1 // SPDX-License-Identifier: GPL-2.0
2 /* elmcan.c - ELM327 based CAN interface driver
3 * (tty line discipline)
5 * This driver started as a derivative of linux/drivers/net/can/slcan.c
6 * and my thanks go to the original authors for their inspiration.
8 * elmcan.c Author : Max Staudt <max-linux@enpas.org>
9 * slcan.c Author : Oliver Hartkopp <socketcan@hartkopp.net>
10 * slip.c Authors : Laurence Culhane <loz@holmes.demon.co.uk>
11 * Fred N. van Kempen <waltje@uwalt.nl.mugnet.org>
13 * This code barely bears any resemblance to slcan anymore, and whatever
14 * may be left is Linux specific boilerplate anyway, however I am leaving
15 * the GPL-2.0 identifier at the top just to be sure.
17 * Please feel free to use my own code, especially the ELM327 communication
18 * logic, in accordance with SPDX-License-Identifier BSD-3-Clause to port
19 * this driver to other systems.
24 #define pr_fmt(fmt) "[elmcan] " fmt
26 #include <linux/init.h>
27 #include <linux/module.h>
28 #include <linux/moduleparam.h>
30 #include <linux/atomic.h>
31 #include <linux/bitops.h>
32 #include <linux/ctype.h>
33 #include <linux/delay.h>
34 #include <linux/errno.h>
35 #include <linux/if_ether.h>
36 #include <linux/kernel.h>
37 #include <linux/list.h>
38 #include <linux/netdevice.h>
39 #include <linux/skbuff.h>
40 #include <linux/spinlock.h>
41 #include <linux/string.h>
42 #include <linux/tty.h>
43 #include <linux/tty_ldisc.h>
44 #include <linux/version.h>
45 #include <linux/workqueue.h>
47 #include <uapi/linux/tty.h>
49 #include <linux/can.h>
50 #include <linux/can/dev.h>
51 #include <linux/can/error.h>
52 #include <linux/can/led.h>
53 #include <linux/can/rx-offload.h>
55 MODULE_ALIAS_LDISC(N_ELMCAN);
56 MODULE_DESCRIPTION("ELM327 based CAN interface");
57 MODULE_LICENSE("GPL");
58 MODULE_AUTHOR("Max Staudt <max-linux@enpas.org>");
60 /* If this is enabled, we'll try to make the best of the situation
61 * even if we receive unexpected characters on the line.
63 * Handle with care, it's likely your hardware is unreliable!
65 static bool accept_flaky_uart;
66 module_param_named(accept_flaky_uart, accept_flaky_uart, bool, 0444);
67 MODULE_PARM_DESC(accept_flaky_uart, "Don't bail at the first invalid character. Behavior undefined.");
69 /* Line discipline ID number */
74 #define ELM327_NAPI_WEIGHT 4
76 #define ELM327_SIZE_RXBUF 256
77 #define ELM327_SIZE_TXBUF 32
79 #define ELM327_CAN_CONFIG_SEND_SFF 0x8000
80 #define ELM327_CAN_CONFIG_VARIABLE_DLC 0x4000
81 #define ELM327_CAN_CONFIG_RECV_BOTH_SFF_EFF 0x2000
82 #define ELM327_CAN_CONFIG_BAUDRATE_MULT_8_7 0x1000
84 #define ELM327_MAGIC_CHAR 'y'
85 #define ELM327_MAGIC_STRING "y"
86 #define ELM327_READY_CHAR '>'
88 /* Bits in elm->cmds_todo */
93 TODO_CANID_29BIT_HIGH,
94 TODO_CAN_CONFIG_PART2,
102 /* This must be the first member when using alloc_candev() */
105 struct can_rx_offload offload;
107 /* TTY and netdev devices that we're bridging */
108 struct tty_struct *tty;
109 struct net_device *dev;
111 /* Per-channel lock */
114 /* Keep track of how many things are using this struct.
115 * Once it reaches 0, we are in the process of cleaning up,
116 * and new operations will be cancelled immediately.
117 * Use atomic_t rather than refcount_t because we deliberately
118 * decrement to 0, and refcount_dec() spills a WARN_ONCE in
123 /* Stop the channel on hardware failure.
124 * Once this is true, nothing will be sent to the TTY.
129 struct work_struct tx_work; /* Flushes TTY TX buffer */
130 unsigned char *txbuf;
131 unsigned char *txhead; /* Pointer to next TX byte */
132 int txleft; /* Bytes left to TX */
135 unsigned char rxbuf[ELM327_SIZE_RXBUF];
148 /* The CAN frame and config the ELM327 is sending/using,
149 * or will send/use after finishing all cmds_todo
151 struct can_frame can_frame;
152 unsigned short can_config;
153 unsigned long can_bitrate;
154 unsigned char can_bitrate_divisor;
155 int silent_monitoring;
157 /* Things we have yet to send */
158 char **next_init_cmd;
159 unsigned long cmds_todo;
162 /* A lock for all tty->disc_data handled by this ldisc.
163 * This is to prevent a case where tty->disc_data is set to NULL,
164 * yet someone is still trying to dereference it.
165 * Without this, we cannot do a clean shutdown.
167 static DEFINE_SPINLOCK(elmcan_discdata_lock);
169 static inline void elm327_hw_failure(struct elmcan *elm);
171 /***********************************************************************
172 * ELM327: Transmission *
174 * (all functions assume elm->lock taken) *
175 ***********************************************************************/
177 static void elm327_send(struct elmcan *elm, const void *buf, size_t len)
184 memcpy(elm->txbuf, buf, len);
186 /* Order of next two lines is *very* important.
187 * When we are sending a little amount of data,
188 * the transfer may be completed inside the ops->write()
189 * routine, because it's running with interrupts enabled.
190 * In this case we *never* got WRITE_WAKEUP event,
191 * if we did not request it before write operation.
192 * 14 Oct 1994 Dmitry Gorodchanin.
194 set_bit(TTY_DO_WRITE_WAKEUP, &elm->tty->flags);
195 actual = elm->tty->ops->write(elm->tty, elm->txbuf, len);
198 "Failed to write to tty %s.\n",
200 elm327_hw_failure(elm);
204 elm->txleft = len - actual;
205 elm->txhead = elm->txbuf + actual;
208 /* Take the ELM327 out of almost any state and back into command mode.
209 * We send ELM327_MAGIC_CHAR which will either abort any running
210 * operation, or be echoed back to us in case we're already in command
213 static void elm327_kick_into_cmd_mode(struct elmcan *elm)
215 if (elm->state != ELM_GETMAGICCHAR && elm->state != ELM_GETPROMPT) {
216 elm327_send(elm, ELM327_MAGIC_STRING, 1);
218 elm->state = ELM_GETMAGICCHAR;
222 /* Schedule a CAN frame and necessary config changes to be sent to the TTY. */
223 static void elm327_send_frame(struct elmcan *elm, struct can_frame *frame)
225 /* Schedule any necessary changes in ELM327's CAN configuration */
226 if (elm->can_frame.can_id != frame->can_id) {
227 /* Set the new CAN ID for transmission. */
228 if ((frame->can_id & CAN_EFF_FLAG)
229 ^ (elm->can_frame.can_id & CAN_EFF_FLAG)) {
230 elm->can_config = (frame->can_id & CAN_EFF_FLAG
232 : ELM327_CAN_CONFIG_SEND_SFF)
233 | ELM327_CAN_CONFIG_VARIABLE_DLC
234 | ELM327_CAN_CONFIG_RECV_BOTH_SFF_EFF
235 | elm->can_bitrate_divisor;
237 set_bit(TODO_CAN_CONFIG, &elm->cmds_todo);
240 if (frame->can_id & CAN_EFF_FLAG) {
241 clear_bit(TODO_CANID_11BIT, &elm->cmds_todo);
242 set_bit(TODO_CANID_29BIT_LOW, &elm->cmds_todo);
243 set_bit(TODO_CANID_29BIT_HIGH, &elm->cmds_todo);
245 set_bit(TODO_CANID_11BIT, &elm->cmds_todo);
246 clear_bit(TODO_CANID_29BIT_LOW, &elm->cmds_todo);
247 clear_bit(TODO_CANID_29BIT_HIGH, &elm->cmds_todo);
251 /* Schedule the CAN frame itself. */
252 elm->can_frame = *frame;
253 set_bit(TODO_CAN_DATA, &elm->cmds_todo);
255 elm327_kick_into_cmd_mode(elm);
258 /***********************************************************************
259 * ELM327: Initialization sequence *
261 * (assumes elm->lock taken) *
262 ***********************************************************************/
264 static char *elm327_init_script[] = {
265 "AT WS\r", /* v1.0: Warm Start */
266 "AT PP FF OFF\r", /* v1.0: All Programmable Parameters Off */
267 "AT M0\r", /* v1.0: Memory Off */
268 "AT AL\r", /* v1.0: Allow Long messages */
269 "AT BI\r", /* v1.0: Bypass Initialization */
270 "AT CAF0\r", /* v1.0: CAN Auto Formatting Off */
271 "AT CFC0\r", /* v1.0: CAN Flow Control Off */
272 "AT CF 000\r", /* v1.0: Reset CAN ID Filter */
273 "AT CM 000\r", /* v1.0: Reset CAN ID Mask */
274 "AT E1\r", /* v1.0: Echo On */
275 "AT H1\r", /* v1.0: Headers On */
276 "AT L0\r", /* v1.0: Linefeeds Off */
277 "AT SH 7DF\r", /* v1.0: Set CAN sending ID to 0x7df */
278 "AT ST FF\r", /* v1.0: Set maximum Timeout for response after TX */
279 "AT AT0\r", /* v1.2: Adaptive Timing Off */
280 "AT D1\r", /* v1.3: Print DLC On */
281 "AT S1\r", /* v1.3: Spaces On */
282 "AT TP B\r", /* v1.0: Try Protocol B */
286 static void elm327_init(struct elmcan *elm)
288 elm->state = ELM_NOTINIT;
289 elm->can_frame.can_id = 0x7df;
291 elm->drop_next_line = 0;
293 /* We can only set the bitrate as a fraction of 500000.
294 * The bit timing constants in elmcan_bittiming_const will
295 * limit the user to the right values.
297 elm->can_bitrate_divisor = 500000 / elm->can.bittiming.bitrate;
298 elm->can_config = ELM327_CAN_CONFIG_SEND_SFF
299 | ELM327_CAN_CONFIG_VARIABLE_DLC
300 | ELM327_CAN_CONFIG_RECV_BOTH_SFF_EFF
301 | elm->can_bitrate_divisor;
303 /* Configure ELM327 and then start monitoring */
304 elm->next_init_cmd = &elm327_init_script[0];
305 set_bit(TODO_INIT, &elm->cmds_todo);
306 set_bit(TODO_SILENT_MONITOR, &elm->cmds_todo);
307 set_bit(TODO_RESPONSES, &elm->cmds_todo);
308 set_bit(TODO_CAN_CONFIG, &elm->cmds_todo);
310 elm327_kick_into_cmd_mode(elm);
313 /***********************************************************************
314 * ELM327: Reception -> netdev glue *
316 * (assumes elm->lock taken) *
317 ***********************************************************************/
319 static void elm327_feed_frame_to_netdev(struct elmcan *elm,
320 const struct can_frame *frame)
322 struct can_frame *cf;
325 if (!netif_running(elm->dev))
328 skb = alloc_can_skb(elm->dev, &cf);
333 memcpy(cf, frame, sizeof(struct can_frame));
335 /* Queue for NAPI pickup.
336 * rx-offload will update stats and LEDs for us.
338 if (can_rx_offload_queue_tail(&elm->offload, skb))
339 elm->dev->stats.rx_fifo_errors++;
341 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5,15,0)
343 can_rx_offload_irq_finish(&elm->offload);
347 /***********************************************************************
348 * ELM327: "Panic" handler *
350 * (assumes elm->lock taken) *
351 ***********************************************************************/
353 /* Called when we're out of ideas and just want it all to end. */
354 static inline void elm327_hw_failure(struct elmcan *elm)
356 struct can_frame frame;
358 memset(&frame, 0, sizeof(frame));
359 frame.can_id = CAN_ERR_FLAG;
360 frame.can_dlc = CAN_ERR_DLC;
364 elm327_feed_frame_to_netdev(elm, &frame);
366 netdev_err(elm->dev, "ELM327 misbehaved. Blocking further communication.\n");
368 elm->hw_failure = true;
369 can_bus_off(elm->dev);
372 /***********************************************************************
373 * ELM327: Reception parser *
375 * (assumes elm->lock taken) *
376 ***********************************************************************/
378 static void elm327_parse_error(struct elmcan *elm, int len)
380 struct can_frame frame;
382 memset(&frame, 0, sizeof(frame));
383 frame.can_id = CAN_ERR_FLAG;
384 frame.can_dlc = CAN_ERR_DLC;
388 if (!memcmp(elm->rxbuf, "UNABLE TO CONNECT", 17)) {
390 "ELM327 reported UNABLE TO CONNECT. Please check your setup.\n");
394 if (!memcmp(elm->rxbuf, "BUFFER FULL", 11)) {
395 /* This case will only happen if the last data
397 * Otherwise, elm327_parse_frame() will heuristically
398 * emit this error frame instead.
400 frame.can_id |= CAN_ERR_CRTL;
401 frame.data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
405 if (!memcmp(elm->rxbuf, "BUS ERROR", 9))
406 frame.can_id |= CAN_ERR_BUSERROR;
407 if (!memcmp(elm->rxbuf, "CAN ERROR", 9))
408 frame.can_id |= CAN_ERR_PROT;
409 if (!memcmp(elm->rxbuf, "<RX ERROR", 9))
410 frame.can_id |= CAN_ERR_PROT;
413 if (!memcmp(elm->rxbuf, "BUS BUSY", 8)) {
414 frame.can_id |= CAN_ERR_PROT;
415 frame.data[2] = CAN_ERR_PROT_OVERLOAD;
417 if (!memcmp(elm->rxbuf, "FB ERROR", 8)) {
418 frame.can_id |= CAN_ERR_PROT;
419 frame.data[2] = CAN_ERR_PROT_TX;
423 if (!memcmp(elm->rxbuf, "ERR", 3)) {
424 netdev_err(elm->dev, "ELM327 reported an ERR%c%c. Please power it off and on again.\n",
425 elm->rxbuf[3], elm->rxbuf[4]);
426 frame.can_id |= CAN_ERR_CRTL;
430 /* Don't emit an error frame if we're unsure */
434 elm327_feed_frame_to_netdev(elm, &frame);
437 /* Parse CAN frames coming as ASCII from ELM327.
438 * They can be of various formats:
440 * 29-bit ID (EFF): 12 34 56 78 D PL PL PL PL PL PL PL PL
441 * 11-bit ID (!EFF): 123 D PL PL PL PL PL PL PL PL
443 * where D = DLC, PL = payload byte
445 * Instead of a payload, RTR indicates a remote request.
447 * We will use the spaces and line length to guess the format.
449 static int elm327_parse_frame(struct elmcan *elm, int len)
451 struct can_frame frame;
456 memset(&frame, 0, sizeof(frame));
458 /* Find first non-hex and non-space character:
459 * - In the simplest case, there is none.
460 * - For RTR frames, 'R' is the first non-hex character.
461 * - An error message may replace the end of the data line.
463 for (hexlen = 0; hexlen <= len; hexlen++) {
464 if (hex_to_bin(elm->rxbuf[hexlen]) < 0 &&
465 elm->rxbuf[hexlen] != ' ') {
470 /* If we accept stray characters coming in:
471 * Check for stray characters on a payload line.
472 * No idea what causes this.
474 if (accept_flaky_uart &&
476 !isdigit(elm->rxbuf[hexlen]) &&
477 !isupper(elm->rxbuf[hexlen]) &&
478 '<' != elm->rxbuf[hexlen] &&
479 ' ' != elm->rxbuf[hexlen]) {
480 /* The line is likely garbled anyway, so bail.
481 * The main code will restart listening.
483 elm327_kick_into_cmd_mode(elm);
487 /* Use spaces in CAN ID to distinguish 29 or 11 bit address length.
488 * No out-of-bounds access:
489 * We use the fact that we can always read from elm->rxbuf.
491 if (elm->rxbuf[2] == ' ' && elm->rxbuf[5] == ' ' &&
492 elm->rxbuf[8] == ' ' && elm->rxbuf[11] == ' ' &&
493 elm->rxbuf[13] == ' ') {
494 frame.can_id = CAN_EFF_FLAG;
496 } else if (elm->rxbuf[3] == ' ' && elm->rxbuf[5] == ' ') {
500 /* This is not a well-formatted data line.
501 * Assume it's an error message.
506 if (hexlen < datastart) {
507 /* The line is too short to be a valid frame hex dump.
508 * Something interrupted the hex dump or it is invalid.
513 /* From here on all chars up to buf[hexlen] are hex or spaces,
514 * at well-defined offsets.
517 /* Read CAN data length */
518 frame.can_dlc = (hex_to_bin(elm->rxbuf[datastart - 2]) << 0);
521 if (frame.can_id & CAN_EFF_FLAG) {
522 frame.can_id |= (hex_to_bin(elm->rxbuf[0]) << 28)
523 | (hex_to_bin(elm->rxbuf[1]) << 24)
524 | (hex_to_bin(elm->rxbuf[3]) << 20)
525 | (hex_to_bin(elm->rxbuf[4]) << 16)
526 | (hex_to_bin(elm->rxbuf[6]) << 12)
527 | (hex_to_bin(elm->rxbuf[7]) << 8)
528 | (hex_to_bin(elm->rxbuf[9]) << 4)
529 | (hex_to_bin(elm->rxbuf[10]) << 0);
531 frame.can_id |= (hex_to_bin(elm->rxbuf[0]) << 8)
532 | (hex_to_bin(elm->rxbuf[1]) << 4)
533 | (hex_to_bin(elm->rxbuf[2]) << 0);
536 /* Check for RTR frame */
537 if (elm->rxfill >= hexlen + 3 &&
538 !memcmp(&elm->rxbuf[hexlen], "RTR", 3)) {
539 frame.can_id |= CAN_RTR_FLAG;
542 /* Is the line long enough to hold the advertised payload?
543 * Note: RTR frames have a DLC, but no actual payload.
545 if (!(frame.can_id & CAN_RTR_FLAG) &&
546 (hexlen < frame.can_dlc * 3 + datastart)) {
547 /* Incomplete frame. */
549 /* Probably the ELM327's RS232 TX buffer was full.
550 * Emit an error frame and exit.
552 frame.can_id = CAN_ERR_FLAG | CAN_ERR_CRTL;
553 frame.can_dlc = CAN_ERR_DLC;
554 frame.data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
555 elm327_feed_frame_to_netdev(elm, &frame);
557 /* Signal failure to parse.
558 * The line will be re-parsed as an error line, which will fail.
559 * However, this will correctly drop the state machine back into
565 /* Parse the data nibbles. */
566 for (i = 0; i < frame.can_dlc; i++) {
567 frame.data[i] = (hex_to_bin(elm->rxbuf[datastart + 3*i]) << 4)
568 | (hex_to_bin(elm->rxbuf[datastart + 3*i + 1]));
571 /* Feed the frame to the network layer. */
572 elm327_feed_frame_to_netdev(elm, &frame);
577 static void elm327_parse_line(struct elmcan *elm, int len)
579 /* Skip empty lines */
583 /* Skip echo lines */
584 if (elm->drop_next_line) {
585 elm->drop_next_line = 0;
587 } else if (elm->rxbuf[0] == 'A' && elm->rxbuf[1] == 'T') {
591 /* Regular parsing */
592 switch (elm->state) {
594 if (elm327_parse_frame(elm, len)) {
595 /* Parse an error line. */
596 elm327_parse_error(elm, len);
599 elm327_kick_into_cmd_mode(elm);
607 static void elm327_handle_prompt(struct elmcan *elm)
609 struct can_frame *frame = &elm->can_frame;
610 char local_txbuf[20];
612 if (!elm->cmds_todo) {
613 /* Enter CAN monitor mode */
614 elm327_send(elm, "ATMA\r", 5);
615 elm->state = ELM_RECEIVING;
620 /* Reconfigure ELM327 step by step as indicated by elm->cmds_todo */
621 if (test_bit(TODO_INIT, &elm->cmds_todo)) {
622 strcpy(local_txbuf, *elm->next_init_cmd);
624 elm->next_init_cmd++;
625 if (!(*elm->next_init_cmd)) {
626 clear_bit(TODO_INIT, &elm->cmds_todo);
627 netdev_info(elm->dev, "Initialization finished.\n");
630 } else if (test_and_clear_bit(TODO_SILENT_MONITOR, &elm->cmds_todo)) {
631 sprintf(local_txbuf, "ATCSM%i\r",
632 !(!(elm->can.ctrlmode & CAN_CTRLMODE_LISTENONLY)));
634 } else if (test_and_clear_bit(TODO_RESPONSES, &elm->cmds_todo)) {
635 sprintf(local_txbuf, "ATR%i\r",
636 !(elm->can.ctrlmode & CAN_CTRLMODE_LISTENONLY));
638 } else if (test_and_clear_bit(TODO_CAN_CONFIG, &elm->cmds_todo)) {
639 sprintf(local_txbuf, "ATPC\r");
640 set_bit(TODO_CAN_CONFIG_PART2, &elm->cmds_todo);
642 } else if (test_and_clear_bit(TODO_CAN_CONFIG_PART2, &elm->cmds_todo)) {
643 sprintf(local_txbuf, "ATPB%04X\r",
646 } else if (test_and_clear_bit(TODO_CANID_29BIT_HIGH, &elm->cmds_todo)) {
647 sprintf(local_txbuf, "ATCP%02X\r",
648 (frame->can_id & CAN_EFF_MASK) >> 24);
650 } else if (test_and_clear_bit(TODO_CANID_29BIT_LOW, &elm->cmds_todo)) {
651 sprintf(local_txbuf, "ATSH%06X\r",
652 frame->can_id & CAN_EFF_MASK & ((1 << 24) - 1));
654 } else if (test_and_clear_bit(TODO_CANID_11BIT, &elm->cmds_todo)) {
655 sprintf(local_txbuf, "ATSH%03X\r",
656 frame->can_id & CAN_SFF_MASK);
658 } else if (test_and_clear_bit(TODO_CAN_DATA, &elm->cmds_todo)) {
659 if (frame->can_id & CAN_RTR_FLAG) {
660 /* Send an RTR frame. Their DLC is fixed.
661 * Some chips don't send them at all.
663 sprintf(local_txbuf, "ATRTR\r");
665 /* Send a regular CAN data frame */
668 for (i = 0; i < frame->can_dlc; i++) {
669 sprintf(&local_txbuf[2 * i], "%02X",
673 sprintf(&local_txbuf[2 * i], "\r");
676 elm->drop_next_line = 1;
677 elm->state = ELM_RECEIVING;
680 elm327_send(elm, local_txbuf, strlen(local_txbuf));
683 static bool elm327_is_ready_char(char c)
685 /* Bits 0xc0 are sometimes set (randomly), hence the mask.
686 * Probably bad hardware.
688 return (c & 0x3f) == ELM327_READY_CHAR;
691 static void elm327_drop_bytes(struct elmcan *elm, int i)
693 memmove(&elm->rxbuf[0], &elm->rxbuf[i], ELM327_SIZE_RXBUF - i);
697 static void elm327_parse_rxbuf(struct elmcan *elm)
701 switch (elm->state) {
706 case ELM_GETMAGICCHAR:
708 /* Wait for 'y' or '>' */
711 for (i = 0; i < elm->rxfill; i++) {
712 if (elm->rxbuf[i] == ELM327_MAGIC_CHAR) {
713 elm327_send(elm, "\r", 1);
714 elm->state = ELM_GETPROMPT;
717 } else if (elm327_is_ready_char(elm->rxbuf[i])) {
718 elm327_send(elm, ELM327_MAGIC_STRING, 1);
724 elm327_drop_bytes(elm, i);
731 if (elm327_is_ready_char(elm->rxbuf[elm->rxfill - 1]))
732 elm327_handle_prompt(elm);
738 /* Find <CR> delimiting feedback lines. */
740 (len < elm->rxfill) && (elm->rxbuf[len] != '\r');
745 if (len == ELM327_SIZE_RXBUF) {
746 /* Line exceeds buffer. It's probably all garbage.
747 * Did we even connect at the right baud rate?
750 "RX buffer overflow. Faulty ELM327 or UART?\n");
751 elm327_hw_failure(elm);
753 } else if (len == elm->rxfill) {
754 if (elm327_is_ready_char(elm->rxbuf[elm->rxfill - 1])) {
755 /* The ELM327's AT ST response timeout ran out,
756 * so we got a prompt.
757 * Clear RX buffer and restart listening.
761 elm327_handle_prompt(elm);
765 /* No <CR> found - we haven't received a full line yet.
766 * Wait for more data.
771 /* We have a full line to parse. */
772 elm327_parse_line(elm, len);
774 /* Remove parsed data from RX buffer. */
775 elm327_drop_bytes(elm, len + 1);
777 /* More data to parse? */
779 elm327_parse_rxbuf(elm);
783 /***********************************************************************
786 * (takes elm->lock) *
787 ***********************************************************************/
789 /* Dummy needed to use can_rx_offload */
790 static struct sk_buff *elmcan_mailbox_read(struct can_rx_offload *offload,
791 unsigned int n, u32 *timestamp,
794 WARN_ON_ONCE(1); /* This function is a dummy, so don't call it! */
796 return ERR_PTR(-ENOBUFS);
799 static int elmcan_netdev_open(struct net_device *dev)
801 struct elmcan *elm = netdev_priv(dev);
804 spin_lock_bh(&elm->lock);
805 if (elm->hw_failure) {
806 netdev_err(elm->dev, "Refusing to open interface after a hardware fault has been detected.\n");
807 spin_unlock_bh(&elm->lock);
812 spin_unlock_bh(&elm->lock);
816 /* open_candev() checks for elm->can.bittiming.bitrate != 0 */
817 err = open_candev(dev);
819 spin_unlock_bh(&elm->lock);
824 spin_unlock_bh(&elm->lock);
826 elm->offload.mailbox_read = elmcan_mailbox_read;
827 err = can_rx_offload_add_fifo(dev, &elm->offload, ELM327_NAPI_WEIGHT);
833 can_rx_offload_enable(&elm->offload);
835 can_led_event(dev, CAN_LED_EVENT_OPEN);
836 elm->can.state = CAN_STATE_ERROR_ACTIVE;
837 netif_start_queue(dev);
842 static int elmcan_netdev_close(struct net_device *dev)
844 struct elmcan *elm = netdev_priv(dev);
846 netif_stop_queue(dev);
848 spin_lock_bh(&elm->lock);
850 /* Interrupt whatever we're doing right now */
851 elm327_send(elm, ELM327_MAGIC_STRING, 1);
853 /* Clear the wakeup bit, as the netdev will be down and thus
854 * the wakeup handler won't clear it
856 clear_bit(TTY_DO_WRITE_WAKEUP, &elm->tty->flags);
858 spin_unlock_bh(&elm->lock);
860 flush_work(&elm->tx_work);
862 spin_unlock_bh(&elm->lock);
865 can_rx_offload_disable(&elm->offload);
866 elm->can.state = CAN_STATE_STOPPED;
867 can_rx_offload_del(&elm->offload);
869 can_led_event(dev, CAN_LED_EVENT_STOP);
874 /* Send a can_frame to a TTY. */
875 static netdev_tx_t elmcan_netdev_start_xmit(struct sk_buff *skb,
876 struct net_device *dev)
878 struct elmcan *elm = netdev_priv(dev);
879 struct can_frame *frame = (struct can_frame *)skb->data;
881 if (skb->len != sizeof(struct can_frame))
884 if (!netif_running(dev)) {
885 netdev_warn(elm->dev, "xmit: iface is down.\n");
889 /* BHs are already disabled, so no spin_lock_bh().
890 * See Documentation/networking/netdevices.txt
892 spin_lock(&elm->lock);
894 /* We shouldn't get here after a hardware fault:
895 * can_bus_off() calls netif_carrier_off()
897 WARN_ON_ONCE(elm->hw_failure);
901 elm->can.ctrlmode & CAN_CTRLMODE_LISTENONLY) {
902 spin_unlock(&elm->lock);
906 netif_stop_queue(dev);
908 elm327_send_frame(elm, frame);
909 spin_unlock(&elm->lock);
911 dev->stats.tx_packets++;
912 dev->stats.tx_bytes += frame->can_dlc;
914 can_led_event(dev, CAN_LED_EVENT_TX);
921 static const struct net_device_ops elmcan_netdev_ops = {
922 .ndo_open = elmcan_netdev_open,
923 .ndo_stop = elmcan_netdev_close,
924 .ndo_start_xmit = elmcan_netdev_start_xmit,
925 .ndo_change_mtu = can_change_mtu,
928 /***********************************************************************
931 * (takes elm->lock) *
932 ***********************************************************************/
934 /* Get a reference to our struct, taking into account locks/refcounts.
935 * This is to ensure ordering in case we are shutting down, and to ensure
936 * there is a refcount at all (otherwise tty->disc_data may be freed and
937 * before we increment the refcount).
938 * Use this for anything that can race against elmcan_ldisc_close().
940 static struct elmcan *get_elm(struct tty_struct *tty)
945 spin_lock_bh(&elmcan_discdata_lock);
946 elm = (struct elmcan *)tty->disc_data;
949 spin_unlock_bh(&elmcan_discdata_lock);
953 got_ref = atomic_inc_not_zero(&elm->refcount);
954 spin_unlock_bh(&elmcan_discdata_lock);
962 static void put_elm(struct elmcan *elm)
964 atomic_dec(&elm->refcount);
967 static bool elmcan_is_valid_rx_char(char c)
969 return (accept_flaky_uart ||
972 c == ELM327_MAGIC_CHAR ||
973 c == ELM327_READY_CHAR ||
984 /* Handle incoming ELM327 ASCII data.
985 * This will not be re-entered while running, but other ldisc
986 * functions may be called in parallel.
988 #if LINUX_VERSION_CODE < KERNEL_VERSION(5,14,0)
989 static void elmcan_ldisc_rx(struct tty_struct *tty,
990 const unsigned char *cp, char *fp, int count)
992 static void elmcan_ldisc_rx(struct tty_struct *tty,
993 const unsigned char *cp, const char *fp, int count)
996 struct elmcan *elm = get_elm(tty);
1001 spin_lock_bh(&elm->lock);
1003 if (elm->hw_failure)
1006 while (count-- && elm->rxfill < ELM327_SIZE_RXBUF) {
1008 netdev_err(elm->dev, "Error in received character stream. Check your wiring.");
1010 elm327_hw_failure(elm);
1015 /* Ignore NUL characters, which the PIC microcontroller may
1016 * inadvertently insert due to a known hardware bug.
1017 * See ELM327 documentation, which refers to a Microchip PIC
1021 /* Check for stray characters on the UART line.
1022 * Likely caused by bad hardware.
1024 if (!elmcan_is_valid_rx_char(*cp)) {
1025 netdev_err(elm->dev,
1026 "Received illegal character %02x.\n",
1028 elm327_hw_failure(elm);
1033 elm->rxbuf[elm->rxfill++] = *cp;
1040 netdev_err(elm->dev, "Receive buffer overflowed. Bad chip or wiring?");
1042 elm327_hw_failure(elm);
1047 elm327_parse_rxbuf(elm);
1050 spin_unlock_bh(&elm->lock);
1054 /* Write out remaining transmit buffer.
1055 * Scheduled when TTY is writable.
1057 static void elmcan_ldisc_tx_worker(struct work_struct *work)
1059 /* No need to use get_elm() here, as we'll always flush workers
1060 * before destroying the elmcan object.
1062 struct elmcan *elm = container_of(work, struct elmcan, tx_work);
1065 spin_lock_bh(&elm->lock);
1066 if (elm->hw_failure) {
1067 spin_unlock_bh(&elm->lock);
1071 if (!elm->tty || !netif_running(elm->dev)) {
1072 spin_unlock_bh(&elm->lock);
1076 if (elm->txleft <= 0) {
1077 /* Our TTY write buffer is empty:
1078 * Allow netdev to hand us another packet
1080 clear_bit(TTY_DO_WRITE_WAKEUP, &elm->tty->flags);
1081 spin_unlock_bh(&elm->lock);
1082 netif_wake_queue(elm->dev);
1086 actual = elm->tty->ops->write(elm->tty, elm->txhead, elm->txleft);
1088 netdev_err(elm->dev,
1089 "Failed to write to tty %s.\n",
1091 elm327_hw_failure(elm);
1092 spin_unlock_bh(&elm->lock);
1096 elm->txleft -= actual;
1097 elm->txhead += actual;
1098 spin_unlock_bh(&elm->lock);
1101 /* Called by the driver when there's room for more data. */
1102 static void elmcan_ldisc_tx_wakeup(struct tty_struct *tty)
1104 struct elmcan *elm = get_elm(tty);
1109 schedule_work(&elm->tx_work);
1114 /* ELM327 can only handle bitrates that are integer divisors of 500 kHz,
1115 * or 7/8 of that. Divisors are 1 to 64.
1116 * Currently we don't implement support for 7/8 rates.
1118 static const u32 elmcan_bitrate_const[64] = {
1119 7812, 7936, 8064, 8196, 8333, 8474, 8620, 8771,
1120 8928, 9090, 9259, 9433, 9615, 9803, 10000, 10204,
1121 10416, 10638, 10869, 11111, 11363, 11627, 11904, 12195,
1122 12500, 12820, 13157, 13513, 13888, 14285, 14705, 15151,
1123 15625, 16129, 16666, 17241, 17857, 18518, 19230, 20000,
1124 20833, 21739, 22727, 23809, 25000, 26315, 27777, 29411,
1125 31250, 33333, 35714, 38461, 41666, 45454, 50000, 55555,
1126 62500, 71428, 83333, 100000, 125000, 166666, 250000, 500000
1129 /* Dummy needed to use bitrate_const */
1130 static int elmcan_do_set_bittiming(struct net_device *netdev)
1137 static int elmcan_ldisc_open(struct tty_struct *tty)
1139 struct net_device *dev;
1143 if (!capable(CAP_NET_ADMIN))
1146 if (!tty->ops->write)
1149 dev = alloc_candev(sizeof(struct elmcan), 0);
1152 elm = netdev_priv(dev);
1154 elm->txbuf = kmalloc(ELM327_SIZE_TXBUF, GFP_KERNEL);
1160 /* Configure TTY interface */
1161 tty->receive_room = 65536; /* We don't flow control */
1162 elm->txleft = 0; /* Clear TTY TX buffer */
1163 spin_lock_init(&elm->lock);
1164 atomic_set(&elm->refcount, 1);
1165 INIT_WORK(&elm->tx_work, elmcan_ldisc_tx_worker);
1167 /* Configure CAN metadata */
1168 elm->can.state = CAN_STATE_STOPPED;
1169 elm->can.bitrate_const = elmcan_bitrate_const;
1170 elm->can.bitrate_const_cnt = ARRAY_SIZE(elmcan_bitrate_const);
1171 elm->can.do_set_bittiming = elmcan_do_set_bittiming;
1172 elm->can.ctrlmode_supported = CAN_CTRLMODE_LISTENONLY;
1174 /* Configure netlink interface */
1176 dev->netdev_ops = &elmcan_netdev_ops;
1178 /* Mark ldisc channel as alive */
1180 tty->disc_data = elm;
1182 devm_can_led_init(elm->dev);
1185 err = register_candev(elm->dev);
1189 netdev_info(elm->dev, "elmcan on %s.\n", tty->name);
1195 free_candev(elm->dev);
1199 /* Close down an elmcan channel.
1200 * This means flushing out any pending queues, and then returning.
1201 * This call is serialized against other ldisc functions:
1202 * Once this is called, no other ldisc function of ours is entered.
1204 * We also use this function for a hangup event.
1206 static void elmcan_ldisc_close(struct tty_struct *tty)
1208 struct elmcan *elm = get_elm(tty);
1213 /* unregister_netdev() calls .ndo_stop() so we don't have to. */
1214 unregister_candev(elm->dev);
1216 /* Decrease the refcount twice, once for our own get_elm(),
1217 * and once to remove the count of 1 that we set in _open().
1218 * Once it reaches 0, we can safely destroy it.
1223 while (atomic_read(&elm->refcount) > 0)
1224 msleep_interruptible(10);
1226 /* At this point, all ldisc calls to us have become no-ops. */
1228 flush_work(&elm->tx_work);
1230 /* Mark channel as dead */
1231 spin_lock_bh(&elm->lock);
1232 tty->disc_data = NULL;
1234 spin_unlock_bh(&elm->lock);
1236 netdev_info(elm->dev, "elmcan off %s.\n", tty->name);
1239 free_candev(elm->dev);
1242 #if LINUX_VERSION_CODE < KERNEL_VERSION(5,16,0)
1243 static int elmcan_ldisc_hangup(struct tty_struct *tty)
1245 static void elmcan_ldisc_hangup(struct tty_struct *tty)
1248 elmcan_ldisc_close(tty);
1249 #if LINUX_VERSION_CODE < KERNEL_VERSION(5,16,0)
1254 static int elmcan_ldisc_ioctl(struct tty_struct *tty,
1255 #if LINUX_VERSION_CODE < KERNEL_VERSION(5,17,0)
1258 unsigned int cmd, unsigned long arg)
1260 struct elmcan *elm = get_elm(tty);
1268 tmp = strnlen(elm->dev->name, IFNAMSIZ - 1) + 1;
1269 if (copy_to_user((void __user *)arg, elm->dev->name, tmp)) {
1283 #if LINUX_VERSION_CODE < KERNEL_VERSION(5,16,0)
1284 return tty_mode_ioctl(tty, file, cmd, arg);
1286 return tty_mode_ioctl(tty, cmd, arg);
1291 static struct tty_ldisc_ops elmcan_ldisc = {
1292 .owner = THIS_MODULE,
1295 .receive_buf = elmcan_ldisc_rx,
1296 .write_wakeup = elmcan_ldisc_tx_wakeup,
1297 .open = elmcan_ldisc_open,
1298 .close = elmcan_ldisc_close,
1299 .hangup = elmcan_ldisc_hangup,
1300 .ioctl = elmcan_ldisc_ioctl,
1303 static int __init elmcan_init(void)
1307 pr_info("ELM327 based best effort CAN interface driver\n");
1308 pr_info("This device is severely limited as a CAN interface, see documentation.\n");
1310 #if LINUX_VERSION_CODE < KERNEL_VERSION(5,14,0)
1311 status = tty_register_ldisc(N_ELMCAN, &elmcan_ldisc);
1313 status = tty_register_ldisc(&elmcan_ldisc);
1316 pr_err("Can't register line discipline\n");
1321 static void __exit elmcan_exit(void)
1323 /* This will only be called when all channels have been closed by
1324 * userspace - tty_ldisc.c takes care of the module's refcount.
1326 #if LINUX_VERSION_CODE < KERNEL_VERSION(5,14,0)
1329 status = tty_unregister_ldisc(N_ELMCAN);
1331 pr_err("Can't unregister line discipline (error: %d)\n",
1334 tty_unregister_ldisc(&elmcan_ldisc);
1338 module_init(elmcan_init);
1339 module_exit(elmcan_exit);