Bad Block Table (BBT)
Since the usual bad block marker in the OOB area does not allow us to distinguish between factory-bad and worn-out-bad blocks, we need to store this information elsewhere. This place is called bad-block table (BBT) and is stored as a bitmap in the last two good blocks at the end of NAND. To increase security, a backup of those two blocks is kept in the two preceding good blocks as well.
The BBT location itself is identified by special markers (BBT0/BBT1) in the OOB area of the first page of the respective erase blocks.
The BBT consists of two bits per block which distinguish the three conditions (factory-bad/worn-out/good).
Both u-boot and Linux implement the same BBT layout and thus interoperate quite well.
The BBT is created once a BBT-implementing u-boot is started for the first time. The BBT scanning code assumes that the NAND is completely erased, i.e. only contains 0xff as content. Any block that contains bytes != 0xff in the OOB is marked as "factory bad" block.
Bad block table
In order to maintain the BBT created by u-boot, the kernel needs to have BBT support enabled. Unfortunately the mainline kernel doesn’t have a CONFIG option for it, so if you’re not using the -moko kernel tree, you have to manually patch the s3c2410 nand driver to enable the BBT option.