QEMU hardens IDE and AHCI against migration and unplug bugs

QEMU is landing a set of IDE and AHCI fixes that close several paths by which a crafted live-migration stream or a surprise device unplug could corrupt host memory, and that correct how emulated disks report and apply CHS geometry to guests.

The most serious migration issue sat in IDE PIO state restore. The load path trusted offset and length fields from the stream without checking them against the I/O buffer, so a malicious source could place the transfer window far outside the allocation. After restore, ordinary data-port accesses became a controlled 16-bit heap write, or a heap read on the opposite transfer direction. The XlabAI Team at Tencent Xuanwu Lab reported the flaw. The fix rejects an out-of-range window and fails the load.

AHCI had related lifetime bugs. Clearing the command-list base could leave the controller still pointing at a mapping that was about to be freed, so a PIO write that finished afterward touched freed memory when the list backed an MMIO bounce buffer rather than guest RAM. Separately, tearing down the HBA on hot unplug did not drain in-flight NCQ, DMA, or PIO work, so completions ran against memory already released when a guest ejected the device without a bus reset. Katherine Leaver reported the command-list case. The series nulls the stale command pointer, treats a failed scatter-gather walk as a failed transfer, rejects command headers with an illegal FIS length, and drains every port before the device is freed.

On the guest-visible side, INITIALIZE DEVICE PARAMETERS no longer divides by zero on a geometry the drive cannot accept; unsupported translations are rejected. IDENTIFY DEVICE now keeps power-on default CHS words distinct from the translation in effect, both stay in sync when the guest changes geometry, and only a hardware reset reverts to power-on defaults (a software reset preserves a guest-selected translation, matching ATA). ATAPI identify data also reports UDMA5 only with matching standard and cable bits.

Regression tests cover the migration rejects, in-flight engine stop, unplug-during-I/O, reset semantics, and identify words. The changes matter anywhere QEMU exposes IDE or AHCI to untrusted guests or accepts migration from an untrusted source.