6.7 SA and terminal on pre-F3 drives and other pre-F3 stuff
Tests on a Barracuda 7200.7 120GB
234375000 decimal LBA's at sata/ata interface = 0x0DF84758
Not F3 just T>
;
Age=50 Type=22 MxCyl=16358 MxHd=2 MxSct=44C BSz=0000 TCode=0000
3 heads (0-2)
cyls 00018-16358 //see later
2>x
Zone 00: 00018 - 00BE8 1100 (044C) 683.439
Zone 01: 00BE9 - 027FE 1056 (0420) 666.63
Zone 02: 027FF - 04707 1026 (0402) 646.275
Zone 03: 04708 - 06CA3 990 (03DE) 622.431
Zone 04: 06CA4 - 08B66 953 (03B9) 602.353
Zone 05: 08B67 - 0A479 916 (0394) 580.392
Zone 06: 0A47A - 0C405 880 (0370) 545.882
Zone 07: 0C406 - 0D99A 836 (0344) 527.59
Zone 08: 0D99B - 0ECD9 806 (0326) 506.144
Zone 09: 0ECDA - 10337 770 (0302) 480.724
Zone 0A: 10338 - 11397 733 (02DD) 461.672
Zone 0B: 11398 - 12854 691 (02B3) 437.423
Zone 0C: 12855 - 13F38 660 (0294) 410.353
Zone 0D: 13F39 - 14AE7 623 (026F) 396.401
Zone 0E: 14AE8 - 155D6 605 (025D) 383.316
Zone 0F: 155D7 - 16358 572 (023C) 363.922
Sys= 0F68E-0F70D 0280 SPTK on sys trks
Total LBAs = 0DFD03F6
All 3 heads use the same zone info and spt varies from 44c-23c
On other drives may see zone info per head
User area starts at cyl 0x18
cylinders 0 to 17 are probably just used as a lead in ?
there do seem to be cylinders beyond 16358 as well //see later
Sys= 0F68E-0F70D 0280 SPTK on sys trks
system area is in the middle of the drive (in zone 9?) and only uses 280 spt
On other drives this may be labeled as “Reserve:”
Total LBAs = 0DFD03F6 broadly as expected (user LBA’s or all LBA’s? Should be just the user LBA’s)
On other drives, eg 160GB 7200.2 it is listed as “KBAs 12BBCC28”
Read and Write buffer are
RD:0200:10
WR:0210:10
6.7.1 Pre-F3 Reading user sectors (supplement to section 5.3 about pre-F3 drives)
2>A0
2>s18,0
2>. //in my experience you cant fully trust everything the ‘current position’ shows here until after a read
2>R0,1 or r,1 or r0,1
2>.
Pgm=00 Trk=00018(00018).0(0).001(000) Zn=0 Err=00 ErCt=0000 Hlth=0008 CHlth=0000 Ready LBA=00000001
confirms current position has incremented as expected
2>B200,200
shows the read buffer contents and is user LBA 0
Logical reads at level A
Need to do S hi,lo then R,1
Level A can decode LBA’s
eg
A>C0
LBA 00000000 = LPL 00018.0.0000 (logical cyl 18 which is also physical cyl 18)
A>D0
LBA 00000000 = PCHS 00000018.0.0000
A> d18,0,0
LBA 00000000 = PCHS 00000018.0.0000
Some confusion about the end of the drive
A>C dfd,03f5 //find the last LBA
LBA 0DFD03F5 = LPL 1634B.1.00C8
A>D dfd,03f5
LBA 0DFD03F5 = PCHS 000163DA.1.0126
but that’s beyond the expected cylinder 16358 ?
Cylinders (and LBA’s) go on beyond here, but maybe arent used ?
The last cylinder which seems to be accessable is 163E7 physical (coincidence? that this is 16358 logical)
Pgm=00 Trk=16358(163E7).0(0).001(107) Zn=F Err=00 ErCt=1A25 Hlth=0008 CHlth=0000 Ready LBA=0DFD41BE
Anyway, strange but not too important (decoding user sectors after the SA area is ‘tricky’/confusing)
The difference between logical and physical is due to slips and due to the SA cylinders in the middle of the drive
//understanding slips and defect lists - to follow (maybe)
V1 = User slip list, which is also the P List on these drives ?
6.7.2 Pre-F3 SA sectors and modules
Sys= 0F68E-0F70D //physical cylinders
80 cylinders * 3 heads * 0280 SPTK on sys trks = approx 120MB, but not all used
This 7200.7 drive is an ALPINE 8.05
T>y doesn’t work to list modules (but might on some drive)
We know the module info for an ALPINE 8.x from
http://malthus.zapto.org/viewtopic.php?f=6&t=161and from STCom data file etc
but still don’t yet fully understand it
APP=15 0 180 80 // offset SA 0x15 0x69 0x180 sectors in length buffer 80
CERT0=29 0 244 //cert code
TABLE=29 244 11 //cert table offset trk 244
ATA=2A 0 61 //0x200 sectors in length
VEN=2C 0 12 //Stuff
STCom tool (described later) can pull off the firmware and extracts it as
196,608 APP.BIN
296,960 CERT.BIN
8,704 TABLE.BIN
49,664 ATA.BIN
9,216 Vendor.BIN
512 ID.BIN
24 SN.TXT
To be examined and compared to raw sector in the SA area
and to the numbers in the module list above
(to follow)
To read from a system track the format is r,x,y
where x is the sector to read and y is the length
(physical sector = logical sector on system tracks).
Lets look at something we know
The
http://malthus.zapto.org/viewtopic.php?f=113&t=122 article has an 7200.7 unlock zoc script
this works (sometimes need to run it several times)
and locates the correct SA module sector(s)
reads smart data and sees the track it was on ? 0f6ba
then reads info in sectors 5 and 6
1>N5
.
2>s0F6BA,00,22
2>r,05,1
looks at something ?
2>r,06,1
1>B0200,0200
2>. shows
Pgm=00 Trk=0F6BA(0F6BA).1(1).007(006) Zn=0 Err=00 ErCt=0000 Hlth=0008 CHlth=0000 Ready LBA=0xxx (cant trust)
confirms logical cyl = physical cyl in the system area
And these sectors indeed contain ‘Seagate’ and some password related data structures
There are other posts that mention ‘ATStuff’ is in sector 4, presumably of this track
so lets take a look
2>s0F6BA,00,22
2>r,04,1
2>B200,200
040000 5A0CFF3F 37C81000 00000000 3F000000 00000000 20202020 20202020 20202020
040020 20202020 20202020 00000040 04002E30 31322020 20205453 31333032 32304136
040040 20532020 20202020 20202020 20202020 20202020 20202020 20202020 20201080
040060 0000002F 00000002 00020700 00000000 00000000 00001000 5847F80D 00000700
040080 03007800 7800F000 78000000 00000000 00000000 00000000 02000000 00000000
…
Lets show that in byte format and ascii
00000030 35 30 20 20 20 20 54 53-31 33 30 32 32 30 41 36 *50 TS130220A6*
00000040 20 53 20 20 20 20 20 20-20 20 20 20 20 20 20 20 * S *
So this SA sector is the same as ID.BIN above
and is where the Passport information comes from
(note that pairs or bytes are ‘twisted’ in the raw data eg model number is ST3120026AS)
More info on ATStuff and firmware
viewtopic.php?f=1&t=23567viewtopic.php?f=1&t=27713viewtopic.php?t=12951Why does important SA things start at this 0F6BA cylinder rather than 0F68E ?
Firmware parts are located on fixed offset relative to the base track. 0xF6BA minus base (F68E) = 0x2C
which matches “VEN=2C 0 12 //Stuff”
Lets read other SA areas using the above s and r, commands and the cylinder offsets
eg 2A for ATA
//to be continued
6.7.3 Pre-F3 self scan
Pre F3 drives have a self-scan capability which could be considered as a low level re-init/’format’ capability
This can be run at certain init states or Age’s from the level 2 N command
However if run it at a low Age, it will wipe out the SA contents !
The age of a seagate drive represent the step in which the drive is in the selfscan process.
It begins at 2 and end at 4F or 50.
50 is the state where the drive responds to ata commands.
See
http://malthus.zapto.org/viewtopic.php?f=2&t=299viewtopic.php?f=1&t=27476
viewtopic.php?f=1&t=27679Experiments with a 160GB Momentus 7200.2 messed up this way and now stuck at F> to follow
see end of
viewtopic.php?f=1&t=27679and other ATStuff articles above
for some info on F> commands
Experiments with STCom tool to access to SA and saving/restoring firmware and modules
see
http://malthus.zapto.org/viewtopic.php?f=143&t=781茌