Raise the disk ceiling: 64-bit blocks, no FSSIZE panic, LBA48

SchFS is a 64-bit format addressing 64 ZB. The stack under it was not,
and the lowest limit was three orders of magnitude below the one anybody
would have guessed:

  ide.c   panicked on any block >= FSSIZE -- 150000 blocks, 614 MB
  ide.c   computed the sector in an int, and addressed it with LBA28
  bio.c   took a 32-bit block number, capping any device at 16 TB
  schfs   refused blocks past 0xffffffff, mirroring the cache

The FSSIZE check is the one that mattered. FSSIZE describes the size of a
v1 filesystem *image*; it had no business bounding a physical device, and
it meant a disk larger than half a gigabyte panicked the kernel rather
than being read.

struct buf's blockno is uint64 now, and so is bread's. idestart computes
the sector in 64 bits and picks LBA48 when it does not fit in 28 -- per
request, so everything that fits stays on the LBA28 path every existing
image has been read through. The 48-bit registers are written high half
first, because each is a two-deep FIFO and the other order leaves the
drive addressing whatever the low bytes alone describe.

Verified with a 2 GB disk carrying a marker at 1 GiB -- block 262144,
well past the old panic at 150000. The guest reads it back:
"MARKER-PAST-THE-OLD-LIMIT". schfs-check passes including the round-trip;
bootcheck 108 [ok].

Two limits deliberately left, both noted rather than guessed at: raw
/dev/hdN access still goes through devsw's 32-bit offset, so a raw device
is addressable to 4 GB; and usb_storage computes a 32-bit LBA, which is
what SCSI READ(10) carries -- READ(16) is a different command, not a
wider variable.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kernel/dev/bio.c

@@ -77,7 +77,7 @@ bdevrw(struct buf *b)
 // If not found, allocate a buffer.
 // In either case, return locked buffer.
 static struct buf*
-bget(uint dev, uint blockno)
+bget(uint dev, uint64 blockno)
 {
   struct buf *b;
 
@@ -112,7 +112,7 @@ bget(uint dev, uint blockno)
 
 // Return a locked buf with the contents of the indicated block.
 struct buf*
-bread(uint dev, uint blockno)
+bread(uint dev, uint64 blockno)
 {
   struct buf *b;
 

kernel/dev/ide.c

@@ -25,6 +25,11 @@
 #define IDE_CMD_RDMUL 0xc4
 #define IDE_CMD_SETMULT 0xc6
 #define IDE_CMD_WRMUL 0xc5
+// The 48-bit forms. Same operations, an address that is not capped at 128 GB.
+#define IDE_CMD_READ_EXT  0x24
+#define IDE_CMD_WRITE_EXT 0x34
+#define IDE_CMD_RDMUL_EXT 0x29
+#define IDE_CMD_WRMUL_EXT 0x39
 
 // idequeue points to the buf now being read/written to the disk.
 // idequeue->qnext points to the next buf to be processed.
@@ -154,25 +159,60 @@ idestart(struct buf *b)
 {
   if(b == 0)
     panic("idestart");
-  if(b->blockno >= FSSIZE)
-    panic("incorrect blockno");
-  int sector_per_block =  BSIZE/SECTOR_SIZE;
-  int sector = b->blockno * sector_per_block;
-  int read_cmd = (sector_per_block == 1) ? IDE_CMD_READ :  IDE_CMD_RDMUL;
-  int write_cmd = (sector_per_block == 1) ? IDE_CMD_WRITE : IDE_CMD_WRMUL;
+
+  // No FSSIZE check. It used to panic on any block past 150000 -- 614 MB at
+  // BSIZE -- which is a constant describing the *v1 filesystem image*, not the
+  // disk. It had no business bounding a device, and it was the lowest ceiling
+  // in the stack by three orders of magnitude: the format addresses 64 ZB and
+  // the drive was refused past half a gigabyte.
+  int sector_per_block = BSIZE/SECTOR_SIZE;
+  uint64 sector = b->blockno * (uint64)sector_per_block;
 
   // No `sector_per_block > 7` panic here any more. That limit existed because
   // nothing had set the drive's multiple count, so anything past the tested
   // two sectors was a guess; ideinit() issues SET MULTIPLE MODE now, and the
   // count is whatever BSIZE says.
 
+  // LBA28 addresses 2^28 sectors, which is 128 GB and no more. Past that the
+  // 48-bit commands are the only way to name the sector at all, so the mode is
+  // chosen per request: LBA28 stays the path for everything that fits, because
+  // it is the one every existing image has been read through.
+  int lba48 = sector >= (1ULL << 28);
+  int read_cmd, write_cmd;
+
+  if(lba48){
+    read_cmd  = (sector_per_block == 1) ? IDE_CMD_READ_EXT  : IDE_CMD_RDMUL_EXT;
+    write_cmd = (sector_per_block == 1) ? IDE_CMD_WRITE_EXT : IDE_CMD_WRMUL_EXT;
+  } else {
+    read_cmd  = (sector_per_block == 1) ? IDE_CMD_READ  : IDE_CMD_RDMUL;
+    write_cmd = (sector_per_block == 1) ? IDE_CMD_WRITE : IDE_CMD_WRMUL;
+  }
+
   idewait(0);
   outb(0x3f6, 0);  // generate interrupt
-  outb(0x1f2, sector_per_block);  // number of sectors
-  outb(0x1f3, sector & 0xff);
-  outb(0x1f4, (sector >> 8) & 0xff);
-  outb(0x1f5, (sector >> 16) & 0xff);
-  outb(0x1f6, 0xe0 | ((b->dev&1)<<4) | ((sector>>24)&0x0f));
+
+  if(lba48){
+    // The high half goes first, then the low half into the same registers:
+    // each is a two-deep FIFO, and writing them in the other order leaves the
+    // drive addressing whichever sector the low bytes alone describe.
+    outb(0x1f2, 0);                          // sector count, high byte
+    outb(0x1f3, (sector >> 24) & 0xff);
+    outb(0x1f4, (sector >> 32) & 0xff);
+    outb(0x1f5, (sector >> 40) & 0xff);
+    outb(0x1f2, sector_per_block);           // sector count, low byte
+    outb(0x1f3, sector & 0xff);
+    outb(0x1f4, (sector >> 8) & 0xff);
+    outb(0x1f5, (sector >> 16) & 0xff);
+    // LBA48 carries no address bits in the drive/head register.
+    outb(0x1f6, 0x40 | ((b->dev&1)<<4));
+  } else {
+    outb(0x1f2, sector_per_block);
+    outb(0x1f3, sector & 0xff);
+    outb(0x1f4, (sector >> 8) & 0xff);
+    outb(0x1f5, (sector >> 16) & 0xff);
+    outb(0x1f6, 0xe0 | ((b->dev&1)<<4) | ((sector>>24)&0x0f));
+  }
+
   if(b->flags & B_DIRTY){
     outb(0x1f7, write_cmd);
     outsl(0x1f0, b->data, BSIZE/4);

kernel/fs/schfs/kmount.c

@@ -112,10 +112,9 @@ kd_read(void *ctx, uint64_t blk, void *out)
 
   if (blk == 0)
     return -1;
-  // The buffer cache addresses blocks with a uint, which caps the volume long
-  // before the on-disk format does. Refusing out here beats truncating and
-  // reading some unrelated sector, which would surface as corruption.
-  if (blk > 0xffffffffULL / SCHFS_BPB)
+  // The buffer cache takes 64-bit block numbers now, so this no longer caps the
+  // volume; the check remains as an overflow guard on the multiply below.
+  if (blk > (~0ULL) / SCHFS_BPB)
     return -1;
 
   for (int i = 0; i < SCHFS_BPB; i++) {
@@ -133,7 +132,7 @@ kd_write(void *ctx, uint64_t blk, const void *in)
 
   if (blk == 0)
     return -1;
-  if (blk > 0xffffffffULL / SCHFS_BPB)
+  if (blk > (~0ULL) / SCHFS_BPB)
     return -1;
 
   // Straight through the buffer cache, with no log. The xv6 log exists to make