Elektroda.com
Elektroda.com
X

UART in HDD - snapshot elektroda.pl

TechEkspert 17157 4
This content has been translated flag-pl » flag-en View the original version here.
  • UART in HDD - snapshot elektroda.pl
    Some hard drives have a serial interface with pins next to the SATA connector. Basic information can be found in the topic: Seagate and Samsung HDD FAQ plus terminal - short description . Communication with the disk via the UART interface is usually used for failure diagnostics or in some cases for defect removal (e.g. the once popular problem with ST3500320AS). The connector on which the serial interface can be accessed was once used to ensure the compatibility of SATA II disks with SATA I:







    UART in HDD - snapshot elektroda.pl UART in HDD - snapshot elektroda.pl
    To connect to the disk, you will need a USB UART 3.3V converter (currently popular, among others due to Arduino). The TX HDD pin can be found experimentally, checking the next pins and waiting for the transmission to appear during the disk boot. The RX HDD pin can also be determined experimentally, for safety, including a 1k? resistor in the converter TX line. The baud rate is usually 9600 or 38400 or 57600bps.
    UART in HDD - snapshot elektroda.pl





    The diagnostic interface can also be found on old PATA drives:
    UART in HDD - snapshot elektroda.pl

    Some commands sent to the disk can damage data or the disk, so it is worth trying with a redundant hard disk.

    Seagate:
    When starting the Seagate HDD, we will usually see a short log, e.g .:
    Code: text
    Log in, to see the code


    In the case of the Seagate HDD, we can start by sending Ctrl + z,
    then we can switch between command levels by entering "/ level_number" and enter eg / 2 second level.
    Level-independent commands such as "." Are also available. current HDD status.
    For example, on level 2 (/ 2), we can issue commands:
    Z - disk spinning is stopped
    U - start disk spin
    and - damage in the current path
    e.t.c.
    At level 3, give the command:
    b - park the heads for a moment
    D - will perform the access speed test (in random mode)
    but e.g. on level 7, issuing the same command means something different:
    D - displays the temperature
    We get the full list of commands at level C (/ C) by issuing the command:
    Q - information about ASCII commands

    For the disk under test, I received quite a substantial set of commands:

    Code: text
    Log in, to see the code


    Here: information about the Seagate HDD terminal commands .

    There we find quite exotic commands, e.g. performing a test of the head positioning mechanism and displaying data to the Bode chart ...

    Efficient Seagate disks at startup are not too "talkative" we usually get information about the correct startup, that. firmware or disk model data, memory amount, in the case of PATA disks with jumper configuration. Sometimes there is information about the date of the firmware compilation and sometimes about the author of the software.

    Here: more information on attempts to access Samsung HDD "operating" system , and the continuation Link .

    Samsung:
    Samsung HDDs are more "talkative" during startup, we get information about the supply voltage, rotational speed temperature, test results, disk parameters, e.g .:

    Code: text
    Log in, to see the code


    From ENG> to DBG mode> switch to Esc key, return to ENG> with GO command.

    The available commands can be obtained by typing:
    HE
    Code: text
    Log in, to see the code


    Public command documentation is weaker for Samsung HDDs than for Seagate HDDs, for example:

    RT - reset, restart
    LB - information about HDD
    DV - firmware information
    LL - possibly sectors pending / damaged

    Checking subsequent commands without knowing them exactly may result in disk damage (eg FE - it could be eg flash erase ...).

    Why did I check this method of communication with HDD?
    This method of communication with the disk is usually used when there is a problem with the HDD. I have two machines where I cannot read SMART disks. In one case the HDDs work in a simple RAID1 handled by the motherboard controller, in the other case the HDD is hidden behind the Intel(R) Smart Response controller. I wanted to use UART communication with the disk for continuous monitoring of the disk's condition (instead of SMART). Unfortunately, in both cases, they were WD drives, which most likely did not have the UART lines on the connector next to the SATA connector.

    Cool? Ranking DIY
    Do you have a problem with Arduino? Ask question. Visit our forum Arduino.
    About Author
    TechEkspert
    Editor
    Offline 
    TechEkspert wrote 4433 posts with rating 3633, helped 12 times. Been with us since 2014 year.
  • #2
    spamove
    Level 10  
    Sensational post, just a comment: Samsung drives sometimes have 2x2 pins, the interface is then this:

    UART in HDD - snapshot elektroda.pl

    As for pin z *, in some (mainly older) drives it allows to force SATA I mode, in others it does nothing or does various strange things.

    Added after 2 [hours] 5 [minutes]:

    After my tests, I present an extended list of "decrypted" commands for Samsung (there may of course be errors here, plus not every drive responds to all of the same):

    HD502IJ F1_3D disk:

    HE RT RC RF PD D DS DL DB DW DI M MD MS ML MB
    MW FB FW DX SB CA DN DT DG BI SP TP RB ZM DZ LE
    PP RP FE FU EP EF RD WR SK QT QB QK QN QA QL QS
    QG QW QR QD R0 R1 XT XL XN XA XC XE XS SL OU ST
    SU SD PK UV SM SG EI WI MI PR PW IF TF RU WU TI
    TU IC TC DV LI WS CB BD BS BC GO SS NS DA DR MR
    LL LM LR LS LV LT LB LD LC L4

    * general

    Escape key - exits from ENG to DBG mode
    HE - Help (displays the above, i.e. a list of commands)

    * commands of the "R" + "PD" group (typical "service" commands)

    RT - Device reset
    RC - displays the "header" of the disk in hexadecimal (for me, after converting hex-> ASCII, you can easily find the disk name there, as well as the disk serial number and firmware revision number)
    RF - displays the firmware "header" in hexadecimal
    PD - displays a fragment of the firmware (hexadecimal) containing "IBR_SETL"

    * group commands "D" "M" "F" and similar (debugging)

    D DS DL DB DW DI
    M MD MS ML MB MW
    FB FW
    - probably access to data / firmware memory while debugging (the second letter is (?) short for Short Long Byte Word, respectively)

    DX SB CA DN DT DG BI
    WI MI PR PW TF RU WU TU IC DB BS BC SS NS DA DR MR RP - as above

    SP TP - ScriPt (possibly run scripts from memory)

    ZM - "CmdZeroMC" (NOTE: I did "reset" the firmware)

    PP - runs something (?)

    FE - Flash Erase (turns HDD into an avant-garde paperweight; not recommended)

    TF RU WU RB SM EI TU DZ LE -? (I think I have NOP)

    IF - executes "InitMcfs"
    TI - displays various information regarding the execution of firmware code (flags, code address, stack pointer, etc.)
    LI - next command treats as an array, and does something with it ("EPOK"?)
    WS - displays "DONE", so it * does * something.
    BD - displays active breakpoints for firmware debugging
    GO - exits from DBG to ENG mode

    DV - I have NOP (after TechEkspert I say that in other drives it may display information about the firmware)

    * commands of the "X" group (mechanical tests and setting their parameters)

    XT parameter - without a parameter displays the possible "CLASS OF SERVO MEASUREMENT", with the parameter sets the desired value
    XA - Equivalent to XT 10, sets HEAD_MISALLIGN test mode
    XN - Equivalent to XT 80, sets test mode NOTCH_ID
    XE - Equivalent to XT 4, sets SEEK_TIME test mode
    XC - runs the "servo spin Current test"
    XL - runs the "servo Latch force test" (I do not recommend running it too long, especially on older drives)
    XS - runs the "Servo head Stiction test"

    * commands related to "X" commands (mechanical commands)

    SL - runs "Servo Latch force test" in old Samsung phones (I have the message "Latch force measurement command is changed from SL to XL")
    OU - park and Unlatch (first one, then another)
    ST - Servo STatus (HDD servo status)
    SD - Disk SpinDown
    SU - Disk SpinUp
    PK - ParK (parks the disc head)
    UV - Unlatch the disk head

    * various commands

    R0 - displays the value "erase Rcc @ SrvC / H"
    R1 - displays the value "write Rcc @ SrvC / H"
    SG - displays possible "CLASS OF SERVO SCANGRAY OPTION", but apparently takes no parameter

    * group commands "L" ("List")

    LL LM LR LS LV LT - "Number of defects" + list of "defects", the second letter in the command is the defect type
    LB - various info about HDD (e.g. serial, firmware rev. Etc.)
    LD - A list of "areas" with defects, along with their ABA, LBA, etc. addresses
    LC -? (some random information)
    L4 - various information on calibration and amplification of warheads

    * unchecked (TODO)

    FU EP EF RD WR SK QT QB QK QN QA QL QS
    QG QW QR QD
  • #3
    TechEkspert
    Editor
    Thank you for the interesting supplement.

    I wonder if SAS disks have such an interface and if SCSI disks did.

    I plan to look at an SSD and see if there is a debugging interface on the board inside the case, which will perhaps reveal a little more about the internal life of the SSD, in particular how the built-in GarbageCollector, WearLeveling works and how (how long) the command is carried out TRIM.
  • #4
    Łukasz_W

    HDD and data recovery specialist
    TechEkspert wrote:
    I wonder if SAS disks have such an interface

    Yes, at Seagate, for example.
    It is also present in some SSDs (SanDisk, Samsung).
  • #5
    TechEkspert
    Editor
    Thanks for the information!
    In SSD, UART is sometimes available inside the case as a PCB field.