Hidden Protected Area

From ThinkWiki
Revision as of 08:07, 27 July 2007 by Hjh (Talk | contribs) (→‎Models featuring this Technology)
Jump to: navigation, search

The Hidden Protected Area

The Hidden Protected Area (also known as the Host Protected Area) is a special area (usually a few gigabytes in size) located at the end of a hard disk. It is preinstalled on the harddisks of some ThinkPads. It is normally hidden to the software running on your ThinkPad. It includes all the software and data needed to recover the preloaded state of the ThinkPad. The HPA also includes some diagnostic tools and a (MS Windows only) backup tool.

The HPA was introduced with the R40, T40 and X30 series of ThinkPads. It is refered to as the Predesktop Area in the BIOS Setup Utility. Recent ThinkPads can have a (hidden) partition that is also called Predesktop Area in the BIOS Setup Utility. That (hidden) partition is not an HPA. More information can be found in Rescue and Recovery,

IBM PreDesktop Area

General information about the HPA

As opposed to Recovery Partitions, Protected Service Areas (PSAs) such as the HPA are (let's say) images of partitions written to the end of a harddisk. They are only accessible through their BEER. The general idea is that, under control of the BIOS, the PSAs are totally hidden from all ordinary software, including malware (viruses, trojans, spyware). They are only accessible when permitted by the BIOS, and even then only through special HPA-aware tools. Under GNU/Linux they are only accessible with low level tools like dd.

The HPA is based on Phoenix FirstWare. FirstWare is (in short) an implementation of two technologies: BEER and PARTIES. (Yes, those names are correct!) BEER (Boot Engineering Extension Record) and PARTIES (Protected Area Run Time Interface Extension Services) are described in this T13 working draft. There is a more general introduction to PARTIES on the IBM site. FirstWare depends on certain ATA-5 commands, so it won't work with lower ATA level (earlier) drives or even with all ATA-5 drives. Unfortunately, there is no public HPA compatibility tester or list of compatible drives.

Basically, what's going on is that the Phoenix BIOS commands the drive to hide the last few gigabytes of the hard disk (the HPA). The to non-HPA aware software, the drive appears to have a smaller size. Note that this is just a setting in the BIOS and can be disabled. The HPA can be accessed by pressing Access IBM or Enter at boot time. The BIOS will then parse the BEER (128 bytes, situated in the last sector of 512 bytes of the harddisk) and the "Directory of Services" (consisting of directory entries of 64 bytes each, starting in the last sector and spilling over into the previous sectors) to see what part of the HPA should be launched. In (most?) ThinkPads the BEER tells the BIOS to launch the Access IBM Predesktop Area. The system will then actually be booting into a (minimal) DOS environment which is able to launch a graphical shell (called Phoenix FirstSight). IBM has simply rebranded this graphical shell to the Access IBM Predesktop Area. From this graphical shell one can launch several tools (BIOS Setup Utility, diagnostic tools, recovery tools).

Three BIOS options

The BIOS has three settings for the "IBM Predesktop Area" (in the Security category):

  • Secure: No user or SW-initiated changes; Contents hidden from OS
  • Normal: Change allowed; Contents hidden from OS
  • Disabled: Not Usable; Visible and Reclaimable

Normal is the default setting. One can boot into the Predesktop Area when either Secure or Normal is set. When Disabled is set the Predesktop Area will not boot. According to the Predesktop Area white paper the HPA is both "locked"1 and "hidden" when Secure is set and only "hidden" when normal is set. In practice the result seems to be that the HPA is totally unavailable to the Linux kernel (and therefore all applications) when Secure is set. (The HPA should be unavailable in "Secure mode" for all operating systems, MS Windows included.) One would expect the HPA to be only accessable to HPA aware tools when Normal is set. However, recent kernels disable the HPA by default when Normal is set. Note that recent threads on linux-ide suggest that the ThinkPad will reenable the HPA on resume and thus causing (possibly serious) conflicts with the GNU/Linux system (that assumes the HPA is still available).

With Disabled you should be able to safely reclaim the area used by the HPA (to GNU/Linux it basically is unallocated space on the harddisk).

Details of the HPA

Fabrice Bellet describes a technique he used to explore the HPA of his ThinkPad T40, using GNU/Linux tools. This technique is only for the more curious or more careless people. It uses "dd" to copy the sectors on the harddisk containing the HPA from "/dev/hda" to a new file: when using "dd" on "/dev/hda" you are only one small typo away from an unrecoverable disaster!

Another option is the Hidden Protected Area FileSystem, a read-only FUSE (Filesystem in USErspace). hpafs allows to analyze, backup, etc. the HPA. The current release is hpafs-0.1.0 (alpha, developers only). Check the README for further details.

Yet another alternative of getting information on HPA is fiesta. This tool allows you to safely (devices are opened in read-only mode) inspect the contents of HPA and display detailed information contained in HPA header. In addition, this program will generate the complete command line needed for a backup of whole HPA, selected HPA partition or HPA header, using basic linux tools like "dd". This shall save your time and potentially disastrous typos. It is not the end though, fiesta will also generate the command line to restore previously saved image of entire HPA or HPA header. Beforehand, read about limitations. For the curious "what's-inside" people, fiesta will also generate the complete mount command line of selected HPA partition.

Finally, the latest, and it seems to be the most powerful set of tools to deal with HPA and PSA's (called, very naturely, hpatools) is discussed in this thread. That stuff is German language only, but here is a translation that was successfully tested with a X31.

How to reclaim the HPA

After disabling the "IBM Predesktop Area" (with the BIOS option "Disabled", see above) it's possible to reclaim the area used by the HPA. Then one can include that area in a partition with standard tools (i.e. fdisk, mkfs) as it will be treated just as regular free space of the hard disk.

If you'd like to use the original drive with an IDE to USB adapter after replacing it, the usb disk may still not be useable to its full capacity, since for Hitachi Travelstar hard disks the "clipping" feature may be activated to hide the HPA as well. With the Hitachi Feature Tool ftool.exe available as a bootable CD ISO (http://www.thgweb.de/downloads/display.php?id=1124) it's possible to readjust the disk capacity to its original value. This works only with the disk connected to the IDE bus during the procedure.

Alternative uses?

It might be possible to use the FirstWare tools included in the HPA to make the HPA more useful for GNU/Linux purposes. For instance, the copy of the preloaded OS could be replaced with an emergency backup of your GNU/Linux distribution. Maybe the Predesktop area could be even used to boot into a GNU/Linux rescue system. Whether the Phoenix proprietary tools really allow alternative uses and whether those tools do not make it too hard to accomplish those cannot yet be said. It seems realistic to assume that the benefits of those alternative uses aren't worth the effort to accomplish them. Still, it might be fun (altough possibly hazardous to your system) to try ...

Problems caused by the HPA

As of Linux 2.6.18, having a HPA may cause errors when resuming the laptop from suspend-to-RAM or suspend-to-disk. See the section called "SectorIdNotFound disk errors when laptop is resumed" in ACPI suspend problems.

External Sources

Models featuring this Technology

FOOTNOTES [Δ]
  1. Presumably by having the BIOS use the SET MAX security extension. The BIOS seems to set a password for the HPA at boot (using the SETMAX-SET PASSWORD command) and after that use that password to issue a SETMAX-LOCK command. Since the password is unknown (and most likely changes at every Secure boot) the HPA is inaccessable to all programs running on the ThinkPad.

    Something similar would be possible running in Normal mode. Then a program could issue the SETMAX-SET PASSWORD command. At the moment there's no program running under GNU/Linux capable of doing that. Of course this is possibly less secure: it's (theoretically) possible that other (rogue) programs get hold of that password.
Retrieved from "https://www.thinkwiki.org/w/index.php?title=Hidden_Protected_Area&oldid=31554"