SPI can suffer from overruns due to TX/RX asymmetry

[bcantrill]

With the fix for #260, we will entirely fill the TX FIFO when we can. As the data there indicates, this results in better performance -- but it also introduces an asymmetry: because we will fill the TX FIFO as much as we can but only drain the RX FIFO a byte at a time, it is relatively easy to get into RX overruns. (This can be seen when doing operations that clearly exceed the FIFO size.) The overruns are then not handled well (see #349), resulting in an infinite loop. The fix is to do to the RX side what we did to the TX side: continue to drain it as long as we can. If/when the TX FIFO empties, SPI transmission will cease until it is refilled, assuring that we throttle on our true ability to drain.

[cbiffle]

I am disappointed that the STM32H7 SPI block doesn't have an interlock that can be used to stop transmission when the RX fifo approaches full. Since SPI is lock-step, you can do this sort of thing. But, I just re-read the manual, and they didn't.

We should definitely alter the driver to dequeue many received bytes when possible -- I actually have a floating change from the plane to MN where I did this, I can see about tracking it down. (I also made it stop using one syscall per byte to deliver into the borrow.)

Because system performance can vary and load-dependent failures are the literal worst, we may also want to make the driver more robust against being starved on the RX side. Concretely, rather than loading the TX fifo to capacity, we may want to only load it with the number of bytes that are free in the RX fifo. This will cause the transmitter underrun interlock to halt driving the bus before an RX overrun can occur.

That being said, we should still handle the overrun case better -- it should be an error returned to the caller, since data was lost.