[hyperv] Assume that VMBus xfer page ranges correspond to RNDIS messages

The (undocumented) VMBus protocol seems to allow for transfer
page-based packets where the data payload is split into an arbitrary
set of ranges within the transfer page set.

The RNDIS protocol includes a length field within the header of each
message, and it is known from observation that multiple RNDIS messages
can be concatenated into a single VMBus message.

iPXE currently assumes that the transfer page range boundaries are
entirely arbitrary, and uses the RNDIS header length to determine the
RNDIS message boundaries.

Windows Server 2012 R2 generates an RNDIS_INDICATE_STATUS_MSG for an
undocumented and unknown status code (0x40020006) with a malformed
RNDIS header length: the length does not cover the StatusBuffer
portion of the message.  This causes iPXE to report a malformed RNDIS
message and to discard any further RNDIS messages within the same
VMBus message.

The Linux Hyper-V driver assumes that the transfer page range
boundaries correspond to RNDIS message boundaries, and so does not
notice the malformed length field in the RNDIS header.

Match the behaviour of the Linux Hyper-V driver: assume that the
transfer page range boundaries correspond to the RNDIS message
boundaries and ignore the RNDIS header length.  This avoids triggering
the "malformed packet" error and also avoids unnecessary data copying:
since we now have one I/O buffer per RNDIS message, there is no longer
any need to use iob_split().

Signed-off-by: Michael Brown <mcb30@ipxe.org>

1 files changed, 14 insertions, 6 deletions

diff --git a/src/drivers/net/netvsc.c b/src/drivers/net/netvsc.c
index 8610339d..0d7708b1 100644
--- a/src/drivers/net/netvsc.c
+++ b/src/drivers/net/netvsc.c
@@ -298,15 +298,17 @@ static int netvsc_recv_control ( struct vmbus_device *vmdev, uint64_t xid,
  * @v xid		Transaction ID
  * @v data		Data
  * @v len		Length of data
- * @v iobuf		I/O buffer, or NULL if allocation failed
+ * @v list		List of I/O buffers
  * @ret rc		Return status code
  */
 static int netvsc_recv_data ( struct vmbus_device *vmdev, uint64_t xid,
 			      const void *data, size_t len,
-			      struct io_buffer *iobuf ) {
+			      struct list_head *list ) {
 	struct rndis_device *rndis = vmbus_get_drvdata ( vmdev );
 	struct netvsc_device *netvsc = rndis->priv;
 	const struct netvsc_rndis_message *msg = data;
+	struct io_buffer *iobuf;
+	struct io_buffer *tmp;
 	int rc;
 
 	/* Sanity check */
@@ -324,21 +326,27 @@ static int netvsc_recv_data ( struct vmbus_device *vmdev, uint64_t xid,
 		goto err_sanity;
 	}
 
-	/* Send completion back to host (even if I/O buffer was missing) */
+	/* Send completion back to host */
 	if ( ( rc = vmbus_send_completion ( vmdev, xid, NULL, 0 ) ) != 0 ) {
 		DBGC ( netvsc, "NETVSC %s could not send completion: %s\n",
 		       netvsc->name, strerror ( rc ) );
 		goto err_completion;
 	}
 
-	/* Hand off to RNDIS (even if I/O buffer was missing) */
-	rndis_rx ( rndis, iob_disown ( iobuf ) );
+	/* Hand off to RNDIS */
+	list_for_each_entry_safe ( iobuf, tmp, list, list ) {
+		list_del ( &iobuf->list );
+		rndis_rx ( rndis, iob_disown ( iobuf ) );
+	}
 
 	return 0;
 
  err_completion:
  err_sanity:
-	free_iob ( iobuf );
+	list_for_each_entry_safe ( iobuf, tmp, list, list ) {
+		list_del ( &iobuf->list );
+		free_iob ( iobuf );
+	}
 	return rc;
 }