bhyve: Improve HDA stream descriptor validation

[markj]

Summary

The length of each block in the stream must be non-zero. This is
assumed in hda_transfer(), otherwise an out-of-bounds read or write is
possible.

Use atomic loads to access stream descriptor fields, since they are
guest-controlled. Make sure that the descriptor array is suitably
aligned so that we can drop the __packed annotation from the structure
definition; per section 3.3.42 of the HDA spec the BDL pointer is
supposed to be 128-byte aligned, in fact.

Reported by: Brian Delgado from Intel using Anthropic Opus 4.8

[christos]

From what I understand, the issue is that because this is not bhyve-internal memory, but entries we read from the guest's memory, we want to make sure these values are read at that point exactly, so that we don't let the compiler re-read them later when the value might have been changed?

By that logic though, shouldn't all/most guest memory loads (paddr_guest2host()) be fixed as well?

[markj]

In D60678#1392578, @christos wrote:

From what I understand, the issue is that because this is not bhyve-internal memory, but entries we read from the guest's memory, we want to make sure these values are read at that point exactly, so that we don't let the compiler re-read them later when the value might have been changed?

Right, here I am (ab)using atomic_load_* to perform a volatile load from an aligned field. That is one problem fixed here. The other problem is fixed by the bdle_sz == 0 check.

By that logic though, shouldn't all/most guest memory loads (paddr_guest2host()) be fixed as well?

paddr_guest2host() doesn't load anything from guest memory, it just gives you a pointer to guest memory. What else needs to be fixed?