[PATCH 1/2] spi: atmel: limit transfers to the bounce buffer size

[Angelo Compagnucci <angelo.compagnucci@gmail.com>]

On SAM9 SoCs (CONFIG_SOC_SAM_V4_V5) a DMA transfer from or to a vmalloc
buffer goes through bounce buffers of SPI_MAX_DMA_XFER bytes. The whole
transfer is copied in them though, whatever its length, and nothing
limits the length of a transfer: a longer one is copied past the end of
the buffer.

The MIPI DBI panel drivers send a whole frame from the framebuffer, a
vmalloc buffer, in one transfer: 153600 bytes for a 320x240 ILI9341
panel. On an Arietta G25 (SAM9G25), once the driver accepts their 16 bit
transfers, the first frame oopses:

  Unable to handle kernel paging request at virtual address c8915000 when write
  PC is at mmiocpy+0x34/0x2a0
   mmiocpy from atmel_spi_one_transfer+0x4f0/0x77c

When the bounce buffers are in use, report SPI_MAX_DMA_XFER as the
maximum transfer size, so that SPI device drivers split longer
transfers.

Fixes: a9889ed62d06 ("spi: atmel: Implements transfers with bounce buffer")
Cc: stable@vger.kernel.org
Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
---
 drivers/spi/spi-atmel.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index ffc1292b0..fb8d4c7c9 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -591,6 +591,12 @@ static void atmel_spi_release_dma(void *data)
 	}
 }
 
+/* Transfers from vmalloc buffers are copied in the bounce buffers */
+static size_t atmel_spi_max_transfer_size(struct spi_device *spi)
+{
+	return SPI_MAX_DMA_XFER;
+}
+
 static int atmel_spi_configure_dma(struct spi_controller *host,
 				   struct atmel_spi *as)
 {
@@ -637,6 +643,8 @@ static int atmel_spi_configure_dma(struct spi_controller *host,
 			err = -ENOMEM;
 			goto err_release_dma;
 		}
+
+		host->max_transfer_size = atmel_spi_max_transfer_size;
 	}
 
 	err = devm_add_action_or_reset(dev, atmel_spi_release_dma, host);
-- 
2.53.0