Flash 越界

现象

[  120.430581] sps:BAM 0x04044000 (va:0x00000000) enabled: ver:0x25, number of pipes:6
[  122.454233] attempt to access beyond end of device
[  122.454263] mmcblk0p38: rw=17, want=25695648, limit=25695181

[   15.461154] ueventd: loading /devices/soc/a21b000.qcom,pronto/firmware/wcnss.b09 took 16ms
[   15.505953] attempt to access beyond end of device
[   15.505985] mmcblk0p38: rw=1, want=25710752, limit=25695181
[   15.513746] init: Service 'qcom-c_main-sh' (pid 392) exited with statu

[   20.550126] attempt to access beyond end of device
[   20.550152] mmcblk0p38: rw=145, want=25710592, limit=25695181
[   20.550487] f2fs_msg: 97 callbacks suppressed
[   20.550506] F2FS-fs (mmcblk0p38): Issue discard(3213312, 3213312, 512) failed, ret: -5

分析

先恢复出问题手机的出厂设置,看能否开机,再往里面填写数据,看能否复现问题.

st=>start: 开始
e1=>end: 其他问题
e2=>end: 分区问题
e3=>end: 其他问题
op1=>operation: 恢复出厂设置
cond1=>condition: 可以开机?
op2=>operation: 写入大量数据
cond2=>condition: 能否复现?

st->op1->cond1->op2->cond2
cond1(yes)->op2
cond1(no)->e1
cond2(yes)->e2
cond2(no)->e3
graph TD;
A-->B;
A-->C;
B-->D;
C-->D;

  • 分区表对比(1A54恢复出厂设置之前和之后的分区表,没有区别,但是1A53-4和1A54的分区表有比较大的区别,但貌似不影响测试结果)
    compareOfPartition

  • 填充手机的方法:

    dd if=/dev/zero of=1M.txt bs=1M count=1



dd if=/dev/zero of=100M.txt bs=100M count=1



dd if=/dev/zero of=1000M.txt bs=1000M count=1



for i in $(seq 1 1000); do adb -s 1f0 push 1000M.txt /sdcard/test/1000M$i.txt;done

</font>

  • LOG:
    正常的LOG应该是提示: Quota exceeded
    不正常的LOG提示: I/O error

    android@NSGWD180021:/data/workspace/temp/0329/ioerror$ for i in $(seq 1 1000); do adb -s 1f0 push 1000M.txt /sdcard/test/1000M$i.txt;done
    1000M.txt: 1 file pushed. 8.7 MB/s (1048576000 bytes in 114.662s)
    1000M.txt: 1 file pushed. 8.4 MB/s (1048576000 bytes in 119.634s)
    1000M.txt: 1 file pushed. 8.3 MB/s (1048576000 bytes in 120.693s)
    1000M.txt: 1 file pushed. 8.3 MB/s (1048576000 bytes in 121.093s)
    1000M.txt: 1 file pushed. 8.3 MB/s (1048576000 bytes in 120.021s)
    1000M.txt: 1 file pushed. 8.3 MB/s (1048576000 bytes in 120.392s)
    1000M.txt: 1 file pushed. 8.3 MB/s (1048576000 bytes in 119.923s)
    1000M.txt: 1 file pushed. 8.3 MB/s (1048576000 bytes in 120.184s)
    1000M.txt: 1 file pushed. 8.3 MB/s (1048576000 bytes in 120.583s)
    1000M.txt: 1 file pushed. 8.3 MB/s (1048576000 bytes in 120.764s)
    1000M.txt: 1 file pushed. 8.0 MB/s (1048576000 bytes in 124.633s)
    adb: error: failed to copy '1000M.txt' to '/sdcard/test/1000M12.txt': remote write failed: Quota exceeded
    1000M.txt: 0 files pushed. 8.6 MB/s (302673832 bytes in 33.740s)
    adb: error: failed to copy '1000M.txt' to '/sdcard/test/1000M13.txt': remote write failed: Quota exceeded
    1000M.txt: 0 files pushed. 9.7 MB/s (298021344 bytes in 29.364s)
    adb: error: failed to copy '1000M.txt' to '/sdcard/test/1000M14.txt': remote write failed: Quota exceeded
    1000M.txt: 0 files pushed. 9.2 MB/s (300970104 bytes in 31.357s)
    adb: error: failed to copy '1000M.txt' to '/sdcard/test/1000M15.txt': remote write failed: Quota exceeded
    1000M.txt: 0 files pushed. 8.2 MB/s (300445880 bytes in 35.017s)
    adb: error: failed to copy '1000M.txt' to '/sdcard/test/1000M16.txt': remote write failed: Quota exceeded
    1000M.txt: 0 files pushed. 9.8 MB/s (297300536 bytes in 29.071s)
    adb: error: failed to copy '1000M.txt' to '/sdcard/test/1000M17.txt': remote write failed: Quota exceeded
    1000M.txt: 0 files pushed. 9.7 MB/s (297890288 bytes in 29.415s)
    adb: error: failed to copy '1000M.txt' to '/sdcard/test/1000M18.txt': remote write failed: Quota exceeded
    1000M.txt: 0 files pushed. 9.7 MB/s (297235008 bytes in 29.371s)

    android@U-NSGWD180020:/data/workspace/log$ for i in $(seq 8 1000); do adb -s 1e4fd635 push 100M.txt /sdcard/test/100M$i.txt;done
    adb: error: failed to copy '100M.txt' to '/sdcard/test/100M8.txt': remote write failed: Quota exceeded
    100M.txt: 0 files pushed. 13.9 MB/s (99405976 bytes in 6.836s)
    adb: error: failed to copy '100M.txt' to '/sdcard/test/100M9.txt': remote write failed: Quota exceeded
    100M.txt: 0 files pushed. 17.8 MB/s (99799144 bytes in 5.354s)
    [ 18%] /sdcard/test/100M10.txt^C

    error
    1000M.txt: 0 files pushed. 245.3 MB/s (2752176 bytes in 0.011s)
    adb: error: failed to copy '1000M.txt' to '/sdcard/test/1000M153.txt': remote couldn't create file: I/O error
    1000M.txt: 0 files pushed. 247.7 MB/s (2752176 bytes in 0.011s)
    adb: error: failed to copy '1000M.txt' to '/sdcard/test/1000M154.txt': remote couldn't create file: I/O error
    1000M.txt: 0 files pushed. 184.7 MB/s (2883232 bytes in 0.015s)

    问题点

    android@NSGWD180021:/data/workspace/temp/0329/ioerror$ adb -s 1f0 shell df -a
    Filesystem 1K-blocks Used Available Use% Mounted on
    rootfs 439876 1668 438208 1% /
    tmpfs 452888 688 452200 1% /dev
    devpts 0 0 0 0% /dev/pts
    proc 0 0 0 0% /proc
    sysfs 0 0 0 0% /sys
    selinuxfs 0 0 0 0% /sys/fs/selinux
    /dev/block/mmcblk0p12 1401624 701420 683820 51% /system
    /dev/block/mmcblk0p37 247872 146556 96196 61% /vendor
    none 0 0 0 0% /acct
    debugfs 0 0 0 0% /sys/kernel/debug
    tmpfs 452888 0 452888 0% /mnt
    none 0 0 0 0% /config
    none 0 0 0 0% /dev/cpuctl
    /dev/block/mmcblk0p38 13356808 12082296 799376 94% /data
    /dev/block/mmcblk0p14 253920 148 248532 1% /cache
    /dev/block/mmcblk0p13 28144 236 27256 1% /persist
    /dev/block/mmcblk0p8 65488 56896 8592 87% /firmware
    tmpfs 452888 0 452888 0% /storage
    tracefs 0 0 0 0% /sys/kernel/debug/tracing
    adb 0 0 0 0% /dev/usb-ffs/adb
    /data/media 13356808 12082296 799376 94% /storage/emulated
    android@NSGWD180021:/data/workspace/temp/0329/ioerror$

恢复出厂设置之后:

android@NSGWD180021:/data/workspace/temp/0329/ioerror$ adb -s 1f0 shell df -a
Filesystem 1K-blocks Used Available Use% Mounted on
rootfs 439876 1668 438208 1% /
tmpfs 452888 688 452200 1% /dev
devpts 0 0 0 0% /dev/pts
proc 0 0 0 0% /proc
sysfs 0 0 0 0% /sys
selinuxfs 0 0 0 0% /sys/fs/selinux
/dev/block/mmcblk0p12 1401624 701420 683820 51% /system
/dev/block/mmcblk0p37 247872 146556 96196 61% /vendor
none 0 0 0 0% /acct
debugfs 0 0 0 0% /sys/kernel/debug
tmpfs 452888 0 452888 0% /mnt
none 0 0 0 0% /config
none 0 0 0 0% /dev/cpuctl
/dev/block/mmcblk0p38 12845524 377124 12001456 4% /data
/dev/block/mmcblk0p14 237536 392 229284 1% /cache
/dev/block/mmcblk0p13 28144 232 27260 1% /persist
/dev/block/mmcblk0p8 65488 56896 8592 87% /firmware
tmpfs 452888 0 452888 0% /storage
tracefs 0 0 0 0% /sys/kernel/debug/tracing
adb 0 0 0 0% /dev/usb-ffs/adb
/data/media 12845524 377124 12001456 4% /storage/emulated

修改方案

  • 修改 BoardConfig.mk 里面

    # Modify by weibiao@hipad.com
    BOARD_USERDATAIMAGE_PARTITION_SIZE := 13155932160
  • 修改后第一开机的df情况

android@NSGWD180021:/data/workspace/temp/0329/ioerror$ adb shell df -a
Filesystem 1K-blocks Used Available Use% Mounted on
rootfs 440392 1668 438724 1% /
tmpfs 453400 688 452712 1% /dev
devpts 0 0 0 0% /dev/pts
proc 0 0 0 0% /proc
sysfs 0 0 0 0% /sys
selinuxfs 0 0 0 0% /sys/fs/selinux
/dev/block/dm-0 1399728 706292 677052 52% /system
/dev/block/dm-1 243892 148496 90360 63% /vendor
none 0 0 0 0% /acct
debugfs 0 0 0 0% /sys/kernel/debug
tmpfs 453400 0 453400 0% /mnt
none 0 0 0 0% /config
none 0 0 0 0% /dev/cpuctl
/dev/block/mmcblk0p38 12845540 382924 11995672 4% /data
/dev/block/mmcblk0p14 253920 148 248532 1% /cache
/dev/block/mmcblk0p13 28144 236 27256 1% /persist
/dev/block/mmcblk0p8 65488 57024 8464 88% /firmware
tmpfs 453400 0 453400 0% /storage
tracefs 0 0 0 0% /sys/kernel/debug/tracing
adb 0 0 0 0% /dev/usb-ffs/adb
/data/media 12845540 382924 11995672 4% /storage/emulated
  • 修改后第一次开机未重启的,最大填充. 433148 字节未填充满.
android@NSGWD180021:/data/workspace/temp/0329/ioerror$ adb -s 1f0 shell df -a
Filesystem 1K-blocks Used Available Use% Mounted on
rootfs 440392 1668 438724 1% /
tmpfs 453400 688 452712 1% /dev
devpts 0 0 0 0% /dev/pts
proc 0 0 0 0% /proc
sysfs 0 0 0 0% /sys
selinuxfs 0 0 0 0% /sys/fs/selinux
/dev/block/dm-0 1399728 706292 677052 52% /system
/dev/block/dm-1 243892 148496 90360 63% /vendor
none 0 0 0 0% /acct
debugfs 0 0 0 0% /sys/kernel/debug
tmpfs 453400 0 453400 0% /mnt
none 0 0 0 0% /config
none 0 0 0 0% /dev/cpuctl
/dev/block/mmcblk0p38 12845540 11945448 433148 97% /data
/dev/block/mmcblk0p14 253920 148 248532 1% /cache
/dev/block/mmcblk0p13 28144 236 27256 1% /persist
/dev/block/mmcblk0p8 65488 57024 8464 88% /firmware
tmpfs 453400 0 453400 0% /storage
tracefs 0 0 0 0% /sys/kernel/debug/tracing
adb 0 0 0 0% /dev/usb-ffs/adb
/data/media 12845540 11945448 433148 97% /storage/emulated
  • 修改后第一次开机重启之后,最大填充. 与上面的数据有出入
android@NSGWD180021:/data/workspace/temp/0329/ioerror$ adb -s 1f0 shell df -a
Filesystem 1K-blocks Used Available Use% Mounted on
rootfs 440392 1668 438724 1% /
tmpfs 453400 688 452712 1% /dev
devpts 0 0 0 0% /dev/pts
proc 0 0 0 0% /proc
sysfs 0 0 0 0% /sys
selinuxfs 0 0 0 0% /sys/fs/selinux
/dev/block/dm-0 1399728 706292 677052 52% /system
/dev/block/dm-1 243892 148496 90360 63% /vendor
none 0 0 0 0% /acct
debugfs 0 0 0 0% /sys/kernel/debug
tmpfs 453400 0 453400 0% /mnt
none 0 0 0 0% /config
none 0 0 0 0% /dev/cpuctl
/dev/block/mmcblk0p38 12845540 11945304 433292 97% /data
/dev/block/mmcblk0p14 253920 148 248532 1% /cache
/dev/block/mmcblk0p13 28144 236 27256 1% /persist
/dev/block/mmcblk0p8 65488 57024 8464 88% /firmware
tmpfs 453400 0 453400 0% /storage
tracefs 0 0 0 0% /sys/kernel/debug/tracing
adb 0 0 0 0% /dev/usb-ffs/adb
  • 恢复出厂设置之后
android@NSGWD180021:/data/workspace/temp/0329/ioerror$ adb -s 1f0 shell df -a
Filesystem 1K-blocks Used Available Use% Mounted on
rootfs 440392 1668 438724 1% /
tmpfs 453400 688 452712 1% /dev
devpts 0 0 0 0% /dev/pts
proc 0 0 0 0% /proc
sysfs 0 0 0 0% /sys
selinuxfs 0 0 0 0% /sys/fs/selinux
/dev/block/dm-0 1399728 706292 677052 52% /system
/dev/block/dm-1 243892 148496 90360 63% /vendor
none 0 0 0 0% /acct
debugfs 0 0 0 0% /sys/kernel/debug
tmpfs 453400 0 453400 0% /mnt
none 0 0 0 0% /config
none 0 0 0 0% /dev/cpuctl
/dev/block/mmcblk0p38 12845524 381700 11996880 4% /data
/dev/block/mmcblk0p14 237536 392 229284 1% /cache
/dev/block/mmcblk0p13 28144 236 27256 1% /persist
/dev/block/mmcblk0p8 65488 57024 8464 88% /firmware
tmpfs 453400 0 453400 0% /storage
tracefs 0 0 0 0% /sys/kernel/debug/tracing
adb 0 0 0 0% /dev/usb-ffs/adb
/data/media 12845524 381700 11996880 4% /storage/emulated