net/tftp.c

   1 /*
   2  * Copyright 1994, 1995, 2000 Neil Russell.
   3  * (See License)
   4  * Copyright 2000, 2001 DENX Software Engineering, Wolfgang Denk, [email protected]
   5  * Copyright 2011 Comelit Group SpA,
   6  *                Luca Ceresoli <[email protected]>
   7  */
   8 #include <command.h>
   9 #include <display_options.h>
  10 #include <efi_loader.h>
  11 #include <env.h>
  12 #include <image.h>
  13 #include <led.h>
  14 #include <lmb.h>
  15 #include <log.h>
  16 #include <mapmem.h>
  17 #include <net.h>
  18 #include <net6.h>
  19 #include <asm/global_data.h>
  20 #include <net/tftp.h>
  21 #include "bootp.h"
  22
  23 DECLARE_GLOBAL_DATA_PTR;
  24
  25 /* Well known TFTP port # */
  26 #define WELL_KNOWN_PORT 69
  27 /* Millisecs to timeout for lost pkt */
  28 #define TIMEOUT         5000UL
  29 /* Number of "loading" hashes per line (for checking the image size) */
  30 #define HASHES_PER_LINE 65
  31
  32 /*
  33  *      TFTP operations.
  34  */
  35 #define TFTP_RRQ        1
  36 #define TFTP_WRQ        2
  37 #define TFTP_DATA       3
  38 #define TFTP_ACK        4
  39 #define TFTP_ERROR      5
  40 #define TFTP_OACK       6
  41
  42 static ulong timeout_ms = TIMEOUT;
  43 static int timeout_count_max = (CONFIG_NET_RETRY_COUNT * 2);
  44 static ulong time_start;   /* Record time we started tftp */
  45 static struct in6_addr tftp_remote_ip6;
  46
  47 /*
  48  * These globals govern the timeout behavior when attempting a connection to a
  49  * TFTP server. tftp_timeout_ms specifies the number of milliseconds to
  50  * wait for the server to respond to initial connection. Second global,
  51  * tftp_timeout_count_max, gives the number of such connection retries.
  52  * tftp_timeout_count_max must be non-negative and tftp_timeout_ms must be
  53  * positive. The globals are meant to be set (and restored) by code needing
  54  * non-standard timeout behavior when initiating a TFTP transfer.
  55  */
  56 ulong tftp_timeout_ms = TIMEOUT;
  57 int tftp_timeout_count_max = (CONFIG_NET_RETRY_COUNT * 2);
  58
  59 enum {
  60         TFTP_ERR_UNDEFINED           = 0,
  61         TFTP_ERR_FILE_NOT_FOUND      = 1,
  62         TFTP_ERR_ACCESS_DENIED       = 2,
  63         TFTP_ERR_DISK_FULL           = 3,
  64         TFTP_ERR_UNEXPECTED_OPCODE   = 4,
  65         TFTP_ERR_UNKNOWN_TRANSFER_ID  = 5,
  66         TFTP_ERR_FILE_ALREADY_EXISTS = 6,
  67         TFTP_ERR_OPTION_NEGOTIATION = 8,
  68 };
  69
  70 static struct in_addr tftp_remote_ip;
  71 /* The UDP port at their end */
  72 static int      tftp_remote_port;
  73 /* The UDP port at our end */
  74 static int      tftp_our_port;
  75 static int      timeout_count;
  76 /* packet sequence number */
  77 static ulong    tftp_cur_block;
  78 /* last packet sequence number received */
  79 static ulong    tftp_prev_block;
  80 /* count of sequence number wraparounds */
  81 static ulong    tftp_block_wrap;
  82 /* memory offset due to wrapping */
  83 static ulong    tftp_block_wrap_offset;
  84 static int      tftp_state;
  85 static ulong    tftp_load_addr;
  86 #ifdef CONFIG_TFTP_TSIZE
  87 /* The file size reported by the server */
  88 static int      tftp_tsize;
  89 /* The number of hashes we printed */
  90 static short    tftp_tsize_num_hash;
  91 #endif
  92 /* The window size negotiated */
  93 static ushort   tftp_windowsize;
  94 /* Next block to send ack to */
  95 static ushort   tftp_next_ack;
  96 /* Last nack block we send */
  97 static ushort   tftp_last_nack;
  98 #ifdef CONFIG_CMD_TFTPPUT
  99 /* 1 if writing, else 0 */
 100 static int      tftp_put_active;
 101 /* 1 if we have sent the last block */
 102 static int      tftp_put_final_block_sent;
 103 #else
 104 #define tftp_put_active 0
 105 #endif
 106
 107 #define STATE_SEND_RRQ  1
 108 #define STATE_DATA      2
 109 #define STATE_TOO_LARGE 3
 110 #define STATE_BAD_MAGIC 4
 111 #define STATE_OACK      5
 112 #define STATE_RECV_WRQ  6
 113 #define STATE_SEND_WRQ  7
 114 #define STATE_INVALID_OPTION    8
 115
 116 /* default TFTP block size */
 117 #define TFTP_BLOCK_SIZE         512
 118 #define TFTP_MTU_BLOCKSIZE6 (CONFIG_TFTP_BLOCKSIZE - 20)
 119 /* sequence number is 16 bit */
 120 #define TFTP_SEQUENCE_SIZE      ((ulong)(1<<16))
 121
 122 #define DEFAULT_NAME_LEN        (8 + 4 + 1)
 123 static char default_filename[DEFAULT_NAME_LEN];
 124
 125 #ifndef CONFIG_TFTP_FILE_NAME_MAX_LEN
 126 #define MAX_LEN 128
 127 #else
 128 #define MAX_LEN CONFIG_TFTP_FILE_NAME_MAX_LEN
 129 #endif
 130
 131 static char tftp_filename[MAX_LEN];
 132
 133 /* 512 is poor choice for ethernet, MTU is typically 1500.
 134  * Minus eth.hdrs thats 1468.  Can get 2x better throughput with
 135  * almost-MTU block sizes.  At least try... fall back to 512 if need be.
 136  * (but those using CONFIG_IP_DEFRAG may want to set a larger block in cfg file)
 137  */
 138
 139 /* When windowsize is defined to 1,
 140  * tftp behaves the same way as it was
 141  * never declared
 142  */
 143 #ifdef CONFIG_TFTP_WINDOWSIZE
 144 #define TFTP_WINDOWSIZE CONFIG_TFTP_WINDOWSIZE
 145 #else
 146 #define TFTP_WINDOWSIZE 1
 147 #endif
 148
 149 static unsigned short tftp_block_size = TFTP_BLOCK_SIZE;
 150 static unsigned short tftp_block_size_option = CONFIG_TFTP_BLOCKSIZE;
 151 static unsigned short tftp_window_size_option = TFTP_WINDOWSIZE;
 152
 153 static inline int store_block(int block, uchar *src, unsigned int len)
 154 {
 155         ulong offset = block * tftp_block_size + tftp_block_wrap_offset -
 156                         tftp_block_size;
 157         ulong newsize = offset + len;
 158         ulong store_addr = tftp_load_addr + offset;
 159         void *ptr;
 160
 161         if (CONFIG_IS_ENABLED(LMB)) {
 162                 if (store_addr < tftp_load_addr ||
 163                     lmb_read_check(store_addr, len)) {
 164                         puts("\nTFTP error: ");
 165                         puts("trying to overwrite reserved memory...\n");
 166                         return -1;
 167                 }
 168         }
 169
 170         ptr = map_sysmem(store_addr, len);
 171         memcpy(ptr, src, len);
 172         unmap_sysmem(ptr);
 173
 174         if (net_boot_file_size < newsize)
 175                 net_boot_file_size = newsize;
 176
 177         return 0;
 178 }
 179
 180 /* Clear our state ready for a new transfer */
 181 static void new_transfer(void)
 182 {
 183         tftp_prev_block = 0;
 184         tftp_block_wrap = 0;
 185         tftp_block_wrap_offset = 0;
 186 #ifdef CONFIG_CMD_TFTPPUT
 187         tftp_put_final_block_sent = 0;
 188 #endif
 189         led_activity_blink();
 190 }
 191
 192 #ifdef CONFIG_CMD_TFTPPUT
 193 /**
 194  * Load the next block from memory to be sent over tftp.
 195  *
 196  * @param block Block number to send
 197  * @param dst   Destination buffer for data
 198  * @param len   Number of bytes in block (this one and every other)
 199  * Return: number of bytes loaded
 200  */
 201 static int load_block(unsigned block, uchar *dst, unsigned len)
 202 {
 203         /* We may want to get the final block from the previous set */
 204         ulong offset = block * tftp_block_size + tftp_block_wrap_offset -
 205                        tftp_block_size;
 206         ulong tosend = len;
 207
 208         tosend = min(net_boot_file_size - offset, tosend);
 209         (void)memcpy(dst, (void *)(image_save_addr + offset), tosend);
 210         debug("%s: block=%u, offset=%lu, len=%u, tosend=%lu\n", __func__,
 211               block, offset, len, tosend);
 212         return tosend;
 213 }
 214 #endif
 215
 216 static void tftp_send(void);
 217 static void tftp_timeout_handler(void);
 218
 219 /**********************************************************************/
 220
 221 static void show_block_marker(void)
 222 {
 223         ulong pos;
 224
 225 #ifdef CONFIG_TFTP_TSIZE
 226         if (tftp_tsize) {
 227                 pos = tftp_cur_block * tftp_block_size +
 228                         tftp_block_wrap_offset;
 229                 if (pos > tftp_tsize)
 230                         pos = tftp_tsize;
 231
 232                 while (tftp_tsize_num_hash < pos * 50 / tftp_tsize) {
 233                         putc('#');
 234                         tftp_tsize_num_hash++;
 235                 }
 236         } else
 237 #endif
 238         {
 239                 pos = (tftp_cur_block - 1) +
 240                         (tftp_block_wrap * TFTP_SEQUENCE_SIZE);
 241                 if ((pos % 10) == 0)
 242                         putc('#');
 243                 else if (((pos + 1) % (10 * HASHES_PER_LINE)) == 0)
 244                         puts("\n\t ");
 245         }
 246 }
 247
 248 /**
 249  * restart the current transfer due to an error
 250  *
 251  * @param msg   Message to print for user
 252  */
 253 static void restart(const char *msg)
 254 {
 255         printf("\n%s; starting again\n", msg);
 256         net_start_again();
 257 }
 258
 259 /*
 260  * Check if the block number has wrapped, and update progress
 261  *
 262  * TODO: The egregious use of global variables in this file should be tidied.
 263  */
 264 static void update_block_number(void)
 265 {
 266         /*
 267          * RFC1350 specifies that the first data packet will
 268          * have sequence number 1. If we receive a sequence
 269          * number of 0 this means that there was a wrap
 270          * around of the (16 bit) counter.
 271          */
 272         if (tftp_cur_block == 0 && tftp_prev_block != 0) {
 273                 tftp_block_wrap++;
 274                 tftp_block_wrap_offset += tftp_block_size * TFTP_SEQUENCE_SIZE;
 275                 timeout_count = 0; /* we've done well, reset the timeout */
 276         }
 277         show_block_marker();
 278 }
 279
 280 /* The TFTP get or put is complete */
 281 static void tftp_complete(void)
 282 {
 283 #ifdef CONFIG_TFTP_TSIZE
 284         /* Print hash marks for the last packet received */
 285         while (tftp_tsize && tftp_tsize_num_hash < 49) {
 286                 putc('#');
 287                 tftp_tsize_num_hash++;
 288         }
 289         puts("  ");
 290         print_size(tftp_tsize, "");
 291 #endif
 292         time_start = get_timer(time_start);
 293         if (time_start > 0) {
 294                 puts("\n\t ");  /* Line up with "Loading: " */
 295                 print_size(net_boot_file_size /
 296                         time_start * 1000, "/s");
 297         }
 298         puts("\ndone\n");
 299
 300         led_activity_off();
 301
 302         if (!tftp_put_active)
 303                 efi_set_bootdev("Net", "", tftp_filename,
 304                                 map_sysmem(tftp_load_addr, 0),
 305                                 net_boot_file_size);
 306         net_set_state(NETLOOP_SUCCESS);
 307 }
 308
 309 static void tftp_send(void)
 310 {
 311         uchar *pkt;
 312         uchar *xp;
 313         int len = 0;
 314         ushort *s;
 315         bool err_pkt = false;
 316
 317         /*
 318          *      We will always be sending some sort of packet, so
 319          *      cobble together the packet headers now.
 320          */
 321         if (IS_ENABLED(CONFIG_IPV6) && use_ip6)
 322                 pkt = net_tx_packet + net_eth_hdr_size() +
 323                       IP6_HDR_SIZE + UDP_HDR_SIZE;
 324         else
 325                 pkt = net_tx_packet + net_eth_hdr_size() + IP_UDP_HDR_SIZE;
 326
 327         switch (tftp_state) {
 328         case STATE_SEND_RRQ:
 329         case STATE_SEND_WRQ:
 330                 xp = pkt;
 331                 s = (ushort *)pkt;
 332 #ifdef CONFIG_CMD_TFTPPUT
 333                 *s++ = htons(tftp_state == STATE_SEND_RRQ ? TFTP_RRQ :
 334                         TFTP_WRQ);
 335 #else
 336                 *s++ = htons(TFTP_RRQ);
 337 #endif
 338                 pkt = (uchar *)s;
 339                 strcpy((char *)pkt, tftp_filename);
 340                 pkt += strlen(tftp_filename) + 1;
 341                 strcpy((char *)pkt, "octet");
 342                 pkt += 5 /*strlen("octet")*/ + 1;
 343                 strcpy((char *)pkt, "timeout");
 344                 pkt += 7 /*strlen("timeout")*/ + 1;
 345                 sprintf((char *)pkt, "%lu", timeout_ms / 1000);
 346                 debug("send option \"timeout %s\"\n", (char *)pkt);
 347                 pkt += strlen((char *)pkt) + 1;
 348 #ifdef CONFIG_TFTP_TSIZE
 349                 pkt += sprintf((char *)pkt, "tsize%c%u%c",
 350                                 0, net_boot_file_size, 0);
 351 #endif
 352                 /* try for more effic. blk size */
 353                 pkt += sprintf((char *)pkt, "blksize%c%d%c",
 354                                 0, tftp_block_size_option, 0);
 355
 356                 /* try for more effic. window size.
 357                  * Implemented only for tftp get.
 358                  * Don't bother sending if it's 1
 359                  */
 360                 if (tftp_state == STATE_SEND_RRQ && tftp_window_size_option > 1)
 361                         pkt += sprintf((char *)pkt, "windowsize%c%d%c",
 362                                         0, tftp_window_size_option, 0);
 363                 len = pkt - xp;
 364                 break;
 365
 366         case STATE_OACK:
 367
 368         case STATE_RECV_WRQ:
 369         case STATE_DATA:
 370                 xp = pkt;
 371                 s = (ushort *)pkt;
 372                 s[0] = htons(TFTP_ACK);
 373                 s[1] = htons(tftp_cur_block);
 374                 pkt = (uchar *)(s + 2);
 375 #ifdef CONFIG_CMD_TFTPPUT
 376                 if (tftp_put_active) {
 377                         int toload = tftp_block_size;
 378                         int loaded = load_block(tftp_cur_block, pkt, toload);
 379
 380                         s[0] = htons(TFTP_DATA);
 381                         pkt += loaded;
 382                         tftp_put_final_block_sent = (loaded < toload);
 383                 }
 384 #endif
 385                 len = pkt - xp;
 386                 break;
 387
 388         case STATE_TOO_LARGE:
 389                 xp = pkt;
 390                 s = (ushort *)pkt;
 391                 *s++ = htons(TFTP_ERROR);
 392                         *s++ = htons(3);
 393
 394                 pkt = (uchar *)s;
 395                 strcpy((char *)pkt, "File too large");
 396                 pkt += 14 /*strlen("File too large")*/ + 1;
 397                 len = pkt - xp;
 398                 err_pkt = true;
 399                 break;
 400
 401         case STATE_BAD_MAGIC:
 402                 xp = pkt;
 403                 s = (ushort *)pkt;
 404                 *s++ = htons(TFTP_ERROR);
 405                 *s++ = htons(2);
 406                 pkt = (uchar *)s;
 407                 strcpy((char *)pkt, "File has bad magic");
 408                 pkt += 18 /*strlen("File has bad magic")*/ + 1;
 409                 len = pkt - xp;
 410                 err_pkt = true;
 411                 break;
 412
 413         case STATE_INVALID_OPTION:
 414                 xp = pkt;
 415                 s = (ushort *)pkt;
 416                 *s++ = htons(TFTP_ERROR);
 417                 *s++ = htons(TFTP_ERR_OPTION_NEGOTIATION);
 418                 pkt = (uchar *)s;
 419                 strcpy((char *)pkt, "Option Negotiation Failed");
 420                 /* strlen("Option Negotiation Failed") + NULL*/
 421                 pkt += 25 + 1;
 422                 len = pkt - xp;
 423                 err_pkt = true;
 424                 break;
 425         }
 426
 427         if (IS_ENABLED(CONFIG_IPV6) && use_ip6)
 428                 net_send_udp_packet6(net_server_ethaddr,
 429                                      &tftp_remote_ip6,
 430                                      tftp_remote_port,
 431                                      tftp_our_port, len);
 432         else
 433                 net_send_udp_packet(net_server_ethaddr, tftp_remote_ip,
 434                                     tftp_remote_port, tftp_our_port, len);
 435
 436         if (err_pkt)
 437                 net_set_state(NETLOOP_FAIL);
 438 }
 439
 440 #ifdef CONFIG_CMD_TFTPPUT
 441 static void icmp_handler(unsigned type, unsigned code, unsigned dest,
 442                          struct in_addr sip, unsigned src, uchar *pkt,
 443                          unsigned len)
 444 {
 445         if (type == ICMP_NOT_REACH && code == ICMP_NOT_REACH_PORT) {
 446                 /* Oh dear the other end has gone away */
 447                 restart("TFTP server died");
 448         }
 449 }
 450 #endif
 451
 452 static void tftp_handler(uchar *pkt, unsigned dest, struct in_addr sip,
 453                          unsigned src, unsigned len)
 454 {
 455         __be16 proto;
 456         __be16 *s;
 457         int i;
 458         u16 timeout_val_rcvd;
 459
 460         if (dest != tftp_our_port) {
 461                         return;
 462         }
 463         if (tftp_state != STATE_SEND_RRQ && src != tftp_remote_port &&
 464             tftp_state != STATE_RECV_WRQ && tftp_state != STATE_SEND_WRQ)
 465                 return;
 466
 467         if (len < 2)
 468                 return;
 469         len -= 2;
 470         /* warning: don't use increment (++) in ntohs() macros!! */
 471         s = (__be16 *)pkt;
 472         proto = *s++;
 473         pkt = (uchar *)s;
 474         switch (ntohs(proto)) {
 475         case TFTP_RRQ:
 476                 break;
 477
 478         case TFTP_ACK:
 479 #ifdef CONFIG_CMD_TFTPPUT
 480                 if (tftp_put_active) {
 481                         if (tftp_put_final_block_sent) {
 482                                 tftp_complete();
 483                         } else {
 484                                 /*
 485                                  * Move to the next block. We want our block
 486                                  * count to wrap just like the other end!
 487                                  */
 488                                 int block = ntohs(*s);
 489                                 int ack_ok = (tftp_cur_block == block);
 490
 491                                 tftp_prev_block = tftp_cur_block;
 492                                 tftp_cur_block = (unsigned short)(block + 1);
 493                                 update_block_number();
 494                                 if (ack_ok) {
 495                                         if (block == 0 &&
 496                                             tftp_state == STATE_SEND_WRQ){
 497                                                 /* connection's first ACK */
 498                                                 tftp_state = STATE_DATA;
 499                                                 tftp_remote_port = src;
 500                                         }
 501                                         tftp_send(); /* Send next data block */
 502                                 }
 503                         }
 504                 }
 505 #endif
 506                 break;
 507
 508         default:
 509                 break;
 510
 511 #ifdef CONFIG_CMD_TFTPSRV
 512         case TFTP_WRQ:
 513                 debug("Got WRQ\n");
 514                 tftp_remote_ip = sip;
 515                 tftp_remote_port = src;
 516                 tftp_our_port = 1024 + (get_timer(0) % 3072);
 517                 new_transfer();
 518                 tftp_send(); /* Send ACK(0) */
 519                 break;
 520 #endif
 521
 522         case TFTP_OACK:
 523                 debug("Got OACK: ");
 524                 for (i = 0; i < len; i++) {
 525                         if (pkt[i] == '\0')
 526                                 debug(" ");
 527                         else
 528                                 debug("%c", pkt[i]);
 529                 }
 530                 debug("\n");
 531                 tftp_state = STATE_OACK;
 532                 tftp_remote_port = src;
 533                 /*
 534                  * Check for 'blksize' option.
 535                  * Careful: "i" is signed, "len" is unsigned, thus
 536                  * something like "len-8" may give a *huge* number
 537                  */
 538                 for (i = 0; i+8 < len; i++) {
 539                         if (strcasecmp((char *)pkt + i, "blksize") == 0) {
 540                                 tftp_block_size = (unsigned short)
 541                                         dectoul((char *)pkt + i + 8, NULL);
 542                                 debug("Blocksize oack: %s, %d\n",
 543                                       (char *)pkt + i + 8, tftp_block_size);
 544                                 if (tftp_block_size > tftp_block_size_option) {
 545                                         printf("Invalid blk size(=%d)\n",
 546                                                tftp_block_size);
 547                                         tftp_state = STATE_INVALID_OPTION;
 548                                 }
 549                         }
 550                         if (strcasecmp((char *)pkt + i, "timeout") == 0) {
 551                                 timeout_val_rcvd = (unsigned short)
 552                                         dectoul((char *)pkt + i + 8, NULL);
 553                                 debug("Timeout oack: %s, %d\n",
 554                                       (char *)pkt + i + 8, timeout_val_rcvd);
 555                                 if (timeout_val_rcvd != (timeout_ms / 1000)) {
 556                                         printf("Invalid timeout val(=%d s)\n",
 557                                                timeout_val_rcvd);
 558                                         tftp_state = STATE_INVALID_OPTION;
 559                                 }
 560                         }
 561 #ifdef CONFIG_TFTP_TSIZE
 562                         if (strcasecmp((char *)pkt + i, "tsize") == 0) {
 563                                 tftp_tsize = dectoul((char *)pkt + i + 6,
 564                                                      NULL);
 565                                 debug("size = %s, %d\n",
 566                                       (char *)pkt + i + 6, tftp_tsize);
 567                         }
 568 #endif
 569                         if (strcasecmp((char *)pkt + i,  "windowsize") == 0) {
 570                                 tftp_windowsize =
 571                                         dectoul((char *)pkt + i + 11, NULL);
 572                                 debug("windowsize = %s, %d\n",
 573                                       (char *)pkt + i + 11, tftp_windowsize);
 574                         }
 575                 }
 576
 577                 tftp_next_ack = tftp_windowsize;
 578
 579 #ifdef CONFIG_CMD_TFTPPUT
 580                 if (tftp_put_active && tftp_state == STATE_OACK) {
 581                         /* Get ready to send the first block */
 582                         tftp_state = STATE_DATA;
 583                         tftp_cur_block++;
 584                 }
 585 #endif
 586                 tftp_send(); /* Send ACK or first data block */
 587                 break;
 588         case TFTP_DATA:
 589                 if (len < 2)
 590                         return;
 591                 len -= 2;
 592
 593                 if (ntohs(*(__be16 *)pkt) != (ushort)(tftp_cur_block + 1)) {
 594                         debug("Received unexpected block: %d, expected: %d\n",
 595                               ntohs(*(__be16 *)pkt),
 596                               (ushort)(tftp_cur_block + 1));
 597                         /*
 598                          * Only ACK if the block count received is greater than
 599                          * the expected block count, otherwise skip ACK.
 600                          * (required to properly handle the server retransmitting
 601                          *  the window)
 602                          */
 603                         if ((ushort)(tftp_cur_block + 1) - (short)(ntohs(*(__be16 *)pkt)) > 0)
 604                                 break;
 605                         /*
 606                          * If one packet is dropped most likely
 607                          * all other buffers in the window
 608                          * that will arrive will cause a sending NACK.
 609                          * This just overwellms the server, let's just send one.
 610                          */
 611                         if (tftp_last_nack != tftp_cur_block) {
 612                                 tftp_send();
 613                                 tftp_last_nack = tftp_cur_block;
 614                                 tftp_next_ack = (ushort)(tftp_cur_block +
 615                                                          tftp_windowsize);
 616                         }
 617                         break;
 618                 }
 619
 620                 tftp_cur_block++;
 621                 tftp_cur_block %= TFTP_SEQUENCE_SIZE;
 622
 623                 if (tftp_state == STATE_SEND_RRQ) {
 624                         debug("Server did not acknowledge any options!\n");
 625                         tftp_next_ack = tftp_windowsize;
 626                 }
 627
 628                 if (tftp_state == STATE_SEND_RRQ || tftp_state == STATE_OACK ||
 629                     tftp_state == STATE_RECV_WRQ) {
 630                         /* first block received */
 631                         tftp_state = STATE_DATA;
 632                         tftp_remote_port = src;
 633                         new_transfer();
 634
 635                         if (tftp_cur_block != 1) {      /* Assertion */
 636                                 puts("\nTFTP error: ");
 637                                 printf("First block is not block 1 (%ld)\n",
 638                                        tftp_cur_block);
 639                                 puts("Starting again\n\n");
 640                                 net_start_again();
 641                                 break;
 642                         }
 643                 }
 644
 645                 if (tftp_cur_block == tftp_prev_block) {
 646                         /* Same block again; ignore it. */
 647                         break;
 648                 }
 649
 650                 update_block_number();
 651                 tftp_prev_block = tftp_cur_block;
 652                 timeout_count_max = tftp_timeout_count_max;
 653                 net_set_timeout_handler(timeout_ms, tftp_timeout_handler);
 654
 655                 if (store_block(tftp_cur_block, pkt + 2, len)) {
 656                         eth_halt();
 657                         net_set_state(NETLOOP_FAIL);
 658                         break;
 659                 }
 660
 661                 if (len < tftp_block_size) {
 662                         tftp_send();
 663                         tftp_complete();
 664                         break;
 665                 }
 666
 667                 /*
 668                  *      Acknowledge the block just received, which will prompt
 669                  *      the remote for the next one.
 670                  */
 671                 if (tftp_cur_block == tftp_next_ack) {
 672                         tftp_send();
 673                         tftp_next_ack += tftp_windowsize;
 674                 }
 675                 break;
 676
 677         case TFTP_ERROR:
 678                 printf("\nTFTP error: '%s' (%d)\n",
 679                        pkt + 2, ntohs(*(__be16 *)pkt));
 680
 681                 switch (ntohs(*(__be16 *)pkt)) {
 682                 case TFTP_ERR_FILE_NOT_FOUND:
 683                 case TFTP_ERR_ACCESS_DENIED:
 684                         puts("Not retrying...\n");
 685                         eth_halt();
 686                         net_set_state(NETLOOP_FAIL);
 687                         break;
 688                 case TFTP_ERR_UNDEFINED:
 689                 case TFTP_ERR_DISK_FULL:
 690                 case TFTP_ERR_UNEXPECTED_OPCODE:
 691                 case TFTP_ERR_UNKNOWN_TRANSFER_ID:
 692                 case TFTP_ERR_FILE_ALREADY_EXISTS:
 693                 default:
 694                         puts("Starting again\n\n");
 695                         net_start_again();
 696                         break;
 697                 }
 698                 break;
 699         }
 700 }
 701
 702 static void tftp_timeout_handler(void)
 703 {
 704         if (++timeout_count > timeout_count_max) {
 705                 restart("Retry count exceeded");
 706         } else {
 707                 puts("T ");
 708                 net_set_timeout_handler(timeout_ms, tftp_timeout_handler);
 709                 if (tftp_state != STATE_RECV_WRQ)
 710                         tftp_send();
 711         }
 712 }
 713
 714 static int tftp_init_load_addr(void)
 715 {
 716         tftp_load_addr = image_load_addr;
 717         return 0;
 718 }
 719
 720 static int saved_tftp_block_size_option;
 721 static void sanitize_tftp_block_size_option(enum proto_t protocol)
 722 {
 723         int cap, max_defrag;
 724
 725         switch (protocol) {
 726         case TFTPGET:
 727                 max_defrag = config_opt_enabled(CONFIG_IP_DEFRAG, CONFIG_NET_MAXDEFRAG, 0);
 728                 if (max_defrag) {
 729                         /* Account for IP, UDP and TFTP headers. */
 730                         cap = max_defrag - (20 + 8 + 4);
 731                         /* RFC2348 sets a hard upper limit. */
 732                         cap = min(cap, 65464);
 733                         break;
 734                 }
 735                 /*
 736                  * If not CONFIG_IP_DEFRAG, cap at the same value as
 737                  * for tftp put, namely normal MTU minus protocol
 738                  * overhead.
 739                  */
 740                 fallthrough;
 741         case TFTPPUT:
 742         default:
 743                 /*
 744                  * U-Boot does not support IP fragmentation on TX, so
 745                  * this must be small enough that it fits normal MTU
 746                  * (and small enough that it fits net_tx_packet which
 747                  * has room for PKTSIZE_ALIGN bytes).
 748                  */
 749                 cap = 1468;
 750         }
 751         if (tftp_block_size_option > cap) {
 752                 printf("Capping tftp block size option to %d (was %d)\n",
 753                        cap, tftp_block_size_option);
 754                 saved_tftp_block_size_option = tftp_block_size_option;
 755                 tftp_block_size_option = cap;
 756         }
 757 }
 758
 759 void tftp_start(enum proto_t protocol)
 760 {
 761         __maybe_unused char *ep;             /* Environment pointer */
 762
 763         if (saved_tftp_block_size_option) {
 764                 tftp_block_size_option = saved_tftp_block_size_option;
 765                 saved_tftp_block_size_option = 0;
 766         }
 767
 768         if (IS_ENABLED(CONFIG_NET_TFTP_VARS)) {
 769
 770                 /*
 771                  * Allow the user to choose TFTP blocksize and timeout.
 772                  * TFTP protocol has a minimal timeout of 1 second.
 773                  */
 774
 775                 ep = env_get("tftpblocksize");
 776                 if (ep != NULL)
 777                         tftp_block_size_option = simple_strtol(ep, NULL, 10);
 778
 779                 ep = env_get("tftpwindowsize");
 780                 if (ep != NULL)
 781                         tftp_window_size_option = simple_strtol(ep, NULL, 10);
 782
 783                 ep = env_get("tftptimeout");
 784                 if (ep != NULL)
 785                         timeout_ms = simple_strtol(ep, NULL, 10);
 786
 787                 if (timeout_ms < 1000) {
 788                         printf("TFTP timeout (%ld ms) too low, set min = 1000 ms\n",
 789                                timeout_ms);
 790                         timeout_ms = 1000;
 791                 }
 792
 793                 ep = env_get("tftptimeoutcountmax");
 794                 if (ep != NULL)
 795                         tftp_timeout_count_max = simple_strtol(ep, NULL, 10);
 796
 797                 if (tftp_timeout_count_max < 0) {
 798                         printf("TFTP timeout count max (%d ms) negative, set to 0\n",
 799                                tftp_timeout_count_max);
 800                         tftp_timeout_count_max = 0;
 801                 }
 802         }
 803
 804         sanitize_tftp_block_size_option(protocol);
 805
 806         debug("TFTP blocksize = %i, TFTP windowsize = %d timeout = %ld ms\n",
 807               tftp_block_size_option, tftp_window_size_option, timeout_ms);
 808
 809         if (IS_ENABLED(CONFIG_IPV6))
 810                 tftp_remote_ip6 = net_server_ip6;
 811
 812         tftp_remote_ip = net_server_ip;
 813         if (!net_parse_bootfile(&tftp_remote_ip, tftp_filename, MAX_LEN)) {
 814                 sprintf(default_filename, "%02X%02X%02X%02X.img",
 815                         net_ip.s_addr & 0xFF,
 816                         (net_ip.s_addr >>  8) & 0xFF,
 817                         (net_ip.s_addr >> 16) & 0xFF,
 818                         (net_ip.s_addr >> 24) & 0xFF);
 819
 820                 strncpy(tftp_filename, default_filename, DEFAULT_NAME_LEN);
 821                 tftp_filename[DEFAULT_NAME_LEN - 1] = 0;
 822
 823                 printf("*** Warning: no boot file name; using '%s'\n",
 824                        tftp_filename);
 825         }
 826
 827         if (IS_ENABLED(CONFIG_IPV6)) {
 828                 if (use_ip6) {
 829                         char *s, *e;
 830                         size_t len;
 831
 832                         s = strchr(net_boot_file_name, '[');
 833                         e = strchr(net_boot_file_name, ']');
 834                         len = e - s;
 835                         if (s && e) {
 836                                 string_to_ip6(s + 1, len - 1, &tftp_remote_ip6);
 837                                 strlcpy(tftp_filename, e + 2, MAX_LEN);
 838                         } else {
 839                                 strlcpy(tftp_filename, net_boot_file_name, MAX_LEN);
 840                                 tftp_filename[MAX_LEN - 1] = 0;
 841                         }
 842                 }
 843         }
 844
 845         printf("Using %s device\n", eth_get_name());
 846
 847         if (IS_ENABLED(CONFIG_IPV6) && use_ip6) {
 848                 printf("TFTP from server %pI6c; our IP address is %pI6c",
 849                        &tftp_remote_ip6, &net_ip6);
 850
 851                 if (tftp_block_size_option > TFTP_MTU_BLOCKSIZE6)
 852                         tftp_block_size_option = TFTP_MTU_BLOCKSIZE6;
 853         } else {
 854                 printf("TFTP %s server %pI4; our IP address is %pI4",
 855 #ifdef CONFIG_CMD_TFTPPUT
 856                protocol == TFTPPUT ? "to" : "from",
 857 #else
 858                "from",
 859 #endif
 860                &tftp_remote_ip, &net_ip);
 861         }
 862
 863         /* Check if we need to send across this subnet */
 864         if (IS_ENABLED(CONFIG_IPV6) && use_ip6) {
 865                 if (!ip6_addr_in_subnet(&net_ip6, &tftp_remote_ip6,
 866                                         net_prefix_length))
 867                         printf("; sending through gateway %pI6c",
 868                                &net_gateway6);
 869         } else if (net_gateway.s_addr && net_netmask.s_addr) {
 870                 struct in_addr our_net;
 871                 struct in_addr remote_net;
 872
 873                 our_net.s_addr = net_ip.s_addr & net_netmask.s_addr;
 874                 remote_net.s_addr = tftp_remote_ip.s_addr & net_netmask.s_addr;
 875                 if (our_net.s_addr != remote_net.s_addr)
 876                         printf("; sending through gateway %pI4", &net_gateway);
 877         }
 878         putc('\n');
 879
 880         printf("Filename '%s'.", tftp_filename);
 881
 882         if (net_boot_file_expected_size_in_blocks) {
 883                 printf(" Size is 0x%x Bytes = ",
 884                        net_boot_file_expected_size_in_blocks << 9);
 885                 print_size(net_boot_file_expected_size_in_blocks << 9, "");
 886         }
 887
 888         putc('\n');
 889 #ifdef CONFIG_CMD_TFTPPUT
 890         tftp_put_active = (protocol == TFTPPUT);
 891         if (tftp_put_active) {
 892                 printf("Save address: 0x%lx\n", image_save_addr);
 893                 printf("Save size:    0x%lx\n", image_save_size);
 894                 net_boot_file_size = image_save_size;
 895                 puts("Saving: *\b");
 896                 tftp_state = STATE_SEND_WRQ;
 897                 new_transfer();
 898         } else
 899 #endif
 900         {
 901                 if (tftp_init_load_addr()) {
 902                         eth_halt();
 903                         net_set_state(NETLOOP_FAIL);
 904                         puts("\nTFTP error: ");
 905                         puts("trying to overwrite reserved memory...\n");
 906                         return;
 907                 }
 908                 printf("Load address: 0x%lx\n", tftp_load_addr);
 909                 puts("Loading: *\b");
 910                 tftp_state = STATE_SEND_RRQ;
 911         }
 912
 913         time_start = get_timer(0);
 914         timeout_count_max = tftp_timeout_count_max;
 915
 916         net_set_timeout_handler(timeout_ms, tftp_timeout_handler);
 917         net_set_udp_handler(tftp_handler);
 918 #ifdef CONFIG_CMD_TFTPPUT
 919         net_set_icmp_handler(icmp_handler);
 920 #endif
 921         tftp_remote_port = WELL_KNOWN_PORT;
 922         timeout_count = 0;
 923         /* Use a pseudo-random port unless a specific port is set */
 924         tftp_our_port = 1024 + (get_timer(0) % 3072);
 925
 926 #ifdef CONFIG_TFTP_PORT
 927         ep = env_get("tftpdstp");
 928         if (ep != NULL)
 929                 tftp_remote_port = simple_strtol(ep, NULL, 10);
 930         ep = env_get("tftpsrcp");
 931         if (ep != NULL)
 932                 tftp_our_port = simple_strtol(ep, NULL, 10);
 933 #endif
 934         tftp_cur_block = 0;
 935         tftp_windowsize = 1;
 936         tftp_last_nack = 0;
 937         /* zero out server ether in case the server ip has changed */
 938         memset(net_server_ethaddr, 0, 6);
 939         /* Revert tftp_block_size to dflt */
 940         tftp_block_size = TFTP_BLOCK_SIZE;
 941 #ifdef CONFIG_TFTP_TSIZE
 942         tftp_tsize = 0;
 943         tftp_tsize_num_hash = 0;
 944 #endif
 945
 946         tftp_send();
 947 }
 948
 949 #ifdef CONFIG_CMD_TFTPSRV
 950 void tftp_start_server(void)
 951 {
 952         tftp_filename[0] = 0;
 953
 954         if (tftp_init_load_addr()) {
 955                 eth_halt();
 956                 net_set_state(NETLOOP_FAIL);
 957                 puts("\nTFTP error: trying to overwrite reserved memory...\n");
 958                 return;
 959         }
 960         printf("Using %s device\n", eth_get_name());
 961         printf("Listening for TFTP transfer on %pI4\n", &net_ip);
 962         printf("Load address: 0x%lx\n", tftp_load_addr);
 963
 964         puts("Loading: *\b");
 965
 966         timeout_count_max = tftp_timeout_count_max;
 967         timeout_count = 0;
 968         timeout_ms = TIMEOUT;
 969         net_set_timeout_handler(timeout_ms, tftp_timeout_handler);
 970
 971         /* Revert tftp_block_size to dflt */
 972         tftp_block_size = TFTP_BLOCK_SIZE;
 973         tftp_cur_block = 0;
 974         tftp_our_port = WELL_KNOWN_PORT;
 975         tftp_windowsize = 1;
 976         tftp_next_ack = tftp_windowsize;
 977
 978 #ifdef CONFIG_TFTP_TSIZE
 979         tftp_tsize = 0;
 980         tftp_tsize_num_hash = 0;
 981 #endif
 982
 983         tftp_state = STATE_RECV_WRQ;
 984         net_set_udp_handler(tftp_handler);
 985
 986         /* zero out server ether in case the server ip has changed */
 987         memset(net_server_ethaddr, 0, 6);
 988 }
 989 #endif /* CONFIG_CMD_TFTPSRV */