[hyperv] Assume that VMBus xfer page ranges correspond to RNDIS messages

The (undocumented) VMBus protocol seems to allow for transfer
page-based packets where the data payload is split into an arbitrary
set of ranges within the transfer page set.

The RNDIS protocol includes a length field within the header of each
message, and it is known from observation that multiple RNDIS messages
can be concatenated into a single VMBus message.

iPXE currently assumes that the transfer page range boundaries are
entirely arbitrary, and uses the RNDIS header length to determine the
RNDIS message boundaries.

Windows Server 2012 R2 generates an RNDIS_INDICATE_STATUS_MSG for an
undocumented and unknown status code (0x40020006) with a malformed
RNDIS header length: the length does not cover the StatusBuffer
portion of the message.  This causes iPXE to report a malformed RNDIS
message and to discard any further RNDIS messages within the same
VMBus message.

The Linux Hyper-V driver assumes that the transfer page range
boundaries correspond to RNDIS message boundaries, and so does not
notice the malformed length field in the RNDIS header.

Match the behaviour of the Linux Hyper-V driver: assume that the
transfer page range boundaries correspond to the RNDIS message
boundaries and ignore the RNDIS header length.  This avoids triggering
the "malformed packet" error and also avoids unnecessary data copying:
since we now have one I/O buffer per RNDIS message, there is no longer
any need to use iob_split().

Signed-off-by: Michael Brown <mcb30@ipxe.org>

1 files changed, 2 insertions, 7 deletions

diff --git a/src/include/ipxe/vmbus.h b/src/include/ipxe/vmbus.h
index 14c66a5d..1ea65edf 100644
--- a/src/include/ipxe/vmbus.h
+++ b/src/include/ipxe/vmbus.h
@@ -403,21 +403,16 @@ struct vmbus_channel_operations {
 	 * @v xid		Transaction ID
 	 * @v data		Data
 	 * @v len		Length of data
-	 * @v iobuf		I/O buffer, or NULL if allocation failed
+	 * @v list		List of I/O buffers
 	 * @ret rc		Return status code
 	 *
 	 * This function takes ownership of the I/O buffer.  It should
 	 * eventually call vmbus_send_completion() to indicate to the
 	 * host that the buffer can be reused.
-	 *
-	 * Note that this function will be called even if we failed to
-	 * allocate or populate the I/O buffer; this is to allow for a
-	 * completion to be sent even in the event of a transient
-	 * memory shortage failure.
 	 */
 	int ( * recv_data ) ( struct vmbus_device *vmdev, uint64_t xid,
 			      const void *data, size_t len,
-			      struct io_buffer *iobuf );
+			      struct list_head *list );
 	/**
 	 * Handle received completion packet
 	 *