diff -uNr tftpd.orig/tftpd.c tftpd/tftpd.c
--- tftpd.orig/tftpd.c	2000-07-29 20:37:21.000000000 +0200
+++ tftpd/tftpd.c	2005-08-05 17:57:59.000000000 +0200
@@ -95,6 +95,17 @@
 #define MAXARG		4
 static char		*dirs[MAXARG+1];
 
+/* JH: For tftp update convenience */
+
+static int do_flash_upgrade = 0;
+
+void start_flash_upgrade(void) {
+	if (vfork() == 0) {
+		char *argv[]={ "upgrade_firmware", NULL };
+		execv("/bin/upgrade_firmware", argv);
+	}
+}
+
 int
 main(int ac, char **av)
 {
@@ -107,7 +118,7 @@
 	int on = 1;
 
 	ac--; av++;
-	if (ac==0) dirs[0] = "/tftpboot";  /* default directory */
+	if (ac==0) dirs[0] = "/var/files";  /* default directory */
 	while (ac-- > 0 && n < MAXARG)
 		dirs[n++] = *av++;
 	openlog("tftpd", LOG_PID, LOG_DAEMON);
@@ -122,6 +133,7 @@
 		syslog(LOG_ERR, "recvfrom: %m\n");
 		exit(1);
 	}
+#if 0 /* JH */
 	/*
 	 * Now that we have read the message out of the UDP
 	 * socket, we fork and exit.  Thus, inetd will go back
@@ -186,6 +198,7 @@
 			exit(1);
 		}
 	}
+#endif /* JH */
 	from.sin_family = AF_INET;
 	alarm(0);
 
@@ -282,10 +295,16 @@
 		nak(ecode);
 		exit(1);
 	}
-	if (tp->th_opcode == WRQ)
+	if (tp->th_opcode == WRQ) {
+		if (strcmp(filename, "tiburon.rbt") == 0) {
+			do_flash_upgrade = 1;
+		}
 		(*pf->f_recv)(pf);
-	else
+
+	} else {
 		(*pf->f_send)(pf);
+	}
+
 	exit(0);
 }
 
@@ -340,8 +359,11 @@
 			return(EACCESS);
 		}
 	}
+#if 0 /* JH */
 	if (stat(filename, &stbuf) < 0)
 		return (errno == ENOENT ? ENOTFOUND : EACCESS);
+#endif /* JH */
+
 #if 0
 	/*
 	 * The idea is that symlinks are dangerous. However, a symlink
@@ -359,6 +381,7 @@
 		return (EACCESS);
 	}
 #endif
+#if 0 /* JH */
 	if (mode == RRQ) {
 		if ((stbuf.st_mode & S_IROTH) == 0)
 			return (EACCESS);
@@ -366,7 +389,8 @@
 		if ((stbuf.st_mode & S_IWOTH) == 0)
 			return (EACCESS);
 	}
-	fd = open(filename, mode == RRQ ? O_RDONLY : O_WRONLY|O_TRUNC);
+#endif /* JH */
+	fd = open(filename, mode == RRQ ? O_RDONLY : O_WRONLY|O_TRUNC|O_CREAT);
 	if (fd < 0)
 		return (errno + 100);
 	file = fdopen(fd, (mode == RRQ)? "r":"w");
@@ -459,6 +483,7 @@
 justquit(int signum)
 {
 	(void)signum;
+
 	exit(0);
 }
 
@@ -526,6 +551,10 @@
 	ap->th_block = htons((u_short)(block));
 	(void) send(peer, ackbuf, 4, 0);
 
+	if (do_flash_upgrade == 1) {
+		start_flash_upgrade();
+	}
+
 	mysignal(SIGALRM, justquit);      /* just quit on timeout */
 	alarm(rexmtval);
 	n = recv(peer, buf, sizeof (buf), 0); /* normally times out and quits */