2 * elmcan.c - ELM327 based CAN interface driver
3 * (tty line discipline)
5 * This file is derived from linux/drivers/net/can/slcan.c
7 * elmcan.c Author : Max Staudt <elmcan@enpas.org>
8 * slcan.c Author : Oliver Hartkopp <socketcan@hartkopp.net>
9 * slip.c Authors : Laurence Culhane <loz@holmes.demon.co.uk>
10 * Fred N. van Kempen <waltje@uwalt.nl.mugnet.org>
12 * SPDX-License-Identifier: GPL-2.0
16 #define pr_fmt(fmt) "[elmcan] " fmt
19 #include <linux/init.h>
20 #include <linux/module.h>
21 #include <linux/moduleparam.h>
23 #include <linux/atomic.h>
24 #include <linux/bitops.h>
25 #include <linux/delay.h>
26 #include <linux/errno.h>
27 #include <linux/if_ether.h>
28 #include <linux/kernel.h>
29 #include <linux/list.h>
30 #include <linux/netdevice.h>
31 #include <linux/skbuff.h>
32 #include <linux/spinlock.h>
33 #include <linux/string.h>
34 #include <linux/tty.h>
35 #include <linux/workqueue.h>
37 #include <linux/can.h>
38 #include <linux/can/dev.h>
39 #include <linux/can/error.h>
40 #include <linux/can/led.h>
43 MODULE_ALIAS_LDISC(N_ELMCAN);
44 MODULE_DESCRIPTION("ELM327 based CAN interface");
45 MODULE_LICENSE("GPL");
46 MODULE_AUTHOR("Max Staudt <max-linux@enpas.org>");
48 /* Line discipline ID number */
53 #define ELM327_CAN_CONFIG_SEND_SFF 0x8000
54 #define ELM327_CAN_CONFIG_VARIABLE_DLC 0x4000
55 #define ELM327_CAN_CONFIG_RECV_BOTH_SFF_EFF 0x2000
56 #define ELM327_CAN_CONFIG_BAUDRATE_MULT_8_7 0x1000
58 #define ELM327_MAGIC_CHAR 'y'
59 #define ELM327_MAGIC_STRING "y"
60 #define ELM327_READY_CHAR '>'
63 /* Bits in elm->cmds_todo */
65 ELM_TODO_CAN_DATA = 0,
67 ELM_TODO_CANID_29BIT_LOW,
68 ELM_TODO_CANID_29BIT_HIGH,
71 ELM_TODO_SILENT_MONITOR,
77 /* This must be the first member when using alloc_candev() */
80 /* TTY and netdev devices that we're bridging */
81 struct tty_struct *tty;
82 struct net_device *dev;
84 /* Per-channel lock */
87 /* Keep track of how many things are using this struct.
88 * Once it reaches 0, we are in the process of cleaning up,
89 * and new operations will be cancelled immediately.
90 * Use atomic_t rather than refcount_t because we deliberately
91 * decrement to 0, and refcount_dec() spills a WARN_ONCE in
96 /* Stop the channel on hardware failure.
97 * Once this is true, nothing will be sent to the TTY.
102 struct work_struct tx_work; /* Flushes TTY TX buffer */
103 unsigned char txbuf[32];
104 unsigned char *txhead; /* Pointer to next TX byte */
105 int txleft; /* Bytes left to TX */
108 unsigned char rxbuf[256];
121 /* The CAN frame and config the ELM327 is sending/using,
122 * or will send/use after finishing all cmds_todo */
123 struct can_frame can_frame;
124 unsigned short can_config;
125 unsigned long can_bitrate;
126 unsigned char can_bitrate_divisor;
127 int silent_monitoring;
129 /* Things we have yet to send */
130 char **next_init_cmd;
131 unsigned long cmds_todo;
135 /* A lock for all tty->disc_data handled by this ldisc.
136 * This is to prevent a case where tty->disc_data is set to NULL,
137 * yet someone is still trying to dereference it.
138 * Without this, we cannot do a clean shutdown.
140 static DEFINE_SPINLOCK(elmcan_discdata_lock);
143 static inline void elm327_hw_failure(struct elmcan *elm);
147 /************************************************************************
148 * ELM327: Transmission *
150 * (all functions assume elm->lock taken) *
151 ************************************************************************/
153 static void elm327_send(struct elmcan *elm, const void *buf, size_t len)
157 if (elm->hw_failure) {
161 memcpy(elm->txbuf, buf, len);
163 /* Order of next two lines is *very* important.
164 * When we are sending a little amount of data,
165 * the transfer may be completed inside the ops->write()
166 * routine, because it's running with interrupts enabled.
167 * In this case we *never* got WRITE_WAKEUP event,
168 * if we did not request it before write operation.
169 * 14 Oct 1994 Dmitry Gorodchanin.
171 set_bit(TTY_DO_WRITE_WAKEUP, &elm->tty->flags);
172 actual = elm->tty->ops->write(elm->tty, elm->txbuf, len);
174 netdev_err(elm->dev, "Failed to write to tty %s.\n", elm->tty->name);
175 elm327_hw_failure(elm);
179 elm->txleft = len - actual;
180 elm->txhead = elm->txbuf + actual;
185 * Take the ELM327 out of almost any state and back into command mode
187 * Assumes elm->lock taken.
189 static void elm327_kick_into_cmd_mode(struct elmcan *elm)
191 if (elm->state != ELM_GETMAGICCHAR && elm->state != ELM_GETPROMPT) {
192 elm327_send(elm, ELM327_MAGIC_STRING, 1);
194 elm->state = ELM_GETMAGICCHAR;
201 * Schedule a CAN frame, and any necessary config changes,
202 * to be sent down the TTY.
204 * Assumes elm->lock taken.
206 static void elm327_send_frame(struct elmcan *elm, struct can_frame *frame)
208 /* Schedule any necessary changes in ELM327's CAN configuration */
209 if (elm->can_frame.can_id != frame->can_id) {
210 /* Set the new CAN ID for transmission. */
211 if ((frame->can_id & CAN_EFF_FLAG) ^ (elm->can_frame.can_id & CAN_EFF_FLAG)) {
212 elm->can_config = (frame->can_id & CAN_EFF_FLAG ? 0 : ELM327_CAN_CONFIG_SEND_SFF)
213 | ELM327_CAN_CONFIG_VARIABLE_DLC
214 | ELM327_CAN_CONFIG_RECV_BOTH_SFF_EFF
215 | elm->can_bitrate_divisor;
217 set_bit(ELM_TODO_CAN_CONFIG, &elm->cmds_todo);
220 if (frame->can_id & CAN_EFF_FLAG) {
221 clear_bit(ELM_TODO_CANID_11BIT, &elm->cmds_todo);
222 set_bit(ELM_TODO_CANID_29BIT_LOW, &elm->cmds_todo);
223 set_bit(ELM_TODO_CANID_29BIT_HIGH, &elm->cmds_todo);
225 set_bit(ELM_TODO_CANID_11BIT, &elm->cmds_todo);
226 clear_bit(ELM_TODO_CANID_29BIT_LOW, &elm->cmds_todo);
227 clear_bit(ELM_TODO_CANID_29BIT_HIGH, &elm->cmds_todo);
231 /* Schedule the CAN frame itself. */
232 elm->can_frame = *frame;
233 set_bit(ELM_TODO_CAN_DATA, &elm->cmds_todo);
235 elm327_kick_into_cmd_mode(elm);
240 /************************************************************************
241 * ELM327: Initialization sequence *
243 * (assumes elm->lock taken) *
244 ************************************************************************/
246 static char *elm327_init_script[] = {
247 "AT WS\r", /* v1.0: Warm Start */
248 "AT PP FF OFF\r", /* v1.0: All Programmable Parameters Off */
249 "AT M0\r", /* v1.0: Memory Off */
250 "AT AL\r", /* v1.0: Allow Long messages */
251 "AT BI\r", /* v1.0: Bypass Initialization */
252 "AT CAF0\r", /* v1.0: CAN Auto Formatting Off */
253 "AT CFC0\r", /* v1.0: CAN Flow Control Off */
254 "AT CF 000\r", /* v1.0: Reset CAN ID Filter */
255 "AT CM 000\r", /* v1.0: Reset CAN ID Mask */
256 "AT E1\r", /* v1.0: Echo On */
257 "AT H1\r", /* v1.0: Headers On */
258 "AT L0\r", /* v1.0: Linefeeds Off */
259 "AT SH 7DF\r", /* v1.0: Set CAN sending ID to 0x7df */
260 "AT ST FF\r", /* v1.0: Set maximum Timeout for response after TX */
261 "AT AT0\r", /* v1.2: Adaptive Timing Off */
262 "AT D1\r", /* v1.3: Print DLC On */
263 "AT S1\r", /* v1.3: Spaces On */
264 "AT TP B\r", /* v1.0: Try Protocol B */
269 static void elm327_init(struct elmcan *elm)
271 elm->state = ELM_NOTINIT;
272 elm->can_frame.can_id = 0x7df;
274 elm->drop_next_line = 0;
276 /* We can only set the bitrate as a fraction of 500000.
277 * The bit timing constants in elmcan_bittiming_const will
278 * limit the user to the right values.
280 elm->can_bitrate_divisor = 500000 / elm->can.bittiming.bitrate;
281 elm->can_config = ELM327_CAN_CONFIG_SEND_SFF
282 | ELM327_CAN_CONFIG_VARIABLE_DLC
283 | ELM327_CAN_CONFIG_RECV_BOTH_SFF_EFF
284 | elm->can_bitrate_divisor;
286 /* Configure ELM327 and then start monitoring */
287 elm->next_init_cmd = &elm327_init_script[0];
288 set_bit(ELM_TODO_INIT, &elm->cmds_todo);
289 set_bit(ELM_TODO_SILENT_MONITOR, &elm->cmds_todo);
290 set_bit(ELM_TODO_RESPONSES, &elm->cmds_todo);
291 set_bit(ELM_TODO_CAN_CONFIG, &elm->cmds_todo);
293 elm327_kick_into_cmd_mode(elm);
298 /************************************************************************
299 * ELM327: Reception -> netdev glue *
301 * (assumes elm->lock taken) *
302 ************************************************************************/
304 static void elm327_feed_frame_to_netdev(struct elmcan *elm, const struct can_frame *frame)
306 struct can_frame *cf;
309 if (!netif_running(elm->dev)) {
313 skb = alloc_can_skb(elm->dev, &cf);
318 memcpy(cf, frame, sizeof(struct can_frame));
320 elm->dev->stats.rx_packets++;
321 elm->dev->stats.rx_bytes += frame->can_dlc;
324 can_led_event(elm->dev, CAN_LED_EVENT_RX);
329 /************************************************************************
330 * ELM327: "Panic" handler *
332 * (assumes elm->lock taken) *
333 ************************************************************************/
335 /* Called when we're out of ideas and just want it all to end. */
336 static inline void elm327_hw_failure(struct elmcan *elm)
338 struct can_frame frame;
340 memset(&frame, 0, sizeof(frame));
341 frame.can_id = CAN_ERR_FLAG;
342 frame.can_dlc = CAN_ERR_DLC;
346 elm327_feed_frame_to_netdev(elm, &frame);
348 netdev_err(elm->dev, "ELM327 misbehaved. "
349 "Blocking further communication.\n");
351 elm->hw_failure = true;
352 can_bus_off(elm->dev);
357 /************************************************************************
358 * ELM327: Reception parser *
360 * (assumes elm->lock taken) *
361 ************************************************************************/
363 static void elm327_parse_error(struct elmcan *elm, int len)
365 struct can_frame frame;
367 memset(&frame, 0, sizeof(frame));
368 frame.can_id = CAN_ERR_FLAG;
369 frame.can_dlc = CAN_ERR_DLC;
373 if (!memcmp(elm->rxbuf, "UNABLE TO CONNECT", 17)) {
374 netdev_err(elm->dev, "The ELM327 reported UNABLE TO CONNECT. Please check your setup.\n");
378 if (!memcmp(elm->rxbuf, "BUFFER FULL", 11)) {
379 /* This case will only happen if the last data
381 * Otherwise, elm327_parse_frame() will emit the
382 * error frame instead.
384 frame.can_id |= CAN_ERR_CRTL;
385 frame.data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
389 if (!memcmp(elm->rxbuf, "BUS ERROR", 9)) {
390 frame.can_id |= CAN_ERR_BUSERROR;
392 if (!memcmp(elm->rxbuf, "CAN ERROR", 9)
393 || !memcmp(elm->rxbuf, "<RX ERROR", 9)) {
394 frame.can_id |= CAN_ERR_PROT;
398 if (!memcmp(elm->rxbuf, "BUS BUSY", 8)) {
399 frame.can_id |= CAN_ERR_PROT;
400 frame.data[2] = CAN_ERR_PROT_OVERLOAD;
402 if (!memcmp(elm->rxbuf, "FB ERROR", 8)) {
403 frame.can_id |= CAN_ERR_PROT;
404 frame.data[2] = CAN_ERR_PROT_TX;
408 if (!memcmp(elm->rxbuf, "ERR", 3)) {
409 netdev_err(elm->dev, "The ELM327 reported an ERR%c%c. Please power it off and on again.\n",
410 elm->rxbuf[3], elm->rxbuf[4]);
411 frame.can_id |= CAN_ERR_CRTL;
415 /* Don't emit an error frame if we're unsure */
419 elm327_feed_frame_to_netdev(elm, &frame);
423 static int elm327_parse_frame(struct elmcan *elm, int len)
425 struct can_frame frame;
430 memset(&frame, 0, sizeof(frame));
432 /* Find first non-hex and non-space character:
433 * - In the simplest case, there is none.
434 * - For RTR frames, 'R' is the first non-hex character.
435 * - An error message may replace the end of the data line.
437 for (hexlen = 0; hexlen <= len; hexlen++) {
438 if (hex_to_bin(elm->rxbuf[hexlen]) < 0
439 && elm->rxbuf[hexlen] != ' ') {
444 /* Use spaces in CAN ID to distinguish 29 or 11 bit address length.
445 * No out-of-bounds access:
446 * We use the fact that we can always read from elm->rxbuf.
448 if (elm->rxbuf[2] == ' ' && elm->rxbuf[5] == ' '
449 && elm->rxbuf[8] == ' ' && elm->rxbuf[11] == ' '
450 && elm->rxbuf[13] == ' ') {
451 frame.can_id = CAN_EFF_FLAG;
453 } else if (elm->rxbuf[3] == ' ' && elm->rxbuf[5] == ' ') {
457 /* This is not a well-formatted data line.
458 * Assume it's an error message.
463 if (hexlen < datastart) {
464 /* The line is too short to be a valid frame hex dump.
465 * Something interrupted the hex dump or it is invalid.
470 /* From here on all chars up to buf[hexlen] are hex or spaces,
471 * at well-defined offsets.
474 /* Read CAN data length */
475 frame.can_dlc = (hex_to_bin(elm->rxbuf[datastart - 2]) << 0);
478 if (frame.can_id & CAN_EFF_FLAG) {
479 frame.can_id |= (hex_to_bin(elm->rxbuf[0]) << 28)
480 | (hex_to_bin(elm->rxbuf[1]) << 24)
481 | (hex_to_bin(elm->rxbuf[3]) << 20)
482 | (hex_to_bin(elm->rxbuf[4]) << 16)
483 | (hex_to_bin(elm->rxbuf[6]) << 12)
484 | (hex_to_bin(elm->rxbuf[7]) << 8)
485 | (hex_to_bin(elm->rxbuf[9]) << 4)
486 | (hex_to_bin(elm->rxbuf[10]) << 0);
488 frame.can_id |= (hex_to_bin(elm->rxbuf[0]) << 8)
489 | (hex_to_bin(elm->rxbuf[1]) << 4)
490 | (hex_to_bin(elm->rxbuf[2]) << 0);
493 /* Check for RTR frame */
494 if (elm->rxfill >= hexlen + 3
495 && elm->rxbuf[hexlen + 0] == 'R'
496 && elm->rxbuf[hexlen + 1] == 'T'
497 && elm->rxbuf[hexlen + 2] == 'R') {
498 frame.can_id |= CAN_RTR_FLAG;
501 /* Is the line long enough to hold the advertised payload? */
502 if (!(frame.can_id & CAN_RTR_FLAG) && (hexlen < frame.can_dlc * 3 + datastart)) {
503 /* Incomplete frame. */
505 /* Probably the ELM327's RS232 TX buffer was full.
506 * Emit an error frame and exit.
508 frame.can_id = CAN_ERR_FLAG | CAN_ERR_CRTL;
509 frame.can_dlc = CAN_ERR_DLC;
510 frame.data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
511 elm327_feed_frame_to_netdev(elm, &frame);
513 /* Signal failure to parse.
514 * The line will be re-parsed as an error line, which will fail.
515 * However, this will correctly drop the state machine back into
521 /* Parse the data nibbles. */
522 for (i = 0; i < frame.can_dlc; i++) {
523 frame.data[i] = (hex_to_bin(elm->rxbuf[datastart+3*i]) << 4)
524 | (hex_to_bin(elm->rxbuf[datastart+3*i+1]) << 0);
527 /* Feed the frame to the network layer. */
528 elm327_feed_frame_to_netdev(elm, &frame);
534 static void elm327_parse_line(struct elmcan *elm, int len)
536 /* Skip empty lines */
541 /* Skip echo lines */
542 if (elm->drop_next_line) {
543 elm->drop_next_line = 0;
545 } else if (elm->rxbuf[0] == 'A' && elm->rxbuf[1] == 'T') {
549 /* Regular parsing */
552 if (elm327_parse_frame(elm, len)) {
553 /* Parse an error line. */
554 elm327_parse_error(elm, len);
556 /* After the error line, we expect a prompt. */
557 elm->state = ELM_GETPROMPT;
566 static void elm327_handle_prompt(struct elmcan *elm)
568 if (elm->cmds_todo) {
569 struct can_frame *frame = &elm->can_frame;
570 char local_txbuf[20];
572 if (test_bit(ELM_TODO_INIT, &elm->cmds_todo)) {
573 elm327_send(elm, *elm->next_init_cmd, strlen(*elm->next_init_cmd));
574 elm->next_init_cmd++;
575 if (!(*elm->next_init_cmd)) {
576 clear_bit(ELM_TODO_INIT, &elm->cmds_todo);
577 netdev_info(elm->dev, "Initialization finished.\n");
580 /* Some chips are unreliable and need extra time after
581 * init commands, as seen with a clone.
582 * So let's do a dummy get-cmd-prompt dance.
584 elm->state = ELM_NOTINIT;
585 elm327_kick_into_cmd_mode(elm);
589 } else if (test_and_clear_bit(ELM_TODO_SILENT_MONITOR, &elm->cmds_todo)) {
590 sprintf(local_txbuf, "ATCSM%i\r",
591 !(!(elm->can.ctrlmode & CAN_CTRLMODE_LISTENONLY)));
593 } else if (test_and_clear_bit(ELM_TODO_RESPONSES, &elm->cmds_todo)) {
594 sprintf(local_txbuf, "ATR%i\r",
595 !(elm->can.ctrlmode & CAN_CTRLMODE_LISTENONLY));
597 } else if (test_and_clear_bit(ELM_TODO_CAN_CONFIG, &elm->cmds_todo)) {
598 sprintf(local_txbuf, "ATPB%04X\r",
601 } else if (test_and_clear_bit(ELM_TODO_CANID_29BIT_HIGH, &elm->cmds_todo)) {
602 sprintf(local_txbuf, "ATCP%02X\r",
603 (frame->can_id & CAN_EFF_MASK) >> 24);
605 } else if (test_and_clear_bit(ELM_TODO_CANID_29BIT_LOW, &elm->cmds_todo)) {
606 sprintf(local_txbuf, "ATSH%06X\r",
607 frame->can_id & CAN_EFF_MASK & ((1 << 24) - 1));
609 } else if (test_and_clear_bit(ELM_TODO_CANID_11BIT, &elm->cmds_todo)) {
610 sprintf(local_txbuf, "ATSH%03X\r",
611 frame->can_id & CAN_SFF_MASK);
613 } else if (test_and_clear_bit(ELM_TODO_CAN_DATA, &elm->cmds_todo)) {
614 if (frame->can_id & CAN_RTR_FLAG) {
615 /* Send an RTR frame. Their DLC is fixed.
616 * Some chips don't send them at all.
618 sprintf(local_txbuf, "ATRTR\r");
620 /* Send a regular CAN data frame */
623 for (i = 0; i < frame->can_dlc; i++) {
624 sprintf(&local_txbuf[2*i], "%02X",
628 sprintf(&local_txbuf[2*i], "\r");
631 elm->drop_next_line = 1;
632 elm->state = ELM_RECEIVING;
635 elm327_send(elm, local_txbuf, strlen(local_txbuf));
637 /* Enter CAN monitor mode */
638 elm327_send(elm, "ATMA\r", 5);
639 elm->state = ELM_RECEIVING;
644 static void elm327_drop_bytes(struct elmcan *elm, int i)
646 memmove(&elm->rxbuf[0], &elm->rxbuf[i], sizeof(elm->rxbuf) - i);
651 static void elm327_parse_rxbuf(struct elmcan *elm)
655 switch (elm->state) {
660 case ELM_GETMAGICCHAR:
662 /* Wait for 'y' or '>' */
665 for (i = 0; i < elm->rxfill; i++) {
666 if (elm->rxbuf[i] == ELM327_MAGIC_CHAR) {
667 elm327_send(elm, "\r", 1);
668 elm->state = ELM_GETPROMPT;
671 } else if (elm->rxbuf[i] == ELM327_READY_CHAR) {
672 elm327_send(elm, ELM327_MAGIC_STRING, 1);
678 elm327_drop_bytes(elm, i);
685 if (elm->rxbuf[elm->rxfill - 1] == ELM327_READY_CHAR) {
686 elm327_handle_prompt(elm);
693 /* Find <CR> delimiting feedback lines. */
695 (len < elm->rxfill) && (elm->rxbuf[len] != '\r');
700 if (len == sizeof(elm->rxbuf)) {
701 /* Line exceeds buffer. It's probably all garbage.
702 * Did we even connect at the right baud rate?
704 netdev_err(elm->dev, "RX buffer overflow. Faulty ELM327 connected?\n");
705 elm327_hw_failure(elm);
707 } else if (len == elm->rxfill) {
708 if (elm->state == ELM_RECEIVING
709 && elm->rxbuf[elm->rxfill - 1] == ELM327_READY_CHAR) {
710 /* The ELM327's AT ST response timeout ran out,
711 * so we got a prompt.
712 * Clear RX buffer and restart listening.
716 elm327_handle_prompt(elm);
719 /* We haven't received a full line yet.
720 * Wait for more data.
726 /* We have a full line to parse. */
727 elm327_parse_line(elm, len);
729 /* Remove parsed data from RX buffer. */
730 elm327_drop_bytes(elm, len+1);
732 /* More data to parse? */
734 elm327_parse_rxbuf(elm);
743 /************************************************************************
746 * (takes elm->lock) *
747 ************************************************************************/
749 /* Netdevice DOWN -> UP routine */
750 static int elmcan_netdev_open(struct net_device *dev)
752 struct elmcan *elm = netdev_priv(dev);
755 spin_lock_bh(&elm->lock);
756 if (elm->hw_failure) {
757 netdev_err(elm->dev, "Refusing to open interface after "
758 "a hardware fault has been detected.\n");
759 spin_unlock_bh(&elm->lock);
763 if (elm->tty == NULL) {
764 spin_unlock_bh(&elm->lock);
768 /* open_candev() checks for elm->can.bittiming.bitrate != 0 */
769 err = open_candev(dev);
771 spin_unlock_bh(&elm->lock);
775 /* Initialize the ELM327 */
777 spin_unlock_bh(&elm->lock);
779 can_led_event(dev, CAN_LED_EVENT_OPEN);
780 elm->can.state = CAN_STATE_ERROR_ACTIVE;
781 netif_start_queue(dev);
786 /* Netdevice UP -> DOWN routine */
787 static int elmcan_netdev_close(struct net_device *dev)
789 struct elmcan *elm = netdev_priv(dev);
791 spin_lock_bh(&elm->lock);
793 /* TTY discipline is running. */
795 /* Interrupt whatever we're doing right now */
796 elm327_send(elm, ELM327_MAGIC_STRING, 1);
798 /* Clear the wakeup bit, as the netdev will be down and thus
799 * the wakeup handler won't clear it
801 clear_bit(TTY_DO_WRITE_WAKEUP, &elm->tty->flags);
803 spin_unlock_bh(&elm->lock);
805 flush_work(&elm->tx_work);
807 spin_unlock_bh(&elm->lock);
810 elm->can.state = CAN_STATE_STOPPED;
811 netif_stop_queue(dev);
813 can_led_event(dev, CAN_LED_EVENT_STOP);
818 /* Send a can_frame to a TTY queue. */
819 static netdev_tx_t elmcan_netdev_start_xmit(struct sk_buff *skb, struct net_device *dev)
821 struct elmcan *elm = netdev_priv(dev);
822 struct can_frame *frame = (struct can_frame *) skb->data;
824 if (skb->len != sizeof(struct can_frame))
827 if (!netif_running(dev)) {
828 netdev_warn(elm->dev, "xmit: iface is down.\n");
832 /* BHs are already disabled, so no spin_lock_bh().
833 * See Documentation/networking/netdevices.txt
835 spin_lock(&elm->lock);
837 /* We shouldn't get here after a hardware fault:
838 * can_bus_off() calls netif_carrier_off()
840 BUG_ON(elm->hw_failure);
843 || elm->can.ctrlmode & CAN_CTRLMODE_LISTENONLY) {
844 spin_unlock(&elm->lock);
848 netif_stop_queue(dev);
850 elm327_send_frame(elm, frame);
851 spin_unlock(&elm->lock);
853 dev->stats.tx_packets++;
854 dev->stats.tx_bytes += frame->can_dlc;
856 can_led_event(dev, CAN_LED_EVENT_TX);
863 static int elmcan_netdev_change_mtu(struct net_device *dev, int new_mtu)
868 static const struct net_device_ops elmcan_netdev_ops = {
869 .ndo_open = elmcan_netdev_open,
870 .ndo_stop = elmcan_netdev_close,
871 .ndo_start_xmit = elmcan_netdev_start_xmit,
872 .ndo_change_mtu = elmcan_netdev_change_mtu,
879 /************************************************************************
882 * (takes elm->lock) *
883 ************************************************************************/
886 * Get a reference to our struct, taking into account locks/refcounts.
887 * This is to ensure ordering in case we are shutting down, and to ensure
888 * there is a refcount at all (because tty->disc_data may be NULL).
890 static struct elmcan* get_elm(struct tty_struct *tty)
895 /* Lock all elmcan TTYs, so tty->disc_data can't become NULL
896 * the moment before we increase the reference counter.
898 spin_lock_bh(&elmcan_discdata_lock);
899 elm = (struct elmcan *) tty->disc_data;
902 spin_unlock_bh(&elmcan_discdata_lock);
906 got_ref = atomic_inc_not_zero(&elm->refcount);
907 spin_unlock_bh(&elmcan_discdata_lock);
916 static void put_elm(struct elmcan *elm)
918 atomic_dec(&elm->refcount);
924 * Handle the 'receiver data ready' interrupt.
925 * This function is called by the 'tty_io' module in the kernel when
926 * a block of ELM327 CAN data has been received, which can now be parsed
927 * and sent on to some IP layer for further processing. This will not
928 * be re-entered while running but other ldisc functions may be called
931 static void elmcan_ldisc_rx(struct tty_struct *tty,
932 const unsigned char *cp, char *fp, int count)
934 struct elmcan *elm = get_elm(tty);
939 /* Read the characters out of the buffer */
940 while (count-- && elm->rxfill < sizeof(elm->rxbuf)) {
942 netdev_err(elm->dev, "Error in received character stream. Check your wiring.");
944 spin_lock_bh(&elm->lock);
945 elm327_hw_failure(elm);
946 spin_unlock_bh(&elm->lock);
952 elm->rxbuf[elm->rxfill++] = *cp;
958 netdev_err(elm->dev, "Receive buffer overflowed. Bad chip or wiring?");
960 spin_lock_bh(&elm->lock);
961 elm327_hw_failure(elm);
962 spin_unlock_bh(&elm->lock);
968 spin_lock_bh(&elm->lock);
969 elm327_parse_rxbuf(elm);
970 spin_unlock_bh(&elm->lock);
976 * Write out remaining transmit buffer.
977 * Scheduled when TTY is writable.
979 static void elmcan_ldisc_tx_worker(struct work_struct *work)
981 /* No need to use get_elm() here, as we'll always flush workers
982 * befory destroying the elmcan object.
984 struct elmcan *elm = container_of(work, struct elmcan, tx_work);
987 spin_lock_bh(&elm->lock);
988 if (elm->hw_failure) {
989 spin_unlock_bh(&elm->lock);
993 if (!elm->tty || !netif_running(elm->dev)) {
994 spin_unlock_bh(&elm->lock);
998 if (elm->txleft <= 0) {
999 /* Our TTY write buffer is empty:
1000 * We can start transmission of another packet
1002 clear_bit(TTY_DO_WRITE_WAKEUP, &elm->tty->flags);
1003 spin_unlock_bh(&elm->lock);
1004 netif_wake_queue(elm->dev);
1008 actual = elm->tty->ops->write(elm->tty, elm->txhead, elm->txleft);
1010 netdev_err(elm->dev, "Failed to write to tty %s.\n", elm->tty->name);
1011 elm327_hw_failure(elm);
1012 spin_unlock_bh(&elm->lock);
1016 elm->txleft -= actual;
1017 elm->txhead += actual;
1018 spin_unlock_bh(&elm->lock);
1023 * Called by the driver when there's room for more data.
1024 * Schedule the transmit.
1026 static void elmcan_ldisc_tx_wakeup(struct tty_struct *tty)
1028 struct elmcan *elm = get_elm(tty);
1033 schedule_work(&elm->tx_work);
1040 /* ELM327 can only handle bitrates that are integer divisors of 500 kHz,
1041 * or 7/8 of that. Divisors are 1 to 64.
1042 * Currently we don't implement support for 7/8 rates.
1044 static const u32 elmcan_bitrate_const[64] = {
1045 7812, 7936, 8064, 8196, 8333, 8474, 8620, 8771,
1046 8928, 9090, 9259, 9433, 9615, 9803, 10000, 10204,
1047 10416, 10638, 10869, 11111, 11363, 11627, 11904, 12195,
1048 12500, 12820, 13157, 13513, 13888, 14285, 14705, 15151,
1049 15625, 16129, 16666, 17241, 17857, 18518, 19230, 20000,
1050 20833, 21739, 22727, 23809, 25000, 26315, 27777, 29411,
1051 31250, 33333, 35714, 38461, 41666, 45454, 50000, 55555,
1052 62500, 71428, 83333, 100000, 125000, 166666, 250000, 500000
1055 /* Dummy function to claim we're changing the bitrate.
1056 * We actually do this when opening the net device.
1058 static int elmcan_do_set_bittiming(struct net_device *netdev)
1065 * Open the high-level part of the elmcan channel.
1066 * This function is called by the TTY module when the
1067 * elmcan line discipline is called for.
1069 * Called in process context serialized from other ldisc calls.
1071 static int elmcan_ldisc_open(struct tty_struct *tty)
1073 struct net_device *dev;
1077 if (!capable(CAP_NET_ADMIN))
1080 if (!tty->ops->write)
1084 /* OK. Find a free elmcan channel to use. */
1085 dev = alloc_candev(sizeof(struct elmcan), 0);
1088 elm = netdev_priv(dev);
1090 /* Configure TTY interface */
1091 tty->receive_room = 65536; /* We don't flow control */
1092 elm->txleft = 0; /* Clear TTY TX buffer */
1093 spin_lock_init(&elm->lock);
1094 atomic_set(&elm->refcount, 1);
1095 INIT_WORK(&elm->tx_work, elmcan_ldisc_tx_worker);
1097 /* Configure CAN metadata */
1098 elm->can.state = CAN_STATE_STOPPED;
1099 elm->can.bitrate_const = elmcan_bitrate_const;
1100 elm->can.bitrate_const_cnt = ARRAY_SIZE(elmcan_bitrate_const);
1101 elm->can.do_set_bittiming = elmcan_do_set_bittiming;
1102 elm->can.ctrlmode_supported = CAN_CTRLMODE_LISTENONLY;
1104 /* Configure netlink interface */
1106 dev->netdev_ops = &elmcan_netdev_ops;
1108 /* Mark ldisc channel as alive */
1110 tty->disc_data = elm;
1112 devm_can_led_init(elm->dev);
1115 err = register_candev(elm->dev);
1117 free_candev(elm->dev);
1121 netdev_info(elm->dev, "elmcan on %s.\n", tty->name);
1127 * Close down an elmcan channel.
1128 * This means flushing out any pending queues, and then returning.
1129 * This call is serialized against other ldisc functions:
1130 * Once this is called, no other ldisc function of ours is entered.
1132 * We also use this function for a hangup event.
1134 static void elmcan_ldisc_close(struct tty_struct *tty)
1136 /* Use get_elm() to synchronize against other users */
1137 struct elmcan *elm = get_elm(tty);
1142 /* Tear down network side.
1143 * unregister_netdev() calls .ndo_stop() so we don't have to.
1145 unregister_candev(elm->dev);
1147 /* Decrease the refcount twice, once for our own get_elm(),
1148 * and once to remove the count of 1 that we set in _open().
1149 * Once it reaches 0, we can safely destroy it.
1154 /* Spin until refcount reaches 0 */
1155 while(atomic_read(&elm->refcount) > 0)
1158 /* At this point, all ldisc calls to us will be no-ops.
1159 * Since the refcount is 0, they are bailing immediately.
1162 /* Mark channel as dead */
1163 spin_lock_bh(&elm->lock);
1164 tty->disc_data = NULL;
1166 spin_unlock_bh(&elm->lock);
1168 /* Flush TTY side */
1169 flush_work(&elm->tx_work);
1171 netdev_info(elm->dev, "elmcan off %s.\n", tty->name);
1173 /* Free our memory */
1174 free_candev(elm->dev);
1177 static int elmcan_ldisc_hangup(struct tty_struct *tty)
1179 elmcan_ldisc_close(tty);
1183 /* Perform I/O control on an active elmcan channel. */
1184 static int elmcan_ldisc_ioctl(struct tty_struct *tty, struct file *file,
1185 unsigned int cmd, unsigned long arg)
1187 struct elmcan *elm = get_elm(tty);
1195 tmp = strlen(elm->dev->name) + 1;
1196 if (copy_to_user((void __user *)arg, elm->dev->name, tmp)) {
1210 return tty_mode_ioctl(tty, file, cmd, arg);
1214 static struct tty_ldisc_ops elmcan_ldisc = {
1215 .owner = THIS_MODULE,
1216 .magic = TTY_LDISC_MAGIC,
1218 .receive_buf = elmcan_ldisc_rx,
1219 .write_wakeup = elmcan_ldisc_tx_wakeup,
1220 .open = elmcan_ldisc_open,
1221 .close = elmcan_ldisc_close,
1222 .hangup = elmcan_ldisc_hangup,
1223 .ioctl = elmcan_ldisc_ioctl,
1230 /************************************************************************
1231 * Module init/exit *
1232 ************************************************************************/
1234 static int __init elmcan_init(void)
1238 pr_info("ELM327 based best-effort CAN interface driver\n");
1239 pr_info("This device is severely limited as a CAN interface, see documentation.\n");
1241 /* Fill in our line protocol discipline, and register it */
1242 status = tty_register_ldisc(N_ELMCAN, &elmcan_ldisc);
1244 pr_err("can't register line discipline\n");
1249 static void __exit elmcan_exit(void)
1251 /* This will only be called when all channels have been closed by
1252 * userspace - tty_ldisc.c takes care of the module's refcount.
1256 status = tty_unregister_ldisc(N_ELMCAN);
1258 pr_err("Can't unregister line discipline (error: %d)\n", status);
1262 module_init(elmcan_init);
1263 module_exit(elmcan_exit);