report/set current negotiation settings\n"
10181 "-D <arg>          \"enable\" or \"disable\" disconnection\n"
10182 "-M mode           set ATA mode\n"
10183 "-O offset         set command delay offset\n"
10184 "-q                be quiet, don't report anything\n"
10185 "-R syncrate       synchronization rate in MHz\n"
10186 "-T <arg>          \"enable\" or \"disable\" tagged queueing\n"
10187 "-U                report/set user negotiation settings\n"
10188 "-W bus_width      set the bus width in bits (8, 16 or 32)\n"
10189 "-v                also print a Path Inquiry CCB for the controller\n"
10190 "format arguments:\n"
10191 "-q                be quiet, don't print status messages\n"
10192 "-r                run in report only mode\n"
10193 "-w                don't send immediate format command\n"
10194 "-y                don't ask any questions\n"
10195 "sanitize arguments:\n"
10196 "-a operation      operation mode: overwrite, block, crypto or exitfailure\n"
10197 "-c passes         overwrite passes to perform (1 to 31)\n"
10198 "-I                invert overwrite pattern after each pass\n"
10199 "-P pattern        path to overwrite pattern file\n"
10200 "-q                be quiet, don't print status messages\n"
10201 "-r                run in report only mode\n"
10202 "-U                run operation in unrestricted completion exit mode\n"
10203 "-w                don't send immediate sanitize command\n"
10204 "-y                don't ask any questions\n"
10205 "idle/standby arguments:\n"
10206 "-t <arg>          number of seconds before respective state.\n"
10207 "fwdownload arguments:\n"
10208 "-f fw_image       path to firmware image file\n"
10209 "-q                don't print informational messages, only errors\n"
10210 "-s                run in simulation mode\n"
10211 "-v                print info for every firmware segment sent to device\n"
10212 "-y                don't ask any questions\n"
10213 "security arguments:\n"
10214 "-d pwd            disable security using the given password for the selected\n"
10215 "                  user\n"
10216 "-e pwd            erase the device using the given pwd for the selected user\n"
10217 "-f                freeze the security configuration of the specified device\n"
10218 "-h pwd            enhanced erase the device using the given pwd for the\n"
10219 "                  selected user\n"
10220 "-k pwd            unlock the device using the given pwd for the selected\n"
10221 "                  user\n"
10222 "-l <high|maximum> specifies which security level to set: high or maximum\n"
10223 "-q                be quiet, do not print any status messages\n"
10224 "-s pwd            password the device (enable security) using the given\n"
10225 "                  pwd for the selected user\n"
10226 "-T timeout        overrides the timeout (seconds) used for erase operation\n"
10227 "-U <user|master>  specifies which user to set: user or master\n"
10228 "-y                don't ask any questions\n"
10229 "hpa arguments:\n"
10230 "-f                freeze the HPA configuration of the device\n"
10231 "-l                lock the HPA configuration of the device\n"
10232 "-P                make the HPA max sectors persist\n"
10233 "-p pwd            Set the HPA configuration password required for unlock\n"
10234 "                  calls\n"
10235 "-q                be quiet, do not print any status messages\n"
10236 "-s sectors        configures the maximum user accessible sectors of the\n"
10237 "                  device\n"
10238 "-U pwd            unlock the HPA configuration of the device\n"
10239 "-y                don't ask any questions\n"
10240 "ama arguments:\n"
10241 "-f                freeze the AMA configuration of the device\n"
10242 "-q                be quiet, do not print any status messages\n"
10243 "-s sectors        configures the maximum user accessible sectors of the\n"
10244 "                  device\n"
10245 "persist arguments:\n"
10246 "-i action         specify read_keys, read_reservation, report_cap, or\n"
10247 "                  read_full_status\n"
10248 "-o action         specify register, register_ignore, reserve, release,\n"
10249 "                  clear, preempt, preempt_abort, register_move, replace_lost\n"
10250 "-a                set the All Target Ports (ALL_TG_PT) bit\n"
10251 "-I tid            specify a Transport ID, e.g.: sas,0x1234567812345678\n"
10252 "-k key            specify the Reservation Key\n"
10253 "-K sa_key         specify the Service Action Reservation Key\n"
10254 "-p                set the Activate Persist Through Power Loss bit\n"
10255 "-R rtp            specify the Relative Target Port\n"
10256 "-s scope          specify the scope: lun, extent, element or a number\n"
10257 "-S                specify Transport ID for register, requires -I\n"
10258 "-T res_type       specify the reservation type: read_shared, wr_ex, rd_ex,\n"
10259 "                  ex_ac, wr_ex_ro, ex_ac_ro, wr_ex_ar, ex_ac_ar\n"
10260 "-U                unregister the current initiator for register_move\n"
10261 "attrib arguments:\n"
10262 "-r action         specify attr_values, attr_list, lv_list, part_list, or\n"
10263 "                  supp_attr\n"
10264 "-w attr           specify an attribute to write, one -w argument per attr\n"
10265 "-a attr_num       only display this attribute number\n"
10266 "-c                get cached attributes\n"
10267 "-e elem_addr      request attributes for the given element in a changer\n"
10268 "-F form1,form2    output format, comma separated list: text_esc, text_raw,\n"
10269 "                  nonascii_esc, nonascii_trim, nonascii_raw, field_all,\n"
10270 "                  field_none, field_desc, field_num, field_size, field_rw\n"
10271 "-p partition      request attributes for the given partition\n"
10272 "-s start_attr     request attributes starting at the given number\n"
10273 "-T elem_type      specify the element type (used with -e)\n"
10274 "-V logical_vol    specify the logical volume ID\n"
10275 "opcodes arguments:\n"
10276 "-o opcode         specify the individual opcode to list\n"
10277 "-s service_action specify the service action for the opcode\n"
10278 "-N                do not return SCSI error for unsupported SA\n"
10279 "-T                request nominal and recommended timeout values\n"
10280 "zone arguments:\n"
10281 "-c cmd            required: rz, open, close, finish, or rwp\n"
10282 "-a                apply the action to all zones\n"
10283 "-l LBA            specify the zone starting LBA\n"
10284 "-o rep_opts       report zones options: all, empty, imp_open, exp_open,\n"
10285 "                  closed, full, ro, offline, reset, nonseq, nonwp\n"
10286 "-P print_opt      report zones printing:  normal, summary, script\n"
10287 "epc arguments:\n"
10288 "-c cmd            required: restore, goto, timer, state, enable, disable,\n"
10289 "                  source, status, list\n"
10290 "-d                disable power mode (timer, state)\n"
10291 "-D                delayed entry (goto)\n"
10292 "-e                enable power mode (timer, state)\n"
10293 "-H                hold power mode (goto)\n"
10294 "-p power_cond     Idle_a, Idle_b, Idle_c, Standby_y, Standby_z (timer,\n"
10295 "                  state, goto)\n"
10296 "-P                only display power mode (status)\n"
10297 "-r rst_src        restore settings from: default, saved (restore)\n"
10298 "-s                save mode (timer, state, restore)\n"
10299 "-S power_src      set power source: battery, nonbattery (source)\n"
10300 "-T timer          set timer, seconds, .1 sec resolution (timer)\n"
10301 "timestamp arguments:\n"
10302 "-r                report the timestamp of the device\n"
10303 "-f format         report the timestamp of the device with the given\n"
10304 "                  strftime(3) format string\n"
10305 "-m                report the timestamp of the device as milliseconds since\n"
10306 "                  January 1st, 1970\n"
10307 "-U                report the time with UTC instead of the local time zone\n"
10308 "-s                set the timestamp of the device\n"
10309 "-f format         the format of the time string passed into strptime(3)\n"
10310 "-T time           the time value passed into strptime(3)\n"
10311 "-U                set the timestamp of the device to UTC time\n"
10312 "depop arguments:\n"
10313 "-d                remove an element from service\n"
10314 "-l                list status of all elements of drive\n"
10315 "-r                restore all elements to service\n"
10316 "-e elm            element to remove\n"
10317 "-c capacity       requested new capacity\n"
10318 "mmcsdcmd arguments:\n"
10319 "-c mmc_cmd        MMC command to send to the card\n"
10320 "-a mmc_arg        Argument for the MMC command\n"
10321 "-f mmc_flag       Flags to set for the MMC command\n"
10322 "-l data_len       Expect data_len bytes of data in reply and display them\n"
10323 "-W                Fill the data buffer before invoking the MMC command\n"
10324 "-b data_byte      One byte of data to fill the data buffer with\n"
10325 "-F frequency      Operating frequency to set on the controller\n"
10326 "-4                Set bus width to 4 bit\n"
10327 "-1                Set bus width to 8 bit\n"
10328 "-S high | std     Set high-speed or standard timing\n"
10329 "-I                Display various card and host controller information\n"
10330 );
10331 }
10332 
10333 int
10334 main(int argc, char **argv)
10335 {
10336 	int c;
10337 	char *device = NULL;
10338 	int unit = 0;
10339 	struct cam_device *cam_dev = NULL;
10340 	int timeout = 0, retry_count = 1;
10341 	camcontrol_optret optreturn;
10342 	char *tstr;
10343 	const char *mainopt = "C:En:Q:t:u:v";
10344 	const char *subopt = NULL;
10345 	char combinedopt[256];
10346 	int error = 0, optstart = 2;
10347 	int task_attr = MSG_SIMPLE_Q_TAG;
10348 	int devopen = 1;
10349 	cam_cmd cmdlist;
10350 	path_id_t bus;
10351 	target_id_t target;
10352 	lun_id_t lun;
10353 
10354 	cmdlist = CAM_CMD_NONE;
10355 	arglist = CAM_ARG_NONE;
10356 
10357 	if (argc < 2) {
10358 		usage(0);
10359 		exit(1);
10360 	}
10361 
10362 	/*
10363 	 * Get the base option.
10364 	 */
10365 	optreturn = getoption(option_table,argv[1], &cmdlist, &arglist,&subopt);
10366 
10367 	if (optreturn == CC_OR_AMBIGUOUS) {
10368 		warnx("ambiguous option %s", argv[1]);
10369 		usage(0);
10370 		exit(1);
10371 	} else if (optreturn == CC_OR_NOT_FOUND) {
10372 		warnx("option %s not found", argv[1]);
10373 		usage(0);
10374 		exit(1);
10375 	}
10376 
10377 	/*
10378 	 * Ahh, getopt(3) is a pain.
10379 	 *
10380 	 * This is a gross hack.  There really aren't many other good
10381 	 * options (excuse the pun) for parsing options in a situation like
10382 	 * this.  getopt is kinda braindead, so you end up having to run
10383 	 * through the options twice, and give each invocation of getopt
10384 	 * the option string for the other invocation.
10385 	 *
10386 	 * You would think that you could just have two groups of options.
10387 	 * The first group would get parsed by the first invocation of
10388 	 * getopt, and the second group would get parsed by the second
10389 	 * invocation of getopt.  It doesn't quite work out that way.  When
10390 	 * the first invocation of getopt finishes, it leaves optind pointing
10391 	 * to the argument _after_ the first argument in the second group.
10392 	 * So when the second invocation of getopt comes around, it doesn't
10393 	 * recognize the first argument it gets and then bails out.
10394 	 *
10395 	 * A nice alternative would be to have a flag for getopt that says
10396 	 * "just keep parsing arguments even when you encounter an unknown
10397 	 * argument", but there isn't one.  So there's no real clean way to
10398 	 * easily parse two sets of arguments without having one invocation
10399 	 * of getopt know about the other.
10400 	 *
10401 	 * Without this hack, the first invocation of getopt would work as
10402 	 * long as the generic arguments are first, but the second invocation
10403 	 * (in the subfunction) would fail in one of two ways.  In the case
10404 	 * where you don't set optreset, it would fail because optind may be
10405 	 * pointing to the argument after the one it should be pointing at.
10406 	 * In the case where you do set optreset, and reset optind, it would
10407 	 * fail because getopt would run into the first set of options, which
10408 	 * it doesn't understand.
10409 	 *
10410 	 * All of this would "sort of" work if you could somehow figure out
10411 	 * whether optind had been incremented one option too far.  The
10412 	 * mechanics of that, however, are more daunting than just giving
10413 	 * both invocations all of the expect options for either invocation.
10414 	 *
10415 	 * Needless to say, I wouldn't mind if someone invented a better
10416 	 * (non-GPL!) command line parsing interface than getopt.  I
10417 	 * wouldn't mind if someone added more knobs to getopt to make it
10418 	 * work better.  Who knows, I may talk myself into doing it someday,
10419 	 * if the standards weenies let me.  As it is, it just leads to
10420 	 * hackery like this and causes people to avoid it in some cases.
10421 	 *
10422 	 * KDM, September 8th, 1998
10423 	 */
10424 	if (subopt != NULL)
10425 		sprintf(combinedopt, "%s%s", mainopt, subopt);
10426 	else
10427 		sprintf(combinedopt, "%s", mainopt);
10428 
10429 	/*
10430 	 * For these options we do not parse optional device arguments and
10431 	 * we do not open a passthrough device.
10432 	 */
10433 	if ((cmdlist == CAM_CMD_RESCAN)
10434 	 || (cmdlist == CAM_CMD_RESET)
10435 	 || (cmdlist == CAM_CMD_DEVTREE)
10436 	 || (cmdlist == CAM_CMD_USAGE)
10437 	 || (cmdlist == CAM_CMD_DEBUG))
10438 		devopen = 0;
10439 
10440 	if ((devopen == 1)
10441 	 && (argc > 2 && argv[2][0] != '-')) {
10442 		char name[30];
10443 		int rv;
10444 
10445 		if (isdigit(argv[2][0])) {
10446 			/* device specified as bus:target[:lun] */
10447 			rv = parse_btl(argv[2], &bus, &target, &lun, &arglist);
10448 			if (rv < 2)
10449 				errx(1, "numeric device specification must "
10450 				     "be either bus:target, or "
10451 				     "bus:target:lun");
10452 			/* default to 0 if lun was not specified */
10453 			if ((arglist & CAM_ARG_LUN) == 0) {
10454 				lun = 0;
10455 				arglist |= CAM_ARG_LUN;
10456 			}
10457 			optstart++;
10458 		} else {
10459 			if (cam_get_device(argv[2], name, sizeof name, &unit)
10460 			    == -1)
10461 				errx(1, "%s", cam_errbuf);
10462 			device = strdup(name);
10463 			arglist |= CAM_ARG_DEVICE | CAM_ARG_UNIT;
10464 			optstart++;
10465 		}
10466 	}
10467 	/*
10468 	 * Start getopt processing at argv[2/3], since we've already
10469 	 * accepted argv[1..2] as the command name, and as a possible
10470 	 * device name.
10471 	 */
10472 	optind = optstart;
10473 
10474 	/*
10475 	 * Now we run through the argument list looking for generic
10476 	 * options, and ignoring options that possibly belong to
10477 	 * subfunctions.
10478 	 */
10479 	while ((c = getopt(argc, argv, combinedopt))!= -1){
10480 		switch(c) {
10481 			case 'C':
10482 				retry_count = strtol(optarg, NULL, 0);
10483 				if (retry_count < 0)
10484 					errx(1, "retry count %d is < 0",
10485 					     retry_count);
10486 				arglist |= CAM_ARG_RETRIES;
10487 				break;
10488 			case 'E':
10489 				arglist |= CAM_ARG_ERR_RECOVER;
10490 				break;
10491 			case 'n':
10492 				arglist |= CAM_ARG_DEVICE;
10493 				tstr = optarg;
10494 				while (isspace(*tstr) && (*tstr != '\0'))
10495 					tstr++;
10496 				device = (char *)strdup(tstr);
10497 				break;
10498 			case 'Q': {
10499 				char *endptr;
10500 				int table_entry = 0;
10501 
10502 				tstr = optarg;
10503 				while (isspace(*tstr) && (*tstr != '\0'))
10504 					tstr++;
10505 				if (isdigit(*tstr)) {
10506 					task_attr = strtol(tstr, &endptr, 0);
10507 					if (*endptr != '\0') {
10508 						errx(1, "Invalid queue option "
10509 						    "%s", tstr);
10510 					}
10511 				} else {
10512 					size_t table_size;
10513 					scsi_nv_status status;
10514 
10515 					table_size = sizeof(task_attrs) /
10516 						     sizeof(task_attrs[0]);
10517 					status = scsi_get_nv(task_attrs,
10518 					    table_size, tstr, &table_entry,
10519 					    SCSI_NV_FLAG_IG_CASE);
10520 					if (status == SCSI_NV_FOUND)
10521 						task_attr = task_attrs[
10522 						    table_entry].value;
10523 					else {
10524 						errx(1, "%s option %s",
10525 						  (status == SCSI_NV_AMBIGUOUS)?
10526 						    "ambiguous" : "invalid",
10527 						    tstr);
10528 					}
10529 				}
10530 				break;
10531 			}
10532 			case 't':
10533 				timeout = strtol(optarg, NULL, 0);
10534 				if (timeout < 0)
10535 					errx(1, "invalid timeout %d", timeout);
10536 				/* Convert the timeout from seconds to ms */
10537 				timeout *= 1000;
10538 				arglist |= CAM_ARG_TIMEOUT;
10539 				break;
10540 			case 'u':
10541 				arglist |= CAM_ARG_UNIT;
10542 				unit = strtol(optarg, NULL, 0);
10543 				break;
10544 			case 'v':
10545 				arglist |= CAM_ARG_VERBOSE;
10546 				break;
10547 			default:
10548 				break;
10549 		}
10550 	}
10551 
10552 	/*
10553 	 * For most commands we'll want to open the passthrough device
10554 	 * associated with the specified device.  In the case of the rescan
10555 	 * commands, we don't use a passthrough device at all, just the
10556 	 * transport layer device.
10557 	 */
10558 	if (devopen == 1) {
10559 		if (((arglist & (CAM_ARG_BUS|CAM_ARG_TARGET)) == 0)
10560 		 && (((arglist & CAM_ARG_DEVICE) == 0)
10561 		  || ((arglist & CAM_ARG_UNIT) == 0))) {
10562 			errx(1, "subcommand \"%s\" requires a valid device "
10563 			     "identifier", argv[1]);
10564 		}
10565 
10566 		if ((cam_dev = ((arglist & (CAM_ARG_BUS | CAM_ARG_TARGET))?
10567 				cam_open_btl(bus, target, lun, O_RDWR, NULL) :
10568 				cam_open_spec_device(device,unit,O_RDWR,NULL)))
10569 		     == NULL)
10570 			errx(1,"%s", cam_errbuf);
10571 	}
10572 
10573 	/*
10574 	 * Reset optind to 2, and reset getopt, so these routines can parse
10575 	 * the arguments again.
10576 	 */
10577 	optind = optstart;
10578 	optreset = 1;
10579 
10580 	switch(cmdlist) {
10581 	case CAM_CMD_DEVLIST:
10582 		error = getdevlist(cam_dev);
10583 		break;
10584 	case CAM_CMD_HPA:
10585 		error = atahpa(cam_dev, retry_count, timeout,
10586 			       argc, argv, combinedopt);
10587 		break;
10588 	case CAM_CMD_AMA:
10589 		error = ataama(cam_dev, retry_count, timeout,
10590 			       argc, argv, combinedopt);
10591 		break;
10592 	case CAM_CMD_DEVTREE:
10593 		error = getdevtree(argc, argv, combinedopt);
10594 		break;
10595 	case CAM_CMD_DEVTYPE:
10596 		error = getdevtype(cam_dev);
10597 		break;
10598 	case CAM_CMD_REQSENSE:
10599 		error = requestsense(cam_dev, argc, argv, combinedopt,
10600 		    task_attr, retry_count, timeout);
10601 		break;
10602 	case CAM_CMD_TUR:
10603 		error = testunitready(cam_dev, task_attr, retry_count,
10604 		    timeout, 0);
10605 		break;
10606 	case CAM_CMD_INQUIRY:
10607 		error = scsidoinquiry(cam_dev, argc, argv, combinedopt,
10608 				      task_attr, retry_count, timeout);
10609 		break;
10610 	case CAM_CMD_IDENTIFY:
10611 		error = identify(cam_dev, retry_count, timeout);
10612 		break;
10613 	case CAM_CMD_STARTSTOP:
10614 		error = scsistart(cam_dev, arglist & CAM_ARG_START_UNIT,
10615 				  arglist & CAM_ARG_EJECT, task_attr,
10616 				  retry_count, timeout);
10617 		break;
10618 	case CAM_CMD_RESCAN:
10619 		error = dorescan_or_reset(argc, argv, 1);
10620 		break;
10621 	case CAM_CMD_RESET:
10622 		error = dorescan_or_reset(argc, argv, 0);
10623 		break;
10624 	case CAM_CMD_READ_DEFECTS:
10625 		error = readdefects(cam_dev, argc, argv, combinedopt,
10626 				    task_attr, retry_count, timeout);
10627 		break;
10628 	case CAM_CMD_MODE_PAGE:
10629 		modepage(cam_dev, argc, argv, combinedopt,
10630 			 task_attr, retry_count, timeout);
10631 		break;
10632 	case CAM_CMD_SCSI_CMD:
10633 		error = scsicmd(cam_dev, argc, argv, combinedopt,
10634 				task_attr, retry_count, timeout);
10635 		break;
10636 	case CAM_CMD_MMCSD_CMD:
10637 		error = mmcsdcmd(cam_dev, argc, argv, combinedopt,
10638 					retry_count, timeout);
10639 		break;
10640 	case CAM_CMD_SMP_CMD:
10641 		error = smpcmd(cam_dev, argc, argv, combinedopt,
10642 			       retry_count, timeout);
10643 		break;
10644 	case CAM_CMD_SMP_RG:
10645 		error = smpreportgeneral(cam_dev, argc, argv,
10646 					 combinedopt, retry_count,
10647 					 timeout);
10648 		break;
10649 	case CAM_CMD_SMP_PC:
10650 		error = smpphycontrol(cam_dev, argc, argv, combinedopt,
10651 				      retry_count, timeout);
10652 		break;
10653 	case CAM_CMD_SMP_PHYLIST:
10654 		error = smpphylist(cam_dev, argc, argv, combinedopt,
10655 				   retry_count, timeout);
10656 		break;
10657 	case CAM_CMD_SMP_MANINFO:
10658 		error = smpmaninfo(cam_dev, argc, argv, combinedopt,
10659 				   retry_count, timeout);
10660 		break;
10661 	case CAM_CMD_DEBUG:
10662 		error = camdebug(argc, argv, combinedopt);
10663 		break;
10664 	case CAM_CMD_TAG:
10665 		error = tagcontrol(cam_dev, argc, argv, combinedopt);
10666 		break;
10667 	case CAM_CMD_RATE:
10668 		error = ratecontrol(cam_dev, task_attr, retry_count,
10669 				    timeout, argc, argv, combinedopt);
10670 		break;
10671 	case CAM_CMD_FORMAT:
10672 		error = scsiformat(cam_dev, argc, argv,
10673 				   combinedopt, task_attr, retry_count,
10674 				   timeout);
10675 		break;
10676 	case CAM_CMD_REPORTLUNS:
10677 		error = scsireportluns(cam_dev, argc, argv,
10678 				       combinedopt, task_attr,
10679 				       retry_count, timeout);
10680 		break;
10681 	case CAM_CMD_READCAP:
10682 		error = scsireadcapacity(cam_dev, argc, argv,
10683 					 combinedopt, task_attr,
10684 					 retry_count, timeout);
10685 		break;
10686 	case CAM_CMD_IDLE:
10687 	case CAM_CMD_STANDBY:
10688 	case CAM_CMD_SLEEP:
10689 	case CAM_CMD_POWER_MODE:
10690 		error = atapm(cam_dev, argc, argv,
10691 			      combinedopt, retry_count, timeout);
10692 		break;
10693 	case CAM_CMD_APM:
10694 	case CAM_CMD_AAM:
10695 		error = ataaxm(cam_dev, argc, argv,
10696 			      combinedopt, retry_count, timeout);
10697 		break;
10698 	case CAM_CMD_SECURITY:
10699 		error = atasecurity(cam_dev, retry_count, timeout,
10700 				    argc, argv, combinedopt);
10701 		break;
10702 	case CAM_CMD_DOWNLOAD_FW:
10703 		error = fwdownload(cam_dev, argc, argv, combinedopt,
10704 		    arglist & CAM_ARG_VERBOSE, task_attr, retry_count,
10705 		    timeout);
10706 		break;
10707 	case CAM_CMD_SANITIZE:
10708 		error = sanitize(cam_dev, argc, argv, combinedopt, task_attr,
10709 				 retry_count, timeout);
10710 		break;
10711 	case CAM_CMD_PERSIST:
10712 		error = scsipersist(cam_dev, argc, argv, combinedopt,
10713 		    task_attr, retry_count, timeout,
10714 		    arglist & CAM_ARG_VERBOSE,
10715 		    arglist & CAM_ARG_ERR_RECOVER);
10716 		break;
10717 	case CAM_CMD_ATTRIB:
10718 		error = scsiattrib(cam_dev, argc, argv, combinedopt,
10719 		    task_attr, retry_count, timeout,
10720 		    arglist & CAM_ARG_VERBOSE,
10721 		    arglist & CAM_ARG_ERR_RECOVER);
10722 		break;
10723 	case CAM_CMD_OPCODES:
10724 		error = scsiopcodes(cam_dev, argc, argv, combinedopt,
10725 		    task_attr, retry_count, timeout,
10726 		    arglist & CAM_ARG_VERBOSE);
10727 		break;
10728 	case CAM_CMD_REPROBE:
10729 		error = reprobe(cam_dev);
10730 		break;
10731 	case CAM_CMD_ZONE:
10732 		error = zone(cam_dev, argc, argv, combinedopt,
10733 		    task_attr, retry_count, timeout,
10734 		    arglist & CAM_ARG_VERBOSE);
10735 		break;
10736 	case CAM_CMD_EPC:
10737 		error = epc(cam_dev, argc, argv, combinedopt,
10738 		    retry_count, timeout, arglist & CAM_ARG_VERBOSE);
10739 		break;
10740 	case CAM_CMD_TIMESTAMP:
10741 		error = timestamp(cam_dev, argc, argv, combinedopt,
10742 		    task_attr, retry_count, timeout,
10743 		    arglist & CAM_ARG_VERBOSE);
10744 		break;
10745 	case CAM_CMD_DEPOP:
10746 		error = depop(cam_dev, argc, argv, combinedopt,
10747 		    task_attr, retry_count, timeout,
10748 		    arglist & CAM_ARG_VERBOSE);
10749 		break;
10750 	case CAM_CMD_USAGE:
10751 		usage(1);
10752 		break;
10753 	default:
10754 		usage(0);
10755 		error = 1;
10756 		break;
10757 	}
10758 
10759 	if (cam_dev != NULL)
10760 		cam_close_device(cam_dev);
10761 
10762 	exit(error);
10763 }
10764