Talk:Predesktop Area

From ThinkWiki
Revision as of 23:32, 20 February 2006 by Pebolle (Talk | contribs) (minor clarifications, typos)
Jump to: navigation, search

Use the HPA for GNU/Linux?

More interesting than removing the HPA (which includes a.o. Acces IBM Predesktop Area, some other tools and a backup of the pre-installed OS) would be to use this area for GNU/Linux too. At least, removing the HPA only saves 3,5 GB on my 60 GB hard disk. It would be worth a try to see whether the backup of the pre-installed OS on the largest PSA could be replaced by a backup of your favourite GNU/Linux distribution.

Elaborating on my ideas a few days later, I'd guess the following could be tried:

  • see whether GRUB can be made to boot the Access IBM Predekstop Area (I guess by "chainloading" the bootsector of its PSA). Right now GRUB refuses to load sectors outside the partioned area. I've got absolutely no idea if it's possible to write a hack to overcome that restriction. Need to contact the GRUB people about that ...
  • write a HPA or SPA driver. That driver should provide something like "/dev/hpa", "/dev/hpa0", etc or "/dev/spa", "/dev/spa0", whatever. The idea here is that it allows you to simply mount (ro!) the Hidden Protected Area (given the correct BIOS settings). Probably just an addaption of the current drivers for (IDE?) harddisks. (This might mean "/dev/hda" and "/dev/hpa" overlap: dangerous?) That would probably need - way - more coding skills than I have ...
  • probably much easier would be to write a FUSE for the HPA: hpafs.
  • write some userspace tools for the HPA/the SPAs (things like: dumpbeer, printDoS).

It should be clear these are basically random ideas. Still feedback would be appreciated ...


Hei,

interesting ideas, but i'd only see a point in it if one could keep Win and Linux rescue stuff in the HPA. That means it would need to be expandable or fit the stuff for both systems. Wyrfel 20:03, 15 Mar 2005 (CET)


Thanks.

Short answer: that should be possible.

Long answer: I see little in the specs (as I understand them now) to stop one from adding (say) an extra 3 GB GNU/Linux-rescue PSA or something like that. We might try to do that first by changing the BEER and DoS manually. (Not sure whether Phoenix added some proprietary stuff to keep you from booting it. The PSA should always be accesable with the proper BIOS setting.) It might be mandatory to put it on a FAT filesystem. The hard part probably is to have it show up in the Access IBM Predesktop Area. (My guess is you need to regenerate the FirstSight "graphical shell". If that's correct we probably only can use the FirstWare tools "hidden" on their little PSA. That's no fun. Well it might a little fun if we try FreeDOS).

Paul Bolle (not logged in)


Update: a trivial patch to grub allows it to also work outside the partioned area:

--- /var/tmp/rpm/BUILD/grub-0.95/stage2/disk_io.c.oud   2004-05-23 18:35:24.000000000 +0200
+++ /var/tmp/rpm/BUILD/grub-0.95/stage2/disk_io.c       2005-03-18 22:38:30.050907408 +0100
@@ -297,8 +297,8 @@
    *  Check partition boundaries
    */
   if (sector < 0
-      || ((sector + ((byte_offset + byte_len - 1) >> SECTOR_BITS))
-         >= part_length))
+      /*|| ((sector + ((byte_offset + byte_len - 1) >> SECTOR_BITS))
+         >= part_length)*/)
     {
       errnum = ERR_OUTSIDE_PART;
       return 0;

I made a grub CD with a grub patched with the above. Now I can "cat" the bootsector of the Predesktop Area from the grub shell (when booting of that grub CD). But I haven't yet managed to boot the Predesktop Area (dangerous stuff!) To be continued ...

Paul Bolle Fri Mar 18 22:42:43 CET 2005



I've been playing around with the predesktop area tonight. I was simply trying to just leave the diagnostics stuff and remove the windows part. I wrote some programs to read/write the BEER data and stuff, but I wasn't able to get the system to boot it, it kept erroring "Authentication of System Services failed" (or something along those lines). I will play around with this some more later


Tim Nordell



A quick look with a hexeditor gave me two instances of "Application authentication has failed!" in the FirstSight application. Does that sound familair?

Paul Bolle Fri Apr 1 19:35:30 CEST 2005



Actually it wasn't that. I did a search of that too, the message itself was not in the predesktop area at all. What also is interesting is the fw*.exe utilities for manipulating the predesktop area, contains the string "MD5" which makes me wonder if there is an md5 hash of each "predesktop" partition. I know on the IBM whitepaper it states there being a signature so that non-signed applications can not be run. Could a simple "md5" be the signature?

Tim Nordell 12:01, 3 Apr 2005 (CEST)



  • What is it that you were trying to do (what did trigger the error you saw)?
  • About ten of the fw*.exe utilities contain the phrase "MD5 Checksums do not match". So they could very well be using MD5 sums for some sort of validation. But they could use the MD5 sums in a lot of ways actually, so I won't yet speculate ...

Paul Bolle Sun Apr 3 15:11:10 CEST 2005

Predesktop Area

I made a program that takes the BEER record at the end, parses it out to a ".cfg" file, lets you modify it, recalibrate the start spots for the records, and write it out to disk again. It doesn't directly access hda, 'cept for reading the original beer record. It makes a script file to go with the files you have, to read in the HPA data, and to write it out again with the new record.

Anyways, I tried simply removing the last record from the BEER, which is the windows recovery partition. It didn't like that.


Did you update the two's complement checksum at the end of the BEER?

Paul Bolle


Yep, I updated that. If I don't update that, it doesn't even say that failed message. I also made a seperate program to update the checksum so you can also modify the beer record by hand with a hex editor and have valid checksums.

Linux kernel support

TODO
research and add to article
  • Add a section on dmesg and hdparm -I output:
(...)
Commands/features:
       Enabled Supported:
(...)
          *    Host Protected Area feature set
(...)
               SET MAX security extension
               Address Offset Reserved Area Boot
(...)
  • Recent (2.6.10 and up?) kernels disable HPAs automatically (in drivers/ide/ide-disk.c). Dmesg example:
hda: Host Protected Area detected.
       current capacity is 110194034 sectors (56419 MB)
        native  capacity is 117210240 sectors (60011 MB)
hda: Host Protected Area disabled.

This should be (further researched and) added to this section (maybe with some pointers to the unexpected consequences of this new approach ...)

Paul Bolle 22:06, 6 Sep 2005 (CEST)

  • SRCMOS24.EXE

In the PSA used by the Predesktop Area I found a "hidden" executable: SRCMOS24.EXE (it is not mentioned in the FAT). This executable can capture and update CMOS data. It might only be used by the FirstSight program to display (part of) the BIOS info. It might be nice to see what it can do and if similar things are possible under GNU/Linux.

Paul Bolle 22:01, 7 Sep 2005 (CEST)

Newer thinkpads don't use Phoenix Firstware?

On my T42 that arrived yesterday, the predesktop area looks a lot like MS Windows. The widget set, the fonts, even the boot sequence looks exactly like Windows 2000. Debian-installer indentified it as "Microsoft Windows NT/2000/XP", while it identified my XP partition as "Microsoft Windows XP Professional"

Has Lenovo/IBM changed their system, or is this Phoenix stuff really just Windows?

-- Evan.Heidtmann

Evan,

Could it be that you're talking about the preinstalled version of Windows here? As far as I know (using information to be found on the internet, not personal research) the preinstalled OS will reformat its partition from FAT32 to NTFS at first boot. That could explain the difference in the identification by the Debian installer (which I never really used).

Moreover the Predesktop Area is part of the HPA and the HPA is not an partition. It seems unlikely that the Debain installer notices the HPA. As far as I know there are at present no GNU/Linux tools with a (useful) support of HPAs.

Paul Bolle 15:43, 4 Aug 2005 (CEST)

My T42P (model 2373HSG) is using a cut-down version of Windows XP as the pre-desktop area. I'm not sure whether it's a special IBM thing or just a Windows PE (preinstallation environment) setup. It includes Java and Python, which are used by some of the IBM tools, and the Opera web browser.

It's no longer an HPA but a 487MB hidden FAT32 called IBM_SERVICE located at the end of the disk.

--Korourke

Rescue and Recovery via grub?

Did anyone get the Rescue and Recovery partition to boot via grub on recent models? On a T43 with

rootnoverify (hd0,1)
chainloader +1

the Rescue and Recovery partition starts booting nicely and then, a few seconds in the R&R loading sequence, chokes with a

STOP: c000021a {Fatal System Error}
The Session Manager Initialization system process terminated unexpectedly with a status of 0xc000003a (0x00000000 0x00000000).
The system has been shut down. 

The problem started right after installing grub into the MBR (I couldn't get the preinstalled MBR to boot grub from an active primary partition). It seems oblivious to the Predesktop BIOS setting.

The same problem has been reported by others with other models (for example here for a T42).

Thinker 11:35, 30 Sep 2005 (CEST)

Your "Rescue and Recovery partition" seems not to be a HPA (which isn't a partition). Maybe we should open a new page for that system.

Paul Bolle 21:54, 30 Sep 2005 (CEST)

It may very well not be an HPA , but the BIOS stil calls it a "Predesktop Area". Anyway, the partition is actually a VFAT partition (even though it has type 0x12, "Compaq Diagnostics"). It seems to boot into PC-DOS (using NTDETECT.EXE so it looks like Windows startup) and then its AUTOEXEC.BAT runs a fancy GUI. --Thinker 23:31, 30 Sep 2005 (CEST)


Right, there has been a lot of confusion about this, we should have a separate page. Introduced an edit link (called Rescue and Recovery) on the ThinkPad Technologies page for that purpose.

Suggestions for projects

I'd guess it would be rather nice to have GNU/Linux tools (like sfdisk and parted) HPA aware. The most urgent change would be to have those programs at least recognize and respect a HPA (e.g.: do not write in or otherwise use the HPA area; unless the user gives a --force option or something similar).

As for now, I realize I caused this error: ENOPATCH.

Paul Bolle 22:56, 5 Nov 2005 (CET)

Keeping functionality of the blue AccessIBM button

Somebody figured out to keep the AccessIBM functionality when installing Linux, quite easy fix. How come nobody thought about it before? :) (link got from Installing_Ubuntu_5.04_on_a_ThinkPad_T43_(1875) here)

--Micampe 17:39, 9 Dec 2005 (CET)

The relevant part of that page:

Set the IBM Predesktop Area (in the BIOS) to “Secure”. Boot using the SUSE DVD. Shrink the Windows partition as required. Follow the instructions and go through the regular installation process. Create a primary partition for /boot (the other stuff can go into the extended partitions) and when the time comes to install GRUB (you do prefer GRUB to LILO, don’t you?), make sure you install it into the boot sector of the boot partition. Set this partition as active. Leave the MBR alone.

That's the first thing I tried on my T43. Didn't work: setting the active partition to /boot had no effect, it was still booting the first (Windows) partition. So I had to install Grub into MBR, thereby killing R&R. Anyway, there's another solution in the article page (didn't try it since I saw it only after purging my R&R partition).


--Thinker 19:18, 9 Dec 2005 (CET)

Parsing the HPA information (BEER/DOS)

I too have been writing a program to parse the BEER and DOS info. Sample output:

beer.signature: 0xBEEF
beer.size: 128
beer.flags: 41
Read Only:
Generated Record:
Use Reserved Area Boot Code Address: yes
Configuration Time Stamp is valid:
Device Supports LBA: yes
Directory of Services is Present
Formatted Geometry Valid
Reported Geometry Valid yes
beer.reported_cylinders: 16383
beer.reported_heads: 16
beer.reported_sectors: 63
beer.reported_bytes_sector: 512
beer.reported_sectors_device: 117210240
beer.formatted_cylinders: 16383
beer.formatted_heads: 16
beer.formatted_sectors: 63
beer.formatted_bytes_sector: 512
beer.formatted_sectors_device: 117210240
year: 2004
day: 313
beer.timestamp: 1426063684
beer.device_index: 0x80
beer.hpa_start: 110194034
beer.boot_code_address: 117002545
beer.num_entries: 8
beer.dir_length: 64
beer.revision: 0
dev_name: HTS726060M9AT00
beer.checksum: -26982
dos[0].flags: 3
Service area is available as B:
Diagnostic Service:
Service Area is Read Only:
This Boot:
Empty Service Area:
Hidden Service Area: yes
Service Area is bootable as A: yes
dos[0].service_area_start: 117005431
dos[0].service_area_size: 204800
dos[0].load_sectors: 1
dos[0].load_address: 0x7:C000
dos[0].service_area_id: 0
dos[0] id_str: FirstWare Reserved Area
dos[0].checksum: -22271
[...]

Very rough code. Send me an e-mail (at the address found at my user page) if you want a (GPL'd) copy, but only if you're willing to test and improve the code.

Paul Bolle 01:15, 24 January 2006 (CET)

SET MAX Security Extensions

I've hacked Andries Brouwer's setmax tool (see: Google) to support the SET MAX security extensions (SET MAX SET PASSWORD, SET MAX LOCK, SET MAX UNLOCK, SET MAX FREEZE). Very rough code once again. Mail me if you're willing to brick your HDD.

A few random observations:

- secure mode: the Phoenix BIOS probably sets a SET MAX password in the HDD, does a non-volatile SET MAX and LOCKs (or FREEZEs) the HDD.

- normal mode: the Phoenix BIOS might set a SET MAX password in the HDD, does a (volatile?) SET MAX but does not LOCK the HDD. The HDD will accept another SET MAX, a new SET MAX SET PASSWORD, etc.

- normal mode: Linux 2.6.x disables the HPA in normal mode (by doing a volatile SET MAX to maximum native address). After a suspend the HDD reenables the HPA (by returning to the latest non-volatile value of SET MAX). It thus treats the suspend cycle as a power cycle (it also discards a SET MAX password, unlocks or unfreezes the HPA etc). I'm not sure whether that is a correct implementation of the ATA spec. (The HDD doesn't do this in secure mode. I would like to know how the Phoenix BIOS and/or Hitachi HDD people have managed this.)

This can lead to some problems if a partition ends within the limits of the HPA (which is then actually (partly) overwritten by that partition). Maybe the best solution would be to have the kernel do a non-volatile SET MAX to the native maximum address. Then a resume from suspend will in effect not reenable the HPA.

Paul Bolle 01:40, 20 February 2006 (CET)