Hidden Protected Area
General information about the HPA
As opposed to Recovery Partitions, Protected Service Areas (PSAs) such as the HPA are (let's say) images of partitions written to the end of a harddisk. They are only accessible through their BEER. The general idea is that, under control of the BIOS, the PSAs are totally hidden from all ordinary software, including malware (viruses, trojans, spyware). They are only accessible when permitted by the BIOS, and even then only through special HPA-aware tools. Under GNU/Linux they are only accessible with low level tools like dd.
The HPA is based on Phoenix FirstWare. FirstWare is (in short) an implementation of two technologies: BEER and PARTIES. (Yes, those names are correct!) BEER (Boot Engineering Extension Record) and PARTIES (Protected Area Run Time Interface Extension Services) are described in this T13 working draft. There is a more general introduction to PARTIES on the IBM site. FirstWare depends on certain ATA-5 commands, so it won't work with lower ATA level (earlier) drives or even with all ATA-5 drives. Unfortunately, there is no public HPA compatibility tester or list of compatible drives.
Basically, what's going on is that the Phoenix BIOS commands the drive to hide the last few gigabytes of the hard disk (the HPA). The to non-HPA aware software, the drive appears to have a smaller size. Note that this is just a setting in the BIOS and can be disabled. The HPA can be accessed by pressingor at boot time. The BIOS will then parse the BEER (128 bytes, situated in the last sector of 512 bytes of the harddisk) and the "Directory of Services" (consisting of directory entries of 64 bytes each, starting in the last sector and spilling over into the previous sectors) to see what part of the HPA should be launched. In (most?) ThinkPads the BEER tells the BIOS to launch the Access IBM Predesktop Area. The system will then actually be booting into a (minimal) DOS environment which is able to launch a graphical shell (called Phoenix FirstSight). IBM has simply rebranded this graphical shell to the Access IBM Predesktop Area. From this graphical shell one can launch several tools (BIOS Setup Utility, diagnostic tools, recovery tools).
Three BIOS options
The BIOS has three settings for the "IBM Predesktop Area" (in the Security category):
- Secure: No user or SW-initiated changes; Contents hidden from OS
- Normal: Change allowed; Contents hidden from OS
- Disabled: Not Usable; Visible and Reclaimable
Normal is the default setting. One can boot into the Predesktop Area when either Secure or Normal is set. When Disabled is set the Predesktop Area will not boot. According to the Predesktop Area white paper the HPA is both "locked"1 and "hidden" when Secure is set and only "hidden" when normal is set. In practice the result seems to be that the HPA is totally unavailable to the Linux kernel (and therefore all applications) when Secure is set. (The HPA should be unavailable in "Secure mode" for all operating systems, MS Windows included.) One would expect the HPA to be only accessable to HPA aware tools when Normal is set. However, recent kernels disable the HPA by default when Normal is set. Note that recent threads on linux-ide suggest that the ThinkPad will reenable the HPA on resume and thus causing (possibly serious) conflicts with the GNU/Linux system (that assumes the HPA is still available).
With Disabled you should be able to safely reclaim the area used by the HPA (to GNU/Linux it basically is unallocated space on the harddisk).
Details of the HPA
Fabrice Bellet describes a technique he used to explore the HPA of his ThinkPad T40, using GNU/Linux tools. This technique is only for the more curious or more careless people. It uses "dd" to copy the sectors on the harddisk containing the HPA from "/dev/hda" to a new file: when using "dd" on "/dev/hda" you are only one small typo away from an unrecoverable disaster!
Another option is the Hidden Protected Area FileSystem, a read-only FUSE (Filesystem in USErspace). hpafs allows to analyze, backup, etc. the HPA. The current release is hpafs-0.1.0 (alpha, developers only). Check the README for further details.
Yet another alternative of getting information on HPA is fiesta. This tool allows you to safely (devices are opened in read-only mode) inspect the contents of HPA and display detailed information contained in HPA header. In addition, this program will generate the complete command line needed for a backup of whole HPA, selected HPA partition or HPA header, using basic linux tools like "dd". This shall save your time and potentially disastrous typos. It is not the end though, fiesta will also generate the command line to restore previously saved image of entire HPA or HPA header. Beforehand, read about limitations. For the curious "what's-inside" people, fiesta will also generate the complete mount command line of selected HPA partition.
Finally, the latest, and it seems to be the most powerful set of tools to deal with HPA and PSA's (called, very naturely, hpatools) is discussed in this thread. That stuff is German language only, but here is a translation that was successfully tested with a X31.
How to reclaim the HPA
After disabling the "IBM Predesktop Area" (with the BIOS option "Disabled", see above) it's possible to reclaim the area used by the HPA. Then one can include that area in a partition with standard tools (i.e. fdisk, mkfs) as it will be treated just as regular free space of the hard disk.
If you'd like to use the original drive with an IDE to USB adapter after replacing it, the usb disk may still not be useable to its full capacity, since for Hitachi Travelstar hard disks the "clipping" feature may be activated to hide the HPA as well. With the Hitachi Feature Tool ftool.exe available as a bootable CD ISO (http://www.thgweb.de/downloads/display.php?id=1124) it's possible to readjust the disk capacity to its original value. This works only with the disk connected to the IDE bus during the procedure.
It might be possible to use the FirstWare tools included in the HPA to make the HPA more useful for GNU/Linux purposes. For instance, the copy of the preloaded OS could be replaced with an emergency backup of your GNU/Linux distribution. Maybe the Predesktop area could be even used to boot into a GNU/Linux rescue system. Whether the Phoenix proprietary tools really allow alternative uses and whether those tools do not make it too hard to accomplish those cannot yet be said. It seems realistic to assume that the benefits of those alternative uses aren't worth the effort to accomplish them. Still, it might be fun (altough possibly hazardous to your system) to try ...
Problems caused by the HPA
As of Linux 2.6.18, having a HPA may cause errors when resuming the laptop from suspend-to-RAM or suspend-to-disk. See the section called "SectorIdNotFound disk errors when laptop is resumed" in ACPI suspend problems.
- Predesktop Area white paper
- Predesktop Aministrator Utility (DOS)
- Protected Area Run Time Interface Extension Services (PARTIES) ANSI INCITS 346-2001 ($30)
- The latest free draft of ANSI INCITS 346-2001 (BEER specs)
- Phoenix FirstWare White Paper
- Section 11 of the Large Disk HOWTO (Clipped disks)
Models featuring this Technology
- ThinkPad R40, R40e, R50, R50e, R50p, R51, R52
- ThinkPad T40, T40p, T41, T41p, T42, T42p, T43, T43p
- ThinkPad X31, X32, X40, X41, X41 Tablet, X61s, X61 Tablet
- ThinkPad Z61m
- Presumably by having the BIOS use the SET MAX security extension. The BIOS seems to set a password for the HPA at boot (using the SETMAX-SET PASSWORD command) and after that use that password to issue a SETMAX-LOCK command. Since the password is unknown (and most likely changes at every Secure boot) the HPA is inaccessable to all programs running on the ThinkPad.
Something similar would be possible running in Normal mode. Then a program could issue the SETMAX-SET PASSWORD command. At the moment there's no program running under GNU/Linux capable of doing that. Of course this is possibly less secure: it's (theoretically) possible that other (rogue) programs get hold of that password.