xref: /linux/drivers/mtd/ubi/wl.c (revision 04b43ea325d21c4c98e831383a1b7d540721898a)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * Copyright (c) International Business Machines Corp., 2006
4  *
5  * Authors: Artem Bityutskiy (Битюцкий Артём), Thomas Gleixner
6  */
7 
8 /*
9  * UBI wear-leveling sub-system.
10  *
11  * This sub-system is responsible for wear-leveling. It works in terms of
12  * physical eraseblocks and erase counters and knows nothing about logical
13  * eraseblocks, volumes, etc. From this sub-system's perspective all physical
14  * eraseblocks are of two types - used and free. Used physical eraseblocks are
15  * those that were "get" by the 'ubi_wl_get_peb()' function, and free physical
16  * eraseblocks are those that were put by the 'ubi_wl_put_peb()' function.
17  *
18  * Physical eraseblocks returned by 'ubi_wl_get_peb()' have only erase counter
19  * header. The rest of the physical eraseblock contains only %0xFF bytes.
20  *
21  * When physical eraseblocks are returned to the WL sub-system by means of the
22  * 'ubi_wl_put_peb()' function, they are scheduled for erasure. The erasure is
23  * done asynchronously in context of the per-UBI device background thread,
24  * which is also managed by the WL sub-system.
25  *
26  * The wear-leveling is ensured by means of moving the contents of used
27  * physical eraseblocks with low erase counter to free physical eraseblocks
28  * with high erase counter.
29  *
30  * If the WL sub-system fails to erase a physical eraseblock, it marks it as
31  * bad.
32  *
33  * This sub-system is also responsible for scrubbing. If a bit-flip is detected
34  * in a physical eraseblock, it has to be moved. Technically this is the same
35  * as moving it for wear-leveling reasons.
36  *
37  * As it was said, for the UBI sub-system all physical eraseblocks are either
38  * "free" or "used". Free eraseblock are kept in the @wl->free RB-tree, while
39  * used eraseblocks are kept in @wl->used, @wl->erroneous, or @wl->scrub
40  * RB-trees, as well as (temporarily) in the @wl->pq queue.
41  *
42  * When the WL sub-system returns a physical eraseblock, the physical
43  * eraseblock is protected from being moved for some "time". For this reason,
44  * the physical eraseblock is not directly moved from the @wl->free tree to the
45  * @wl->used tree. There is a protection queue in between where this
46  * physical eraseblock is temporarily stored (@wl->pq).
47  *
48  * All this protection stuff is needed because:
49  *  o we don't want to move physical eraseblocks just after we have given them
50  *    to the user; instead, we first want to let users fill them up with data;
51  *
52  *  o there is a chance that the user will put the physical eraseblock very
53  *    soon, so it makes sense not to move it for some time, but wait.
54  *
55  * Physical eraseblocks stay protected only for limited time. But the "time" is
56  * measured in erase cycles in this case. This is implemented with help of the
57  * protection queue. Eraseblocks are put to the tail of this queue when they
58  * are returned by the 'ubi_wl_get_peb()', and eraseblocks are removed from the
59  * head of the queue on each erase operation (for any eraseblock). So the
60  * length of the queue defines how may (global) erase cycles PEBs are protected.
61  *
62  * To put it differently, each physical eraseblock has 2 main states: free and
63  * used. The former state corresponds to the @wl->free tree. The latter state
64  * is split up on several sub-states:
65  * o the WL movement is allowed (@wl->used tree);
66  * o the WL movement is disallowed (@wl->erroneous) because the PEB is
67  *   erroneous - e.g., there was a read error;
68  * o the WL movement is temporarily prohibited (@wl->pq queue);
69  * o scrubbing is needed (@wl->scrub tree).
70  *
71  * Depending on the sub-state, wear-leveling entries of the used physical
72  * eraseblocks may be kept in one of those structures.
73  *
74  * Note, in this implementation, we keep a small in-RAM object for each physical
75  * eraseblock. This is surely not a scalable solution. But it appears to be good
76  * enough for moderately large flashes and it is simple. In future, one may
77  * re-work this sub-system and make it more scalable.
78  *
79  * At the moment this sub-system does not utilize the sequence number, which
80  * was introduced relatively recently. But it would be wise to do this because
81  * the sequence number of a logical eraseblock characterizes how old is it. For
82  * example, when we move a PEB with low erase counter, and we need to pick the
83  * target PEB, we pick a PEB with the highest EC if our PEB is "old" and we
84  * pick target PEB with an average EC if our PEB is not very "old". This is a
85  * room for future re-works of the WL sub-system.
86  */
87 
88 #include <linux/slab.h>
89 #include <linux/crc32.h>
90 #include <linux/freezer.h>
91 #include <linux/kthread.h>
92 #include <linux/reboot.h>
93 #include "ubi.h"
94 #include "wl.h"
95 
96 /* Number of physical eraseblocks reserved for wear-leveling purposes */
97 #define WL_RESERVED_PEBS 1
98 
99 /*
100  * Maximum difference between two erase counters. If this threshold is
101  * exceeded, the WL sub-system starts moving data from used physical
102  * eraseblocks with low erase counter to free physical eraseblocks with high
103  * erase counter.
104  */
105 #define UBI_WL_THRESHOLD CONFIG_MTD_UBI_WL_THRESHOLD
106 
107 /*
108  * When a physical eraseblock is moved, the WL sub-system has to pick the target
109  * physical eraseblock to move to. The simplest way would be just to pick the
110  * one with the highest erase counter. But in certain workloads this could lead
111  * to an unlimited wear of one or few physical eraseblock. Indeed, imagine a
112  * situation when the picked physical eraseblock is constantly erased after the
113  * data is written to it. So, we have a constant which limits the highest erase
114  * counter of the free physical eraseblock to pick. Namely, the WL sub-system
115  * does not pick eraseblocks with erase counter greater than the lowest erase
116  * counter plus %WL_FREE_MAX_DIFF.
117  */
118 #define WL_FREE_MAX_DIFF (2*UBI_WL_THRESHOLD)
119 
120 /*
121  * Maximum number of consecutive background thread failures which is enough to
122  * switch to read-only mode.
123  */
124 #define WL_MAX_FAILURES 32
125 
126 static int self_check_ec(struct ubi_device *ubi, int pnum, int ec);
127 static int self_check_in_wl_tree(const struct ubi_device *ubi,
128 				 struct ubi_wl_entry *e, struct rb_root *root);
129 static int self_check_in_pq(const struct ubi_device *ubi,
130 			    struct ubi_wl_entry *e);
131 static int ubi_wl_reboot_notifier(struct notifier_block *n,
132 				  unsigned long state, void *cmd);
133 
134 /**
135  * wl_tree_add - add a wear-leveling entry to a WL RB-tree.
136  * @e: the wear-leveling entry to add
137  * @root: the root of the tree
138  *
139  * Note, we use (erase counter, physical eraseblock number) pairs as keys in
140  * the @ubi->used and @ubi->free RB-trees.
141  */
wl_tree_add(struct ubi_wl_entry * e,struct rb_root * root)142 static void wl_tree_add(struct ubi_wl_entry *e, struct rb_root *root)
143 {
144 	struct rb_node **p, *parent = NULL;
145 
146 	p = &root->rb_node;
147 	while (*p) {
148 		struct ubi_wl_entry *e1;
149 
150 		parent = *p;
151 		e1 = rb_entry(parent, struct ubi_wl_entry, u.rb);
152 
153 		if (e->ec < e1->ec)
154 			p = &(*p)->rb_left;
155 		else if (e->ec > e1->ec)
156 			p = &(*p)->rb_right;
157 		else {
158 			ubi_assert(e->pnum != e1->pnum);
159 			if (e->pnum < e1->pnum)
160 				p = &(*p)->rb_left;
161 			else
162 				p = &(*p)->rb_right;
163 		}
164 	}
165 
166 	rb_link_node(&e->u.rb, parent, p);
167 	rb_insert_color(&e->u.rb, root);
168 }
169 
170 /**
171  * wl_entry_destroy - destroy a wear-leveling entry.
172  * @ubi: UBI device description object
173  * @e: the wear-leveling entry to add
174  *
175  * This function destroys a wear leveling entry and removes
176  * the reference from the lookup table.
177  */
wl_entry_destroy(struct ubi_device * ubi,struct ubi_wl_entry * e)178 static void wl_entry_destroy(struct ubi_device *ubi, struct ubi_wl_entry *e)
179 {
180 	ubi->lookuptbl[e->pnum] = NULL;
181 	kmem_cache_free(ubi_wl_entry_slab, e);
182 }
183 
184 /**
185  * do_work - do one pending work.
186  * @ubi: UBI device description object
187  * @executed: whether there is one work is executed
188  *
189  * This function returns zero in case of success and a negative error code in
190  * case of failure. If @executed is not NULL and there is one work executed,
191  * @executed is set as %1, otherwise @executed is set as %0.
192  */
do_work(struct ubi_device * ubi,int * executed)193 static int do_work(struct ubi_device *ubi, int *executed)
194 {
195 	int err;
196 	struct ubi_work *wrk;
197 
198 	cond_resched();
199 
200 	/*
201 	 * @ubi->work_sem is used to synchronize with the workers. Workers take
202 	 * it in read mode, so many of them may be doing works at a time. But
203 	 * the queue flush code has to be sure the whole queue of works is
204 	 * done, and it takes the mutex in write mode.
205 	 */
206 	down_read(&ubi->work_sem);
207 	spin_lock(&ubi->wl_lock);
208 	if (list_empty(&ubi->works)) {
209 		spin_unlock(&ubi->wl_lock);
210 		up_read(&ubi->work_sem);
211 		if (executed)
212 			*executed = 0;
213 		return 0;
214 	}
215 
216 	if (executed)
217 		*executed = 1;
218 	wrk = list_entry(ubi->works.next, struct ubi_work, list);
219 	list_del(&wrk->list);
220 	ubi->works_count -= 1;
221 	ubi_assert(ubi->works_count >= 0);
222 	spin_unlock(&ubi->wl_lock);
223 
224 	/*
225 	 * Call the worker function. Do not touch the work structure
226 	 * after this call as it will have been freed or reused by that
227 	 * time by the worker function.
228 	 */
229 	err = wrk->func(ubi, wrk, 0);
230 	if (err)
231 		ubi_err(ubi, "work failed with error code %d", err);
232 	up_read(&ubi->work_sem);
233 
234 	return err;
235 }
236 
237 /**
238  * in_wl_tree - check if wear-leveling entry is present in a WL RB-tree.
239  * @e: the wear-leveling entry to check
240  * @root: the root of the tree
241  *
242  * This function returns non-zero if @e is in the @root RB-tree and zero if it
243  * is not.
244  */
in_wl_tree(struct ubi_wl_entry * e,struct rb_root * root)245 static int in_wl_tree(struct ubi_wl_entry *e, struct rb_root *root)
246 {
247 	struct rb_node *p;
248 
249 	p = root->rb_node;
250 	while (p) {
251 		struct ubi_wl_entry *e1;
252 
253 		e1 = rb_entry(p, struct ubi_wl_entry, u.rb);
254 
255 		if (e->pnum == e1->pnum) {
256 			ubi_assert(e == e1);
257 			return 1;
258 		}
259 
260 		if (e->ec < e1->ec)
261 			p = p->rb_left;
262 		else if (e->ec > e1->ec)
263 			p = p->rb_right;
264 		else {
265 			ubi_assert(e->pnum != e1->pnum);
266 			if (e->pnum < e1->pnum)
267 				p = p->rb_left;
268 			else
269 				p = p->rb_right;
270 		}
271 	}
272 
273 	return 0;
274 }
275 
276 /**
277  * in_pq - check if a wear-leveling entry is present in the protection queue.
278  * @ubi: UBI device description object
279  * @e: the wear-leveling entry to check
280  *
281  * This function returns non-zero if @e is in the protection queue and zero
282  * if it is not.
283  */
in_pq(const struct ubi_device * ubi,struct ubi_wl_entry * e)284 static inline int in_pq(const struct ubi_device *ubi, struct ubi_wl_entry *e)
285 {
286 	struct ubi_wl_entry *p;
287 	int i;
288 
289 	for (i = 0; i < UBI_PROT_QUEUE_LEN; ++i)
290 		list_for_each_entry(p, &ubi->pq[i], u.list)
291 			if (p == e)
292 				return 1;
293 
294 	return 0;
295 }
296 
297 /**
298  * prot_queue_add - add physical eraseblock to the protection queue.
299  * @ubi: UBI device description object
300  * @e: the physical eraseblock to add
301  *
302  * This function adds @e to the tail of the protection queue @ubi->pq, where
303  * @e will stay for %UBI_PROT_QUEUE_LEN erase operations and will be
304  * temporarily protected from the wear-leveling worker. Note, @wl->lock has to
305  * be locked.
306  */
prot_queue_add(struct ubi_device * ubi,struct ubi_wl_entry * e)307 static void prot_queue_add(struct ubi_device *ubi, struct ubi_wl_entry *e)
308 {
309 	int pq_tail = ubi->pq_head - 1;
310 
311 	if (pq_tail < 0)
312 		pq_tail = UBI_PROT_QUEUE_LEN - 1;
313 	ubi_assert(pq_tail >= 0 && pq_tail < UBI_PROT_QUEUE_LEN);
314 	list_add_tail(&e->u.list, &ubi->pq[pq_tail]);
315 	dbg_wl("added PEB %d EC %d to the protection queue", e->pnum, e->ec);
316 }
317 
318 /**
319  * find_wl_entry - find wear-leveling entry closest to certain erase counter.
320  * @ubi: UBI device description object
321  * @root: the RB-tree where to look for
322  * @diff: maximum possible difference from the smallest erase counter
323  * @pick_max: pick PEB even its erase counter beyonds 'min_ec + @diff'
324  *
325  * This function looks for a wear leveling entry with erase counter closest to
326  * min + @diff, where min is the smallest erase counter.
327  */
find_wl_entry(struct ubi_device * ubi,struct rb_root * root,int diff,int pick_max)328 static struct ubi_wl_entry *find_wl_entry(struct ubi_device *ubi,
329 					  struct rb_root *root, int diff,
330 					  int pick_max)
331 {
332 	struct rb_node *p;
333 	struct ubi_wl_entry *e;
334 	int max;
335 
336 	e = rb_entry(rb_first(root), struct ubi_wl_entry, u.rb);
337 	max = e->ec + diff;
338 
339 	p = root->rb_node;
340 	while (p) {
341 		struct ubi_wl_entry *e1;
342 
343 		e1 = rb_entry(p, struct ubi_wl_entry, u.rb);
344 		if (e1->ec >= max) {
345 			if (pick_max)
346 				e = e1;
347 			p = p->rb_left;
348 		} else {
349 			p = p->rb_right;
350 			e = e1;
351 		}
352 	}
353 
354 	return e;
355 }
356 
357 /**
358  * find_mean_wl_entry - find wear-leveling entry with medium erase counter.
359  * @ubi: UBI device description object
360  * @root: the RB-tree where to look for
361  *
362  * This function looks for a wear leveling entry with medium erase counter,
363  * but not greater or equivalent than the lowest erase counter plus
364  * %WL_FREE_MAX_DIFF/2.
365  */
find_mean_wl_entry(struct ubi_device * ubi,struct rb_root * root)366 static struct ubi_wl_entry *find_mean_wl_entry(struct ubi_device *ubi,
367 					       struct rb_root *root)
368 {
369 	struct ubi_wl_entry *e, *first, *last;
370 
371 	first = rb_entry(rb_first(root), struct ubi_wl_entry, u.rb);
372 	last = rb_entry(rb_last(root), struct ubi_wl_entry, u.rb);
373 
374 	if (last->ec - first->ec < WL_FREE_MAX_DIFF) {
375 		e = rb_entry(root->rb_node, struct ubi_wl_entry, u.rb);
376 
377 		/*
378 		 * If no fastmap has been written and fm_anchor is not
379 		 * reserved and this WL entry can be used as anchor PEB
380 		 * hold it back and return the second best WL entry such
381 		 * that fastmap can use the anchor PEB later.
382 		 */
383 		e = may_reserve_for_fm(ubi, e, root);
384 	} else
385 		e = find_wl_entry(ubi, root, WL_FREE_MAX_DIFF/2, 0);
386 
387 	return e;
388 }
389 
390 /**
391  * wl_get_wle - get a mean wl entry to be used by ubi_wl_get_peb() or
392  * refill_wl_user_pool().
393  * @ubi: UBI device description object
394  *
395  * This function returns a wear leveling entry in case of success and
396  * NULL in case of failure.
397  */
wl_get_wle(struct ubi_device * ubi)398 static struct ubi_wl_entry *wl_get_wle(struct ubi_device *ubi)
399 {
400 	struct ubi_wl_entry *e;
401 
402 	e = find_mean_wl_entry(ubi, &ubi->free);
403 	if (!e) {
404 		ubi_err(ubi, "no free eraseblocks");
405 		return NULL;
406 	}
407 
408 	self_check_in_wl_tree(ubi, e, &ubi->free);
409 
410 	/*
411 	 * Move the physical eraseblock to the protection queue where it will
412 	 * be protected from being moved for some time.
413 	 */
414 	rb_erase(&e->u.rb, &ubi->free);
415 	ubi->free_count--;
416 	dbg_wl("PEB %d EC %d", e->pnum, e->ec);
417 
418 	return e;
419 }
420 
421 /**
422  * prot_queue_del - remove a physical eraseblock from the protection queue.
423  * @ubi: UBI device description object
424  * @pnum: the physical eraseblock to remove
425  *
426  * This function deletes PEB @pnum from the protection queue and returns zero
427  * in case of success and %-ENODEV if the PEB was not found.
428  */
prot_queue_del(struct ubi_device * ubi,int pnum)429 static int prot_queue_del(struct ubi_device *ubi, int pnum)
430 {
431 	struct ubi_wl_entry *e;
432 
433 	e = ubi->lookuptbl[pnum];
434 	if (!e)
435 		return -ENODEV;
436 
437 	if (self_check_in_pq(ubi, e))
438 		return -ENODEV;
439 
440 	list_del(&e->u.list);
441 	dbg_wl("deleted PEB %d from the protection queue", e->pnum);
442 	return 0;
443 }
444 
445 /**
446  * ubi_sync_erase - synchronously erase a physical eraseblock.
447  * @ubi: UBI device description object
448  * @e: the physical eraseblock to erase
449  * @torture: if the physical eraseblock has to be tortured
450  *
451  * This function returns zero in case of success and a negative error code in
452  * case of failure.
453  */
ubi_sync_erase(struct ubi_device * ubi,struct ubi_wl_entry * e,int torture)454 int ubi_sync_erase(struct ubi_device *ubi, struct ubi_wl_entry *e, int torture)
455 {
456 	int err;
457 	struct ubi_ec_hdr *ec_hdr;
458 	unsigned long long ec = e->ec;
459 
460 	dbg_wl("erase PEB %d, old EC %llu", e->pnum, ec);
461 
462 	err = self_check_ec(ubi, e->pnum, e->ec);
463 	if (err)
464 		return -EINVAL;
465 
466 	ec_hdr = kzalloc(ubi->ec_hdr_alsize, GFP_NOFS);
467 	if (!ec_hdr)
468 		return -ENOMEM;
469 
470 	err = ubi_io_sync_erase(ubi, e->pnum, torture);
471 	if (err < 0)
472 		goto out_free;
473 
474 	ec += err;
475 	if (ec > UBI_MAX_ERASECOUNTER) {
476 		/*
477 		 * Erase counter overflow. Upgrade UBI and use 64-bit
478 		 * erase counters internally.
479 		 */
480 		ubi_err(ubi, "erase counter overflow at PEB %d, EC %llu",
481 			e->pnum, ec);
482 		err = -EINVAL;
483 		goto out_free;
484 	}
485 
486 	dbg_wl("erased PEB %d, new EC %llu", e->pnum, ec);
487 
488 	ec_hdr->ec = cpu_to_be64(ec);
489 
490 	err = ubi_io_write_ec_hdr(ubi, e->pnum, ec_hdr);
491 	if (err)
492 		goto out_free;
493 
494 	e->ec = ec;
495 	spin_lock(&ubi->wl_lock);
496 	if (e->ec > ubi->max_ec)
497 		ubi->max_ec = e->ec;
498 	spin_unlock(&ubi->wl_lock);
499 
500 out_free:
501 	kfree(ec_hdr);
502 	return err;
503 }
504 
505 /**
506  * serve_prot_queue - check if it is time to stop protecting PEBs.
507  * @ubi: UBI device description object
508  *
509  * This function is called after each erase operation and removes PEBs from the
510  * tail of the protection queue. These PEBs have been protected for long enough
511  * and should be moved to the used tree.
512  */
serve_prot_queue(struct ubi_device * ubi)513 static void serve_prot_queue(struct ubi_device *ubi)
514 {
515 	struct ubi_wl_entry *e, *tmp;
516 	int count;
517 
518 	/*
519 	 * There may be several protected physical eraseblock to remove,
520 	 * process them all.
521 	 */
522 repeat:
523 	count = 0;
524 	spin_lock(&ubi->wl_lock);
525 	list_for_each_entry_safe(e, tmp, &ubi->pq[ubi->pq_head], u.list) {
526 		dbg_wl("PEB %d EC %d protection over, move to used tree",
527 			e->pnum, e->ec);
528 
529 		list_del(&e->u.list);
530 		wl_tree_add(e, &ubi->used);
531 		if (count++ > 32) {
532 			/*
533 			 * Let's be nice and avoid holding the spinlock for
534 			 * too long.
535 			 */
536 			spin_unlock(&ubi->wl_lock);
537 			cond_resched();
538 			goto repeat;
539 		}
540 	}
541 
542 	ubi->pq_head += 1;
543 	if (ubi->pq_head == UBI_PROT_QUEUE_LEN)
544 		ubi->pq_head = 0;
545 	ubi_assert(ubi->pq_head >= 0 && ubi->pq_head < UBI_PROT_QUEUE_LEN);
546 	spin_unlock(&ubi->wl_lock);
547 }
548 
549 /**
550  * __schedule_ubi_work - schedule a work.
551  * @ubi: UBI device description object
552  * @wrk: the work to schedule
553  *
554  * This function adds a work defined by @wrk to the tail of the pending works
555  * list. Can only be used if ubi->work_sem is already held in read mode!
556  */
__schedule_ubi_work(struct ubi_device * ubi,struct ubi_work * wrk)557 static void __schedule_ubi_work(struct ubi_device *ubi, struct ubi_work *wrk)
558 {
559 	spin_lock(&ubi->wl_lock);
560 	list_add_tail(&wrk->list, &ubi->works);
561 	ubi_assert(ubi->works_count >= 0);
562 	ubi->works_count += 1;
563 	if (ubi->thread_enabled && !ubi_dbg_is_bgt_disabled(ubi))
564 		wake_up_process(ubi->bgt_thread);
565 	spin_unlock(&ubi->wl_lock);
566 }
567 
568 /**
569  * schedule_ubi_work - schedule a work.
570  * @ubi: UBI device description object
571  * @wrk: the work to schedule
572  *
573  * This function adds a work defined by @wrk to the tail of the pending works
574  * list.
575  */
schedule_ubi_work(struct ubi_device * ubi,struct ubi_work * wrk)576 static void schedule_ubi_work(struct ubi_device *ubi, struct ubi_work *wrk)
577 {
578 	down_read(&ubi->work_sem);
579 	__schedule_ubi_work(ubi, wrk);
580 	up_read(&ubi->work_sem);
581 }
582 
583 static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
584 			int shutdown);
585 
586 /**
587  * schedule_erase - schedule an erase work.
588  * @ubi: UBI device description object
589  * @e: the WL entry of the physical eraseblock to erase
590  * @vol_id: the volume ID that last used this PEB
591  * @lnum: the last used logical eraseblock number for the PEB
592  * @torture: if the physical eraseblock has to be tortured
593  * @nested: denotes whether the work_sem is already held
594  *
595  * This function returns zero in case of success and a %-ENOMEM in case of
596  * failure.
597  */
schedule_erase(struct ubi_device * ubi,struct ubi_wl_entry * e,int vol_id,int lnum,int torture,bool nested)598 static int schedule_erase(struct ubi_device *ubi, struct ubi_wl_entry *e,
599 			  int vol_id, int lnum, int torture, bool nested)
600 {
601 	struct ubi_work *wl_wrk;
602 
603 	ubi_assert(e);
604 
605 	dbg_wl("schedule erasure of PEB %d, EC %d, torture %d",
606 	       e->pnum, e->ec, torture);
607 
608 	wl_wrk = kmalloc(sizeof(struct ubi_work), GFP_NOFS);
609 	if (!wl_wrk)
610 		return -ENOMEM;
611 
612 	wl_wrk->func = &erase_worker;
613 	wl_wrk->e = e;
614 	wl_wrk->vol_id = vol_id;
615 	wl_wrk->lnum = lnum;
616 	wl_wrk->torture = torture;
617 
618 	if (nested)
619 		__schedule_ubi_work(ubi, wl_wrk);
620 	else
621 		schedule_ubi_work(ubi, wl_wrk);
622 	return 0;
623 }
624 
625 static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk);
626 /**
627  * do_sync_erase - run the erase worker synchronously.
628  * @ubi: UBI device description object
629  * @e: the WL entry of the physical eraseblock to erase
630  * @vol_id: the volume ID that last used this PEB
631  * @lnum: the last used logical eraseblock number for the PEB
632  * @torture: if the physical eraseblock has to be tortured
633  *
634  */
do_sync_erase(struct ubi_device * ubi,struct ubi_wl_entry * e,int vol_id,int lnum,int torture)635 static int do_sync_erase(struct ubi_device *ubi, struct ubi_wl_entry *e,
636 			 int vol_id, int lnum, int torture)
637 {
638 	struct ubi_work wl_wrk;
639 
640 	dbg_wl("sync erase of PEB %i", e->pnum);
641 
642 	wl_wrk.e = e;
643 	wl_wrk.vol_id = vol_id;
644 	wl_wrk.lnum = lnum;
645 	wl_wrk.torture = torture;
646 
647 	return __erase_worker(ubi, &wl_wrk);
648 }
649 
650 static int ensure_wear_leveling(struct ubi_device *ubi, int nested);
651 /**
652  * wear_leveling_worker - wear-leveling worker function.
653  * @ubi: UBI device description object
654  * @wrk: the work object
655  * @shutdown: non-zero if the worker has to free memory and exit
656  * because the WL-subsystem is shutting down
657  *
658  * This function copies a more worn out physical eraseblock to a less worn out
659  * one. Returns zero in case of success and a negative error code in case of
660  * failure.
661  */
wear_leveling_worker(struct ubi_device * ubi,struct ubi_work * wrk,int shutdown)662 static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
663 				int shutdown)
664 {
665 	int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0;
666 	int erase = 0, keep = 0, vol_id = -1, lnum = -1;
667 	struct ubi_wl_entry *e1, *e2;
668 	struct ubi_vid_io_buf *vidb;
669 	struct ubi_vid_hdr *vid_hdr;
670 	int dst_leb_clean = 0;
671 
672 	kfree(wrk);
673 	if (shutdown)
674 		return 0;
675 
676 	vidb = ubi_alloc_vid_buf(ubi, GFP_NOFS);
677 	if (!vidb)
678 		return -ENOMEM;
679 
680 	vid_hdr = ubi_get_vid_hdr(vidb);
681 
682 	down_read(&ubi->fm_eba_sem);
683 	mutex_lock(&ubi->move_mutex);
684 	spin_lock(&ubi->wl_lock);
685 	ubi_assert(!ubi->move_from && !ubi->move_to);
686 	ubi_assert(!ubi->move_to_put);
687 
688 #ifdef CONFIG_MTD_UBI_FASTMAP
689 	if (!next_peb_for_wl(ubi, true) ||
690 #else
691 	if (!ubi->free.rb_node ||
692 #endif
693 	    (!ubi->used.rb_node && !ubi->scrub.rb_node)) {
694 		/*
695 		 * No free physical eraseblocks? Well, they must be waiting in
696 		 * the queue to be erased. Cancel movement - it will be
697 		 * triggered again when a free physical eraseblock appears.
698 		 *
699 		 * No used physical eraseblocks? They must be temporarily
700 		 * protected from being moved. They will be moved to the
701 		 * @ubi->used tree later and the wear-leveling will be
702 		 * triggered again.
703 		 */
704 		dbg_wl("cancel WL, a list is empty: free %d, used %d",
705 		       !ubi->free.rb_node, !ubi->used.rb_node);
706 		goto out_cancel;
707 	}
708 
709 #ifdef CONFIG_MTD_UBI_FASTMAP
710 	e1 = find_anchor_wl_entry(&ubi->used);
711 	if (e1 && ubi->fm_anchor &&
712 	    (ubi->fm_anchor->ec - e1->ec >= UBI_WL_THRESHOLD)) {
713 		ubi->fm_do_produce_anchor = 1;
714 		/*
715 		 * fm_anchor is no longer considered a good anchor.
716 		 * NULL assignment also prevents multiple wear level checks
717 		 * of this PEB.
718 		 */
719 		wl_tree_add(ubi->fm_anchor, &ubi->free);
720 		ubi->fm_anchor = NULL;
721 		ubi->free_count++;
722 	}
723 
724 	if (ubi->fm_do_produce_anchor) {
725 		if (!e1)
726 			goto out_cancel;
727 		e2 = get_peb_for_wl(ubi);
728 		if (!e2)
729 			goto out_cancel;
730 
731 		self_check_in_wl_tree(ubi, e1, &ubi->used);
732 		rb_erase(&e1->u.rb, &ubi->used);
733 		dbg_wl("anchor-move PEB %d to PEB %d", e1->pnum, e2->pnum);
734 		ubi->fm_do_produce_anchor = 0;
735 	} else if (!ubi->scrub.rb_node) {
736 #else
737 	if (!ubi->scrub.rb_node) {
738 #endif
739 		/*
740 		 * Now pick the least worn-out used physical eraseblock and a
741 		 * highly worn-out free physical eraseblock. If the erase
742 		 * counters differ much enough, start wear-leveling.
743 		 */
744 		e1 = rb_entry(rb_first(&ubi->used), struct ubi_wl_entry, u.rb);
745 		e2 = get_peb_for_wl(ubi);
746 		if (!e2)
747 			goto out_cancel;
748 
749 		if (!(e2->ec - e1->ec >= UBI_WL_THRESHOLD)) {
750 			dbg_wl("no WL needed: min used EC %d, max free EC %d",
751 			       e1->ec, e2->ec);
752 
753 			/* Give the unused PEB back */
754 			wl_tree_add(e2, &ubi->free);
755 			ubi->free_count++;
756 			goto out_cancel;
757 		}
758 		self_check_in_wl_tree(ubi, e1, &ubi->used);
759 		rb_erase(&e1->u.rb, &ubi->used);
760 		dbg_wl("move PEB %d EC %d to PEB %d EC %d",
761 		       e1->pnum, e1->ec, e2->pnum, e2->ec);
762 	} else {
763 		/* Perform scrubbing */
764 		scrubbing = 1;
765 		e1 = rb_entry(rb_first(&ubi->scrub), struct ubi_wl_entry, u.rb);
766 		e2 = get_peb_for_wl(ubi);
767 		if (!e2)
768 			goto out_cancel;
769 
770 		self_check_in_wl_tree(ubi, e1, &ubi->scrub);
771 		rb_erase(&e1->u.rb, &ubi->scrub);
772 		dbg_wl("scrub PEB %d to PEB %d", e1->pnum, e2->pnum);
773 	}
774 
775 	ubi->move_from = e1;
776 	ubi->move_to = e2;
777 	spin_unlock(&ubi->wl_lock);
778 
779 	/*
780 	 * Now we are going to copy physical eraseblock @e1->pnum to @e2->pnum.
781 	 * We so far do not know which logical eraseblock our physical
782 	 * eraseblock (@e1) belongs to. We have to read the volume identifier
783 	 * header first.
784 	 *
785 	 * Note, we are protected from this PEB being unmapped and erased. The
786 	 * 'ubi_wl_put_peb()' would wait for moving to be finished if the PEB
787 	 * which is being moved was unmapped.
788 	 */
789 
790 	err = ubi_io_read_vid_hdr(ubi, e1->pnum, vidb, 0);
791 	if (err && err != UBI_IO_BITFLIPS) {
792 		dst_leb_clean = 1;
793 		if (err == UBI_IO_FF) {
794 			/*
795 			 * We are trying to move PEB without a VID header. UBI
796 			 * always write VID headers shortly after the PEB was
797 			 * given, so we have a situation when it has not yet
798 			 * had a chance to write it, because it was preempted.
799 			 * So add this PEB to the protection queue so far,
800 			 * because presumably more data will be written there
801 			 * (including the missing VID header), and then we'll
802 			 * move it.
803 			 */
804 			dbg_wl("PEB %d has no VID header", e1->pnum);
805 			protect = 1;
806 			goto out_not_moved;
807 		} else if (err == UBI_IO_FF_BITFLIPS) {
808 			/*
809 			 * The same situation as %UBI_IO_FF, but bit-flips were
810 			 * detected. It is better to schedule this PEB for
811 			 * scrubbing.
812 			 */
813 			dbg_wl("PEB %d has no VID header but has bit-flips",
814 			       e1->pnum);
815 			scrubbing = 1;
816 			goto out_not_moved;
817 		} else if (ubi->fast_attach && err == UBI_IO_BAD_HDR_EBADMSG) {
818 			/*
819 			 * While a full scan would detect interrupted erasures
820 			 * at attach time we can face them here when attached from
821 			 * Fastmap.
822 			 */
823 			dbg_wl("PEB %d has ECC errors, maybe from an interrupted erasure",
824 			       e1->pnum);
825 			erase = 1;
826 			goto out_not_moved;
827 		}
828 
829 		ubi_err(ubi, "error %d while reading VID header from PEB %d",
830 			err, e1->pnum);
831 		goto out_error;
832 	}
833 
834 	vol_id = be32_to_cpu(vid_hdr->vol_id);
835 	lnum = be32_to_cpu(vid_hdr->lnum);
836 
837 	err = ubi_eba_copy_leb(ubi, e1->pnum, e2->pnum, vidb);
838 	if (err) {
839 		if (err == MOVE_CANCEL_RACE) {
840 			/*
841 			 * The LEB has not been moved because the volume is
842 			 * being deleted or the PEB has been put meanwhile. We
843 			 * should prevent this PEB from being selected for
844 			 * wear-leveling movement again, so put it to the
845 			 * protection queue.
846 			 */
847 			protect = 1;
848 			dst_leb_clean = 1;
849 			goto out_not_moved;
850 		}
851 		if (err == MOVE_RETRY) {
852 			/*
853 			 * For source PEB:
854 			 * 1. The scrubbing is set for scrub type PEB, it will
855 			 *    be put back into ubi->scrub list.
856 			 * 2. Non-scrub type PEB will be put back into ubi->used
857 			 *    list.
858 			 */
859 			keep = 1;
860 			dst_leb_clean = 1;
861 			goto out_not_moved;
862 		}
863 		if (err == MOVE_TARGET_BITFLIPS || err == MOVE_TARGET_WR_ERR ||
864 		    err == MOVE_TARGET_RD_ERR) {
865 			/*
866 			 * Target PEB had bit-flips or write error - torture it.
867 			 */
868 			torture = 1;
869 			keep = 1;
870 			goto out_not_moved;
871 		}
872 
873 		if (err == MOVE_SOURCE_RD_ERR) {
874 			/*
875 			 * An error happened while reading the source PEB. Do
876 			 * not switch to R/O mode in this case, and give the
877 			 * upper layers a possibility to recover from this,
878 			 * e.g. by unmapping corresponding LEB. Instead, just
879 			 * put this PEB to the @ubi->erroneous list to prevent
880 			 * UBI from trying to move it over and over again.
881 			 */
882 			if (ubi->erroneous_peb_count > ubi->max_erroneous) {
883 				ubi_err(ubi, "too many erroneous eraseblocks (%d)",
884 					ubi->erroneous_peb_count);
885 				goto out_error;
886 			}
887 			dst_leb_clean = 1;
888 			erroneous = 1;
889 			goto out_not_moved;
890 		}
891 
892 		if (err < 0)
893 			goto out_error;
894 
895 		ubi_assert(0);
896 	}
897 
898 	/* The PEB has been successfully moved */
899 	if (scrubbing)
900 		ubi_msg(ubi, "scrubbed PEB %d (LEB %d:%d), data moved to PEB %d",
901 			e1->pnum, vol_id, lnum, e2->pnum);
902 	ubi_free_vid_buf(vidb);
903 
904 	spin_lock(&ubi->wl_lock);
905 	if (!ubi->move_to_put) {
906 		wl_tree_add(e2, &ubi->used);
907 		e2 = NULL;
908 	}
909 	ubi->move_from = ubi->move_to = NULL;
910 	ubi->move_to_put = ubi->wl_scheduled = 0;
911 	spin_unlock(&ubi->wl_lock);
912 
913 	err = do_sync_erase(ubi, e1, vol_id, lnum, 0);
914 	if (err) {
915 		if (e2) {
916 			spin_lock(&ubi->wl_lock);
917 			wl_entry_destroy(ubi, e2);
918 			spin_unlock(&ubi->wl_lock);
919 		}
920 		goto out_ro;
921 	}
922 
923 	if (e2) {
924 		/*
925 		 * Well, the target PEB was put meanwhile, schedule it for
926 		 * erasure.
927 		 */
928 		dbg_wl("PEB %d (LEB %d:%d) was put meanwhile, erase",
929 		       e2->pnum, vol_id, lnum);
930 		err = do_sync_erase(ubi, e2, vol_id, lnum, 0);
931 		if (err)
932 			goto out_ro;
933 	}
934 
935 	dbg_wl("done");
936 	mutex_unlock(&ubi->move_mutex);
937 	up_read(&ubi->fm_eba_sem);
938 	return 0;
939 
940 	/*
941 	 * For some reasons the LEB was not moved, might be an error, might be
942 	 * something else. @e1 was not changed, so return it back. @e2 might
943 	 * have been changed, schedule it for erasure.
944 	 */
945 out_not_moved:
946 	if (vol_id != -1)
947 		dbg_wl("cancel moving PEB %d (LEB %d:%d) to PEB %d (%d)",
948 		       e1->pnum, vol_id, lnum, e2->pnum, err);
949 	else
950 		dbg_wl("cancel moving PEB %d to PEB %d (%d)",
951 		       e1->pnum, e2->pnum, err);
952 	spin_lock(&ubi->wl_lock);
953 	if (protect)
954 		prot_queue_add(ubi, e1);
955 	else if (erroneous) {
956 		wl_tree_add(e1, &ubi->erroneous);
957 		ubi->erroneous_peb_count += 1;
958 	} else if (scrubbing)
959 		wl_tree_add(e1, &ubi->scrub);
960 	else if (keep)
961 		wl_tree_add(e1, &ubi->used);
962 	if (dst_leb_clean) {
963 		wl_tree_add(e2, &ubi->free);
964 		ubi->free_count++;
965 	}
966 
967 	ubi_assert(!ubi->move_to_put);
968 	ubi->move_from = ubi->move_to = NULL;
969 	ubi->wl_scheduled = 0;
970 	spin_unlock(&ubi->wl_lock);
971 
972 	ubi_free_vid_buf(vidb);
973 	if (dst_leb_clean) {
974 		ensure_wear_leveling(ubi, 1);
975 	} else {
976 		err = do_sync_erase(ubi, e2, vol_id, lnum, torture);
977 		if (err)
978 			goto out_ro;
979 	}
980 
981 	if (erase) {
982 		err = do_sync_erase(ubi, e1, vol_id, lnum, 1);
983 		if (err)
984 			goto out_ro;
985 	}
986 
987 	mutex_unlock(&ubi->move_mutex);
988 	up_read(&ubi->fm_eba_sem);
989 	return 0;
990 
991 out_error:
992 	if (vol_id != -1)
993 		ubi_err(ubi, "error %d while moving PEB %d to PEB %d",
994 			err, e1->pnum, e2->pnum);
995 	else
996 		ubi_err(ubi, "error %d while moving PEB %d (LEB %d:%d) to PEB %d",
997 			err, e1->pnum, vol_id, lnum, e2->pnum);
998 	spin_lock(&ubi->wl_lock);
999 	ubi->move_from = ubi->move_to = NULL;
1000 	ubi->move_to_put = ubi->wl_scheduled = 0;
1001 	wl_entry_destroy(ubi, e1);
1002 	wl_entry_destroy(ubi, e2);
1003 	spin_unlock(&ubi->wl_lock);
1004 
1005 	ubi_free_vid_buf(vidb);
1006 
1007 out_ro:
1008 	ubi_ro_mode(ubi);
1009 	mutex_unlock(&ubi->move_mutex);
1010 	up_read(&ubi->fm_eba_sem);
1011 	ubi_assert(err != 0);
1012 	return err < 0 ? err : -EIO;
1013 
1014 out_cancel:
1015 	ubi->wl_scheduled = 0;
1016 	spin_unlock(&ubi->wl_lock);
1017 	mutex_unlock(&ubi->move_mutex);
1018 	up_read(&ubi->fm_eba_sem);
1019 	ubi_free_vid_buf(vidb);
1020 	return 0;
1021 }
1022 
1023 /**
1024  * ensure_wear_leveling - schedule wear-leveling if it is needed.
1025  * @ubi: UBI device description object
1026  * @nested: set to non-zero if this function is called from UBI worker
1027  *
1028  * This function checks if it is time to start wear-leveling and schedules it
1029  * if yes. This function returns zero in case of success and a negative error
1030  * code in case of failure.
1031  */
1032 static int ensure_wear_leveling(struct ubi_device *ubi, int nested)
1033 {
1034 	int err = 0;
1035 	struct ubi_work *wrk;
1036 
1037 	spin_lock(&ubi->wl_lock);
1038 	if (ubi->wl_scheduled)
1039 		/* Wear-leveling is already in the work queue */
1040 		goto out_unlock;
1041 
1042 	/*
1043 	 * If the ubi->scrub tree is not empty, scrubbing is needed, and the
1044 	 * WL worker has to be scheduled anyway.
1045 	 */
1046 	if (!ubi->scrub.rb_node) {
1047 #ifdef CONFIG_MTD_UBI_FASTMAP
1048 		if (!need_wear_leveling(ubi))
1049 			goto out_unlock;
1050 #else
1051 		struct ubi_wl_entry *e1;
1052 		struct ubi_wl_entry *e2;
1053 
1054 		if (!ubi->used.rb_node || !ubi->free.rb_node)
1055 			/* No physical eraseblocks - no deal */
1056 			goto out_unlock;
1057 
1058 		/*
1059 		 * We schedule wear-leveling only if the difference between the
1060 		 * lowest erase counter of used physical eraseblocks and a high
1061 		 * erase counter of free physical eraseblocks is greater than
1062 		 * %UBI_WL_THRESHOLD.
1063 		 */
1064 		e1 = rb_entry(rb_first(&ubi->used), struct ubi_wl_entry, u.rb);
1065 		e2 = find_wl_entry(ubi, &ubi->free, WL_FREE_MAX_DIFF, 0);
1066 
1067 		if (!(e2->ec - e1->ec >= UBI_WL_THRESHOLD))
1068 			goto out_unlock;
1069 #endif
1070 		dbg_wl("schedule wear-leveling");
1071 	} else
1072 		dbg_wl("schedule scrubbing");
1073 
1074 	ubi->wl_scheduled = 1;
1075 	spin_unlock(&ubi->wl_lock);
1076 
1077 	wrk = kmalloc(sizeof(struct ubi_work), GFP_NOFS);
1078 	if (!wrk) {
1079 		err = -ENOMEM;
1080 		goto out_cancel;
1081 	}
1082 
1083 	wrk->func = &wear_leveling_worker;
1084 	if (nested)
1085 		__schedule_ubi_work(ubi, wrk);
1086 	else
1087 		schedule_ubi_work(ubi, wrk);
1088 	return err;
1089 
1090 out_cancel:
1091 	spin_lock(&ubi->wl_lock);
1092 	ubi->wl_scheduled = 0;
1093 out_unlock:
1094 	spin_unlock(&ubi->wl_lock);
1095 	return err;
1096 }
1097 
1098 /**
1099  * __erase_worker - physical eraseblock erase worker function.
1100  * @ubi: UBI device description object
1101  * @wl_wrk: the work object
1102  *
1103  * This function erases a physical eraseblock and perform torture testing if
1104  * needed. It also takes care about marking the physical eraseblock bad if
1105  * needed. Returns zero in case of success and a negative error code in case of
1106  * failure.
1107  */
1108 static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk)
1109 {
1110 	struct ubi_wl_entry *e = wl_wrk->e;
1111 	int pnum = e->pnum;
1112 	int vol_id = wl_wrk->vol_id;
1113 	int lnum = wl_wrk->lnum;
1114 	int err, available_consumed = 0;
1115 
1116 	dbg_wl("erase PEB %d EC %d LEB %d:%d",
1117 	       pnum, e->ec, wl_wrk->vol_id, wl_wrk->lnum);
1118 
1119 	err = ubi_sync_erase(ubi, e, wl_wrk->torture);
1120 	if (!err) {
1121 		spin_lock(&ubi->wl_lock);
1122 
1123 		if (!ubi->fm_disabled && !ubi->fm_anchor &&
1124 		    e->pnum < UBI_FM_MAX_START) {
1125 			/*
1126 			 * Abort anchor production, if needed it will be
1127 			 * enabled again in the wear leveling started below.
1128 			 */
1129 			ubi->fm_anchor = e;
1130 			ubi->fm_do_produce_anchor = 0;
1131 		} else {
1132 			wl_tree_add(e, &ubi->free);
1133 			ubi->free_count++;
1134 		}
1135 
1136 		spin_unlock(&ubi->wl_lock);
1137 
1138 		/*
1139 		 * One more erase operation has happened, take care about
1140 		 * protected physical eraseblocks.
1141 		 */
1142 		serve_prot_queue(ubi);
1143 
1144 		/* And take care about wear-leveling */
1145 		err = ensure_wear_leveling(ubi, 1);
1146 		return err;
1147 	}
1148 
1149 	ubi_err(ubi, "failed to erase PEB %d, error %d", pnum, err);
1150 
1151 	if (err == -EINTR || err == -ENOMEM || err == -EAGAIN ||
1152 	    err == -EBUSY) {
1153 		int err1;
1154 
1155 		/* Re-schedule the LEB for erasure */
1156 		err1 = schedule_erase(ubi, e, vol_id, lnum, 0, true);
1157 		if (err1) {
1158 			spin_lock(&ubi->wl_lock);
1159 			wl_entry_destroy(ubi, e);
1160 			spin_unlock(&ubi->wl_lock);
1161 			err = err1;
1162 			goto out_ro;
1163 		}
1164 		return err;
1165 	}
1166 
1167 	spin_lock(&ubi->wl_lock);
1168 	wl_entry_destroy(ubi, e);
1169 	spin_unlock(&ubi->wl_lock);
1170 	if (err != -EIO)
1171 		/*
1172 		 * If this is not %-EIO, we have no idea what to do. Scheduling
1173 		 * this physical eraseblock for erasure again would cause
1174 		 * errors again and again. Well, lets switch to R/O mode.
1175 		 */
1176 		goto out_ro;
1177 
1178 	/* It is %-EIO, the PEB went bad */
1179 
1180 	if (!ubi->bad_allowed) {
1181 		ubi_err(ubi, "bad physical eraseblock %d detected", pnum);
1182 		goto out_ro;
1183 	}
1184 
1185 	spin_lock(&ubi->volumes_lock);
1186 	if (ubi->beb_rsvd_pebs == 0) {
1187 		if (ubi->avail_pebs == 0) {
1188 			spin_unlock(&ubi->volumes_lock);
1189 			ubi_err(ubi, "no reserved/available physical eraseblocks");
1190 			goto out_ro;
1191 		}
1192 		ubi->avail_pebs -= 1;
1193 		available_consumed = 1;
1194 	}
1195 	spin_unlock(&ubi->volumes_lock);
1196 
1197 	ubi_msg(ubi, "mark PEB %d as bad", pnum);
1198 	err = ubi_io_mark_bad(ubi, pnum);
1199 	if (err)
1200 		goto out_ro;
1201 
1202 	spin_lock(&ubi->volumes_lock);
1203 	if (ubi->beb_rsvd_pebs > 0) {
1204 		if (available_consumed) {
1205 			/*
1206 			 * The amount of reserved PEBs increased since we last
1207 			 * checked.
1208 			 */
1209 			ubi->avail_pebs += 1;
1210 			available_consumed = 0;
1211 		}
1212 		ubi->beb_rsvd_pebs -= 1;
1213 	}
1214 	ubi->bad_peb_count += 1;
1215 	ubi->good_peb_count -= 1;
1216 	ubi_calculate_reserved(ubi);
1217 	if (available_consumed)
1218 		ubi_warn(ubi, "no PEBs in the reserved pool, used an available PEB");
1219 	else if (ubi->beb_rsvd_pebs)
1220 		ubi_msg(ubi, "%d PEBs left in the reserve",
1221 			ubi->beb_rsvd_pebs);
1222 	else
1223 		ubi_warn(ubi, "last PEB from the reserve was used");
1224 	spin_unlock(&ubi->volumes_lock);
1225 
1226 	return err;
1227 
1228 out_ro:
1229 	if (available_consumed) {
1230 		spin_lock(&ubi->volumes_lock);
1231 		ubi->avail_pebs += 1;
1232 		spin_unlock(&ubi->volumes_lock);
1233 	}
1234 	ubi_ro_mode(ubi);
1235 	return err;
1236 }
1237 
1238 static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
1239 			  int shutdown)
1240 {
1241 	int ret;
1242 
1243 	if (shutdown) {
1244 		struct ubi_wl_entry *e = wl_wrk->e;
1245 
1246 		dbg_wl("cancel erasure of PEB %d EC %d", e->pnum, e->ec);
1247 		kfree(wl_wrk);
1248 		wl_entry_destroy(ubi, e);
1249 		return 0;
1250 	}
1251 
1252 	ret = __erase_worker(ubi, wl_wrk);
1253 	kfree(wl_wrk);
1254 	return ret;
1255 }
1256 
1257 /**
1258  * ubi_wl_put_peb - return a PEB to the wear-leveling sub-system.
1259  * @ubi: UBI device description object
1260  * @vol_id: the volume ID that last used this PEB
1261  * @lnum: the last used logical eraseblock number for the PEB
1262  * @pnum: physical eraseblock to return
1263  * @torture: if this physical eraseblock has to be tortured
1264  *
1265  * This function is called to return physical eraseblock @pnum to the pool of
1266  * free physical eraseblocks. The @torture flag has to be set if an I/O error
1267  * occurred to this @pnum and it has to be tested. This function returns zero
1268  * in case of success, and a negative error code in case of failure.
1269  */
1270 int ubi_wl_put_peb(struct ubi_device *ubi, int vol_id, int lnum,
1271 		   int pnum, int torture)
1272 {
1273 	int err;
1274 	struct ubi_wl_entry *e;
1275 
1276 	dbg_wl("PEB %d", pnum);
1277 	ubi_assert(pnum >= 0);
1278 	ubi_assert(pnum < ubi->peb_count);
1279 
1280 	down_read(&ubi->fm_protect);
1281 
1282 retry:
1283 	spin_lock(&ubi->wl_lock);
1284 	e = ubi->lookuptbl[pnum];
1285 	if (!e) {
1286 		/*
1287 		 * This wl entry has been removed for some errors by other
1288 		 * process (eg. wear leveling worker), corresponding process
1289 		 * (except __erase_worker, which cannot concurrent with
1290 		 * ubi_wl_put_peb) will set ubi ro_mode at the same time,
1291 		 * just ignore this wl entry.
1292 		 */
1293 		spin_unlock(&ubi->wl_lock);
1294 		up_read(&ubi->fm_protect);
1295 		return 0;
1296 	}
1297 	if (e == ubi->move_from) {
1298 		/*
1299 		 * User is putting the physical eraseblock which was selected to
1300 		 * be moved. It will be scheduled for erasure in the
1301 		 * wear-leveling worker.
1302 		 */
1303 		dbg_wl("PEB %d is being moved, wait", pnum);
1304 		spin_unlock(&ubi->wl_lock);
1305 
1306 		/* Wait for the WL worker by taking the @ubi->move_mutex */
1307 		mutex_lock(&ubi->move_mutex);
1308 		mutex_unlock(&ubi->move_mutex);
1309 		goto retry;
1310 	} else if (e == ubi->move_to) {
1311 		/*
1312 		 * User is putting the physical eraseblock which was selected
1313 		 * as the target the data is moved to. It may happen if the EBA
1314 		 * sub-system already re-mapped the LEB in 'ubi_eba_copy_leb()'
1315 		 * but the WL sub-system has not put the PEB to the "used" tree
1316 		 * yet, but it is about to do this. So we just set a flag which
1317 		 * will tell the WL worker that the PEB is not needed anymore
1318 		 * and should be scheduled for erasure.
1319 		 */
1320 		dbg_wl("PEB %d is the target of data moving", pnum);
1321 		ubi_assert(!ubi->move_to_put);
1322 		ubi->move_to_put = 1;
1323 		spin_unlock(&ubi->wl_lock);
1324 		up_read(&ubi->fm_protect);
1325 		return 0;
1326 	} else {
1327 		if (in_wl_tree(e, &ubi->used)) {
1328 			self_check_in_wl_tree(ubi, e, &ubi->used);
1329 			rb_erase(&e->u.rb, &ubi->used);
1330 		} else if (in_wl_tree(e, &ubi->scrub)) {
1331 			self_check_in_wl_tree(ubi, e, &ubi->scrub);
1332 			rb_erase(&e->u.rb, &ubi->scrub);
1333 		} else if (in_wl_tree(e, &ubi->erroneous)) {
1334 			self_check_in_wl_tree(ubi, e, &ubi->erroneous);
1335 			rb_erase(&e->u.rb, &ubi->erroneous);
1336 			ubi->erroneous_peb_count -= 1;
1337 			ubi_assert(ubi->erroneous_peb_count >= 0);
1338 			/* Erroneous PEBs should be tortured */
1339 			torture = 1;
1340 		} else {
1341 			err = prot_queue_del(ubi, e->pnum);
1342 			if (err) {
1343 				ubi_err(ubi, "PEB %d not found", pnum);
1344 				ubi_ro_mode(ubi);
1345 				spin_unlock(&ubi->wl_lock);
1346 				up_read(&ubi->fm_protect);
1347 				return err;
1348 			}
1349 		}
1350 	}
1351 	spin_unlock(&ubi->wl_lock);
1352 
1353 	err = schedule_erase(ubi, e, vol_id, lnum, torture, false);
1354 	if (err) {
1355 		spin_lock(&ubi->wl_lock);
1356 		wl_tree_add(e, &ubi->used);
1357 		spin_unlock(&ubi->wl_lock);
1358 	}
1359 
1360 	up_read(&ubi->fm_protect);
1361 	return err;
1362 }
1363 
1364 /**
1365  * ubi_wl_scrub_peb - schedule a physical eraseblock for scrubbing.
1366  * @ubi: UBI device description object
1367  * @pnum: the physical eraseblock to schedule
1368  *
1369  * If a bit-flip in a physical eraseblock is detected, this physical eraseblock
1370  * needs scrubbing. This function schedules a physical eraseblock for
1371  * scrubbing which is done in background. This function returns zero in case of
1372  * success and a negative error code in case of failure.
1373  */
1374 int ubi_wl_scrub_peb(struct ubi_device *ubi, int pnum)
1375 {
1376 	struct ubi_wl_entry *e;
1377 
1378 	ubi_msg(ubi, "schedule PEB %d for scrubbing", pnum);
1379 
1380 retry:
1381 	spin_lock(&ubi->wl_lock);
1382 	e = ubi->lookuptbl[pnum];
1383 	if (e == ubi->move_from || in_wl_tree(e, &ubi->scrub) ||
1384 				   in_wl_tree(e, &ubi->erroneous)) {
1385 		spin_unlock(&ubi->wl_lock);
1386 		return 0;
1387 	}
1388 
1389 	if (e == ubi->move_to) {
1390 		/*
1391 		 * This physical eraseblock was used to move data to. The data
1392 		 * was moved but the PEB was not yet inserted to the proper
1393 		 * tree. We should just wait a little and let the WL worker
1394 		 * proceed.
1395 		 */
1396 		spin_unlock(&ubi->wl_lock);
1397 		dbg_wl("the PEB %d is not in proper tree, retry", pnum);
1398 		yield();
1399 		goto retry;
1400 	}
1401 
1402 	if (in_wl_tree(e, &ubi->used)) {
1403 		self_check_in_wl_tree(ubi, e, &ubi->used);
1404 		rb_erase(&e->u.rb, &ubi->used);
1405 	} else {
1406 		int err;
1407 
1408 		err = prot_queue_del(ubi, e->pnum);
1409 		if (err) {
1410 			ubi_err(ubi, "PEB %d not found", pnum);
1411 			ubi_ro_mode(ubi);
1412 			spin_unlock(&ubi->wl_lock);
1413 			return err;
1414 		}
1415 	}
1416 
1417 	wl_tree_add(e, &ubi->scrub);
1418 	spin_unlock(&ubi->wl_lock);
1419 
1420 	/*
1421 	 * Technically scrubbing is the same as wear-leveling, so it is done
1422 	 * by the WL worker.
1423 	 */
1424 	return ensure_wear_leveling(ubi, 0);
1425 }
1426 
1427 /**
1428  * ubi_wl_flush - flush all pending works.
1429  * @ubi: UBI device description object
1430  * @vol_id: the volume id to flush for
1431  * @lnum: the logical eraseblock number to flush for
1432  *
1433  * This function executes all pending works for a particular volume id /
1434  * logical eraseblock number pair. If either value is set to %UBI_ALL, then it
1435  * acts as a wildcard for all of the corresponding volume numbers or logical
1436  * eraseblock numbers. It returns zero in case of success and a negative error
1437  * code in case of failure.
1438  */
1439 int ubi_wl_flush(struct ubi_device *ubi, int vol_id, int lnum)
1440 {
1441 	int err = 0;
1442 	int found = 1;
1443 
1444 	/*
1445 	 * Erase while the pending works queue is not empty, but not more than
1446 	 * the number of currently pending works.
1447 	 */
1448 	dbg_wl("flush pending work for LEB %d:%d (%d pending works)",
1449 	       vol_id, lnum, ubi->works_count);
1450 
1451 	while (found) {
1452 		struct ubi_work *wrk, *tmp;
1453 		found = 0;
1454 
1455 		down_read(&ubi->work_sem);
1456 		spin_lock(&ubi->wl_lock);
1457 		list_for_each_entry_safe(wrk, tmp, &ubi->works, list) {
1458 			if ((vol_id == UBI_ALL || wrk->vol_id == vol_id) &&
1459 			    (lnum == UBI_ALL || wrk->lnum == lnum)) {
1460 				list_del(&wrk->list);
1461 				ubi->works_count -= 1;
1462 				ubi_assert(ubi->works_count >= 0);
1463 				spin_unlock(&ubi->wl_lock);
1464 
1465 				err = wrk->func(ubi, wrk, 0);
1466 				if (err) {
1467 					up_read(&ubi->work_sem);
1468 					return err;
1469 				}
1470 
1471 				spin_lock(&ubi->wl_lock);
1472 				found = 1;
1473 				break;
1474 			}
1475 		}
1476 		spin_unlock(&ubi->wl_lock);
1477 		up_read(&ubi->work_sem);
1478 	}
1479 
1480 	/*
1481 	 * Make sure all the works which have been done in parallel are
1482 	 * finished.
1483 	 */
1484 	down_write(&ubi->work_sem);
1485 	up_write(&ubi->work_sem);
1486 
1487 	return err;
1488 }
1489 
1490 static bool scrub_possible(struct ubi_device *ubi, struct ubi_wl_entry *e)
1491 {
1492 	if (in_wl_tree(e, &ubi->scrub))
1493 		return false;
1494 	else if (in_wl_tree(e, &ubi->erroneous))
1495 		return false;
1496 	else if (ubi->move_from == e)
1497 		return false;
1498 	else if (ubi->move_to == e)
1499 		return false;
1500 
1501 	return true;
1502 }
1503 
1504 /**
1505  * ubi_bitflip_check - Check an eraseblock for bitflips and scrub it if needed.
1506  * @ubi: UBI device description object
1507  * @pnum: the physical eraseblock to schedule
1508  * @force: don't read the block, assume bitflips happened and take action.
1509  *
1510  * This function reads the given eraseblock and checks if bitflips occured.
1511  * In case of bitflips, the eraseblock is scheduled for scrubbing.
1512  * If scrubbing is forced with @force, the eraseblock is not read,
1513  * but scheduled for scrubbing right away.
1514  *
1515  * Returns:
1516  * %EINVAL, PEB is out of range
1517  * %ENOENT, PEB is no longer used by UBI
1518  * %EBUSY, PEB cannot be checked now or a check is currently running on it
1519  * %EAGAIN, bit flips happened but scrubbing is currently not possible
1520  * %EUCLEAN, bit flips happened and PEB is scheduled for scrubbing
1521  * %0, no bit flips detected
1522  */
1523 int ubi_bitflip_check(struct ubi_device *ubi, int pnum, int force)
1524 {
1525 	int err = 0;
1526 	struct ubi_wl_entry *e;
1527 
1528 	if (pnum < 0 || pnum >= ubi->peb_count) {
1529 		err = -EINVAL;
1530 		goto out;
1531 	}
1532 
1533 	/*
1534 	 * Pause all parallel work, otherwise it can happen that the
1535 	 * erase worker frees a wl entry under us.
1536 	 */
1537 	down_write(&ubi->work_sem);
1538 
1539 	/*
1540 	 * Make sure that the wl entry does not change state while
1541 	 * inspecting it.
1542 	 */
1543 	spin_lock(&ubi->wl_lock);
1544 	e = ubi->lookuptbl[pnum];
1545 	if (!e) {
1546 		spin_unlock(&ubi->wl_lock);
1547 		err = -ENOENT;
1548 		goto out_resume;
1549 	}
1550 
1551 	/*
1552 	 * Does it make sense to check this PEB?
1553 	 */
1554 	if (!scrub_possible(ubi, e)) {
1555 		spin_unlock(&ubi->wl_lock);
1556 		err = -EBUSY;
1557 		goto out_resume;
1558 	}
1559 	spin_unlock(&ubi->wl_lock);
1560 
1561 	if (!force) {
1562 		mutex_lock(&ubi->buf_mutex);
1563 		err = ubi_io_read(ubi, ubi->peb_buf, pnum, 0, ubi->peb_size);
1564 		mutex_unlock(&ubi->buf_mutex);
1565 	}
1566 
1567 	if (force || err == UBI_IO_BITFLIPS) {
1568 		/*
1569 		 * Okay, bit flip happened, let's figure out what we can do.
1570 		 */
1571 		spin_lock(&ubi->wl_lock);
1572 
1573 		/*
1574 		 * Recheck. We released wl_lock, UBI might have killed the
1575 		 * wl entry under us.
1576 		 */
1577 		e = ubi->lookuptbl[pnum];
1578 		if (!e) {
1579 			spin_unlock(&ubi->wl_lock);
1580 			err = -ENOENT;
1581 			goto out_resume;
1582 		}
1583 
1584 		/*
1585 		 * Need to re-check state
1586 		 */
1587 		if (!scrub_possible(ubi, e)) {
1588 			spin_unlock(&ubi->wl_lock);
1589 			err = -EBUSY;
1590 			goto out_resume;
1591 		}
1592 
1593 		if (in_pq(ubi, e)) {
1594 			prot_queue_del(ubi, e->pnum);
1595 			wl_tree_add(e, &ubi->scrub);
1596 			spin_unlock(&ubi->wl_lock);
1597 
1598 			err = ensure_wear_leveling(ubi, 1);
1599 		} else if (in_wl_tree(e, &ubi->used)) {
1600 			rb_erase(&e->u.rb, &ubi->used);
1601 			wl_tree_add(e, &ubi->scrub);
1602 			spin_unlock(&ubi->wl_lock);
1603 
1604 			err = ensure_wear_leveling(ubi, 1);
1605 		} else if (in_wl_tree(e, &ubi->free)) {
1606 			rb_erase(&e->u.rb, &ubi->free);
1607 			ubi->free_count--;
1608 			spin_unlock(&ubi->wl_lock);
1609 
1610 			/*
1611 			 * This PEB is empty we can schedule it for
1612 			 * erasure right away. No wear leveling needed.
1613 			 */
1614 			err = schedule_erase(ubi, e, UBI_UNKNOWN, UBI_UNKNOWN,
1615 					     force ? 0 : 1, true);
1616 		} else {
1617 			spin_unlock(&ubi->wl_lock);
1618 			err = -EAGAIN;
1619 		}
1620 
1621 		if (!err && !force)
1622 			err = -EUCLEAN;
1623 	} else {
1624 		err = 0;
1625 	}
1626 
1627 out_resume:
1628 	up_write(&ubi->work_sem);
1629 out:
1630 
1631 	return err;
1632 }
1633 
1634 /**
1635  * tree_destroy - destroy an RB-tree.
1636  * @ubi: UBI device description object
1637  * @root: the root of the tree to destroy
1638  */
1639 static void tree_destroy(struct ubi_device *ubi, struct rb_root *root)
1640 {
1641 	struct rb_node *rb;
1642 	struct ubi_wl_entry *e;
1643 
1644 	rb = root->rb_node;
1645 	while (rb) {
1646 		if (rb->rb_left)
1647 			rb = rb->rb_left;
1648 		else if (rb->rb_right)
1649 			rb = rb->rb_right;
1650 		else {
1651 			e = rb_entry(rb, struct ubi_wl_entry, u.rb);
1652 
1653 			rb = rb_parent(rb);
1654 			if (rb) {
1655 				if (rb->rb_left == &e->u.rb)
1656 					rb->rb_left = NULL;
1657 				else
1658 					rb->rb_right = NULL;
1659 			}
1660 
1661 			wl_entry_destroy(ubi, e);
1662 		}
1663 	}
1664 }
1665 
1666 /**
1667  * ubi_thread - UBI background thread.
1668  * @u: the UBI device description object pointer
1669  */
1670 int ubi_thread(void *u)
1671 {
1672 	int failures = 0;
1673 	struct ubi_device *ubi = u;
1674 
1675 	ubi_msg(ubi, "background thread \"%s\" started, PID %d",
1676 		ubi->bgt_name, task_pid_nr(current));
1677 
1678 	set_freezable();
1679 	for (;;) {
1680 		int err;
1681 
1682 		if (kthread_should_stop())
1683 			break;
1684 
1685 		if (try_to_freeze())
1686 			continue;
1687 
1688 		spin_lock(&ubi->wl_lock);
1689 		if (list_empty(&ubi->works) || ubi->ro_mode ||
1690 		    !ubi->thread_enabled || ubi_dbg_is_bgt_disabled(ubi)) {
1691 			set_current_state(TASK_INTERRUPTIBLE);
1692 			spin_unlock(&ubi->wl_lock);
1693 
1694 			/*
1695 			 * Check kthread_should_stop() after we set the task
1696 			 * state to guarantee that we either see the stop bit
1697 			 * and exit or the task state is reset to runnable such
1698 			 * that it's not scheduled out indefinitely and detects
1699 			 * the stop bit at kthread_should_stop().
1700 			 */
1701 			if (kthread_should_stop()) {
1702 				set_current_state(TASK_RUNNING);
1703 				break;
1704 			}
1705 
1706 			schedule();
1707 			continue;
1708 		}
1709 		spin_unlock(&ubi->wl_lock);
1710 
1711 		err = do_work(ubi, NULL);
1712 		if (err) {
1713 			ubi_err(ubi, "%s: work failed with error code %d",
1714 				ubi->bgt_name, err);
1715 			if (failures++ > WL_MAX_FAILURES) {
1716 				/*
1717 				 * Too many failures, disable the thread and
1718 				 * switch to read-only mode.
1719 				 */
1720 				ubi_msg(ubi, "%s: %d consecutive failures",
1721 					ubi->bgt_name, WL_MAX_FAILURES);
1722 				ubi_ro_mode(ubi);
1723 				ubi->thread_enabled = 0;
1724 				continue;
1725 			}
1726 		} else
1727 			failures = 0;
1728 
1729 		cond_resched();
1730 	}
1731 
1732 	dbg_wl("background thread \"%s\" is killed", ubi->bgt_name);
1733 	ubi->thread_enabled = 0;
1734 	return 0;
1735 }
1736 
1737 /**
1738  * shutdown_work - shutdown all pending works.
1739  * @ubi: UBI device description object
1740  */
1741 static void shutdown_work(struct ubi_device *ubi)
1742 {
1743 	while (!list_empty(&ubi->works)) {
1744 		struct ubi_work *wrk;
1745 
1746 		wrk = list_entry(ubi->works.next, struct ubi_work, list);
1747 		list_del(&wrk->list);
1748 		wrk->func(ubi, wrk, 1);
1749 		ubi->works_count -= 1;
1750 		ubi_assert(ubi->works_count >= 0);
1751 	}
1752 }
1753 
1754 /**
1755  * erase_aeb - erase a PEB given in UBI attach info PEB
1756  * @ubi: UBI device description object
1757  * @aeb: UBI attach info PEB
1758  * @sync: If true, erase synchronously. Otherwise schedule for erasure
1759  */
1760 static int erase_aeb(struct ubi_device *ubi, struct ubi_ainf_peb *aeb, bool sync)
1761 {
1762 	struct ubi_wl_entry *e;
1763 	int err;
1764 
1765 	e = kmem_cache_alloc(ubi_wl_entry_slab, GFP_KERNEL);
1766 	if (!e)
1767 		return -ENOMEM;
1768 
1769 	e->pnum = aeb->pnum;
1770 	e->ec = aeb->ec;
1771 	ubi->lookuptbl[e->pnum] = e;
1772 
1773 	if (sync) {
1774 		err = ubi_sync_erase(ubi, e, false);
1775 		if (err)
1776 			goto out_free;
1777 
1778 		wl_tree_add(e, &ubi->free);
1779 		ubi->free_count++;
1780 	} else {
1781 		err = schedule_erase(ubi, e, aeb->vol_id, aeb->lnum, 0, false);
1782 		if (err)
1783 			goto out_free;
1784 	}
1785 
1786 	return 0;
1787 
1788 out_free:
1789 	wl_entry_destroy(ubi, e);
1790 
1791 	return err;
1792 }
1793 
1794 /**
1795  * ubi_wl_init - initialize the WL sub-system using attaching information.
1796  * @ubi: UBI device description object
1797  * @ai: attaching information
1798  *
1799  * This function returns zero in case of success, and a negative error code in
1800  * case of failure.
1801  */
1802 int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai)
1803 {
1804 	int err, i, reserved_pebs, found_pebs = 0;
1805 	struct rb_node *rb1, *rb2;
1806 	struct ubi_ainf_volume *av;
1807 	struct ubi_ainf_peb *aeb, *tmp;
1808 	struct ubi_wl_entry *e;
1809 
1810 	ubi->used = ubi->erroneous = ubi->free = ubi->scrub = RB_ROOT;
1811 	spin_lock_init(&ubi->wl_lock);
1812 	mutex_init(&ubi->move_mutex);
1813 	init_rwsem(&ubi->work_sem);
1814 	ubi->max_ec = ai->max_ec;
1815 	INIT_LIST_HEAD(&ubi->works);
1816 
1817 	sprintf(ubi->bgt_name, UBI_BGT_NAME_PATTERN, ubi->ubi_num);
1818 
1819 	err = -ENOMEM;
1820 	ubi->lookuptbl = kcalloc(ubi->peb_count, sizeof(void *), GFP_KERNEL);
1821 	if (!ubi->lookuptbl)
1822 		return err;
1823 
1824 	for (i = 0; i < UBI_PROT_QUEUE_LEN; i++)
1825 		INIT_LIST_HEAD(&ubi->pq[i]);
1826 	ubi->pq_head = 0;
1827 
1828 	ubi->free_count = 0;
1829 	list_for_each_entry_safe(aeb, tmp, &ai->erase, u.list) {
1830 		cond_resched();
1831 
1832 		err = erase_aeb(ubi, aeb, false);
1833 		if (err)
1834 			goto out_free;
1835 
1836 		found_pebs++;
1837 	}
1838 
1839 	list_for_each_entry(aeb, &ai->free, u.list) {
1840 		cond_resched();
1841 
1842 		e = kmem_cache_alloc(ubi_wl_entry_slab, GFP_KERNEL);
1843 		if (!e) {
1844 			err = -ENOMEM;
1845 			goto out_free;
1846 		}
1847 
1848 		e->pnum = aeb->pnum;
1849 		e->ec = aeb->ec;
1850 		ubi_assert(e->ec >= 0);
1851 
1852 		wl_tree_add(e, &ubi->free);
1853 		ubi->free_count++;
1854 
1855 		ubi->lookuptbl[e->pnum] = e;
1856 
1857 		found_pebs++;
1858 	}
1859 
1860 	ubi_rb_for_each_entry(rb1, av, &ai->volumes, rb) {
1861 		ubi_rb_for_each_entry(rb2, aeb, &av->root, u.rb) {
1862 			cond_resched();
1863 
1864 			e = kmem_cache_alloc(ubi_wl_entry_slab, GFP_KERNEL);
1865 			if (!e) {
1866 				err = -ENOMEM;
1867 				goto out_free;
1868 			}
1869 
1870 			e->pnum = aeb->pnum;
1871 			e->ec = aeb->ec;
1872 			ubi->lookuptbl[e->pnum] = e;
1873 
1874 			if (!aeb->scrub) {
1875 				dbg_wl("add PEB %d EC %d to the used tree",
1876 				       e->pnum, e->ec);
1877 				wl_tree_add(e, &ubi->used);
1878 			} else {
1879 				dbg_wl("add PEB %d EC %d to the scrub tree",
1880 				       e->pnum, e->ec);
1881 				wl_tree_add(e, &ubi->scrub);
1882 			}
1883 
1884 			found_pebs++;
1885 		}
1886 	}
1887 
1888 	list_for_each_entry(aeb, &ai->fastmap, u.list) {
1889 		cond_resched();
1890 
1891 		e = ubi_find_fm_block(ubi, aeb->pnum);
1892 
1893 		if (e) {
1894 			ubi_assert(!ubi->lookuptbl[e->pnum]);
1895 			ubi->lookuptbl[e->pnum] = e;
1896 		} else {
1897 			bool sync = false;
1898 
1899 			/*
1900 			 * Usually old Fastmap PEBs are scheduled for erasure
1901 			 * and we don't have to care about them but if we face
1902 			 * an power cut before scheduling them we need to
1903 			 * take care of them here.
1904 			 */
1905 			if (ubi->lookuptbl[aeb->pnum])
1906 				continue;
1907 
1908 			/*
1909 			 * The fastmap update code might not find a free PEB for
1910 			 * writing the fastmap anchor to and then reuses the
1911 			 * current fastmap anchor PEB. When this PEB gets erased
1912 			 * and a power cut happens before it is written again we
1913 			 * must make sure that the fastmap attach code doesn't
1914 			 * find any outdated fastmap anchors, hence we erase the
1915 			 * outdated fastmap anchor PEBs synchronously here.
1916 			 */
1917 			if (aeb->vol_id == UBI_FM_SB_VOLUME_ID)
1918 				sync = true;
1919 
1920 			err = erase_aeb(ubi, aeb, sync);
1921 			if (err)
1922 				goto out_free;
1923 		}
1924 
1925 		found_pebs++;
1926 	}
1927 
1928 	dbg_wl("found %i PEBs", found_pebs);
1929 
1930 	ubi_assert(ubi->good_peb_count == found_pebs);
1931 
1932 	reserved_pebs = WL_RESERVED_PEBS;
1933 	ubi_fastmap_init(ubi, &reserved_pebs);
1934 
1935 	if (ubi->avail_pebs < reserved_pebs) {
1936 		ubi_err(ubi, "no enough physical eraseblocks (%d, need %d)",
1937 			ubi->avail_pebs, reserved_pebs);
1938 		if (ubi->corr_peb_count)
1939 			ubi_err(ubi, "%d PEBs are corrupted and not used",
1940 				ubi->corr_peb_count);
1941 		err = -ENOSPC;
1942 		goto out_free;
1943 	}
1944 	ubi->avail_pebs -= reserved_pebs;
1945 	ubi->rsvd_pebs += reserved_pebs;
1946 
1947 	/* Schedule wear-leveling if needed */
1948 	err = ensure_wear_leveling(ubi, 0);
1949 	if (err)
1950 		goto out_free;
1951 
1952 #ifdef CONFIG_MTD_UBI_FASTMAP
1953 	if (!ubi->ro_mode && !ubi->fm_disabled)
1954 		ubi_ensure_anchor_pebs(ubi);
1955 #endif
1956 
1957 	if (!ubi->wl_reboot_notifier.notifier_call) {
1958 		ubi->wl_reboot_notifier.notifier_call = ubi_wl_reboot_notifier;
1959 		ubi->wl_reboot_notifier.priority = 1; /* Higher than MTD */
1960 		register_reboot_notifier(&ubi->wl_reboot_notifier);
1961 	}
1962 
1963 	return 0;
1964 
1965 out_free:
1966 	shutdown_work(ubi);
1967 	tree_destroy(ubi, &ubi->used);
1968 	tree_destroy(ubi, &ubi->free);
1969 	tree_destroy(ubi, &ubi->scrub);
1970 	kfree(ubi->lookuptbl);
1971 	return err;
1972 }
1973 
1974 /**
1975  * protection_queue_destroy - destroy the protection queue.
1976  * @ubi: UBI device description object
1977  */
1978 static void protection_queue_destroy(struct ubi_device *ubi)
1979 {
1980 	int i;
1981 	struct ubi_wl_entry *e, *tmp;
1982 
1983 	for (i = 0; i < UBI_PROT_QUEUE_LEN; ++i) {
1984 		list_for_each_entry_safe(e, tmp, &ubi->pq[i], u.list) {
1985 			list_del(&e->u.list);
1986 			wl_entry_destroy(ubi, e);
1987 		}
1988 	}
1989 }
1990 
1991 /**
1992  * ubi_wl_close - close the wear-leveling sub-system.
1993  * @ubi: UBI device description object
1994  */
1995 void ubi_wl_close(struct ubi_device *ubi)
1996 {
1997 	dbg_wl("close the WL sub-system");
1998 	ubi_fastmap_close(ubi);
1999 	shutdown_work(ubi);
2000 	protection_queue_destroy(ubi);
2001 	tree_destroy(ubi, &ubi->used);
2002 	tree_destroy(ubi, &ubi->erroneous);
2003 	tree_destroy(ubi, &ubi->free);
2004 	tree_destroy(ubi, &ubi->scrub);
2005 	kfree(ubi->lookuptbl);
2006 }
2007 
2008 static int ubi_wl_reboot_notifier(struct notifier_block *n,
2009 				  unsigned long state, void *cmd)
2010 {
2011 	struct ubi_device *ubi;
2012 
2013 	ubi = container_of(n, struct ubi_device, wl_reboot_notifier);
2014 	ubi_wl_close(ubi);
2015 
2016 	return NOTIFY_DONE;
2017 }
2018 
2019 /**
2020  * self_check_ec - make sure that the erase counter of a PEB is correct.
2021  * @ubi: UBI device description object
2022  * @pnum: the physical eraseblock number to check
2023  * @ec: the erase counter to check
2024  *
2025  * This function returns zero if the erase counter of physical eraseblock @pnum
2026  * is equivalent to @ec, and a negative error code if not or if an error
2027  * occurred.
2028  */
2029 static int self_check_ec(struct ubi_device *ubi, int pnum, int ec)
2030 {
2031 	int err;
2032 	long long read_ec;
2033 	struct ubi_ec_hdr *ec_hdr;
2034 
2035 	if (!ubi_dbg_chk_gen(ubi))
2036 		return 0;
2037 
2038 	ec_hdr = kzalloc(ubi->ec_hdr_alsize, GFP_NOFS);
2039 	if (!ec_hdr)
2040 		return -ENOMEM;
2041 
2042 	err = ubi_io_read_ec_hdr(ubi, pnum, ec_hdr, 0);
2043 	if (err && err != UBI_IO_BITFLIPS) {
2044 		/* The header does not have to exist */
2045 		err = 0;
2046 		goto out_free;
2047 	}
2048 
2049 	read_ec = be64_to_cpu(ec_hdr->ec);
2050 	if (ec != read_ec && read_ec - ec > 1) {
2051 		ubi_err(ubi, "self-check failed for PEB %d", pnum);
2052 		ubi_err(ubi, "read EC is %lld, should be %d", read_ec, ec);
2053 		dump_stack();
2054 		err = 1;
2055 	} else
2056 		err = 0;
2057 
2058 out_free:
2059 	kfree(ec_hdr);
2060 	return err;
2061 }
2062 
2063 /**
2064  * self_check_in_wl_tree - check that wear-leveling entry is in WL RB-tree.
2065  * @ubi: UBI device description object
2066  * @e: the wear-leveling entry to check
2067  * @root: the root of the tree
2068  *
2069  * This function returns zero if @e is in the @root RB-tree and %-EINVAL if it
2070  * is not.
2071  */
2072 static int self_check_in_wl_tree(const struct ubi_device *ubi,
2073 				 struct ubi_wl_entry *e, struct rb_root *root)
2074 {
2075 	if (!ubi_dbg_chk_gen(ubi))
2076 		return 0;
2077 
2078 	if (in_wl_tree(e, root))
2079 		return 0;
2080 
2081 	ubi_err(ubi, "self-check failed for PEB %d, EC %d, RB-tree %p ",
2082 		e->pnum, e->ec, root);
2083 	dump_stack();
2084 	return -EINVAL;
2085 }
2086 
2087 /**
2088  * self_check_in_pq - check if wear-leveling entry is in the protection
2089  *                        queue.
2090  * @ubi: UBI device description object
2091  * @e: the wear-leveling entry to check
2092  *
2093  * This function returns zero if @e is in @ubi->pq and %-EINVAL if it is not.
2094  */
2095 static int self_check_in_pq(const struct ubi_device *ubi,
2096 			    struct ubi_wl_entry *e)
2097 {
2098 	if (!ubi_dbg_chk_gen(ubi))
2099 		return 0;
2100 
2101 	if (in_pq(ubi, e))
2102 		return 0;
2103 
2104 	ubi_err(ubi, "self-check failed for PEB %d, EC %d, Protect queue",
2105 		e->pnum, e->ec);
2106 	dump_stack();
2107 	return -EINVAL;
2108 }
2109 #ifndef CONFIG_MTD_UBI_FASTMAP
2110 static struct ubi_wl_entry *get_peb_for_wl(struct ubi_device *ubi)
2111 {
2112 	struct ubi_wl_entry *e;
2113 
2114 	e = find_wl_entry(ubi, &ubi->free, WL_FREE_MAX_DIFF, 0);
2115 	self_check_in_wl_tree(ubi, e, &ubi->free);
2116 	ubi->free_count--;
2117 	ubi_assert(ubi->free_count >= 0);
2118 	rb_erase(&e->u.rb, &ubi->free);
2119 
2120 	return e;
2121 }
2122 
2123 /**
2124  * produce_free_peb - produce a free physical eraseblock.
2125  * @ubi: UBI device description object
2126  *
2127  * This function tries to make a free PEB by means of synchronous execution of
2128  * pending works. This may be needed if, for example the background thread is
2129  * disabled. Returns zero in case of success and a negative error code in case
2130  * of failure.
2131  */
2132 static int produce_free_peb(struct ubi_device *ubi)
2133 {
2134 	int err;
2135 
2136 	while (!ubi->free.rb_node && ubi->works_count) {
2137 		spin_unlock(&ubi->wl_lock);
2138 
2139 		dbg_wl("do one work synchronously");
2140 		err = do_work(ubi, NULL);
2141 
2142 		spin_lock(&ubi->wl_lock);
2143 		if (err)
2144 			return err;
2145 	}
2146 
2147 	return 0;
2148 }
2149 
2150 /**
2151  * ubi_wl_get_peb - get a physical eraseblock.
2152  * @ubi: UBI device description object
2153  *
2154  * This function returns a physical eraseblock in case of success and a
2155  * negative error code in case of failure.
2156  * Returns with ubi->fm_eba_sem held in read mode!
2157  */
2158 int ubi_wl_get_peb(struct ubi_device *ubi)
2159 {
2160 	int err;
2161 	struct ubi_wl_entry *e;
2162 
2163 retry:
2164 	down_read(&ubi->fm_eba_sem);
2165 	spin_lock(&ubi->wl_lock);
2166 	if (!ubi->free.rb_node) {
2167 		if (ubi->works_count == 0) {
2168 			ubi_err(ubi, "no free eraseblocks");
2169 			ubi_assert(list_empty(&ubi->works));
2170 			spin_unlock(&ubi->wl_lock);
2171 			return -ENOSPC;
2172 		}
2173 
2174 		err = produce_free_peb(ubi);
2175 		if (err < 0) {
2176 			spin_unlock(&ubi->wl_lock);
2177 			return err;
2178 		}
2179 		spin_unlock(&ubi->wl_lock);
2180 		up_read(&ubi->fm_eba_sem);
2181 		goto retry;
2182 
2183 	}
2184 	e = wl_get_wle(ubi);
2185 	prot_queue_add(ubi, e);
2186 	spin_unlock(&ubi->wl_lock);
2187 
2188 	err = ubi_self_check_all_ff(ubi, e->pnum, ubi->vid_hdr_aloffset,
2189 				    ubi->peb_size - ubi->vid_hdr_aloffset);
2190 	if (err) {
2191 		ubi_err(ubi, "new PEB %d does not contain all 0xFF bytes", e->pnum);
2192 		return err;
2193 	}
2194 
2195 	return e->pnum;
2196 }
2197 #else
2198 #include "fastmap-wl.c"
2199 #endif
2200