Re: [PATCH 2/2] ata: libata-core: Set capacity to zero for a security locked drive

[Hannes Reinecke <hare@suse.de>]

On 11/19/25 15:13, Niklas Cassel wrote:
> For Security locked drives (drives that have Security enabled, and have
> not been Security unlocked by boot firmware), the automatic partition
> scanning will result in the user being spammed with errors such as:
> 
>    ata5.00: failed command: READ DMA
>    ata5.00: cmd c8/00:08:00:00:00/00:00:00:00:00/e0 tag 7 dma 4096 in
>             res 51/04:08:00:00:00/00:00:00:00:00/e0 Emask 0x1 (device error)
>    ata5.00: status: { DRDY ERR }
>    ata5.00: error: { ABRT }
>    sd 4:0:0:0: [sda] tag#7 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s
>    sd 4:0:0:0: [sda] tag#7 Sense Key : Aborted Command [current]
>    sd 4:0:0:0: [sda] tag#7 Add. Sense: No additional sense information
> 
> during boot, because most commands except for IDENTIFY will be aborted by
> a Security locked drive.
> 
> For a Security locked drive, set capacity to zero, so that no automatic
> partition scanning will happen.
> 
> If the user later unlocks the drive using e.g. hdparm, the close() by the
> user space application should trigger a revalidation of the drive.
> 
> Signed-off-by: Niklas Cassel <cassel@kernel.org>
> ---
>   drivers/ata/libata-core.c | 10 ++++++++++
>   1 file changed, 10 insertions(+)
> 
> diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
> index 2a210719c4ce..f48fb63d7e85 100644
> --- a/drivers/ata/libata-core.c
> +++ b/drivers/ata/libata-core.c
> @@ -3006,6 +3006,16 @@ int ata_dev_configure(struct ata_device *dev)
>   		}
>   
>   		dev->n_sectors = ata_id_n_sectors(id);
> +		if (ata_id_is_locked(id)) {
> +			/*
> +			 * If Security locked, set capacity to zero to prevent
> +			 * any I/O, e.g. partition scanning, as any I/O to a
> +			 * locked drive will result in user visible errors.
> +			 */
> +			ata_dev_info(dev,
> +				"Security locked, setting capacity to zero\n");
> +			dev->n_sectors = 0;
> +		}
>   
>   		/* get current R/W Multiple count setting */
>   		if ((dev->id[47] >> 8) == 0x80 && (dev->id[59] & 0x100)) {

Reviewed-by: Hannes Reinecke <hare@suse.de>

Cheers,

Hannes
-- 
Dr. Hannes Reinecke                  Kernel Storage Architect
hare@suse.de                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich