[PATCH] SPI: define null tx_buf to mean "shift out zeroes"

Some issues were recently turned up with the current specification of what
it means for spi_transfer.tx_buf to be null, as part of transfers which are
(from the SPI protocol driver perspective) pure reads.

Specifically, that it seems better to change the TX behaviour there from
"undefined" to "will shift zeroes".  This lets protocol drivers (like the
ads7846 driver) depend on that behavior.  It's what most controller drivers
in the tree are already doing (with one exception and one case of driver
wanting-to-oops), it's what Microwire hardware will necessarily be doing,
and it removes an issue whereby certain security audits would need to
define such a value anyway as part of removing covert channels.

This patch changes the specification to require shifting zeroes, and
updates all currently merged SPI controller drivers to do so.
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NKumar Gala <galak@kernel.crashing.org>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

drivers/spi/spi_mpc83xx.c

@@ -112,6 +112,8 @@ u32 mpc83xx_spi_tx_buf_##type(struct mpc83xx_spi *mpc83xx_spi)	\
 {								\
 	u32 data;						\
 	const type * tx = mpc83xx_spi->tx;			\
+	if (!tx)						\
+		return 0;					\
 	data = *tx++;						\
 	mpc83xx_spi->tx = tx;					\
 	return data;						\

drivers/spi/spi_s3c24xx.c

@@ -174,7 +174,7 @@ static int s3c24xx_spi_setup(struct spi_device *spi)
 
 static inline unsigned int hw_txbyte(struct s3c24xx_spi *hw, int count)
 {
-	return hw->tx ? hw->tx[count] : 0xff;
+	return hw->tx ? hw->tx[count] : 0;
 }
 
 static int s3c24xx_spi_txrx(struct spi_device *spi, struct spi_transfer *t)

include/linux/spi/spi.h

@@ -289,7 +289,7 @@ extern struct spi_master *spi_busnum_to_master(u16 busnum);
  * the data being transferred; that may reduce overhead, when the
  * underlying driver uses dma.
  *
- * If the transmit buffer is null, undefined data will be shifted out
+ * If the transmit buffer is null, zeroes will be shifted out
  * while filling rx_buf.  If the receive buffer is null, the data
  * shifted in will be discarded.  Only "len" bytes shift out (or in).
  * It's an error to try to shift out a partial word.  (For example, by