Separate buffers from struct elm
[elmcan.git] / module / elmcan.c
index c3acc07f70f5da8cb1880e86ea8eeba09827742a..7ac1f5466a052a3c6e889e830fc6927313fc8b42 100644 (file)
@@ -1,16 +1,15 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * elmcan.c - ELM327 based CAN interface driver
  *            (tty line discipline)
  *
  * This file is derived from linux/drivers/net/can/slcan.c
  *
- * elmcan.c Author : Max Staudt <elmcan@enpas.org>
+ * elmcan.c Author : Max Staudt <max-linux@enpas.org>
  * slcan.c Author  : Oliver Hartkopp <socketcan@hartkopp.net>
  * slip.c Authors  : Laurence Culhane <loz@holmes.demon.co.uk>
  *                   Fred N. van Kempen <waltje@uwalt.nl.mugnet.org>
  *
- * SPDX-License-Identifier: GPL-2.0
- *
  */
 
 #define pr_fmt(fmt) "[elmcan] " fmt
@@ -22,6 +21,7 @@
 
 #include <linux/atomic.h>
 #include <linux/bitops.h>
+#include <linux/ctype.h>
 #include <linux/delay.h>
 #include <linux/errno.h>
 #include <linux/if_ether.h>
@@ -45,11 +45,24 @@ MODULE_DESCRIPTION("ELM327 based CAN interface");
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Max Staudt <max-linux@enpas.org>");
 
+/* If this is enabled, we'll try to make the best of the situation
+ * even if we receive unexpected characters on the line.
+ * No guarantees.
+ * Handle with care, it's likely your hardware is unreliable!
+ */
+static bool accept_flaky_uart;
+module_param_named(accept_flaky_uart, accept_flaky_uart, bool, 0444);
+MODULE_PARM_DESC(accept_flaky_uart, "Don't bail at the first invalid character. Behavior undefined.");
+
+
 /* Line discipline ID number */
 #ifndef N_ELMCAN
 #define N_ELMCAN 29
 #endif
 
+#define ELM327_SIZE_RXBUF 256
+#define ELM327_SIZE_TXBUF 32
+
 #define ELM327_CAN_CONFIG_SEND_SFF           0x8000
 #define ELM327_CAN_CONFIG_VARIABLE_DLC       0x4000
 #define ELM327_CAN_CONFIG_RECV_BOTH_SFF_EFF  0x2000
@@ -66,6 +79,7 @@ enum ELM_TODO {
        ELM_TODO_CANID_11BIT,
        ELM_TODO_CANID_29BIT_LOW,
        ELM_TODO_CANID_29BIT_HIGH,
+       ELM_TODO_CAN_CONFIG_PART2,
        ELM_TODO_CAN_CONFIG,
        ELM_TODO_RESPONSES,
        ELM_TODO_SILENT_MONITOR,
@@ -100,12 +114,12 @@ struct elmcan {
 
        /* TTY TX helpers */
        struct work_struct      tx_work;        /* Flushes TTY TX buffer   */
-       unsigned char           txbuf[32];
+       unsigned char           *txbuf;
        unsigned char           *txhead;        /* Pointer to next TX byte */
        int                     txleft;         /* Bytes left to TX */
 
        /* TTY RX helpers */
-       unsigned char rxbuf[256];
+       unsigned char *rxbuf;
        int rxfill;
 
        /* State machine */
@@ -119,7 +133,8 @@ struct elmcan {
        int drop_next_line;
 
        /* The CAN frame and config the ELM327 is sending/using,
-        * or will send/use after finishing all cmds_todo */
+        * or will send/use after finishing all cmds_todo
+        */
        struct can_frame can_frame;
        unsigned short can_config;
        unsigned long can_bitrate;
@@ -144,19 +159,18 @@ static inline void elm327_hw_failure(struct elmcan *elm);
 
 
 
- /************************************************************************
-  *            ELM327: Transmission                            *
-  *                                                            *
-  * (all functions assume elm->lock taken)                     *
-  ************************************************************************/
+ /***********************************************************************
+  *            ELM327: Transmission                                    *
+  *                                                                    *
+  * (all functions assume elm->lock taken)                             *
+  ***********************************************************************/
 
 static void elm327_send(struct elmcan *elm, const void *buf, size_t len)
 {
        int actual;
 
-       if (elm->hw_failure) {
+       if (elm->hw_failure)
                return;
-       }
 
        memcpy(elm->txbuf, buf, len);
 
@@ -171,7 +185,9 @@ static void elm327_send(struct elmcan *elm, const void *buf, size_t len)
        set_bit(TTY_DO_WRITE_WAKEUP, &elm->tty->flags);
        actual = elm->tty->ops->write(elm->tty, elm->txbuf, len);
        if (actual < 0) {
-               netdev_err(elm->dev, "Failed to write to tty %s.\n", elm->tty->name);
+               netdev_err(elm->dev,
+                       "Failed to write to tty %s.\n",
+                       elm->tty->name);
                elm327_hw_failure(elm);
                return;
        }
@@ -181,10 +197,10 @@ static void elm327_send(struct elmcan *elm, const void *buf, size_t len)
 }
 
 
-/*
- * Take the ELM327 out of almost any state and back into command mode
- *
- * Assumes elm->lock taken.
+/* Take the ELM327 out of almost any state and back into command mode.
+ * We send ELM327_MAGIC_CHAR which will either abort any running
+ * operation, or be echoed back to us in case we're already in command
+ * mode.
  */
 static void elm327_kick_into_cmd_mode(struct elmcan *elm)
 {
@@ -192,24 +208,21 @@ static void elm327_kick_into_cmd_mode(struct elmcan *elm)
                elm327_send(elm, ELM327_MAGIC_STRING, 1);
 
                elm->state = ELM_GETMAGICCHAR;
-               elm->rxfill = 0;
        }
 }
 
 
-/*
- * Schedule a CAN frame, and any necessary config changes,
- * to be sent down the TTY.
- *
- * Assumes elm->lock taken.
- */
+/* Schedule a CAN frame and necessary config changes to be sent to the TTY. */
 static void elm327_send_frame(struct elmcan *elm, struct can_frame *frame)
 {
        /* Schedule any necessary changes in ELM327's CAN configuration */
        if (elm->can_frame.can_id != frame->can_id) {
                /* Set the new CAN ID for transmission. */
-               if ((frame->can_id & CAN_EFF_FLAG) ^ (elm->can_frame.can_id & CAN_EFF_FLAG)) {
-                       elm->can_config = (frame->can_id & CAN_EFF_FLAG ? 0 : ELM327_CAN_CONFIG_SEND_SFF)
+               if ((frame->can_id & CAN_EFF_FLAG)
+                   ^ (elm->can_frame.can_id & CAN_EFF_FLAG)) {
+                       elm->can_config = (frame->can_id & CAN_EFF_FLAG
+                                               ? 0
+                                               : ELM327_CAN_CONFIG_SEND_SFF)
                                        | ELM327_CAN_CONFIG_VARIABLE_DLC
                                        | ELM327_CAN_CONFIG_RECV_BOTH_SFF_EFF
                                        | elm->can_bitrate_divisor;
@@ -237,11 +250,11 @@ static void elm327_send_frame(struct elmcan *elm, struct can_frame *frame)
 
 
 
- /************************************************************************
-  *            ELM327: Initialization sequence                 *
-  *                                                            *
-  * (assumes elm->lock taken)                                  *
-  ************************************************************************/
+ /***********************************************************************
+  *            ELM327: Initialization sequence                         *
+  *                                                                    *
+  * (assumes elm->lock taken)                                          *
+  ***********************************************************************/
 
 static char *elm327_init_script[] = {
        "AT WS\r",        /* v1.0: Warm Start */
@@ -295,20 +308,20 @@ static void elm327_init(struct elmcan *elm)
 
 
 
- /************************************************************************
-  *            ELM327: Reception -> netdev glue                *
-  *                                                            *
-  * (assumes elm->lock taken)                                  *
-  ************************************************************************/
+ /***********************************************************************
+  *            ELM327: Reception -> netdev glue                        *
+  *                                                                    *
+  * (assumes elm->lock taken)                                          *
+  ***********************************************************************/
 
-static void elm327_feed_frame_to_netdev(struct elmcan *elm, const struct can_frame *frame)
+static void elm327_feed_frame_to_netdev(struct elmcan *elm,
+                                       const struct can_frame *frame)
 {
        struct can_frame *cf;
        struct sk_buff *skb;
 
-       if (!netif_running(elm->dev)) {
+       if (!netif_running(elm->dev))
                return;
-       }
 
        skb = alloc_can_skb(elm->dev, &cf);
 
@@ -326,11 +339,11 @@ static void elm327_feed_frame_to_netdev(struct elmcan *elm, const struct can_fra
 
 
 
- /************************************************************************
-  *            ELM327: "Panic" handler                         *
-  *                                                            *
-  * (assumes elm->lock taken)                                  *
-  ************************************************************************/
+ /***********************************************************************
+  *            ELM327: "Panic" handler                                 *
+  *                                                                    *
+  * (assumes elm->lock taken)                                          *
+  ***********************************************************************/
 
 /* Called when we're out of ideas and just want it all to end. */
 static inline void elm327_hw_failure(struct elmcan *elm)
@@ -345,8 +358,7 @@ static inline void elm327_hw_failure(struct elmcan *elm)
        frame.data[7] = 'P';
        elm327_feed_frame_to_netdev(elm, &frame);
 
-       netdev_err(elm->dev, "ELM327 misbehaved. "
-                       "Blocking further communication.\n");
+       netdev_err(elm->dev, "ELM327 misbehaved. Blocking further communication.\n");
 
        elm->hw_failure = true;
        can_bus_off(elm->dev);
@@ -368,58 +380,70 @@ static void elm327_parse_error(struct elmcan *elm, int len)
        frame.can_id = CAN_ERR_FLAG;
        frame.can_dlc = CAN_ERR_DLC;
 
-       switch(len) {
-               case 17:
-                       if (!memcmp(elm->rxbuf, "UNABLE TO CONNECT", 17)) {
-                               netdev_err(elm->dev, "The ELM327 reported UNABLE TO CONNECT. Please check your setup.\n");
-                       }
-                       break;
-               case 11:
-                       if (!memcmp(elm->rxbuf, "BUFFER FULL", 11)) {
-                               /* This case will only happen if the last data
-                                * line was complete.
-                                * Otherwise, elm327_parse_frame() will emit the
-                                * error frame instead.
-                                */
-                               frame.can_id |= CAN_ERR_CRTL;
-                               frame.data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
-                       }
-                       break;
-               case 9:
-                       if (!memcmp(elm->rxbuf, "BUS ERROR", 9)) {
-                               frame.can_id |= CAN_ERR_BUSERROR;
-                       }
-                       if (!memcmp(elm->rxbuf, "CAN ERROR", 9)
-                               || !memcmp(elm->rxbuf, "<RX ERROR", 9)) {
-                               frame.can_id |= CAN_ERR_PROT;
-                       }
-                       break;
-               case 8:
-                       if (!memcmp(elm->rxbuf, "BUS BUSY", 8)) {
-                               frame.can_id |= CAN_ERR_PROT;
-                               frame.data[2] = CAN_ERR_PROT_OVERLOAD;
-                       }
-                       if (!memcmp(elm->rxbuf, "FB ERROR", 8)) {
-                               frame.can_id |= CAN_ERR_PROT;
-                               frame.data[2] = CAN_ERR_PROT_TX;
-                       }
-                       break;
-               case 5:
-                       if (!memcmp(elm->rxbuf, "ERR", 3)) {
-                               netdev_err(elm->dev, "The ELM327 reported an ERR%c%c. Please power it off and on again.\n",
-                                       elm->rxbuf[3], elm->rxbuf[4]);
-                               frame.can_id |= CAN_ERR_CRTL;
-                       }
-                       break;
-               default:
-                       /* Don't emit an error frame if we're unsure */
-                       return;
+       switch (len) {
+       case 17:
+               if (!memcmp(elm->rxbuf, "UNABLE TO CONNECT", 17)) {
+                       netdev_err(elm->dev,
+                               "The ELM327 reported UNABLE TO CONNECT. Please check your setup.\n");
+               }
+               break;
+       case 11:
+               if (!memcmp(elm->rxbuf, "BUFFER FULL", 11)) {
+                       /* This case will only happen if the last data
+                        * line was complete.
+                        * Otherwise, elm327_parse_frame() will heuristically
+                        * emit this error frame instead.
+                        */
+                       frame.can_id |= CAN_ERR_CRTL;
+                       frame.data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
+               }
+               break;
+       case 9:
+               if (!memcmp(elm->rxbuf, "BUS ERROR", 9))
+                       frame.can_id |= CAN_ERR_BUSERROR;
+               if (!memcmp(elm->rxbuf, "CAN ERROR", 9))
+                       frame.can_id |= CAN_ERR_PROT;
+               if (!memcmp(elm->rxbuf, "<RX ERROR", 9))
+                       frame.can_id |= CAN_ERR_PROT;
+               break;
+       case 8:
+               if (!memcmp(elm->rxbuf, "BUS BUSY", 8)) {
+                       frame.can_id |= CAN_ERR_PROT;
+                       frame.data[2] = CAN_ERR_PROT_OVERLOAD;
+               }
+               if (!memcmp(elm->rxbuf, "FB ERROR", 8)) {
+                       frame.can_id |= CAN_ERR_PROT;
+                       frame.data[2] = CAN_ERR_PROT_TX;
+               }
+               break;
+       case 5:
+               if (!memcmp(elm->rxbuf, "ERR", 3)) {
+                       netdev_err(elm->dev, "The ELM327 reported an ERR%c%c. Please power it off and on again.\n",
+                               elm->rxbuf[3], elm->rxbuf[4]);
+                       frame.can_id |= CAN_ERR_CRTL;
+               }
+               break;
+       default:
+               /* Don't emit an error frame if we're unsure */
+               return;
        }
 
        elm327_feed_frame_to_netdev(elm, &frame);
 }
 
 
+/* Parse CAN frames coming as ASCII from ELM327.
+ * They can be of various formats:
+ *
+ * 29-bit ID (EFF):  12 34 56 78 D PL PL PL PL PL PL PL PL
+ * 11-bit ID (!EFF): 123 D PL PL PL PL PL PL PL PL
+ *
+ * where D = DLC, PL = payload byte
+ *
+ * Instead of a payload, RTR indicates a remote request.
+ *
+ * We will use the spaces and line length to guess the format.
+ */
 static int elm327_parse_frame(struct elmcan *elm, int len)
 {
        struct can_frame frame;
@@ -441,6 +465,23 @@ static int elm327_parse_frame(struct elmcan *elm, int len)
                }
        }
 
+       /* If we accept stray characters coming in:
+        * Check for stray characters on a payload line.
+        * No idea what causes this.
+        */
+       if (accept_flaky_uart
+           && hexlen < len
+           && !isdigit(elm->rxbuf[hexlen])
+           && !isupper(elm->rxbuf[hexlen])
+           && '<' != elm->rxbuf[hexlen]
+           && ' ' != elm->rxbuf[hexlen]) {
+               /* The line is likely garbled anyway, so bail.
+                * The main code will restart listening.
+                */
+               elm327_kick_into_cmd_mode(elm);
+               return 3;
+       }
+
        /* Use spaces in CAN ID to distinguish 29 or 11 bit address length.
         * No out-of-bounds access:
         * We use the fact that we can always read from elm->rxbuf.
@@ -492,14 +533,15 @@ static int elm327_parse_frame(struct elmcan *elm, int len)
 
        /* Check for RTR frame */
        if (elm->rxfill >= hexlen + 3
-           && elm->rxbuf[hexlen + 0] == 'R'
-           && elm->rxbuf[hexlen + 1] == 'T'
-           && elm->rxbuf[hexlen + 2] == 'R') {
+           && !memcmp(&elm->rxbuf[hexlen], "RTR", 3)) {
                frame.can_id |= CAN_RTR_FLAG;
        }
 
-       /* Is the line long enough to hold the advertised payload? */
-       if (!(frame.can_id & CAN_RTR_FLAG) && (hexlen < frame.can_dlc * 3 + datastart)) {
+       /* Is the line long enough to hold the advertised payload?
+        * Note: RTR frames have a DLC, but no actual payload.
+        */
+       if (!(frame.can_id & CAN_RTR_FLAG)
+           && (hexlen < frame.can_dlc * 3 + datastart)) {
                /* Incomplete frame. */
 
                /* Probably the ELM327's RS232 TX buffer was full.
@@ -521,7 +563,7 @@ static int elm327_parse_frame(struct elmcan *elm, int len)
        /* Parse the data nibbles. */
        for (i = 0; i < frame.can_dlc; i++) {
                frame.data[i] = (hex_to_bin(elm->rxbuf[datastart+3*i]) << 4)
-                                | (hex_to_bin(elm->rxbuf[datastart+3*i+1]) << 0);
+                             | (hex_to_bin(elm->rxbuf[datastart+3*i+1]) << 0);
        }
 
        /* Feed the frame to the network layer. */
@@ -534,9 +576,8 @@ static int elm327_parse_frame(struct elmcan *elm, int len)
 static void elm327_parse_line(struct elmcan *elm, int len)
 {
        /* Skip empty lines */
-       if (!len) {
+       if (!len)
                return;
-       }
 
        /* Skip echo lines */
        if (elm->drop_next_line) {
@@ -547,107 +588,112 @@ static void elm327_parse_line(struct elmcan *elm, int len)
        }
 
        /* Regular parsing */
-       switch(elm->state) {
-               case ELM_RECEIVING:
-                       if (elm327_parse_frame(elm, len)) {
-                               /* Parse an error line. */
-                               elm327_parse_error(elm, len);
+       switch (elm->state) {
+       case ELM_RECEIVING:
+               if (elm327_parse_frame(elm, len)) {
+                       /* Parse an error line. */
+                       elm327_parse_error(elm, len);
 
-                               /* After the error line, we expect a prompt. */
-                               elm->state = ELM_GETPROMPT;
-                       }
-                       break;
-               default:
-                       break;
+                       /* Start afresh. */
+                       elm327_kick_into_cmd_mode(elm);
+               }
+               break;
+       default:
+               break;
        }
 }
 
-
 static void elm327_handle_prompt(struct elmcan *elm)
 {
-       if (elm->cmds_todo) {
-               struct can_frame *frame = &elm->can_frame;
-               char local_txbuf[20];
-
-               if (test_bit(ELM_TODO_INIT, &elm->cmds_todo)) {
-                       elm327_send(elm, *elm->next_init_cmd, strlen(*elm->next_init_cmd));
-                       elm->next_init_cmd++;
-                       if (!(*elm->next_init_cmd)) {
-                               clear_bit(ELM_TODO_INIT, &elm->cmds_todo);
-                               netdev_info(elm->dev, "Initialization finished.\n");
-                       }
+       struct can_frame *frame = &elm->can_frame;
+       char local_txbuf[20];
 
-                       /* Some chips are unreliable and need extra time after
-                        * init commands, as seen with a clone.
-                        * So let's do a dummy get-cmd-prompt dance.
-                        */
-                       elm->state = ELM_NOTINIT;
-                       elm327_kick_into_cmd_mode(elm);
+       if (!elm->cmds_todo) {
+               /* Enter CAN monitor mode */
+               elm327_send(elm, "ATMA\r", 5);
+               elm->state = ELM_RECEIVING;
 
-                       return;
+               return;
+       }
+
+       /* Reconfigure ELM327 step by step as indicated by elm->cmds_todo */
+       if (test_bit(ELM_TODO_INIT, &elm->cmds_todo)) {
+               strcpy(local_txbuf, *elm->next_init_cmd);
 
-               } else if (test_and_clear_bit(ELM_TODO_SILENT_MONITOR, &elm->cmds_todo)) {
-                       sprintf(local_txbuf, "ATCSM%i\r",
-                               !(!(elm->can.ctrlmode & CAN_CTRLMODE_LISTENONLY)));
+               elm->next_init_cmd++;
+               if (!(*elm->next_init_cmd)) {
+                       clear_bit(ELM_TODO_INIT, &elm->cmds_todo);
+                       netdev_info(elm->dev, "Initialization finished.\n");
+               }
 
-               } else if (test_and_clear_bit(ELM_TODO_RESPONSES, &elm->cmds_todo)) {
-                       sprintf(local_txbuf, "ATR%i\r",
-                               !(elm->can.ctrlmode & CAN_CTRLMODE_LISTENONLY));
+       } else if (test_and_clear_bit(ELM_TODO_SILENT_MONITOR, &elm->cmds_todo)) {
+               sprintf(local_txbuf, "ATCSM%i\r",
+                       !(!(elm->can.ctrlmode & CAN_CTRLMODE_LISTENONLY)));
 
-               } else if (test_and_clear_bit(ELM_TODO_CAN_CONFIG, &elm->cmds_todo)) {
-                       sprintf(local_txbuf, "ATPB%04X\r",
-                               elm->can_config);
+       } else if (test_and_clear_bit(ELM_TODO_RESPONSES, &elm->cmds_todo)) {
+               sprintf(local_txbuf, "ATR%i\r",
+                       !(elm->can.ctrlmode & CAN_CTRLMODE_LISTENONLY));
 
-               } else if (test_and_clear_bit(ELM_TODO_CANID_29BIT_HIGH, &elm->cmds_todo)) {
-                       sprintf(local_txbuf, "ATCP%02X\r",
-                               (frame->can_id & CAN_EFF_MASK) >> 24);
+       } else if (test_and_clear_bit(ELM_TODO_CAN_CONFIG, &elm->cmds_todo)) {
+               sprintf(local_txbuf, "ATPC\r");
+               set_bit(ELM_TODO_CAN_CONFIG_PART2, &elm->cmds_todo);
 
-               } else if (test_and_clear_bit(ELM_TODO_CANID_29BIT_LOW, &elm->cmds_todo)) {
-                       sprintf(local_txbuf, "ATSH%06X\r",
-                               frame->can_id & CAN_EFF_MASK & ((1 << 24) - 1));
+       } else if (test_and_clear_bit(ELM_TODO_CAN_CONFIG_PART2, &elm->cmds_todo)) {
+               sprintf(local_txbuf, "ATPB%04X\r",
+                       elm->can_config);
 
-               } else if (test_and_clear_bit(ELM_TODO_CANID_11BIT, &elm->cmds_todo)) {
-                       sprintf(local_txbuf, "ATSH%03X\r",
-                               frame->can_id & CAN_SFF_MASK);
+       } else if (test_and_clear_bit(ELM_TODO_CANID_29BIT_HIGH, &elm->cmds_todo)) {
+               sprintf(local_txbuf, "ATCP%02X\r",
+                       (frame->can_id & CAN_EFF_MASK) >> 24);
 
-               } else if (test_and_clear_bit(ELM_TODO_CAN_DATA, &elm->cmds_todo)) {
-                       if (frame->can_id & CAN_RTR_FLAG) {
-                               /* Send an RTR frame. Their DLC is fixed.
-                                * Some chips don't send them at all.
-                                */
-                               sprintf(local_txbuf, "ATRTR\r");
-                       } else {
-                               /* Send a regular CAN data frame */
-                               int i;
+       } else if (test_and_clear_bit(ELM_TODO_CANID_29BIT_LOW, &elm->cmds_todo)) {
+               sprintf(local_txbuf, "ATSH%06X\r",
+                       frame->can_id & CAN_EFF_MASK & ((1 << 24) - 1));
 
-                               for (i = 0; i < frame->can_dlc; i++) {
-                                       sprintf(&local_txbuf[2*i], "%02X",
-                                               frame->data[i]);
-                               }
+       } else if (test_and_clear_bit(ELM_TODO_CANID_11BIT, &elm->cmds_todo)) {
+               sprintf(local_txbuf, "ATSH%03X\r",
+                       frame->can_id & CAN_SFF_MASK);
 
-                               sprintf(&local_txbuf[2*i], "\r");
+       } else if (test_and_clear_bit(ELM_TODO_CAN_DATA, &elm->cmds_todo)) {
+               if (frame->can_id & CAN_RTR_FLAG) {
+                       /* Send an RTR frame. Their DLC is fixed.
+                        * Some chips don't send them at all.
+                        */
+                       sprintf(local_txbuf, "ATRTR\r");
+               } else {
+                       /* Send a regular CAN data frame */
+                       int i;
+
+                       for (i = 0; i < frame->can_dlc; i++) {
+                               sprintf(&local_txbuf[2*i], "%02X",
+                                       frame->data[i]);
                        }
 
-                       elm->drop_next_line = 1;
-                       elm->state = ELM_RECEIVING;
+                       sprintf(&local_txbuf[2*i], "\r");
                }
 
-               elm327_send(elm, local_txbuf, strlen(local_txbuf));
-       } else {
-               /* Enter CAN monitor mode */
-               elm327_send(elm, "ATMA\r", 5);
+               elm->drop_next_line = 1;
                elm->state = ELM_RECEIVING;
        }
+
+       elm327_send(elm, local_txbuf, strlen(local_txbuf));
 }
 
 
+static bool elm327_is_ready_char(char c)
+{
+       /* Bits 0xc0 are sometimes set (randomly), hence the mask.
+        * Probably bad hardware.
+        */
+       return (c & 0x3f) == ELM327_READY_CHAR;
+}
+
 static void elm327_drop_bytes(struct elmcan *elm, int i)
 {
-       memmove(&elm->rxbuf[0], &elm->rxbuf[i], sizeof(elm->rxbuf) - i);
+       memmove(&elm->rxbuf[0], &elm->rxbuf[i], ELM327_SIZE_RXBUF - i);
        elm->rxfill -= i;
 }
 
-
 static void elm327_parse_rxbuf(struct elmcan *elm)
 {
        int len;
@@ -655,7 +701,7 @@ static void elm327_parse_rxbuf(struct elmcan *elm)
        switch (elm->state) {
        case ELM_NOTINIT:
                elm->rxfill = 0;
-               return;
+               break;
 
        case ELM_GETMAGICCHAR:
        {
@@ -668,7 +714,7 @@ static void elm327_parse_rxbuf(struct elmcan *elm)
                                elm->state = ELM_GETPROMPT;
                                i++;
                                break;
-                       } else if (elm->rxbuf[i] == ELM327_READY_CHAR) {
+                       } else if (elm327_is_ready_char(elm->rxbuf[i])) {
                                elm327_send(elm, ELM327_MAGIC_STRING, 1);
                                i++;
                                break;
@@ -677,17 +723,16 @@ static void elm327_parse_rxbuf(struct elmcan *elm)
 
                elm327_drop_bytes(elm, i);
 
-               return;
+               break;
        }
 
        case ELM_GETPROMPT:
                /* Wait for '>' */
-               if (elm->rxbuf[elm->rxfill - 1] == ELM327_READY_CHAR) {
+               if (elm327_is_ready_char(elm->rxbuf[elm->rxfill - 1]))
                        elm327_handle_prompt(elm);
-               }
 
                elm->rxfill = 0;
-               return;
+               break;
 
        case ELM_RECEIVING:
                /* Find <CR> delimiting feedback lines. */
@@ -697,16 +742,16 @@ static void elm327_parse_rxbuf(struct elmcan *elm)
                        /* empty loop */
                }
 
-               if (len == sizeof(elm->rxbuf)) {
+               if (len == ELM327_SIZE_RXBUF) {
                        /* Line exceeds buffer. It's probably all garbage.
                         * Did we even connect at the right baud rate?
                         */
-                       netdev_err(elm->dev, "RX buffer overflow. Faulty ELM327 connected?\n");
+                       netdev_err(elm->dev,
+                               "RX buffer overflow. Faulty ELM327 or UART?\n");
                        elm327_hw_failure(elm);
-                       return;
+                       break;
                } else if (len == elm->rxfill) {
-                       if (elm->state == ELM_RECEIVING
-                               && elm->rxbuf[elm->rxfill - 1] == ELM327_READY_CHAR) {
+                       if (elm327_is_ready_char(elm->rxbuf[elm->rxfill - 1])) {
                                /* The ELM327's AT ST response timeout ran out,
                                 * so we got a prompt.
                                 * Clear RX buffer and restart listening.
@@ -714,13 +759,13 @@ static void elm327_parse_rxbuf(struct elmcan *elm)
                                elm->rxfill = 0;
 
                                elm327_handle_prompt(elm);
-                               return;
-                       } else {
-                               /* We haven't received a full line yet.
-                                * Wait for more data.
-                                */
-                               return;
+                               break;
                        }
+
+                       /* No <CR> found - we haven't received a full line yet.
+                        * Wait for more data.
+                        */
+                       break;
                }
 
                /* We have a full line to parse. */
@@ -730,9 +775,8 @@ static void elm327_parse_rxbuf(struct elmcan *elm)
                elm327_drop_bytes(elm, len+1);
 
                /* More data to parse? */
-               if (elm->rxfill) {
+               if (elm->rxfill)
                        elm327_parse_rxbuf(elm);
-               }
        }
 }
 
@@ -740,13 +784,12 @@ static void elm327_parse_rxbuf(struct elmcan *elm)
 
 
 
- /************************************************************************
-  *            netdev                                          *
-  *                                                            *
-  * (takes elm->lock)                                          *
-  ************************************************************************/
+ /***********************************************************************
+  *            netdev                                                  *
+  *                                                                    *
+  * (takes elm->lock)                                                  *
+  ***********************************************************************/
 
-/* Netdevice DOWN -> UP routine */
 static int elmcan_netdev_open(struct net_device *dev)
 {
        struct elmcan *elm = netdev_priv(dev);
@@ -754,8 +797,7 @@ static int elmcan_netdev_open(struct net_device *dev)
 
        spin_lock_bh(&elm->lock);
        if (elm->hw_failure) {
-               netdev_err(elm->dev, "Refusing to open interface after "
-                               "a hardware fault has been detected.\n");
+               netdev_err(elm->dev, "Refusing to open interface after a hardware fault has been detected.\n");
                spin_unlock_bh(&elm->lock);
                return -EIO;
        }
@@ -772,7 +814,6 @@ static int elmcan_netdev_open(struct net_device *dev)
                return err;
        }
 
-       /* Initialize the ELM327 */
        elm327_init(elm);
        spin_unlock_bh(&elm->lock);
 
@@ -783,15 +824,12 @@ static int elmcan_netdev_open(struct net_device *dev)
        return 0;
 }
 
-/* Netdevice UP -> DOWN routine */
 static int elmcan_netdev_close(struct net_device *dev)
 {
        struct elmcan *elm = netdev_priv(dev);
 
        spin_lock_bh(&elm->lock);
        if (elm->tty) {
-               /* TTY discipline is running. */
-
                /* Interrupt whatever we're doing right now */
                elm327_send(elm, ELM327_MAGIC_STRING, 1);
 
@@ -815,8 +853,9 @@ static int elmcan_netdev_close(struct net_device *dev)
        return 0;
 }
 
-/* Send a can_frame to a TTY queue. */
-static netdev_tx_t elmcan_netdev_start_xmit(struct sk_buff *skb, struct net_device *dev)
+/* Send a can_frame to a TTY. */
+static netdev_tx_t elmcan_netdev_start_xmit(struct sk_buff *skb,
+                                           struct net_device *dev)
 {
        struct elmcan *elm = netdev_priv(dev);
        struct can_frame *frame = (struct can_frame *) skb->data;
@@ -837,9 +876,10 @@ static netdev_tx_t elmcan_netdev_start_xmit(struct sk_buff *skb, struct net_devi
        /* We shouldn't get here after a hardware fault:
         * can_bus_off() calls netif_carrier_off()
         */
-       BUG_ON(elm->hw_failure);
+       WARN_ON(elm->hw_failure);
 
        if (elm->tty == NULL
+               || elm->hw_failure
                || elm->can.ctrlmode & CAN_CTRLMODE_LISTENONLY) {
                spin_unlock(&elm->lock);
                goto out;
@@ -860,41 +900,35 @@ out:
        return NETDEV_TX_OK;
 }
 
-static int elmcan_netdev_change_mtu(struct net_device *dev, int new_mtu)
-{
-       return -EINVAL;
-}
 
 static const struct net_device_ops elmcan_netdev_ops = {
        .ndo_open       = elmcan_netdev_open,
        .ndo_stop       = elmcan_netdev_close,
        .ndo_start_xmit = elmcan_netdev_start_xmit,
-       .ndo_change_mtu = elmcan_netdev_change_mtu,
+       .ndo_change_mtu = can_change_mtu,
 };
 
 
 
 
 
- /************************************************************************
-  *            Line discipline                                 *
-  *                                                            *
-  * (takes elm->lock)                                          *
-  ************************************************************************/
+ /***********************************************************************
+  *            Line discipline                                         *
+  *                                                                    *
+  * (takes elm->lock)                                                  *
+  ***********************************************************************/
 
-/*
- * Get a reference to our struct, taking into account locks/refcounts.
+/* Get a reference to our struct, taking into account locks/refcounts.
  * This is to ensure ordering in case we are shutting down, and to ensure
- * there is a refcount at all (because tty->disc_data may be NULL).
+ * there is a refcount at all (otherwise tty->disc_data may be freed and
+ * before we increment the refcount).
+ * Use this for anything that can race against elmcan_ldisc_close().
  */
-static struct elmcanget_elm(struct tty_struct *tty)
+static struct elmcan *get_elm(struct tty_struct *tty)
 {
        struct elmcan *elm;
        bool got_ref;
 
-       /* Lock all elmcan TTYs, so tty->disc_data can't become NULL
-        * the moment before we increase the reference counter.
-        */
        spin_lock_bh(&elmcan_discdata_lock);
        elm = (struct elmcan *) tty->disc_data;
 
@@ -906,9 +940,8 @@ static struct elmcan* get_elm(struct tty_struct *tty)
        got_ref = atomic_inc_not_zero(&elm->refcount);
        spin_unlock_bh(&elmcan_discdata_lock);
 
-       if (!got_ref) {
+       if (!got_ref)
                return NULL;
-       }
 
        return elm;
 }
@@ -919,14 +952,26 @@ static void put_elm(struct elmcan *elm)
 }
 
 
+static bool elmcan_is_valid_rx_char(char c)
+{
+       return (accept_flaky_uart
+               || isdigit(c)
+               || isupper(c)
+               || ELM327_MAGIC_CHAR == c
+               || ELM327_READY_CHAR == c
+               || '<' == c
+               || 'a' == c
+               || 'b' == c
+               || 'v' == c
+               || '.' == c
+               || '?' == c
+               || '\r' == c
+               || ' ' == c);
+}
 
-/*
- * Handle the 'receiver data ready' interrupt.
- * This function is called by the 'tty_io' module in the kernel when
- * a block of ELM327 CAN data has been received, which can now be parsed
- * and sent on to some IP layer for further processing. This will not
- * be re-entered while running but other ldisc functions may be called
- * in parallel
+/* Handle incoming ELM327 ASCII data.
+ * This will not be re-entered while running, but other ldisc
+ * functions may be called in parallel.
  */
 static void elmcan_ldisc_rx(struct tty_struct *tty,
                        const unsigned char *cp, char *fp, int count)
@@ -936,50 +981,68 @@ static void elmcan_ldisc_rx(struct tty_struct *tty,
        if (!elm)
                return;
 
-       /* Read the characters out of the buffer */
-       while (count-- && elm->rxfill < sizeof(elm->rxbuf)) {
+       spin_lock_bh(&elm->lock);
+
+       if (elm->hw_failure) {
+               goto out;
+       }
+
+       while (count-- && elm->rxfill < ELM327_SIZE_RXBUF) {
                if (fp && *fp++) {
                        netdev_err(elm->dev, "Error in received character stream. Check your wiring.");
 
-                       spin_lock_bh(&elm->lock);
                        elm327_hw_failure(elm);
-                       spin_unlock_bh(&elm->lock);
 
-                       put_elm(elm);
-                       return;
+                       goto out;
                }
+
+               /* Ignore NUL characters, which the PIC microcontroller may
+                * inadvertently insert due to a known hardware bug.
+                * See ELM327 documentation, which refers to a Microchip PIC
+                * bug description.
+                */
                if (*cp != 0) {
+                       /* Check for stray characters on the UART line.
+                        * Likely caused by bad hardware.
+                        */
+                       if (!elmcan_is_valid_rx_char(*cp)) {
+                               netdev_err(elm->dev,
+                                          "Received illegal character %02x.\n",
+                                          *cp);
+                               elm327_hw_failure(elm);
+
+                               goto out;
+                       }
+
                        elm->rxbuf[elm->rxfill++] = *cp;
                }
+
                cp++;
        }
 
        if (count >= 0) {
                netdev_err(elm->dev, "Receive buffer overflowed. Bad chip or wiring?");
 
-               spin_lock_bh(&elm->lock);
                elm327_hw_failure(elm);
-               spin_unlock_bh(&elm->lock);
 
-               put_elm(elm);
-               return;
+               goto out;
        }
 
-       spin_lock_bh(&elm->lock);
        elm327_parse_rxbuf(elm);
-       spin_unlock_bh(&elm->lock);
 
+out:
+       spin_unlock_bh(&elm->lock);
        put_elm(elm);
 }
 
-/*
- * Write out remaining transmit buffer.
+
+/* Write out remaining transmit buffer.
  * Scheduled when TTY is writable.
  */
 static void elmcan_ldisc_tx_worker(struct work_struct *work)
 {
        /* No need to use get_elm() here, as we'll always flush workers
-        * befory destroying the elmcan object.
+        * before destroying the elmcan object.
         */
        struct elmcan *elm = container_of(work, struct elmcan, tx_work);
        ssize_t actual;
@@ -997,7 +1060,7 @@ static void elmcan_ldisc_tx_worker(struct work_struct *work)
 
        if (elm->txleft <= 0)  {
                /* Our TTY write buffer is empty:
-                * We can start transmission of another packet
+                * Allow netdev to hand us another packet
                 */
                clear_bit(TTY_DO_WRITE_WAKEUP, &elm->tty->flags);
                spin_unlock_bh(&elm->lock);
@@ -1007,7 +1070,9 @@ static void elmcan_ldisc_tx_worker(struct work_struct *work)
 
        actual = elm->tty->ops->write(elm->tty, elm->txhead, elm->txleft);
        if (actual < 0) {
-               netdev_err(elm->dev, "Failed to write to tty %s.\n", elm->tty->name);
+               netdev_err(elm->dev,
+                          "Failed to write to tty %s.\n",
+                          elm->tty->name);
                elm327_hw_failure(elm);
                spin_unlock_bh(&elm->lock);
                return;
@@ -1018,11 +1083,7 @@ static void elmcan_ldisc_tx_worker(struct work_struct *work)
        spin_unlock_bh(&elm->lock);
 }
 
-
-/*
- * Called by the driver when there's room for more data.
- * Schedule the transmit.
- */
+/* Called by the driver when there's room for more data. */
 static void elmcan_ldisc_tx_wakeup(struct tty_struct *tty)
 {
        struct elmcan *elm = get_elm(tty);
@@ -1036,27 +1097,31 @@ static void elmcan_ldisc_tx_wakeup(struct tty_struct *tty)
 }
 
 
-
-/* Some fake bit timings to allow bitrate setting */
-static const struct can_bittiming_const elmcan_bittiming_const = {
-       .name = "elmcan",
-       .tseg1_min = 1,
-       .tseg1_max = 1,
-       .tseg2_min = 0,
-       .tseg2_max = 0,
-       .sjw_max = 1,
-       .brp_min = 1,
-       .brp_max = 500,
-       .brp_inc = 1,
+/* ELM327 can only handle bitrates that are integer divisors of 500 kHz,
+ * or 7/8 of that. Divisors are 1 to 64.
+ * Currently we don't implement support for 7/8 rates.
+ */
+static const u32 elmcan_bitrate_const[64] = {
+        7812,  7936,  8064,  8196,  8333,  8474,  8620,  8771,
+        8928,  9090,  9259,  9433,  9615,  9803, 10000, 10204,
+       10416, 10638, 10869, 11111, 11363, 11627, 11904, 12195,
+       12500, 12820, 13157, 13513, 13888, 14285, 14705, 15151,
+       15625, 16129, 16666, 17241, 17857, 18518, 19230, 20000,
+       20833, 21739, 22727, 23809, 25000, 26315, 27777, 29411,
+       31250, 33333, 35714, 38461, 41666, 45454, 50000, 55555,
+       62500, 71428, 83333, 100000, 125000, 166666, 250000, 500000
 };
 
-/*
- * Open the high-level part of the elmcan channel.
- * This function is called by the TTY module when the
- * elmcan line discipline is called for.
- *
- * Called in process context serialized from other ldisc calls.
- */
+
+/* Dummy needed to use bitrate_const */
+static int elmcan_do_set_bittiming(struct net_device *netdev)
+{
+       (void)netdev;
+
+       return 0;
+}
+
+
 static int elmcan_ldisc_open(struct tty_struct *tty)
 {
        struct net_device *dev;
@@ -1070,12 +1135,18 @@ static int elmcan_ldisc_open(struct tty_struct *tty)
                return -EOPNOTSUPP;
 
 
-       /* OK.  Find a free elmcan channel to use. */
        dev = alloc_candev(sizeof(struct elmcan), 0);
        if (!dev)
                return -ENFILE;
        elm = netdev_priv(dev);
 
+       elm->rxbuf = kmalloc(ELM327_SIZE_RXBUF, GFP_KERNEL);
+       elm->txbuf = kmalloc(ELM327_SIZE_TXBUF, GFP_KERNEL);
+       if (!elm->rxbuf || !elm->txbuf) {
+               err = -ENOMEM;
+               goto out_err;
+       }
+
        /* Configure TTY interface */
        tty->receive_room = 65536; /* We don't flow control */
        elm->txleft = 0; /* Clear TTY TX buffer */
@@ -1085,8 +1156,9 @@ static int elmcan_ldisc_open(struct tty_struct *tty)
 
        /* Configure CAN metadata */
        elm->can.state = CAN_STATE_STOPPED;
-       elm->can.clock.freq = 1000000;
-       elm->can.bittiming_const = &elmcan_bittiming_const;
+       elm->can.bitrate_const = elmcan_bitrate_const;
+       elm->can.bitrate_const_cnt = ARRAY_SIZE(elmcan_bitrate_const);
+       elm->can.do_set_bittiming = elmcan_do_set_bittiming;
        elm->can.ctrlmode_supported = CAN_CTRLMODE_LISTENONLY;
 
        /* Configure netlink interface */
@@ -1101,18 +1173,23 @@ static int elmcan_ldisc_open(struct tty_struct *tty)
 
        /* Let 'er rip */
        err = register_candev(elm->dev);
-       if (err) {
-               free_candev(elm->dev);
-               return err;
-       }
+       if (err)
+               goto out_err;
 
        netdev_info(elm->dev, "elmcan on %s.\n", tty->name);
 
        return 0;
+
+out_err:
+       if (elm->txbuf)
+               kfree(elm->txbuf);
+       if (elm->rxbuf)
+               kfree(elm->rxbuf);
+       free_candev(elm->dev);
+       return err;
 }
 
-/*
- * Close down an elmcan channel.
+/* Close down an elmcan channel.
  * This means flushing out any pending queues, and then returning.
  * This call is serialized against other ldisc functions:
  * Once this is called, no other ldisc function of ours is entered.
@@ -1121,15 +1198,12 @@ static int elmcan_ldisc_open(struct tty_struct *tty)
  */
 static void elmcan_ldisc_close(struct tty_struct *tty)
 {
-       /* Use get_elm() to synchronize against other users */
        struct elmcan *elm = get_elm(tty);
 
        if (!elm)
                return;
 
-       /* Tear down network side.
-        * unregister_netdev() calls .ndo_stop() so we don't have to.
-        */
+       /* unregister_netdev() calls .ndo_stop() so we don't have to. */
        unregister_candev(elm->dev);
 
        /* Decrease the refcount twice, once for our own get_elm(),
@@ -1139,13 +1213,10 @@ static void elmcan_ldisc_close(struct tty_struct *tty)
        put_elm(elm);
        put_elm(elm);
 
-       /* Spin until refcount reaches 0 */
-       while(atomic_read(&elm->refcount) > 0)
-               msleep(1);
+       while (atomic_read(&elm->refcount) > 0)
+               msleep_interruptible(10);
 
-       /* At this point, all ldisc calls to us will be no-ops.
-        * Since the refcount is 0, they are bailing immediately.
-        */
+       /* At this point, all ldisc calls to us have become no-ops. */
 
        /* Mark channel as dead */
        spin_lock_bh(&elm->lock);
@@ -1153,12 +1224,12 @@ static void elmcan_ldisc_close(struct tty_struct *tty)
        elm->tty = NULL;
        spin_unlock_bh(&elm->lock);
 
-       /* Flush TTY side */
        flush_work(&elm->tx_work);
 
        netdev_info(elm->dev, "elmcan off %s.\n", tty->name);
 
-       /* Free our memory */
+       kfree(elm->txbuf);
+       kfree(elm->rxbuf);
        free_candev(elm->dev);
 }
 
@@ -1168,7 +1239,6 @@ static int elmcan_ldisc_hangup(struct tty_struct *tty)
        return 0;
 }
 
-/* Perform I/O control on an active elmcan channel. */
 static int elmcan_ldisc_ioctl(struct tty_struct *tty, struct file *file,
                        unsigned int cmd, unsigned long arg)
 {
@@ -1180,7 +1250,7 @@ static int elmcan_ldisc_ioctl(struct tty_struct *tty, struct file *file,
 
        switch (cmd) {
        case SIOCGIFNAME:
-               tmp = strlen(elm->dev->name) + 1;
+               tmp = strnlen(elm->dev->name, IFNAMSIZ - 1) + 1;
                if (copy_to_user((void __user *)arg, elm->dev->name, tmp)) {
                        put_elm(elm);
                        return -EFAULT;
@@ -1213,12 +1283,6 @@ static struct tty_ldisc_ops elmcan_ldisc = {
 
 
 
-
-
- /************************************************************************
-  *            Module init/exit                                *
-  ************************************************************************/
-
 static int __init elmcan_init(void)
 {
        int status;
@@ -1226,11 +1290,10 @@ static int __init elmcan_init(void)
        pr_info("ELM327 based best-effort CAN interface driver\n");
        pr_info("This device is severely limited as a CAN interface, see documentation.\n");
 
-       /* Fill in our line protocol discipline, and register it */
        status = tty_register_ldisc(N_ELMCAN, &elmcan_ldisc);
-       if (status) {
+       if (status)
                pr_err("can't register line discipline\n");
-       }
+
        return status;
 }
 
@@ -1242,9 +1305,9 @@ static void __exit elmcan_exit(void)
        int status;
 
        status = tty_unregister_ldisc(N_ELMCAN);
-       if (status) {
-               pr_err("Can't unregister line discipline (error: %d)\n", status);
-       }
+       if (status)
+               pr_err("Can't unregister line discipline (error: %d)\n",
+                      status);
 }
 
 module_init(elmcan_init);