[can] add lifecycle bus-off and recovery handling

[wdfk-prog]

Summary

Extend the lifecycle model from PR #10 to cover safe close/reconfigure and explicit CAN bus state/recovery.

This PR adds:

• an orthogonal rt_can_bus_state model (ERROR_ACTIVE/WARNING/PASSIVE/BUS_OFF);
• optional ISR-safe rt_hw_can_bus_state() reporting for drivers with precise state events;
• default rejection of new TX while BUS_OFF;
• cancellation of software-queued TX when BUS_OFF is reported so stale control traffic is not replayed after recovery;
• RT_CAN_CAP_MANUAL_RECOVERY and RT_CAN_CMD_RECOVER;
• rt_can_recover() lifecycle transition through RECOVERING;
• transactional reconfiguration through QUIESCED -> RECONFIGURING -> RUNNING;
• close quiesce before IRQ disable/resource release.

Lifecycle vs bus state

Lifecycle and CAN protocol state are intentionally separate. For example a device can be RUNNING + ERROR_PASSIVE, or RECOVERING + BUS_OFF.

Close safety

Final close now performs ABORT_ALL quiesce first. CAN runtime resources are not detached/freed unless accepted TX ownership has been retired. This prevents a late TX ISR from touching already-freed request/mailbox state.

Reconfiguration

RT_DEVICE_CTRL_CONFIG, mode changes and baud-rate changes are performed from an explicit quiesced boundary. Baud changes use the destructive ABORT_ALL policy; normal configuration/mode changes use DRAIN.

Recovery

Drivers may advertise manual recovery. rt_can_recover() serializes recovery with lifecycle operations, invokes the driver recovery command, restores ERROR_ACTIVE on success, and restarts the existing scheduler without a deferred worker.

Compatibility

• Existing BSP rt_hw_can_isr() sites remain source-compatible.
• rt_hw_can_bus_state() is additive/optional.
• Existing drivers that do not advertise manual recovery are unchanged.

Tests

The fake-controller tests now cover BUS_OFF TX rejection and successful manual recovery before TX admission resumes.

No target-board/hardware validation has been performed in this PR.

Stack

PR 6/7. Base: PR #10 (refactor/can-quiesce-flush).

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).

---

🛠 操作步骤 | Steps

1. 前往 Actions 页面 | Go to the Actions page
   点击进入工作流 → | Click to open workflow →

2. 点击 Run workflow | Click Run workflow

• Use workflow from 保持默认分支（通常为 master）
  Keep the default branch (usually master) in Use workflow from
• 在 branch 输入框填写 PR 分支 refactor/can-lifecycle-recovery
  Enter PR branch refactor/can-lifecycle-recovery in the branch field
• 设置需排除的文件/目录（目录请以"/"结尾）
  Set files/directories to exclude (directories should end with "/")

3. 等待工作流完成 | Wait for the workflow to complete
   格式化后的代码将作为独立提交推送至你的分支。
   The formatting changes will be pushed to your branch as a separate commit.

完成后，提交将自动更新至 refactor/can-lifecycle-recovery 分支，关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the refactor/can-lifecycle-recovery branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们，再次感谢您的贡献！💐
If you have any questions, feel free to reach out. Thanks again for your contribution!