From: dayou5941@163.com
To: linux-ide@vger.kernel.org
Cc: damien.lemoal@opensource.wdc.com, niklas.soderlund@corigine.com,
liyouhong@kylinos.cn, Damien Le Moal <dlemoal@kernel.org>
Subject: [PATCH v2] ata: ahci: fail probe if BAR too small for claimed ports
Date: Sat, 25 Apr 2026 14:55:09 +0800 [thread overview]
Message-ID: <20260425065509.733544-1-dayou5941@163.com> (raw)
From: liyouhong <liyouhong@kylinos.cn>
When an AHCI controller is disabled in BIOS, its HOST_CAP register may
contain invalid values (e.g., 0xFFFFFFFF) indicating an impossibly large
number of ports. If CAP.NP claims more ports than can physically fit
within the mapped BAR region, accessing port registers beyond the BAR
boundary causes a kernel panic.
Add validation in ahci_init_one() to check that the BAR size is
sufficient for the number of ports claimed in CAP.NP. The check
calculates the required MMIO size as:
required_size = 0x100 (global registers) + max_ports * 0x80
If required_size exceeds the actual BAR size, the probe fails with
-ENODEV, preventing the panic and providing a clear error message.
This solution follows the suggestion by Damien Le Moal and Niklas Cassel
to detect and reject obviously broken controller configurations early.
v2:
- Complete rewrite based on community feedback
- Move check from libahci.c to ahci.c
- Fail probe early instead of attempting to work around invalid state
- Implement BAR size validation as suggested
Reported-by: liyouhong <liyouhong@kylinos.cn>
Suggested-by: Damien Le Moal <dlemoal@kernel.org>
Suggested-by: Niklas Cassel <niklas.soderlund@corigine.com>
Signed-off-by: liyouhong <liyouhong@kylinos.cn>
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 1d73a53370cf..09026ea12cde 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1888,6 +1888,23 @@ static ssize_t remapped_nvme_show(struct device *dev,
static DEVICE_ATTR_RO(remapped_nvme);
+static int ahci_validate_bar_size(struct pci_dev *pdev, void __iomem *mmio)
+{
+ u32 cap = readl(mmio + HOST_CAP);
+ unsigned int max_ports = ahci_nr_ports(cap);
+ u32 last_port_end = 0x100 + (max_ports * 0x80);
+ resource_size_t bar_size = pci_resource_len(pdev, AHCI_PCI_BAR_STANDARD);
+
+ if (last_port_end > bar_size) {
+ dev_err(&pdev->dev,
+ "AHCI: BAR5 too small for %u ports (last port ends at %u, BAR %llu)\n",
+ max_ports, last_port_end, (unsigned long long)bar_size);
+ return -ENODEV;
+ }
+
+ return 0;
+}
+
static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
{
unsigned int board_id = ent->driver_data;
@@ -1988,6 +2005,10 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
if (!hpriv->mmio)
return -ENOMEM;
+ rc = ahci_validate_bar_size(pdev, hpriv->mmio);
+ if (rc)
+ return rc;
+
/* detect remapped nvme devices */
ahci_remap_check(pdev, ahci_pci_bar, hpriv);
--
2.25.1
next reply other threads:[~2026-04-25 6:56 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-25 6:55 dayou5941 [this message]
2026-04-26 23:46 ` [PATCH v2] ata: ahci: fail probe if BAR too small for claimed ports Damien Le Moal
2026-04-27 2:07 ` 李佑鸿
2026-04-27 4:40 ` Damien Le Moal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260425065509.733544-1-dayou5941@163.com \
--to=dayou5941@163.com \
--cc=damien.lemoal@opensource.wdc.com \
--cc=dlemoal@kernel.org \
--cc=linux-ide@vger.kernel.org \
--cc=liyouhong@kylinos.cn \
--cc=niklas.soderlund@corigine.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox