Well, I was glad to have found the thread that described my case perfectly (OTA brick, no recovery, no download, unable to reset). Thus, I installed Ubuntu, and followed all the steps. When I came to the final step of 'rebooting the phone', my VZW G2 VS980 (I think) was unresponsive to anything. I thought that perhaps it got fully discharged, so I hooked it up to a charger. And - nothing, not even after a few hours of charging. I realize that I used the files that may not be EXACTLY for the version I have, but someone on this thread suggested that these may still work. So - not sure if this was THE death blow...
If before Win8 recognized it as a Qualcomm device (with the attendant smorgasbord of phantom drives), now the error is for a generic 'unrecognized usb device'.
So - it is a complete brick, which does not respond to any hadrware inputs - i.e., matter what buttons are pressed and for how long, there is no response from the device.
Thoughts??
This is a copy from the terminal window, as it stands curently:
/dev/sda /dev/sda2 /dev/sdb1 /dev/sdb5
/dev/sda1 /dev/sdb /dev/sdb2 /dev/sdb6
Disk /dev/sdb: 976773168 sectors, 465.8 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 918B6C9F-D1B0-49D5-8CA2-F14781192942
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 976773134
Partitions will be aligned on 8-sector boundaries
Total free space is 4594 sectors (2.2 MiB)
Number Start (sector) End (sector) Size Code Name
1 63 780764729 372.3 GiB 0700 Microsoft basic data
5 780765184 959999999 85.5 GiB 8300 Linux filesystem
6 960002048 976771071 8.0 GiB 8200 Linux swap
Related
So I was transferring some files to the large internal sdcard, when my computer keeled over from a sudden and unanticipated hardware failure. I unplugged the phone immediately and waited for the Media scanning to finish, and waited, and waited. So I shut down the phone, which may in retrospect have been a mistake.
Now the internal sdcard is bizarrely named "_PNG []-1" and Media scanning is currently hung after reattempting the file transfer (begun at 9:58 and still going).
Any advice on steps I should take in attempting to remedy the situation is greatly appreciated.
Magicked from my Vibrant by tube traversing XDA elves.
Well, I used the disktype utility and discovered that the internal memory is fat32. So I ran
Code:
dosfsck -vV /dev/sdc
and got the following for my trouble
Code:
dosfsck 3.0.9 (31 Jan 2010)
dosfsck 3.0.9, 31 Jan 2010, FAT32, LFN
Checking we can access the last sector of the filesystem
Boot sector contents:
System ID "android "
Media byte 0xf0 (5.25" or 3.5" HD floppy)
512 bytes per logical sector
32768 bytes per cluster
32 reserved sectors
First FAT starts at byte 16384 (sector 32)
2 FATs, 32 bit entries
1675264 bytes per FAT (= 3272 sectors)
Root directory start at cluster 2 (arbitrary size)
Data area starts at byte 3366912 (sector 6576)
418713 data clusters (13720387584 bytes)
16 sectors/track, 4 heads
0 hidden sectors
26804208 sectors total
Starting check/repair pass.
Checking for unused clusters.
Checking free cluster summary.
Starting verification pass.
Checking for unused clusters.
/dev/sdc: 32571 files, 130173/418713 clusters
Of course in spite of this happy results, Media scanning continues to hang. (I gave it a half hour before I plugged it in again to run this test, so... I don't think it was gonna snap out of it).
Not really big news for anyone who's installed SDE and poked around a bit, but I thought I'd post this anyway.
Taken from a 16GB Archos 101. Your results may differ.
Code:
Disk /dev/mmcblk0: 536 MB, 536870912 bytes
4 heads, 16 sectors/track, 16384 cylinders
Units = cylinders of 64 * 512 = 32768 bytes
Device Boot Start End Blocks Id System
/dev/mmcblk0p1 5 1605 51200+ 83 Linux
/dev/mmcblk0p2 1605 5511 125023 83 Linux
/dev/mmcblk0p3 5512 6489 31296 83 Linux
/dev/mmcblk0p4 6490 16384 316640 83 Linux
Disk /dev/mmcblk1: 15.3 GB, 15388901376 bytes
4 heads, 16 sectors/track, 469632 cylinders
Units = cylinders of 64 * 512 = 32768 bytes
Device Boot Start End Blocks Id System
/dev/mmcblk1p1 1 469632 15028216 c Win95 FAT32 (LBA)
Being MMC rather than MTD devices, it ought to be possible to repartition to shuffle some space around, perhaps gaining as much as 50MB extra space for /data.
Additionally, for custom firmwares maybe even repartitioning mmcblk1 may be possible, to create an alternate partition to mount /data/ to.
Of course, for fear of ruining my 101 I have only used fdisk for read-only operations.
don't forget mmcblk2..
it's the external sdcard
Of course I was examining the internal flash storage of the device.
Having my 101 for just under 3 weeks I'm not quite brave enough to repartition mmcblk0, as it would be very difficult to recover an operational system if this were to not go as well as expected. :>
I'm hoping that someone with a little more insight or perhaps a little braver than I could chime in on the possibility.
why won't you repartition (shrink p1 and append other partitions) blk1? (8 / 16 GB storage)
don't touch blk0 when you don't have to
chulri said:
why won't you repartition (shrink p1 and append other partitions) blk1? (8 / 16 GB storage)
don't touch blk0 when you don't have to
Click to expand...
Click to collapse
This was of course my suggestion for alternate firmwares that can take advantage of this.
Moved to general as not android development
In case this info is of use to someone...
Trying to understand what goes where,
Here is the partition table of a U8800:
#######################################
Disk /dev/sdb: 3959 MB, 3959422976 bytes
1 heads, 62 sectors/track, 124729 cylinders, total 7733248 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000
Device Boot Start End Blocks Id System
/dev/sdb1 1 491520 245760 b W95 FAT32
/dev/sdb2 * 491521 492520 500 4d QNX4.x
/dev/sdb3 492521 498520 3000 46 Unknown
/dev/sdb4 498521 7733247 3617363+ 5 Extended
/dev/sdb5 524288 548863 12288 59 Unknown
/dev/sdb6 655360 921599 133120 4c Unknown
/dev/sdb7 1048576 1049575 500 5a Unknown
/dev/sdb8 1179648 1185791 3072 58 Unknown
/dev/sdb9 1310720 1324719 7000 50 OnTrack DM
/dev/sdb10 1441792 1447935 3072 4a Unknown
/dev/sdb11 1572864 1579007 3072 4b Unknown
/dev/sdb12 1703936 2154495 225280 83 Linux
/dev/sdb13 2228224 3457023 614400 83 Linux
/dev/sdb14 3538944 7733247 2097152 69 Unknown
#############################################
sdb1: This is the FAT32 partition that gets mounted when we boot into pink screen;
It holds, among other files, EMMCBOOT.MBN, which, if not present and as far as I've experimented, will get the phone straight into a blue screen and initiate a flash procedure if a 'dload' folder with a ROM is found in the sdcard. The contens of this partition are changed when a ROM is flashed.
sdb2: Is flagged as bootable, and holds an (so far) unknown filesystem (if any; could hold a raw binary image, for instance);
sdb3: Holds an unknown filesystem, if any. This partition is changed whenever you flash a ROM. dumping this partition back, from any 2.3BETA, to a 2.3 (B522) running phone, will get the USB pink screen mode working again, allowing acces to sdb1.
sdb5: holds an unknown filesystem if any; dumping this one back gets us the original "IDEOS" logo and, probably, whatever is needed to make previous CWM backups work again.
sdb6: ext3 filesystem with a directory called "recovery".
sdb7: Unknown filessytem, if any.
sdb8: Unknown filesystem, if any.
sdb9: Unknown filesystem, if any.
sdb10: Unknown filesystem, if any.
sdb11: Unknown filesystem, if any.
sdb12: ext3 filesystem; gets mounted at "/system".
sdb13: ext3 filesystem; gets mounted at "/data".
sdb14: vfat filesystem; represents the internal sdcard.
I'm trying to find out what needs to be restored in order to perform a clean, reliable downgrade. sdb5 is a must, but not the only one. I've flashed 2.2 and dumped it back right after. The result is an almost downgraded U8800. I say almost because charging the battery while the phone is off shows a different image (the one that comes with 2.3) and I can't power up the phone unless I take the cable out; this means there are still remnants of 2.3 somewhere...
UPDATE: Not being able to power up the phone was to due to the CWM recovery; restoring original recovery.img solved that one.
Not so long ago I started experiencing severe freezes and lockups on my I9300. The symptoms were well known as pre-SDS lockups. Before SDS workarounds have been released such symptoms would mean a death sentence for the device. While this is not the case any more the freezes still make the phone virtually unusable.
So far the only way to bring the phone back to usability was a full wipe of the device combined with filling the partitions with some data in order to ensure that every sector has been written to. Some have also succeeded to get rid of such behaviour after flashing stock firmware (after having been running AOSP).
Some technical background
The reason for the freezes (at least on my device) were block read errors. This is roughly equivalent to a situation where you HDD starts having bad sectors, however flash memory is a bit different to a magnetic disk drive. The read errors encountered most likely due to data corruption resulting in CRC errors during read. In my case the dmesg (kernel log) showed the following errors:
Code:
[ 5896.313473] c0 mmc0: it occurs a critical error on eMMC it'll try to recover eMMC to normal state
[ 5896.482283] c0 mif: set_hsic_lpa_states: 304: called(exynos4_check_usb_op+0x84/0x100):
[ 5896.482469] c0 mif: set hsic lpa enter: active state (0), pda active (0)
[ 5896.665712] c0 mmc0: Fixing MoviNAND SDS bug.
[ 5896.708336] c0 mmc0: Verifying SDS patch.
[ 5896.794283] c0 mmc0: recovering eMMC has been done
[ 5896.794412] c0 brq->sbc.opcode=23,brq->cmd.opcode=18.
[ 5896.794539] c0 brq->sbc.error=-131,brq->cmd.error=0, brq->stop.error=0,brq->data.error=0.
[ 5896.794789] c0 mmcblk0: unknown error -131 sending read/write command, card status 0x900
[ 5896.795869] c0 end_request: I/O error, dev mmcblk0, sector 21590248
[ 5896.796034] c0 end_request: I/O error, dev mmcblk0, sector 21590256
[ 5896.796182] c0 end_request: I/O error, dev mmcblk0, sector 21590264
[ 5896.796379] c0 CMD aborting case in MMC's block layer ret 0.
[ 5896.796512] c0 mmcblk0: CMD18, ARG=0x14970e8.
[ 5896.796613] c0 packed CMD type = 0.
[ 5896.796700] c0 mmc0, request returns 4.
Instead of doing a full wipe of the device's internal flash memory partitions I've tried out another method. I was looking for a program that would rewrite all the data without actually wiping it. Such operation would cause the data to be written again and additionally the wear levelling algorithm inside the eMMC controller would have the chance to relocate the data to another physical block on the flash memory chip.
It turned out that the program I was looking for is already there - just not fully thought of being the right one to use in such case.
When bad blocks encounter on a HDD on your PC you normally need to scan the whole media and mark all the bad blocks found on the filesystem so that they can no longer be allocated for file storage. On Linux this task is performed by the e2fsck system utility which uses another utility called badblocks to do the scan and report the unusable blocks. It is the latter that is interesting.
Among several options found in the badblocks utility there are three methods for discovering such broken blocks:
- read-only where the program will attempt to read all blocks one-by-one.
- non-destructive read-write in which case the program will for each block: read it, fill it with a pattern and write back the original content.
- destructive write where all blocks will be filled by pattern(s) destroying any existing content.
The two last modes are interesting for the purpose of rewriting your device's memory partitions to get rid of bad blocks.
The non-destructive read-write mode can be used to attempt to recover without wiping the contents of the partition. This is mostly relevant to the /data partition (and possibly /efs) as all other ones can be easily restored. Note however that when a read error occurs the data in that sector is already lost. When you attempt to recover such partition it will appear to be working again, but some apps may be crashing randomly as some of their data is corrupted. The non-destructive read-write mode can also be used to prevent freezes from happening. All you need is to treat the /data partition this way once a while (not too often - every 6 months without a factory reset).
The destructive write mode can be used in case you don't care for the data. This is equivalent to the methods used so far (wiping the partition and filling it with random junk). This mode can also be used to securely* wipe your phone before selling it or giving it away.
* Due to wear levelling this is actually not a secure wipe as some of the data will still persist on the Flash memory chip. However it is secure from a user point of view as the data is no longer visible and recovering it will most likely require advanced and expensive procedures.
Fix and prevent
Rewriting your flash partition data will fix freezes due to bad blocks. However when freezes start to happen this usually means that some data is already unreadable and therefore - lost. In order to refresh the data the non-destructive write test in badblocks can be used periodically to rewrite the data. This will result in a small speedup of your phone.
Important: You must be careful not to rewrite your partition too often as each flash memory block has a limited number of erase cycles (around 100,000 for SLC and 10,000 for MLC chips). Doing this too often will actually damage your chip in the long term making your phone unusable. I believe that rewriting your /data partition every 6 months without a factory reset should prevent any issues. You do not need to do this if you periodically factory-reset your phone as in such case the data is rewritten anyway.
Step-by-step instructions
DISCLAIMER: This may be a dangerous operation if not executed properly. I do not accept any responsibility for damage that it may cause. Please do this on your own risk.
Prerequisites
Before you begin there are some requirements that need to be fulfilled:
A recent backup of your phone. Remember - there are three kinds of people in this world - those who make backups, those who have not yet lost their data and those morons who still refuse to make backups despite loosing data.
SDS-proof recovery. This is true for all recent recoveries these days, but better make sure. The recovery must also allow ADB connections. While this is true for all recoveries, some have problems with it. In my case I couldn't connect to CWM 6.0.4.4 as ADB kept complaining that the connection is unauthorized. Flashing latest Philz Touch (6.00.8 in my case) solved the problem.
ADB installed on your PC. Please search forum or internet to find instructions.
badblocks binary for Android recovery. Since this utility is not included in the recovery by default you need to obtain it elsewhere. The one I've built is attached to this post.
Instructions
These assume we're working on the /data partition. For other partitions please check their corresponding device node and modify the instructions accordingly.
Reboot to recovery.
Do a nandroid backup if not done before.
Connect to your phone using the USB cable.
Run adb push badblocks sbin/badblocks. In case you have just downloaded the attached ZIP file unzip it first to extract the badblocks binary.
Run adb shell to enter a shell on your phone.
Run chmod 0755 sbin/badblocks to make the badblocks binary executable.
Make sure your /data is not mounted. The quick way is to run mount. It will list all mounted filesystems. If /data on /dev/block/mmcblk0p12 is among them you'll need to unmount it by running: umount /data. If it complains about the filesystem being busy you'll need to reboot the phone and enter recovery again. After that repeat all the steps.
Once you are sure that /data is not mounted run: badblocks -b 4096 -n -t 0xFF -s /dev/block/mmcblk0p12. This command is where the main magic happens. What it does is it reads every sector, fills it with 0xFF bytes and then writes back the original data. This way the data is unchanged, but every block gets rewritten. After running badblocks you should see some percentage indicator about the progress. The operation on /data should take around an hour. Observe any errors that may occur. In my case there were none, but if the flash is heavily worn out there may be some unrecoverable sectors.
In case there are no errors everything should be done. Optionally you may want to trim the /data filesystem as all blocks have been rewritten and the eMMC conroller will think that there are no unused blocks on the device. You can do this by mounting the /data filesystem (mount /data) and running fstrim (fstrim -v /data).
You're good to go. Type exit in the ADB shell and reboot your phone into the system.
In case you do not care for the data on the partition you may run badblocks in destructive mode. In such case in step 7 replace "-n" with "-w" in badblocks command line: badblocks -b 4096 -w -t 0xFF -s /dev/block/mmcblk0p12
The same procedure can be repeated for other filesystems (/system, /cache). I would not recommend doing this on the partitions containing the kernel, recovery, efs or bootloader unless you're asking for trouble.
Reserved for future use.
This should seriously be stickied. Works better than using the dummy file generator that everyone recommends.
Actually, if you're getting SDS freeze on patched firmware with V2 fix (XXEMB2+) it is SDS fix recovering bad block. It's even stated in your kernel message.
This method is good if you want to get rid of misc freezes and fix all blocks at once. Because badblocks forces kernel to rewrite all blocks instead of only one/affected block (during normal freeze).
May be useful, but it's not a magic trick. If somebody gets freezes and kernel can't fix it itself then magic badblocks binary won't help him, unfortunately.
I wonder if you could use e2fsck to mark some permanently broken blocks as bad blocks on the filesystem so that they won't be used for filesystem data. A similar thing used to be done on HDDs. The problem that I see here is that the FTL may relocate that block somewhere and it may end up being reused somewhere else and keep doing damage.
I'm really curious how does the eMMC controller on the I9300 handle permanently broken blocks. Does it have some reservoir of usable blocks (like in modern SSD disks) that can be used as a replacement?
KrissN said:
I wonder if you could use e2fsck to mark some permanently broken blocks as bad blocks on the filesystem so that they won't be used for filesystem data. A similar thing used to be done on HDDs. The problem that I see here is that the FTL may relocate that block somewhere and it may end up being reused somewhere else and keep doing damage.
I'm really curious how does the eMMC controller on the I9300 handle permanently broken blocks. Does it have some reservoir of usable blocks (like in modern SSD disks) that can be used as a replacement?
Click to expand...
Click to collapse
This is actually a very good question, I'm wondering as well. If you're clever enough then you may download my latest ArchiDroid 2.X Experimental ROM with built-in debian and try to discover that with native linux gnu utilities.
JustArchi said:
This is actually a very good question, I'm wondering as well. If you're clever enough then you may download my latest ArchiDroid 2.X Experimental ROM with built-in debian and try to discover that with native linux gnu utilities.
Click to expand...
Click to collapse
Desctructive mode? Will that be equivalent to a lets say factory reset? ie losing all user made data.
Wow, this really helped. I am using SM-G355H (not really made with exynos but with sc8830 from spreadtrum but still by samsung) and was afraid that the phone has failed for good. Though the partition failing was the /system/ not the /data/, OP's badblocks build and instructions definitely fixed it, like magic.
Additional note: To identify which partition is failing
Take note of the failing sector, in my case it's at 1879872
Code:
mmcblk0: error -110 transferring data, sector [B]1879872[/B], nr 256, cmd response 0x900, card status 0xb00
and find the partition using the output of this command where /dev/block/mmcblk0 is the block device
Code:
sgdisk --print [B]/dev/block/mmcblk0[/B]
It will print something like:
Code:
Logical sector size: 512 bytes
Disk identifier (GUID): 52444E41-494F-2044-4D4D-43204449534B
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 7618526
Partitions will be aligned on 512-sector boundaries
Total free space is 21949 sectors (10.7 MiB)
Number Start (sector) End (sector) Size Code Name
1 8192 15871 3.8 MiB 0700 FIXNV1
2 15872 23551 3.8 MiB 0700 FIXNV2
3 23552 27647 2.0 MiB 0700 SBL1
4 27648 31743 2.0 MiB 0700 SBL2
5 31744 41983 5.0 MiB 0700 WDSP
6 41984 52223 5.0 MiB 0700 WDSP_BACKUP
7 52224 72703 10.0 MiB 0700 MODEM
8 72704 93183 10.0 MiB 0700 MODEM_BACKUP
9 93184 93695 256.0 KiB 0700 FOTA_SIG
10 93696 110079 8.0 MiB 0700 OTA
11 110080 117759 3.8 MiB 0700 RUNTIMENV1
12 117760 125439 3.8 MiB 0700 RUNTIMENV2
13 125440 131071 2.8 MiB 0700 PARAM
14 135680 176639 20.0 MiB 0700 efs
15 176640 186879 5.0 MiB 0700 prodnv
16 186880 187391 256.0 KiB 0700 Odin_reserved
17 187392 218111 15.0 MiB 0700 KERNEL
18 218112 248831 15.0 MiB 0700 RECOVERY
19 248832 494591 120.0 MiB 0700 CSC
20 494592 2829311 1.1 GiB 0700 system
21 2829312 2890751 30.0 MiB 0700 HIDDEN
22 2890752 7609343 2.3 GiB 0700 userdata
Find the partition whose start and end sectors contain that failing sector. In my case it's the system since
1879872 in within 494592 to 2829311
Code:
20 [B]494592 2829311[/B] 1.1 GiB 0700 system
I am in the process of flashing a custom rom. My phone is an original unlocked Consumer Cellular which had 2.2.1 installed and later on got an OTA update to 2.2.2.
I rooted the Bravo, made a system dump, installed 2nd-init and created a nandroid backup. As a final check I wanted to look at the partition table and that's when things got interesting. I tried parted but parted terminated with an error message about a partition "beyond" the device's last sector.
Looked around a bit and found out that fdisk is preinstalled in /system/xbin. So I used fdisk and this is what I found:
fdisk's info about the device:
Code:
Disk /dev/block/mmcblk1: 1958 MB, 1958739968 bytes
16 heads, 16 sectors/track, 14944 cylinders
Units = cylinders of 256 * 512 = 131072 bytes
That sounds about right, it is a 2 GByte flash rom. The problem is partition p4 (the "extended" partition) and partition p25 (aka "userdata"). Partition p4 is listed in the partition table as:
Code:
Device Boot Start End Blocks Id System
/dev/block/mmcblk1p4 13 122496 15677952 5 Extended
Well, "start" and "end" are cylinders, so the "end" being 122496 is waaaay beyond 14944! Partition p25 also seems to be messed up the same way:
Code:
Device Boot Start End Blocks Id System
/dev/block/mmcblk1p25 4633 122496 15086592 83 Linux
However, a "cat /proc/partitions" shows this:
Code:
cat /proc/partitions
major minor #blocks name alias
179 32 1912832 mmcblk1
179 33 128 mmcblk1p1
179 34 512 mmcblk1p2
179 35 512 mmcblk1p3
179 36 1 mmcblk1p4
179 37 512 mmcblk1p5
179 38 512 mmcblk1p6
179 39 4096 mmcblk1p7 pds
179 40 512 mmcblk1p8
179 41 512 mmcblk1p9
179 42 1024 mmcblk1p10
179 43 2048 mmcblk1p11
179 44 512 mmcblk1p12
179 45 512 mmcblk1p13
179 46 4096 mmcblk1p14
179 47 8192 mmcblk1p15 boot
179 48 8192 mmcblk1p16 recovery
179 49 14336 mmcblk1p17 cdrom
179 50 512 mmcblk1p18 misc
179 51 512 mmcblk1p19 cid
179 52 4096 mmcblk1p20 kpanic
179 53 334848 mmcblk1p21 system
179 54 512 mmcblk1p22 prek
179 55 512 mmcblk1p23 pkbackup
179 56 204800 mmcblk1p24 cache
179 57 1319936 mmcblk1p25 userdata
179 0 1931264 mmcblk0
179 1 1930240 mmcblk0p1
So besides the partition data which I seem to not understand the size of userdata seems to be 1319936 blocks which is ~1.3 GByte.
This leads to my 2 questions:
Is there a problem here or do I simply misunderstand fdisk's partition list (parted says that is something wrong though!)?
Do I have to try to "fix" this before installing a custom rom (planning on trying cm-10.2-20131030-NIGHTLY-mb520.zip)?
Thanks,
Markus
Ok ... I'm answering my own question here, just in case someone else is interested in the solution:
General Information:
Historically (pc compatible) partitions used to be aligned on cylinder boundaries. Nowadays partitions are usually aligned on a sector number which is a multiple of 2048. For standard 512 sectors this evaluates to a 1 MByte boundary - which is also compatible with drives with a larger sector size (4096 bytes for drives > 2 TByte).
Logical volumes within the extended partition do not use the first head of the first cylinder (or the first 2048 sectors) because the area holds the volume's EBR - which is only a 512 byte record, similar to a MBR.
Implementation in the Motorola Bravo:
The Linux kernel reports 16 heads per cylinder and 16 tracks per head, resulting in 128 kByte per cylinder.
Partitions are aligned to this "virtual" disk geometry.
Digging through the list of EBRs (using dd and hexdump) I found that the partitioning utility used by Motorola creates volumes in the extended partition in a different (but still compatible) way: instead of wasting the first "track" (for the volume's EBR) in each volume, it consolidates all the EBRs in the disk space wasted by the partition entry for the extended partition itself (which usually is 1 cylinder or 2048 sectors).
Motorola actually allocated 512 kByte (1024 sectors) for the extended partition itself, giving the system the theoretical limit of 1024 volumes.
The question still unanswered though is: why does the extended partition (and the last volume in that partition) extend way beyond the end of mmcblk1?
Findings:
I searched around and I discovered that the tool Motorola used to create the partition table was most likely something like nand-part (part of the sunxi tools, please look it up on Wikipedia, I am not allowed yet to post links outside this forum).
This tool creates the EBRs for logical volumes in the same way as they appear in the Bravo's partitions. And most important, this tools also allows to create partitions which extend beyond the end of the device!
Ok ... on with the story: whenever a file system utility like mkfs wants to format a partition, it asks the kernel for information about that partition. The kernel is smart enough to correct partition definitions which extend beyond the end of device in order to avoid a failure or crash of the file system formatting utility. This "correction" is not permanent (partition table stays as it is) but done on the fly.
Conclusions:
nand-part's lack of parameter checking together with the kernel's smartness about partitions exceeding the device made it possible for Motorola to create one common partition layout for devices with different flash capacities: the setup used in the Bravo would be sufficient for flash up to 8 GByte without even changing the partition tables. The last partition (userdata) would simply benefit from a higher flash capacity.
Having answered that question, I still wanted to know what happenes when I try to correct that error (I know, I just asked for trouble). So I went ahead and as a first step I corrected the size in userdata's (mmcblk1p25) EBR to the correct value (using dd and a hex editor). After the correction everything looked fine. The definition of mmcblk1p25 now matched the actual size. I rebooted the phone and ... boom! The bootloader obviously was extremely unhappy and I was forced to do my first "sbf" - which I managed to do and meanwhile my Bravo is happily running CM10.2.
Dear Moderator:
If this post is of any use for the "Dev" section, please move it over there. I do not have the permission (yet) to post in the dev section.
Happy hacking,
Markus