From q@uni.de  Sun Oct 10 18:23:38 2004
Return-Path: <q@uni.de>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 1113216A4CE; Sun, 10 Oct 2004 18:23:38 +0000 (GMT)
Received: from wrzx35.rz.uni-wuerzburg.de (wrzx35.rz.uni-wuerzburg.de [132.187.3.35])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 6E69D43D48; Sun, 10 Oct 2004 18:23:37 +0000 (GMT)
	(envelope-from q@uni.de)
Received: from wrzx30.rz.uni-wuerzburg.de (wrzx30.rz.uni-wuerzburg.de [132.187.1.30])
	by wrzx35.rz.uni-wuerzburg.de (Postfix) with ESMTP
	id 398DCDD1FC; Sun, 10 Oct 2004 20:23:36 +0200 (CEST)
Received: from virusscan (localhost [127.0.0.1])
	by wrzx30.rz.uni-wuerzburg.de (Postfix) with ESMTP
	id 1D5B38FDCC; Sun, 10 Oct 2004 20:23:36 +0200 (CEST)
Received: from wrzx28.rz.uni-wuerzburg.de (wrzx28.rz.uni-wuerzburg.de [132.187.3.28])
	by wrzx30.rz.uni-wuerzburg.de (Postfix) with ESMTP
	id F3B138FD54; Sun, 10 Oct 2004 20:23:35 +0200 (CEST)
Received: from coyote.q.local (wwsx14.win-screen.uni-wuerzburg.de [132.187.253.14])
	by wrzx28.rz.uni-wuerzburg.de (Postfix) with ESMTP
	id D3682D4659; Sun, 10 Oct 2004 20:23:35 +0200 (CEST)
Received: from roadrunner.q.local (roadrunner.q.local [192.168.0.148])
	by coyote.q.local (8.12.10/8.12.10) with ESMTP id i9AINZA4070701;
	Sun, 10 Oct 2004 20:23:35 +0200 (CEST)
	(envelope-from q@roadrunner.q.local)
Received: from roadrunner.q.local (localhost [127.0.0.1])
	by roadrunner.q.local (8.13.1/8.13.1) with ESMTP id i9AINZEO000933;
	Sun, 10 Oct 2004 20:23:35 +0200 (CEST)
	(envelope-from q@roadrunner.q.local)
Received: (from q@localhost)
	by roadrunner.q.local (8.13.1/8.13.1/Submit) id i9AINZeb000932;
	Sun, 10 Oct 2004 20:23:35 +0200 (CEST)
	(envelope-from q)
Message-Id: <200410101823.i9AINZeb000932@roadrunner.q.local>
Date: Sun, 10 Oct 2004 20:23:35 +0200 (CEST)
From: Ulrich Spoerlein <q@uni.de>
Reply-To: Ulrich Spoerlein <q@uni.de>
To: FreeBSD-gnats-submit@freebsd.org
Cc: sos@freebsd.org
Subject: ata-queue.c rev 1.22 broke dd(1) conv=noerror
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         72488
>Category:       kern
>Synopsis:       ata-queue.c rev 1.22 broke dd(1) conv=noerror
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    sos
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Oct 10 18:30:15 GMT 2004
>Closed-Date:    Mon Apr 11 11:17:58 GMT 2005
>Last-Modified:  Sat Aug 13 16:20:09 GMT 2005
>Originator:     Ulrich Spoerlein
>Release:        FreeBSD 5.3-BETA7 i386
>Organization:
>Environment:
System: FreeBSD roadrunner 5.3-BETA7
One Kernel dated 2004/02/28
One Kernel dated 2004/02/29
>Description:
# dd if=/dev/acd0 bs=2048 of=foo conv=sync,noerror
dd: /dev/acd0: Input/output error
2316+0 records in
2316+0 records out
4743168 bytes transferred in 10.777543 secs (440097 bytes/sec)
dd: /dev/acd0: Input/output error
dd: /dev/acd0: Invalid argument
2317+0 records in
2317+0 records out
2318+0 records in
2318+0 records out
4747264 bytes transferred in 10.800617 secs (439536 bytes/sec)
dd: /dev/acd0: Invalid argument
dd: /dev/acd0: Invalid argument
2319+0 records in
2319+0 records out
4749312 bytes transferred in 10.800908 secs (439714 bytes/sec)
dd: /dev/acd0: Invalid argument
dd: /dev/acd0: Invalid argument
2320+0 records in
2320+0 records out
... This loops as fast as it can, dd(1) doesn't even try to access the
device from this point forward.

When booting the 29th Kernel but with ata-queue.c rev 1.21 instead of 1.22:
# dd if=/dev/acd0 bs=2048 of=foo conv=sync,noerror
dd: /dev/acd0: Input/output error
2316+0 records in
2316+0 records out
4743168 bytes transferred in 10.737025 secs (441758 bytes/sec)
dd: /dev/acd0: Input/output error
dd: /dev/acd0: Input/output error
2317+0 records in
2317+0 records out
4745216 bytes transferred in 12.324324 secs (385028 bytes/sec)
dd: /dev/acd0: Input/output error
dd: /dev/acd0: Input/output error
2318+0 records in
2318+0 records out
4747264 bytes transferred in 13.919411 secs (341054 bytes/sec)
dd: /dev/acd0: Input/output error
2326+0 records in
2326+0 records out
^C

Note, that it at least reads blocks 2319-2326, it's also spinning the CD like
mad (this is expected).
Additionally I get this in dmesg, whereas rev. 1.22 is silent
acd0: FAILURE - READ_BIG status=51<READY,DSC,ERROR> sensekey=MEDIUM ERROR error=4<ABORTED>
acd0: FAILURE - READ_BIG status=51<READY,DSC,ERROR> sensekey=MEDIUM ERROR error=4<ABORTED>
acd0: FAILURE - READ_BIG status=51<READY,DSC,ERROR> sensekey=MEDIUM ERROR error=4<ABORTED>
acd0: FAILURE - READ_BIG status=51<READY,DSC,ERROR> sensekey=MEDIUM ERROR error=4<ABORTED>

Someone from bsdforen.de pointed out, that he too got this error when reading
old CDs and tracked it down to the relative lseek() failing in dd(1). When
using an absolute lseek() things just work.

>How-To-Repeat:
Put old/scratched CD in drive, run:
dd if=/dev/acd0 of=/dev/null bs=2048 conv=noerror
Wait for the first error, then watch those errors fly by...
>Fix:
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->sos 
Responsible-Changed-By: simon 
Responsible-Changed-When: Sun Oct 10 18:42:50 GMT 2004 
Responsible-Changed-Why:  
Over to sos for evaluation. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=72488 
State-Changed-From-To: open->closed 
State-Changed-By: sos 
State-Changed-When: Mon Apr 11 11:15:06 GMT 2005 
State-Changed-Why:  
This should be solved on -current. However handling media errors are to some 
extent drive specific so not all errors can be handled in a sane fashion. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=72488 

From: Ulrich Spoerlein <q@galgenberg.net>
To: =?iso-8859-15?Q?S=F8ren?= Schmidt <sos@FreeBSD.org>
Cc: FreeBSD-gnats-submit@FreeBSD.org
Subject: Re: kern/72488: ata-queue.c rev 1.22 broke dd(1) conv=noerror
Date: Sat, 13 Aug 2005 18:10:26 +0200

 On Mon, 11.04.2005 at 11:17:58 +0000, SXren Schmidt wrote:
 > This should be solved on -current. However handling media errors are to some
 > extent drive specific so not all errors can be handled in a sane fashion.
 
 Sorry to bring this up again, but this problem still exists for
 RELENG_6. Upon the first unreadable bad sector, dd(1) will loop reading
 _nothing_ from the CD and writing chunks of zeros to the outfile.
 
 Do you want me to produce a crash dump when this happens? Or any other
 things I should try?
 
 Ulrich Spoerlein
>Unformatted:
