Hidden Protected Area

The Hidden Protected Area The Hidden Protected Area (also known as the Host Protected Area) is a special area (usually a few gigabytes in size) located at the end of a hard disk. It is preinstalled on the harddisks of some ThinkPads. It is normally hidden to the software running on your ThinkPad. It includes all the software and data needed to recover the preloaded state of the ThinkPad. The HPA also includes some diagnostic tools and a (MS Windows only) backup tool. The HPA was introduced with the R40, T40 and X30 series of ThinkPads. It is refered to as the Predesktop Area in the BIOS Setup Utility. Recent ThinkPads can have a (hidden) partition that is also called Predesktop Area in the BIOS Setup Utility. That (hidden) partition is not an HPA. More information can be found in Rescue and Recovery,

General information about the HPA

As opposed to Recovery Partitions, Protected Service Areas (PSAs) such as the HPA are (let's say) images of partitions written to the end of a harddisk. They are only accessible through their BEER. The general idea is that, under control of the BIOS, the PSAs are totally hidden from all ordinary software, including malware (viruses, trojans, spyware). They are only accessible when permitted by the BIOS, and even then only through special HPA-aware tools. Under GNU/Linux they are only accessible with low level tools like dd.

The HPA is based on Phoenix FirstWare. FirstWare is (in short) an implementation of two technologies: BEER and PARTIES. (Yes, those names are correct!) BEER (Boot Engineering Extension Record) and PARTIES (Protected Area Run Time Interface Extension Services) are described in this T13 working draft. There is a more general introduction to PARTIES on the IBM site. FirstWare depends on certain ATA-5 commands, so it won't work with lower ATA level (earlier) drives or even with all ATA-5 drives. Unfortunately, there is no public HPA compatibility tester or list of compatible drives.

Basically, what's going on is that the Phoenix BIOS commands the drive to hide the last few gigabytes of the hard disk (the HPA). To the non-HPA aware software, the drive appears to have a smaller size. Note that this is just a setting in the BIOS and can be disabled. The HPA can be accessed by pressing Access IBM or Enter at boot time. The BIOS will then parse the BEER (128 bytes, situated in the last sector of 512 bytes of the harddisk) and the "Directory of Services" (consisting of directory entries of 64 bytes each, starting in the last sector and spilling over into the previous sectors) to see what part of the HPA should be launched. In (most?) ThinkPads the BEER tells the BIOS to launch the Access IBM Predesktop Area. The system will then actually be booting into a (minimal) DOS environment which is able to launch a graphical shell (called Phoenix FirstSight). IBM has simply rebranded this graphical shell to the Access IBM Predesktop Area. From this graphical shell one can launch several tools (BIOS Setup Utility, diagnostic tools, recovery tools).

Three BIOS options

The BIOS has three settings for the "IBM Predesktop Area" (in the Security category):

• Secure: No user or SW-initiated changes; Contents hidden from OS
• Normal: Change allowed; Contents hidden from OS
• Disabled: Not Usable; Visible and Reclaimable

Normal is the default setting. One can boot into the Predesktop Area when either Secure or Normal is set. When Disabled is set the Predesktop Area will not boot. According to the Predesktop Area white paper the HPA is both "locked"¹ and "hidden" when Secure is set and only "hidden" when normal is set. In practice the result seems to be that the HPA is totally unavailable to the Linux kernel (and therefore all applications) when Secure is set. (The HPA should be unavailable in "Secure mode" for all operating systems, MS Windows included.) One would expect the HPA to be only accessable to HPA aware tools when Normal is set. However, recent kernels disable the HPA by default when Normal is set. Note that recent threads on linux-ide suggest that the ThinkPad will reenable the HPA on resume and thus causing (possibly serious) conflicts with the GNU/Linux system (that assumes the HPA is still available).

With Disabled you should be able to safely reclaim the area used by the HPA (to GNU/Linux it basically is unallocated space on the harddisk).

Details of the HPA

Fabrice Bellet describes a technique he used to explore the HPA of his ThinkPad T40, using GNU/Linux tools. This technique is only for the more curious or more careless people. It uses "dd" to copy the sectors on the harddisk containing the HPA from "/dev/hda" to a new file: when using "dd" on "/dev/hda" you are only one small typo away from an unrecoverable disaster!

Another option is the Hidden Protected Area FileSystem, a read-only FUSE (Filesystem in USErspace). hpafs allows to analyze, backup, etc. the HPA. The current release is hpafs-0.1.0 (alpha, developers only). Check the README for further details.

Good news for all who need to copy HPA from an old disk to a new one. fiesta is an easy (hence its name) to use info/backup/restore/copy tool for HPA equipped computers. Apart from displaying detailed information about the structure of HPA, it allows for extraction of HPA "partitions", or PSA's, direct mounting (if they contain a filesystem), and most importantly, a copy of entire HPA from one disk to the other, in case of a disk up(down)grade, in a simple two-step procedure.

Finally, the powerful set of tools to deal with HPA and PSA's (called, very naturely, hpatools) is discussed in this thread. That stuff is German language only, but here is a translation that was successfully tested with a X31.

How to reclaim the HPA

After disabling the "IBM Predesktop Area" (with the BIOS option "Disabled", see above) it's possible to reclaim the area used by the HPA. Then one can include that area in a partition with standard tools (i.e. fdisk, mkfs) as it will be treated just as regular free space of the hard disk.

If you'd like to use the original drive with an IDE to USB adapter after replacing it, the usb disk may still not be useable to its full capacity, since for Hitachi Travelstar hard disks the "clipping" feature may be activated to hide the HPA as well. With the Hitachi Feature Tool ftool.exe available as a bootable CD ISO (http://www.thgweb.de/downloads/display.php?id=1124) it's possible to readjust the disk capacity to its original value. This works only with the disk connected to the IDE bus during the procedure.

Alternative uses?

It might be possible to use the FirstWare tools included in the HPA to make the HPA more useful for GNU/Linux purposes. For instance, the copy of the preloaded OS could be replaced with an emergency backup of your GNU/Linux distribution. Maybe the Predesktop area could be even used to boot into a GNU/Linux rescue system. Whether the Phoenix proprietary tools really allow alternative uses and whether those tools do not make it too hard to accomplish those cannot yet be said. It seems realistic to assume that the benefits of those alternative uses aren't worth the effort to accomplish them. Still, it might be fun (altough possibly hazardous to your system) to try ...

Problems caused by the HPA

Resuming from suspend

As of Linux 2.6.18, having a HPA may cause errors when resuming the laptop from suspend-to-RAM or suspend-to-disk. See the section called "SectorIdNotFound disk errors when laptop is resumed" in ACPI suspend problems.

Failure to boot

If the HPA is enabled in the BIOS (mode set to "Normal"), Linux may get confused about the correct partition geometry. The exact reason is not clear, but apparently a Linux installation may overwrite/damage the HPA, which then causes problems during boot. The problem may also be caused by changing the BIOS mode of the HPA after the installation of Linux.

Reported symptoms are:

• Linux fails to boot: On boot, Grub displays Error 17; Lilo shows L 99 99 99 99 ...
• Windows XP bluescreens during booting, with the message STOP [....] UNMOUNTABLE_BOOT_VOLUME

See for example this bug report from Ubuntu: Bug #25451: Thinkpad BIOS can't hide the Predesktop area

This problem can apparently be fixed by setting the HPA mode to "Disable" in the BIOS setup.

Note that this setting will allow software to overwrite the HPA. In particular, a subsequent Linux installation is likely to overwrite the HPA whent it wipes the drive. If you need the recovery features of the recovery system installed in the HPA, you should probably keep the setting to "Secure". However, if you experience the boot problems describe above, your HPA is probably already destroyed, so "Disable" is the best setting (in some cases, the BIOS will actually force you to set "Disable" if it detects that the HPA has been deleted).

External Sources

• Predesktop Area white paper
• Predesktop Aministrator Utility (DOS)
• Protected Area Run Time Interface Extension Services (PARTIES) ANSI INCITS 346-2001 ($30)
• The latest free draft of ANSI INCITS 346-2001 (BEER specs)
• Phoenix FirstWare White Paper
• Section 11 of the Large Disk HOWTO (Clipped disks)
• hpafs-0.1.0.tgz
• fiesta
• hpatools

Models featuring this Technology

• ThinkPad R40, R40e, R50, R50e, R50p, R51, R52
• ThinkPad T40, T40p, T41, T41p, T42, T42p, T43, T43p
• ThinkPad X31, X32, X40, X41, X41 Tablet, X61s, X61 Tablet
• ThinkPad Z61m

FOOTNOTES [Δ]

1. Presumably by having the BIOS use the SET MAX security extension. The BIOS seems to set a password for the HPA at boot (using the SETMAX-SET PASSWORD command) and after that use that password to issue a SETMAX-LOCK command. Since the password is unknown (and most likely changes at every Secure boot) the HPA is inaccessable to all programs running on the ThinkPad.
   
   Something similar would be possible running in Normal mode. Then a program could issue the SETMAX-SET PASSWORD command. At the moment there's no program running under GNU/Linux capable of doing that. Of course this is possibly less secure: it's (theoretically) possible that other (rogue) programs get hold of that password.