Hi,

I am the maintainer of a MPC5200 port of eCos at Elektrobit.
I found a race-condition in the implementation of our MSCAN
CAN-driver and it seems your driver has the same problem
(I reviewed your code for reference reasons):
http://git.kernel.org/?p=linux/kernel/git/davem/net-next-2.6.git;a=blob_plain;f=drivers/net/can/mscan/mscan.c;hb=HEAD

I first contacted Wolfram Sang personally and he pointed me
to the right sources and to this mailing list.

Problem is:
MSCAN has three Tx-Buffers. But only one buffer-interface.
So to select one buffer you must use a buffer selection (cantbsel)
register.

Your driver implementation selects the buffer in the 
mscan_start_xmit() function and then fills the buffer with
payload.

But in the ISR mscan_isr() the buffer is also selected
to maintain the tx-stats.

Race-condition occurs if mscan_isr() interrupts mscan_start_xmit()
after it selects a buffer by writing to the tbsel register.
After ISR returns mscan_start_xmit will continue to write payload
into the wrong buffer.

A second race condition occurs with the cantier register.
The documentation says its an interrupt-enable register.
But in-fact it is a sort of acknowledgement register which
is accessed in both ISR and xmit function with load-and-store
operations.

The fix in my eCos driver was to lock the ISR from occuring during
cantbsel and cantier register are accessed inside the transmit function.

If you need a reference-implementation I can send you my
implementation of the MSCAN driver for eCos operating system.
It differs with your implementation because it is able to
abort buffers whenever a Can-Message arrives at the Tx-API
with has higher priority than the messages currently in the
buffers (to avoid starvation on the bus).

Perhaps the following lines could be  written simpler
in function mscan_isr():

   cantier = in_8(&regs->cantier) & MSCAN_TXE;
   cantflg = in_8(&regs->cantflg) & cantier;

   if (cantier && cantflg) {
      ...
Instead of this i would write (its the same):
   if (cantflg) {
      ...

Freundliche Grüße / Best regards
Günter Ebermann

-- 
Dipl.-Ing. (FH) Guenter Ebermann, Software Architect, Product
Development Bus Tools
EB - Discover the Experience
Phone: +43 1 59983-95, mailto:[email protected]
Fax: +43 1 59983-18, http://www.elektrobit.com

Elektrobit Austria GmbH, Kaiserstraße 45 / Stiege 2, A-1070 Wien, Austria 
Managing Director Otto Fößel
Register Court Vienna, Commercial Register No. FN211944h


----------------------------------------------------------------
Please note: This e-mail may contain confidential information
intended solely for the addressee. If you have received this
e-mail in error, please do not disclose it to anyone, notify
the sender promptly, and delete the message from your system.
Thank you.

_______________________________________________
Socketcan-core mailing list
[email protected]
https://lists.berlios.de/mailman/listinfo/socketcan-core

Reply via email to