1 /*
2  * Copyright 1994, 1995, 2000 Neil Russell.
3  * (See License)
4  * Copyright 2000, 2001 DENX Software Engineering, Wolfgang Denk, wd@denx.de
5  * Copyright 2011 Comelit Group SpA,
6  *                Luca Ceresoli <luca.ceresoli@comelit.it>
7  */
8 #include <common.h>
9 #include <command.h>
10 #include <efi_loader.h>
11 #include <env.h>
12 #include <image.h>
13 #include <lmb.h>
14 #include <log.h>
15 #include <mapmem.h>
16 #include <net.h>
17 #include <asm/global_data.h>
18 #include <net/tftp.h>
19 #include "bootp.h"
20 #ifdef CONFIG_SYS_DIRECT_FLASH_TFTP
21 #include <flash.h>
22 #endif
23 
24 DECLARE_GLOBAL_DATA_PTR;
25 
26 /* Well known TFTP port # */
27 #define WELL_KNOWN_PORT	69
28 /* Millisecs to timeout for lost pkt */
29 #define TIMEOUT		5000UL
30 #ifndef	CONFIG_NET_RETRY_COUNT
31 /* # of timeouts before giving up */
32 # define TIMEOUT_COUNT	10
33 #else
34 # define TIMEOUT_COUNT  (CONFIG_NET_RETRY_COUNT * 2)
35 #endif
36 /* Number of "loading" hashes per line (for checking the image size) */
37 #define HASHES_PER_LINE	65
38 
39 /*
40  *	TFTP operations.
41  */
42 #define TFTP_RRQ	1
43 #define TFTP_WRQ	2
44 #define TFTP_DATA	3
45 #define TFTP_ACK	4
46 #define TFTP_ERROR	5
47 #define TFTP_OACK	6
48 
49 static ulong timeout_ms = TIMEOUT;
50 static int timeout_count_max = TIMEOUT_COUNT;
51 static ulong time_start;   /* Record time we started tftp */
52 
53 /*
54  * These globals govern the timeout behavior when attempting a connection to a
55  * TFTP server. tftp_timeout_ms specifies the number of milliseconds to
56  * wait for the server to respond to initial connection. Second global,
57  * tftp_timeout_count_max, gives the number of such connection retries.
58  * tftp_timeout_count_max must be non-negative and tftp_timeout_ms must be
59  * positive. The globals are meant to be set (and restored) by code needing
60  * non-standard timeout behavior when initiating a TFTP transfer.
61  */
62 ulong tftp_timeout_ms = TIMEOUT;
63 int tftp_timeout_count_max = TIMEOUT_COUNT;
64 
65 enum {
66 	TFTP_ERR_UNDEFINED           = 0,
67 	TFTP_ERR_FILE_NOT_FOUND      = 1,
68 	TFTP_ERR_ACCESS_DENIED       = 2,
69 	TFTP_ERR_DISK_FULL           = 3,
70 	TFTP_ERR_UNEXPECTED_OPCODE   = 4,
71 	TFTP_ERR_UNKNOWN_TRANSFER_ID  = 5,
72 	TFTP_ERR_FILE_ALREADY_EXISTS = 6,
73 	TFTP_ERR_OPTION_NEGOTIATION = 8,
74 };
75 
76 static struct in_addr tftp_remote_ip;
77 /* The UDP port at their end */
78 static int	tftp_remote_port;
79 /* The UDP port at our end */
80 static int	tftp_our_port;
81 static int	timeout_count;
82 /* packet sequence number */
83 static ulong	tftp_cur_block;
84 /* last packet sequence number received */
85 static ulong	tftp_prev_block;
86 /* count of sequence number wraparounds */
87 static ulong	tftp_block_wrap;
88 /* memory offset due to wrapping */
89 static ulong	tftp_block_wrap_offset;
90 static int	tftp_state;
91 static ulong	tftp_load_addr;
92 #ifdef CONFIG_LMB
93 static ulong	tftp_load_size;
94 #endif
95 #ifdef CONFIG_TFTP_TSIZE
96 /* The file size reported by the server */
97 static int	tftp_tsize;
98 /* The number of hashes we printed */
99 static short	tftp_tsize_num_hash;
100 #endif
101 /* The window size negotiated */
102 static ushort	tftp_windowsize;
103 /* Next block to send ack to */
104 static ushort	tftp_next_ack;
105 /* Last nack block we send */
106 static ushort	tftp_last_nack;
107 #ifdef CONFIG_CMD_TFTPPUT
108 /* 1 if writing, else 0 */
109 static int	tftp_put_active;
110 /* 1 if we have sent the last block */
111 static int	tftp_put_final_block_sent;
112 #else
113 #define tftp_put_active	0
114 #endif
115 
116 #define STATE_SEND_RRQ	1
117 #define STATE_DATA	2
118 #define STATE_TOO_LARGE	3
119 #define STATE_BAD_MAGIC	4
120 #define STATE_OACK	5
121 #define STATE_RECV_WRQ	6
122 #define STATE_SEND_WRQ	7
123 #define STATE_INVALID_OPTION	8
124 
125 /* default TFTP block size */
126 #define TFTP_BLOCK_SIZE		512
127 /* sequence number is 16 bit */
128 #define TFTP_SEQUENCE_SIZE	((ulong)(1<<16))
129 
130 #define DEFAULT_NAME_LEN	(8 + 4 + 1)
131 static char default_filename[DEFAULT_NAME_LEN];
132 
133 #ifndef CONFIG_TFTP_FILE_NAME_MAX_LEN
134 #define MAX_LEN 128
135 #else
136 #define MAX_LEN CONFIG_TFTP_FILE_NAME_MAX_LEN
137 #endif
138 
139 static char tftp_filename[MAX_LEN];
140 
141 /* 512 is poor choice for ethernet, MTU is typically 1500.
142  * Minus eth.hdrs thats 1468.  Can get 2x better throughput with
143  * almost-MTU block sizes.  At least try... fall back to 512 if need be.
144  * (but those using CONFIG_IP_DEFRAG may want to set a larger block in cfg file)
145  */
146 
147 /* When windowsize is defined to 1,
148  * tftp behaves the same way as it was
149  * never declared
150  */
151 #ifdef CONFIG_TFTP_WINDOWSIZE
152 #define TFTP_WINDOWSIZE CONFIG_TFTP_WINDOWSIZE
153 #else
154 #define TFTP_WINDOWSIZE 1
155 #endif
156 
157 static unsigned short tftp_block_size = TFTP_BLOCK_SIZE;
158 static unsigned short tftp_block_size_option = CONFIG_TFTP_BLOCKSIZE;
159 static unsigned short tftp_window_size_option = TFTP_WINDOWSIZE;
160 
store_block(int block,uchar * src,unsigned int len)161 static inline int store_block(int block, uchar *src, unsigned int len)
162 {
163 	ulong offset = block * tftp_block_size + tftp_block_wrap_offset -
164 			tftp_block_size;
165 	ulong newsize = offset + len;
166 	ulong store_addr = tftp_load_addr + offset;
167 #ifdef CONFIG_SYS_DIRECT_FLASH_TFTP
168 	int i, rc = 0;
169 
170 	for (i = 0; i < CONFIG_SYS_MAX_FLASH_BANKS; i++) {
171 		/* start address in flash? */
172 		if (flash_info[i].flash_id == FLASH_UNKNOWN)
173 			continue;
174 		if (store_addr >= flash_info[i].start[0]) {
175 			rc = 1;
176 			break;
177 		}
178 	}
179 
180 	if (rc) { /* Flash is destination for this packet */
181 		rc = flash_write((char *)src, store_addr, len);
182 		if (rc) {
183 			flash_perror(rc);
184 			return rc;
185 		}
186 	} else
187 #endif /* CONFIG_SYS_DIRECT_FLASH_TFTP */
188 	{
189 		void *ptr;
190 
191 #ifdef CONFIG_LMB
192 		ulong end_addr = tftp_load_addr + tftp_load_size;
193 
194 		if (!end_addr)
195 			end_addr = ULONG_MAX;
196 
197 		if (store_addr < tftp_load_addr ||
198 		    store_addr + len > end_addr) {
199 			puts("\nTFTP error: ");
200 			puts("trying to overwrite reserved memory...\n");
201 			return -1;
202 		}
203 #endif
204 		ptr = map_sysmem(store_addr, len);
205 		memcpy(ptr, src, len);
206 		unmap_sysmem(ptr);
207 	}
208 
209 	if (net_boot_file_size < newsize)
210 		net_boot_file_size = newsize;
211 
212 	return 0;
213 }
214 
215 /* Clear our state ready for a new transfer */
new_transfer(void)216 static void new_transfer(void)
217 {
218 	tftp_prev_block = 0;
219 	tftp_block_wrap = 0;
220 	tftp_block_wrap_offset = 0;
221 #ifdef CONFIG_CMD_TFTPPUT
222 	tftp_put_final_block_sent = 0;
223 #endif
224 }
225 
226 #ifdef CONFIG_CMD_TFTPPUT
227 /**
228  * Load the next block from memory to be sent over tftp.
229  *
230  * @param block	Block number to send
231  * @param dst	Destination buffer for data
232  * @param len	Number of bytes in block (this one and every other)
233  * @return number of bytes loaded
234  */
load_block(unsigned block,uchar * dst,unsigned len)235 static int load_block(unsigned block, uchar *dst, unsigned len)
236 {
237 	/* We may want to get the final block from the previous set */
238 	ulong offset = block * tftp_block_size + tftp_block_wrap_offset -
239 		       tftp_block_size;
240 	ulong tosend = len;
241 
242 	tosend = min(net_boot_file_size - offset, tosend);
243 	(void)memcpy(dst, (void *)(image_save_addr + offset), tosend);
244 	debug("%s: block=%u, offset=%lu, len=%u, tosend=%lu\n", __func__,
245 	      block, offset, len, tosend);
246 	return tosend;
247 }
248 #endif
249 
250 static void tftp_send(void);
251 static void tftp_timeout_handler(void);
252 
253 /**********************************************************************/
254 
show_block_marker(void)255 static void show_block_marker(void)
256 {
257 	ulong pos;
258 
259 #ifdef CONFIG_TFTP_TSIZE
260 	if (tftp_tsize) {
261 		pos = tftp_cur_block * tftp_block_size +
262 			tftp_block_wrap_offset;
263 		if (pos > tftp_tsize)
264 			pos = tftp_tsize;
265 
266 		while (tftp_tsize_num_hash < pos * 50 / tftp_tsize) {
267 			putc('#');
268 			tftp_tsize_num_hash++;
269 		}
270 	} else
271 #endif
272 	{
273 		pos = (tftp_cur_block - 1) +
274 			(tftp_block_wrap * TFTP_SEQUENCE_SIZE);
275 		if ((pos % 10) == 0)
276 			putc('#');
277 		else if (((pos + 1) % (10 * HASHES_PER_LINE)) == 0)
278 			puts("\n\t ");
279 	}
280 }
281 
282 /**
283  * restart the current transfer due to an error
284  *
285  * @param msg	Message to print for user
286  */
restart(const char * msg)287 static void restart(const char *msg)
288 {
289 	printf("\n%s; starting again\n", msg);
290 	net_start_again();
291 }
292 
293 /*
294  * Check if the block number has wrapped, and update progress
295  *
296  * TODO: The egregious use of global variables in this file should be tidied.
297  */
update_block_number(void)298 static void update_block_number(void)
299 {
300 	/*
301 	 * RFC1350 specifies that the first data packet will
302 	 * have sequence number 1. If we receive a sequence
303 	 * number of 0 this means that there was a wrap
304 	 * around of the (16 bit) counter.
305 	 */
306 	if (tftp_cur_block == 0 && tftp_prev_block != 0) {
307 		tftp_block_wrap++;
308 		tftp_block_wrap_offset += tftp_block_size * TFTP_SEQUENCE_SIZE;
309 		timeout_count = 0; /* we've done well, reset the timeout */
310 	}
311 	show_block_marker();
312 }
313 
314 /* The TFTP get or put is complete */
tftp_complete(void)315 static void tftp_complete(void)
316 {
317 #ifdef CONFIG_TFTP_TSIZE
318 	/* Print hash marks for the last packet received */
319 	while (tftp_tsize && tftp_tsize_num_hash < 49) {
320 		putc('#');
321 		tftp_tsize_num_hash++;
322 	}
323 	puts("  ");
324 	print_size(tftp_tsize, "");
325 #endif
326 	time_start = get_timer(time_start);
327 	if (time_start > 0) {
328 		puts("\n\t ");	/* Line up with "Loading: " */
329 		print_size(net_boot_file_size /
330 			time_start * 1000, "/s");
331 	}
332 	puts("\ndone\n");
333 	if (IS_ENABLED(CONFIG_CMD_BOOTEFI)) {
334 		if (!tftp_put_active)
335 			efi_set_bootdev("Net", "", tftp_filename,
336 					map_sysmem(tftp_load_addr, 0),
337 					net_boot_file_size);
338 	}
339 	net_set_state(NETLOOP_SUCCESS);
340 }
341 
tftp_send(void)342 static void tftp_send(void)
343 {
344 	uchar *pkt;
345 	uchar *xp;
346 	int len = 0;
347 	ushort *s;
348 	bool err_pkt = false;
349 
350 	/*
351 	 *	We will always be sending some sort of packet, so
352 	 *	cobble together the packet headers now.
353 	 */
354 	pkt = net_tx_packet + net_eth_hdr_size() + IP_UDP_HDR_SIZE;
355 
356 	switch (tftp_state) {
357 	case STATE_SEND_RRQ:
358 	case STATE_SEND_WRQ:
359 		xp = pkt;
360 		s = (ushort *)pkt;
361 #ifdef CONFIG_CMD_TFTPPUT
362 		*s++ = htons(tftp_state == STATE_SEND_RRQ ? TFTP_RRQ :
363 			TFTP_WRQ);
364 #else
365 		*s++ = htons(TFTP_RRQ);
366 #endif
367 		pkt = (uchar *)s;
368 		strcpy((char *)pkt, tftp_filename);
369 		pkt += strlen(tftp_filename) + 1;
370 		strcpy((char *)pkt, "octet");
371 		pkt += 5 /*strlen("octet")*/ + 1;
372 		strcpy((char *)pkt, "timeout");
373 		pkt += 7 /*strlen("timeout")*/ + 1;
374 		sprintf((char *)pkt, "%lu", timeout_ms / 1000);
375 		debug("send option \"timeout %s\"\n", (char *)pkt);
376 		pkt += strlen((char *)pkt) + 1;
377 #ifdef CONFIG_TFTP_TSIZE
378 		pkt += sprintf((char *)pkt, "tsize%c%u%c",
379 				0, net_boot_file_size, 0);
380 #endif
381 		/* try for more effic. blk size */
382 		pkt += sprintf((char *)pkt, "blksize%c%d%c",
383 				0, tftp_block_size_option, 0);
384 
385 		/* try for more effic. window size.
386 		 * Implemented only for tftp get.
387 		 * Don't bother sending if it's 1
388 		 */
389 		if (tftp_state == STATE_SEND_RRQ && tftp_window_size_option > 1)
390 			pkt += sprintf((char *)pkt, "windowsize%c%d%c",
391 					0, tftp_window_size_option, 0);
392 		len = pkt - xp;
393 		break;
394 
395 	case STATE_OACK:
396 
397 	case STATE_RECV_WRQ:
398 	case STATE_DATA:
399 		xp = pkt;
400 		s = (ushort *)pkt;
401 		s[0] = htons(TFTP_ACK);
402 		s[1] = htons(tftp_cur_block);
403 		pkt = (uchar *)(s + 2);
404 #ifdef CONFIG_CMD_TFTPPUT
405 		if (tftp_put_active) {
406 			int toload = tftp_block_size;
407 			int loaded = load_block(tftp_cur_block, pkt, toload);
408 
409 			s[0] = htons(TFTP_DATA);
410 			pkt += loaded;
411 			tftp_put_final_block_sent = (loaded < toload);
412 		}
413 #endif
414 		len = pkt - xp;
415 		break;
416 
417 	case STATE_TOO_LARGE:
418 		xp = pkt;
419 		s = (ushort *)pkt;
420 		*s++ = htons(TFTP_ERROR);
421 			*s++ = htons(3);
422 
423 		pkt = (uchar *)s;
424 		strcpy((char *)pkt, "File too large");
425 		pkt += 14 /*strlen("File too large")*/ + 1;
426 		len = pkt - xp;
427 		err_pkt = true;
428 		break;
429 
430 	case STATE_BAD_MAGIC:
431 		xp = pkt;
432 		s = (ushort *)pkt;
433 		*s++ = htons(TFTP_ERROR);
434 		*s++ = htons(2);
435 		pkt = (uchar *)s;
436 		strcpy((char *)pkt, "File has bad magic");
437 		pkt += 18 /*strlen("File has bad magic")*/ + 1;
438 		len = pkt - xp;
439 		err_pkt = true;
440 		break;
441 
442 	case STATE_INVALID_OPTION:
443 		xp = pkt;
444 		s = (ushort *)pkt;
445 		*s++ = htons(TFTP_ERROR);
446 		*s++ = htons(TFTP_ERR_OPTION_NEGOTIATION);
447 		pkt = (uchar *)s;
448 		strcpy((char *)pkt, "Option Negotiation Failed");
449 		/* strlen("Option Negotiation Failed") + NULL*/
450 		pkt += 25 + 1;
451 		len = pkt - xp;
452 		err_pkt = true;
453 		break;
454 	}
455 
456 	net_send_udp_packet(net_server_ethaddr, tftp_remote_ip,
457 			    tftp_remote_port, tftp_our_port, len);
458 
459 	if (err_pkt)
460 		net_set_state(NETLOOP_FAIL);
461 }
462 
463 #ifdef CONFIG_CMD_TFTPPUT
icmp_handler(unsigned type,unsigned code,unsigned dest,struct in_addr sip,unsigned src,uchar * pkt,unsigned len)464 static void icmp_handler(unsigned type, unsigned code, unsigned dest,
465 			 struct in_addr sip, unsigned src, uchar *pkt,
466 			 unsigned len)
467 {
468 	if (type == ICMP_NOT_REACH && code == ICMP_NOT_REACH_PORT) {
469 		/* Oh dear the other end has gone away */
470 		restart("TFTP server died");
471 	}
472 }
473 #endif
474 
tftp_handler(uchar * pkt,unsigned dest,struct in_addr sip,unsigned src,unsigned len)475 static void tftp_handler(uchar *pkt, unsigned dest, struct in_addr sip,
476 			 unsigned src, unsigned len)
477 {
478 	__be16 proto;
479 	__be16 *s;
480 	int i;
481 	u16 timeout_val_rcvd;
482 
483 	if (dest != tftp_our_port) {
484 			return;
485 	}
486 	if (tftp_state != STATE_SEND_RRQ && src != tftp_remote_port &&
487 	    tftp_state != STATE_RECV_WRQ && tftp_state != STATE_SEND_WRQ)
488 		return;
489 
490 	if (len < 2)
491 		return;
492 	len -= 2;
493 	/* warning: don't use increment (++) in ntohs() macros!! */
494 	s = (__be16 *)pkt;
495 	proto = *s++;
496 	pkt = (uchar *)s;
497 	switch (ntohs(proto)) {
498 	case TFTP_RRQ:
499 		break;
500 
501 	case TFTP_ACK:
502 #ifdef CONFIG_CMD_TFTPPUT
503 		if (tftp_put_active) {
504 			if (tftp_put_final_block_sent) {
505 				tftp_complete();
506 			} else {
507 				/*
508 				 * Move to the next block. We want our block
509 				 * count to wrap just like the other end!
510 				 */
511 				int block = ntohs(*s);
512 				int ack_ok = (tftp_cur_block == block);
513 
514 				tftp_prev_block = tftp_cur_block;
515 				tftp_cur_block = (unsigned short)(block + 1);
516 				update_block_number();
517 				if (ack_ok)
518 					tftp_send(); /* Send next data block */
519 			}
520 		}
521 #endif
522 		break;
523 
524 	default:
525 		break;
526 
527 #ifdef CONFIG_CMD_TFTPSRV
528 	case TFTP_WRQ:
529 		debug("Got WRQ\n");
530 		tftp_remote_ip = sip;
531 		tftp_remote_port = src;
532 		tftp_our_port = 1024 + (get_timer(0) % 3072);
533 		new_transfer();
534 		tftp_send(); /* Send ACK(0) */
535 		break;
536 #endif
537 
538 	case TFTP_OACK:
539 		debug("Got OACK: ");
540 		for (i = 0; i < len; i++) {
541 			if (pkt[i] == '\0')
542 				debug(" ");
543 			else
544 				debug("%c", pkt[i]);
545 		}
546 		debug("\n");
547 		tftp_state = STATE_OACK;
548 		tftp_remote_port = src;
549 		/*
550 		 * Check for 'blksize' option.
551 		 * Careful: "i" is signed, "len" is unsigned, thus
552 		 * something like "len-8" may give a *huge* number
553 		 */
554 		for (i = 0; i+8 < len; i++) {
555 			if (strcasecmp((char *)pkt + i, "blksize") == 0) {
556 				tftp_block_size = (unsigned short)
557 					simple_strtoul((char *)pkt + i + 8,
558 						       NULL, 10);
559 				debug("Blocksize oack: %s, %d\n",
560 				      (char *)pkt + i + 8, tftp_block_size);
561 				if (tftp_block_size > tftp_block_size_option) {
562 					printf("Invalid blk size(=%d)\n",
563 					       tftp_block_size);
564 					tftp_state = STATE_INVALID_OPTION;
565 				}
566 			}
567 			if (strcasecmp((char *)pkt + i, "timeout") == 0) {
568 				timeout_val_rcvd = (unsigned short)
569 					simple_strtoul((char *)pkt + i + 8,
570 						       NULL, 10);
571 				debug("Timeout oack: %s, %d\n",
572 				      (char *)pkt + i + 8, timeout_val_rcvd);
573 				if (timeout_val_rcvd != (timeout_ms / 1000)) {
574 					printf("Invalid timeout val(=%d s)\n",
575 					       timeout_val_rcvd);
576 					tftp_state = STATE_INVALID_OPTION;
577 				}
578 			}
579 #ifdef CONFIG_TFTP_TSIZE
580 			if (strcasecmp((char *)pkt + i, "tsize") == 0) {
581 				tftp_tsize = simple_strtoul((char *)pkt + i + 6,
582 							   NULL, 10);
583 				debug("size = %s, %d\n",
584 				      (char *)pkt + i + 6, tftp_tsize);
585 			}
586 #endif
587 			if (strcasecmp((char *)pkt + i,  "windowsize") == 0) {
588 				tftp_windowsize =
589 					simple_strtoul((char *)pkt + i + 11,
590 						       NULL, 10);
591 				debug("windowsize = %s, %d\n",
592 				      (char *)pkt + i + 11, tftp_windowsize);
593 			}
594 		}
595 
596 		tftp_next_ack = tftp_windowsize;
597 
598 #ifdef CONFIG_CMD_TFTPPUT
599 		if (tftp_put_active && tftp_state == STATE_OACK) {
600 			/* Get ready to send the first block */
601 			tftp_state = STATE_DATA;
602 			tftp_cur_block++;
603 		}
604 #endif
605 		tftp_send(); /* Send ACK or first data block */
606 		break;
607 	case TFTP_DATA:
608 		if (len < 2)
609 			return;
610 		len -= 2;
611 
612 		if (ntohs(*(__be16 *)pkt) != (ushort)(tftp_cur_block + 1)) {
613 			debug("Received unexpected block: %d, expected: %d\n",
614 			      ntohs(*(__be16 *)pkt),
615 			      (ushort)(tftp_cur_block + 1));
616 			/*
617 			 * If one packet is dropped most likely
618 			 * all other buffers in the window
619 			 * that will arrive will cause a sending NACK.
620 			 * This just overwellms the server, let's just send one.
621 			 */
622 			if (tftp_last_nack != tftp_cur_block) {
623 				tftp_send();
624 				tftp_last_nack = tftp_cur_block;
625 				tftp_next_ack = (ushort)(tftp_cur_block +
626 							 tftp_windowsize);
627 			}
628 			break;
629 		}
630 
631 		tftp_cur_block++;
632 		tftp_cur_block %= TFTP_SEQUENCE_SIZE;
633 
634 		if (tftp_state == STATE_SEND_RRQ) {
635 			debug("Server did not acknowledge any options!\n");
636 			tftp_next_ack = tftp_windowsize;
637 		}
638 
639 		if (tftp_state == STATE_SEND_RRQ || tftp_state == STATE_OACK ||
640 		    tftp_state == STATE_RECV_WRQ) {
641 			/* first block received */
642 			tftp_state = STATE_DATA;
643 			tftp_remote_port = src;
644 			new_transfer();
645 
646 			if (tftp_cur_block != 1) {	/* Assertion */
647 				puts("\nTFTP error: ");
648 				printf("First block is not block 1 (%ld)\n",
649 				       tftp_cur_block);
650 				puts("Starting again\n\n");
651 				net_start_again();
652 				break;
653 			}
654 		}
655 
656 		if (tftp_cur_block == tftp_prev_block) {
657 			/* Same block again; ignore it. */
658 			break;
659 		}
660 
661 		update_block_number();
662 		tftp_prev_block = tftp_cur_block;
663 		timeout_count_max = tftp_timeout_count_max;
664 		net_set_timeout_handler(timeout_ms, tftp_timeout_handler);
665 
666 		if (store_block(tftp_cur_block, pkt + 2, len)) {
667 			eth_halt();
668 			net_set_state(NETLOOP_FAIL);
669 			break;
670 		}
671 
672 		if (len < tftp_block_size) {
673 			tftp_send();
674 			tftp_complete();
675 			break;
676 		}
677 
678 		/*
679 		 *	Acknowledge the block just received, which will prompt
680 		 *	the remote for the next one.
681 		 */
682 		if (tftp_cur_block == tftp_next_ack) {
683 			tftp_send();
684 			tftp_next_ack += tftp_windowsize;
685 		}
686 		break;
687 
688 	case TFTP_ERROR:
689 		printf("\nTFTP error: '%s' (%d)\n",
690 		       pkt + 2, ntohs(*(__be16 *)pkt));
691 
692 		switch (ntohs(*(__be16 *)pkt)) {
693 		case TFTP_ERR_FILE_NOT_FOUND:
694 		case TFTP_ERR_ACCESS_DENIED:
695 			puts("Not retrying...\n");
696 			eth_halt();
697 			net_set_state(NETLOOP_FAIL);
698 			break;
699 		case TFTP_ERR_UNDEFINED:
700 		case TFTP_ERR_DISK_FULL:
701 		case TFTP_ERR_UNEXPECTED_OPCODE:
702 		case TFTP_ERR_UNKNOWN_TRANSFER_ID:
703 		case TFTP_ERR_FILE_ALREADY_EXISTS:
704 		default:
705 			puts("Starting again\n\n");
706 			net_start_again();
707 			break;
708 		}
709 		break;
710 	}
711 }
712 
713 
tftp_timeout_handler(void)714 static void tftp_timeout_handler(void)
715 {
716 	if (++timeout_count > timeout_count_max) {
717 		restart("Retry count exceeded");
718 	} else {
719 		puts("T ");
720 		net_set_timeout_handler(timeout_ms, tftp_timeout_handler);
721 		if (tftp_state != STATE_RECV_WRQ)
722 			tftp_send();
723 	}
724 }
725 
726 /* Initialize tftp_load_addr and tftp_load_size from image_load_addr and lmb */
tftp_init_load_addr(void)727 static int tftp_init_load_addr(void)
728 {
729 #ifdef CONFIG_LMB
730 	struct lmb lmb;
731 	phys_size_t max_size;
732 
733 	lmb_init_and_reserve(&lmb, gd->bd, (void *)gd->fdt_blob);
734 
735 	max_size = lmb_get_free_size(&lmb, image_load_addr);
736 	if (!max_size)
737 		return -1;
738 
739 	tftp_load_size = max_size;
740 #endif
741 	tftp_load_addr = image_load_addr;
742 	return 0;
743 }
744 
tftp_start(enum proto_t protocol)745 void tftp_start(enum proto_t protocol)
746 {
747 #if CONFIG_NET_TFTP_VARS
748 	char *ep;             /* Environment pointer */
749 
750 	/*
751 	 * Allow the user to choose TFTP blocksize and timeout.
752 	 * TFTP protocol has a minimal timeout of 1 second.
753 	 */
754 
755 	ep = env_get("tftpblocksize");
756 	if (ep != NULL)
757 		tftp_block_size_option = simple_strtol(ep, NULL, 10);
758 
759 	ep = env_get("tftpwindowsize");
760 	if (ep != NULL)
761 		tftp_window_size_option = simple_strtol(ep, NULL, 10);
762 
763 	ep = env_get("tftptimeout");
764 	if (ep != NULL)
765 		timeout_ms = simple_strtol(ep, NULL, 10);
766 
767 	if (timeout_ms < 1000) {
768 		printf("TFTP timeout (%ld ms) too low, set min = 1000 ms\n",
769 		       timeout_ms);
770 		timeout_ms = 1000;
771 	}
772 
773 	ep = env_get("tftptimeoutcountmax");
774 	if (ep != NULL)
775 		tftp_timeout_count_max = simple_strtol(ep, NULL, 10);
776 
777 	if (tftp_timeout_count_max < 0) {
778 		printf("TFTP timeout count max (%d ms) negative, set to 0\n",
779 		       tftp_timeout_count_max);
780 		tftp_timeout_count_max = 0;
781 	}
782 #endif
783 
784 	debug("TFTP blocksize = %i, TFTP windowsize = %d timeout = %ld ms\n",
785 	      tftp_block_size_option, tftp_window_size_option, timeout_ms);
786 
787 	tftp_remote_ip = net_server_ip;
788 	if (!net_parse_bootfile(&tftp_remote_ip, tftp_filename, MAX_LEN)) {
789 		sprintf(default_filename, "%02X%02X%02X%02X.img",
790 			net_ip.s_addr & 0xFF,
791 			(net_ip.s_addr >>  8) & 0xFF,
792 			(net_ip.s_addr >> 16) & 0xFF,
793 			(net_ip.s_addr >> 24) & 0xFF);
794 
795 		strncpy(tftp_filename, default_filename, DEFAULT_NAME_LEN);
796 		tftp_filename[DEFAULT_NAME_LEN - 1] = 0;
797 
798 		printf("*** Warning: no boot file name; using '%s'\n",
799 		       tftp_filename);
800 	}
801 
802 	printf("Using %s device\n", eth_get_name());
803 	printf("TFTP %s server %pI4; our IP address is %pI4",
804 #ifdef CONFIG_CMD_TFTPPUT
805 	       protocol == TFTPPUT ? "to" : "from",
806 #else
807 	       "from",
808 #endif
809 	       &tftp_remote_ip, &net_ip);
810 
811 	/* Check if we need to send across this subnet */
812 	if (net_gateway.s_addr && net_netmask.s_addr) {
813 		struct in_addr our_net;
814 		struct in_addr remote_net;
815 
816 		our_net.s_addr = net_ip.s_addr & net_netmask.s_addr;
817 		remote_net.s_addr = tftp_remote_ip.s_addr & net_netmask.s_addr;
818 		if (our_net.s_addr != remote_net.s_addr)
819 			printf("; sending through gateway %pI4", &net_gateway);
820 	}
821 	putc('\n');
822 
823 	printf("Filename '%s'.", tftp_filename);
824 
825 	if (net_boot_file_expected_size_in_blocks) {
826 		printf(" Size is 0x%x Bytes = ",
827 		       net_boot_file_expected_size_in_blocks << 9);
828 		print_size(net_boot_file_expected_size_in_blocks << 9, "");
829 	}
830 
831 	putc('\n');
832 #ifdef CONFIG_CMD_TFTPPUT
833 	tftp_put_active = (protocol == TFTPPUT);
834 	if (tftp_put_active) {
835 		printf("Save address: 0x%lx\n", image_save_addr);
836 		printf("Save size:    0x%lx\n", image_save_size);
837 		net_boot_file_size = image_save_size;
838 		puts("Saving: *\b");
839 		tftp_state = STATE_SEND_WRQ;
840 		new_transfer();
841 	} else
842 #endif
843 	{
844 		if (tftp_init_load_addr()) {
845 			eth_halt();
846 			net_set_state(NETLOOP_FAIL);
847 			puts("\nTFTP error: ");
848 			puts("trying to overwrite reserved memory...\n");
849 			return;
850 		}
851 		printf("Load address: 0x%lx\n", tftp_load_addr);
852 		puts("Loading: *\b");
853 		tftp_state = STATE_SEND_RRQ;
854 	}
855 
856 	time_start = get_timer(0);
857 	timeout_count_max = tftp_timeout_count_max;
858 
859 	net_set_timeout_handler(timeout_ms, tftp_timeout_handler);
860 	net_set_udp_handler(tftp_handler);
861 #ifdef CONFIG_CMD_TFTPPUT
862 	net_set_icmp_handler(icmp_handler);
863 #endif
864 	tftp_remote_port = WELL_KNOWN_PORT;
865 	timeout_count = 0;
866 	/* Use a pseudo-random port unless a specific port is set */
867 	tftp_our_port = 1024 + (get_timer(0) % 3072);
868 
869 #ifdef CONFIG_TFTP_PORT
870 	ep = env_get("tftpdstp");
871 	if (ep != NULL)
872 		tftp_remote_port = simple_strtol(ep, NULL, 10);
873 	ep = env_get("tftpsrcp");
874 	if (ep != NULL)
875 		tftp_our_port = simple_strtol(ep, NULL, 10);
876 #endif
877 	tftp_cur_block = 0;
878 	tftp_windowsize = 1;
879 	tftp_last_nack = 0;
880 	/* zero out server ether in case the server ip has changed */
881 	memset(net_server_ethaddr, 0, 6);
882 	/* Revert tftp_block_size to dflt */
883 	tftp_block_size = TFTP_BLOCK_SIZE;
884 #ifdef CONFIG_TFTP_TSIZE
885 	tftp_tsize = 0;
886 	tftp_tsize_num_hash = 0;
887 #endif
888 
889 	tftp_send();
890 }
891 
892 #ifdef CONFIG_CMD_TFTPSRV
tftp_start_server(void)893 void tftp_start_server(void)
894 {
895 	tftp_filename[0] = 0;
896 
897 	if (tftp_init_load_addr()) {
898 		eth_halt();
899 		net_set_state(NETLOOP_FAIL);
900 		puts("\nTFTP error: trying to overwrite reserved memory...\n");
901 		return;
902 	}
903 	printf("Using %s device\n", eth_get_name());
904 	printf("Listening for TFTP transfer on %pI4\n", &net_ip);
905 	printf("Load address: 0x%lx\n", tftp_load_addr);
906 
907 	puts("Loading: *\b");
908 
909 	timeout_count_max = tftp_timeout_count_max;
910 	timeout_count = 0;
911 	timeout_ms = TIMEOUT;
912 	net_set_timeout_handler(timeout_ms, tftp_timeout_handler);
913 
914 	/* Revert tftp_block_size to dflt */
915 	tftp_block_size = TFTP_BLOCK_SIZE;
916 	tftp_cur_block = 0;
917 	tftp_our_port = WELL_KNOWN_PORT;
918 
919 #ifdef CONFIG_TFTP_TSIZE
920 	tftp_tsize = 0;
921 	tftp_tsize_num_hash = 0;
922 #endif
923 
924 	tftp_state = STATE_RECV_WRQ;
925 	net_set_udp_handler(tftp_handler);
926 
927 	/* zero out server ether in case the server ip has changed */
928 	memset(net_server_ethaddr, 0, 6);
929 }
930 #endif /* CONFIG_CMD_TFTPSRV */
931 
932