lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <202601060153.21682.pisa@fel.cvut.cz>
Date: Tue, 6 Jan 2026 01:53:21 +0100
From: Pavel Pisa <pisa@....cvut.cz>
To: Vincent Mailhol <mailhol@...nel.org>,
 Ondrej Ille <ondrej.ille@...il.com>
Cc: linux-can@...r.kernel.org,
 "Marc Kleine-Budde" <mkl@...gutronix.de>,
 David Laight <david.laight.linux@...il.com>,
 "David S. Miller" <davem@...emloft.net>,
 Andrea Daoud <andreadaoud6@...il.com>,
 Wolfgang Grandegger <wg@...ndegger.com>,
 Paolo Abeni <pabeni@...hat.com>,
 netdev@...r.kernel.org,
 Jiri Novak <jnovak@....cvut.cz>
Subject: Re: [PATCH v2] can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.

Dear Vincent Mailhol,

thanks for pointing to Transmission Delay Compensation
related code introduced in 5.16 kernel. I have noticed it
in the past but not considered it yet and I think
that we need minimal fixes to help users and
allow change to propagate into stable series now.

More details inline

On Monday 05 of January 2026 21:27:11 Vincent Mailhol wrote:
> Le 05/01/2026 à 12:16, Pavel Pisa a écrit :
> > From: Ondrej Ille <ondrej.ille@...il.com>
> >
> > The Secondary Sample Point Source field has been
> > set to an incorrect value by some mistake in the
> > past
> >
> >   0b01 - SSP_SRC_NO_SSP - SSP is not used.
> >
> > for data bitrates above 1 MBit/s. The correct/default
> > value already used for lower bitrates is
>
> Where does this 1 MBit/s threshold come from? Is this an empirical value?
>
> The check is normally done on the data BRP. For example we had some
> problems on the mcp251xfd, c.f. commit 5e1663810e11 ("can: mcp251xfd:
> fix TDC setting for low data bit rates").

The CTU CAN FD check is done on data bitrate

https://elixir.bootlin.com/linux/v6.18.3/source/drivers/net/can/ctucanfd/ctucanfd_base.c#L290

  if (dbt->bitrate > 1000000)

the line expands to

  if (priv->can.fd.data_bittiming.bitrate > 1000000)

The value computation has been defined by Ondrej Ille, main author
of the CTU CAN FD IP core. The main driver author has been
Martin Jerabek and there seems that we have made some mistake,
flip in value in the past. But Ondrej Ille is the most competent
for the core limits and intended behavior and SW support.
He has invested to complete iso-16845 compliance testing
framework re-implementation for detailed timing testing.
There is even simulated environment with clocks jitters
and delays equivalent to linear, start and other typologies
run at each core update. The kudos for idea how to implement
this without unacceptable time required for simulation
goes to Martin Jerabek. But lot of scenarios are tested
and Ondrej Ille can specify what is right and has been
tested. May it be, even Jiri Novak can provide some input
as well, because he uses CTU CAN FD to deliver more generations
of CTU tester systems to car makers (mainly SkodaAuto)
and the need of configurable IP core for these purposes was initial
driver for the CTU CAN FD core design.

The function of SSP is described in the datasheet and implementation
in the CTU CAN FD IP CORE System Architecture manual or we can go
to HDL design as well.

I extrapolate that 1 Mbit/s has been chosen as the switching point,
because controller and transceivers are expected to support
arbitration bit rate to at least 1 Mbit/s according to CAN and CAN FD
standards and there is no chance to use SSP during nominal bitrate.

> Can you use the TDC framework?

In longer term it would be right direction. But TRV_DELAY
measurement is and should be considered as default for
data bit rate and BRS set and then the transceiver delay
should be fully compensated on CTU CAN FD.

Problem was that the compensation was switched off by mistake
in the encoded value.

But when I study manuals and implementation again, I think that
there is problem with data bitrate < 1 Mbit/s, because for these
the compensation should be switched off or the data rate sample_point
should be recomputed to SSP_OFFET because else sampling is done
too early. Delay is not added to sampling point. So we should
correct this to make case with BRS and switching to
higher data rate (but under 1 Mbit/s) to be more reliable.

There are some limitations in maximal values which can be
set to SSP_OFFET field. It resolution is high, 10 ns typically
for our IP CORE FPGA targets with the 100 MHz IP core clock.
On silicon version, as I know, 80 MHz has been used in the
last integration. So again, limit is around 2.5 usec or a little
more for 80 MHz. This matches again mode switch at 1 Mbit/s
or the other option could be switch when SSP_OFFET exceeds
250 or some such value.

> Not only would you get a correct 
> calculation for when to activate/deactivate TDC, you will also have the
> netlink reporting (refer to the above commit for an example).

Yes, I agree that availability of tuning and monitoring over
netlink is nice added value. But at this moment I (personally)
prefer the minimal fix to help actual users.

I add there links to current CAN FD Transmission Delay Compensation
support and definition in the Linux kernel code for future integration
into CTU CAN FD IP core driver

https://elixir.bootlin.com/linux/v6.18.3/source/include/linux/can/bittiming.h#L25

https://elixir.bootlin.com/linux/v6.18.3/source/drivers/net/can/dev/calc_bittiming.c#L174

https://elixir.bootlin.com/linux/v6.18.3/source/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c#L595

and in the controller features announcement

priv->can.ctrlmode_supported = CAN_CTRLMODE_LOOPBACK |
		CAN_CTRLMODE_LISTENONLY | CAN_CTRLMODE_BERR_REPORTING |
		CAN_CTRLMODE_FD | CAN_CTRLMODE_FD_NON_ISO |
		CAN_CTRLMODE_CC_LEN8_DLC | CAN_CTRLMODE_TDC_AUTO |
		CAN_CTRLMODE_TDC_MANUAL;

Best wishes,

Pavel

> >   0b00 - SSP_SRC_MEAS_N_OFFSET - SSP position = TRV_DELAY
> >          (Measured Transmitter delay) + SSP_OFFSET.
> >
> > The related configuration register structure is described
> > in section 3.1.46 SSP_CFG of the CTU CAN FD
> > IP CORE Datasheet.
> >
> > The analysis leading to the proper configuration
> > is described in section 2.8.3 Secondary sampling point
> > of the datasheet.
> >
> > The change has been tested on AMD/Xilinx Zynq
> > with the next CTU CN FD IP core versions:
> >
> >  - 2.6 aka master in the "integration with Zynq-7000 system" test
> >    6.12.43-rt12+ #1 SMP PREEMPT_RT kernel with CTU CAN FD git
> >    driver (change already included in the driver repo)
> >  - older 2.5 snapshot with mainline kernels with this patch
> >    applied locally in the multiple CAN latency tester nightly runs
> >    6.18.0-rc4-rt3-dut #1 SMP PREEMPT_RT
> >    6.19.0-rc3-dut
> >
> > The logs, the datasheet and sources are available at
> >
> >  https://canbus.pages.fel.cvut.cz/
> >
> > Signed-off-by: Ondrej Ille <ondrej.ille@...il.com>
> > Signed-off-by: Pavel Pisa <pisa@....cvut.cz>
>
> Yours sincerely,
> Vincent Mailhol


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ