Re: Lost partition tables on ide-hd + ahci drive

[Fiona Ebner]

Am 16.02.23 um 17:15 schrieb Mike Maslenkin:
> Makes sense for disks without partition table.
> But wouldn't Linux or any other OS write at least 4K bytes in that case?

Yes, it does here.

> Who may want to write 512 bytes for any purposes except for boot
> sector nowadays..

>From a quick test, fdisk on Linux even causes a 4KiB write when
partitioning, Windows only 512 bytes.

> In dump mentioned before only 512 bytes were not zeroed, so I guess it
> was caused by IO from guest OS.

Yes, with all checks you suggested, most false positives could be
avoided, and we can hope to catch something with Windows. And on Linux
if the corruption on Linux is also just 512 bytes and not 4KiB, but we
don't have any dumps yet unfortunately.

> In other cases it can be caused by misconfigured IDE registers state
> or broken FIS memory area.

I stumbled upon [0], which will be addressed by [1]. Any chance that it
could be related?

[0]: https://gitlab.com/qemu-project/qemu/-/issues/62
[1]: https://lists.nongnu.org/archive/html/qemu-devel/2023-02/msg01141.html

Best Regards,
Fiona

> On Thu, Feb 16, 2023 at 6:25 PM Fiona Ebner <f.ebner@proxmox.com> wrote:
>>
>> Am 16.02.23 um 15:17 schrieb Mike Maslenkin:
>>> Does additional comparison make a sense here: check for LBA == 0 and
>>> then check MBR signature bytes.
>>> Additionally it’s easy to check buffer_is_zero() result or even print
>>> FIS contents under these conditions.
>>> Data looks like a part of guest memory of 64bit Windows.
>>
>> Thank you for the suggestion! I'll think about adding such a check and
>> dumping of FIS contents in a custom build for affected users. But in
>> general it would be too much noise for non-MBR cases: e.g. on a disk
>> formatted with ext4 (without any partitions), Linux will write to sector
>> 0 on every startup and shutdown.
>>
>> Best Regards,
>> Fiona
>>
>