net: avoid vector allocation in MMDS path

When handling network traffic from the guest destined towards MMDS we
create a vector to copy the packet from guest to host memory. This is
because, the packet in guest memory might be stored in multiple
(non-contiguous) descriptors and MMDS code can't handle those.

Change this logic to always keep a buffer inside the Net struct to
handle these cases, so that we avoid the vector allocation.

Also, introduce a check in the TX path that ensures we only handle
sensibly-sized packets from the guest (MAX_BUFFER_SIZE).

Signed-off-by: Babis Chalios <bchalios@amazon.es>

Author: bchalios

src/vmm/src/devices/virtio/net/device.rs

@@ -127,8 +127,7 @@ pub struct Net {
 
     rx_bytes_read: usize,
     rx_frame_buf: [u8; MAX_BUFFER_SIZE],
-
-    tx_frame_headers: [u8; frame_hdr_len()],
+    tx_frame_buf: [u8; MAX_BUFFER_SIZE],
 
     pub(crate) irq_trigger: IrqTrigger,
 
@@ -189,7 +188,7 @@ impl Net {
             rx_deferred_frame: false,
             rx_bytes_read: 0,
             rx_frame_buf: [0u8; MAX_BUFFER_SIZE],
-            tx_frame_headers: [0u8; frame_hdr_len()],
+            tx_frame_buf: [0u8; MAX_BUFFER_SIZE],
             irq_trigger: IrqTrigger::new().map_err(NetError::EventFd)?,
             config_space,
             guest_mac,
@@ -438,37 +437,42 @@ impl Net {
     fn write_to_mmds_or_tap(
         mmds_ns: Option<&mut MmdsNetworkStack>,
         rate_limiter: &mut RateLimiter,
-        headers: &mut [u8],
+        tx_frame_buf: &mut [u8],
         frame_iovec: &IoVecBuffer,
         tap: &mut Tap,
         guest_mac: Option<MacAddr>,
         net_metrics: &NetDeviceMetrics,
     ) -> Result<bool, NetError> {
         // Read the frame headers from the IoVecBuffer
-        let max_header_len = headers.len();
+        let max_header_len = frame_hdr_len();
         let header_len = frame_iovec
-            .read_volatile_at(&mut &mut *headers, 0, max_header_len)
+            .read_volatile_at(&mut &mut *tx_frame_buf, 0, max_header_len)
             .map_err(|err| {
                 error!("Received malformed TX buffer: {:?}", err);
                 net_metrics.tx_malformed_frames.inc();
                 NetError::VnetHeaderMissing
             })?;
 
-        let headers = frame_bytes_from_buf(&headers[..header_len]).map_err(|e| {
+        // First read just the headers of the frame so we can check if this is
+        // destined for MMDS.
+        let headers = frame_bytes_from_buf(&tx_frame_buf[..header_len]).map_err(|e| {
             error!("VNET headers missing in TX frame");
             net_metrics.tx_malformed_frames.inc();
             e
         })?;
 
         if let Some(ns) = mmds_ns {
             if ns.is_mmds_frame(headers) {
-                let mut frame = vec![0u8; frame_iovec.len() - vnet_hdr_len()];
-                // Ok to unwrap here, because we are passing a buffer that has the exact size
-                // of the `IoVecBuffer` minus the VNET headers.
-                frame_iovec
-                    .read_exact_volatile_at(&mut frame, vnet_hdr_len())
-                    .unwrap();
-                let _ = ns.detour_frame(&frame);
+                // This frame is destined for MMDS. So, now read the rest of the frame (if there's
+                // anything to read)
+                if frame_iovec.len() > header_len {
+                    // Ok to unwrap here, because we are passing a buffer that has the exact size
+                    // of the `IoVecBuffer` minus the VNET headers.
+                    frame_iovec
+                        .read_exact_volatile_at(&mut tx_frame_buf[header_len..], header_len)
+                        .unwrap();
+                }
+                let _ = ns.detour_frame(&tx_frame_buf[vnet_hdr_len()..]);
                 METRICS.mmds.rx_accepted.inc();
 
                 // MMDS frames are not accounted by the rate limiter.
@@ -607,6 +611,17 @@ impl Net {
                     continue;
                 }
             };
+
+            // We only handle frames that are up to MAX_BUFFER_SIZE
+            if buffer.len() > MAX_BUFFER_SIZE {
+                error!("net: received too big frame from driver");
+                self.metrics.tx_fails.inc();
+                tx_queue
+                    .add_used(mem, head_index, 0)
+                    .map_err(DeviceError::QueueError)?;
+                continue;
+            }
+
             if !Self::rate_limiter_consume_op(&mut self.tx_rate_limiter, buffer.len() as u64) {
                 tx_queue.undo_pop();
                 self.metrics.tx_rate_limiter_throttled.inc();
@@ -616,7 +631,7 @@ impl Net {
             let frame_consumed_by_mmds = Self::write_to_mmds_or_tap(
                 self.mmds_ns.as_mut(),
                 &mut self.tx_rate_limiter,
-                &mut self.tx_frame_headers,
+                &mut self.tx_frame_buf[..buffer.len()],
                 &buffer,
                 &mut self.tap,
                 self.guest_mac,