/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
 */

/*
 * The reference for the functions in this file is the
 *
 *	Mellanox HCA Flash Programming Application Note
 * (Mellanox document number 2205AN) rev 1.45, 2007.
 * Chapter 4 in particular.
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/sysmacros.h>
#include <sys/queue.h>
#include <fcntl.h>
#include <ctype.h>
#include <string.h>
#include <strings.h>

#include <sys/byteorder.h>

#include <libintl.h> /* for gettext(3c) */

#include <fwflash/fwflash.h>
#include "../../hdrs/hermon_ib.h"

char *devprefix = "/devices";
char drivername[] = "hermon\0";
char *devsuffix = ":devctl";

extern di_node_t rootnode;
extern int errno;
extern struct fw_plugin *self;
extern struct vrfyplugin *verifier;
extern int fwflash_debug;

/* required functions for this plugin */
int fw_readfw(struct devicelist *device, char *filename);
int fw_writefw(struct devicelist *device);
int fw_identify(int start);
int fw_devinfo();


/* helper functions */
static int cnx_identify(struct devicelist *thisdev);
static int cnx_get_guids(ib_cnx_encap_ident_t *handle);
static int cnx_close(struct devicelist *flashdev);
static int cnx_check_for_magic_pattern(ib_cnx_encap_ident_t *hdl, uint32_t adr);
static uint32_t cnx_get_log2_chunk_size_f_hdl(ib_cnx_encap_ident_t *handle,
    int type);
static uint32_t cnx_get_log2_chunk_size(uint32_t chunk_size_word);
static uint32_t cnx_cont2phys(uint32_t log2_chunk_sz, uint32_t cont_addr,
    int type);
static uint32_t cnx_get_image_size_f_hdl(ib_cnx_encap_ident_t *hdl, int type);
static void cnx_local_set_guid_crc_img(uint32_t offset, uint32_t guid_crc_size,
    uint32_t guid_crc_offset);
static int cnx_read_image(ib_cnx_encap_ident_t *handle);
static int cnx_write_file(ib_cnx_encap_ident_t *handle, const char *filename);
static int cnx_verify_image(ib_cnx_encap_ident_t *handle, int type);
static int cnx_read_guids(ib_cnx_encap_ident_t *handle, int type);
static int cnx_set_guids(ib_cnx_encap_ident_t *handle, void *arg);
static int cnx_write_image(ib_cnx_encap_ident_t *handle, int type);
static int cnx_read_ioctl(ib_cnx_encap_ident_t *hdl,
    hermon_flash_ioctl_t *info);
static int cnx_write_ioctl(ib_cnx_encap_ident_t *hdl,
    hermon_flash_ioctl_t *info);
static int cnx_erase_sector_ioctl(ib_cnx_encap_ident_t *hdl,
    hermon_flash_ioctl_t *info);
static int cnx_find_magic_n_chnk_sz(ib_cnx_encap_ident_t *handle, int type);
static int cnx_get_image_info(ib_cnx_encap_ident_t *handle);


int
fw_readfw(struct devicelist *flashdev, char *filename)
{
	ib_cnx_encap_ident_t	*manuf;
	int 			rv = FWFLASH_SUCCESS;

	logmsg(MSG_INFO, "hermon: fw_readfw: filename %s\n", filename);

	manuf = (ib_cnx_encap_ident_t *)flashdev->ident->encap_ident;
	if (CNX_I_CHECK_HANDLE(manuf)) {
		logmsg(MSG_ERROR, gettext("hermon: Invalid Handle for "
		    "device %s! \n"), flashdev->access_devname);
		return (FWFLASH_FAILURE);
	}

	logmsg(MSG_INFO, "hermon: fw_identify should have read the image. "
	    "state 0x%x\n", manuf->state);

	rv = cnx_read_image(manuf);
	if (rv != FWFLASH_SUCCESS) {
		logmsg(MSG_ERROR, gettext("hermon: Failed to read any valid "
		    "image on device (%s)\n"), flashdev->access_devname);
		logmsg(MSG_ERROR, gettext("Aborting read.\n"));
	} else {
		rv = cnx_write_file(manuf, filename);
	}

	cnx_close(flashdev);
	return (rv);
}


/*
 * If we're invoking fw_writefw, then flashdev is a valid,
 * flashable device as determined by fw_identify().
 *
 * If verifier is null, then we haven't been called following a firmware
 * image verification load operation.
 */
int
fw_writefw(struct devicelist *flashdev)
{
	ib_cnx_encap_ident_t	*manuf;
	int			i, j, k;

	logmsg(MSG_INFO, "hermon: fw_writefw\n");

	manuf = (ib_cnx_encap_ident_t *)flashdev->ident->encap_ident;

	if (CNX_I_CHECK_HANDLE(manuf)) {
		logmsg(MSG_ERROR, gettext("hermon: Invalid Handle for "
		    "device %s! \n"), flashdev->access_devname);
		return (FWFLASH_FAILURE);
	}

	/*
	 * Try the primary first, then the secondary.
	 * If we get here, then the verifier has _already_ checked that
	 * the part number in the firmware image matches that in the HCA,
	 * so we only need this check if there's no hardware info available
	 * already after running through fw_identify().
	 */
	if (manuf->pn_len == 0) {
		int resp;

		(void) fprintf(stderr, gettext("Unable to completely verify "
		    "that this firmware image (%s) is compatible with your "
		    "HCA %s"), verifier->imgfile, flashdev->access_devname);
		(void) fprintf(stderr, gettext("Do you really want to "
		    "continue? (Y/N): "));
		(void) fflush(stdin);
		resp = getchar();
		if (resp != 'Y' && resp != 'y') {
			(void) fprintf(stderr, gettext("Not proceeding with "
			    "flash operation of %s on %s"),
			    verifier->imgfile, flashdev->access_devname);
			return (FWFLASH_FAILURE);
		}
	}

	logmsg(MSG_INFO, "hermon: fw_writefw: Using Existing GUIDs.\n");
	manuf->state |=
	    FWFLASH_IB_STATE_GUIDN |
	    FWFLASH_IB_STATE_GUID1 |
	    FWFLASH_IB_STATE_GUID2 |
	    FWFLASH_IB_STATE_GUIDS;
	if (cnx_set_guids(manuf, manuf->ibguids) != FWFLASH_SUCCESS) {
		logmsg(MSG_WARN, gettext("hermon: Failed to set GUIDs"));
	}

	/*
	 * Update both Primary and Secondary images
	 *
	 * For Failsafe firmware image update, if the current image (i.e.
	 * containing a magic pattern) on the Flash is stored on the Primary
	 * location, burn the new image to the Secondary location first,
	 * or vice versa.
	 */

	/* Note Current Image location. */
	j = manuf->state &
	    (FWFLASH_IB_STATE_IMAGE_PRI | FWFLASH_IB_STATE_IMAGE_SEC);

	/*
	 * If we find that current image location is not found, no worries
	 * we shall default to PRIMARY, and proceed with burning anyway.
	 */
	if (j == 0)
		j = FWFLASH_IB_STATE_IMAGE_PRI;

	for (i = FWFLASH_FLASH_IMAGES; i > 0; i--) {
		char *type;

		if (i == 2) {
			if (j == 2)
				k = 1;	/* Burn PRI First */
			else
				k = 2;	/* Burn SEC First */
		} else {
			if (k == 2)
				k = 1;	/* Burn PRI next */
			else
				k = 2;	/* Burn SEC next */
		}
		type = ((k == 1) ? "Primary" : "Secondary");

		logmsg(MSG_INFO, "hermon: fw_write: UPDATING %s image\n", type);

		if (cnx_write_image(manuf, k) != FWFLASH_SUCCESS) {
			(void) fprintf(stderr,
			    gettext("Failed to update %s image on device %s"),
			    type, flashdev->access_devname);
			goto out;
		}

		logmsg(MSG_INFO, "hermon: fw_write: Verify %s image..\n", type);
		if (cnx_verify_image(manuf, k) != FWFLASH_SUCCESS) {
			(void) fprintf(stderr,
			    gettext("Failed to verify %s image for device %s"),
			    type, flashdev->access_devname);
			goto out;
		}
	}
out:
	/* final update marker to the user */
	(void) printf(" +\n");
	return (cnx_close(flashdev));
}


/*
 * The fw_identify() function walks the device tree trying to find
 * devices which this plugin can work with.
 *
 * The parameter "start" gives us the starting index number
 * to give the device when we add it to the fw_devices list.
 *
 * firstdev is allocated by us and we add space as necessary
 */
int
fw_identify(int start)
{
	int		rv = FWFLASH_FAILURE;
	di_node_t	thisnode;
	struct devicelist *newdev;
	char		*devpath;
	int		idx = start;
	int		devlength = 0;

	logmsg(MSG_INFO, "hermon: fw_identify\n");
	thisnode = di_drv_first_node(drivername, rootnode);

	if (thisnode == DI_NODE_NIL) {
		logmsg(MSG_INFO, gettext("No %s nodes in this system\n"),
		    drivername);
		return (rv);
	}

	/* we've found one, at least */
	for (; thisnode != DI_NODE_NIL; thisnode = di_drv_next_node(thisnode)) {

		devpath = di_devfs_path(thisnode);

		if ((newdev = calloc(1, sizeof (struct devicelist))) == NULL) {
			logmsg(MSG_ERROR, gettext("hermon: Unable to allocate "
			    "space for device entry\n"));
			di_devfs_path_free(devpath);
			return (FWFLASH_FAILURE);
		}

		/* calloc enough for /devices + devpath + ":devctl" + '\0' */
		devlength = strlen(devpath) + strlen(devprefix) +
		    strlen(devsuffix) + 2;

		if ((newdev->access_devname = calloc(1, devlength)) == NULL) {
			logmsg(MSG_ERROR, gettext("hermon: Unable to allocate "
			    "space for a devfs name\n"));
			(void) free(newdev);
			di_devfs_path_free(devpath);
			return (FWFLASH_FAILURE);
		}
		snprintf(newdev->access_devname, devlength,
		    "%s%s%s", devprefix, devpath, devsuffix);

		if ((newdev->ident = calloc(1, sizeof (struct vpr))) == NULL) {
			logmsg(MSG_ERROR, gettext("hermon: Unable to allocate "
			    "space for a device identification record\n"));
			(void) free(newdev->access_devname);
			(void) free(newdev);
			di_devfs_path_free(devpath);
			return (FWFLASH_FAILURE);
		}

		/* CHECK VARIOUS IB THINGS HERE */
		rv = cnx_identify(newdev);
		if (rv == FWFLASH_FAILURE) {
			(void) free(newdev->ident);
			(void) free(newdev->access_devname);
			(void) free(newdev);
			di_devfs_path_free(devpath);
			continue;
		}

		if ((newdev->drvname = calloc(1, strlen(drivername) + 1))
		    == NULL) {
			logmsg(MSG_ERROR, gettext("hermon: Unable to allocate"
			    " space for a driver name\n"));
			(void) free(newdev->ident);
			(void) free(newdev->access_devname);
			(void) free(newdev);
			di_devfs_path_free(devpath);
			return (FWFLASH_FAILURE);
		}

		(void) strlcpy(newdev->drvname, drivername,
		    strlen(drivername) + 1);

		/* this next bit is backwards compatibility - "IB\0" */
		if ((newdev->classname = calloc(1, 3)) == NULL) {
			logmsg(MSG_ERROR, gettext("hermon: Unable to allocate "
			    "space for a class name\n"));
			(void) free(newdev->drvname);
			(void) free(newdev->ident);
			(void) free(newdev->access_devname);
			(void) free(newdev);
			di_devfs_path_free(devpath);
			return (FWFLASH_FAILURE);
		}
		(void) strlcpy(newdev->classname, "IB", 3);

		newdev->index = idx;
		++idx;
		newdev->plugin = self;

		di_devfs_path_free(devpath);

		TAILQ_INSERT_TAIL(fw_devices, newdev, nextdev);
	}

	if (fwflash_debug != 0) {
		struct devicelist *tempdev;

		TAILQ_FOREACH(tempdev, fw_devices, nextdev) {
			logmsg(MSG_INFO, "fw_identify: hermon:\n");
			logmsg(MSG_INFO, "\ttempdev @ 0x%lx\n"
			    "\t\taccess_devname: %s\n"
			    "\t\tdrvname: %s\tclassname: %s\n"
			    "\t\tident->vid:   %s\n"
			    "\t\tident->pid:   %s\n"
			    "\t\tident->revid: %s\n"
			    "\t\tindex: %d\n"
			    "\t\tguid0: %s\n"
			    "\t\tguid1: %s\n"
			    "\t\tguid2: %s\n"
			    "\t\tguid3: %s\n"
			    "\t\tplugin @ 0x%lx\n\n",
			    &tempdev,
			    tempdev->access_devname,
			    tempdev->drvname, newdev->classname,
			    tempdev->ident->vid,
			    tempdev->ident->pid,
			    tempdev->ident->revid,
			    tempdev->index,
			    (tempdev->addresses[0] ? tempdev->addresses[0] :
			    "(not supported)"),
			    (tempdev->addresses[1] ? tempdev->addresses[1] :
			    "(not supported)"),
			    (tempdev->addresses[2] ? tempdev->addresses[2] :
			    "(not supported)"),
			    (tempdev->addresses[3] ? tempdev->addresses[3] :
			    "(not supported)"),
			    tempdev->plugin);
		}
	}

	return (FWFLASH_SUCCESS);
}


int
fw_devinfo(struct devicelist *thisdev)
{
	ib_cnx_encap_ident_t	*encap;

	logmsg(MSG_INFO, "hermon: fw_devinfo\n");

	encap = (ib_cnx_encap_ident_t *)thisdev->ident->encap_ident;
	if (CNX_I_CHECK_HANDLE(encap)) {
		logmsg(MSG_ERROR, gettext("hermon: fw_devinfo: Invalid handle "
		    "for device %s! \n"), thisdev->access_devname);
		return (FWFLASH_FAILURE);
	}

	/* Try the primary first, then the secondary */
	fprintf(stdout, gettext("Device[%d] %s\n"),
	    thisdev->index, thisdev->access_devname);
	fprintf(stdout, gettext("Class [%s]\n"), thisdev->classname);

	fprintf(stdout, "\t");

	/* Mellanox HCA Flash app note, p40, #4.2.3 table 9 */
	fprintf(stdout, gettext("GUID: System Image - %s\n"),
	    thisdev->addresses[3]);
	fprintf(stdout, gettext("\t\tNode Image - %s\n"),
	    thisdev->addresses[0]);
	fprintf(stdout, gettext("\t\tPort 1\t   - %s\n"),
	    thisdev->addresses[1]);
	fprintf(stdout, gettext("\t\tPort 2\t   - %s\n"),
	    thisdev->addresses[2]);

	fprintf(stdout, gettext("\tFirmware revision  : %s\n"),
	    thisdev->ident->revid);

	if (encap->pn_len != 0) {
		if (strlen(encap->info.mlx_id))
			fprintf(stdout, gettext("\tProduct\t\t   : "
			    "%s %X (%s)\n"), encap->info.mlx_pn,
			    encap->hwrev, encap->info.mlx_id);
		else
			fprintf(stdout, gettext("\tProduct\t\t   : %s %X\n"),
			    encap->info.mlx_pn, encap->hwrev);

		if (strlen(encap->info.mlx_psid))
			fprintf(stdout, gettext("\tPSID\t\t   : %s\n"),
			    encap->info.mlx_psid);
		else if (strlen(thisdev->ident->pid))
			fprintf(stdout, gettext("\t%s\n"), thisdev->ident->pid);
	} else {
		fprintf(stdout, gettext("\t%s\n"), thisdev->ident->pid);
	}
	fprintf(stdout, "\n\n");

	return (cnx_close(thisdev));
}


/*
 * Helper functions lurk beneath this point
 */


/*
 * Notes:
 * 1. flash read is done in 32 bit quantities, and the driver returns
 *    data in host byteorder form.
 * 2. flash write is done in 8 bit quantities by the driver.
 * 3. data in the flash should be in network byteorder.
 * 4. data in image files is in network byteorder form.
 * 5. data in image structures in memory is kept in network byteorder.
 * 6. the functions in this file deal with data in host byteorder form.
 */

static int
cnx_read_image(ib_cnx_encap_ident_t *handle)
{
	hermon_flash_ioctl_t	ioctl_info;
	uint32_t		phys_addr;
	int			ret, i;
	int			image_size;
	int			type;

	type = handle->state &
	    (FWFLASH_IB_STATE_IMAGE_PRI | FWFLASH_IB_STATE_IMAGE_SEC);
	logmsg(MSG_INFO, "cnx_read_image: type %lx\n", type);

	if (type == 0) {
		logmsg(MSG_ERROR, gettext("cnx_read_image: Must read in "
		    "image first\n"));
		return (FWFLASH_FAILURE);
	}

	image_size = handle->fw_sz;
	if (image_size <= 0) {
		logmsg(MSG_ERROR, gettext("cnx_read_image: Invalid image size "
		    "0x%x for %s image\n"),
		    image_size, (type == 0x1 ? "Primary" : "Secondary"));
		return (FWFLASH_FAILURE);
	}

	logmsg(MSG_INFO, "hermon: fw_size: 0x%x\n", image_size);

	handle->fw = (uint32_t *)calloc(1, image_size);
	if (handle->fw == NULL) {
		logmsg(MSG_ERROR, gettext("cnx_read_image: Unable to allocate "
		    "memory for fw_img : (%s)\n"), strerror(errno));
		return (FWFLASH_FAILURE);
	}

	ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;
	for (i = 0; i < image_size; i += 4) {
		phys_addr = cnx_cont2phys(handle->log2_chunk_sz, i, type);
		ioctl_info.af_addr = phys_addr;

		ret = cnx_read_ioctl(handle, &ioctl_info);
		if (ret != 0) {
			logmsg(MSG_ERROR, gettext("cnx_read_image: Failed to "
			    "read sector %d\n"), i);
			free(handle->fw);
			return (FWFLASH_FAILURE);
		}
		handle->fw[i / 4] = htonl(ioctl_info.af_quadlet);
	}

	for (i = 0; i < image_size; i += 4) {
		logmsg(MSG_INFO, "cnx_read_image: addr[0x%x] = 0x%08x\n", i,
		    ntohl(handle->fw[i / 4]));
	}

	return (FWFLASH_SUCCESS);
}

static int
cnx_write_file(ib_cnx_encap_ident_t *handle, const char *filename)
{
	FILE		*fp;
	int 		fd;
	mode_t		mode = S_IRUSR | S_IWUSR;
	int		len;

	logmsg(MSG_INFO, "cnx_write_file\n");

	errno = 0;
	if ((fd = open(filename, O_RDWR|O_CREAT|O_DSYNC, mode)) < 0) {
		logmsg(MSG_ERROR, gettext("hermon: Unable to open specified "
		    "file (%s) for writing: %s\n"), filename, strerror(errno));
		return (FWFLASH_FAILURE);
	}

	errno = 0;
	fp = fdopen(fd, "w");
	if (fp == NULL) {
		(void) fprintf(stderr, gettext("hermon: Unknown filename %s : "
		    "%s\n"), filename, strerror(errno));
		return (FWFLASH_FAILURE);
	}

	len = ntohl(handle->fw[CNX_IMG_SIZE_OFFSET / 4]);
	logmsg(MSG_INFO, "cnx_write_file: Writing to file. Length 0x%x\n", len);

	if (fwrite(&handle->fw[0], len, 1, fp) == 0) {
		(void) fprintf(stderr, gettext("hermon: fwrite failed"));
		perror("fwrite");
		(void) fclose(fp);
		return (FWFLASH_FAILURE);
	}
	(void) fclose(fp);
	return (FWFLASH_SUCCESS);
}

static int
cnx_verify_image(ib_cnx_encap_ident_t *handle, int type)
{
	uint32_t	new_start_addr;

	logmsg(MSG_INFO, "hermon: cnx_verify_image\n");

	new_start_addr = cnx_cont2phys(handle->log2_chunk_sz, 0, type);

	return (cnx_check_for_magic_pattern(handle, new_start_addr));
}

static int
cnx_set_guids(ib_cnx_encap_ident_t *handle, void *arg)
{
	uint32_t	addr;
	uint32_t	*guids;

	logmsg(MSG_INFO, "hermon: cnx_set_guids\n");

	guids = (uint32_t *)arg;
	addr = ntohl(verifier->fwimage[CNX_NGUIDPTR_OFFSET / 4]) / 4;
	logmsg(MSG_INFO, "cnx_set_guids: guid_start_addr: 0x%x\n", addr * 4);

	/*
	 * guids are supplied by callers as 64 bit values in host byteorder.
	 * Storage is in network byteorder.
	 */
#ifdef _BIG_ENDIAN
	if (handle->state & FWFLASH_IB_STATE_GUIDN) {
		verifier->fwimage[addr] = guids[0];
		verifier->fwimage[addr + 1] = guids[1];
	}

	if (handle->state & FWFLASH_IB_STATE_GUID1) {
		verifier->fwimage[addr + 2] = guids[2];
		verifier->fwimage[addr + 3] = guids[3];
	}

	if (handle->state & FWFLASH_IB_STATE_GUID2) {
		verifier->fwimage[addr + 4] = guids[4];
		verifier->fwimage[addr + 5] = guids[5];
	}

	if (handle->state & FWFLASH_IB_STATE_GUIDS) {
		verifier->fwimage[addr + 6] = guids[6];
		verifier->fwimage[addr + 7] = guids[7];
	}
#else
	if (handle->state & FWFLASH_IB_STATE_GUIDN) {
		verifier->fwimage[addr] = htonl(guids[1]);
		verifier->fwimage[addr + 1] = htonl(guids[0]);
	}

	if (handle->state & FWFLASH_IB_STATE_GUID1) {
		verifier->fwimage[addr + 2] = htonl(guids[3]);
		verifier->fwimage[addr + 3] = htonl(guids[2]);
	}

	if (handle->state & FWFLASH_IB_STATE_GUID2) {
		verifier->fwimage[addr + 4] = htonl(guids[5]);
		verifier->fwimage[addr + 5] = htonl(guids[4]);
	}

	if (handle->state & FWFLASH_IB_STATE_GUIDS) {
		verifier->fwimage[addr + 6] = htonl(guids[7]);
		verifier->fwimage[addr + 7] = htonl(guids[6]);
	}
#endif

	cnx_local_set_guid_crc_img((addr * 4) - 0x10, CNX_GUID_CRC16_SIZE,
	    CNX_GUID_CRC16_OFFSET);

	return (FWFLASH_SUCCESS);
}

/*
 * Notes: Burn the image
 *
 * 1. Erase the entire sector where the new image is to be burned.
 * 2. Burn the image WITHOUT the magic pattern. This marks the new image
 *    as invalid during the burn process. If the current image (i.e
 *    containing a magic pattern) on the Flash is stored on the even
 *    chunks (PRIMARY), burn the new image to the odd chunks (SECONDARY),
 *    or vice versa.
 * 3. Burn the magic pattern at the beginning of the new image on the Flash.
 *    This will validate the new image.
 * 4. Set the BootAddress register to its new location.
 */
static int
cnx_write_image(ib_cnx_encap_ident_t *handle, int type)
{
	hermon_flash_ioctl_t	ioctl_info;
	int			sector_size;
	int			size;
	int			i;
	uint32_t		new_start_addr;
	uint32_t		log2_chunk_sz;
	uint8_t			*fw;

	logmsg(MSG_INFO, "hermon: cnx_write_image\n");

	if (type == 0) {
		logmsg(MSG_ERROR, gettext("cnx_write_image: Must inform us "
		    " where to write.\n"));
		return (FWFLASH_FAILURE);
	}

	log2_chunk_sz = cnx_get_log2_chunk_size(
	    ntohl(verifier->fwimage[CNX_CHUNK_SIZE_OFFSET / 4]));

	sector_size = handle->sector_sz;
	new_start_addr = ((type - 1) << handle->log2_chunk_sz);

	/* Read Image Size */
	size = ntohl(verifier->fwimage[CNX_IMG_SIZE_OFFSET / 4]);
	logmsg(MSG_INFO, "cnx_write_image: fw image size: 0x%x\n", size);

	/* Sectors must be erased before they can be written to. */
	ioctl_info.af_type = HERMON_FLASH_ERASE_SECTOR;
	for (i = 0; i < size; i += sector_size) {
		ioctl_info.af_sector_num =
		    cnx_cont2phys(log2_chunk_sz, i, type) / sector_size;
		if (cnx_erase_sector_ioctl(handle, &ioctl_info) != 0) {
			logmsg(MSG_ERROR, gettext("cnx_write_image: Failed to "
			    "erase sector 0x%x\n"), ioctl_info.af_sector_num);
			return (FWFLASH_FAILURE);
		}
	}

	fw = (uint8_t *)verifier->fwimage;
	ioctl_info.af_type = HERMON_FLASH_WRITE_BYTE;

	/* Write the new image without the magic pattern */
	for (i = 16; i < size; i++) {
		ioctl_info.af_byte = fw[i];
		ioctl_info.af_addr = cnx_cont2phys(log2_chunk_sz, i, type);
		if (cnx_write_ioctl(handle, &ioctl_info) != 0) {
			logmsg(MSG_ERROR, gettext("cnx_write_image: Failed to "
			    "write byte 0x%x\n"), ioctl_info.af_byte);
			return (FWFLASH_FAILURE);
		}

		if (i && !(i % handle->sector_sz)) {
			(void) printf(" .");
			(void) fflush((void *)NULL);
		}
	}

	/* Validate the new image -- Write the magic pattern. */
	for (i = 0; i < 16; i++) {
		ioctl_info.af_byte = fw[i];
		ioctl_info.af_addr = cnx_cont2phys(log2_chunk_sz, i, type);
		if (cnx_write_ioctl(handle, &ioctl_info) != 0) {
			logmsg(MSG_ERROR, gettext("cnx_write_image: Failed to "
			    "write magic pattern byte 0x%x\n"),
			    ioctl_info.af_byte);
			return (FWFLASH_FAILURE);
		}
	}

	/* Write new image start address to CR space */
	errno = 0;
	ioctl_info.af_addr = new_start_addr;
	if (ioctl(handle->fd, HERMON_IOCTL_WRITE_BOOT_ADDR, &ioctl_info) != 0) {
		logmsg(MSG_WARN, gettext("cnx_write_image: Failed to "
		    "update boot address register: %s\n"), strerror(errno));
	}

	return (FWFLASH_SUCCESS);
}


/*
 * cnx_identify performs the following actions:
 *
 *	allocates and assigns thisdev->vpr
 *
 *	allocates space for the 4 GUIDs which each IB device must have
 *	queries the hermon driver for this device's GUIDs
 *
 *	determines the hardware vendor, so that thisdev->vpr->vid
 *	can be set correctly
 */
static int
cnx_identify(struct devicelist *thisdev)
{
	int				fd, ret, i;
	hermon_flash_init_ioctl_t	init_ioctl;
	ib_cnx_encap_ident_t		*manuf;
	cfi_t				cfi;
	int				hw_psid_found = 0;

	logmsg(MSG_INFO, "hermon: cnx_identify\n");
	/* open the device */
	/* hook thisdev->ident->encap_ident to ib_cnx_encap_ident_t */
	/* check that all the bits are sane */
	/* return success, if warranted */

	errno = 0;
	if ((fd = open(thisdev->access_devname, O_RDONLY)) < 0) {
		logmsg(MSG_ERROR, gettext("hermon: Unable to open a %s-"
		    "attached device node: %s: %s\n"), drivername,
		    thisdev->access_devname, strerror(errno));
		return (FWFLASH_FAILURE);
	}

	if ((manuf = calloc(1, sizeof (ib_cnx_encap_ident_t))) == NULL) {
		logmsg(MSG_ERROR, gettext("hermon: Unable to allocate space "
		    "for a %s-attached handle structure\n"), drivername);
		close(fd);
		return (FWFLASH_FAILURE);
	}
	manuf->magic = FWFLASH_IB_MAGIC_NUMBER;
	manuf->state = FWFLASH_IB_STATE_NONE;
	manuf->fd = fd;
	manuf->log2_chunk_sz = 0;

	thisdev->ident->encap_ident = manuf;

	/*
	 * Inform driver that this command supports the Intel Extended
	 * CFI command set.
	 */
	cfi.cfi_char[0x10] = 'M';
	cfi.cfi_char[0x11] = 'X';
	cfi.cfi_char[0x12] = '2';
	init_ioctl.af_cfi_info[0x4] = ntohl(cfi.cfi_int[0x4]);

	errno = 0;
	ret = ioctl(fd, HERMON_IOCTL_FLASH_INIT, &init_ioctl);
	if (ret < 0) {
		logmsg(MSG_ERROR, gettext("hermon: HERMON_IOCTL_FLASH_INIT "
		    "failed: %s\n"), strerror(errno));
		close(fd);
		free(manuf);
		return (FWFLASH_FAILURE);
	}

	manuf->hwrev = init_ioctl.af_hwrev;
	logmsg(MSG_INFO, "hermon: init_ioctl: hwrev: %x, fwver: %d.%d.%04d, "
	    "PN# Len %d\n", init_ioctl.af_hwrev, init_ioctl.af_fwrev.afi_maj,
	    init_ioctl.af_fwrev.afi_min, init_ioctl.af_fwrev.afi_sub,
	    init_ioctl.af_pn_len);

	/*
	 * Determine whether the attached driver supports the Intel or
	 * AMD Extended CFI command sets. If it doesn't support either,
	 * then we're hosed, so error out.
	 */
	for (i = 0; i < HERMON_FLASH_CFI_SIZE_QUADLET; i++) {
		cfi.cfi_int[i] = ntohl(init_ioctl.af_cfi_info[i]);
	}
	manuf->cmd_set = cfi.cfi_char[0x13];

	if (cfi.cfi_char[0x10] == 'Q' &&
	    cfi.cfi_char[0x11] == 'R' &&
	    cfi.cfi_char[0x12] == 'Y') {
		/* make sure the cmd set is SPI */
		if (manuf->cmd_set != HERMON_FLASH_SPI_CMDSET) {
			logmsg(MSG_ERROR, gettext("hermon: Unsupported flash "
			    "device command set\n"));
			goto identify_end;
		}
		/* set some defaults */
		manuf->sector_sz = HERMON_FLASH_SECTOR_SZ_DEFAULT;
		manuf->device_sz = HERMON_FLASH_DEVICE_SZ_DEFAULT;
	} else if (manuf->cmd_set == HERMON_FLASH_SPI_CMDSET) {
		manuf->sector_sz = HERMON_FLASH_SPI_SECTOR_SIZE;
		manuf->device_sz = HERMON_FLASH_SPI_DEVICE_SIZE;
	} else {
		if (manuf->cmd_set != HERMON_FLASH_AMD_CMDSET &&
		    manuf->cmd_set != HERMON_FLASH_INTEL_CMDSET) {
			logmsg(MSG_ERROR, gettext("hermon: Unknown flash "
			    "device command set %lx\n"), manuf->cmd_set);
			goto identify_end;
		}
		/* read from the CFI data */
		manuf->sector_sz = ((cfi.cfi_char[0x30] << 8) |
		    cfi.cfi_char[0x2F]) << 8;
		manuf->device_sz = 0x1 << cfi.cfi_char[0x27];
	}

	logmsg(MSG_INFO, "hermon: sector_sz: 0x%08x device_sz: 0x%08x\n",
	    manuf->sector_sz, manuf->device_sz);

	/* set firmware revision */
	manuf->hwfw_img_info.fw_rev.major = init_ioctl.af_fwrev.afi_maj;
	manuf->hwfw_img_info.fw_rev.minor = init_ioctl.af_fwrev.afi_min;
	manuf->hwfw_img_info.fw_rev.subminor = init_ioctl.af_fwrev.afi_sub;

	if (((thisdev->ident->vid = calloc(1, MLX_VPR_VIDLEN + 1)) == NULL) ||
	    ((thisdev->ident->revid = calloc(1, MLX_VPR_REVLEN + 1)) == NULL)) {
		logmsg(MSG_ERROR, gettext("hermon: Unable to allocate space "
		    "for a VPR record.\n"));
		goto identify_end;
	}
	(void) strlcpy(thisdev->ident->vid, "MELLANOX", MLX_VPR_VIDLEN);

	/*
	 * We actually want the hwrev field from the ioctl above.
	 * Until we find out otherwise, add it onto the end of the
	 * firmware version details.
	 */
	snprintf(thisdev->ident->revid, MLX_VPR_REVLEN, "%d.%d.%03d",
	    manuf->hwfw_img_info.fw_rev.major,
	    manuf->hwfw_img_info.fw_rev.minor,
	    manuf->hwfw_img_info.fw_rev.subminor);

	if ((ret = cnx_get_guids(manuf)) != FWFLASH_SUCCESS) {
		logmsg(MSG_WARN, gettext("hermon: No GUIDs found for "
		    "device %s!\n"), thisdev->access_devname);
	}

	/* set hw part number, psid, and name in handle */
	/* now walk the magic decoder ring table */
	manuf->info.mlx_pn = NULL;
	manuf->info.mlx_psid = NULL;
	manuf->info.mlx_id = NULL;

	if (cnx_get_image_info(manuf) != FWFLASH_SUCCESS) {
		logmsg(MSG_WARN, gettext("hermon: Failed to read Image Info "
		    "for PSID\n"));
		hw_psid_found = 0;
	} else {
		hw_psid_found = 1;
	}

	if (init_ioctl.af_pn_len != 0) {
		/* part number length */
		for (i = 0; i < init_ioctl.af_pn_len; i++) {
			if (init_ioctl.af_hwpn[i] == ' ') {
				manuf->pn_len = i;
				break;
			}
		}
		if (i == init_ioctl.af_pn_len) {
			manuf->pn_len = init_ioctl.af_pn_len;
		}
	} else {
		logmsg(MSG_INFO, "hermon: Failed to get Part# from hermon "
		    "driver \n");
		manuf->pn_len = 0;
	}

	if (manuf->pn_len != 0) {
		errno = 0;
		manuf->info.mlx_pn = calloc(1, manuf->pn_len);
		if (manuf->info.mlx_pn == NULL) {
			logmsg(MSG_ERROR, gettext("hermon: no space available "
			    "for the HCA PN record (%s)\n"), strerror(errno));
			goto identify_end;
		}
		(void) memcpy(manuf->info.mlx_pn, init_ioctl.af_hwpn,
		    manuf->pn_len);
		manuf->info.mlx_pn[manuf->pn_len] = 0;

		logmsg(MSG_INFO, "hermon: HCA PN (%s) PN-Len %d\n",
		    manuf->info.mlx_pn, manuf->pn_len);

		errno = 0;
		manuf->info.mlx_psid = calloc(1, MLX_PSID_SZ);
		if (manuf->info.mlx_psid == NULL) {
			logmsg(MSG_ERROR, gettext("hermon: PSID calloc "
			    "failed :%s\n"), strerror(errno));
			goto identify_end;
		}

		errno = 0;
		if ((manuf->info.mlx_id = calloc(1, MLX_STR_ID_SZ)) == NULL) {
			logmsg(MSG_ERROR, gettext("hermon: "
			    "ID calloc failed (%s)\n"),
			    strerror(errno));
			goto identify_end;
		}

		/* Find part number, set the rest */
		for (i = 0; i < MLX_MAX_ID; i++) {
			if (strncmp((const char *)init_ioctl.af_hwpn,
			    mlx_mdr[i].mlx_pn, manuf->pn_len) == 0) {

				if (hw_psid_found) {
					logmsg(MSG_INFO, "HW-PSID: %s "
					    "MLX_MDR[%d]: %s\n",
					    manuf->hwfw_img_info.psid, i,
					    mlx_mdr[i].mlx_psid);
					if (strncmp((const char *)
					    manuf->hwfw_img_info.psid,
					    mlx_mdr[i].mlx_psid,
					    MLX_PSID_SZ) != 0)
						continue;
				}
				/* Set PSID */
				(void) memcpy(manuf->info.mlx_psid,
				    mlx_mdr[i].mlx_psid, MLX_PSID_SZ);
				manuf->info.mlx_psid[MLX_PSID_SZ - 1] = 0;

				logmsg(MSG_INFO, "hermon: HCA PSID (%s)\n",
				    manuf->info.mlx_psid);

				(void) strlcpy(manuf->info.mlx_id,
				    mlx_mdr[i].mlx_id,
				    strlen(mlx_mdr[i].mlx_id) + 1);

				logmsg(MSG_INFO, "hermon: HCA Name (%s)\n",
				    manuf->info.mlx_id);

				break;
			}
		}
	}

	if ((manuf->pn_len == 0) || (i == MLX_MAX_ID)) {
		logmsg(MSG_INFO, "hermon: No hardware part number "
		    "information available for this HCA\n");

		i = strlen("No hardware information available for this device");

		thisdev->ident->pid = calloc(1, i + 2);
		sprintf(thisdev->ident->pid, "No additional hardware info "
		    "available for this device");
	} else {
		errno = 0;
		if ((thisdev->ident->pid = calloc(1,
		    strlen(manuf->info.mlx_psid) + 1)) != NULL) {
			(void) strlcpy(thisdev->ident->pid,
			    manuf->info.mlx_psid,
			    strlen(manuf->info.mlx_psid) + 1);
		} else {
			logmsg(MSG_ERROR,
			    gettext("hermon: Unable to allocate space for a "
			    "hardware identifier: %s\n"), strerror(errno));
			goto identify_end;
		}
	}

	for (i = 0; i < 4; i++) {
		errno = 0;
		if ((thisdev->addresses[i] = calloc(1,
		    (2 * sizeof (uint64_t)) + 1)) == NULL) {
			logmsg(MSG_ERROR,
			    gettext("hermon: Unable to allocate space for a "
			    "human-readable HCA guid: %s\n"), strerror(errno));
			goto identify_end;
		}
		(void) sprintf(thisdev->addresses[i], "%016llx",
		    manuf->ibguids[i]);
	}

	/*
	 * We do NOT close the fd here, since we can close it
	 * at the end of the fw_readfw() or fw_writefw() functions
	 * instead and not get the poor dear confused about whether
	 * it's been inited already.
	 */

	return (FWFLASH_SUCCESS);

	/* cleanup */
identify_end:
	cnx_close(thisdev);
	return (FWFLASH_FAILURE);
}

static int
cnx_get_guids(ib_cnx_encap_ident_t *handle)
{
	int	i, rv;

	logmsg(MSG_INFO, "cnx_get_guids\n");

	/* make sure we've got our fallback position organised */
	for (i = 0; i < 4; i++) {
		handle->ibguids[i] = 0x00000000;
	}

	rv = cnx_find_magic_n_chnk_sz(handle, FWFLASH_IB_STATE_IMAGE_PRI);
	if (rv != FWFLASH_SUCCESS) {
		logmsg(MSG_INFO, "hermon: Failed to get Primary magic number. "
		    "Trying Secondary... \n");
		rv = cnx_find_magic_n_chnk_sz(handle,
		    FWFLASH_IB_STATE_IMAGE_SEC);
		if (rv != FWFLASH_SUCCESS) {
			logmsg(MSG_ERROR, gettext("hermon: Failed to get "
			    "Secondary magic number.\n"));
			logmsg(MSG_ERROR,
			    gettext("Warning: HCA Firmware corrupt.\n"));
			return (FWFLASH_FAILURE);
		}
		rv = cnx_read_guids(handle, FWFLASH_IB_STATE_IMAGE_SEC);
		if (rv != FWFLASH_SUCCESS) {
			logmsg(MSG_ERROR, gettext("hermon: Failed to read "
			    "secondary guids.\n"));
			return (FWFLASH_FAILURE);
		}
	} else {
		rv = cnx_read_guids(handle, FWFLASH_IB_STATE_IMAGE_PRI);
		if (rv != FWFLASH_SUCCESS) {
			logmsg(MSG_ERROR, gettext("hermon: Failed to read "
			    "primary guids.\n"));
			return (FWFLASH_FAILURE);
		}
	}
	for (i = 0; i < 4; i++) {
		logmsg(MSG_INFO, "hermon: ibguids[%d] 0x%016llx\n", i,
		    handle->ibguids[i]);
	}
	for (i = 0; i < 2; i++) {
		logmsg(MSG_INFO, "hermon: ib_portmac[%d] 0x%016llx\n", i,
		    handle->ib_mac[i]);
	}

	return (FWFLASH_SUCCESS);
}

static int
cnx_close(struct devicelist *flashdev)
{
	ib_cnx_encap_ident_t	*handle;

	logmsg(MSG_INFO, "cnx_close\n");

	handle = (ib_cnx_encap_ident_t *)flashdev->ident->encap_ident;

	if (CNX_I_CHECK_HANDLE(handle)) {
		logmsg(MSG_ERROR, gettext("hermon: Invalid Handle to close "
		    "device %s! \n"), flashdev->access_devname);
		return (FWFLASH_FAILURE);
	}

	if (handle->fd > 0) {
		errno = 0;
		(void) ioctl(handle->fd, HERMON_IOCTL_FLASH_FINI);
		if (close(handle->fd) != 0) {
			logmsg(MSG_ERROR, gettext("hermon: Unable to properly "
			    "close device %s! (%s)\n"),
			    flashdev->access_devname, strerror(errno));
			return (FWFLASH_FAILURE);
		}
	}

	if (handle != NULL) {
		if (handle->info.mlx_id != NULL)
			free(handle->info.mlx_id);

		if (handle->info.mlx_psid != NULL)
			free(handle->info.mlx_psid);

		if (handle->fw != NULL)
			free(handle->fw);
		free(handle);
	}

	if (flashdev->ident->vid != NULL)
		free(flashdev->ident->vid);

	if (flashdev->ident->revid != NULL)
		free(flashdev->ident->revid);

	return (FWFLASH_SUCCESS);
}


/*
 * Driver read/write ioctl calls.
 */
static int
cnx_read_ioctl(ib_cnx_encap_ident_t *hdl, hermon_flash_ioctl_t *info)
{
	int	ret;

#ifdef CNX_DEBUG
	logmsg(MSG_INFO, "cnx_read_ioctl: fd %d af_type 0x%x af_addr 0x%x "
	    "af_sector_num(0x%x)\n", hdl->fd, info->af_type,
	    info->af_addr, info->af_sector_num);
#endif

	errno = 0;
	ret = ioctl(hdl->fd, HERMON_IOCTL_FLASH_READ, info);
	if (ret != 0) {
		logmsg(MSG_ERROR, gettext("HERMON_IOCTL_FLASH_READ failed "
		    "(%s)\n"), strerror(errno));
	}
	return (ret);
}

static int
cnx_write_ioctl(ib_cnx_encap_ident_t *hdl, hermon_flash_ioctl_t *info)
{
	int	ret;

#ifdef CNX_DEBUG
	logmsg(MSG_INFO, "cnx_write_ioctl: fd(%d) af_type(0x%x) "
	    "af_addr(0x%x) af_sector_num(0x%x) af_byte(0x%x)\n",
	    hdl->fd, info->af_type, info->af_addr, info->af_sector_num,
	    info->af_byte);
#endif
	errno = 0;
	ret = ioctl(hdl->fd, HERMON_IOCTL_FLASH_WRITE, info);
	if (ret != 0) {
		logmsg(MSG_ERROR, gettext("HERMON_IOCTL_FLASH_WRITE "
		    "failed (%s)\n"), strerror(errno));
	}
	return (ret);
}

static int
cnx_erase_sector_ioctl(ib_cnx_encap_ident_t *hdl, hermon_flash_ioctl_t *info)
{
	int	ret;

#ifdef CNX_DEBUG
	logmsg(MSG_INFO, "cnx_erase_sector_ioctl: fd(%d) af_type(0x%x) "
	    "af_sector_num(0x%x)\n", hdl->fd, info->af_type,
	    info->af_sector_num);
#endif
	errno = 0;
	ret = ioctl(hdl->fd, HERMON_IOCTL_FLASH_ERASE, info);
	if (ret != 0) {
		logmsg(MSG_ERROR, gettext("HERMON_IOCTL_FLASH_ERASE "
		    "failed (%s)\n"), strerror(errno));
	}
	return (ret);
}

/*
 * cnx_crc16 - computes 16 bit crc of supplied buffer.
 *   image should be in network byteorder
 *   result is returned in host byteorder form
 */
uint16_t
cnx_crc16(uint8_t *image, uint32_t size, int is_image)
{
	const uint16_t	poly = 0x100b;
	uint32_t	crc = 0xFFFF;
	uint32_t	word;
	uint32_t	i, j;

	logmsg(MSG_INFO, "hermon: cnx_crc16\n");

	for (i = 0; i < size / 4; i++) {
		word = (image[4 * i] << 24) |
		    (image[4 * i + 1] << 16) |
		    (image[4 * i + 2] << 8) |
		    (image[4 * i + 3]);

		if (is_image == CNX_HW_IMG)
			word = MLXSWAPBITS32(word);

		for (j = 0; j < 32; j++) {
			if (crc & 0x8000) {
				crc = (((crc << 1) |
				    (word >> 31)) ^ poly) & 0xFFFF;
			} else {
				crc = ((crc << 1) | (word >> 31)) & 0xFFFF;
			}
			word = (word << 1) & 0xFFFFFFFF;
		}
	}

	for (i = 0; i < 16; i++) {
		if (crc & 0x8000) {
			crc = ((crc << 1) ^ poly) & 0xFFFF;
		} else {
			crc = (crc << 1) & 0xFFFF;
		}
	}

	crc = crc ^ 0xFFFF;
	return (crc & 0xFFFF);
}

static void
cnx_local_set_guid_crc_img(uint32_t offset, uint32_t guid_crc_size,
    uint32_t guid_crc_offset)
{
	uint16_t	crc;
	uint8_t		*fw_p = (uint8_t *)&verifier->fwimage[0];

	crc = htons(cnx_crc16((uint8_t *)&verifier->fwimage[offset / 4],
	    guid_crc_size, CNX_FILE_IMG));

	logmsg(MSG_INFO, "cnx_local_set_guid_crc_img: new guid_sect crc: %x\n",
	    ntohs(crc));
	(void) memcpy(&fw_p[offset + guid_crc_offset], &crc, 2);
}

/*
 * Address translation functions for ConnectX
 * Variable definitions:
 * - log2_chunk_size: log2 of a Flash chunk size
 * - cont_addr: a contiguous image address to be translated
 * - is_image_in_odd_chunk: When this bit is 1, it indicates the new image is
 * stored in odd chunks of the Flash.
 */
static uint32_t
cnx_cont2phys(uint32_t log2_chunk_size, uint32_t cont_addr, int type)
{
	uint32_t	result;
	int		is_image_in_odd_chunks;

	is_image_in_odd_chunks = type - 1;

	if (log2_chunk_size) {
		result = cont_addr & (0xffffffff >> (32 - log2_chunk_size)) |
		    (is_image_in_odd_chunks << log2_chunk_size) |
		    (cont_addr << 1) & (0xffffffff << (log2_chunk_size + 1));
	} else {
		result = cont_addr;
	}

	return (result);
}

static int
cnx_read_guids(ib_cnx_encap_ident_t *handle, int type)
{
#ifdef _LITTLE_ENDIAN
	uint32_t		*ptr, tmp;
#endif
	hermon_flash_ioctl_t	ioctl_info;
	uint32_t		*guids;
	uint32_t		*ibmac;
	int			ret, i;
	uint32_t		nguidptr_addr;
	union {
		uint8_t		bytes[4];
		uint32_t	dword;
	} crc16_u;
	uint32_t		*guid_structure;
	uint16_t		crc;

	logmsg(MSG_INFO, "cnx_read_guids\n");

	errno = 0;
	guid_structure = (uint32_t *)calloc(1,
	    CNX_GUID_CRC16_SIZE / 4 * sizeof (uint32_t));
	if (guid_structure == NULL) {
		logmsg(MSG_WARN, gettext("hermon: Can't calloc guid_structure "
		    ": (%s)\n"), strerror(errno));
		return (FWFLASH_FAILURE);
	}

	ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;
	ioctl_info.af_addr = cnx_cont2phys(handle->log2_chunk_sz,
	    CNX_NGUIDPTR_OFFSET, type);

	ret = cnx_read_ioctl(handle, &ioctl_info);
	if (ret != 0) {
		logmsg(MSG_WARN, gettext("hermon: Failed to read GUID Pointer "
		    "Address\n"));
		goto out;
	}

	guids = (uint32_t *)&handle->ibguids[0];
	ibmac = (uint32_t *)&handle->ib_mac[0];
	nguidptr_addr = cnx_cont2phys(handle->log2_chunk_sz,
	    ioctl_info.af_quadlet, type);

	logmsg(MSG_INFO, "NGUIDPTR: 0x%08x \n", nguidptr_addr);
	/* Read in the entire guid section in order to calculate the CRC */
	ioctl_info.af_addr = nguidptr_addr - 0x10;
	ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;

	for (i = 0; i < CNX_GUID_CRC16_SIZE / 4; i++) {
		ret = cnx_read_ioctl(handle, &ioctl_info);
		if (ret != 0) {
			logmsg(MSG_INFO, "Failed to read guid_structure "
			    "(0x%x)\n", i);
			goto out;
		}

		if (i >= 4 && i < 12) {
			guids[i - 4] = ioctl_info.af_quadlet;
		}
		if (i >= 12 && i < 16) {
			ibmac[i - 12] = ioctl_info.af_quadlet;
		}

		guid_structure[i] = ioctl_info.af_quadlet;
		ioctl_info.af_addr += 4;
	}

	for (i = 0; i < CNX_GUID_CRC16_SIZE / 4; i++) {
		logmsg(MSG_INFO, "guid_structure[%x] = 0x%08x\n", i,
		    guid_structure[i]);
	}

	/*
	 * Check the CRC--make sure it computes.
	 */

	/* 0x12 subtracted: 0x2 for alignment, 0x10 to reach structure start */
	ioctl_info.af_addr = nguidptr_addr + CNX_GUID_CRC16_OFFSET - 0x12;
	ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;

	ret = cnx_read_ioctl(handle, &ioctl_info);
	if (ret != 0) {
		logmsg(MSG_WARN, gettext("hermon: Failed to read guid crc "
		    "at 0x%x\n"), ioctl_info.af_addr);
		goto out;
	}

	crc16_u.dword = ioctl_info.af_quadlet;
	crc = cnx_crc16((uint8_t *)guid_structure, CNX_GUID_CRC16_SIZE,
	    CNX_HW_IMG);

	if (crc != crc16_u.dword) {
		logmsg(MSG_WARN, gettext("hermon: calculated crc16: 0x%x "
		    "differs from GUID section 0x%x\n"), crc, crc16_u.dword);
	} else {
		logmsg(MSG_INFO, "hermon: calculated crc16: 0x%x MATCHES with "
		    "GUID section 0x%x\n", crc, crc16_u.dword);
	}

#ifdef _LITTLE_ENDIAN
	/*
	 * guids are read as pairs of 32 bit host byteorder values and treated
	 * by callers as 64 bit values. So swap each pair of 32 bit values
	 * to make them correct
	 */
	ptr = (uint32_t *)guids;
	for (ret = 0; ret < 8; ret += 2) {
		tmp = ptr[ret];
		ptr[ret] = ptr[ret+1];
		ptr[ret+1] = tmp;
	}
	ptr = (uint32_t *)&handle->ib_mac[0];
	for (ret = 0; ret < 4; ret += 2) {
		tmp = ptr[ret];
		ptr[ret] = ptr[ret+1];
		ptr[ret+1] = tmp;
	}
#endif
	ret = FWFLASH_SUCCESS;

out:
	free(guid_structure);
	return (ret);
}

static int
cnx_find_magic_n_chnk_sz(ib_cnx_encap_ident_t *handle, int type)
{
	int	i, found = 0;
	uint32_t addr;
	uint32_t boot_addresses[] =
	    {0, 0x10000, 0x20000, 0x40000, 0x80000, 0x100000};

	logmsg(MSG_INFO, "cnx_find_magic_n_chnk_sz\n");

	switch (type) {
	case FWFLASH_IB_STATE_IMAGE_PRI:
		addr = 0;
		if (cnx_check_for_magic_pattern(handle, addr) !=
		    FWFLASH_SUCCESS) {
			goto err;
		}
		break;

	case FWFLASH_IB_STATE_IMAGE_SEC:
		for (i = 1; i < 6; i++) {
			addr = boot_addresses[i];
			if (cnx_check_for_magic_pattern(handle, addr) ==
			    FWFLASH_SUCCESS) {
				found = 1;
				break;
			}
		}
		if (!found) {
			goto err;
		}
		break;

	default:
		logmsg(MSG_INFO, "cnx_find_magic_pattern: unknown type\n");
		goto err;
	}

	logmsg(MSG_INFO, "magic_pattern found at addr %x\n", addr);
	handle->img2_start_addr = addr;

	handle->log2_chunk_sz = cnx_get_log2_chunk_size_f_hdl(handle, type);
	if (handle->log2_chunk_sz == 0) {
		logmsg(MSG_INFO, "no chunk size found for type %x. "
		    "Assuming non-failsafe burn\n", type);
	}

	handle->fw_sz = cnx_get_image_size_f_hdl(handle, type);
	if (handle->fw_sz == 0) {
		logmsg(MSG_INFO, "no fw size found for type %x. \n", type);
	}
	handle->state |= type;

	return (FWFLASH_SUCCESS);
err:
	logmsg(MSG_INFO, "no magic_pattern found for type %x\n", type);
	return (FWFLASH_FAILURE);
}

static int
cnx_check_for_magic_pattern(ib_cnx_encap_ident_t *handle, uint32_t addr)
{
	int 			i;
	hermon_flash_ioctl_t	ioctl_info;
	int 			magic_pattern_buf[4];

	logmsg(MSG_INFO, "cnx_check_for_magic_pattern\n");

	ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;

	for (i = 0; i < 4; i++) {
		ioctl_info.af_addr = addr + (i * sizeof (uint32_t));
		if (cnx_read_ioctl(handle, &ioctl_info) != 0) {
			logmsg(MSG_INFO, "\nFailed to read magic pattern\n");
			return (FWFLASH_FAILURE);
		}

		magic_pattern_buf[i] = ioctl_info.af_quadlet;
	}

	return (cnx_is_magic_pattern_present(magic_pattern_buf, CNX_HW_IMG));

}

int
cnx_is_magic_pattern_present(int *data, int is_image)
{
	int	i;
	int	dword;

	logmsg(MSG_INFO, "cnx_is_magic_pattern_present\n");

	for (i = 0; i < 4; i++) {
		if (is_image == CNX_FILE_IMG)
			dword = MLXSWAPBITS32(data[i]);
		else
			dword = data[i];
		logmsg(MSG_INFO, "local_quadlet: %08x, magic pattern: %08x\n",
		    dword, cnx_magic_pattern[i]);
		if (dword != cnx_magic_pattern[i]) {
			return (FWFLASH_FAILURE);
		}
	}

	return (FWFLASH_SUCCESS);
}

static uint32_t
cnx_get_log2_chunk_size_f_hdl(ib_cnx_encap_ident_t *handle, int type)
{
	hermon_flash_ioctl_t	ioctl_info;
	int			ret;

	logmsg(MSG_INFO, "cnx_get_log2_chunk_size_f_hdl\n");

	/* If chunk size is already set, just return it. */
	if (handle->log2_chunk_sz) {
		return (handle->log2_chunk_sz);
	}

	switch (type) {
	case FWFLASH_IB_STATE_IMAGE_PRI:
		ioctl_info.af_addr = CNX_CHUNK_SIZE_OFFSET;
		break;
	case FWFLASH_IB_STATE_IMAGE_SEC:
		ioctl_info.af_addr =
		    handle->img2_start_addr + CNX_CHUNK_SIZE_OFFSET;
		break;
	default:
		logmsg(MSG_INFO,
		    "cnx_get_log2_chunk_size_f_hdl: unknown type\n");
		return (0);
	}

	ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;

	ret = cnx_read_ioctl(handle, &ioctl_info);
	if (ret != 0) {
		logmsg(MSG_INFO, "\nFailed to read chunk size\n");
		return (0);
	}

	return (cnx_get_log2_chunk_size(ioctl_info.af_quadlet));
}


static uint32_t
cnx_get_log2_chunk_size(uint32_t chunk_size_word)
{
	uint8_t		checksum;
	uint32_t	log2_chunk_size;

	logmsg(MSG_INFO, "cnx_get_log2_chunk_size: chunk_size_word:"
	    " 0x%x\n", chunk_size_word);

	checksum =
	    (chunk_size_word & 0xff) +
	    ((chunk_size_word >> 8) & 0xff) +
	    ((chunk_size_word >> 16) & 0xff) +
	    ((chunk_size_word >> 24) & 0xff);

	if (checksum != 0) {
		logmsg(MSG_INFO, "Corrupted chunk size checksum\n");
		return (0);
	}

	if (chunk_size_word & 0x8) {
		log2_chunk_size = (chunk_size_word & 0x7) + 16;
		logmsg(MSG_INFO, "log2 chunk size: 0x%x\n", log2_chunk_size);
		return (log2_chunk_size);
	} else {
		return (0);
	}
}

static uint32_t
cnx_get_image_size_f_hdl(ib_cnx_encap_ident_t *handle, int type)
{
	hermon_flash_ioctl_t	ioctl_info;
	int			ret;

	logmsg(MSG_INFO, "cnx_get_image_size_f_hdl\n");

	ioctl_info.af_addr = cnx_cont2phys(handle->log2_chunk_sz,
	    CNX_IMG_SIZE_OFFSET, type);
	ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;

	ret = cnx_read_ioctl(handle, &ioctl_info);
	if (ret != 0) {
		logmsg(MSG_INFO, "Failed to read image size\n");
		return (0);
	}

	logmsg(MSG_INFO, "Image Size: 0x%x\n", ioctl_info.af_quadlet);

	return (ioctl_info.af_quadlet);
}

static int
cnx_get_image_info(ib_cnx_encap_ident_t *handle)
{
	uint32_t	ii_ptr_addr;
	uint32_t	ii_size;
	int		*buf;
	int		i, type;
	hermon_flash_ioctl_t	ioctl_info;

	logmsg(MSG_INFO, "cnx_get_image_info: state %x\n", handle->state);

	type = handle->state &
	    (FWFLASH_IB_STATE_IMAGE_PRI | FWFLASH_IB_STATE_IMAGE_SEC);

	/* Get the image info pointer */
	ioctl_info.af_addr = cnx_cont2phys(handle->log2_chunk_sz,
	    CNX_IMG_INF_PTR_OFFSET, type);
	ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;

	if (cnx_read_ioctl(handle, &ioctl_info) != FWFLASH_SUCCESS) {
		logmsg(MSG_WARN, gettext("hermon: Failed to read image info "
		    "Address\n"));
		return (FWFLASH_FAILURE);
	}
	ii_ptr_addr = ioctl_info.af_quadlet & 0xffffff;

	/* Get the image info size, a negative offset from the image info ptr */
	ioctl_info.af_addr = cnx_cont2phys(handle->log2_chunk_sz,
	    ii_ptr_addr + CNX_IMG_INF_SZ_OFFSET, type);
	ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;

	if (cnx_read_ioctl(handle, &ioctl_info) != FWFLASH_SUCCESS) {
		logmsg(MSG_WARN, gettext("hermon: Failed to read image info "
		    "size\n"));
		return (FWFLASH_FAILURE);
	}
	logmsg(MSG_INFO, "hermon: ImageInfo Sz: 0x%x\n", ioctl_info.af_quadlet);

	ii_size = ioctl_info.af_quadlet;
	/* size is in dwords--convert it to bytes */
	ii_size *= 4;

	logmsg(MSG_INFO, "hermon: ii_ptr_addr: 0x%x ii_size: 0x%x\n",
	    ii_ptr_addr, ii_size);

	buf = (int *)calloc(1, ii_size);

	ioctl_info.af_addr = cnx_cont2phys(handle->log2_chunk_sz,
	    ii_ptr_addr, type);
	ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;

	for (i = 0; i < ii_size/4; i++) {
		if (cnx_read_ioctl(handle, &ioctl_info) != FWFLASH_SUCCESS) {
			logmsg(MSG_WARN, gettext("hermon: Failed to read "
			    "image info (0x%x)\n"), i);
			free(buf);
			return (FWFLASH_FAILURE);
		}

		buf[i] = ioctl_info.af_quadlet;
		ioctl_info.af_addr += 4;
	}

	/* Parse the image info section */
	if (cnx_parse_img_info(buf, ii_size, &handle->hwfw_img_info,
	    CNX_HW_IMG) != FWFLASH_SUCCESS) {
		logmsg(MSG_WARN, gettext("hermon: Failed to parse Image Info "
		    "section\n"));
		free(buf);
		return (FWFLASH_FAILURE);
	}

	free(buf);
	return (FWFLASH_SUCCESS);
}

int
cnx_parse_img_info(int *buf, uint32_t byte_size, cnx_img_info_t *img_info,
    int is_image)
{
	uint32_t 	*p;
	uint32_t 	offs = 0;
	uint32_t 	tag_num = 0;
	int 		end_found = 0;
	uint32_t 	tag_size, tag_id;
	uint32_t 	tmp;
	const char 	*str;
	int		i;

	p = (uint32_t *)buf;

	logmsg(MSG_INFO, "hermon: cnx_parse_img_info\n");

	while (!end_found && (offs < byte_size)) {
		if (is_image == CNX_FILE_IMG) {
			tag_size = ntohl(*p) & 0xffffff;
			tag_id = ntohl(*p) >> 24;
			tmp = ntohl(*(p + 1));
		} else {
			tag_size = ((*p) & 0xffffff);
			tag_id = ((*p) >> 24);
			tmp = (*(p + 1));
		}

		logmsg(MSG_INFO, "tag_id: %d tag_size: %d\n", tag_id, tag_size);

		if ((offs + tag_size) > byte_size) {
			logmsg(MSG_WARN, gettext("hermon: Image Info section "
			    "corrupted: Tag# %d - tag_id %d, size %d exceeds "
			    "info section size (%d bytes)"), tag_num, tag_id,
			    tag_size, byte_size);
			return (FWFLASH_FAILURE);
		}

		switch (tag_id) {
		case CNX_FW_VER:
			if (tag_size != CNX_FW_VER_SZ) {
				logmsg(MSG_INFO, "ERROR: tag_id: %d tag_size: "
				    "%d expected sz %d\n", tag_id, tag_size,
				    CNX_FW_VER_SZ);
			}
			tmp = (tmp & CNX_MASK_FW_VER_MAJ) >> 16;
			img_info->fw_rev.major = tmp;
			if (is_image == CNX_FILE_IMG)
				tmp = ntohl(*(p + 2));
			else
				tmp = (*(p + 2));
			img_info->fw_rev.minor =
			    (tmp & CNX_MASK_FW_VER_MIN)>> 16;
			img_info->fw_rev.subminor =
			    tmp & CNX_MASK_FW_VER_SUBMIN;

			logmsg(MSG_INFO, "FW_VER: %d.%d.%03d\n",
			    img_info->fw_rev.major, img_info->fw_rev.minor,
			    img_info->fw_rev.subminor);
			break;

		case CNX_FW_BUILD_TIME:
			if (tag_size != CNX_FW_BUILD_TIME_SZ) {
				logmsg(MSG_INFO, "ERROR: tag_id: %d tag_size: "
				    "%d expected sz %d\n", tag_id, tag_size,
				    CNX_FW_BUILD_TIME_SZ);
			}
			img_info->fw_buildtime.hour =
			    (tmp & CNX_MASK_FW_BUILD_HOUR) >> 16;
			img_info->fw_buildtime.minute =
			    (tmp & CNX_MASK_FW_BUILD_MIN) >> 8;
			img_info->fw_buildtime.second =
			    (tmp & CNX_MASK_FW_BUILD_SEC);

			if (is_image == CNX_FILE_IMG)
				tmp = ntohl(*(p + 2));
			else
				tmp = (*(p + 2));

			img_info->fw_buildtime.year =
			    (tmp & CNX_MASK_FW_BUILD_YEAR) >> 16;
			img_info->fw_buildtime.month =
			    (tmp & CNX_MASK_FW_BUILD_MON) >> 8;
			img_info->fw_buildtime.day =
			    (tmp & CNX_MASK_FW_BUILD_DAY);

			logmsg(MSG_INFO, "Build TIME: %d:%d:%d %d:%d:%d\n",
			    img_info->fw_buildtime.year,
			    img_info->fw_buildtime.month,
			    img_info->fw_buildtime.day,
			    img_info->fw_buildtime.hour,
			    img_info->fw_buildtime.minute,
			    img_info->fw_buildtime.second);
			break;

		case CNX_DEV_TYPE:
			if (tag_size != CNX_DEV_TYPE_SZ) {
				logmsg(MSG_INFO, "ERROR: tag_id: %d tag_size: "
				    "%d expected sz %d\n", tag_id, tag_size,
				    CNX_DEV_TYPE_SZ);
			}
			img_info->dev_id = tmp & CNX_MASK_DEV_TYPE_ID;
			logmsg(MSG_INFO, "DEV_TYPE: %d\n", img_info->dev_id);
			break;

		case CNX_VSD_VENDOR_ID:
			if (tag_size != CNX_VSD_VENDOR_ID_SZ) {
				logmsg(MSG_INFO, "ERROR: tag_id: %d tag_size: "
				    "%d expected sz %d\n", tag_id, tag_size,
				    CNX_VSD_VENDOR_ID_SZ);
			}
			img_info->vsd_vendor_id = tmp & CNX_MASK_VSD_VENDORID;
			logmsg(MSG_INFO, "VSD Vendor ID: 0x%lX\n",
			    img_info->vsd_vendor_id);
			break;

		case CNX_PSID:
			if (tag_size != CNX_PSID_SZ) {
				logmsg(MSG_INFO, "ERROR: tag_id: %d tag_size: "
				    "%d expected sz %d\n", tag_id, tag_size,
				    CNX_PSID_SZ);
			}
			str = (const char *)p;
			str += 4;

			for (i = 0; i < CNX_PSID_SZ; i++)
				img_info->psid[i] = str[i];

#ifdef _LITTLE_ENDIAN
			if (is_image == CNX_HW_IMG) {
				for (i = 0; i < CNX_PSID_SZ; i += 4) {
					img_info->psid[i+3] = str[i];
					img_info->psid[i+2] = str[i+1];
					img_info->psid[i+1] = str[i+2];
					img_info->psid[i] = str[i+3];
				}
			}
#endif

			logmsg(MSG_INFO, "PSID: %s\n", img_info->psid);
			break;

		case CNX_VSD:
			if (tag_size != CNX_VSD_SZ) {
				logmsg(MSG_INFO, "ERROR: tag_id: %d tag_size: "
				    "%d expected sz %d\n", tag_id, tag_size,
				    CNX_VSD_SZ);
			}
			str = (const char *)p;
			str += 4;

			for (i = 0; i < CNX_VSD_SZ; i++)
				img_info->vsd[i] = str[i];

#ifdef _LITTLE_ENDIAN
			if (is_image == CNX_HW_IMG) {
				for (i = 0; i < CNX_VSD_SZ; i += 4) {
					img_info->vsd[i+3] = str[i];
					img_info->vsd[i+2] = str[i+1];
					img_info->vsd[i+1] = str[i+2];
					img_info->vsd[i] = str[i+3];
				}
			}
#endif
			logmsg(MSG_INFO, "VSD: %s\n", img_info->vsd);
			break;

		case CNX_END_TAG:
			if (tag_size != CNX_END_TAG_SZ) {
				logmsg(MSG_INFO, "ERROR: tag_id: %d tag_size: "
				    "%d expected sz %d\n", tag_id, tag_size,
				    CNX_END_TAG_SZ);
			}
			end_found = 1;
			break;

		default:
			if (tag_id > CNX_END_TAG) {
				logmsg(MSG_WARN, gettext("Invalid img_info "
				    "tag ID %d of size %d\n"), tag_id,
				    tag_size);
			}
			break;
		}

		p += (tag_size / 4) + 1;
		offs += tag_size + 4;
		tag_num++;
	}

	if (offs != byte_size) {
		logmsg(MSG_WARN, gettext("hermon: Corrupt Image Info section "
		    "in firmware image\n"));
		if (end_found) {
			logmsg(MSG_WARN, gettext("Info section corrupted: "
			    "Section data size is %x bytes, but end tag found "
			    "after %x bytes.\n"), byte_size, offs);
		} else {
			logmsg(MSG_WARN, gettext("Info section corrupted: "
			    "Section data size is %x bytes, but end tag not "
			    "found at section end.\n"), byte_size);
		}
		return (FWFLASH_FAILURE);
	}

	return (FWFLASH_SUCCESS);
}