net: (actually/better) deal with CVE-2022-{30790,30552}
[platform/kernel/u-boot.git] / net / nfs.c
1 /*
2  * NFS support driver - based on etherboot and U-BOOT's tftp.c
3  *
4  * Masami Komiya <mkomiya@sonare.it> 2004
5  *
6  */
7
8 /* NOTE: the NFS code is heavily inspired by the NetBSD netboot code (read:
9  * large portions are copied verbatim) as distributed in OSKit 0.97.  A few
10  * changes were necessary to adapt the code to Etherboot and to fix several
11  * inconsistencies.  Also the RPC message preparation is done "by hand" to
12  * avoid adding netsprintf() which I find hard to understand and use.  */
13
14 /* NOTE 2: Etherboot does not care about things beyond the kernel image, so
15  * it loads the kernel image off the boot server (ARP_SERVER) and does not
16  * access the client root disk (root-path in dhcpd.conf), which would use
17  * ARP_ROOTSERVER.  The root disk is something the operating system we are
18  * about to load needs to use.  This is different from the OSKit 0.97 logic.  */
19
20 /* NOTE 3: Symlink handling introduced by Anselm M Hoffmeister, 2003-July-14
21  * If a symlink is encountered, it is followed as far as possible (recursion
22  * possible, maximum 16 steps). There is no clearing of ".."'s inside the
23  * path, so please DON'T DO THAT. thx. */
24
25 /* NOTE 4: NFSv3 support added by Guillaume GARDET, 2016-June-20.
26  * NFSv2 is still used by default. But if server does not support NFSv2, then
27  * NFSv3 is used, if available on NFS server. */
28
29 #include <common.h>
30 #include <command.h>
31 #include <display_options.h>
32 #ifdef CONFIG_SYS_DIRECT_FLASH_NFS
33 #include <flash.h>
34 #endif
35 #include <image.h>
36 #include <log.h>
37 #include <net.h>
38 #include <malloc.h>
39 #include <mapmem.h>
40 #include "nfs.h"
41 #include "bootp.h"
42 #include <time.h>
43
44 #define HASHES_PER_LINE 65      /* Number of "loading" hashes per line  */
45 #define NFS_RETRY_COUNT 30
46
47 #define NFS_RPC_ERR     1
48 #define NFS_RPC_DROP    124
49
50 static int fs_mounted;
51 static unsigned long rpc_id;
52 static int nfs_offset = -1;
53 static int nfs_len;
54 static const ulong nfs_timeout = CONFIG_NFS_TIMEOUT;
55
56 static char dirfh[NFS_FHSIZE];  /* NFSv2 / NFSv3 file handle of directory */
57 static char filefh[NFS3_FHSIZE]; /* NFSv2 / NFSv3 file handle */
58 static unsigned int filefh3_length;     /* (variable) length of filefh when NFSv3 */
59
60 static enum net_loop_state nfs_download_state;
61 static struct in_addr nfs_server_ip;
62 static int nfs_server_mount_port;
63 static int nfs_server_port;
64 static int nfs_our_port;
65 static int nfs_timeout_count;
66 static int nfs_state;
67 #define STATE_PRCLOOKUP_PROG_MOUNT_REQ  1
68 #define STATE_PRCLOOKUP_PROG_NFS_REQ    2
69 #define STATE_MOUNT_REQ                 3
70 #define STATE_UMOUNT_REQ                4
71 #define STATE_LOOKUP_REQ                5
72 #define STATE_READ_REQ                  6
73 #define STATE_READLINK_REQ              7
74
75 static char *nfs_filename;
76 static char *nfs_path;
77 static char nfs_path_buff[2048];
78
79 #define NFSV2_FLAG 1
80 #define NFSV3_FLAG 1 << 1
81 static char supported_nfs_versions = NFSV2_FLAG | NFSV3_FLAG;
82
83 static inline int store_block(uchar *src, unsigned offset, unsigned len)
84 {
85         ulong newsize = offset + len;
86 #ifdef CONFIG_SYS_DIRECT_FLASH_NFS
87         int i, rc = 0;
88
89         for (i = 0; i < CONFIG_SYS_MAX_FLASH_BANKS; i++) {
90                 /* start address in flash? */
91                 if (image_load_addr + offset >= flash_info[i].start[0]) {
92                         rc = 1;
93                         break;
94                 }
95         }
96
97         if (rc) { /* Flash is destination for this packet */
98                 rc = flash_write((uchar *)src, (ulong)image_load_addr + offset,
99                                  len);
100                 if (rc) {
101                         flash_perror(rc);
102                         return -1;
103                 }
104         } else
105 #endif /* CONFIG_SYS_DIRECT_FLASH_NFS */
106         {
107                 void *ptr = map_sysmem(image_load_addr + offset, len);
108
109                 memcpy(ptr, src, len);
110                 unmap_sysmem(ptr);
111         }
112
113         if (net_boot_file_size < (offset + len))
114                 net_boot_file_size = newsize;
115         return 0;
116 }
117
118 static char *basename(char *path)
119 {
120         char *fname;
121
122         fname = path + strlen(path) - 1;
123         while (fname >= path) {
124                 if (*fname == '/') {
125                         fname++;
126                         break;
127                 }
128                 fname--;
129         }
130         return fname;
131 }
132
133 static char *dirname(char *path)
134 {
135         char *fname;
136
137         fname = basename(path);
138         --fname;
139         *fname = '\0';
140         return path;
141 }
142
143 /**************************************************************************
144 RPC_ADD_CREDENTIALS - Add RPC authentication/verifier entries
145 **************************************************************************/
146 static uint32_t *rpc_add_credentials(uint32_t *p)
147 {
148         /* Here's the executive summary on authentication requirements of the
149          * various NFS server implementations:  Linux accepts both AUTH_NONE
150          * and AUTH_UNIX authentication (also accepts an empty hostname field
151          * in the AUTH_UNIX scheme).  *BSD refuses AUTH_NONE, but accepts
152          * AUTH_UNIX (also accepts an empty hostname field in the AUTH_UNIX
153          * scheme).  To be safe, use AUTH_UNIX and pass the hostname if we have
154          * it (if the BOOTP/DHCP reply didn't give one, just use an empty
155          * hostname).  */
156
157         /* Provide an AUTH_UNIX credential.  */
158         *p++ = htonl(1);                /* AUTH_UNIX */
159         *p++ = htonl(20);               /* auth length */
160         *p++ = 0;                       /* stamp */
161         *p++ = 0;                       /* hostname string */
162         *p++ = 0;                       /* uid */
163         *p++ = 0;                       /* gid */
164         *p++ = 0;                       /* auxiliary gid list */
165
166         /* Provide an AUTH_NONE verifier.  */
167         *p++ = 0;                       /* AUTH_NONE */
168         *p++ = 0;                       /* auth length */
169
170         return p;
171 }
172
173 /**************************************************************************
174 RPC_LOOKUP - Lookup RPC Port numbers
175 **************************************************************************/
176 static void rpc_req(int rpc_prog, int rpc_proc, uint32_t *data, int datalen)
177 {
178         struct rpc_t rpc_pkt;
179         unsigned long id;
180         uint32_t *p;
181         int pktlen;
182         int sport;
183
184         id = ++rpc_id;
185         rpc_pkt.u.call.id = htonl(id);
186         rpc_pkt.u.call.type = htonl(MSG_CALL);
187         rpc_pkt.u.call.rpcvers = htonl(2);      /* use RPC version 2 */
188         rpc_pkt.u.call.prog = htonl(rpc_prog);
189         switch (rpc_prog) {
190         case PROG_NFS:
191                 if (supported_nfs_versions & NFSV2_FLAG)
192                         rpc_pkt.u.call.vers = htonl(2); /* NFS v2 */
193                 else /* NFSV3_FLAG */
194                         rpc_pkt.u.call.vers = htonl(3); /* NFS v3 */
195                 break;
196         case PROG_PORTMAP:
197         case PROG_MOUNT:
198         default:
199                 rpc_pkt.u.call.vers = htonl(2); /* portmapper is version 2 */
200         }
201         rpc_pkt.u.call.proc = htonl(rpc_proc);
202         p = rpc_pkt.u.call.data;
203
204         if (datalen)
205                 memcpy(p, data, datalen * sizeof(uint32_t));
206
207         pktlen = (char *)p + datalen * sizeof(uint32_t) - (char *)&rpc_pkt;
208
209         memcpy((char *)net_tx_packet + net_eth_hdr_size() + IP_UDP_HDR_SIZE,
210                &rpc_pkt.u.data[0], pktlen);
211
212         if (rpc_prog == PROG_PORTMAP)
213                 sport = SUNRPC_PORT;
214         else if (rpc_prog == PROG_MOUNT)
215                 sport = nfs_server_mount_port;
216         else
217                 sport = nfs_server_port;
218
219         net_send_udp_packet(net_server_ethaddr, nfs_server_ip, sport,
220                             nfs_our_port, pktlen);
221 }
222
223 /**************************************************************************
224 RPC_LOOKUP - Lookup RPC Port numbers
225 **************************************************************************/
226 static void rpc_lookup_req(int prog, int ver)
227 {
228         uint32_t data[16];
229
230         data[0] = 0; data[1] = 0;       /* auth credential */
231         data[2] = 0; data[3] = 0;       /* auth verifier */
232         data[4] = htonl(prog);
233         data[5] = htonl(ver);
234         data[6] = htonl(17);    /* IP_UDP */
235         data[7] = 0;
236         rpc_req(PROG_PORTMAP, PORTMAP_GETPORT, data, 8);
237 }
238
239 /**************************************************************************
240 NFS_MOUNT - Mount an NFS Filesystem
241 **************************************************************************/
242 static void nfs_mount_req(char *path)
243 {
244         uint32_t data[1024];
245         uint32_t *p;
246         int len;
247         int pathlen;
248
249         pathlen = strlen(path);
250
251         p = &(data[0]);
252         p = rpc_add_credentials(p);
253
254         *p++ = htonl(pathlen);
255         if (pathlen & 3)
256                 *(p + pathlen / 4) = 0;
257         memcpy(p, path, pathlen);
258         p += (pathlen + 3) / 4;
259
260         len = (uint32_t *)p - (uint32_t *)&(data[0]);
261
262         rpc_req(PROG_MOUNT, MOUNT_ADDENTRY, data, len);
263 }
264
265 /**************************************************************************
266 NFS_UMOUNTALL - Unmount all our NFS Filesystems on the Server
267 **************************************************************************/
268 static void nfs_umountall_req(void)
269 {
270         uint32_t data[1024];
271         uint32_t *p;
272         int len;
273
274         if ((nfs_server_mount_port == -1) || (!fs_mounted))
275                 /* Nothing mounted, nothing to umount */
276                 return;
277
278         p = &(data[0]);
279         p = rpc_add_credentials(p);
280
281         len = (uint32_t *)p - (uint32_t *)&(data[0]);
282
283         rpc_req(PROG_MOUNT, MOUNT_UMOUNTALL, data, len);
284 }
285
286 /***************************************************************************
287  * NFS_READLINK (AH 2003-07-14)
288  * This procedure is called when read of the first block fails -
289  * this probably happens when it's a directory or a symlink
290  * In case of successful readlink(), the dirname is manipulated,
291  * so that inside the nfs() function a recursion can be done.
292  **************************************************************************/
293 static void nfs_readlink_req(void)
294 {
295         uint32_t data[1024];
296         uint32_t *p;
297         int len;
298
299         p = &(data[0]);
300         p = rpc_add_credentials(p);
301
302         if (supported_nfs_versions & NFSV2_FLAG) {
303                 memcpy(p, filefh, NFS_FHSIZE);
304                 p += (NFS_FHSIZE / 4);
305         } else { /* NFSV3_FLAG */
306                 *p++ = htonl(filefh3_length);
307                 memcpy(p, filefh, filefh3_length);
308                 p += (filefh3_length / 4);
309         }
310
311         len = (uint32_t *)p - (uint32_t *)&(data[0]);
312
313         rpc_req(PROG_NFS, NFS_READLINK, data, len);
314 }
315
316 /**************************************************************************
317 NFS_LOOKUP - Lookup Pathname
318 **************************************************************************/
319 static void nfs_lookup_req(char *fname)
320 {
321         uint32_t data[1024];
322         uint32_t *p;
323         int len;
324         int fnamelen;
325
326         fnamelen = strlen(fname);
327
328         p = &(data[0]);
329         p = rpc_add_credentials(p);
330
331         if (supported_nfs_versions & NFSV2_FLAG) {
332                 memcpy(p, dirfh, NFS_FHSIZE);
333                 p += (NFS_FHSIZE / 4);
334                 *p++ = htonl(fnamelen);
335                 if (fnamelen & 3)
336                         *(p + fnamelen / 4) = 0;
337                 memcpy(p, fname, fnamelen);
338                 p += (fnamelen + 3) / 4;
339
340                 len = (uint32_t *)p - (uint32_t *)&(data[0]);
341
342                 rpc_req(PROG_NFS, NFS_LOOKUP, data, len);
343         } else {  /* NFSV3_FLAG */
344                 *p++ = htonl(NFS_FHSIZE);       /* Dir handle length */
345                 memcpy(p, dirfh, NFS_FHSIZE);
346                 p += (NFS_FHSIZE / 4);
347                 *p++ = htonl(fnamelen);
348                 if (fnamelen & 3)
349                         *(p + fnamelen / 4) = 0;
350                 memcpy(p, fname, fnamelen);
351                 p += (fnamelen + 3) / 4;
352
353                 len = (uint32_t *)p - (uint32_t *)&(data[0]);
354
355                 rpc_req(PROG_NFS, NFS3PROC_LOOKUP, data, len);
356         }
357 }
358
359 /**************************************************************************
360 NFS_READ - Read File on NFS Server
361 **************************************************************************/
362 static void nfs_read_req(int offset, int readlen)
363 {
364         uint32_t data[1024];
365         uint32_t *p;
366         int len;
367
368         p = &(data[0]);
369         p = rpc_add_credentials(p);
370
371         if (supported_nfs_versions & NFSV2_FLAG) {
372                 memcpy(p, filefh, NFS_FHSIZE);
373                 p += (NFS_FHSIZE / 4);
374                 *p++ = htonl(offset);
375                 *p++ = htonl(readlen);
376                 *p++ = 0;
377         } else { /* NFSV3_FLAG */
378                 *p++ = htonl(filefh3_length);
379                 memcpy(p, filefh, filefh3_length);
380                 p += (filefh3_length / 4);
381                 *p++ = htonl(0); /* offset is 64-bit long, so fill with 0 */
382                 *p++ = htonl(offset);
383                 *p++ = htonl(readlen);
384                 *p++ = 0;
385         }
386
387         len = (uint32_t *)p - (uint32_t *)&(data[0]);
388
389         rpc_req(PROG_NFS, NFS_READ, data, len);
390 }
391
392 /**************************************************************************
393 RPC request dispatcher
394 **************************************************************************/
395 static void nfs_send(void)
396 {
397         debug("%s\n", __func__);
398
399         switch (nfs_state) {
400         case STATE_PRCLOOKUP_PROG_MOUNT_REQ:
401                 if (supported_nfs_versions & NFSV2_FLAG)
402                         rpc_lookup_req(PROG_MOUNT, 1);
403                 else  /* NFSV3_FLAG */
404                         rpc_lookup_req(PROG_MOUNT, 3);
405                 break;
406         case STATE_PRCLOOKUP_PROG_NFS_REQ:
407                 if (supported_nfs_versions & NFSV2_FLAG)
408                         rpc_lookup_req(PROG_NFS, 2);
409                 else  /* NFSV3_FLAG */
410                         rpc_lookup_req(PROG_NFS, 3);
411                 break;
412         case STATE_MOUNT_REQ:
413                 nfs_mount_req(nfs_path);
414                 break;
415         case STATE_UMOUNT_REQ:
416                 nfs_umountall_req();
417                 break;
418         case STATE_LOOKUP_REQ:
419                 nfs_lookup_req(nfs_filename);
420                 break;
421         case STATE_READ_REQ:
422                 nfs_read_req(nfs_offset, nfs_len);
423                 break;
424         case STATE_READLINK_REQ:
425                 nfs_readlink_req();
426                 break;
427         }
428 }
429
430 /**************************************************************************
431 Handlers for the reply from server
432 **************************************************************************/
433
434 static int rpc_lookup_reply(int prog, uchar *pkt, unsigned len)
435 {
436         struct rpc_t rpc_pkt;
437
438         memcpy(&rpc_pkt.u.data[0], pkt, len);
439
440         debug("%s\n", __func__);
441
442         if (ntohl(rpc_pkt.u.reply.id) > rpc_id)
443                 return -NFS_RPC_ERR;
444         else if (ntohl(rpc_pkt.u.reply.id) < rpc_id)
445                 return -NFS_RPC_DROP;
446
447         if (rpc_pkt.u.reply.rstatus  ||
448             rpc_pkt.u.reply.verifier ||
449             rpc_pkt.u.reply.astatus)
450                 return -1;
451
452         switch (prog) {
453         case PROG_MOUNT:
454                 nfs_server_mount_port = ntohl(rpc_pkt.u.reply.data[0]);
455                 break;
456         case PROG_NFS:
457                 nfs_server_port = ntohl(rpc_pkt.u.reply.data[0]);
458                 break;
459         }
460
461         return 0;
462 }
463
464 static int nfs_mount_reply(uchar *pkt, unsigned len)
465 {
466         struct rpc_t rpc_pkt;
467
468         debug("%s\n", __func__);
469
470         memcpy(&rpc_pkt.u.data[0], pkt, len);
471
472         if (ntohl(rpc_pkt.u.reply.id) > rpc_id)
473                 return -NFS_RPC_ERR;
474         else if (ntohl(rpc_pkt.u.reply.id) < rpc_id)
475                 return -NFS_RPC_DROP;
476
477         if (rpc_pkt.u.reply.rstatus  ||
478             rpc_pkt.u.reply.verifier ||
479             rpc_pkt.u.reply.astatus  ||
480             rpc_pkt.u.reply.data[0])
481                 return -1;
482
483         fs_mounted = 1;
484         /*  NFSv2 and NFSv3 use same structure */
485         memcpy(dirfh, rpc_pkt.u.reply.data + 1, NFS_FHSIZE);
486
487         return 0;
488 }
489
490 static int nfs_umountall_reply(uchar *pkt, unsigned len)
491 {
492         struct rpc_t rpc_pkt;
493
494         debug("%s\n", __func__);
495
496         memcpy(&rpc_pkt.u.data[0], pkt, len);
497
498         if (ntohl(rpc_pkt.u.reply.id) > rpc_id)
499                 return -NFS_RPC_ERR;
500         else if (ntohl(rpc_pkt.u.reply.id) < rpc_id)
501                 return -NFS_RPC_DROP;
502
503         if (rpc_pkt.u.reply.rstatus  ||
504             rpc_pkt.u.reply.verifier ||
505             rpc_pkt.u.reply.astatus)
506                 return -1;
507
508         fs_mounted = 0;
509         memset(dirfh, 0, sizeof(dirfh));
510
511         return 0;
512 }
513
514 static int nfs_lookup_reply(uchar *pkt, unsigned len)
515 {
516         struct rpc_t rpc_pkt;
517
518         debug("%s\n", __func__);
519
520         memcpy(&rpc_pkt.u.data[0], pkt, len);
521
522         if (ntohl(rpc_pkt.u.reply.id) > rpc_id)
523                 return -NFS_RPC_ERR;
524         else if (ntohl(rpc_pkt.u.reply.id) < rpc_id)
525                 return -NFS_RPC_DROP;
526
527         if (rpc_pkt.u.reply.rstatus  ||
528             rpc_pkt.u.reply.verifier ||
529             rpc_pkt.u.reply.astatus  ||
530             rpc_pkt.u.reply.data[0]) {
531                 switch (ntohl(rpc_pkt.u.reply.astatus)) {
532                 case NFS_RPC_SUCCESS: /* Not an error */
533                         break;
534                 case NFS_RPC_PROG_MISMATCH:
535                         /* Remote can't support NFS version */
536                         switch (ntohl(rpc_pkt.u.reply.data[0])) {
537                         /* Minimal supported NFS version */
538                         case 3:
539                                 debug("*** Warning: NFS version not supported: Requested: V%d, accepted: min V%d - max V%d\n",
540                                       (supported_nfs_versions & NFSV2_FLAG) ?
541                                                 2 : 3,
542                                       ntohl(rpc_pkt.u.reply.data[0]),
543                                       ntohl(rpc_pkt.u.reply.data[1]));
544                                 debug("Will retry with NFSv3\n");
545                                 /* Clear NFSV2_FLAG from supported versions */
546                                 supported_nfs_versions &= ~NFSV2_FLAG;
547                                 return -NFS_RPC_PROG_MISMATCH;
548                         case 4:
549                         default:
550                                 puts("*** ERROR: NFS version not supported");
551                                 debug(": Requested: V%d, accepted: min V%d - max V%d\n",
552                                       (supported_nfs_versions & NFSV2_FLAG) ?
553                                                 2 : 3,
554                                       ntohl(rpc_pkt.u.reply.data[0]),
555                                       ntohl(rpc_pkt.u.reply.data[1]));
556                                 puts("\n");
557                         }
558                         break;
559                 case NFS_RPC_PROG_UNAVAIL:
560                 case NFS_RPC_PROC_UNAVAIL:
561                 case NFS_RPC_GARBAGE_ARGS:
562                 case NFS_RPC_SYSTEM_ERR:
563                 default: /* Unknown error on 'accept state' flag */
564                         debug("*** ERROR: accept state error (%d)\n",
565                               ntohl(rpc_pkt.u.reply.astatus));
566                         break;
567                 }
568                 return -1;
569         }
570
571         if (supported_nfs_versions & NFSV2_FLAG) {
572                 if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + NFS_FHSIZE) > len)
573                         return -NFS_RPC_DROP;
574                 memcpy(filefh, rpc_pkt.u.reply.data + 1, NFS_FHSIZE);
575         } else {  /* NFSV3_FLAG */
576                 filefh3_length = ntohl(rpc_pkt.u.reply.data[1]);
577                 if (filefh3_length > NFS3_FHSIZE)
578                         filefh3_length  = NFS3_FHSIZE;
579                 memcpy(filefh, rpc_pkt.u.reply.data + 2, filefh3_length);
580         }
581
582         return 0;
583 }
584
585 static int nfs3_get_attributes_offset(uint32_t *data)
586 {
587         if (data[1]) {
588                 /* 'attributes_follow' flag is TRUE,
589                  * so we have attributes on 21 dwords */
590                 /* Skip unused values :
591                         type;   32 bits value,
592                         mode;   32 bits value,
593                         nlink;  32 bits value,
594                         uid;    32 bits value,
595                         gid;    32 bits value,
596                         size;   64 bits value,
597                         used;   64 bits value,
598                         rdev;   64 bits value,
599                         fsid;   64 bits value,
600                         fileid; 64 bits value,
601                         atime;  64 bits value,
602                         mtime;  64 bits value,
603                         ctime;  64 bits value,
604                 */
605                 return 22;
606         } else {
607                 /* 'attributes_follow' flag is FALSE,
608                  * so we don't have any attributes */
609                 return 1;
610         }
611 }
612
613 static int nfs_readlink_reply(uchar *pkt, unsigned len)
614 {
615         struct rpc_t rpc_pkt;
616         int rlen;
617         int nfsv3_data_offset = 0;
618
619         debug("%s\n", __func__);
620
621         memcpy((unsigned char *)&rpc_pkt, pkt, len);
622
623         if (ntohl(rpc_pkt.u.reply.id) > rpc_id)
624                 return -NFS_RPC_ERR;
625         else if (ntohl(rpc_pkt.u.reply.id) < rpc_id)
626                 return -NFS_RPC_DROP;
627
628         if (rpc_pkt.u.reply.rstatus  ||
629             rpc_pkt.u.reply.verifier ||
630             rpc_pkt.u.reply.astatus  ||
631             rpc_pkt.u.reply.data[0])
632                 return -1;
633
634         if (!(supported_nfs_versions & NFSV2_FLAG)) { /* NFSV3_FLAG */
635                 nfsv3_data_offset =
636                         nfs3_get_attributes_offset(rpc_pkt.u.reply.data);
637         }
638
639         /* new path length */
640         rlen = ntohl(rpc_pkt.u.reply.data[1 + nfsv3_data_offset]);
641
642         if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + rlen) > len)
643                 return -NFS_RPC_DROP;
644
645         if (*((char *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset])) != '/') {
646                 int pathlen;
647
648                 strcat(nfs_path, "/");
649                 pathlen = strlen(nfs_path);
650                 memcpy(nfs_path + pathlen,
651                        (uchar *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset]),
652                        rlen);
653                 nfs_path[pathlen + rlen] = 0;
654         } else {
655                 memcpy(nfs_path,
656                        (uchar *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset]),
657                        rlen);
658                 nfs_path[rlen] = 0;
659         }
660         return 0;
661 }
662
663 static int nfs_read_reply(uchar *pkt, unsigned len)
664 {
665         struct rpc_t rpc_pkt;
666         int rlen;
667         uchar *data_ptr;
668
669         debug("%s\n", __func__);
670
671         memcpy(&rpc_pkt.u.data[0], pkt, sizeof(rpc_pkt.u.reply));
672
673         if (ntohl(rpc_pkt.u.reply.id) > rpc_id)
674                 return -NFS_RPC_ERR;
675         else if (ntohl(rpc_pkt.u.reply.id) < rpc_id)
676                 return -NFS_RPC_DROP;
677
678         if (rpc_pkt.u.reply.rstatus  ||
679             rpc_pkt.u.reply.verifier ||
680             rpc_pkt.u.reply.astatus  ||
681             rpc_pkt.u.reply.data[0]) {
682                 if (rpc_pkt.u.reply.rstatus)
683                         return -9999;
684                 if (rpc_pkt.u.reply.astatus)
685                         return -9999;
686                 return -ntohl(rpc_pkt.u.reply.data[0]);
687         }
688
689         if ((nfs_offset != 0) && !((nfs_offset) %
690                         (NFS_READ_SIZE / 2 * 10 * HASHES_PER_LINE)))
691                 puts("\n\t ");
692         if (!(nfs_offset % ((NFS_READ_SIZE / 2) * 10)))
693                 putc('#');
694
695         if (supported_nfs_versions & NFSV2_FLAG) {
696                 rlen = ntohl(rpc_pkt.u.reply.data[18]);
697                 data_ptr = (uchar *)&(rpc_pkt.u.reply.data[19]);
698         } else {  /* NFSV3_FLAG */
699                 int nfsv3_data_offset =
700                         nfs3_get_attributes_offset(rpc_pkt.u.reply.data);
701
702                 /* count value */
703                 rlen = ntohl(rpc_pkt.u.reply.data[1 + nfsv3_data_offset]);
704                 /* Skip unused values :
705                         EOF:            32 bits value,
706                         data_size:      32 bits value,
707                 */
708                 data_ptr = (uchar *)
709                         &(rpc_pkt.u.reply.data[4 + nfsv3_data_offset]);
710         }
711
712         if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + rlen) > len)
713                         return -9999;
714
715         if (store_block(data_ptr, nfs_offset, rlen))
716                         return -9999;
717
718         return rlen;
719 }
720
721 /**************************************************************************
722 Interfaces of U-BOOT
723 **************************************************************************/
724 static void nfs_timeout_handler(void)
725 {
726         if (++nfs_timeout_count > NFS_RETRY_COUNT) {
727                 puts("\nRetry count exceeded; starting again\n");
728                 net_start_again();
729         } else {
730                 puts("T ");
731                 net_set_timeout_handler(nfs_timeout +
732                                         nfs_timeout * nfs_timeout_count,
733                                         nfs_timeout_handler);
734                 nfs_send();
735         }
736 }
737
738 static void nfs_handler(uchar *pkt, unsigned dest, struct in_addr sip,
739                         unsigned src, unsigned len)
740 {
741         int rlen;
742         int reply;
743
744         debug("%s\n", __func__);
745
746         if (len > sizeof(struct rpc_t))
747                 return;
748
749         if (dest != nfs_our_port)
750                 return;
751
752         switch (nfs_state) {
753         case STATE_PRCLOOKUP_PROG_MOUNT_REQ:
754                 if (rpc_lookup_reply(PROG_MOUNT, pkt, len) == -NFS_RPC_DROP)
755                         break;
756                 nfs_state = STATE_PRCLOOKUP_PROG_NFS_REQ;
757                 nfs_send();
758                 break;
759
760         case STATE_PRCLOOKUP_PROG_NFS_REQ:
761                 if (rpc_lookup_reply(PROG_NFS, pkt, len) == -NFS_RPC_DROP)
762                         break;
763                 nfs_state = STATE_MOUNT_REQ;
764                 nfs_send();
765                 break;
766
767         case STATE_MOUNT_REQ:
768                 reply = nfs_mount_reply(pkt, len);
769                 if (reply == -NFS_RPC_DROP) {
770                         break;
771                 } else if (reply == -NFS_RPC_ERR) {
772                         puts("*** ERROR: Cannot mount\n");
773                         /* just to be sure... */
774                         nfs_state = STATE_UMOUNT_REQ;
775                         nfs_send();
776                 } else {
777                         nfs_state = STATE_LOOKUP_REQ;
778                         nfs_send();
779                 }
780                 break;
781
782         case STATE_UMOUNT_REQ:
783                 reply = nfs_umountall_reply(pkt, len);
784                 if (reply == -NFS_RPC_DROP) {
785                         break;
786                 } else if (reply == -NFS_RPC_ERR) {
787                         debug("*** ERROR: Cannot umount\n");
788                         net_set_state(NETLOOP_FAIL);
789                 } else {
790                         puts("\ndone\n");
791                         net_set_state(nfs_download_state);
792                 }
793                 break;
794
795         case STATE_LOOKUP_REQ:
796                 reply = nfs_lookup_reply(pkt, len);
797                 if (reply == -NFS_RPC_DROP) {
798                         break;
799                 } else if (reply == -NFS_RPC_ERR) {
800                         puts("*** ERROR: File lookup fail\n");
801                         nfs_state = STATE_UMOUNT_REQ;
802                         nfs_send();
803                 } else if (reply == -NFS_RPC_PROG_MISMATCH &&
804                            supported_nfs_versions != 0) {
805                         /* umount */
806                         nfs_state = STATE_UMOUNT_REQ;
807                         nfs_send();
808                         /* And retry with another supported version */
809                         nfs_state = STATE_PRCLOOKUP_PROG_MOUNT_REQ;
810                         nfs_send();
811                 } else {
812                         nfs_state = STATE_READ_REQ;
813                         nfs_offset = 0;
814                         nfs_len = NFS_READ_SIZE;
815                         nfs_send();
816                 }
817                 break;
818
819         case STATE_READLINK_REQ:
820                 reply = nfs_readlink_reply(pkt, len);
821                 if (reply == -NFS_RPC_DROP) {
822                         break;
823                 } else if (reply == -NFS_RPC_ERR) {
824                         puts("*** ERROR: Symlink fail\n");
825                         nfs_state = STATE_UMOUNT_REQ;
826                         nfs_send();
827                 } else {
828                         debug("Symlink --> %s\n", nfs_path);
829                         nfs_filename = basename(nfs_path);
830                         nfs_path     = dirname(nfs_path);
831
832                         nfs_state = STATE_MOUNT_REQ;
833                         nfs_send();
834                 }
835                 break;
836
837         case STATE_READ_REQ:
838                 rlen = nfs_read_reply(pkt, len);
839                 if (rlen == -NFS_RPC_DROP)
840                         break;
841                 net_set_timeout_handler(nfs_timeout, nfs_timeout_handler);
842                 if (rlen > 0) {
843                         nfs_offset += rlen;
844                         nfs_send();
845                 } else if ((rlen == -NFSERR_ISDIR) || (rlen == -NFSERR_INVAL)) {
846                         /* symbolic link */
847                         nfs_state = STATE_READLINK_REQ;
848                         nfs_send();
849                 } else {
850                         if (!rlen)
851                                 nfs_download_state = NETLOOP_SUCCESS;
852                         if (rlen < 0)
853                                 debug("NFS READ error (%d)\n", rlen);
854                         nfs_state = STATE_UMOUNT_REQ;
855                         nfs_send();
856                 }
857                 break;
858         }
859 }
860
861
862 void nfs_start(void)
863 {
864         debug("%s\n", __func__);
865         nfs_download_state = NETLOOP_FAIL;
866
867         nfs_server_ip = net_server_ip;
868         nfs_path = (char *)nfs_path_buff;
869
870         if (nfs_path == NULL) {
871                 net_set_state(NETLOOP_FAIL);
872                 printf("*** ERROR: Fail allocate memory\n");
873                 return;
874         }
875
876         if (!net_parse_bootfile(&nfs_server_ip, nfs_path,
877                                 sizeof(nfs_path_buff))) {
878                 sprintf(nfs_path, "/nfsroot/%02X%02X%02X%02X.img",
879                         net_ip.s_addr & 0xFF,
880                         (net_ip.s_addr >>  8) & 0xFF,
881                         (net_ip.s_addr >> 16) & 0xFF,
882                         (net_ip.s_addr >> 24) & 0xFF);
883
884                 printf("*** Warning: no boot file name; using '%s'\n",
885                        nfs_path);
886         }
887
888         nfs_filename = basename(nfs_path);
889         nfs_path     = dirname(nfs_path);
890
891         printf("Using %s device\n", eth_get_name());
892
893         printf("File transfer via NFS from server %pI4; our IP address is %pI4",
894                &nfs_server_ip, &net_ip);
895
896         /* Check if we need to send across this subnet */
897         if (net_gateway.s_addr && net_netmask.s_addr) {
898                 struct in_addr our_net;
899                 struct in_addr server_net;
900
901                 our_net.s_addr = net_ip.s_addr & net_netmask.s_addr;
902                 server_net.s_addr = nfs_server_ip.s_addr & net_netmask.s_addr;
903                 if (our_net.s_addr != server_net.s_addr)
904                         printf("; sending through gateway %pI4",
905                                &net_gateway);
906         }
907         printf("\nFilename '%s/%s'.", nfs_path, nfs_filename);
908
909         if (net_boot_file_expected_size_in_blocks) {
910                 printf(" Size is 0x%x Bytes = ",
911                        net_boot_file_expected_size_in_blocks << 9);
912                 print_size(net_boot_file_expected_size_in_blocks << 9, "");
913         }
914         printf("\nLoad address: 0x%lx\nLoading: *\b", image_load_addr);
915
916         net_set_timeout_handler(nfs_timeout, nfs_timeout_handler);
917         net_set_udp_handler(nfs_handler);
918
919         nfs_timeout_count = 0;
920         nfs_state = STATE_PRCLOOKUP_PROG_MOUNT_REQ;
921
922         /*nfs_our_port = 4096 + (get_ticks() % 3072);*/
923         /*FIX ME !!!*/
924         nfs_our_port = 1000;
925
926         /* zero out server ether in case the server ip has changed */
927         memset(net_server_ethaddr, 0, 6);
928
929         nfs_send();
930 }