2.6.26-rc8 nftl + nand(diskonchip) + powerpc = crash + no work

[Wang Jian <lark@linux.net.cn>]

Hi,

I am off list so please CC: me.

I have problem when I try to make DOC2000 work on a powerpc dev board.
The DOC2000 is 8bit so I add 

#elif defined(__powerpc__)
#define ReadDOC_(adr, reg)      ((unsigned char)(*(volatile __u8 *)(((unsigned long)adr)+(reg))))
#define WriteDOC_(d, adr, reg)  do{ *(volatile __u8 *)(((unsigned long)adr)+((reg))) = (__u8)d; wmb();} while(0)
#define DOC_IOREMAP_LEN 0x2000
#else

to include/linux/mtd/doc2000.h. After this modification, the doc2000 can
be probed correctly.

But fdisk/mke2fs write on /dev/nftla will crash. I trace down to
driver/mtd/nftlcore.c

/*
 * Write data and oob to flash
 */
static int nftl_write(struct mtd_info *mtd, loff_t offs, size_t len,
		      size_t *retlen, uint8_t *buf, uint8_t *oob)
{
	struct mtd_oob_ops ops;
	int res;

	ops.mode = MTD_OOB_PLACE;
	ops.ooboffs = offs;
	// --> should be ops.ooboffs = offs & (mtd->writesize - 1); ???
	ops.ooblen = mtd->oobsize;
	ops.oobbuf = oob;
	ops.datbuf = buf;
	ops.len = len;

	res = mtd->write_oob(mtd, offs & ~(mtd->writesize - 1), &ops);
	*retlen = ops.retlen;
	return res;
}

This is the only place that offs assigned to ops.ooboffs without
masking. Then in drivers/mtd/nand/nand_base.c 

static uint8_t *nand_fill_oob(struct nand_chip *chip, uint8_t *oob,
				  struct mtd_oob_ops *ops)
{
------ snip ------
		memcpy(chip->oob_poi + ops->ooboffs, oob, len);
------ snip ------

This triggers the crash.

Fixing this does prevent fdisk/mke2fs from crash, but fdisk/mke2fs can't
work either. Hexdump tells me that it is all zero after write.

The questions are:

1. The DOC2000 can be correctly probed, (size correctly reported), then
the doc2000.h modification is correct and enough?

2. ops.ooboffs = offs; is intended here, or actually a bug?

3. what I can do next to find why no data is written?