Commit 91842ed8 authored Nov 19, 2025 by Niklas Cassel

ata: libata-core: Set capacity to zero for a security locked drive



For Security locked drives (drives that have Security enabled, and have
not been Security unlocked by boot firmware), the automatic partition
scanning will result in the user being spammed with errors such as:

  ata5.00: failed command: READ DMA
  ata5.00: cmd c8/00:08:00:00:00/00:00:00:00:00/e0 tag 7 dma 4096 in
           res 51/04:08:00:00:00/00:00:00:00:00/e0 Emask 0x1 (device error)
  ata5.00: status: { DRDY ERR }
  ata5.00: error: { ABRT }
  sd 4:0:0:0: [sda] tag#7 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s
  sd 4:0:0:0: [sda] tag#7 Sense Key : Aborted Command [current]
  sd 4:0:0:0: [sda] tag#7 Add. Sense: No additional sense information

during boot, because most commands except for IDENTIFY will be aborted by
a Security locked drive.

For a Security locked drive, set capacity to zero, so that no automatic
partition scanning will happen.

If the user later unlocks the drive using e.g. hdparm, the close() by the
user space application should trigger a revalidation of the drive.

Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>

parent b1189068

drivers/ata/libata-core.c

+10 −0

Original line number	Diff line number	Diff line
		@@ -3006,6 +3006,16 @@ int ata_dev_configure(struct ata_device *dev)
		}

		dev->n_sectors = ata_id_n_sectors(id);
		if (ata_id_is_locked(id)) {
		/*
		* If Security locked, set capacity to zero to prevent
		* any I/O, e.g. partition scanning, as any I/O to a
		* locked drive will result in user visible errors.
		*/
		ata_dev_info(dev,
		"Security locked, setting capacity to zero\n");
		dev->n_sectors = 0;
		}

		/* get current R/W Multiple count setting */
		if ((dev->id[47] >> 8) == 0x80 && (dev->id[59] & 0x100)) {