[hyperv] Assume that VMBus xfer page ranges correspond to RNDIS messages

The (undocumented) VMBus protocol seems to allow for transfer
page-based packets where the data payload is split into an arbitrary
set of ranges within the transfer page set.

The RNDIS protocol includes a length field within the header of each
message, and it is known from observation that multiple RNDIS messages
can be concatenated into a single VMBus message.

iPXE currently assumes that the transfer page range boundaries are
entirely arbitrary, and uses the RNDIS header length to determine the
RNDIS message boundaries.

Windows Server 2012 R2 generates an RNDIS_INDICATE_STATUS_MSG for an
undocumented and unknown status code (0x40020006) with a malformed
RNDIS header length: the length does not cover the StatusBuffer
portion of the message.  This causes iPXE to report a malformed RNDIS
message and to discard any further RNDIS messages within the same
VMBus message.

The Linux Hyper-V driver assumes that the transfer page range
boundaries correspond to RNDIS message boundaries, and so does not
notice the malformed length field in the RNDIS header.

Match the behaviour of the Linux Hyper-V driver: assume that the
transfer page range boundaries correspond to the RNDIS message
boundaries and ignore the RNDIS header length.  This avoids triggering
the "malformed packet" error and also avoids unnecessary data copying:
since we now have one I/O buffer per RNDIS message, there is no longer
any need to use iob_split().

Signed-off-by: Michael Brown <mcb30@ipxe.org>

1 files changed, 13 insertions, 50 deletions

diff --git a/src/net/rndis.c b/src/net/rndis.c
index e21dd19..dde4fcd 100644
--- a/src/net/rndis.c
+++ b/src/net/rndis.c
@@ -759,67 +759,30 @@ static void rndis_rx_message ( struct rndis_device *rndis,
  * Receive packet from underlying transport layer
  *
  * @v rndis		RNDIS device
- * @v iobuf		I/O buffer, or NULL if allocation failed
+ * @v iobuf		I/O buffer
  */
 void rndis_rx ( struct rndis_device *rndis, struct io_buffer *iobuf ) {
 	struct net_device *netdev = rndis->netdev;
 	struct rndis_header *header;
-	struct io_buffer *msg;
-	size_t len;
 	unsigned int type;
 	int rc;
 
-	/* Record dropped packet if I/O buffer is missing */
-	if ( ! iobuf ) {
-		DBGC2 ( rndis, "RNDIS %s received dropped packet\n",
-			rndis->name );
-		rc = -ENOBUFS;
+	/* Sanity check */
+	if ( iob_len ( iobuf ) < sizeof ( *header ) ) {
+		DBGC ( rndis, "RNDIS %s received underlength packet:\n",
+		       rndis->name );
+		DBGC_HDA ( rndis, 0, iobuf->data, iob_len ( iobuf ) );
+		rc = -EINVAL;
 		goto drop;
 	}
+	header = iobuf->data;
 
-	/* Split packet into messages */
-	while ( iobuf ) {
-
-		/* Sanity check */
-		if ( iob_len ( iobuf ) < sizeof ( *header ) ) {
-			DBGC ( rndis, "RNDIS %s received underlength packet:\n",
-			       rndis->name );
-			DBGC_HDA ( rndis, 0, iobuf->data, iob_len ( iobuf ) );
-			rc = -EINVAL;
-			goto drop;
-		}
-		header = iobuf->data;
-
-		/* Parse and check header */
-		type = le32_to_cpu ( header->type );
-		len = le32_to_cpu ( header->len );
-		if ( ( len < sizeof ( *header ) ) ||
-		     ( len > iob_len ( iobuf ) ) ) {
-			DBGC ( rndis, "RNDIS %s received malformed packet:\n",
-			       rndis->name );
-			DBGC_HDA ( rndis, 0, iobuf->data, iob_len ( iobuf ) );
-			rc = -EINVAL;
-			goto drop;
-		}
-
-		/* Split buffer if required */
-		if ( len < iob_len ( iobuf ) ) {
-			msg = iob_split ( iobuf, len );
-			if ( ! msg ) {
-				rc = -ENOMEM;
-				goto drop;
-			}
-		} else {
-			msg = iobuf;
-			iobuf = NULL;
-		}
-
-		/* Strip header */
-		iob_pull ( msg, sizeof ( *header ) );
+	/* Parse and strip header */
+	type = le32_to_cpu ( header->type );
+	iob_pull ( iobuf, sizeof ( *header ) );
 
-		/* Handle message */
-		rndis_rx_message ( rndis, iob_disown ( msg ), type );
-	}
+	/* Handle message */
+	rndis_rx_message ( rndis, iob_disown ( iobuf ), type );
 
 	return;