transport/common/hermon.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
 */

/*
 * The reference for the functions in this file is the
 *
 *  Mellanox HCA Flash Programming Application Note
 * (Mellanox document number 2205AN) rev 1.45, 2007.
 * Chapter 4 in particular.
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/sysmacros.h>
#include <sys/queue.h>
#include <fcntl.h>
#include <ctype.h>
#include <string.h>
#include <strings.h>

#include <sys/byteorder.h>

#include <libintl.h> /* for gettext(3c) */

#include <fwflash/fwflash.h>
#include "../../hdrs/hermon_ib.h"

char *devprefix = "/devices";
char drivername[] = "hermon\0";
char *devsuffix = ":devctl";

extern di_node_t rootnode;
extern int errno;
extern struct fw_plugin *self;
extern struct vrfyplugin *verifier;
extern int fwflash_debug;

/* required functions for this plugin */
int fw_readfw(struct devicelist *device, char *filename);
int fw_writefw(struct devicelist *device);
int fw_identify(int start);
int fw_devinfo();


/* helper functions */
static int cnx_identify(struct devicelist *thisdev);
static int cnx_get_guids(ib_cnx_encap_ident_t *handle);
static int cnx_close(struct devicelist *flashdev);
static int cnx_check_for_magic_pattern(ib_cnx_encap_ident_t *hdl, uint32_t adr);
static uint32_t cnx_get_log2_chunk_size_f_hdl(ib_cnx_encap_ident_t *handle,
    int type);
static uint32_t cnx_get_log2_chunk_size(uint32_t chunk_size_word);
static uint32_t cnx_cont2phys(uint32_t log2_chunk_sz, uint32_t cont_addr,
    int type);
static uint32_t cnx_get_image_size_f_hdl(ib_cnx_encap_ident_t *hdl, int type);
static void cnx_local_set_guid_crc_img(uint32_t offset, uint32_t guid_crc_size,
    uint32_t guid_crc_offset);
static int cnx_read_image(ib_cnx_encap_ident_t *handle);
static int cnx_write_file(ib_cnx_encap_ident_t *handle, const char *filename);
static int cnx_verify_image(ib_cnx_encap_ident_t *handle, int type);
static int cnx_read_guids(ib_cnx_encap_ident_t *handle, int type);
static int cnx_set_guids(ib_cnx_encap_ident_t *handle, void *arg);
static int cnx_write_image(ib_cnx_encap_ident_t *handle, int type);
static int cnx_read_ioctl(ib_cnx_encap_ident_t *hdl,
    hermon_flash_ioctl_t *info);
static int cnx_write_ioctl(ib_cnx_encap_ident_t *hdl,
    hermon_flash_ioctl_t *info);
static int cnx_erase_sector_ioctl(ib_cnx_encap_ident_t *hdl,
    hermon_flash_ioctl_t *info);
static int cnx_find_magic_n_chnk_sz(ib_cnx_encap_ident_t *handle, int type);
static int cnx_get_image_info(ib_cnx_encap_ident_t *handle);


int
fw_readfw(struct devicelist *flashdev, char *filename)
{
    ib_cnx_encap_ident_t    *manuf;
    int             rv = FWFLASH_SUCCESS;

    logmsg(MSG_INFO, "hermon: fw_readfw: filename %s\n", filename);

    manuf = (ib_cnx_encap_ident_t *)flashdev->ident->encap_ident;
    if (CNX_I_CHECK_HANDLE(manuf)) {
        logmsg(MSG_ERROR, gettext("hermon: Invalid Handle for "
            "device %s! \n"), flashdev->access_devname);
        return (FWFLASH_FAILURE);
    }

    logmsg(MSG_INFO, "hermon: fw_identify should have read the image. "
        "state 0x%x\n", manuf->state);

    rv = cnx_read_image(manuf);
    if (rv != FWFLASH_SUCCESS) {
        logmsg(MSG_ERROR, gettext("hermon: Failed to read any valid "
            "image on device (%s)\n"), flashdev->access_devname);
        logmsg(MSG_ERROR, gettext("Aborting read.\n"));
    } else {
        rv = cnx_write_file(manuf, filename);
    }

    cnx_close(flashdev);
    return (rv);
}


/*
 * If we're invoking fw_writefw, then flashdev is a valid,
 * flashable device as determined by fw_identify().
 *
 * If verifier is null, then we haven't been called following a firmware
 * image verification load operation.
 */
int
fw_writefw(struct devicelist *flashdev)
{
    ib_cnx_encap_ident_t    *manuf;
    int         i, j, k;

    logmsg(MSG_INFO, "hermon: fw_writefw\n");

    manuf = (ib_cnx_encap_ident_t *)flashdev->ident->encap_ident;

    if (CNX_I_CHECK_HANDLE(manuf)) {
        logmsg(MSG_ERROR, gettext("hermon: Invalid Handle for "
            "device %s! \n"), flashdev->access_devname);
        return (FWFLASH_FAILURE);
    }

    /*
     * Try the primary first, then the secondary.
     * If we get here, then the verifier has _already_ checked that
     * the part number in the firmware image matches that in the HCA,
     * so we only need this check if there's no hardware info available
     * already after running through fw_identify().
     */
    if (manuf->pn_len == 0) {
        int resp;

        (void) fprintf(stderr, gettext("Unable to completely verify "
            "that this firmware image (%s) is compatible with your "
            "HCA %s"), verifier->imgfile, flashdev->access_devname);
        (void) fprintf(stderr, gettext("Do you really want to "
            "continue? (Y/N): "));
        (void) fflush(stdin);
        resp = getchar();
        if (resp != 'Y' && resp != 'y') {
            (void) fprintf(stderr, gettext("Not proceeding with "
                "flash operation of %s on %s"),
                verifier->imgfile, flashdev->access_devname);
            return (FWFLASH_FAILURE);
        }
    }

    logmsg(MSG_INFO, "hermon: fw_writefw: Using Existing GUIDs.\n");
    manuf->state |=
        FWFLASH_IB_STATE_GUIDN |
        FWFLASH_IB_STATE_GUID1 |
        FWFLASH_IB_STATE_GUID2 |
        FWFLASH_IB_STATE_GUIDS;
    if (cnx_set_guids(manuf, manuf->ibguids) != FWFLASH_SUCCESS) {
        logmsg(MSG_WARN, gettext("hermon: Failed to set GUIDs"));
    }

    /*
     * Update both Primary and Secondary images
     *
     * For Failsafe firmware image update, if the current image (i.e.
     * containing a magic pattern) on the Flash is stored on the Primary
     * location, burn the new image to the Secondary location first,
     * or vice versa.
     */

    /* Note Current Image location. */
    j = manuf->state &
        (FWFLASH_IB_STATE_IMAGE_PRI | FWFLASH_IB_STATE_IMAGE_SEC);

    /*
     * If we find that current image location is not found, no worries
     * we shall default to PRIMARY, and proceed with burning anyway.
     */
    if (j == 0)
        j = FWFLASH_IB_STATE_IMAGE_PRI;

    for (i = FWFLASH_FLASH_IMAGES; i > 0; i--) {
        char *type;

        if (i == 2) {
            if (j == 2)
                k = 1;  /* Burn PRI First */
            else
                k = 2;  /* Burn SEC First */
        } else {
            if (k == 2)
                k = 1;  /* Burn PRI next */
            else
                k = 2;  /* Burn SEC next */
        }
        type = ((k == 1) ? "Primary" : "Secondary");

        logmsg(MSG_INFO, "hermon: fw_write: UPDATING %s image\n", type);

        if (cnx_write_image(manuf, k) != FWFLASH_SUCCESS) {
            (void) fprintf(stderr,
                gettext("Failed to update %s image on device %s"),
                type, flashdev->access_devname);
            goto out;
        }

        logmsg(MSG_INFO, "hermon: fw_write: Verify %s image..\n", type);
        if (cnx_verify_image(manuf, k) != FWFLASH_SUCCESS) {
            (void) fprintf(stderr,
                gettext("Failed to verify %s image for device %s"),
                type, flashdev->access_devname);
            goto out;
        }
    }
out:
    /* final update marker to the user */
    (void) printf(" +\n");
    return (cnx_close(flashdev));
}


/*
 * The fw_identify() function walks the device tree trying to find
 * devices which this plugin can work with.
 *
 * The parameter "start" gives us the starting index number
 * to give the device when we add it to the fw_devices list.
 *
 * firstdev is allocated by us and we add space as necessary
 */
int
fw_identify(int start)
{
    int     rv = FWFLASH_FAILURE;
    di_node_t   thisnode;
    struct devicelist *newdev;
    char        *devpath;
    int     idx = start;
    int     devlength = 0;

    logmsg(MSG_INFO, "hermon: fw_identify\n");
    thisnode = di_drv_first_node(drivername, rootnode);

    if (thisnode == DI_NODE_NIL) {
        logmsg(MSG_INFO, gettext("No %s nodes in this system\n"),
            drivername);
        return (rv);
    }

    /* we've found one, at least */
    for (; thisnode != DI_NODE_NIL; thisnode = di_drv_next_node(thisnode)) {

        devpath = di_devfs_path(thisnode);

        if ((newdev = calloc(1, sizeof (struct devicelist))) == NULL) {
            logmsg(MSG_ERROR, gettext("hermon: Unable to allocate "
                "space for device entry\n"));
            di_devfs_path_free(devpath);
            return (FWFLASH_FAILURE);
        }

        /* calloc enough for /devices + devpath + ":devctl" + '\0' */
        devlength = strlen(devpath) + strlen(devprefix) +
            strlen(devsuffix) + 2;

        if ((newdev->access_devname = calloc(1, devlength)) == NULL) {
            logmsg(MSG_ERROR, gettext("hermon: Unable to allocate "
                "space for a devfs name\n"));
            (void) free(newdev);
            di_devfs_path_free(devpath);
            return (FWFLASH_FAILURE);
        }
        snprintf(newdev->access_devname, devlength,
            "%s%s%s", devprefix, devpath, devsuffix);

        if ((newdev->ident = calloc(1, sizeof (struct vpr))) == NULL) {
            logmsg(MSG_ERROR, gettext("hermon: Unable to allocate "
                "space for a device identification record\n"));
            (void) free(newdev->access_devname);
            (void) free(newdev);
            di_devfs_path_free(devpath);
            return (FWFLASH_FAILURE);
        }

        /* CHECK VARIOUS IB THINGS HERE */
        rv = cnx_identify(newdev);
        if (rv == FWFLASH_FAILURE) {
            (void) free(newdev->ident);
            (void) free(newdev->access_devname);
            (void) free(newdev);
            di_devfs_path_free(devpath);
            continue;
        }

        if ((newdev->drvname = calloc(1, strlen(drivername) + 1))
            == NULL) {
            logmsg(MSG_ERROR, gettext("hermon: Unable to allocate"
                " space for a driver name\n"));
            (void) free(newdev->ident);
            (void) free(newdev->access_devname);
            (void) free(newdev);
            di_devfs_path_free(devpath);
            return (FWFLASH_FAILURE);
        }

        (void) strlcpy(newdev->drvname, drivername,
            strlen(drivername) + 1);

        /* this next bit is backwards compatibility - "IB\0" */
        if ((newdev->classname = calloc(1, 3)) == NULL) {
            logmsg(MSG_ERROR, gettext("hermon: Unable to allocate "
                "space for a class name\n"));
            (void) free(newdev->drvname);
            (void) free(newdev->ident);
            (void) free(newdev->access_devname);
            (void) free(newdev);
            di_devfs_path_free(devpath);
            return (FWFLASH_FAILURE);
        }
        (void) strlcpy(newdev->classname, "IB", 3);

        newdev->index = idx;
        ++idx;
        newdev->plugin = self;

        di_devfs_path_free(devpath);

        TAILQ_INSERT_TAIL(fw_devices, newdev, nextdev);
    }

    if (fwflash_debug != 0) {
        struct devicelist *tempdev;

        TAILQ_FOREACH(tempdev, fw_devices, nextdev) {
            logmsg(MSG_INFO, "fw_identify: hermon:\n");
            logmsg(MSG_INFO, "\ttempdev @ 0x%lx\n"
                "\t\taccess_devname: %s\n"
                "\t\tdrvname: %s\tclassname: %s\n"
                "\t\tident->vid:   %s\n"
                "\t\tident->pid:   %s\n"
                "\t\tident->revid: %s\n"
                "\t\tindex: %d\n"
                "\t\tguid0: %s\n"
                "\t\tguid1: %s\n"
                "\t\tguid2: %s\n"
                "\t\tguid3: %s\n"
                "\t\tplugin @ 0x%lx\n\n",
                &tempdev,
                tempdev->access_devname,
                tempdev->drvname, newdev->classname,
                tempdev->ident->vid,
                tempdev->ident->pid,
                tempdev->ident->revid,
                tempdev->index,
                (tempdev->addresses[0] ? tempdev->addresses[0] :
                "(not supported)"),
                (tempdev->addresses[1] ? tempdev->addresses[1] :
                "(not supported)"),
                (tempdev->addresses[2] ? tempdev->addresses[2] :
                "(not supported)"),
                (tempdev->addresses[3] ? tempdev->addresses[3] :
                "(not supported)"),
                tempdev->plugin);
        }
    }

    return (FWFLASH_SUCCESS);
}


int
fw_devinfo(struct devicelist *thisdev)
{
    ib_cnx_encap_ident_t    *encap;

    logmsg(MSG_INFO, "hermon: fw_devinfo\n");

    encap = (ib_cnx_encap_ident_t *)thisdev->ident->encap_ident;
    if (CNX_I_CHECK_HANDLE(encap)) {
        logmsg(MSG_ERROR, gettext("hermon: fw_devinfo: Invalid handle "
            "for device %s! \n"), thisdev->access_devname);
        return (FWFLASH_FAILURE);
    }

    /* Try the primary first, then the secondary */
    fprintf(stdout, gettext("Device[%d] %s\n"),
        thisdev->index, thisdev->access_devname);
    fprintf(stdout, gettext("Class [%s]\n"), thisdev->classname);

    fprintf(stdout, "\t");

    /* Mellanox HCA Flash app note, p40, #4.2.3 table 9 */
    fprintf(stdout, gettext("GUID: System Image - %s\n"),
        thisdev->addresses[3]);
    fprintf(stdout, gettext("\t\tNode Image - %s\n"),
        thisdev->addresses[0]);
    fprintf(stdout, gettext("\t\tPort 1\t   - %s\n"),
        thisdev->addresses[1]);
    fprintf(stdout, gettext("\t\tPort 2\t   - %s\n"),
        thisdev->addresses[2]);

    fprintf(stdout, gettext("\tFirmware revision  : %s\n"),
        thisdev->ident->revid);

    if (encap->pn_len != 0) {
        if (strlen(encap->info.mlx_id))
            fprintf(stdout, gettext("\tProduct\t\t   : "
                "%s %X (%s)\n"), encap->info.mlx_pn,
                encap->hwrev, encap->info.mlx_id);
        else
            fprintf(stdout, gettext("\tProduct\t\t   : %s %X\n"),
                encap->info.mlx_pn, encap->hwrev);

        if (strlen(encap->info.mlx_psid))
            fprintf(stdout, gettext("\tPSID\t\t   : %s\n"),
                encap->info.mlx_psid);
        else if (strlen(thisdev->ident->pid))
            fprintf(stdout, gettext("\t%s\n"), thisdev->ident->pid);
    } else {
        fprintf(stdout, gettext("\t%s\n"), thisdev->ident->pid);
    }
    fprintf(stdout, "\n\n");

    return (cnx_close(thisdev));
}


/*
 * Helper functions lurk beneath this point
 */


/*
 * Notes:
 * 1. flash read is done in 32 bit quantities, and the driver returns
 *    data in host byteorder form.
 * 2. flash write is done in 8 bit quantities by the driver.
 * 3. data in the flash should be in network byteorder.
 * 4. data in image files is in network byteorder form.
 * 5. data in image structures in memory is kept in network byteorder.
 * 6. the functions in this file deal with data in host byteorder form.
 */

static int
cnx_read_image(ib_cnx_encap_ident_t *handle)
{
    hermon_flash_ioctl_t    ioctl_info;
    uint32_t        phys_addr;
    int         ret, i;
    int         image_size;
    int         type;

    type = handle->state &
        (FWFLASH_IB_STATE_IMAGE_PRI | FWFLASH_IB_STATE_IMAGE_SEC);
    logmsg(MSG_INFO, "cnx_read_image: type %lx\n", type);

    if (type == 0) {
        logmsg(MSG_ERROR, gettext("cnx_read_image: Must read in "
            "image first\n"));
        return (FWFLASH_FAILURE);
    }

    image_size = handle->fw_sz;
    if (image_size <= 0) {
        logmsg(MSG_ERROR, gettext("cnx_read_image: Invalid image size "
            "0x%x for %s image\n"),
            image_size, (type == 0x1 ? "Primary" : "Secondary"));
        return (FWFLASH_FAILURE);
    }

    logmsg(MSG_INFO, "hermon: fw_size: 0x%x\n", image_size);

    handle->fw = (uint32_t *)calloc(1, image_size);
    if (handle->fw == NULL) {
        logmsg(MSG_ERROR, gettext("cnx_read_image: Unable to allocate "
            "memory for fw_img : (%s)\n"), strerror(errno));
        return (FWFLASH_FAILURE);
    }

    ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;
    for (i = 0; i < image_size; i += 4) {
        phys_addr = cnx_cont2phys(handle->log2_chunk_sz, i, type);
        ioctl_info.af_addr = phys_addr;

        ret = cnx_read_ioctl(handle, &ioctl_info);
        if (ret != 0) {
            logmsg(MSG_ERROR, gettext("cnx_read_image: Failed to "
                "read sector %d\n"), i);
            free(handle->fw);
            return (FWFLASH_FAILURE);
        }
        handle->fw[i / 4] = htonl(ioctl_info.af_quadlet);
    }

    for (i = 0; i < image_size; i += 4) {
        logmsg(MSG_INFO, "cnx_read_image: addr[0x%x] = 0x%08x\n", i,
            ntohl(handle->fw[i / 4]));
    }

    return (FWFLASH_SUCCESS);
}

static int
cnx_write_file(ib_cnx_encap_ident_t *handle, const char *filename)
{
    FILE        *fp;
    int         fd;
    mode_t      mode = S_IRUSR | S_IWUSR;
    int     len;

    logmsg(MSG_INFO, "cnx_write_file\n");

    errno = 0;
    if ((fd = open(filename, O_RDWR|O_CREAT|O_DSYNC, mode)) < 0) {
        logmsg(MSG_ERROR, gettext("hermon: Unable to open specified "
            "file (%s) for writing: %s\n"), filename, strerror(errno));
        return (FWFLASH_FAILURE);
    }

    errno = 0;
    fp = fdopen(fd, "w");
    if (fp == NULL) {
        (void) fprintf(stderr, gettext("hermon: Unknown filename %s : "
            "%s\n"), filename, strerror(errno));
        return (FWFLASH_FAILURE);
    }

    len = ntohl(handle->fw[CNX_IMG_SIZE_OFFSET / 4]);
    logmsg(MSG_INFO, "cnx_write_file: Writing to file. Length 0x%x\n", len);

    if (fwrite(&handle->fw[0], len, 1, fp) == 0) {
        (void) fprintf(stderr, gettext("hermon: fwrite failed"));
        perror("fwrite");
        (void) fclose(fp);
        return (FWFLASH_FAILURE);
    }
    (void) fclose(fp);
    return (FWFLASH_SUCCESS);
}

static int
cnx_verify_image(ib_cnx_encap_ident_t *handle, int type)
{
    uint32_t    new_start_addr;

    logmsg(MSG_INFO, "hermon: cnx_verify_image\n");

    new_start_addr = cnx_cont2phys(handle->log2_chunk_sz, 0, type);

    return (cnx_check_for_magic_pattern(handle, new_start_addr));
}

static int
cnx_set_guids(ib_cnx_encap_ident_t *handle, void *arg)
{
    uint32_t    addr;
    uint32_t    *guids;

    logmsg(MSG_INFO, "hermon: cnx_set_guids\n");

    guids = (uint32_t *)arg;
    addr = ntohl(verifier->fwimage[CNX_NGUIDPTR_OFFSET / 4]) / 4;
    logmsg(MSG_INFO, "cnx_set_guids: guid_start_addr: 0x%x\n", addr * 4);

    /*
     * guids are supplied by callers as 64 bit values in host byteorder.
     * Storage is in network byteorder.
     */
#ifdef _BIG_ENDIAN
    if (handle->state & FWFLASH_IB_STATE_GUIDN) {
        verifier->fwimage[addr] = guids[0];
        verifier->fwimage[addr + 1] = guids[1];
    }

    if (handle->state & FWFLASH_IB_STATE_GUID1) {
        verifier->fwimage[addr + 2] = guids[2];
        verifier->fwimage[addr + 3] = guids[3];
    }

    if (handle->state & FWFLASH_IB_STATE_GUID2) {
        verifier->fwimage[addr + 4] = guids[4];
        verifier->fwimage[addr + 5] = guids[5];
    }

    if (handle->state & FWFLASH_IB_STATE_GUIDS) {
        verifier->fwimage[addr + 6] = guids[6];
        verifier->fwimage[addr + 7] = guids[7];
    }
#else
    if (handle->state & FWFLASH_IB_STATE_GUIDN) {
        verifier->fwimage[addr] = htonl(guids[1]);
        verifier->fwimage[addr + 1] = htonl(guids[0]);
    }

    if (handle->state & FWFLASH_IB_STATE_GUID1) {
        verifier->fwimage[addr + 2] = htonl(guids[3]);
        verifier->fwimage[addr + 3] = htonl(guids[2]);
    }

    if (handle->state & FWFLASH_IB_STATE_GUID2) {
        verifier->fwimage[addr + 4] = htonl(guids[5]);
        verifier->fwimage[addr + 5] = htonl(guids[4]);
    }

    if (handle->state & FWFLASH_IB_STATE_GUIDS) {
        verifier->fwimage[addr + 6] = htonl(guids[7]);
        verifier->fwimage[addr + 7] = htonl(guids[6]);
    }
#endif

    cnx_local_set_guid_crc_img((addr * 4) - 0x10, CNX_GUID_CRC16_SIZE,
        CNX_GUID_CRC16_OFFSET);

    return (FWFLASH_SUCCESS);
}

/*
 * Notes: Burn the image
 *
 * 1. Erase the entire sector where the new image is to be burned.
 * 2. Burn the image WITHOUT the magic pattern. This marks the new image
 *    as invalid during the burn process. If the current image (i.e
 *    containing a magic pattern) on the Flash is stored on the even
 *    chunks (PRIMARY), burn the new image to the odd chunks (SECONDARY),
 *    or vice versa.
 * 3. Burn the magic pattern at the beginning of the new image on the Flash.
 *    This will validate the new image.
 * 4. Set the BootAddress register to its new location.
 */
static int
cnx_write_image(ib_cnx_encap_ident_t *handle, int type)
{
    hermon_flash_ioctl_t    ioctl_info;
    int         sector_size;
    int         size;
    int         i;
    uint32_t        new_start_addr;
    uint32_t        log2_chunk_sz;
    uint8_t         *fw;

    logmsg(MSG_INFO, "hermon: cnx_write_image\n");

    if (type == 0) {
        logmsg(MSG_ERROR, gettext("cnx_write_image: Must inform us "
            " where to write.\n"));
        return (FWFLASH_FAILURE);
    }

    log2_chunk_sz = cnx_get_log2_chunk_size(
        ntohl(verifier->fwimage[CNX_CHUNK_SIZE_OFFSET / 4]));

    sector_size = handle->sector_sz;
    new_start_addr = ((type - 1) << handle->log2_chunk_sz);

    /* Read Image Size */
    size = ntohl(verifier->fwimage[CNX_IMG_SIZE_OFFSET / 4]);
    logmsg(MSG_INFO, "cnx_write_image: fw image size: 0x%x\n", size);

    /* Sectors must be erased before they can be written to. */
    ioctl_info.af_type = HERMON_FLASH_ERASE_SECTOR;
    for (i = 0; i < size; i += sector_size) {
        ioctl_info.af_sector_num =
            cnx_cont2phys(log2_chunk_sz, i, type) / sector_size;
        if (cnx_erase_sector_ioctl(handle, &ioctl_info) != 0) {
            logmsg(MSG_ERROR, gettext("cnx_write_image: Failed to "
                "erase sector 0x%x\n"), ioctl_info.af_sector_num);
            return (FWFLASH_FAILURE);
        }
    }

    fw = (uint8_t *)verifier->fwimage;
    ioctl_info.af_type = HERMON_FLASH_WRITE_BYTE;

    /* Write the new image without the magic pattern */
    for (i = 16; i < size; i++) {
        ioctl_info.af_byte = fw[i];
        ioctl_info.af_addr = cnx_cont2phys(log2_chunk_sz, i, type);
        if (cnx_write_ioctl(handle, &ioctl_info) != 0) {
            logmsg(MSG_ERROR, gettext("cnx_write_image: Failed to "
                "write byte 0x%x\n"), ioctl_info.af_byte);
            return (FWFLASH_FAILURE);
        }

        if (i && !(i % handle->sector_sz)) {
            (void) printf(" .");
            (void) fflush((void *)NULL);
        }
    }

    /* Validate the new image -- Write the magic pattern. */
    for (i = 0; i < 16; i++) {
        ioctl_info.af_byte = fw[i];
        ioctl_info.af_addr = cnx_cont2phys(log2_chunk_sz, i, type);
        if (cnx_write_ioctl(handle, &ioctl_info) != 0) {
            logmsg(MSG_ERROR, gettext("cnx_write_image: Failed to "
                "write magic pattern byte 0x%x\n"),
                ioctl_info.af_byte);
            return (FWFLASH_FAILURE);
        }
    }

    /* Write new image start address to CR space */
    errno = 0;
    ioctl_info.af_addr = new_start_addr;
    if (ioctl(handle->fd, HERMON_IOCTL_WRITE_BOOT_ADDR, &ioctl_info) != 0) {
        logmsg(MSG_WARN, gettext("cnx_write_image: Failed to "
            "update boot address register: %s\n"), strerror(errno));
    }

    return (FWFLASH_SUCCESS);
}


/*
 * cnx_identify performs the following actions:
 *
 *  allocates and assigns thisdev->vpr
 *
 *  allocates space for the 4 GUIDs which each IB device must have
 *  queries the hermon driver for this device's GUIDs
 *
 *  determines the hardware vendor, so that thisdev->vpr->vid
 *  can be set correctly
 */
static int
cnx_identify(struct devicelist *thisdev)
{
    int             fd, ret, i;
    hermon_flash_init_ioctl_t   init_ioctl;
    ib_cnx_encap_ident_t        *manuf;
    cfi_t               cfi;
    int             hw_psid_found = 0;

    logmsg(MSG_INFO, "hermon: cnx_identify\n");
    /* open the device */
    /* hook thisdev->ident->encap_ident to ib_cnx_encap_ident_t */
    /* check that all the bits are sane */
    /* return success, if warranted */

    errno = 0;
    if ((fd = open(thisdev->access_devname, O_RDONLY)) < 0) {
        logmsg(MSG_ERROR, gettext("hermon: Unable to open a %s-"
            "attached device node: %s: %s\n"), drivername,
            thisdev->access_devname, strerror(errno));
        return (FWFLASH_FAILURE);
    }

    if ((manuf = calloc(1, sizeof (ib_cnx_encap_ident_t))) == NULL) {
        logmsg(MSG_ERROR, gettext("hermon: Unable to allocate space "
            "for a %s-attached handle structure\n"), drivername);
        close(fd);
        return (FWFLASH_FAILURE);
    }
    manuf->magic = FWFLASH_IB_MAGIC_NUMBER;
    manuf->state = FWFLASH_IB_STATE_NONE;
    manuf->fd = fd;
    manuf->log2_chunk_sz = 0;

    thisdev->ident->encap_ident = manuf;

    /*
     * Inform driver that this command supports the Intel Extended
     * CFI command set.
     */
    cfi.cfi_char[0x10] = 'M';
    cfi.cfi_char[0x11] = 'X';
    cfi.cfi_char[0x12] = '2';
    init_ioctl.af_cfi_info[0x4] = ntohl(cfi.cfi_int[0x4]);

    errno = 0;
    ret = ioctl(fd, HERMON_IOCTL_FLASH_INIT, &init_ioctl);
    if (ret < 0) {
        logmsg(MSG_ERROR, gettext("hermon: HERMON_IOCTL_FLASH_INIT "
            "failed: %s\n"), strerror(errno));
        close(fd);
        free(manuf);
        return (FWFLASH_FAILURE);
    }

    manuf->hwrev = init_ioctl.af_hwrev;
    logmsg(MSG_INFO, "hermon: init_ioctl: hwrev: %x, fwver: %d.%d.%04d, "
        "PN# Len %d\n", init_ioctl.af_hwrev, init_ioctl.af_fwrev.afi_maj,
        init_ioctl.af_fwrev.afi_min, init_ioctl.af_fwrev.afi_sub,
        init_ioctl.af_pn_len);

    /*
     * Determine whether the attached driver supports the Intel or
     * AMD Extended CFI command sets. If it doesn't support either,
     * then we're hosed, so error out.
     */
    for (i = 0; i < HERMON_FLASH_CFI_SIZE_QUADLET; i++) {
        cfi.cfi_int[i] = ntohl(init_ioctl.af_cfi_info[i]);
    }
    manuf->cmd_set = cfi.cfi_char[0x13];

    if (cfi.cfi_char[0x10] == 'Q' &&
        cfi.cfi_char[0x11] == 'R' &&
        cfi.cfi_char[0x12] == 'Y') {
        /* make sure the cmd set is SPI */
        if (manuf->cmd_set != HERMON_FLASH_SPI_CMDSET) {
            logmsg(MSG_ERROR, gettext("hermon: Unsupported flash "
                "device command set\n"));
            goto identify_end;
        }
        /* set some defaults */
        manuf->sector_sz = HERMON_FLASH_SECTOR_SZ_DEFAULT;
        manuf->device_sz = HERMON_FLASH_DEVICE_SZ_DEFAULT;
    } else if (manuf->cmd_set == HERMON_FLASH_SPI_CMDSET) {
        manuf->sector_sz = HERMON_FLASH_SPI_SECTOR_SIZE;
        manuf->device_sz = HERMON_FLASH_SPI_DEVICE_SIZE;
    } else {
        if (manuf->cmd_set != HERMON_FLASH_AMD_CMDSET &&
            manuf->cmd_set != HERMON_FLASH_INTEL_CMDSET) {
            logmsg(MSG_ERROR, gettext("hermon: Unknown flash "
                "device command set %lx\n"), manuf->cmd_set);
            goto identify_end;
        }
        /* read from the CFI data */
        manuf->sector_sz = ((cfi.cfi_char[0x30] << 8) |
            cfi.cfi_char[0x2F]) << 8;
        manuf->device_sz = 0x1 << cfi.cfi_char[0x27];
    }

    logmsg(MSG_INFO, "hermon: sector_sz: 0x%08x device_sz: 0x%08x\n",
        manuf->sector_sz, manuf->device_sz);

    /* set firmware revision */
    manuf->hwfw_img_info.fw_rev.major = init_ioctl.af_fwrev.afi_maj;
    manuf->hwfw_img_info.fw_rev.minor = init_ioctl.af_fwrev.afi_min;
    manuf->hwfw_img_info.fw_rev.subminor = init_ioctl.af_fwrev.afi_sub;

    if (((thisdev->ident->vid = calloc(1, MLX_VPR_VIDLEN + 1)) == NULL) ||
        ((thisdev->ident->revid = calloc(1, MLX_VPR_REVLEN + 1)) == NULL)) {
        logmsg(MSG_ERROR, gettext("hermon: Unable to allocate space "
            "for a VPR record.\n"));
        goto identify_end;
    }
    (void) strlcpy(thisdev->ident->vid, "MELLANOX", MLX_VPR_VIDLEN);

    /*
     * We actually want the hwrev field from the ioctl above.
     * Until we find out otherwise, add it onto the end of the
     * firmware version details.
     */
    snprintf(thisdev->ident->revid, MLX_VPR_REVLEN, "%d.%d.%03d",
        manuf->hwfw_img_info.fw_rev.major,
        manuf->hwfw_img_info.fw_rev.minor,
        manuf->hwfw_img_info.fw_rev.subminor);

    if ((ret = cnx_get_guids(manuf)) != FWFLASH_SUCCESS) {
        logmsg(MSG_WARN, gettext("hermon: No GUIDs found for "
            "device %s!\n"), thisdev->access_devname);
    }

    /* set hw part number, psid, and name in handle */
    /* now walk the magic decoder ring table */
    manuf->info.mlx_pn = NULL;
    manuf->info.mlx_psid = NULL;
    manuf->info.mlx_id = NULL;

    if (cnx_get_image_info(manuf) != FWFLASH_SUCCESS) {
        logmsg(MSG_WARN, gettext("hermon: Failed to read Image Info "
            "for PSID\n"));
        hw_psid_found = 0;
    } else {
        hw_psid_found = 1;
    }

    if (init_ioctl.af_pn_len != 0) {
        /* part number length */
        for (i = 0; i < init_ioctl.af_pn_len; i++) {
            if (init_ioctl.af_hwpn[i] == ' ') {
                manuf->pn_len = i;
                break;
            }
        }
        if (i == init_ioctl.af_pn_len) {
            manuf->pn_len = init_ioctl.af_pn_len;
        }
    } else {
        logmsg(MSG_INFO, "hermon: Failed to get Part# from hermon "
            "driver \n");
        manuf->pn_len = 0;
    }

    if (manuf->pn_len != 0) {
        errno = 0;
        manuf->info.mlx_pn = calloc(1, manuf->pn_len);
        if (manuf->info.mlx_pn == NULL) {
            logmsg(MSG_ERROR, gettext("hermon: no space available "
                "for the HCA PN record (%s)\n"), strerror(errno));
            goto identify_end;
        }
        (void) memcpy(manuf->info.mlx_pn, init_ioctl.af_hwpn,
            manuf->pn_len);
        manuf->info.mlx_pn[manuf->pn_len] = 0;

        logmsg(MSG_INFO, "hermon: HCA PN (%s) PN-Len %d\n",
            manuf->info.mlx_pn, manuf->pn_len);

        errno = 0;
        manuf->info.mlx_psid = calloc(1, MLX_PSID_SZ);
        if (manuf->info.mlx_psid == NULL) {
            logmsg(MSG_ERROR, gettext("hermon: PSID calloc "
                "failed :%s\n"), strerror(errno));
            goto identify_end;
        }

        errno = 0;
        if ((manuf->info.mlx_id = calloc(1, MLX_STR_ID_SZ)) == NULL) {
            logmsg(MSG_ERROR, gettext("hermon: "
                "ID calloc failed (%s)\n"),
                strerror(errno));
            goto identify_end;
        }

        /* Find part number, set the rest */
        for (i = 0; i < MLX_MAX_ID; i++) {
            if (strncmp((const char *)init_ioctl.af_hwpn,
                mlx_mdr[i].mlx_pn, manuf->pn_len) == 0) {

                if (hw_psid_found) {
                    logmsg(MSG_INFO, "HW-PSID: %s "
                        "MLX_MDR[%d]: %s\n",
                        manuf->hwfw_img_info.psid, i,
                        mlx_mdr[i].mlx_psid);
                    if (strncmp((const char *)
                        manuf->hwfw_img_info.psid,
                        mlx_mdr[i].mlx_psid,
                        MLX_PSID_SZ) != 0)
                        continue;
                }
                /* Set PSID */
                (void) memcpy(manuf->info.mlx_psid,
                    mlx_mdr[i].mlx_psid, MLX_PSID_SZ);
                manuf->info.mlx_psid[MLX_PSID_SZ - 1] = 0;

                logmsg(MSG_INFO, "hermon: HCA PSID (%s)\n",
                    manuf->info.mlx_psid);

                (void) strlcpy(manuf->info.mlx_id,
                    mlx_mdr[i].mlx_id,
                    strlen(mlx_mdr[i].mlx_id) + 1);

                logmsg(MSG_INFO, "hermon: HCA Name (%s)\n",
                    manuf->info.mlx_id);

                break;
            }
        }
    }

    if ((manuf->pn_len == 0) || (i == MLX_MAX_ID)) {
        logmsg(MSG_INFO, "hermon: No hardware part number "
            "information available for this HCA\n");

        i = strlen("No hardware information available for this device");

        thisdev->ident->pid = calloc(1, i + 2);
        sprintf(thisdev->ident->pid, "No additional hardware info "
            "available for this device");
    } else {
        errno = 0;
        if ((thisdev->ident->pid = calloc(1,
            strlen(manuf->info.mlx_psid) + 1)) != NULL) {
            (void) strlcpy(thisdev->ident->pid,
                manuf->info.mlx_psid,
                strlen(manuf->info.mlx_psid) + 1);
        } else {
            logmsg(MSG_ERROR,
                gettext("hermon: Unable to allocate space for a "
                "hardware identifier: %s\n"), strerror(errno));
            goto identify_end;
        }
    }

    for (i = 0; i < 4; i++) {
        errno = 0;
        if ((thisdev->addresses[i] = calloc(1,
            (2 * sizeof (uint64_t)) + 1)) == NULL) {
            logmsg(MSG_ERROR,
                gettext("hermon: Unable to allocate space for a "
                "human-readable HCA guid: %s\n"), strerror(errno));
            goto identify_end;
        }
        (void) sprintf(thisdev->addresses[i], "%016llx",
            manuf->ibguids[i]);
    }

    /*
     * We do NOT close the fd here, since we can close it
     * at the end of the fw_readfw() or fw_writefw() functions
     * instead and not get the poor dear confused about whether
     * it's been inited already.
     */

    return (FWFLASH_SUCCESS);

    /* cleanup */
identify_end:
    cnx_close(thisdev);
    return (FWFLASH_FAILURE);
}

static int
cnx_get_guids(ib_cnx_encap_ident_t *handle)
{
    int i, rv;

    logmsg(MSG_INFO, "cnx_get_guids\n");

    /* make sure we've got our fallback position organised */
    for (i = 0; i < 4; i++) {
        handle->ibguids[i] = 0x00000000;
    }

    rv = cnx_find_magic_n_chnk_sz(handle, FWFLASH_IB_STATE_IMAGE_PRI);
    if (rv != FWFLASH_SUCCESS) {
        logmsg(MSG_INFO, "hermon: Failed to get Primary magic number. "
            "Trying Secondary... \n");
        rv = cnx_find_magic_n_chnk_sz(handle,
            FWFLASH_IB_STATE_IMAGE_SEC);
        if (rv != FWFLASH_SUCCESS) {
            logmsg(MSG_ERROR, gettext("hermon: Failed to get "
                "Secondary magic number.\n"));
            logmsg(MSG_ERROR,
                gettext("Warning: HCA Firmware corrupt.\n"));
            return (FWFLASH_FAILURE);
        }
        rv = cnx_read_guids(handle, FWFLASH_IB_STATE_IMAGE_SEC);
        if (rv != FWFLASH_SUCCESS) {
            logmsg(MSG_ERROR, gettext("hermon: Failed to read "
                "secondary guids.\n"));
            return (FWFLASH_FAILURE);
        }
    } else {
        rv = cnx_read_guids(handle, FWFLASH_IB_STATE_IMAGE_PRI);
        if (rv != FWFLASH_SUCCESS) {
            logmsg(MSG_ERROR, gettext("hermon: Failed to read "
                "primary guids.\n"));
            return (FWFLASH_FAILURE);
        }
    }
    for (i = 0; i < 4; i++) {
        logmsg(MSG_INFO, "hermon: ibguids[%d] 0x%016llx\n", i,
            handle->ibguids[i]);
    }
    for (i = 0; i < 2; i++) {
        logmsg(MSG_INFO, "hermon: ib_portmac[%d] 0x%016llx\n", i,
            handle->ib_mac[i]);
    }

    return (FWFLASH_SUCCESS);
}

static int
cnx_close(struct devicelist *flashdev)
{
    ib_cnx_encap_ident_t    *handle;

    logmsg(MSG_INFO, "cnx_close\n");

    handle = (ib_cnx_encap_ident_t *)flashdev->ident->encap_ident;

    if (CNX_I_CHECK_HANDLE(handle)) {
        logmsg(MSG_ERROR, gettext("hermon: Invalid Handle to close "
            "device %s! \n"), flashdev->access_devname);
        return (FWFLASH_FAILURE);
    }

    if (handle->fd > 0) {
        errno = 0;
        (void) ioctl(handle->fd, HERMON_IOCTL_FLASH_FINI);
        if (close(handle->fd) != 0) {
            logmsg(MSG_ERROR, gettext("hermon: Unable to properly "
                "close device %s! (%s)\n"),
                flashdev->access_devname, strerror(errno));
            return (FWFLASH_FAILURE);
        }
    }

    if (handle != NULL) {
        if (handle->info.mlx_id != NULL)
            free(handle->info.mlx_id);

        if (handle->info.mlx_psid != NULL)
            free(handle->info.mlx_psid);

        if (handle->fw != NULL)
            free(handle->fw);
        free(handle);
    }

    if (flashdev->ident->vid != NULL)
        free(flashdev->ident->vid);

    if (flashdev->ident->revid != NULL)
        free(flashdev->ident->revid);

    return (FWFLASH_SUCCESS);
}


/*
 * Driver read/write ioctl calls.
 */
static int
cnx_read_ioctl(ib_cnx_encap_ident_t *hdl, hermon_flash_ioctl_t *info)
{
    int ret;

#ifdef CNX_DEBUG
    logmsg(MSG_INFO, "cnx_read_ioctl: fd %d af_type 0x%x af_addr 0x%x "
        "af_sector_num(0x%x)\n", hdl->fd, info->af_type,
        info->af_addr, info->af_sector_num);
#endif

    errno = 0;
    ret = ioctl(hdl->fd, HERMON_IOCTL_FLASH_READ, info);
    if (ret != 0) {
        logmsg(MSG_ERROR, gettext("HERMON_IOCTL_FLASH_READ failed "
            "(%s)\n"), strerror(errno));
    }
    return (ret);
}

static int
cnx_write_ioctl(ib_cnx_encap_ident_t *hdl, hermon_flash_ioctl_t *info)
{
    int ret;

#ifdef CNX_DEBUG
    logmsg(MSG_INFO, "cnx_write_ioctl: fd(%d) af_type(0x%x) "
        "af_addr(0x%x) af_sector_num(0x%x) af_byte(0x%x)\n",
        hdl->fd, info->af_type, info->af_addr, info->af_sector_num,
        info->af_byte);
#endif
    errno = 0;
    ret = ioctl(hdl->fd, HERMON_IOCTL_FLASH_WRITE, info);
    if (ret != 0) {
        logmsg(MSG_ERROR, gettext("HERMON_IOCTL_FLASH_WRITE "
            "failed (%s)\n"), strerror(errno));
    }
    return (ret);
}

static int
cnx_erase_sector_ioctl(ib_cnx_encap_ident_t *hdl, hermon_flash_ioctl_t *info)
{
    int ret;

#ifdef CNX_DEBUG
    logmsg(MSG_INFO, "cnx_erase_sector_ioctl: fd(%d) af_type(0x%x) "
        "af_sector_num(0x%x)\n", hdl->fd, info->af_type,
        info->af_sector_num);
#endif
    errno = 0;
    ret = ioctl(hdl->fd, HERMON_IOCTL_FLASH_ERASE, info);
    if (ret != 0) {
        logmsg(MSG_ERROR, gettext("HERMON_IOCTL_FLASH_ERASE "
            "failed (%s)\n"), strerror(errno));
    }
    return (ret);
}

/*
 * cnx_crc16 - computes 16 bit crc of supplied buffer.
 *   image should be in network byteorder
 *   result is returned in host byteorder form
 */
uint16_t
cnx_crc16(uint8_t *image, uint32_t size, int is_image)
{
    const uint16_t  poly = 0x100b;
    uint32_t    crc = 0xFFFF;
    uint32_t    word;
    uint32_t    i, j;

    logmsg(MSG_INFO, "hermon: cnx_crc16\n");

    for (i = 0; i < size / 4; i++) {
        word = (image[4 * i] << 24) |
            (image[4 * i + 1] << 16) |
            (image[4 * i + 2] << 8) |
            (image[4 * i + 3]);

        if (is_image == CNX_HW_IMG)
            word = MLXSWAPBITS32(word);

        for (j = 0; j < 32; j++) {
            if (crc & 0x8000) {
                crc = (((crc << 1) |
                    (word >> 31)) ^ poly) & 0xFFFF;
            } else {
                crc = ((crc << 1) | (word >> 31)) & 0xFFFF;
            }
            word = (word << 1) & 0xFFFFFFFF;
        }
    }

    for (i = 0; i < 16; i++) {
        if (crc & 0x8000) {
            crc = ((crc << 1) ^ poly) & 0xFFFF;
        } else {
            crc = (crc << 1) & 0xFFFF;
        }
    }

    crc = crc ^ 0xFFFF;
    return (crc & 0xFFFF);
}

static void
cnx_local_set_guid_crc_img(uint32_t offset, uint32_t guid_crc_size,
    uint32_t guid_crc_offset)
{
    uint16_t    crc;
    uint8_t     *fw_p = (uint8_t *)&verifier->fwimage[0];

    crc = htons(cnx_crc16((uint8_t *)&verifier->fwimage[offset / 4],
        guid_crc_size, CNX_FILE_IMG));

    logmsg(MSG_INFO, "cnx_local_set_guid_crc_img: new guid_sect crc: %x\n",
        ntohs(crc));
    (void) memcpy(&fw_p[offset + guid_crc_offset], &crc, 2);
}

/*
 * Address translation functions for ConnectX
 * Variable definitions:
 * - log2_chunk_size: log2 of a Flash chunk size
 * - cont_addr: a contiguous image address to be translated
 * - is_image_in_odd_chunk: When this bit is 1, it indicates the new image is
 * stored in odd chunks of the Flash.
 */
static uint32_t
cnx_cont2phys(uint32_t log2_chunk_size, uint32_t cont_addr, int type)
{
    uint32_t    result;
    int     is_image_in_odd_chunks;

    is_image_in_odd_chunks = type - 1;

    if (log2_chunk_size) {
        result = cont_addr & (0xffffffff >> (32 - log2_chunk_size)) |
            (is_image_in_odd_chunks << log2_chunk_size) |
            (cont_addr << 1) & (0xffffffff << (log2_chunk_size + 1));
    } else {
        result = cont_addr;
    }

    return (result);
}

static int
cnx_read_guids(ib_cnx_encap_ident_t *handle, int type)
{
#ifdef _LITTLE_ENDIAN
    uint32_t        *ptr, tmp;
#endif
    hermon_flash_ioctl_t    ioctl_info;
    uint32_t        *guids;
    uint32_t        *ibmac;
    int         ret, i;
    uint32_t        nguidptr_addr;
    union {
        uint8_t     bytes[4];
        uint32_t    dword;
    } crc16_u;
    uint32_t        *guid_structure;
    uint16_t        crc;

    logmsg(MSG_INFO, "cnx_read_guids\n");

    errno = 0;
    guid_structure = (uint32_t *)calloc(1,
        CNX_GUID_CRC16_SIZE / 4 * sizeof (uint32_t));
    if (guid_structure == NULL) {
        logmsg(MSG_WARN, gettext("hermon: Can't calloc guid_structure "
            ": (%s)\n"), strerror(errno));
        return (FWFLASH_FAILURE);
    }

    ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;
    ioctl_info.af_addr = cnx_cont2phys(handle->log2_chunk_sz,
        CNX_NGUIDPTR_OFFSET, type);

    ret = cnx_read_ioctl(handle, &ioctl_info);
    if (ret != 0) {
        logmsg(MSG_WARN, gettext("hermon: Failed to read GUID Pointer "
            "Address\n"));
        goto out;
    }

    guids = (uint32_t *)&handle->ibguids[0];
    ibmac = (uint32_t *)&handle->ib_mac[0];
    nguidptr_addr = cnx_cont2phys(handle->log2_chunk_sz,
        ioctl_info.af_quadlet, type);

    logmsg(MSG_INFO, "NGUIDPTR: 0x%08x \n", nguidptr_addr);
    /* Read in the entire guid section in order to calculate the CRC */
    ioctl_info.af_addr = nguidptr_addr - 0x10;
    ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;

    for (i = 0; i < CNX_GUID_CRC16_SIZE / 4; i++) {
        ret = cnx_read_ioctl(handle, &ioctl_info);
        if (ret != 0) {
            logmsg(MSG_INFO, "Failed to read guid_structure "
                "(0x%x)\n", i);
            goto out;
        }

        if (i >= 4 && i < 12) {
            guids[i - 4] = ioctl_info.af_quadlet;
        }
        if (i >= 12 && i < 16) {
            ibmac[i - 12] = ioctl_info.af_quadlet;
        }

        guid_structure[i] = ioctl_info.af_quadlet;
        ioctl_info.af_addr += 4;
    }

    for (i = 0; i < CNX_GUID_CRC16_SIZE / 4; i++) {
        logmsg(MSG_INFO, "guid_structure[%x] = 0x%08x\n", i,
            guid_structure[i]);
    }

    /*
     * Check the CRC--make sure it computes.
     */

    /* 0x12 subtracted: 0x2 for alignment, 0x10 to reach structure start */
    ioctl_info.af_addr = nguidptr_addr + CNX_GUID_CRC16_OFFSET - 0x12;
    ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;

    ret = cnx_read_ioctl(handle, &ioctl_info);
    if (ret != 0) {
        logmsg(MSG_WARN, gettext("hermon: Failed to read guid crc "
            "at 0x%x\n"), ioctl_info.af_addr);
        goto out;
    }

    crc16_u.dword = ioctl_info.af_quadlet;
    crc = cnx_crc16((uint8_t *)guid_structure, CNX_GUID_CRC16_SIZE,
        CNX_HW_IMG);

    if (crc != crc16_u.dword) {
        logmsg(MSG_WARN, gettext("hermon: calculated crc16: 0x%x "
            "differs from GUID section 0x%x\n"), crc, crc16_u.dword);
    } else {
        logmsg(MSG_INFO, "hermon: calculated crc16: 0x%x MATCHES with "
            "GUID section 0x%x\n", crc, crc16_u.dword);
    }

#ifdef _LITTLE_ENDIAN
    /*
     * guids are read as pairs of 32 bit host byteorder values and treated
     * by callers as 64 bit values. So swap each pair of 32 bit values
     * to make them correct
     */
    ptr = (uint32_t *)guids;
    for (ret = 0; ret < 8; ret += 2) {
        tmp = ptr[ret];
        ptr[ret] = ptr[ret+1];
        ptr[ret+1] = tmp;
    }
    ptr = (uint32_t *)&handle->ib_mac[0];
    for (ret = 0; ret < 4; ret += 2) {
        tmp = ptr[ret];
        ptr[ret] = ptr[ret+1];
        ptr[ret+1] = tmp;
    }
#endif
    ret = FWFLASH_SUCCESS;

out:
    free(guid_structure);
    return (ret);
}

static int
cnx_find_magic_n_chnk_sz(ib_cnx_encap_ident_t *handle, int type)
{
    int i, found = 0;
    uint32_t addr;
    uint32_t boot_addresses[] =
        {0, 0x10000, 0x20000, 0x40000, 0x80000, 0x100000};

    logmsg(MSG_INFO, "cnx_find_magic_n_chnk_sz\n");

    switch (type) {
    case FWFLASH_IB_STATE_IMAGE_PRI:
        addr = 0;
        if (cnx_check_for_magic_pattern(handle, addr) !=
            FWFLASH_SUCCESS) {
            goto err;
        }
        break;

    case FWFLASH_IB_STATE_IMAGE_SEC:
        for (i = 1; i < 6; i++) {
            addr = boot_addresses[i];
            if (cnx_check_for_magic_pattern(handle, addr) ==
                FWFLASH_SUCCESS) {
                found = 1;
                break;
            }
        }
        if (!found) {
            goto err;
        }
        break;

    default:
        logmsg(MSG_INFO, "cnx_find_magic_pattern: unknown type\n");
        goto err;
    }

    logmsg(MSG_INFO, "magic_pattern found at addr %x\n", addr);
    handle->img2_start_addr = addr;

    handle->log2_chunk_sz = cnx_get_log2_chunk_size_f_hdl(handle, type);
    if (handle->log2_chunk_sz == 0) {
        logmsg(MSG_INFO, "no chunk size found for type %x. "
            "Assuming non-failsafe burn\n", type);
    }

    handle->fw_sz = cnx_get_image_size_f_hdl(handle, type);
    if (handle->fw_sz == 0) {
        logmsg(MSG_INFO, "no fw size found for type %x. \n", type);
    }
    handle->state |= type;

    return (FWFLASH_SUCCESS);
err:
    logmsg(MSG_INFO, "no magic_pattern found for type %x\n", type);
    return (FWFLASH_FAILURE);
}

static int
cnx_check_for_magic_pattern(ib_cnx_encap_ident_t *handle, uint32_t addr)
{
    int             i;
    hermon_flash_ioctl_t    ioctl_info;
    int             magic_pattern_buf[4];

    logmsg(MSG_INFO, "cnx_check_for_magic_pattern\n");

    ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;

    for (i = 0; i < 4; i++) {
        ioctl_info.af_addr = addr + (i * sizeof (uint32_t));
        if (cnx_read_ioctl(handle, &ioctl_info) != 0) {
            logmsg(MSG_INFO, "\nFailed to read magic pattern\n");
            return (FWFLASH_FAILURE);
        }

        magic_pattern_buf[i] = ioctl_info.af_quadlet;
    }

    return (cnx_is_magic_pattern_present(magic_pattern_buf, CNX_HW_IMG));

}

int
cnx_is_magic_pattern_present(int *data, int is_image)
{
    int i;
    int dword;

    logmsg(MSG_INFO, "cnx_is_magic_pattern_present\n");

    for (i = 0; i < 4; i++) {
        if (is_image == CNX_FILE_IMG)
            dword = MLXSWAPBITS32(data[i]);
        else
            dword = data[i];
        logmsg(MSG_INFO, "local_quadlet: %08x, magic pattern: %08x\n",
            dword, cnx_magic_pattern[i]);
        if (dword != cnx_magic_pattern[i]) {
            return (FWFLASH_FAILURE);
        }
    }

    return (FWFLASH_SUCCESS);
}

static uint32_t
cnx_get_log2_chunk_size_f_hdl(ib_cnx_encap_ident_t *handle, int type)
{
    hermon_flash_ioctl_t    ioctl_info;
    int         ret;

    logmsg(MSG_INFO, "cnx_get_log2_chunk_size_f_hdl\n");

    /* If chunk size is already set, just return it. */
    if (handle->log2_chunk_sz) {
        return (handle->log2_chunk_sz);
    }

    switch (type) {
    case FWFLASH_IB_STATE_IMAGE_PRI:
        ioctl_info.af_addr = CNX_CHUNK_SIZE_OFFSET;
        break;
    case FWFLASH_IB_STATE_IMAGE_SEC:
        ioctl_info.af_addr =
            handle->img2_start_addr + CNX_CHUNK_SIZE_OFFSET;
        break;
    default:
        logmsg(MSG_INFO,
            "cnx_get_log2_chunk_size_f_hdl: unknown type\n");
        return (0);
    }

    ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;

    ret = cnx_read_ioctl(handle, &ioctl_info);
    if (ret != 0) {
        logmsg(MSG_INFO, "\nFailed to read chunk size\n");
        return (0);
    }

    return (cnx_get_log2_chunk_size(ioctl_info.af_quadlet));
}


static uint32_t
cnx_get_log2_chunk_size(uint32_t chunk_size_word)
{
    uint8_t     checksum;
    uint32_t    log2_chunk_size;

    logmsg(MSG_INFO, "cnx_get_log2_chunk_size: chunk_size_word:"
        " 0x%x\n", chunk_size_word);

    checksum =
        (chunk_size_word & 0xff) +
        ((chunk_size_word >> 8) & 0xff) +
        ((chunk_size_word >> 16) & 0xff) +
        ((chunk_size_word >> 24) & 0xff);

    if (checksum != 0) {
        logmsg(MSG_INFO, "Corrupted chunk size checksum\n");
        return (0);
    }

    if (chunk_size_word & 0x8) {
        log2_chunk_size = (chunk_size_word & 0x7) + 16;
        logmsg(MSG_INFO, "log2 chunk size: 0x%x\n", log2_chunk_size);
        return (log2_chunk_size);
    } else {
        return (0);
    }
}

static uint32_t
cnx_get_image_size_f_hdl(ib_cnx_encap_ident_t *handle, int type)
{
    hermon_flash_ioctl_t    ioctl_info;
    int         ret;

    logmsg(MSG_INFO, "cnx_get_image_size_f_hdl\n");

    ioctl_info.af_addr = cnx_cont2phys(handle->log2_chunk_sz,
        CNX_IMG_SIZE_OFFSET, type);
    ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;

    ret = cnx_read_ioctl(handle, &ioctl_info);
    if (ret != 0) {
        logmsg(MSG_INFO, "Failed to read image size\n");
        return (0);
    }

    logmsg(MSG_INFO, "Image Size: 0x%x\n", ioctl_info.af_quadlet);

    return (ioctl_info.af_quadlet);
}

static int
cnx_get_image_info(ib_cnx_encap_ident_t *handle)
{
    uint32_t    ii_ptr_addr;
    uint32_t    ii_size;
    int     *buf;
    int     i, type;
    hermon_flash_ioctl_t    ioctl_info;

    logmsg(MSG_INFO, "cnx_get_image_info: state %x\n", handle->state);

    type = handle->state &
        (FWFLASH_IB_STATE_IMAGE_PRI | FWFLASH_IB_STATE_IMAGE_SEC);

    /* Get the image info pointer */
    ioctl_info.af_addr = cnx_cont2phys(handle->log2_chunk_sz,
        CNX_IMG_INF_PTR_OFFSET, type);
    ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;

    if (cnx_read_ioctl(handle, &ioctl_info) != FWFLASH_SUCCESS) {
        logmsg(MSG_WARN, gettext("hermon: Failed to read image info "
            "Address\n"));
        return (FWFLASH_FAILURE);
    }
    ii_ptr_addr = ioctl_info.af_quadlet & 0xffffff;

    /* Get the image info size, a negative offset from the image info ptr */
    ioctl_info.af_addr = cnx_cont2phys(handle->log2_chunk_sz,
        ii_ptr_addr + CNX_IMG_INF_SZ_OFFSET, type);
    ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;

    if (cnx_read_ioctl(handle, &ioctl_info) != FWFLASH_SUCCESS) {
        logmsg(MSG_WARN, gettext("hermon: Failed to read image info "
            "size\n"));
        return (FWFLASH_FAILURE);
    }
    logmsg(MSG_INFO, "hermon: ImageInfo Sz: 0x%x\n", ioctl_info.af_quadlet);

    ii_size = ioctl_info.af_quadlet;
    /* size is in dwords--convert it to bytes */
    ii_size *= 4;

    logmsg(MSG_INFO, "hermon: ii_ptr_addr: 0x%x ii_size: 0x%x\n",
        ii_ptr_addr, ii_size);

    buf = (int *)calloc(1, ii_size);

    ioctl_info.af_addr = cnx_cont2phys(handle->log2_chunk_sz,
        ii_ptr_addr, type);
    ioctl_info.af_type = HERMON_FLASH_READ_QUADLET;

    for (i = 0; i < ii_size/4; i++) {
        if (cnx_read_ioctl(handle, &ioctl_info) != FWFLASH_SUCCESS) {
            logmsg(MSG_WARN, gettext("hermon: Failed to read "
                "image info (0x%x)\n"), i);
            free(buf);
            return (FWFLASH_FAILURE);
        }

        buf[i] = ioctl_info.af_quadlet;
        ioctl_info.af_addr += 4;
    }

    /* Parse the image info section */
    if (cnx_parse_img_info(buf, ii_size, &handle->hwfw_img_info,
        CNX_HW_IMG) != FWFLASH_SUCCESS) {
        logmsg(MSG_WARN, gettext("hermon: Failed to parse Image Info "
            "section\n"));
        free(buf);
        return (FWFLASH_FAILURE);
    }

    free(buf);
    return (FWFLASH_SUCCESS);
}

int
cnx_parse_img_info(int *buf, uint32_t byte_size, cnx_img_info_t *img_info,
    int is_image)
{
    uint32_t    *p;
    uint32_t    offs = 0;
    uint32_t    tag_num = 0;
    int         end_found = 0;
    uint32_t    tag_size, tag_id;
    uint32_t    tmp;
    const char  *str;
    int     i;

    p = (uint32_t *)buf;

    logmsg(MSG_INFO, "hermon: cnx_parse_img_info\n");

    while (!end_found && (offs < byte_size)) {
        if (is_image == CNX_FILE_IMG) {
            tag_size = ntohl(*p) & 0xffffff;
            tag_id = ntohl(*p) >> 24;
            tmp = ntohl(*(p + 1));
        } else {
            tag_size = ((*p) & 0xffffff);
            tag_id = ((*p) >> 24);
            tmp = (*(p + 1));
        }

        logmsg(MSG_INFO, "tag_id: %d tag_size: %d\n", tag_id, tag_size);

        if ((offs + tag_size) > byte_size) {
            logmsg(MSG_WARN, gettext("hermon: Image Info section "
                "corrupted: Tag# %d - tag_id %d, size %d exceeds "
                "info section size (%d bytes)"), tag_num, tag_id,
                tag_size, byte_size);
            return (FWFLASH_FAILURE);
        }

        switch (tag_id) {
        case CNX_FW_VER:
            if (tag_size != CNX_FW_VER_SZ) {
                logmsg(MSG_INFO, "ERROR: tag_id: %d tag_size: "
                    "%d expected sz %d\n", tag_id, tag_size,
                    CNX_FW_VER_SZ);
            }
            tmp = (tmp & CNX_MASK_FW_VER_MAJ) >> 16;
            img_info->fw_rev.major = tmp;
            if (is_image == CNX_FILE_IMG)
                tmp = ntohl(*(p + 2));
            else
                tmp = (*(p + 2));
            img_info->fw_rev.minor =
                (tmp & CNX_MASK_FW_VER_MIN)>> 16;
            img_info->fw_rev.subminor =
                tmp & CNX_MASK_FW_VER_SUBMIN;

            logmsg(MSG_INFO, "FW_VER: %d.%d.%03d\n",
                img_info->fw_rev.major, img_info->fw_rev.minor,
                img_info->fw_rev.subminor);
            break;

        case CNX_FW_BUILD_TIME:
            if (tag_size != CNX_FW_BUILD_TIME_SZ) {
                logmsg(MSG_INFO, "ERROR: tag_id: %d tag_size: "
                    "%d expected sz %d\n", tag_id, tag_size,
                    CNX_FW_BUILD_TIME_SZ);
            }
            img_info->fw_buildtime.hour =
                (tmp & CNX_MASK_FW_BUILD_HOUR) >> 16;
            img_info->fw_buildtime.minute =
                (tmp & CNX_MASK_FW_BUILD_MIN) >> 8;
            img_info->fw_buildtime.second =
                (tmp & CNX_MASK_FW_BUILD_SEC);

            if (is_image == CNX_FILE_IMG)
                tmp = ntohl(*(p + 2));
            else
                tmp = (*(p + 2));

            img_info->fw_buildtime.year =
                (tmp & CNX_MASK_FW_BUILD_YEAR) >> 16;
            img_info->fw_buildtime.month =
                (tmp & CNX_MASK_FW_BUILD_MON) >> 8;
            img_info->fw_buildtime.day =
                (tmp & CNX_MASK_FW_BUILD_DAY);

            logmsg(MSG_INFO, "Build TIME: %d:%d:%d %d:%d:%d\n",
                img_info->fw_buildtime.year,
                img_info->fw_buildtime.month,
                img_info->fw_buildtime.day,
                img_info->fw_buildtime.hour,
                img_info->fw_buildtime.minute,
                img_info->fw_buildtime.second);
            break;

        case CNX_DEV_TYPE:
            if (tag_size != CNX_DEV_TYPE_SZ) {
                logmsg(MSG_INFO, "ERROR: tag_id: %d tag_size: "
                    "%d expected sz %d\n", tag_id, tag_size,
                    CNX_DEV_TYPE_SZ);
            }
            img_info->dev_id = tmp & CNX_MASK_DEV_TYPE_ID;
            logmsg(MSG_INFO, "DEV_TYPE: %d\n", img_info->dev_id);
            break;

        case CNX_VSD_VENDOR_ID:
            if (tag_size != CNX_VSD_VENDOR_ID_SZ) {
                logmsg(MSG_INFO, "ERROR: tag_id: %d tag_size: "
                    "%d expected sz %d\n", tag_id, tag_size,
                    CNX_VSD_VENDOR_ID_SZ);
            }
            img_info->vsd_vendor_id = tmp & CNX_MASK_VSD_VENDORID;
            logmsg(MSG_INFO, "VSD Vendor ID: 0x%lX\n",
                img_info->vsd_vendor_id);
            break;

        case CNX_PSID:
            if (tag_size != CNX_PSID_SZ) {
                logmsg(MSG_INFO, "ERROR: tag_id: %d tag_size: "
                    "%d expected sz %d\n", tag_id, tag_size,
                    CNX_PSID_SZ);
            }
            str = (const char *)p;
            str += 4;

            for (i = 0; i < CNX_PSID_SZ; i++)
                img_info->psid[i] = str[i];

#ifdef _LITTLE_ENDIAN
            if (is_image == CNX_HW_IMG) {
                for (i = 0; i < CNX_PSID_SZ; i += 4) {
                    img_info->psid[i+3] = str[i];
                    img_info->psid[i+2] = str[i+1];
                    img_info->psid[i+1] = str[i+2];
                    img_info->psid[i] = str[i+3];
                }
            }
#endif

            logmsg(MSG_INFO, "PSID: %s\n", img_info->psid);
            break;

        case CNX_VSD:
            if (tag_size != CNX_VSD_SZ) {
                logmsg(MSG_INFO, "ERROR: tag_id: %d tag_size: "
                    "%d expected sz %d\n", tag_id, tag_size,
                    CNX_VSD_SZ);
            }
            str = (const char *)p;
            str += 4;

            for (i = 0; i < CNX_VSD_SZ; i++)
                img_info->vsd[i] = str[i];

#ifdef _LITTLE_ENDIAN
            if (is_image == CNX_HW_IMG) {
                for (i = 0; i < CNX_VSD_SZ; i += 4) {
                    img_info->vsd[i+3] = str[i];
                    img_info->vsd[i+2] = str[i+1];
                    img_info->vsd[i+1] = str[i+2];
                    img_info->vsd[i] = str[i+3];
                }
            }
#endif
            logmsg(MSG_INFO, "VSD: %s\n", img_info->vsd);
            break;

        case CNX_END_TAG:
            if (tag_size != CNX_END_TAG_SZ) {
                logmsg(MSG_INFO, "ERROR: tag_id: %d tag_size: "
                    "%d expected sz %d\n", tag_id, tag_size,
                    CNX_END_TAG_SZ);
            }
            end_found = 1;
            break;

        default:
            if (tag_id > CNX_END_TAG) {
                logmsg(MSG_WARN, gettext("Invalid img_info "
                    "tag ID %d of size %d\n"), tag_id,
                    tag_size);
            }
            break;
        }

        p += (tag_size / 4) + 1;
        offs += tag_size + 4;
        tag_num++;
    }

    if (offs != byte_size) {
        logmsg(MSG_WARN, gettext("hermon: Corrupt Image Info section "
            "in firmware image\n"));
        if (end_found) {
            logmsg(MSG_WARN, gettext("Info section corrupted: "
                "Section data size is %x bytes, but end tag found "
                "after %x bytes.\n"), byte_size, offs);
        } else {
            logmsg(MSG_WARN, gettext("Info section corrupted: "
                "Section data size is %x bytes, but end tag not "
                "found at section end.\n"), byte_size);
        }
        return (FWFLASH_FAILURE);
    }

    return (FWFLASH_SUCCESS);
}