In yaffs_rd_chunk_tags_nand() invoked by yaffs_check_chunk_erased(), there is an implicit raw read of data and user spare area (oob data excluding ECC data). However, in yaffs_tags_marshall_read() [with valid tags input], a yaffs_mtd_read() is invoked with ops.mode = MTD_OPS_AUTO_OOB unconditionally. (ops.mode should be conditional between MTD_OPS_RAW and MTD_OPS_AUTO_OOB). The reason I said an "implicit raw read" is because for NAND Flash controller that has ECC implemented in hw, a typical nand_ecc_ctrl.read_page() implementation will have its page size data corrected by ECC. However, in the scenario when yaffs_check_chunk_erased() is invoked, a yaffs_check_ff() is performed afterward which checks for all data in the page is 1. Unfortunately, the initial condition of a given page + spare area (including ECC data) is all 1's leads to Flash controller (hw) correcting data in page (with invalid ECCs) and thus yield some data bits in the page not be 1's.
I feel the proper implementation should be nand_ecc_ctrl.read_page_raw() should be invoked (instead of nand_ecc_ctrl.read_page()) and in order to achieve that result, ops.mode needs to be MTD_OPS_RAW.
Notice: This e-mail and any files transmitted with it may contain Data Device Corporation's and its subsidiaries privileged and proprietary information. It is intended solely for the use of the individual or entity to whom it is addressed. If you are not the named recipient of this transmission, any disclosure, copying, distribution or reliance on the contents of this message is prohibited. If you received this e-mail in error, please destroy it and any attached files and notify me immediately.