[BACKPORT] arch/arm/src/imxrt: Unify FlexCAN TX work and add SIOCGCANERRORS.

[dakejahl]

Summary

Backport of apache/nuttx#20008 plus apache/nuttx dd53c34 (first commit).

Commit order matches the rewritten upstream PR: SIOCSCANBITRATE requires the interface down (already on apache master, not in #20008), then the stm32h7 FDCAN filter stubs are removed, then the per-command CAN ioctl options are merged into NETDEV_CAN_IOCTL, then one TX worker for completions and deadline aborts plus SIOCGCANERRORS. PX4 side is PX4/PX4-Autopilot#28457, whose board defconfigs enable NETDEV_CAN_IOCTL (the old names are silently dropped, taking the whole CAN ioctl block with them).

The nxstyle commit on #20008 is not backported: this tree's SocketCAN drivers have diverged, and PX4/NuttX CI does not run nxstyle over whole files.

Bench (ARK FMU-v6XRT, two nodes, 2026-08-29): unplugging one node, the ioctl reports error-passive, TEC 128, REC 0 for the gap and a monotonic error count, matching ECR/ESR1 read over SWD at 20 Hz sample for sample, while the other interface stays error-active with 0 errors. UAVCAN_BITRATE 500000 through ifdown → set → ifup brings both nodes up at 500 kbit/s. The T0–T7 CAN regression suite passes with the pre-existing IOB-drop failure of T2 unchanged from main. ark_fmu-v6xrt_default rebuilt with CONFIG_NETDEV_CAN_IOCTL=y, error path confirmed linked.

Problem

imxrt_txdone_work and imxrt_txtimeout_work shared priv->irqwork. work_queue() cancels a pending callback when its work_s is reused, so whichever was queued second silently replaced the first: deadlines left set, IMASK1 TX bits left off, or expired frames never aborted.

The socket layer had no way to see the controller's error state. libuavcan's getErrorCount() / isInBusOffState() are stubs on every SocketCAN board, and the last error-passive failure on this driver was only diagnosed by reading ECR/ESR1 over SWD.

SIOCSCANBITRATE called imxrt_ifup() on a running controller. With CONFIG_IMXRT_FLEXCAN_ECC that zeroes the FlexCAN RAM outside freeze mode, which is a bus fault: imxrt_busfault in wq:uavcan on every boot once UAVCAN_BITRATE differs from the Kconfig rate.

Solution

Both paths queue imxrt_tx_work(), which retires completions before aborting expired mailboxes. SIOCGCANERRORS (_SIOC(0x0045), behind NETDEV_CAN_IOCTL) fills can_ioctl_errors_s. Bus errors are counted by sampling the clear-on-read ESR1 error flags at every driver entry (TX work, RX work, the ioctl) instead of enabling ERRINT, which fires per error frame and storms at bus rate on a dead bus. rx_overruns counts CODE=OVERRUN mailboxes. CAN frames the socket layer drops for want of an IOB now count as rx_dropped under NETDEV_STATISTICS.

SIOCSCANBITRATE stores the timings and the netdev layer returns -EBUSY while the interface is up, as upstream does since dd53c34; the caller takes the interface down, sets the rate and brings it up.

NETDEV_CAN_BITRATE_IOCTL and NETDEV_CAN_FILTER_IOCTL guarded identical option blocks, and every SIOCxCANxxx case forwarded a member of the same ifr_ifru union to d_ioctl(); one option and one case block now cover all of them (this tree has no NETDEV_CAN_STATE_IOCTL).

Upstream SIOCGCANSTATE (0x0041) is sleep/operational, not fault confinement, hence a new command. Submitted upstream as apache/nuttx#20008 (without the bitrate-down commit, which upstream already has).