bhyve/virtio-scsi: check LUN address validity

[rosenfeld_grumpf.hope-2000.org]

Summary

Instead of blindly trusting the guest OS driver that it sends us well-
formed LUN addresses, check the LUN address for validity and fail the
request if it is invalid. While here, constify the members of the virtio
requests which aren't device-writable anyway.

[rosenfeld_grumpf.hope-2000.org]

Rebase, revert unintentional white space change.

[corvink]

usr.sbin/bhyve/pci_virtio_scsi.c

412

434–436

Should we really just assert here? It's a guest give value isn't it? So, we should omit the check on release builds. I know bhyve doesn't opt out assert on release builds. However, we shouldn't add new asserts which are required for release builds too.

[rosenfeld_grumpf.hope-2000.org]

Improve the comments describing the LUN address parsing.

[rosenfeld_grumpf.hope-2000.org]

usr.sbin/bhyve/pci_virtio_scsi.c

412

No, they must be zero, thats why we return false if any one of them isn't.

434–436

Every code path using pci_vtscsi_get_lun() (and pci_vtscsi_get_target() in a later change) is supposed to use pci_vtscsi_check_lun() to check LUN validity before even getting there and return an appropriate error to the guest.

Having these asserts in pci_vtscsi_get_lun() is thus a matter of defensive programming. These checks cost next to nothing, and they blow up only if there's a coding error, which is precisely what assertions are for.