1 .. SPDX-License-Identifier: (GPL-2.0-only OR BSD-3-Clause)
3 can327: ELM327 driver for Linux SocketCAN
4 ==========================================
9 This driver has become an official part of Linux since v6.0:
11 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/net/can/can327.c?h=v6.0
13 For documentation and how to use the driver, please refer to the
14 documentation that comes with your Linux kernel version, since
15 the details may change as the driver evolves. The documentation
16 below applies ONLY to the downstream driver.
18 https://www.kernel.org/doc/html/latest/networking/device_drivers/can/can327.html
20 Please send patches upstream to [linux-can] and the maintainers for
23 I may or may not backport upstream patches to this downstream
24 repository, and/or use it for further pre-upstream work.
31 This is the non-upstreamed version of the can327 driver.
32 Please see out-of-tree.rst for compilation/usage hints.
39 Max Staudt <max-linux@enpas.org>
46 This driver aims to lower the initial cost for hackers interested in
47 working with CAN buses.
49 CAN adapters are expensive, few, and far between.
50 ELM327 interfaces are cheap and plentiful.
51 Let's use ELM327s as CAN adapters.
58 This driver is an effort to turn abundant ELM327 based OBD interfaces
59 into full fledged (as far as possible) CAN interfaces.
61 Since the ELM327 was never meant to be a stand alone CAN controller,
62 the driver has to switch between its modes as quickly as possible in
63 order to fake full-duplex operation.
65 As such, can327 is a best effort driver. However, this is more than
66 enough to implement simple request-response protocols (such as OBD II),
67 and to monitor broadcast messages on a bus (such as in a vehicle).
69 Most ELM327s come as nondescript serial devices, attached via USB or
70 Bluetooth. The driver cannot recognize them by itself, and as such it
71 is up to the user to attach it in form of a TTY line discipline
72 (similar to PPP, SLIP, slcan, ...).
74 This driver is meant for ELM327 versions 1.4b and up, see below for
75 known limitations in older controllers and clones.
82 The official data sheets can be found at ELM electronics' home page:
84 https://www.elmelectronics.com/
88 How to attach the line discipline
89 ----------------------------------
91 Every ELM327 chip is factory programmed to operate at a serial setting
92 of 38400 baud/s, 8 data bits, no parity, 1 stopbit.
94 If you have kept this default configuration, the line discipline can
95 be attached on a command prompt as follows::
103 --iflag -ICRNL,INLCR,-IXOFF \
107 To change the ELM327's serial settings, please refer to its data
108 sheet. This needs to be done before attaching the line discipline.
110 Once the ldisc is attached, the CAN interface starts out unconfigured.
111 Set the speed before starting it::
113 # The interface needs to be down to change parameters
114 sudo ip link set can0 down
115 sudo ip link set can0 type can bitrate 500000
116 sudo ip link set can0 up
118 500000 bit/s is a common rate for OBD-II diagnostics.
119 If you're connecting straight to a car's OBD port, this is the speed
120 that most cars (but not all!) expect.
122 After this, you can set out as usual with candump, cansniffer, etc.
126 How to check the controller version
127 ------------------------------------
129 Use a terminal program to attach to the controller.
131 After issuing the "``AT WS``" command, the controller will respond with
141 Note that clones may claim to be any version they like.
142 It is not indicative of their actual feature set.
147 Communication example
148 ----------------------
150 This is a short and incomplete introduction on how to talk to an ELM327.
151 It is here to guide understanding of the controller's and the driver's
152 limitation (listed below) as well as manual testing.
155 The ELM327 has two modes:
160 In command mode, it expects one command per line, terminated by CR.
161 By default, the prompt is a "``>``", after which a command can be
168 The init script in the driver switches off several configuration options
169 that are only meaningful in the original OBD scenario the chip is meant
170 for, and are actually a hindrance for can327.
173 When a command is not recognized, such as by an older version of the
174 ELM327, a question mark is printed as a response instead of OK::
180 At present, can327 does not evaluate this response. See the section
181 below on known limitations for details.
184 When a CAN frame is to be sent, the target address is configured, after
185 which the frame is sent as a command that consists of the data's hex
194 The above interaction sends the SFF frame "``DE AD BE EF 12 34 56 78``"
195 with (11 bit) CAN ID ``0x123``.
196 For this to function, the controller must be configured for SFF sending
197 mode (using "``AT PB``", see code or datasheet).
200 Once a frame has been sent and wait-for-reply mode is on (``ATR1``,
201 configured on ``listen-only=off``), or when the reply timeout expires
202 and the driver sets the controller into monitoring mode (``ATMA``),
203 the ELM327 will send one line for each received CAN frame, consisting
204 of CAN ID, DLC, and data::
206 123 8 DEADBEEF12345678
208 For EFF (29 bit) CAN frames, the address format is slightly different,
209 which can327 uses to tell the two apart::
211 12 34 56 78 8 DEADBEEF12345678
213 The ELM327 will receive both SFF and EFF frames - the current CAN
214 config (``ATPB``) does not matter.
217 If the ELM327's internal UART sending buffer runs full, it will abort
218 the monitoring mode, print "BUFFER FULL" and drop back into command
219 mode. Note that in this case, unlike with other error messages, the
220 error message may appear on the same line as the last (usually
221 incomplete) data frame::
223 12 34 56 78 8 DEADBEEF123 BUFFER FULL
227 Known limitations of the controller
228 ------------------------------------
230 - Clone devices ("v1.5" and others)
232 Sending RTR frames is not supported and will be dropped silently.
234 Receiving RTR with DLC 8 will appear to be a regular frame with
235 the last received frame's DLC and payload.
237 "``AT CSM``" (CAN Silent Monitoring, i.e. don't send CAN ACKs) is
238 not supported, and is hard coded to ON. Thus, frames are not ACKed
239 while listening: "``AT MA``" (Monitor All) will always be "silent".
240 However, immediately after sending a frame, the ELM327 will be in
241 "receive reply" mode, in which it *does* ACK any received frames.
242 Once the bus goes silent, or an error occurs (such as BUFFER FULL),
243 or the receive reply timeout runs out, the ELM327 will end reply
244 reception mode on its own and can327 will fall back to "``AT MA``"
245 in order to keep monitoring the bus.
247 Other limitations may apply, depending on the clone and the quality
253 No full duplex operation is supported. The driver will switch
254 between input/output mode as quickly as possible.
256 The length of outgoing RTR frames cannot be set. In fact, some
257 clones (tested with one identifying as "``v1.5``") are unable to
258 send RTR frames at all.
260 We don't have a way to get real-time notifications on CAN errors.
261 While there is a command (``AT CS``) to retrieve some basic stats,
262 we don't poll it as it would force us to interrupt reception mode.
265 - Versions prior to 1.4b
267 These versions do not send CAN ACKs when in monitoring mode (AT MA).
268 However, they do send ACKs while waiting for a reply immediately
269 after sending a frame. The driver maximizes this time to make the
270 controller as useful as possible.
272 Starting with version 1.4b, the ELM327 supports the "``AT CSM``"
273 command, and the "listen-only" CAN option will take effect.
276 - Versions prior to 1.4
278 These chips do not support the "``AT PB``" command, and thus cannot
279 change bitrate or SFF/EFF mode on-the-fly. This will have to be
280 programmed by the user before attaching the line discipline. See the
281 data sheet for details.
284 - Versions prior to 1.3
286 These chips cannot be used at all with can327. They do not support
287 the "``AT D1``" command, which is necessary to avoid parsing conflicts
288 on incoming data, as well as distinction of RTR frame lengths.
290 Specifically, this allows for easy distinction of SFF and EFF
291 frames, and to check whether frames are complete. While it is possible
292 to deduce the type and length from the length of the line the ELM327
293 sends us, this method fails when the ELM327's UART output buffer
294 overruns. It may abort sending in the middle of the line, which will
295 then be mistaken for something else.
299 Known limitations of the driver
300 --------------------------------
304 ELM327 can only set CAN bitrates that are of the form 500000/n, where
305 n is an integer divisor.
306 However there is an exception: With a separate flag, it may set the
307 speed to be 8/7 of the speed indicated by the divisor.
308 This mode is not currently implemented.
310 - No evaluation of command responses.
312 The ELM327 will reply with OK when a command is understood, and with ?
313 when it is not. The driver does not currently check this, and simply
314 assumes that the chip understands every command.
315 The driver is built such that functionality degrades gracefully
316 nevertheless. See the section on known limitations of the controller.
318 - No use of hardware CAN ID filtering
320 An ELM327's UART sending buffer will easily overflow on heavy CAN bus
321 load, resulting in the "``BUFFER FULL``" message. Using the hardware
322 filters available through "``AT CF xxx``" and "``AT CM xxx``" would be
323 helpful here, however SocketCAN does not currently provide a facility
324 to make use of such hardware features.
328 Rationale behind the chosen configuration
329 ------------------------------------------
334 We need this to be able to get a prompt reliably.
339 We need this to distinguish 11/29 bit CAN addresses received.
342 We can usually do this using the line length (odd/even),
343 but this fails if the line is not transmitted fully to
344 the host (BUFFER FULL).
349 We need this to tell the "length" of RTR frames.
353 A note on CAN bus termination
354 ------------------------------
356 Your adapter may have resistors soldered in which are meant to terminate
357 the bus. This is correct when it is plugged into a OBD-II socket, but
358 not helpful when trying to tap into the middle of an existing CAN bus.
360 If communications don't work with the adapter connected, check for the
361 termination resistors on its PCB and try removing them.