Palmer ROM issue

[Jakiro]

Hi ,

 got a WD palmer where i suspect a damaged ROM ,  don't know how rom could damaged by it self
when powered ON  Drive becomes ready no clicking sound and  no ID also with the following log in Karnal mode :

Techno mode key
Techno mode key......................... : Ok
 
RAM:
System controller (SoC).............. : 88i1053A0 0x(5460)
HDD Info reading........................ : Ok
Heads number............................ : 2
Cyl Count............................... : 512
ROM:
Read ROM................................ : Ok
ROM Data size........................... : 1024 Kb
Flash ROM dir reading................... : Ok (Active)
Flash ROM dir reading (Ext)............. : Ok
Modules directory address............... : 947 380
SA regions address...................... : by default
Module 02 access........................ : Granted
 
SA SPT.................................. : 0
 
ROM Modules:
ROM version............................. : 02.1AP
ROM F/W version......................... : Module ID 4F reading error Device Error Detected: "FM ERR HEADER II SIGNATURE INVALID"
Overlay F/W version..................... : 02.1AP
Servo F/W version....................... : 01.3C
 
Head Map Reading Error.................. : Module ID 0A reading error Device Error Detected: "FM ERR HEADER II SIGNATURE INVALID"
 
Relocations............................. : 0 (0)

attached rom Dump 

any help much appreciated  , thank you all 

[pbzcbf...@gmail.com]

I don't understand why the drive spins up. 

The firmware is configured to use the wrong module directory in the ROM. The active directory flags point to 0x0B as the active directory (flag = 3) when it should be 0x20B (flag = 2). Many of the modules in 0x0B have not been initialised, so what is the firmware doing with them?

The safest solution would be to copy the modules in 0x20B to their copies in 0x0B. I can do that for you if you are unable. An alternative solution would be to change the relevant flag from 2 to 4 (and recompute the checksum).

Analysing ROM_palmer.bin ...

Searching for LDSCs and verifying PCMBlocks ...

LDSC   LDSC    Att   PCMBlock          RAM         size      PCMBlk CS
Start  ID CS        Start -  End     address     RAM / ROM    Exp/Act
-----  -- --   --   -----   -----   --------   ------ -----  ---------
    0  5A FB   04      20 -  1ACF       1000     1AAC  1AAC  000A7455 000A7455 OK (digitally signed)
 2000  01 BF   04    2180 -  49DC      49688     275C  275C    B2   B2   OK
 2020  02 3B   11    49DD -  88E9   30080000 c   542C  3F0C    02   02   OK
 2040  03 47   0C    88EA -  8CDE   24000000      3F4   3F4    D8   D8   OK
 2060  04 60   40    8CDF -  DF9B   FFE00200     52BC  52BC    FE   FE   OK
 2080  05 9A   01    DF9C -  EAA8   38248600 c    D48   B0C    E3   E3   OK
 20A0  06 9B   04    EAA9 -  EF49   3824A600      4A0   4A0    79   79   OK
 20C0  07 F9   01    EF4A - 14F26          0 c   7A14  5FDC    5F   5F   OK
 20E0  08 A7   01   14F27 - 152E7       DD88 c    484   3C0    42   42   OK
 2100  09 34   03   152E8 - 178E0      40340 c   3088  25F8    C6   C6   OK
 2120  0A A0   03   178E1 - 17CB9   60249600 c    9AC   3D8    26   26   OK
 2140  0B 2E   01   17CBA - 2FB7E   3832D000 c  20174 17EC4    52   52   OK
 2160  0C 7F   01   2FB7F - 5415F   38008230 c  317EC 245E0    A7   A7   OK
82000  01 9F   04   82180 - 84A4C      49688     27CC  27CC    E3   E3   OK
82020  02 AC   11   84A4D - 88959   30080000 c   542C  3F0C    02   02   OK
82040  03 B8   0C   8895A - 88D4E   24000000      3F4   3F4    D8   D8   OK
82060  04 D1   40   88D4F - 8E00B   FFE00200     52BC  52BC    FE   FE   OK
82080  05 0B   01   8E00C - 8EB18   38248600 c    D48   B0C    14   14   OK
820A0  06 0C   04   8EB19 - 8EFB9   3824A600      4A0   4A0    79   79   OK
820C0  07 69   01   8EFBA - 94F96          0 c   7A14  5FDC    20   20   OK
820E0  08 17   01   94F97 - 95357       DD88 c    484   3C0    42   42   OK
82100  09 A5   03   95358 - 97950      40340 c   3088  25F8    76   76   OK
82120  0A 11   03   97951 - 97D29   60249600 c    9AC   3D8    92   92   OK
82140  0B AF   01   97D2A - AFBEE   3832D000 c  20184 17EC4    8F   8F   OK
82160  0C A6   01   AFBEF - D4207   38008230 c  31830 24618    3D   3D   OK

LDSC   = PM Loader Config String (32 bytes)
ID     = ID byte of LDSC (byte #0)
CS     = Checksum byte or word
Att    = Attributes
PCMBlk = Program Code Memory Block
Exp    = Expected checksum for PCMBLock
Act    = Actual checksum for PCMBLock
c      = compressed PCMBlock
size   = size of decompressed (in RAM) and compressed (in ROM) PCMBlock in bytes


ROYL directory module 0x000B found at 0x7F39A

Active directory flag = 0x03

Identifying SA regions ...

Reg#    Reg size     Reg loc
----  ----------  ----------
0x00  0x000E86C0  0x00000000
0x01  0x000E86C0  0x000EEBA8

Verifying ROYL modules ...

 ID          Size (bytes)         Address    Checksum
 dir   hdr        dir       hdr
----  ----   --------  --------   --------   --------
0001  N/A    00004000  N/A        000278A0             N/A
000A  FFFF   0000004E  01FFFE00   0007E000   0000FFEC  BAD
000B  OK     0000013D  00000200   0007F39A   00000000  OK
020B  OK     0000013D  00000200   0007D39A   00000000  OK
0030  OK     00000400  OK         000FE000   00000000  OK
0047  FFFF   00000600  01FFFE00   0007E556   FFFFFE80  BAD
000D  FFFF   00000108  01FFFE00   0007E04E   FFFFFFBE  BAD
004F  FFFF   00000400  01FFFE00   0007E156   FFFFFF00  BAD
0181  OK     00000C00  OK         000FE400   00000000  OK
01A2  FFFF   0000007E  01FFFE00   0007EB56   0000FFE0  BAD
01B6  FFFF   0000069E  01FFFE00   0007EBD4   DE1DE637  BAD
01B0  OK     00000128  00000200   0007F272   00000000  OK

ROYL directory module 0x020B found at 0x7D39A

Active directory flag = 0x02

Identifying SA regions ...

Reg#    Reg size     Reg loc
----  ----------  ----------
0x00  0x000E86C0  0x00000000
0x01  0x000E86C0  0x000EEBA8

Verifying ROYL modules ...

 ID          Size (bytes)         Address    Checksum
 dir   hdr        dir       hdr
----  ----   --------  --------   --------   --------
0001  N/A    00004000  N/A        000E74B4             N/A
000A  OK     0000004E  00000200   0007C000   00000000  OK
000B  OK     0000013D  00000200   0007F39A   00000000  OK
020B  OK     0000013D  00000200   0007D39A   00000000  OK
0181  OK     00000C00  OK         000FE400   00000000  OK
0030  OK     00000400  OK         000FE000   00000000  OK
0047  OK     00000600  00000800   0007C556   00000000  OK
000D  OK     00000108  00000200   0007C04E   00000000  OK
004F  OK     00000400  OK         0007C156   00000000  OK
01A2  OK     0000007E  00000200   0007CB56   00000000  OK
01B6  OK     0000069E  00000800   0007CBD4   00000000  OK
01B0  OK     00000128  00000200   0007D272   00000000  OK

dir  -  Module ID/Size as reported in directory module (0x20B or 0x0B)
hdr  -  Module ID/Size as reported in module's header
N/A  -  Not Applicable
BAD  -  Module has invalid checksum. This may be due to non-existent module.

ROM modules saved to Flash_00\000Bmods and Flash_00\020Bmods

Active directory is 0x0B

Analysing active 0x0A module ...

Module has bad checksum -- processing aborted

Analysing active 0x0D module ...

Module has bad checksum -- processing aborted

Analysing active 0x4F module ...

Module has bad checksum -- processing aborted

Analysing active 0x47 module ...

Module has bad checksum -- processing aborted

[Jakiro]

thanks for the quick response 

I didn't clearly understand what to do because I'm still a beginner in this field, if you could have some extra time and could you help me I would be grateful

[pbzcbf...@gmail.com]

The ROM has several modules -- 0x0B, 0x20B, 0x0A, 0x30, 0x47, 0x0D, 0x4F, 0x181, 0x1A2, 0x1B6, 0x1B0.

There are two directory modules, 0x0B and 0x20B. Each module has a flag which determines whether it is active or inactive. The module with the highest flag is active. The entries in the directory modules point to the other ROM modules and also to SA module 0x01.

This is PC3K's output:

ROM:
Read ROM................................ : Ok
ROM Data size........................... : 1024 Kb

Flash ROM dir reading................... : Ok (Active)  <-- this is module 0x0B, flag = 3
Flash ROM dir reading (Ext)............. : Ok           <-- this is module 0x20B, flag = 2
Modules directory address............... : 947 380      <-- this is the ABA of module 0x01 in the SA, 947380 = 0xE74B4

PC3K's analysis is confusing because, although it identifies 0x0B as the active directory, it reports the ABA of module 0x01 in the inactive directory (0x20B).

The following analysis uses those modules referenced by the active directory (0x0B), many of which have not been initialised. The same modules in the inactive directory (0x20B) are all OK.

ROM Modules:
ROM version............................. : 02.1AP
ROM F/W version......................... : Module ID 4F reading error Device Error Detected: "FM ERR HEADER II SIGNATURE INVALID"
Overlay F/W version..................... : 02.1AP
Servo F/W version....................... : 01.3C
 
Head Map Reading Error.................. : Module ID 0A reading error Device Error Detected: "FM ERR HEADER II SIGNATURE INVALID"

I don't know what is going on inside the firmware, but clearly PC3K is confused by it. I have attached a ROM image where I have changed the flag for 0x20B from 2 to 4. This should make PC3K happy, but I doubt that it will change the overall outcome.

BTW, these ROMs appear to have two flag bytes per directory, but I'm not completely certain. Maybe that's why the behaviour differs from earlier ROMs.

Directory 0x0B:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 4F 59 4C 04 80 1E 00 0B 00 01 00 E9 FC 4C 6B  ROYL.€......éüLk
00000010  30 30 30 33 30 30 30 30 00 00 00 03 03 00 0C 12  00030000........
                                           ^^ ^^
                                           flag bytes

Directory 0x20B:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  52 4F 59 4C 04 80 1E 00 0B 02 01 00 6B 0C B3 1B  ROYL.€......k.³.
00000010  30 30 30 33 30 30 30 30 00 00 00 02 02 00 0C 12  00030000........
                                           ^^ ^^
                                           flag bytes

[Jakiro]

Thanks for this detailed explanation, I learned something new today
I've tried the modified ROM, but unfortunately it still doesn't work 
the kernel log still the same ( Module ID 4F & 0A reading error Device Error Detected: "FM ERR HEADER II SIGNATURE INVALID"  )

[pbzcbf...@gmail.com]

In the attached ROM I have replaced the 0B modules with 20B modules.

[pbzcbf...@gmail.com]

This is the new analysis:

Analysing ROM_palmer_0B_mods_replaced_with_20B.bin ...

000A  OK     0000004E  00000200   0007E000   00000000  OK

000B  OK     0000013D  00000200   0007F39A   00000000  OK
020B  OK     0000013D  00000200   0007D39A   00000000  OK

0030  OK     00000400  OK         000FE000   00000000  OK

0047  OK     00000600  00000800   0007E556   00000000  OK
000D  OK     00000108  00000200   0007E04E   00000000  OK
004F  OK     00000400  OK         0007E156   00000000  OK

0181  OK     00000C00  OK         000FE400   00000000  OK

01A2  OK     0000007E  00000200   0007EB56   00000000  OK
01B6  OK     0000069E  00000800   0007EBD4   00000000  OK

ROM modules saved to Flash_02\000Bmods and Flash_02\020Bmods

Active directory is 0x0B

Analysing active 0x0A module ...

Head map checksum (Expected / Actual) = 0x0000 / 0x0000 - OK
Number of heads (physical / in use) = 2/2
Head map #1 = 0x0003 / 0b0000000000000011
Head map #2 = 0x0003 / 0b0000000000000011

DCM = | R | 3 Z 7 B H 3 9
      : : : : : : : : : :
      : : : : : : : : : unknown
      : : : : : : : : top VCM
      : : : : : : : ACA
      : : : : : : bottom VCM
      : : : : : HSA
      : : : : media
      : : : preamp
      : : latch
      : base
      spindle motor

Analysing active 0x0D module ...

Firmware Version = 0      
World Wide Name = 50014EE6B2B7AB6D
Model Number = WDC WD10SPZX-24Z10T0                    
Serial Number =                    

Analysing active 0x4F module ...

ROM version = 0012000T

Analysing active 0x47 module ...

Preamp values
-----------
0  012A0581
1  012A0581

Microjogs
-------
0  0000
1  0000

Head/Media DCM = 7Z

[Jakiro]

thanks   Franc for your hard efforts ,

tried  0B_mods_replaced_with_20B ROM , the drive stuck on busy  register for around 4 mints and then  get Ready , head sound calibrated when powered on , NO ID serial No or capacity , the  log in kernel mode as follow :

Techno mode key
Techno mode key......................... : Ok

Debug Stop Code......................... : HOST DEBUGSTOP RESET TIMEOUT

RAM:
System controller (SoC).............. : 88i1053A0 0x(5460)
HDD Info reading........................ : Ok

Heads number............................ : 1
Cyl Count............................... : 512

ROM:
Read ROM................................ : Ok
ROM Data size........................... : 1024 Kb
Flash ROM dir reading................... : Ok

Flash ROM dir reading (Ext)............. : Ok (Active)

Modules directory address............... : 947 380

SA regions address...................... : by default
Module 02 access........................ : Granted
 
SA SPT.................................. : 0
 

ROM Modules:
ROM version............................. : 02.1AP

ROM F/W version......................... : 0012000T

Overlay F/W version..................... : 02.1AP
Servo F/W version....................... : 01.3C
 

Heads configuration..................... : by map
Heads number............................ : 2
Heads number in use..................... : 2
Switched off heads...................... : No
Heads map............................... : 0,1
 
Relocations............................. : 0 (0)

Tried to load LDR from same FW code  , block SA & mod 02 in ROM  upload Dir From SA Error message pop up 

HOST DEBUGSTOP RESET TIMEOUT

Static module reading error Device Error Detected: "VSC ERR STATIC FILE INVALID"

thank you 

[pbzcbf...@gmail.com]

I suspect that there was no problem with the original ROM. The drive's firmware seems to know which modules are the correct ones. It's only PC3K that has problems.

I wonder if the drive now uses directory 0x0B instead of 0x20B because I have initialised those modules which were previously uninitialised? If so, then it would be looking for SA module 0x01 at ABA 0x278A0 rather than 0xE74B4. That could explain the error.

I have now edited module 0x0B to point to ABA 0xE74B4.I'm guessing that this will make both the drive and PC3K happy, but it probably won't change the actual fault.

[Jakiro]

as you suspect , PC3k now is happy but the drive is not 

with  edited module 0x0B  to point to ABA 0xE74B4 the drive becomes ready quickly but still no SA access yet 

[pbzcbf...@gmail.com]

I think that there is no problem with the original ROM. All I have done is to copy directory 0x20B and its modules to 0x0B.You need to ignore the false errors reported by PC3K.

[Jakiro]

I do appreciate your contribution in this case  Franc 
hope some of engineers in this forum come across a problem  like this and can share his knowledge  

[pbzcbf...@gmail.com]

Does your unlocked ROM spin up the drive?

I ask this because there is a bad checksum in PC3000's hacked code.

This is one of the hacked regions in your ROM:

Offset(h) 00       04       08       0C

00080000  00000000 DC0BFFFF 00000000 20000000
00080010  00100000 B0190000 00000000 00000000
00080020  00000000 6823FFFF 00000000 00000000
00080030  00000000 00000000 00000000 00000000
00080040  00000000 00000000 00000000 00100000
00080050  00000000 F0050000 EEEEEEEE EEEEEEEE

                   ^^^^^^^^ 32-bit little-endian checksum (bad)
00080060  EEEEEEEE EEEEEEEE EEEEEEEE EEEEEEEE
........
00080150  EEEEEEEE EEEEEEEE

This is a different unlocked Palmer example:

Offset(h) 00       04       08       0C

00080000  00000000 DC0BFFFF 00000000 20000000
00080010  00100000 281A0000 00000000 00000000
00080020  00000000 6823FFFF 00000000 00000000
00080030  00000000 00000000 00000000 00000000
00080040  00000000 00000000 00000000 00100000
00080050  00000000 F0050000 EEEEEEEE EEEEEEEE

                   ^^^^^^^^ 32-bit little-endian checksum (good)
00080060  EEEEEEEE EEEEEEEE EEEEEEEE EEEEEEEE
........
00080150  EEEEEEEE EEEEEEEE

The checksum is computed by adding the dwords in the range from 0x80000 to 0x80053. The first has a bad checksum while second is correct.

[pbzcbf...@gmail.com]

Sorry, that should read ...

"The checksum is computed by adding the bytes in the range from 0x80000 to 0x80053."

[LarrySabo]

They look identical to me?

[Joe]

In my experience, for Palmer you can use a donor ROM.

[pbzcbf...@gmail.com]

The checksums are identical, but the data at 0x80014 differ.

[Jakiro]

yes the unlocked ROM does spin up the drive , there is no difference in behavior with locked or unlocked ROM 

[Jakiro]

thank you Joe for contribution 

I keep reading same sentence in different forums , but not in my case it is different 

it could be related to palmer model code  or manufacture date  i don't know exactly 

[pbzcbf...@gmail.com]

See this weird thread:

https://forum.hddguru.com/viewtopic.php?f=1&t=42645

In that particular case the same ROM code with the same PC3K patch fails to spin up the same model drive.

[pbzcbf...@gmail.com]

I notice that ROM modules 0x1A2 and 0x1B6 are both empty. Other ROMs appear to have 0x200-byte and 0x100-byte blocks of data in these modules. Perhaps these are digital signatures or keys?