xref: /openbmc/linux/drivers/mtd/nand/raw/nand_bbt.c (revision f59a3ee6)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  *  Overview:
4  *   Bad block table support for the NAND driver
5  *
6  *  Copyright © 2004 Thomas Gleixner (tglx@linutronix.de)
7  *
8  * Description:
9  *
10  * When nand_scan_bbt is called, then it tries to find the bad block table
11  * depending on the options in the BBT descriptor(s). If no flash based BBT
12  * (NAND_BBT_USE_FLASH) is specified then the device is scanned for factory
13  * marked good / bad blocks. This information is used to create a memory BBT.
14  * Once a new bad block is discovered then the "factory" information is updated
15  * on the device.
16  * If a flash based BBT is specified then the function first tries to find the
17  * BBT on flash. If a BBT is found then the contents are read and the memory
18  * based BBT is created. If a mirrored BBT is selected then the mirror is
19  * searched too and the versions are compared. If the mirror has a greater
20  * version number, then the mirror BBT is used to build the memory based BBT.
21  * If the tables are not versioned, then we "or" the bad block information.
22  * If one of the BBTs is out of date or does not exist it is (re)created.
23  * If no BBT exists at all then the device is scanned for factory marked
24  * good / bad blocks and the bad block tables are created.
25  *
26  * For manufacturer created BBTs like the one found on M-SYS DOC devices
27  * the BBT is searched and read but never created
28  *
29  * The auto generated bad block table is located in the last good blocks
30  * of the device. The table is mirrored, so it can be updated eventually.
31  * The table is marked in the OOB area with an ident pattern and a version
32  * number which indicates which of both tables is more up to date. If the NAND
33  * controller needs the complete OOB area for the ECC information then the
34  * option NAND_BBT_NO_OOB should be used (along with NAND_BBT_USE_FLASH, of
35  * course): it moves the ident pattern and the version byte into the data area
36  * and the OOB area will remain untouched.
37  *
38  * The table uses 2 bits per block
39  * 11b:		block is good
40  * 00b:		block is factory marked bad
41  * 01b, 10b:	block is marked bad due to wear
42  *
43  * The memory bad block table uses the following scheme:
44  * 00b:		block is good
45  * 01b:		block is marked bad due to wear
46  * 10b:		block is reserved (to protect the bbt area)
47  * 11b:		block is factory marked bad
48  *
49  * Multichip devices like DOC store the bad block info per floor.
50  *
51  * Following assumptions are made:
52  * - bbts start at a page boundary, if autolocated on a block boundary
53  * - the space necessary for a bbt in FLASH does not exceed a block boundary
54  */
55 
56 #include <linux/slab.h>
57 #include <linux/types.h>
58 #include <linux/mtd/mtd.h>
59 #include <linux/mtd/bbm.h>
60 #include <linux/bitops.h>
61 #include <linux/delay.h>
62 #include <linux/vmalloc.h>
63 #include <linux/export.h>
64 #include <linux/string.h>
65 
66 #include "internals.h"
67 
68 #define BBT_BLOCK_GOOD		0x00
69 #define BBT_BLOCK_WORN		0x01
70 #define BBT_BLOCK_RESERVED	0x02
71 #define BBT_BLOCK_FACTORY_BAD	0x03
72 
73 #define BBT_ENTRY_MASK		0x03
74 #define BBT_ENTRY_SHIFT		2
75 
76 static inline uint8_t bbt_get_entry(struct nand_chip *chip, int block)
77 {
78 	uint8_t entry = chip->bbt[block >> BBT_ENTRY_SHIFT];
79 	entry >>= (block & BBT_ENTRY_MASK) * 2;
80 	return entry & BBT_ENTRY_MASK;
81 }
82 
83 static inline void bbt_mark_entry(struct nand_chip *chip, int block,
84 		uint8_t mark)
85 {
86 	uint8_t msk = (mark & BBT_ENTRY_MASK) << ((block & BBT_ENTRY_MASK) * 2);
87 	chip->bbt[block >> BBT_ENTRY_SHIFT] |= msk;
88 }
89 
90 static int check_pattern_no_oob(uint8_t *buf, struct nand_bbt_descr *td)
91 {
92 	if (memcmp(buf, td->pattern, td->len))
93 		return -1;
94 	return 0;
95 }
96 
97 /**
98  * check_pattern - [GENERIC] check if a pattern is in the buffer
99  * @buf: the buffer to search
100  * @len: the length of buffer to search
101  * @paglen: the pagelength
102  * @td: search pattern descriptor
103  *
104  * Check for a pattern at the given place. Used to search bad block tables and
105  * good / bad block identifiers.
106  */
107 static int check_pattern(uint8_t *buf, int len, int paglen, struct nand_bbt_descr *td)
108 {
109 	if (td->options & NAND_BBT_NO_OOB)
110 		return check_pattern_no_oob(buf, td);
111 
112 	/* Compare the pattern */
113 	if (memcmp(buf + paglen + td->offs, td->pattern, td->len))
114 		return -1;
115 
116 	return 0;
117 }
118 
119 /**
120  * check_short_pattern - [GENERIC] check if a pattern is in the buffer
121  * @buf: the buffer to search
122  * @td:	search pattern descriptor
123  *
124  * Check for a pattern at the given place. Used to search bad block tables and
125  * good / bad block identifiers. Same as check_pattern, but no optional empty
126  * check.
127  */
128 static int check_short_pattern(uint8_t *buf, struct nand_bbt_descr *td)
129 {
130 	/* Compare the pattern */
131 	if (memcmp(buf + td->offs, td->pattern, td->len))
132 		return -1;
133 	return 0;
134 }
135 
136 /**
137  * add_marker_len - compute the length of the marker in data area
138  * @td: BBT descriptor used for computation
139  *
140  * The length will be 0 if the marker is located in OOB area.
141  */
142 static u32 add_marker_len(struct nand_bbt_descr *td)
143 {
144 	u32 len;
145 
146 	if (!(td->options & NAND_BBT_NO_OOB))
147 		return 0;
148 
149 	len = td->len;
150 	if (td->options & NAND_BBT_VERSION)
151 		len++;
152 	return len;
153 }
154 
155 /**
156  * read_bbt - [GENERIC] Read the bad block table starting from page
157  * @this: NAND chip object
158  * @buf: temporary buffer
159  * @page: the starting page
160  * @num: the number of bbt descriptors to read
161  * @td: the bbt describtion table
162  * @offs: block number offset in the table
163  *
164  * Read the bad block table starting from page.
165  */
166 static int read_bbt(struct nand_chip *this, uint8_t *buf, int page, int num,
167 		    struct nand_bbt_descr *td, int offs)
168 {
169 	struct mtd_info *mtd = nand_to_mtd(this);
170 	int res, ret = 0, i, j, act = 0;
171 	size_t retlen, len, totlen;
172 	loff_t from;
173 	int bits = td->options & NAND_BBT_NRBITS_MSK;
174 	uint8_t msk = (uint8_t)((1 << bits) - 1);
175 	u32 marker_len;
176 	int reserved_block_code = td->reserved_block_code;
177 
178 	totlen = (num * bits) >> 3;
179 	marker_len = add_marker_len(td);
180 	from = ((loff_t)page) << this->page_shift;
181 
182 	while (totlen) {
183 		len = min(totlen, (size_t)(1 << this->bbt_erase_shift));
184 		if (marker_len) {
185 			/*
186 			 * In case the BBT marker is not in the OOB area it
187 			 * will be just in the first page.
188 			 */
189 			len -= marker_len;
190 			from += marker_len;
191 			marker_len = 0;
192 		}
193 		res = mtd_read(mtd, from, len, &retlen, buf);
194 		if (res < 0) {
195 			if (mtd_is_eccerr(res)) {
196 				pr_info("nand_bbt: ECC error in BBT at 0x%012llx\n",
197 					from & ~mtd->writesize);
198 				return res;
199 			} else if (mtd_is_bitflip(res)) {
200 				pr_info("nand_bbt: corrected error in BBT at 0x%012llx\n",
201 					from & ~mtd->writesize);
202 				ret = res;
203 			} else {
204 				pr_info("nand_bbt: error reading BBT\n");
205 				return res;
206 			}
207 		}
208 
209 		/* Analyse data */
210 		for (i = 0; i < len; i++) {
211 			uint8_t dat = buf[i];
212 			for (j = 0; j < 8; j += bits, act++) {
213 				uint8_t tmp = (dat >> j) & msk;
214 				if (tmp == msk)
215 					continue;
216 				if (reserved_block_code && (tmp == reserved_block_code)) {
217 					pr_info("nand_read_bbt: reserved block at 0x%012llx\n",
218 						 (loff_t)(offs + act) <<
219 						 this->bbt_erase_shift);
220 					bbt_mark_entry(this, offs + act,
221 							BBT_BLOCK_RESERVED);
222 					mtd->ecc_stats.bbtblocks++;
223 					continue;
224 				}
225 				/*
226 				 * Leave it for now, if it's matured we can
227 				 * move this message to pr_debug.
228 				 */
229 				pr_info("nand_read_bbt: bad block at 0x%012llx\n",
230 					 (loff_t)(offs + act) <<
231 					 this->bbt_erase_shift);
232 				/* Factory marked bad or worn out? */
233 				if (tmp == 0)
234 					bbt_mark_entry(this, offs + act,
235 							BBT_BLOCK_FACTORY_BAD);
236 				else
237 					bbt_mark_entry(this, offs + act,
238 							BBT_BLOCK_WORN);
239 				mtd->ecc_stats.badblocks++;
240 			}
241 		}
242 		totlen -= len;
243 		from += len;
244 	}
245 	return ret;
246 }
247 
248 /**
249  * read_abs_bbt - [GENERIC] Read the bad block table starting at a given page
250  * @this: NAND chip object
251  * @buf: temporary buffer
252  * @td: descriptor for the bad block table
253  * @chip: read the table for a specific chip, -1 read all chips; applies only if
254  *        NAND_BBT_PERCHIP option is set
255  *
256  * Read the bad block table for all chips starting at a given page. We assume
257  * that the bbt bits are in consecutive order.
258  */
259 static int read_abs_bbt(struct nand_chip *this, uint8_t *buf,
260 			struct nand_bbt_descr *td, int chip)
261 {
262 	struct mtd_info *mtd = nand_to_mtd(this);
263 	u64 targetsize = nanddev_target_size(&this->base);
264 	int res = 0, i;
265 
266 	if (td->options & NAND_BBT_PERCHIP) {
267 		int offs = 0;
268 		for (i = 0; i < nanddev_ntargets(&this->base); i++) {
269 			if (chip == -1 || chip == i)
270 				res = read_bbt(this, buf, td->pages[i],
271 					targetsize >> this->bbt_erase_shift,
272 					td, offs);
273 			if (res)
274 				return res;
275 			offs += targetsize >> this->bbt_erase_shift;
276 		}
277 	} else {
278 		res = read_bbt(this, buf, td->pages[0],
279 				mtd->size >> this->bbt_erase_shift, td, 0);
280 		if (res)
281 			return res;
282 	}
283 	return 0;
284 }
285 
286 /* BBT marker is in the first page, no OOB */
287 static int scan_read_data(struct nand_chip *this, uint8_t *buf, loff_t offs,
288 			  struct nand_bbt_descr *td)
289 {
290 	struct mtd_info *mtd = nand_to_mtd(this);
291 	size_t retlen;
292 	size_t len;
293 
294 	len = td->len;
295 	if (td->options & NAND_BBT_VERSION)
296 		len++;
297 
298 	return mtd_read(mtd, offs, len, &retlen, buf);
299 }
300 
301 /**
302  * scan_read_oob - [GENERIC] Scan data+OOB region to buffer
303  * @this: NAND chip object
304  * @buf: temporary buffer
305  * @offs: offset at which to scan
306  * @len: length of data region to read
307  *
308  * Scan read data from data+OOB. May traverse multiple pages, interleaving
309  * page,OOB,page,OOB,... in buf. Completes transfer and returns the "strongest"
310  * ECC condition (error or bitflip). May quit on the first (non-ECC) error.
311  */
312 static int scan_read_oob(struct nand_chip *this, uint8_t *buf, loff_t offs,
313 			 size_t len)
314 {
315 	struct mtd_info *mtd = nand_to_mtd(this);
316 	struct mtd_oob_ops ops = { };
317 	int res, ret = 0;
318 
319 	ops.mode = MTD_OPS_PLACE_OOB;
320 	ops.ooboffs = 0;
321 	ops.ooblen = mtd->oobsize;
322 
323 	while (len > 0) {
324 		ops.datbuf = buf;
325 		ops.len = min(len, (size_t)mtd->writesize);
326 		ops.oobbuf = buf + ops.len;
327 
328 		res = mtd_read_oob(mtd, offs, &ops);
329 		if (res) {
330 			if (!mtd_is_bitflip_or_eccerr(res))
331 				return res;
332 			else if (mtd_is_eccerr(res) || !ret)
333 				ret = res;
334 		}
335 
336 		buf += mtd->oobsize + mtd->writesize;
337 		len -= mtd->writesize;
338 		offs += mtd->writesize;
339 	}
340 	return ret;
341 }
342 
343 static int scan_read(struct nand_chip *this, uint8_t *buf, loff_t offs,
344 		     size_t len, struct nand_bbt_descr *td)
345 {
346 	if (td->options & NAND_BBT_NO_OOB)
347 		return scan_read_data(this, buf, offs, td);
348 	else
349 		return scan_read_oob(this, buf, offs, len);
350 }
351 
352 /* Scan write data with oob to flash */
353 static int scan_write_bbt(struct nand_chip *this, loff_t offs, size_t len,
354 			  uint8_t *buf, uint8_t *oob)
355 {
356 	struct mtd_info *mtd = nand_to_mtd(this);
357 	struct mtd_oob_ops ops = { };
358 
359 	ops.mode = MTD_OPS_PLACE_OOB;
360 	ops.ooboffs = 0;
361 	ops.ooblen = mtd->oobsize;
362 	ops.datbuf = buf;
363 	ops.oobbuf = oob;
364 	ops.len = len;
365 
366 	return mtd_write_oob(mtd, offs, &ops);
367 }
368 
369 static u32 bbt_get_ver_offs(struct nand_chip *this, struct nand_bbt_descr *td)
370 {
371 	struct mtd_info *mtd = nand_to_mtd(this);
372 	u32 ver_offs = td->veroffs;
373 
374 	if (!(td->options & NAND_BBT_NO_OOB))
375 		ver_offs += mtd->writesize;
376 	return ver_offs;
377 }
378 
379 /**
380  * read_abs_bbts - [GENERIC] Read the bad block table(s) for all chips starting at a given page
381  * @this: NAND chip object
382  * @buf: temporary buffer
383  * @td: descriptor for the bad block table
384  * @md:	descriptor for the bad block table mirror
385  *
386  * Read the bad block table(s) for all chips starting at a given page. We
387  * assume that the bbt bits are in consecutive order.
388  */
389 static void read_abs_bbts(struct nand_chip *this, uint8_t *buf,
390 			  struct nand_bbt_descr *td, struct nand_bbt_descr *md)
391 {
392 	struct mtd_info *mtd = nand_to_mtd(this);
393 
394 	/* Read the primary version, if available */
395 	if (td->options & NAND_BBT_VERSION) {
396 		scan_read(this, buf, (loff_t)td->pages[0] << this->page_shift,
397 			  mtd->writesize, td);
398 		td->version[0] = buf[bbt_get_ver_offs(this, td)];
399 		pr_info("Bad block table at page %d, version 0x%02X\n",
400 			 td->pages[0], td->version[0]);
401 	}
402 
403 	/* Read the mirror version, if available */
404 	if (md && (md->options & NAND_BBT_VERSION)) {
405 		scan_read(this, buf, (loff_t)md->pages[0] << this->page_shift,
406 			  mtd->writesize, md);
407 		md->version[0] = buf[bbt_get_ver_offs(this, md)];
408 		pr_info("Bad block table at page %d, version 0x%02X\n",
409 			 md->pages[0], md->version[0]);
410 	}
411 }
412 
413 /* Scan a given block partially */
414 static int scan_block_fast(struct nand_chip *this, struct nand_bbt_descr *bd,
415 			   loff_t offs, uint8_t *buf)
416 {
417 	struct mtd_info *mtd = nand_to_mtd(this);
418 
419 	struct mtd_oob_ops ops = { };
420 	int ret, page_offset;
421 
422 	ops.ooblen = mtd->oobsize;
423 	ops.oobbuf = buf;
424 	ops.ooboffs = 0;
425 	ops.datbuf = NULL;
426 	ops.mode = MTD_OPS_PLACE_OOB;
427 
428 	page_offset = nand_bbm_get_next_page(this, 0);
429 
430 	while (page_offset >= 0) {
431 		/*
432 		 * Read the full oob until read_oob is fixed to handle single
433 		 * byte reads for 16 bit buswidth.
434 		 */
435 		ret = mtd_read_oob(mtd, offs + (page_offset * mtd->writesize),
436 				   &ops);
437 		/* Ignore ECC errors when checking for BBM */
438 		if (ret && !mtd_is_bitflip_or_eccerr(ret))
439 			return ret;
440 
441 		if (check_short_pattern(buf, bd))
442 			return 1;
443 
444 		page_offset = nand_bbm_get_next_page(this, page_offset + 1);
445 	}
446 
447 	return 0;
448 }
449 
450 /* Check if a potential BBT block is marked as bad */
451 static int bbt_block_checkbad(struct nand_chip *this, struct nand_bbt_descr *td,
452 			      loff_t offs, uint8_t *buf)
453 {
454 	struct nand_bbt_descr *bd = this->badblock_pattern;
455 
456 	/*
457 	 * No need to check for a bad BBT block if the BBM area overlaps with
458 	 * the bad block table marker area in OOB since writing a BBM here
459 	 * invalidates the bad block table marker anyway.
460 	 */
461 	if (!(td->options & NAND_BBT_NO_OOB) &&
462 	    td->offs >= bd->offs && td->offs < bd->offs + bd->len)
463 		return 0;
464 
465 	/*
466 	 * There is no point in checking for a bad block marker if writing
467 	 * such marker is not supported
468 	 */
469 	if (this->bbt_options & NAND_BBT_NO_OOB_BBM ||
470 	    this->options & NAND_NO_BBM_QUIRK)
471 		return 0;
472 
473 	if (scan_block_fast(this, bd, offs, buf) > 0)
474 		return 1;
475 
476 	return 0;
477 }
478 
479 /**
480  * create_bbt - [GENERIC] Create a bad block table by scanning the device
481  * @this: NAND chip object
482  * @buf: temporary buffer
483  * @bd: descriptor for the good/bad block search pattern
484  * @chip: create the table for a specific chip, -1 read all chips; applies only
485  *        if NAND_BBT_PERCHIP option is set
486  *
487  * Create a bad block table by scanning the device for the given good/bad block
488  * identify pattern.
489  */
490 static int create_bbt(struct nand_chip *this, uint8_t *buf,
491 		      struct nand_bbt_descr *bd, int chip)
492 {
493 	u64 targetsize = nanddev_target_size(&this->base);
494 	struct mtd_info *mtd = nand_to_mtd(this);
495 	int i, numblocks, startblock;
496 	loff_t from;
497 
498 	pr_info("Scanning device for bad blocks\n");
499 
500 	if (chip == -1) {
501 		numblocks = mtd->size >> this->bbt_erase_shift;
502 		startblock = 0;
503 		from = 0;
504 	} else {
505 		if (chip >= nanddev_ntargets(&this->base)) {
506 			pr_warn("create_bbt(): chipnr (%d) > available chips (%d)\n",
507 			        chip + 1, nanddev_ntargets(&this->base));
508 			return -EINVAL;
509 		}
510 		numblocks = targetsize >> this->bbt_erase_shift;
511 		startblock = chip * numblocks;
512 		numblocks += startblock;
513 		from = (loff_t)startblock << this->bbt_erase_shift;
514 	}
515 
516 	for (i = startblock; i < numblocks; i++) {
517 		int ret;
518 
519 		BUG_ON(bd->options & NAND_BBT_NO_OOB);
520 
521 		ret = scan_block_fast(this, bd, from, buf);
522 		if (ret < 0)
523 			return ret;
524 
525 		if (ret) {
526 			bbt_mark_entry(this, i, BBT_BLOCK_FACTORY_BAD);
527 			pr_warn("Bad eraseblock %d at 0x%012llx\n",
528 				i, (unsigned long long)from);
529 			mtd->ecc_stats.badblocks++;
530 		}
531 
532 		from += (1 << this->bbt_erase_shift);
533 	}
534 	return 0;
535 }
536 
537 /**
538  * search_bbt - [GENERIC] scan the device for a specific bad block table
539  * @this: NAND chip object
540  * @buf: temporary buffer
541  * @td: descriptor for the bad block table
542  *
543  * Read the bad block table by searching for a given ident pattern. Search is
544  * preformed either from the beginning up or from the end of the device
545  * downwards. The search starts always at the start of a block. If the option
546  * NAND_BBT_PERCHIP is given, each chip is searched for a bbt, which contains
547  * the bad block information of this chip. This is necessary to provide support
548  * for certain DOC devices.
549  *
550  * The bbt ident pattern resides in the oob area of the first page in a block.
551  */
552 static int search_bbt(struct nand_chip *this, uint8_t *buf,
553 		      struct nand_bbt_descr *td)
554 {
555 	u64 targetsize = nanddev_target_size(&this->base);
556 	struct mtd_info *mtd = nand_to_mtd(this);
557 	int i, chips;
558 	int startblock, block, dir;
559 	int scanlen = mtd->writesize + mtd->oobsize;
560 	int bbtblocks;
561 	int blocktopage = this->bbt_erase_shift - this->page_shift;
562 
563 	/* Search direction top -> down? */
564 	if (td->options & NAND_BBT_LASTBLOCK) {
565 		startblock = (mtd->size >> this->bbt_erase_shift) - 1;
566 		dir = -1;
567 	} else {
568 		startblock = 0;
569 		dir = 1;
570 	}
571 
572 	/* Do we have a bbt per chip? */
573 	if (td->options & NAND_BBT_PERCHIP) {
574 		chips = nanddev_ntargets(&this->base);
575 		bbtblocks = targetsize >> this->bbt_erase_shift;
576 		startblock &= bbtblocks - 1;
577 	} else {
578 		chips = 1;
579 		bbtblocks = mtd->size >> this->bbt_erase_shift;
580 	}
581 
582 	for (i = 0; i < chips; i++) {
583 		/* Reset version information */
584 		td->version[i] = 0;
585 		td->pages[i] = -1;
586 		/* Scan the maximum number of blocks */
587 		for (block = 0; block < td->maxblocks; block++) {
588 
589 			int actblock = startblock + dir * block;
590 			loff_t offs = (loff_t)actblock << this->bbt_erase_shift;
591 
592 			/* Check if block is marked bad */
593 			if (bbt_block_checkbad(this, td, offs, buf))
594 				continue;
595 
596 			/* Read first page */
597 			scan_read(this, buf, offs, mtd->writesize, td);
598 			if (!check_pattern(buf, scanlen, mtd->writesize, td)) {
599 				td->pages[i] = actblock << blocktopage;
600 				if (td->options & NAND_BBT_VERSION) {
601 					offs = bbt_get_ver_offs(this, td);
602 					td->version[i] = buf[offs];
603 				}
604 				break;
605 			}
606 		}
607 		startblock += targetsize >> this->bbt_erase_shift;
608 	}
609 	/* Check, if we found a bbt for each requested chip */
610 	for (i = 0; i < chips; i++) {
611 		if (td->pages[i] == -1)
612 			pr_warn("Bad block table not found for chip %d\n", i);
613 		else
614 			pr_info("Bad block table found at page %d, version 0x%02X\n",
615 				td->pages[i], td->version[i]);
616 	}
617 	return 0;
618 }
619 
620 /**
621  * search_read_bbts - [GENERIC] scan the device for bad block table(s)
622  * @this: NAND chip object
623  * @buf: temporary buffer
624  * @td: descriptor for the bad block table
625  * @md: descriptor for the bad block table mirror
626  *
627  * Search and read the bad block table(s).
628  */
629 static void search_read_bbts(struct nand_chip *this, uint8_t *buf,
630 			     struct nand_bbt_descr *td,
631 			     struct nand_bbt_descr *md)
632 {
633 	/* Search the primary table */
634 	search_bbt(this, buf, td);
635 
636 	/* Search the mirror table */
637 	if (md)
638 		search_bbt(this, buf, md);
639 }
640 
641 /**
642  * get_bbt_block - Get the first valid eraseblock suitable to store a BBT
643  * @this: the NAND device
644  * @td: the BBT description
645  * @md: the mirror BBT descriptor
646  * @chip: the CHIP selector
647  *
648  * This functions returns a positive block number pointing a valid eraseblock
649  * suitable to store a BBT (i.e. in the range reserved for BBT), or -ENOSPC if
650  * all blocks are already used of marked bad. If td->pages[chip] was already
651  * pointing to a valid block we re-use it, otherwise we search for the next
652  * valid one.
653  */
654 static int get_bbt_block(struct nand_chip *this, struct nand_bbt_descr *td,
655 			 struct nand_bbt_descr *md, int chip)
656 {
657 	u64 targetsize = nanddev_target_size(&this->base);
658 	int startblock, dir, page, numblocks, i;
659 
660 	/*
661 	 * There was already a version of the table, reuse the page. This
662 	 * applies for absolute placement too, as we have the page number in
663 	 * td->pages.
664 	 */
665 	if (td->pages[chip] != -1)
666 		return td->pages[chip] >>
667 				(this->bbt_erase_shift - this->page_shift);
668 
669 	numblocks = (int)(targetsize >> this->bbt_erase_shift);
670 	if (!(td->options & NAND_BBT_PERCHIP))
671 		numblocks *= nanddev_ntargets(&this->base);
672 
673 	/*
674 	 * Automatic placement of the bad block table. Search direction
675 	 * top -> down?
676 	 */
677 	if (td->options & NAND_BBT_LASTBLOCK) {
678 		startblock = numblocks * (chip + 1) - 1;
679 		dir = -1;
680 	} else {
681 		startblock = chip * numblocks;
682 		dir = 1;
683 	}
684 
685 	for (i = 0; i < td->maxblocks; i++) {
686 		int block = startblock + dir * i;
687 
688 		/* Check, if the block is bad */
689 		switch (bbt_get_entry(this, block)) {
690 		case BBT_BLOCK_WORN:
691 		case BBT_BLOCK_FACTORY_BAD:
692 			continue;
693 		}
694 
695 		page = block << (this->bbt_erase_shift - this->page_shift);
696 
697 		/* Check, if the block is used by the mirror table */
698 		if (!md || md->pages[chip] != page)
699 			return block;
700 	}
701 
702 	return -ENOSPC;
703 }
704 
705 /**
706  * mark_bbt_block_bad - Mark one of the block reserved for BBT bad
707  * @this: the NAND device
708  * @td: the BBT description
709  * @chip: the CHIP selector
710  * @block: the BBT block to mark
711  *
712  * Blocks reserved for BBT can become bad. This functions is an helper to mark
713  * such blocks as bad. It takes care of updating the in-memory BBT, marking the
714  * block as bad using a bad block marker and invalidating the associated
715  * td->pages[] entry.
716  */
717 static void mark_bbt_block_bad(struct nand_chip *this,
718 			       struct nand_bbt_descr *td,
719 			       int chip, int block)
720 {
721 	loff_t to;
722 	int res;
723 
724 	bbt_mark_entry(this, block, BBT_BLOCK_WORN);
725 
726 	to = (loff_t)block << this->bbt_erase_shift;
727 	res = nand_markbad_bbm(this, to);
728 	if (res)
729 		pr_warn("nand_bbt: error %d while marking block %d bad\n",
730 			res, block);
731 
732 	td->pages[chip] = -1;
733 }
734 
735 /**
736  * write_bbt - [GENERIC] (Re)write the bad block table
737  * @this: NAND chip object
738  * @buf: temporary buffer
739  * @td: descriptor for the bad block table
740  * @md: descriptor for the bad block table mirror
741  * @chipsel: selector for a specific chip, -1 for all
742  *
743  * (Re)write the bad block table.
744  */
745 static int write_bbt(struct nand_chip *this, uint8_t *buf,
746 		     struct nand_bbt_descr *td, struct nand_bbt_descr *md,
747 		     int chipsel)
748 {
749 	u64 targetsize = nanddev_target_size(&this->base);
750 	struct mtd_info *mtd = nand_to_mtd(this);
751 	struct erase_info einfo;
752 	int i, res, chip = 0;
753 	int bits, page, offs, numblocks, sft, sftmsk;
754 	int nrchips, pageoffs, ooboffs;
755 	uint8_t msk[4];
756 	uint8_t rcode = td->reserved_block_code;
757 	size_t retlen, len = 0;
758 	loff_t to;
759 	struct mtd_oob_ops ops = { };
760 
761 	ops.ooblen = mtd->oobsize;
762 	ops.ooboffs = 0;
763 	ops.datbuf = NULL;
764 	ops.mode = MTD_OPS_PLACE_OOB;
765 
766 	if (!rcode)
767 		rcode = 0xff;
768 	/* Write bad block table per chip rather than per device? */
769 	if (td->options & NAND_BBT_PERCHIP) {
770 		numblocks = (int)(targetsize >> this->bbt_erase_shift);
771 		/* Full device write or specific chip? */
772 		if (chipsel == -1) {
773 			nrchips = nanddev_ntargets(&this->base);
774 		} else {
775 			nrchips = chipsel + 1;
776 			chip = chipsel;
777 		}
778 	} else {
779 		numblocks = (int)(mtd->size >> this->bbt_erase_shift);
780 		nrchips = 1;
781 	}
782 
783 	/* Loop through the chips */
784 	while (chip < nrchips) {
785 		int block;
786 
787 		block = get_bbt_block(this, td, md, chip);
788 		if (block < 0) {
789 			pr_err("No space left to write bad block table\n");
790 			res = block;
791 			goto outerr;
792 		}
793 
794 		/*
795 		 * get_bbt_block() returns a block number, shift the value to
796 		 * get a page number.
797 		 */
798 		page = block << (this->bbt_erase_shift - this->page_shift);
799 
800 		/* Set up shift count and masks for the flash table */
801 		bits = td->options & NAND_BBT_NRBITS_MSK;
802 		msk[2] = ~rcode;
803 		switch (bits) {
804 		case 1: sft = 3; sftmsk = 0x07; msk[0] = 0x00; msk[1] = 0x01;
805 			msk[3] = 0x01;
806 			break;
807 		case 2: sft = 2; sftmsk = 0x06; msk[0] = 0x00; msk[1] = 0x01;
808 			msk[3] = 0x03;
809 			break;
810 		case 4: sft = 1; sftmsk = 0x04; msk[0] = 0x00; msk[1] = 0x0C;
811 			msk[3] = 0x0f;
812 			break;
813 		case 8: sft = 0; sftmsk = 0x00; msk[0] = 0x00; msk[1] = 0x0F;
814 			msk[3] = 0xff;
815 			break;
816 		default: return -EINVAL;
817 		}
818 
819 		to = ((loff_t)page) << this->page_shift;
820 
821 		/* Must we save the block contents? */
822 		if (td->options & NAND_BBT_SAVECONTENT) {
823 			/* Make it block aligned */
824 			to &= ~(((loff_t)1 << this->bbt_erase_shift) - 1);
825 			len = 1 << this->bbt_erase_shift;
826 			res = mtd_read(mtd, to, len, &retlen, buf);
827 			if (res < 0) {
828 				if (retlen != len) {
829 					pr_info("nand_bbt: error reading block for writing the bad block table\n");
830 					return res;
831 				}
832 				pr_warn("nand_bbt: ECC error while reading block for writing bad block table\n");
833 			}
834 			/* Read oob data */
835 			ops.ooblen = (len >> this->page_shift) * mtd->oobsize;
836 			ops.oobbuf = &buf[len];
837 			res = mtd_read_oob(mtd, to + mtd->writesize, &ops);
838 			if (res < 0 || ops.oobretlen != ops.ooblen)
839 				goto outerr;
840 
841 			/* Calc the byte offset in the buffer */
842 			pageoffs = page - (int)(to >> this->page_shift);
843 			offs = pageoffs << this->page_shift;
844 			/* Preset the bbt area with 0xff */
845 			memset(&buf[offs], 0xff, (size_t)(numblocks >> sft));
846 			ooboffs = len + (pageoffs * mtd->oobsize);
847 
848 		} else if (td->options & NAND_BBT_NO_OOB) {
849 			ooboffs = 0;
850 			offs = td->len;
851 			/* The version byte */
852 			if (td->options & NAND_BBT_VERSION)
853 				offs++;
854 			/* Calc length */
855 			len = (size_t)(numblocks >> sft);
856 			len += offs;
857 			/* Make it page aligned! */
858 			len = ALIGN(len, mtd->writesize);
859 			/* Preset the buffer with 0xff */
860 			memset(buf, 0xff, len);
861 			/* Pattern is located at the begin of first page */
862 			memcpy(buf, td->pattern, td->len);
863 		} else {
864 			/* Calc length */
865 			len = (size_t)(numblocks >> sft);
866 			/* Make it page aligned! */
867 			len = ALIGN(len, mtd->writesize);
868 			/* Preset the buffer with 0xff */
869 			memset(buf, 0xff, len +
870 			       (len >> this->page_shift)* mtd->oobsize);
871 			offs = 0;
872 			ooboffs = len;
873 			/* Pattern is located in oob area of first page */
874 			memcpy(&buf[ooboffs + td->offs], td->pattern, td->len);
875 		}
876 
877 		if (td->options & NAND_BBT_VERSION)
878 			buf[ooboffs + td->veroffs] = td->version[chip];
879 
880 		/* Walk through the memory table */
881 		for (i = 0; i < numblocks; i++) {
882 			uint8_t dat;
883 			int sftcnt = (i << (3 - sft)) & sftmsk;
884 			dat = bbt_get_entry(this, chip * numblocks + i);
885 			/* Do not store the reserved bbt blocks! */
886 			buf[offs + (i >> sft)] &= ~(msk[dat] << sftcnt);
887 		}
888 
889 		memset(&einfo, 0, sizeof(einfo));
890 		einfo.addr = to;
891 		einfo.len = 1 << this->bbt_erase_shift;
892 		res = nand_erase_nand(this, &einfo, 1);
893 		if (res < 0) {
894 			pr_warn("nand_bbt: error while erasing BBT block %d\n",
895 				res);
896 			mark_bbt_block_bad(this, td, chip, block);
897 			continue;
898 		}
899 
900 		res = scan_write_bbt(this, to, len, buf,
901 				     td->options & NAND_BBT_NO_OOB ?
902 				     NULL : &buf[len]);
903 		if (res < 0) {
904 			pr_warn("nand_bbt: error while writing BBT block %d\n",
905 				res);
906 			mark_bbt_block_bad(this, td, chip, block);
907 			continue;
908 		}
909 
910 		pr_info("Bad block table written to 0x%012llx, version 0x%02X\n",
911 			 (unsigned long long)to, td->version[chip]);
912 
913 		/* Mark it as used */
914 		td->pages[chip++] = page;
915 	}
916 	return 0;
917 
918  outerr:
919 	pr_warn("nand_bbt: error while writing bad block table %d\n", res);
920 	return res;
921 }
922 
923 /**
924  * nand_memory_bbt - [GENERIC] create a memory based bad block table
925  * @this: NAND chip object
926  * @bd: descriptor for the good/bad block search pattern
927  *
928  * The function creates a memory based bbt by scanning the device for
929  * manufacturer / software marked good / bad blocks.
930  */
931 static inline int nand_memory_bbt(struct nand_chip *this,
932 				  struct nand_bbt_descr *bd)
933 {
934 	u8 *pagebuf = nand_get_data_buf(this);
935 
936 	return create_bbt(this, pagebuf, bd, -1);
937 }
938 
939 /**
940  * check_create - [GENERIC] create and write bbt(s) if necessary
941  * @this: the NAND device
942  * @buf: temporary buffer
943  * @bd: descriptor for the good/bad block search pattern
944  *
945  * The function checks the results of the previous call to read_bbt and creates
946  * / updates the bbt(s) if necessary. Creation is necessary if no bbt was found
947  * for the chip/device. Update is necessary if one of the tables is missing or
948  * the version nr. of one table is less than the other.
949  */
950 static int check_create(struct nand_chip *this, uint8_t *buf,
951 			struct nand_bbt_descr *bd)
952 {
953 	int i, chips, writeops, create, chipsel, res, res2;
954 	struct nand_bbt_descr *td = this->bbt_td;
955 	struct nand_bbt_descr *md = this->bbt_md;
956 	struct nand_bbt_descr *rd, *rd2;
957 
958 	/* Do we have a bbt per chip? */
959 	if (td->options & NAND_BBT_PERCHIP)
960 		chips = nanddev_ntargets(&this->base);
961 	else
962 		chips = 1;
963 
964 	for (i = 0; i < chips; i++) {
965 		writeops = 0;
966 		create = 0;
967 		rd = NULL;
968 		rd2 = NULL;
969 		res = res2 = 0;
970 		/* Per chip or per device? */
971 		chipsel = (td->options & NAND_BBT_PERCHIP) ? i : -1;
972 		/* Mirrored table available? */
973 		if (md) {
974 			if (td->pages[i] == -1 && md->pages[i] == -1) {
975 				create = 1;
976 				writeops = 0x03;
977 			} else if (td->pages[i] == -1) {
978 				rd = md;
979 				writeops = 0x01;
980 			} else if (md->pages[i] == -1) {
981 				rd = td;
982 				writeops = 0x02;
983 			} else if (td->version[i] == md->version[i]) {
984 				rd = td;
985 				if (!(td->options & NAND_BBT_VERSION))
986 					rd2 = md;
987 			} else if (((int8_t)(td->version[i] - md->version[i])) > 0) {
988 				rd = td;
989 				writeops = 0x02;
990 			} else {
991 				rd = md;
992 				writeops = 0x01;
993 			}
994 		} else {
995 			if (td->pages[i] == -1) {
996 				create = 1;
997 				writeops = 0x01;
998 			} else {
999 				rd = td;
1000 			}
1001 		}
1002 
1003 		if (create) {
1004 			/* Create the bad block table by scanning the device? */
1005 			if (!(td->options & NAND_BBT_CREATE))
1006 				continue;
1007 
1008 			/* Create the table in memory by scanning the chip(s) */
1009 			if (!(this->bbt_options & NAND_BBT_CREATE_EMPTY))
1010 				create_bbt(this, buf, bd, chipsel);
1011 
1012 			td->version[i] = 1;
1013 			if (md)
1014 				md->version[i] = 1;
1015 		}
1016 
1017 		/* Read back first? */
1018 		if (rd) {
1019 			res = read_abs_bbt(this, buf, rd, chipsel);
1020 			if (mtd_is_eccerr(res)) {
1021 				/* Mark table as invalid */
1022 				rd->pages[i] = -1;
1023 				rd->version[i] = 0;
1024 				i--;
1025 				continue;
1026 			}
1027 		}
1028 		/* If they weren't versioned, read both */
1029 		if (rd2) {
1030 			res2 = read_abs_bbt(this, buf, rd2, chipsel);
1031 			if (mtd_is_eccerr(res2)) {
1032 				/* Mark table as invalid */
1033 				rd2->pages[i] = -1;
1034 				rd2->version[i] = 0;
1035 				i--;
1036 				continue;
1037 			}
1038 		}
1039 
1040 		/* Scrub the flash table(s)? */
1041 		if (mtd_is_bitflip(res) || mtd_is_bitflip(res2))
1042 			writeops = 0x03;
1043 
1044 		/* Update version numbers before writing */
1045 		if (md) {
1046 			td->version[i] = max(td->version[i], md->version[i]);
1047 			md->version[i] = td->version[i];
1048 		}
1049 
1050 		/* Write the bad block table to the device? */
1051 		if ((writeops & 0x01) && (td->options & NAND_BBT_WRITE)) {
1052 			res = write_bbt(this, buf, td, md, chipsel);
1053 			if (res < 0)
1054 				return res;
1055 		}
1056 
1057 		/* Write the mirror bad block table to the device? */
1058 		if ((writeops & 0x02) && md && (md->options & NAND_BBT_WRITE)) {
1059 			res = write_bbt(this, buf, md, td, chipsel);
1060 			if (res < 0)
1061 				return res;
1062 		}
1063 	}
1064 	return 0;
1065 }
1066 
1067 /**
1068  * nand_update_bbt - update bad block table(s)
1069  * @this: the NAND device
1070  * @offs: the offset of the newly marked block
1071  *
1072  * The function updates the bad block table(s).
1073  */
1074 static int nand_update_bbt(struct nand_chip *this, loff_t offs)
1075 {
1076 	struct mtd_info *mtd = nand_to_mtd(this);
1077 	int len, res = 0;
1078 	int chip, chipsel;
1079 	uint8_t *buf;
1080 	struct nand_bbt_descr *td = this->bbt_td;
1081 	struct nand_bbt_descr *md = this->bbt_md;
1082 
1083 	if (!this->bbt || !td)
1084 		return -EINVAL;
1085 
1086 	/* Allocate a temporary buffer for one eraseblock incl. oob */
1087 	len = (1 << this->bbt_erase_shift);
1088 	len += (len >> this->page_shift) * mtd->oobsize;
1089 	buf = kmalloc(len, GFP_KERNEL);
1090 	if (!buf)
1091 		return -ENOMEM;
1092 
1093 	/* Do we have a bbt per chip? */
1094 	if (td->options & NAND_BBT_PERCHIP) {
1095 		chip = (int)(offs >> this->chip_shift);
1096 		chipsel = chip;
1097 	} else {
1098 		chip = 0;
1099 		chipsel = -1;
1100 	}
1101 
1102 	td->version[chip]++;
1103 	if (md)
1104 		md->version[chip]++;
1105 
1106 	/* Write the bad block table to the device? */
1107 	if (td->options & NAND_BBT_WRITE) {
1108 		res = write_bbt(this, buf, td, md, chipsel);
1109 		if (res < 0)
1110 			goto out;
1111 	}
1112 	/* Write the mirror bad block table to the device? */
1113 	if (md && (md->options & NAND_BBT_WRITE)) {
1114 		res = write_bbt(this, buf, md, td, chipsel);
1115 	}
1116 
1117  out:
1118 	kfree(buf);
1119 	return res;
1120 }
1121 
1122 /**
1123  * mark_bbt_region - [GENERIC] mark the bad block table regions
1124  * @this: the NAND device
1125  * @td: bad block table descriptor
1126  *
1127  * The bad block table regions are marked as "bad" to prevent accidental
1128  * erasures / writes. The regions are identified by the mark 0x02.
1129  */
1130 static void mark_bbt_region(struct nand_chip *this, struct nand_bbt_descr *td)
1131 {
1132 	u64 targetsize = nanddev_target_size(&this->base);
1133 	struct mtd_info *mtd = nand_to_mtd(this);
1134 	int i, j, chips, block, nrblocks, update;
1135 	uint8_t oldval;
1136 
1137 	/* Do we have a bbt per chip? */
1138 	if (td->options & NAND_BBT_PERCHIP) {
1139 		chips = nanddev_ntargets(&this->base);
1140 		nrblocks = (int)(targetsize >> this->bbt_erase_shift);
1141 	} else {
1142 		chips = 1;
1143 		nrblocks = (int)(mtd->size >> this->bbt_erase_shift);
1144 	}
1145 
1146 	for (i = 0; i < chips; i++) {
1147 		if ((td->options & NAND_BBT_ABSPAGE) ||
1148 		    !(td->options & NAND_BBT_WRITE)) {
1149 			if (td->pages[i] == -1)
1150 				continue;
1151 			block = td->pages[i] >> (this->bbt_erase_shift - this->page_shift);
1152 			oldval = bbt_get_entry(this, block);
1153 			bbt_mark_entry(this, block, BBT_BLOCK_RESERVED);
1154 			if ((oldval != BBT_BLOCK_RESERVED) &&
1155 					td->reserved_block_code)
1156 				nand_update_bbt(this, (loff_t)block <<
1157 						this->bbt_erase_shift);
1158 			continue;
1159 		}
1160 		update = 0;
1161 		if (td->options & NAND_BBT_LASTBLOCK)
1162 			block = ((i + 1) * nrblocks) - td->maxblocks;
1163 		else
1164 			block = i * nrblocks;
1165 		for (j = 0; j < td->maxblocks; j++) {
1166 			oldval = bbt_get_entry(this, block);
1167 			bbt_mark_entry(this, block, BBT_BLOCK_RESERVED);
1168 			if (oldval != BBT_BLOCK_RESERVED)
1169 				update = 1;
1170 			block++;
1171 		}
1172 		/*
1173 		 * If we want reserved blocks to be recorded to flash, and some
1174 		 * new ones have been marked, then we need to update the stored
1175 		 * bbts.  This should only happen once.
1176 		 */
1177 		if (update && td->reserved_block_code)
1178 			nand_update_bbt(this, (loff_t)(block - 1) <<
1179 					this->bbt_erase_shift);
1180 	}
1181 }
1182 
1183 /**
1184  * verify_bbt_descr - verify the bad block description
1185  * @this: the NAND device
1186  * @bd: the table to verify
1187  *
1188  * This functions performs a few sanity checks on the bad block description
1189  * table.
1190  */
1191 static void verify_bbt_descr(struct nand_chip *this, struct nand_bbt_descr *bd)
1192 {
1193 	u64 targetsize = nanddev_target_size(&this->base);
1194 	struct mtd_info *mtd = nand_to_mtd(this);
1195 	u32 pattern_len;
1196 	u32 bits;
1197 	u32 table_size;
1198 
1199 	if (!bd)
1200 		return;
1201 
1202 	pattern_len = bd->len;
1203 	bits = bd->options & NAND_BBT_NRBITS_MSK;
1204 
1205 	BUG_ON((this->bbt_options & NAND_BBT_NO_OOB) &&
1206 			!(this->bbt_options & NAND_BBT_USE_FLASH));
1207 	BUG_ON(!bits);
1208 
1209 	if (bd->options & NAND_BBT_VERSION)
1210 		pattern_len++;
1211 
1212 	if (bd->options & NAND_BBT_NO_OOB) {
1213 		BUG_ON(!(this->bbt_options & NAND_BBT_USE_FLASH));
1214 		BUG_ON(!(this->bbt_options & NAND_BBT_NO_OOB));
1215 		BUG_ON(bd->offs);
1216 		if (bd->options & NAND_BBT_VERSION)
1217 			BUG_ON(bd->veroffs != bd->len);
1218 		BUG_ON(bd->options & NAND_BBT_SAVECONTENT);
1219 	}
1220 
1221 	if (bd->options & NAND_BBT_PERCHIP)
1222 		table_size = targetsize >> this->bbt_erase_shift;
1223 	else
1224 		table_size = mtd->size >> this->bbt_erase_shift;
1225 	table_size >>= 3;
1226 	table_size *= bits;
1227 	if (bd->options & NAND_BBT_NO_OOB)
1228 		table_size += pattern_len;
1229 	BUG_ON(table_size > (1 << this->bbt_erase_shift));
1230 }
1231 
1232 /**
1233  * nand_scan_bbt - [NAND Interface] scan, find, read and maybe create bad block table(s)
1234  * @this: the NAND device
1235  * @bd: descriptor for the good/bad block search pattern
1236  *
1237  * The function checks, if a bad block table(s) is/are already available. If
1238  * not it scans the device for manufacturer marked good / bad blocks and writes
1239  * the bad block table(s) to the selected place.
1240  *
1241  * The bad block table memory is allocated here. It must be freed by calling
1242  * the nand_free_bbt function.
1243  */
1244 static int nand_scan_bbt(struct nand_chip *this, struct nand_bbt_descr *bd)
1245 {
1246 	struct mtd_info *mtd = nand_to_mtd(this);
1247 	int len, res;
1248 	uint8_t *buf;
1249 	struct nand_bbt_descr *td = this->bbt_td;
1250 	struct nand_bbt_descr *md = this->bbt_md;
1251 
1252 	len = (mtd->size >> (this->bbt_erase_shift + 2)) ? : 1;
1253 	/*
1254 	 * Allocate memory (2bit per block) and clear the memory bad block
1255 	 * table.
1256 	 */
1257 	this->bbt = kzalloc(len, GFP_KERNEL);
1258 	if (!this->bbt)
1259 		return -ENOMEM;
1260 
1261 	/*
1262 	 * If no primary table descriptor is given, scan the device to build a
1263 	 * memory based bad block table.
1264 	 */
1265 	if (!td) {
1266 		if ((res = nand_memory_bbt(this, bd))) {
1267 			pr_err("nand_bbt: can't scan flash and build the RAM-based BBT\n");
1268 			goto err_free_bbt;
1269 		}
1270 		return 0;
1271 	}
1272 	verify_bbt_descr(this, td);
1273 	verify_bbt_descr(this, md);
1274 
1275 	/* Allocate a temporary buffer for one eraseblock incl. oob */
1276 	len = (1 << this->bbt_erase_shift);
1277 	len += (len >> this->page_shift) * mtd->oobsize;
1278 	buf = vmalloc(len);
1279 	if (!buf) {
1280 		res = -ENOMEM;
1281 		goto err_free_bbt;
1282 	}
1283 
1284 	/* Is the bbt at a given page? */
1285 	if (td->options & NAND_BBT_ABSPAGE) {
1286 		read_abs_bbts(this, buf, td, md);
1287 	} else {
1288 		/* Search the bad block table using a pattern in oob */
1289 		search_read_bbts(this, buf, td, md);
1290 	}
1291 
1292 	res = check_create(this, buf, bd);
1293 	if (res)
1294 		goto err_free_buf;
1295 
1296 	/* Prevent the bbt regions from erasing / writing */
1297 	mark_bbt_region(this, td);
1298 	if (md)
1299 		mark_bbt_region(this, md);
1300 
1301 	vfree(buf);
1302 	return 0;
1303 
1304 err_free_buf:
1305 	vfree(buf);
1306 err_free_bbt:
1307 	kfree(this->bbt);
1308 	this->bbt = NULL;
1309 	return res;
1310 }
1311 
1312 /*
1313  * Define some generic bad / good block scan pattern which are used
1314  * while scanning a device for factory marked good / bad blocks.
1315  */
1316 static uint8_t scan_ff_pattern[] = { 0xff, 0xff };
1317 
1318 /* Generic flash bbt descriptors */
1319 static uint8_t bbt_pattern[] = {'B', 'b', 't', '0' };
1320 static uint8_t mirror_pattern[] = {'1', 't', 'b', 'B' };
1321 
1322 static struct nand_bbt_descr bbt_main_descr = {
1323 	.options = NAND_BBT_LASTBLOCK | NAND_BBT_CREATE | NAND_BBT_WRITE
1324 		| NAND_BBT_2BIT | NAND_BBT_VERSION | NAND_BBT_PERCHIP,
1325 	.offs =	8,
1326 	.len = 4,
1327 	.veroffs = 12,
1328 	.maxblocks = NAND_BBT_SCAN_MAXBLOCKS,
1329 	.pattern = bbt_pattern
1330 };
1331 
1332 static struct nand_bbt_descr bbt_mirror_descr = {
1333 	.options = NAND_BBT_LASTBLOCK | NAND_BBT_CREATE | NAND_BBT_WRITE
1334 		| NAND_BBT_2BIT | NAND_BBT_VERSION | NAND_BBT_PERCHIP,
1335 	.offs =	8,
1336 	.len = 4,
1337 	.veroffs = 12,
1338 	.maxblocks = NAND_BBT_SCAN_MAXBLOCKS,
1339 	.pattern = mirror_pattern
1340 };
1341 
1342 static struct nand_bbt_descr bbt_main_no_oob_descr = {
1343 	.options = NAND_BBT_LASTBLOCK | NAND_BBT_CREATE | NAND_BBT_WRITE
1344 		| NAND_BBT_2BIT | NAND_BBT_VERSION | NAND_BBT_PERCHIP
1345 		| NAND_BBT_NO_OOB,
1346 	.len = 4,
1347 	.veroffs = 4,
1348 	.maxblocks = NAND_BBT_SCAN_MAXBLOCKS,
1349 	.pattern = bbt_pattern
1350 };
1351 
1352 static struct nand_bbt_descr bbt_mirror_no_oob_descr = {
1353 	.options = NAND_BBT_LASTBLOCK | NAND_BBT_CREATE | NAND_BBT_WRITE
1354 		| NAND_BBT_2BIT | NAND_BBT_VERSION | NAND_BBT_PERCHIP
1355 		| NAND_BBT_NO_OOB,
1356 	.len = 4,
1357 	.veroffs = 4,
1358 	.maxblocks = NAND_BBT_SCAN_MAXBLOCKS,
1359 	.pattern = mirror_pattern
1360 };
1361 
1362 #define BADBLOCK_SCAN_MASK (~NAND_BBT_NO_OOB)
1363 /**
1364  * nand_create_badblock_pattern - [INTERN] Creates a BBT descriptor structure
1365  * @this: NAND chip to create descriptor for
1366  *
1367  * This function allocates and initializes a nand_bbt_descr for BBM detection
1368  * based on the properties of @this. The new descriptor is stored in
1369  * this->badblock_pattern. Thus, this->badblock_pattern should be NULL when
1370  * passed to this function.
1371  */
1372 static int nand_create_badblock_pattern(struct nand_chip *this)
1373 {
1374 	struct nand_bbt_descr *bd;
1375 	if (this->badblock_pattern) {
1376 		pr_warn("Bad block pattern already allocated; not replacing\n");
1377 		return -EINVAL;
1378 	}
1379 	bd = kzalloc(sizeof(*bd), GFP_KERNEL);
1380 	if (!bd)
1381 		return -ENOMEM;
1382 	bd->options = this->bbt_options & BADBLOCK_SCAN_MASK;
1383 	bd->offs = this->badblockpos;
1384 	bd->len = (this->options & NAND_BUSWIDTH_16) ? 2 : 1;
1385 	bd->pattern = scan_ff_pattern;
1386 	bd->options |= NAND_BBT_DYNAMICSTRUCT;
1387 	this->badblock_pattern = bd;
1388 	return 0;
1389 }
1390 
1391 /**
1392  * nand_create_bbt - [NAND Interface] Select a default bad block table for the device
1393  * @this: NAND chip object
1394  *
1395  * This function selects the default bad block table support for the device and
1396  * calls the nand_scan_bbt function.
1397  */
1398 int nand_create_bbt(struct nand_chip *this)
1399 {
1400 	int ret;
1401 
1402 	/* Is a flash based bad block table requested? */
1403 	if (this->bbt_options & NAND_BBT_USE_FLASH) {
1404 		/* Use the default pattern descriptors */
1405 		if (!this->bbt_td) {
1406 			if (this->bbt_options & NAND_BBT_NO_OOB) {
1407 				this->bbt_td = &bbt_main_no_oob_descr;
1408 				this->bbt_md = &bbt_mirror_no_oob_descr;
1409 			} else {
1410 				this->bbt_td = &bbt_main_descr;
1411 				this->bbt_md = &bbt_mirror_descr;
1412 			}
1413 		}
1414 	} else {
1415 		this->bbt_td = NULL;
1416 		this->bbt_md = NULL;
1417 	}
1418 
1419 	if (!this->badblock_pattern) {
1420 		ret = nand_create_badblock_pattern(this);
1421 		if (ret)
1422 			return ret;
1423 	}
1424 
1425 	return nand_scan_bbt(this, this->badblock_pattern);
1426 }
1427 EXPORT_SYMBOL(nand_create_bbt);
1428 
1429 /**
1430  * nand_isreserved_bbt - [NAND Interface] Check if a block is reserved
1431  * @this: NAND chip object
1432  * @offs: offset in the device
1433  */
1434 int nand_isreserved_bbt(struct nand_chip *this, loff_t offs)
1435 {
1436 	int block;
1437 
1438 	block = (int)(offs >> this->bbt_erase_shift);
1439 	return bbt_get_entry(this, block) == BBT_BLOCK_RESERVED;
1440 }
1441 
1442 /**
1443  * nand_isbad_bbt - [NAND Interface] Check if a block is bad
1444  * @this: NAND chip object
1445  * @offs: offset in the device
1446  * @allowbbt: allow access to bad block table region
1447  */
1448 int nand_isbad_bbt(struct nand_chip *this, loff_t offs, int allowbbt)
1449 {
1450 	int block, res;
1451 
1452 	block = (int)(offs >> this->bbt_erase_shift);
1453 	res = bbt_get_entry(this, block);
1454 
1455 	pr_debug("nand_isbad_bbt(): bbt info for offs 0x%08x: (block %d) 0x%02x\n",
1456 		 (unsigned int)offs, block, res);
1457 
1458 	if (mtd_check_expert_analysis_mode())
1459 		return 0;
1460 
1461 	switch (res) {
1462 	case BBT_BLOCK_GOOD:
1463 		return 0;
1464 	case BBT_BLOCK_WORN:
1465 		return 1;
1466 	case BBT_BLOCK_RESERVED:
1467 		return allowbbt ? 0 : 1;
1468 	}
1469 	return 1;
1470 }
1471 
1472 /**
1473  * nand_markbad_bbt - [NAND Interface] Mark a block bad in the BBT
1474  * @this: NAND chip object
1475  * @offs: offset of the bad block
1476  */
1477 int nand_markbad_bbt(struct nand_chip *this, loff_t offs)
1478 {
1479 	int block, ret = 0;
1480 
1481 	block = (int)(offs >> this->bbt_erase_shift);
1482 
1483 	/* Mark bad block in memory */
1484 	bbt_mark_entry(this, block, BBT_BLOCK_WORN);
1485 
1486 	/* Update flash-based bad block table */
1487 	if (this->bbt_options & NAND_BBT_USE_FLASH)
1488 		ret = nand_update_bbt(this, offs);
1489 
1490 	return ret;
1491 }
1492