kern/98962: writing >1 session on ATAPI CDs fails [patch included]

[john hood]

>Number:         98962
>Category:       kern
>Synopsis:       writing >1 session on ATAPI CDs fails [patch included]
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jun 14 22:20:27 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator:     john hood
>Release:        FreeBSD 6.0-RELEASE i386
>Organization:
Sandstorm Enterprises
>Environment:
System: FreeBSD faster.sandstorm.net 6.0-RELEASE FreeBSD 6.0-RELEASE #0: Thu Nov 3 09:36:13 UTC 2005 root at x64.samsco.home:/usr/obj/usr/src/sys/GENERIC i386

Dell Dimension 2400 with ATAPI CD-RW drive.  dmesg.boot follows:

Copyright (c) 1992-2005 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
	The Regents of the University of California. All rights reserved.
FreeBSD 6.0-RELEASE #0: Thu Nov  3 09:36:13 UTC 2005
    root at x64.samsco.home:/usr/obj/usr/src/sys/GENERIC
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: Intel(R) Celeron(R) CPU 2.40GHz (2392.95-MHz 686-class CPU)
  Origin = "GenuineIntel"  Id = 0xf29  Stepping = 9
  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
  Features2=0x4400<CNTX-ID,<b14>>
real memory  = 796344320 (759 MB)
avail memory = 770007040 (734 MB)
ACPI APIC Table: <DELL   2400   >
ioapic0: Changing APIC ID to 1
ioapic0 <Version 2.0> irqs 0-23 on motherboard
npx0: [FAST]
npx0: <math processor> on motherboard
npx0: INT 16 interface
acpi0: <DELL 2400   > on motherboard
acpi0: Power Button (fixed)
pci_link0: <ACPI PCI Link LNKA> irq 11 on acpi0
pci_link1: <ACPI PCI Link LNKB> irq 5 on acpi0
pci_link2: <ACPI PCI Link LNKC> irq 9 on acpi0
pci_link3: <ACPI PCI Link LNKD> irq 10 on acpi0
pci_link4: <ACPI PCI Link LNKE> on acpi0
pci_link5: <ACPI PCI Link LNKF> on acpi0
pci_link6: <ACPI PCI Link LNKG> on acpi0
pci_link7: <ACPI PCI Link LNKH> irq 7 on acpi0
Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x808-0x80b on acpi0
cpu0: <ACPI CPU> on acpi0
acpi_button0: <Power Button> on acpi0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
pci0: <display> at device 2.0 (no driver attached)
uhci0: <Intel 82801DB (ICH4) USB controller USB-A> port 0xff80-0xff9f irq 16 at device 29.0 on pci0
uhci0: [GIANT-LOCKED]
usb0: <Intel 82801DB (ICH4) USB controller USB-A> on uhci0
usb0: USB revision 1.0
uhub0: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
uhci1: <Intel 82801DB (ICH4) USB controller USB-B> port 0xff60-0xff7f irq 19 at device 29.1 on pci0
uhci1: [GIANT-LOCKED]
usb1: <Intel 82801DB (ICH4) USB controller USB-B> on uhci1
usb1: USB revision 1.0
uhub1: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
uhci2: <Intel 82801DB (ICH4) USB controller USB-C> port 0xff40-0xff5f irq 18 at device 29.2 on pci0
uhci2: [GIANT-LOCKED]
usb2: <Intel 82801DB (ICH4) USB controller USB-C> on uhci2
usb2: USB revision 1.0
uhub2: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub2: 2 ports with 2 removable, self powered
ehci0: <Intel 82801DB/DBL/DBM (ICH4) USB 2.0 controller> mem 0xffa80800-0xffa80bff irq 23 at device 29.7 on pci0
ehci0: [GIANT-LOCKED]
usb3: EHCI version 1.0
usb3: companion controllers, 2 ports each: usb0 usb1 usb2
usb3: <Intel 82801DB/DBL/DBM (ICH4) USB 2.0 controller> on ehci0
usb3: USB revision 2.0
uhub3: Intel EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
uhub3: 6 ports with 6 removable, self powered
pcib1: <ACPI PCI-PCI bridge> at device 30.0 on pci0
pci1: <ACPI PCI bus> on pcib1
pci1: <display, VGA> at device 6.0 (no driver attached)
bfe0: <Broadcom BCM4401 Fast Ethernet> mem 0xfe9ee000-0xfe9effff irq 17 at device 9.0 on pci1
miibus0: <MII bus> on bfe0
bmtphy0: <BCM4401 10/100baseTX PHY> on miibus0
bmtphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
bfe0: Ethernet address: 00:0d:56:be:f8:69
isab0: <PCI-ISA bridge> at device 31.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <Intel ICH4 UDMA100 controller> port 0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0xffa0-0xffaf mem 0xfeb7fc00-0xfeb7ffff irq 18 at device 31.1 on pci0
ata0: <ATA channel 0> on atapci0
ata1: <ATA channel 1> on atapci0
pci0: <serial bus, SMBus> at device 31.3 (no driver attached)
pcm0: <Intel ICH4 (82801DB)> port 0xee00-0xeeff,0xedc0-0xedff mem 0xfeb7fa00-0xfeb7fbff,0xfeb7f900-0xfeb7f9ff irq 17 at device 31.5 on pci0
pcm0: [GIANT-LOCKED]
pcm0: <Analog Devices AD1981B AC97 Codec>
fdc0: <floppy drive controller> port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on acpi0
fdc0: [FAST]
atkbdc0: <Keyboard controller (i8042)> port 0x60,0x64 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
atkbd0: [GIANT-LOCKED]
psm0: <PS/2 Mouse> irq 12 on atkbdc0
psm0: [GIANT-LOCKED]
psm0: model Generic PS/2 mouse, device ID 0
sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
sio0: type 16550A
pmtimer0 on isa0
orm0: <ISA Option ROMs> at iomem 0xc0000-0xc8fff,0xc9000-0xca7ff,0xca800-0xcbfff on isa0
ppc0: parallel port not found.
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
sio1: configured irq 3 not in bitmap of probed irqs 0
sio1: port may not be enabled
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
ums0: Logitech USB-PS/2 Mouse M-BA47, rev 1.00/1.20, addr 2, iclass 3/1
ums0: 4 buttons and Z dir.
Timecounter "TSC" frequency 2392950508 Hz quality 800
Timecounters tick every 1.000 msec
ad0: 76319MB <Seagate ST380021A 3.19> at ata0-master UDMA100
acd0: CDRW <HL-DT-ST GCE-8483B/B105> at ata1-master UDMA33
Trying to mount root from ufs:/dev/ad0s1a
Accounting enabled

Test media for this report is an "HP CD-RW" 12X, ATIP info as reported
by cdrecord is:

ATIP info from disk:
  Indicated writing power: 3
  Reference speed: 6
  Is not unrestricted
  Is erasable
  Disk sub type: High speed Rewritable (CAV) media (1)
  ATIP start of lead in:  -11635 (97:26/65)
  ATIP start of lead out: 359849 (79:59/74)
  1T speed low:  4 1T speed high: 10
  2T speed low:  4 2T speed high:  0 (reserved val  6)
  power mult factor: 1 5
  recommended erase/write power: 3
  A1 values: 24 1A BC
  A2 values: 26 B2 26
Disk type:    Phase change
Manuf. index: 3
Manufacturer: CMC Magnetics Corporation

>Description:

Writing the second session on a multi-session CD-R or CD-RW with
burncd fails.  Edited script session follows:

Script started on Wed Jun 14 17:02:04 2006
root at faster# burncd blank
blanking CD - 98 % done     
root at faster# mkisofs -r -o /tmp/iso1 /etc/profile
Total translation table size: 0
Total rockridge attributes bytes: 248
Total directory bytes: 0
Path table size(bytes): 10
Max brk space used 91c4
176 extents written (0 MB)
root at faster# burncd -m data /tmp/iso1 fixate
next writeable LBA 0
writing from file /tmp/iso1 size 352 KB
written this track 352 KB (100%) total 352 KB
fixating CD, please wait..
root at faster# burncd msinfo
burncd: ioctl(CDIOREADTOCHEADER): Input/output error
root at faster# cdcontrol ej  # this stale-TOC bug is already fixed
root at faster# cdcontrol cl
root at faster# burncd msinfo
0,11700
root at faster# mkisofs -r -C 0,11700 -M /dev/acd0 -o /tmp/iso2 /etc/printcap
Rock Ridge signatures found
Total translation table size: 0
Total rockridge attributes bytes: 329
Total directory bytes: 0
Path table size(bytes): 10
Max brk space used a1c4
11877 extents written (23 MB)
root at faster# burncd -m data /tmp/iso2 fixate
next writeable LBA 11700
writing from file /tmp/iso2 size 354 KB

Input/output error

fixating CD, please wait..
root at faster# echo $?
0
root at faster# cdcontrol ej
root at faster# cdcontrol cl
root at faster# mount /cdrom
root at faster# ls /cdrom
profile
root at faster# umount /cdrom
root at faster# burncd msinfo
0,11700
root at faster# exit

Script done on Wed Jun 14 17:10:17 2006

ktrace shows burncd getting EIO on its first write to /dev/acd0.

>How-To-Repeat:
	See above script.
>Fix:

If a CD has a TOC, the acd driver reports the CD's current size to
GEOM, and GEOM later prevents writes beyond the last session on the
media.  Writing the first session works because the driver sets the
disk size to (u_int32_t)-1, which gets cast to an int64 for GEOM,
becoming 0xffffffff.

This patch sets the media size for GEOM to a large positive number,
but only when the device is opened writable.


Index: dev/ata/atapi-cd.c
===================================================================
RCS file: /sand/CVSROOT/ni/src/freebsd/sys6.0/dev/ata/atapi-cd.c,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- dev/ata/atapi-cd.c	14 Jun 2006 20:30:33 -0000	1.1
+++ dev/ata/atapi-cd.c	14 Jun 2006 20:32:35 -0000	1.2
@@ -731,6 +731,8 @@
     else {
 	pp->sectorsize = cdp->block_size;
 	pp->mediasize = cdp->disk_size;
+	if (dw + pp->acw != 0)
+	  pp->mediasize = INT32_MAX; /* Pick a number. */
     }
     pp->mediasize *= pp->sectorsize;
 
>Release-Note:
>Audit-Trail:
>Unformatted: