Overrun errors in kvaser_pci after quest reboot

[Jean-Tiare Le Bigot]

Hi,

I have a X86/KVM virtual machine on Qemu 4.2.0 with a kvaser_pci CAN device.

On the host, a Python program sends ~10 CAN frames per second to emulate some ECUs and make the guest happy.

On the first boot, everything works fine and I can receive the frames in the guest.

After a reboot it "generally" enters in an "overrun" loop and no frames can be read any longer.

I tried to down/up the can devices both on the guest and the host with no luck.

So far, the best workaround I found is to stop + start the VM in place of a reboot. This is acceptable in my scenario (automated tests).

Here is the CAN device configuration in Qemu in the config file format:

# can0
[device "root_port3"]
  driver = "ioh3420"
  multifunction = "on"
  chassis = "3"
  bus = "pcie.0"
  addr = "1b.0"

[device]
  driver = "kvaser_pci"
  canbus = "canbus0"
  bus = "root_port3"
  addr = "0"

[object "canbus0"]
  qom-type = "can-bus"

[object "canhost0"]
  qom-type = "can-host-socketcan"
  if = "can0"
  canbus = "canbus0"

I tried to attach "gdb" to the Qemu process with breakpoints in the "overrun" check and "overrun" reset sections. The overrun section is entered for every new frames and the reset section is entered as well. Therefore, the Linux driver seems to do its job of clearing the flag.

However, the "s->rx_cnt" field was strangely close to 0xfffffff2.

As an attempt to go further, I attached a breakpoint in the "/* Release Receive Buffer */" before the rx_cnt decrement IF it is about to underflow:

break hw/net/can/can_sja1000.c:501 if s->rx_cnt < count

When this fires, "tmp8" point to a part of the message itself rather than the message header forged in "frame2buff_pel" so that the corruption might be in "s->rxbuf_start" itself.

Unfortunately, my debugging skills stop short at this point :/

Do you have an idea of what could be going wrong and how to fix it ?

--

Jean-Tiare LE BIGOT
Embedded OS Product Owner

office +33 (0)5 32 10 81 90
jean-tiare.le-bigot@easymile‍.com

21 Boulevard de la Marquette

Bat B, 3éme étage

31000 Toulouse

easymile‍.com