PXE is broken on LWIP

[Jerome Forissier]

Hello Heinrich,

On 4/22/25 16:54, Heinrich Schuchardt wrote:
> Hello Jerome
> 
> PXE booting from standard boot with NET_LWIP just stalls if the server does not respond:
> 
> Using ethernet at 16030000 device
> TFTP from server 192.168.99.1; our IP address is 192.168.99.47
> Filename 'pxelinux.cfg/01-6c-cf-39-00-2d-29'.
> Load address: 0x45900000
> Loading:
> 
> If a server cannot be connected, the network loop should be exited.

I agree. I was thinking the lwIP TFTP app would handle this but it
is not the case. I have a patch for this, which will abort the transfer
when no data is received for more than 10 seconds.

> 
> When pressing CTRL-C multiple times I see crashes with a call chain
> 
> tftp_open -> sys_check_timeouts -> memp_free -> do_memp_free_pool

tftp_open() in net/lwip/tftp.c does nothing. Do you mean tftp_loop()?
> 
> I guess in sys_check_timeouts() we must remove timed-out timers from the chain to avoid freeing them twice.

I can't reproduce this crash with qemu_arm64_lwip_defconfig.

$ make qemu_arm64_lwip_defconfig
[...]
$ make -s -j$(nproc) CROSS_COMPILE="ccache aarch64-linux-gnu-"
$ qemu-system-aarch64 -M virt -nographic -cpu max -bios u-boot.bin
[...]
=> dhcp; setenv serverip 10.0.2.1; tftp
DHCP client bound to address 10.0.2.15 (3 ms)
Using virtio-net#32 device
TFTP from server 10.0.2.1; our IP address is 10.0.2.15
Filename ''.
Load address: 0x40200000
Loading:
[Press Ctrl+C]
Abort
=>

Which platform/config are you using? Can you create a reproducer with
QEMU?

Thanks,
-- 
Jerome

> 
> Best regards
> 
> Heinrich
> 
>