xref: /openbmc/linux/drivers/net/can/can327.c (revision f052febd)
1 // SPDX-License-Identifier: GPL-2.0
2 /* ELM327 based CAN interface driver (tty line discipline)
3  *
4  * This driver started as a derivative of linux/drivers/net/can/slcan.c
5  * and my thanks go to the original authors for their inspiration.
6  *
7  * can327.c Author : Max Staudt <max-linux@enpas.org>
8  * slcan.c Author  : Oliver Hartkopp <socketcan@hartkopp.net>
9  * slip.c Authors  : Laurence Culhane <loz@holmes.demon.co.uk>
10  *                   Fred N. van Kempen <waltje@uwalt.nl.mugnet.org>
11  */
12 
13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
14 
15 #include <linux/init.h>
16 #include <linux/module.h>
17 
18 #include <linux/bitops.h>
19 #include <linux/ctype.h>
20 #include <linux/errno.h>
21 #include <linux/kernel.h>
22 #include <linux/list.h>
23 #include <linux/lockdep.h>
24 #include <linux/netdevice.h>
25 #include <linux/skbuff.h>
26 #include <linux/spinlock.h>
27 #include <linux/string.h>
28 #include <linux/tty.h>
29 #include <linux/tty_ldisc.h>
30 #include <linux/workqueue.h>
31 
32 #include <uapi/linux/tty.h>
33 
34 #include <linux/can.h>
35 #include <linux/can/dev.h>
36 #include <linux/can/error.h>
37 #include <linux/can/rx-offload.h>
38 
39 #define CAN327_NAPI_WEIGHT 4
40 
41 #define CAN327_SIZE_TXBUF 32
42 #define CAN327_SIZE_RXBUF 1024
43 
44 #define CAN327_CAN_CONFIG_SEND_SFF 0x8000
45 #define CAN327_CAN_CONFIG_VARIABLE_DLC 0x4000
46 #define CAN327_CAN_CONFIG_RECV_BOTH_SFF_EFF 0x2000
47 #define CAN327_CAN_CONFIG_BAUDRATE_MULT_8_7 0x1000
48 
49 #define CAN327_DUMMY_CHAR 'y'
50 #define CAN327_DUMMY_STRING "y"
51 #define CAN327_READY_CHAR '>'
52 
53 /* Bits in elm->cmds_todo */
54 enum can327_tx_do {
55 	CAN327_TX_DO_CAN_DATA = 0,
56 	CAN327_TX_DO_CANID_11BIT,
57 	CAN327_TX_DO_CANID_29BIT_LOW,
58 	CAN327_TX_DO_CANID_29BIT_HIGH,
59 	CAN327_TX_DO_CAN_CONFIG_PART2,
60 	CAN327_TX_DO_CAN_CONFIG,
61 	CAN327_TX_DO_RESPONSES,
62 	CAN327_TX_DO_SILENT_MONITOR,
63 	CAN327_TX_DO_INIT,
64 };
65 
66 struct can327 {
67 	/* This must be the first member when using alloc_candev() */
68 	struct can_priv can;
69 
70 	struct can_rx_offload offload;
71 
72 	/* TTY buffers */
73 	u8 txbuf[CAN327_SIZE_TXBUF];
74 	u8 rxbuf[CAN327_SIZE_RXBUF];
75 
76 	/* Per-channel lock */
77 	spinlock_t lock;
78 
79 	/* TTY and netdev devices that we're bridging */
80 	struct tty_struct *tty;
81 	struct net_device *dev;
82 
83 	/* TTY buffer accounting */
84 	struct work_struct tx_work;	/* Flushes TTY TX buffer */
85 	u8 *txhead;			/* Next TX byte */
86 	size_t txleft;			/* Bytes left to TX */
87 	int rxfill;			/* Bytes already RX'd in buffer */
88 
89 	/* State machine */
90 	enum {
91 		CAN327_STATE_NOTINIT = 0,
92 		CAN327_STATE_GETDUMMYCHAR,
93 		CAN327_STATE_GETPROMPT,
94 		CAN327_STATE_RECEIVING,
95 	} state;
96 
97 	/* Things we have yet to send */
98 	char **next_init_cmd;
99 	unsigned long cmds_todo;
100 
101 	/* The CAN frame and config the ELM327 is sending/using,
102 	 * or will send/use after finishing all cmds_todo
103 	 */
104 	struct can_frame can_frame_to_send;
105 	u16 can_config;
106 	u8 can_bitrate_divisor;
107 
108 	/* Parser state */
109 	bool drop_next_line;
110 
111 	/* Stop the channel on UART side hardware failure, e.g. stray
112 	 * characters or neverending lines. This may be caused by bad
113 	 * UART wiring, a bad ELM327, a bad UART bridge...
114 	 * Once this is true, nothing will be sent to the TTY.
115 	 */
116 	bool uart_side_failure;
117 };
118 
119 static inline void can327_uart_side_failure(struct can327 *elm);
120 
121 static void can327_send(struct can327 *elm, const void *buf, size_t len)
122 {
123 	int written;
124 
125 	lockdep_assert_held(&elm->lock);
126 
127 	if (elm->uart_side_failure)
128 		return;
129 
130 	memcpy(elm->txbuf, buf, len);
131 
132 	/* Order of next two lines is *very* important.
133 	 * When we are sending a little amount of data,
134 	 * the transfer may be completed inside the ops->write()
135 	 * routine, because it's running with interrupts enabled.
136 	 * In this case we *never* got WRITE_WAKEUP event,
137 	 * if we did not request it before write operation.
138 	 *       14 Oct 1994  Dmitry Gorodchanin.
139 	 */
140 	set_bit(TTY_DO_WRITE_WAKEUP, &elm->tty->flags);
141 	written = elm->tty->ops->write(elm->tty, elm->txbuf, len);
142 	if (written < 0) {
143 		netdev_err(elm->dev, "Failed to write to tty %s.\n",
144 			   elm->tty->name);
145 		can327_uart_side_failure(elm);
146 		return;
147 	}
148 
149 	elm->txleft = len - written;
150 	elm->txhead = elm->txbuf + written;
151 }
152 
153 /* Take the ELM327 out of almost any state and back into command mode.
154  * We send CAN327_DUMMY_CHAR which will either abort any running
155  * operation, or be echoed back to us in case we're already in command
156  * mode.
157  */
158 static void can327_kick_into_cmd_mode(struct can327 *elm)
159 {
160 	lockdep_assert_held(&elm->lock);
161 
162 	if (elm->state != CAN327_STATE_GETDUMMYCHAR &&
163 	    elm->state != CAN327_STATE_GETPROMPT) {
164 		can327_send(elm, CAN327_DUMMY_STRING, 1);
165 
166 		elm->state = CAN327_STATE_GETDUMMYCHAR;
167 	}
168 }
169 
170 /* Schedule a CAN frame and necessary config changes to be sent to the TTY. */
171 static void can327_send_frame(struct can327 *elm, struct can_frame *frame)
172 {
173 	lockdep_assert_held(&elm->lock);
174 
175 	/* Schedule any necessary changes in ELM327's CAN configuration */
176 	if (elm->can_frame_to_send.can_id != frame->can_id) {
177 		/* Set the new CAN ID for transmission. */
178 		if ((frame->can_id ^ elm->can_frame_to_send.can_id)
179 		    & CAN_EFF_FLAG) {
180 			elm->can_config =
181 				(frame->can_id & CAN_EFF_FLAG ? 0 : CAN327_CAN_CONFIG_SEND_SFF) |
182 				CAN327_CAN_CONFIG_VARIABLE_DLC |
183 				CAN327_CAN_CONFIG_RECV_BOTH_SFF_EFF |
184 				elm->can_bitrate_divisor;
185 
186 			set_bit(CAN327_TX_DO_CAN_CONFIG, &elm->cmds_todo);
187 		}
188 
189 		if (frame->can_id & CAN_EFF_FLAG) {
190 			clear_bit(CAN327_TX_DO_CANID_11BIT, &elm->cmds_todo);
191 			set_bit(CAN327_TX_DO_CANID_29BIT_LOW, &elm->cmds_todo);
192 			set_bit(CAN327_TX_DO_CANID_29BIT_HIGH, &elm->cmds_todo);
193 		} else {
194 			set_bit(CAN327_TX_DO_CANID_11BIT, &elm->cmds_todo);
195 			clear_bit(CAN327_TX_DO_CANID_29BIT_LOW,
196 				  &elm->cmds_todo);
197 			clear_bit(CAN327_TX_DO_CANID_29BIT_HIGH,
198 				  &elm->cmds_todo);
199 		}
200 	}
201 
202 	/* Schedule the CAN frame itself. */
203 	elm->can_frame_to_send = *frame;
204 	set_bit(CAN327_TX_DO_CAN_DATA, &elm->cmds_todo);
205 
206 	can327_kick_into_cmd_mode(elm);
207 }
208 
209 /* ELM327 initialisation sequence.
210  * The line length is limited by the buffer in can327_handle_prompt().
211  */
212 static char *can327_init_script[] = {
213 	"AT WS\r",        /* v1.0: Warm Start */
214 	"AT PP FF OFF\r", /* v1.0: All Programmable Parameters Off */
215 	"AT M0\r",        /* v1.0: Memory Off */
216 	"AT AL\r",        /* v1.0: Allow Long messages */
217 	"AT BI\r",        /* v1.0: Bypass Initialisation */
218 	"AT CAF0\r",      /* v1.0: CAN Auto Formatting Off */
219 	"AT CFC0\r",      /* v1.0: CAN Flow Control Off */
220 	"AT CF 000\r",    /* v1.0: Reset CAN ID Filter */
221 	"AT CM 000\r",    /* v1.0: Reset CAN ID Mask */
222 	"AT E1\r",        /* v1.0: Echo On */
223 	"AT H1\r",        /* v1.0: Headers On */
224 	"AT L0\r",        /* v1.0: Linefeeds Off */
225 	"AT SH 7DF\r",    /* v1.0: Set CAN sending ID to 0x7df */
226 	"AT ST FF\r",     /* v1.0: Set maximum Timeout for response after TX */
227 	"AT AT0\r",       /* v1.2: Adaptive Timing Off */
228 	"AT D1\r",        /* v1.3: Print DLC On */
229 	"AT S1\r",        /* v1.3: Spaces On */
230 	"AT TP B\r",      /* v1.0: Try Protocol B */
231 	NULL
232 };
233 
234 static void can327_init_device(struct can327 *elm)
235 {
236 	lockdep_assert_held(&elm->lock);
237 
238 	elm->state = CAN327_STATE_NOTINIT;
239 	elm->can_frame_to_send.can_id = 0x7df; /* ELM327 HW default */
240 	elm->rxfill = 0;
241 	elm->drop_next_line = 0;
242 
243 	/* We can only set the bitrate as a fraction of 500000.
244 	 * The bitrates listed in can327_bitrate_const will
245 	 * limit the user to the right values.
246 	 */
247 	elm->can_bitrate_divisor = 500000 / elm->can.bittiming.bitrate;
248 	elm->can_config =
249 		CAN327_CAN_CONFIG_SEND_SFF | CAN327_CAN_CONFIG_VARIABLE_DLC |
250 		CAN327_CAN_CONFIG_RECV_BOTH_SFF_EFF | elm->can_bitrate_divisor;
251 
252 	/* Configure ELM327 and then start monitoring */
253 	elm->next_init_cmd = &can327_init_script[0];
254 	set_bit(CAN327_TX_DO_INIT, &elm->cmds_todo);
255 	set_bit(CAN327_TX_DO_SILENT_MONITOR, &elm->cmds_todo);
256 	set_bit(CAN327_TX_DO_RESPONSES, &elm->cmds_todo);
257 	set_bit(CAN327_TX_DO_CAN_CONFIG, &elm->cmds_todo);
258 
259 	can327_kick_into_cmd_mode(elm);
260 }
261 
262 static void can327_feed_frame_to_netdev(struct can327 *elm, struct sk_buff *skb)
263 {
264 	lockdep_assert_held(&elm->lock);
265 
266 	if (!netif_running(elm->dev))
267 		return;
268 
269 	/* Queue for NAPI pickup.
270 	 * rx-offload will update stats and LEDs for us.
271 	 */
272 	if (can_rx_offload_queue_tail(&elm->offload, skb))
273 		elm->dev->stats.rx_fifo_errors++;
274 
275 	/* Wake NAPI */
276 	can_rx_offload_irq_finish(&elm->offload);
277 }
278 
279 /* Called when we're out of ideas and just want it all to end. */
280 static inline void can327_uart_side_failure(struct can327 *elm)
281 {
282 	struct can_frame *frame;
283 	struct sk_buff *skb;
284 
285 	lockdep_assert_held(&elm->lock);
286 
287 	elm->uart_side_failure = true;
288 
289 	clear_bit(TTY_DO_WRITE_WAKEUP, &elm->tty->flags);
290 
291 	elm->can.can_stats.bus_off++;
292 	netif_stop_queue(elm->dev);
293 	elm->can.state = CAN_STATE_BUS_OFF;
294 	can_bus_off(elm->dev);
295 
296 	netdev_err(elm->dev,
297 		   "ELM327 misbehaved. Blocking further communication.\n");
298 
299 	skb = alloc_can_err_skb(elm->dev, &frame);
300 	if (!skb)
301 		return;
302 
303 	frame->can_id |= CAN_ERR_BUSOFF;
304 	can327_feed_frame_to_netdev(elm, skb);
305 }
306 
307 /* Compares a byte buffer (non-NUL terminated) to the payload part of
308  * a string, and returns true iff the buffer (content *and* length) is
309  * exactly that string, without the terminating NUL byte.
310  *
311  * Example: If reference is "BUS ERROR", then this returns true iff nbytes == 9
312  *          and !memcmp(buf, "BUS ERROR", 9).
313  *
314  * The reason to use strings is so we can easily include them in the C
315  * code, and to avoid hardcoding lengths.
316  */
317 static inline bool can327_rxbuf_cmp(const u8 *buf, size_t nbytes,
318 				    const char *reference)
319 {
320 	size_t ref_len = strlen(reference);
321 
322 	return (nbytes == ref_len) && !memcmp(buf, reference, ref_len);
323 }
324 
325 static void can327_parse_error(struct can327 *elm, size_t len)
326 {
327 	struct can_frame *frame;
328 	struct sk_buff *skb;
329 
330 	lockdep_assert_held(&elm->lock);
331 
332 	skb = alloc_can_err_skb(elm->dev, &frame);
333 	if (!skb)
334 		/* It's okay to return here:
335 		 * The outer parsing loop will drop this UART buffer.
336 		 */
337 		return;
338 
339 	/* Filter possible error messages based on length of RX'd line */
340 	if (can327_rxbuf_cmp(elm->rxbuf, len, "UNABLE TO CONNECT")) {
341 		netdev_err(elm->dev,
342 			   "ELM327 reported UNABLE TO CONNECT. Please check your setup.\n");
343 	} else if (can327_rxbuf_cmp(elm->rxbuf, len, "BUFFER FULL")) {
344 		/* This will only happen if the last data line was complete.
345 		 * Otherwise, can327_parse_frame() will heuristically
346 		 * emit this kind of error frame instead.
347 		 */
348 		frame->can_id |= CAN_ERR_CRTL;
349 		frame->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
350 	} else if (can327_rxbuf_cmp(elm->rxbuf, len, "BUS ERROR")) {
351 		frame->can_id |= CAN_ERR_BUSERROR;
352 	} else if (can327_rxbuf_cmp(elm->rxbuf, len, "CAN ERROR")) {
353 		frame->can_id |= CAN_ERR_PROT;
354 	} else if (can327_rxbuf_cmp(elm->rxbuf, len, "<RX ERROR")) {
355 		frame->can_id |= CAN_ERR_PROT;
356 	} else if (can327_rxbuf_cmp(elm->rxbuf, len, "BUS BUSY")) {
357 		frame->can_id |= CAN_ERR_PROT;
358 		frame->data[2] = CAN_ERR_PROT_OVERLOAD;
359 	} else if (can327_rxbuf_cmp(elm->rxbuf, len, "FB ERROR")) {
360 		frame->can_id |= CAN_ERR_PROT;
361 		frame->data[2] = CAN_ERR_PROT_TX;
362 	} else if (len == 5 && !memcmp(elm->rxbuf, "ERR", 3)) {
363 		/* ERR is followed by two digits, hence line length 5 */
364 		netdev_err(elm->dev, "ELM327 reported an ERR%c%c. Please power it off and on again.\n",
365 			   elm->rxbuf[3], elm->rxbuf[4]);
366 		frame->can_id |= CAN_ERR_CRTL;
367 	} else {
368 		/* Something else has happened.
369 		 * Maybe garbage on the UART line.
370 		 * Emit a generic error frame.
371 		 */
372 	}
373 
374 	can327_feed_frame_to_netdev(elm, skb);
375 }
376 
377 /* Parse CAN frames coming as ASCII from ELM327.
378  * They can be of various formats:
379  *
380  * 29-bit ID (EFF):  12 34 56 78 D PL PL PL PL PL PL PL PL
381  * 11-bit ID (!EFF): 123 D PL PL PL PL PL PL PL PL
382  *
383  * where D = DLC, PL = payload byte
384  *
385  * Instead of a payload, RTR indicates a remote request.
386  *
387  * We will use the spaces and line length to guess the format.
388  */
389 static int can327_parse_frame(struct can327 *elm, size_t len)
390 {
391 	struct can_frame *frame;
392 	struct sk_buff *skb;
393 	int hexlen;
394 	int datastart;
395 	int i;
396 
397 	lockdep_assert_held(&elm->lock);
398 
399 	skb = alloc_can_skb(elm->dev, &frame);
400 	if (!skb)
401 		return -ENOMEM;
402 
403 	/* Find first non-hex and non-space character:
404 	 *  - In the simplest case, there is none.
405 	 *  - For RTR frames, 'R' is the first non-hex character.
406 	 *  - An error message may replace the end of the data line.
407 	 */
408 	for (hexlen = 0; hexlen <= len; hexlen++) {
409 		if (hex_to_bin(elm->rxbuf[hexlen]) < 0 &&
410 		    elm->rxbuf[hexlen] != ' ') {
411 			break;
412 		}
413 	}
414 
415 	/* Sanity check whether the line is really a clean hexdump,
416 	 * or terminated by an error message, or contains garbage.
417 	 */
418 	if (hexlen < len && !isdigit(elm->rxbuf[hexlen]) &&
419 	    !isupper(elm->rxbuf[hexlen]) && '<' != elm->rxbuf[hexlen] &&
420 	    ' ' != elm->rxbuf[hexlen]) {
421 		/* The line is likely garbled anyway, so bail.
422 		 * The main code will restart listening.
423 		 */
424 		kfree_skb(skb);
425 		return -ENODATA;
426 	}
427 
428 	/* Use spaces in CAN ID to distinguish 29 or 11 bit address length.
429 	 * No out-of-bounds access:
430 	 * We use the fact that we can always read from elm->rxbuf.
431 	 */
432 	if (elm->rxbuf[2] == ' ' && elm->rxbuf[5] == ' ' &&
433 	    elm->rxbuf[8] == ' ' && elm->rxbuf[11] == ' ' &&
434 	    elm->rxbuf[13] == ' ') {
435 		frame->can_id = CAN_EFF_FLAG;
436 		datastart = 14;
437 	} else if (elm->rxbuf[3] == ' ' && elm->rxbuf[5] == ' ') {
438 		datastart = 6;
439 	} else {
440 		/* This is not a well-formatted data line.
441 		 * Assume it's an error message.
442 		 */
443 		kfree_skb(skb);
444 		return -ENODATA;
445 	}
446 
447 	if (hexlen < datastart) {
448 		/* The line is too short to be a valid frame hex dump.
449 		 * Something interrupted the hex dump or it is invalid.
450 		 */
451 		kfree_skb(skb);
452 		return -ENODATA;
453 	}
454 
455 	/* From here on all chars up to buf[hexlen] are hex or spaces,
456 	 * at well-defined offsets.
457 	 */
458 
459 	/* Read CAN data length */
460 	frame->len = (hex_to_bin(elm->rxbuf[datastart - 2]) << 0);
461 
462 	/* Read CAN ID */
463 	if (frame->can_id & CAN_EFF_FLAG) {
464 		frame->can_id |= (hex_to_bin(elm->rxbuf[0]) << 28) |
465 				 (hex_to_bin(elm->rxbuf[1]) << 24) |
466 				 (hex_to_bin(elm->rxbuf[3]) << 20) |
467 				 (hex_to_bin(elm->rxbuf[4]) << 16) |
468 				 (hex_to_bin(elm->rxbuf[6]) << 12) |
469 				 (hex_to_bin(elm->rxbuf[7]) << 8) |
470 				 (hex_to_bin(elm->rxbuf[9]) << 4) |
471 				 (hex_to_bin(elm->rxbuf[10]) << 0);
472 	} else {
473 		frame->can_id |= (hex_to_bin(elm->rxbuf[0]) << 8) |
474 				 (hex_to_bin(elm->rxbuf[1]) << 4) |
475 				 (hex_to_bin(elm->rxbuf[2]) << 0);
476 	}
477 
478 	/* Check for RTR frame */
479 	if (elm->rxfill >= hexlen + 3 &&
480 	    !memcmp(&elm->rxbuf[hexlen], "RTR", 3)) {
481 		frame->can_id |= CAN_RTR_FLAG;
482 	}
483 
484 	/* Is the line long enough to hold the advertised payload?
485 	 * Note: RTR frames have a DLC, but no actual payload.
486 	 */
487 	if (!(frame->can_id & CAN_RTR_FLAG) &&
488 	    (hexlen < frame->len * 3 + datastart)) {
489 		/* Incomplete frame.
490 		 * Probably the ELM327's RS232 TX buffer was full.
491 		 * Emit an error frame and exit.
492 		 */
493 		frame->can_id = CAN_ERR_FLAG | CAN_ERR_CRTL;
494 		frame->len = CAN_ERR_DLC;
495 		frame->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
496 		can327_feed_frame_to_netdev(elm, skb);
497 
498 		/* Signal failure to parse.
499 		 * The line will be re-parsed as an error line, which will fail.
500 		 * However, this will correctly drop the state machine back into
501 		 * command mode.
502 		 */
503 		return -ENODATA;
504 	}
505 
506 	/* Parse the data nibbles. */
507 	for (i = 0; i < frame->len; i++) {
508 		frame->data[i] =
509 			(hex_to_bin(elm->rxbuf[datastart + 3 * i]) << 4) |
510 			(hex_to_bin(elm->rxbuf[datastart + 3 * i + 1]));
511 	}
512 
513 	/* Feed the frame to the network layer. */
514 	can327_feed_frame_to_netdev(elm, skb);
515 
516 	return 0;
517 }
518 
519 static void can327_parse_line(struct can327 *elm, size_t len)
520 {
521 	lockdep_assert_held(&elm->lock);
522 
523 	/* Skip empty lines */
524 	if (!len)
525 		return;
526 
527 	/* Skip echo lines */
528 	if (elm->drop_next_line) {
529 		elm->drop_next_line = 0;
530 		return;
531 	} else if (!memcmp(elm->rxbuf, "AT", 2)) {
532 		return;
533 	}
534 
535 	/* Regular parsing */
536 	if (elm->state == CAN327_STATE_RECEIVING &&
537 	    can327_parse_frame(elm, len)) {
538 		/* Parse an error line. */
539 		can327_parse_error(elm, len);
540 
541 		/* Start afresh. */
542 		can327_kick_into_cmd_mode(elm);
543 	}
544 }
545 
546 static void can327_handle_prompt(struct can327 *elm)
547 {
548 	struct can_frame *frame = &elm->can_frame_to_send;
549 	/* Size this buffer for the largest ELM327 line we may generate,
550 	 * which is currently an 8 byte CAN frame's payload hexdump.
551 	 * Items in can327_init_script must fit here, too!
552 	 */
553 	char local_txbuf[sizeof("0102030405060708\r")];
554 
555 	lockdep_assert_held(&elm->lock);
556 
557 	if (!elm->cmds_todo) {
558 		/* Enter CAN monitor mode */
559 		can327_send(elm, "ATMA\r", 5);
560 		elm->state = CAN327_STATE_RECEIVING;
561 
562 		/* We will be in the default state once this command is
563 		 * sent, so enable the TX packet queue.
564 		 */
565 		netif_wake_queue(elm->dev);
566 
567 		return;
568 	}
569 
570 	/* Reconfigure ELM327 step by step as indicated by elm->cmds_todo */
571 	if (test_bit(CAN327_TX_DO_INIT, &elm->cmds_todo)) {
572 		snprintf(local_txbuf, sizeof(local_txbuf), "%s",
573 			 *elm->next_init_cmd);
574 
575 		elm->next_init_cmd++;
576 		if (!(*elm->next_init_cmd)) {
577 			clear_bit(CAN327_TX_DO_INIT, &elm->cmds_todo);
578 			/* Init finished. */
579 		}
580 
581 	} else if (test_and_clear_bit(CAN327_TX_DO_SILENT_MONITOR, &elm->cmds_todo)) {
582 		snprintf(local_txbuf, sizeof(local_txbuf),
583 			 "ATCSM%i\r",
584 			 !!(elm->can.ctrlmode & CAN_CTRLMODE_LISTENONLY));
585 
586 	} else if (test_and_clear_bit(CAN327_TX_DO_RESPONSES, &elm->cmds_todo)) {
587 		snprintf(local_txbuf, sizeof(local_txbuf),
588 			 "ATR%i\r",
589 			 !(elm->can.ctrlmode & CAN_CTRLMODE_LISTENONLY));
590 
591 	} else if (test_and_clear_bit(CAN327_TX_DO_CAN_CONFIG, &elm->cmds_todo)) {
592 		snprintf(local_txbuf, sizeof(local_txbuf),
593 			 "ATPC\r");
594 		set_bit(CAN327_TX_DO_CAN_CONFIG_PART2, &elm->cmds_todo);
595 
596 	} else if (test_and_clear_bit(CAN327_TX_DO_CAN_CONFIG_PART2, &elm->cmds_todo)) {
597 		snprintf(local_txbuf, sizeof(local_txbuf),
598 			 "ATPB%04X\r",
599 			 elm->can_config);
600 
601 	} else if (test_and_clear_bit(CAN327_TX_DO_CANID_29BIT_HIGH, &elm->cmds_todo)) {
602 		snprintf(local_txbuf, sizeof(local_txbuf),
603 			 "ATCP%02X\r",
604 			 (frame->can_id & CAN_EFF_MASK) >> 24);
605 
606 	} else if (test_and_clear_bit(CAN327_TX_DO_CANID_29BIT_LOW, &elm->cmds_todo)) {
607 		snprintf(local_txbuf, sizeof(local_txbuf),
608 			 "ATSH%06X\r",
609 			 frame->can_id & CAN_EFF_MASK & ((1 << 24) - 1));
610 
611 	} else if (test_and_clear_bit(CAN327_TX_DO_CANID_11BIT, &elm->cmds_todo)) {
612 		snprintf(local_txbuf, sizeof(local_txbuf),
613 			 "ATSH%03X\r",
614 			 frame->can_id & CAN_SFF_MASK);
615 
616 	} else if (test_and_clear_bit(CAN327_TX_DO_CAN_DATA, &elm->cmds_todo)) {
617 		if (frame->can_id & CAN_RTR_FLAG) {
618 			/* Send an RTR frame. Their DLC is fixed.
619 			 * Some chips don't send them at all.
620 			 */
621 			snprintf(local_txbuf, sizeof(local_txbuf), "ATRTR\r");
622 		} else {
623 			/* Send a regular CAN data frame */
624 			int i;
625 
626 			for (i = 0; i < frame->len; i++) {
627 				snprintf(&local_txbuf[2 * i],
628 					 sizeof(local_txbuf), "%02X",
629 					 frame->data[i]);
630 			}
631 
632 			snprintf(&local_txbuf[2 * i], sizeof(local_txbuf),
633 				 "\r");
634 		}
635 
636 		elm->drop_next_line = 1;
637 		elm->state = CAN327_STATE_RECEIVING;
638 
639 		/* We will be in the default state once this command is
640 		 * sent, so enable the TX packet queue.
641 		 */
642 		netif_wake_queue(elm->dev);
643 	}
644 
645 	can327_send(elm, local_txbuf, strlen(local_txbuf));
646 }
647 
648 static bool can327_is_ready_char(char c)
649 {
650 	/* Bits 0xc0 are sometimes set (randomly), hence the mask.
651 	 * Probably bad hardware.
652 	 */
653 	return (c & 0x3f) == CAN327_READY_CHAR;
654 }
655 
656 static void can327_drop_bytes(struct can327 *elm, size_t i)
657 {
658 	lockdep_assert_held(&elm->lock);
659 
660 	memmove(&elm->rxbuf[0], &elm->rxbuf[i], CAN327_SIZE_RXBUF - i);
661 	elm->rxfill -= i;
662 }
663 
664 static void can327_parse_rxbuf(struct can327 *elm, size_t first_new_char_idx)
665 {
666 	size_t len, pos;
667 
668 	lockdep_assert_held(&elm->lock);
669 
670 	switch (elm->state) {
671 	case CAN327_STATE_NOTINIT:
672 		elm->rxfill = 0;
673 		break;
674 
675 	case CAN327_STATE_GETDUMMYCHAR:
676 		/* Wait for 'y' or '>' */
677 		for (pos = 0; pos < elm->rxfill; pos++) {
678 			if (elm->rxbuf[pos] == CAN327_DUMMY_CHAR) {
679 				can327_send(elm, "\r", 1);
680 				elm->state = CAN327_STATE_GETPROMPT;
681 				pos++;
682 				break;
683 			} else if (can327_is_ready_char(elm->rxbuf[pos])) {
684 				can327_send(elm, CAN327_DUMMY_STRING, 1);
685 				pos++;
686 				break;
687 			}
688 		}
689 
690 		can327_drop_bytes(elm, pos);
691 		break;
692 
693 	case CAN327_STATE_GETPROMPT:
694 		/* Wait for '>' */
695 		if (can327_is_ready_char(elm->rxbuf[elm->rxfill - 1]))
696 			can327_handle_prompt(elm);
697 
698 		elm->rxfill = 0;
699 		break;
700 
701 	case CAN327_STATE_RECEIVING:
702 		/* Find <CR> delimiting feedback lines. */
703 		len = first_new_char_idx;
704 		while (len < elm->rxfill && elm->rxbuf[len] != '\r')
705 			len++;
706 
707 		if (len == CAN327_SIZE_RXBUF) {
708 			/* Assume the buffer ran full with garbage.
709 			 * Did we even connect at the right baud rate?
710 			 */
711 			netdev_err(elm->dev,
712 				   "RX buffer overflow. Faulty ELM327 or UART?\n");
713 			can327_uart_side_failure(elm);
714 		} else if (len == elm->rxfill) {
715 			if (can327_is_ready_char(elm->rxbuf[elm->rxfill - 1])) {
716 				/* The ELM327's AT ST response timeout ran out,
717 				 * so we got a prompt.
718 				 * Clear RX buffer and restart listening.
719 				 */
720 				elm->rxfill = 0;
721 
722 				can327_handle_prompt(elm);
723 			}
724 
725 			/* No <CR> found - we haven't received a full line yet.
726 			 * Wait for more data.
727 			 */
728 		} else {
729 			/* We have a full line to parse. */
730 			can327_parse_line(elm, len);
731 
732 			/* Remove parsed data from RX buffer. */
733 			can327_drop_bytes(elm, len + 1);
734 
735 			/* More data to parse? */
736 			if (elm->rxfill)
737 				can327_parse_rxbuf(elm, 0);
738 		}
739 	}
740 }
741 
742 static int can327_netdev_open(struct net_device *dev)
743 {
744 	struct can327 *elm = netdev_priv(dev);
745 	int err;
746 
747 	spin_lock_bh(&elm->lock);
748 
749 	if (!elm->tty) {
750 		spin_unlock_bh(&elm->lock);
751 		return -ENODEV;
752 	}
753 
754 	if (elm->uart_side_failure)
755 		netdev_warn(elm->dev,
756 			    "Reopening netdev after a UART side fault has been detected.\n");
757 
758 	/* Clear TTY buffers */
759 	elm->rxfill = 0;
760 	elm->txleft = 0;
761 
762 	/* open_candev() checks for elm->can.bittiming.bitrate != 0 */
763 	err = open_candev(dev);
764 	if (err) {
765 		spin_unlock_bh(&elm->lock);
766 		return err;
767 	}
768 
769 	can327_init_device(elm);
770 	spin_unlock_bh(&elm->lock);
771 
772 	err = can_rx_offload_add_manual(dev, &elm->offload, CAN327_NAPI_WEIGHT);
773 	if (err) {
774 		close_candev(dev);
775 		return err;
776 	}
777 
778 	can_rx_offload_enable(&elm->offload);
779 
780 	elm->can.state = CAN_STATE_ERROR_ACTIVE;
781 	netif_start_queue(dev);
782 
783 	return 0;
784 }
785 
786 static int can327_netdev_close(struct net_device *dev)
787 {
788 	struct can327 *elm = netdev_priv(dev);
789 
790 	/* Interrupt whatever the ELM327 is doing right now */
791 	spin_lock_bh(&elm->lock);
792 	can327_send(elm, CAN327_DUMMY_STRING, 1);
793 	spin_unlock_bh(&elm->lock);
794 
795 	netif_stop_queue(dev);
796 
797 	/* Give UART one final chance to flush. */
798 	clear_bit(TTY_DO_WRITE_WAKEUP, &elm->tty->flags);
799 	flush_work(&elm->tx_work);
800 
801 	can_rx_offload_disable(&elm->offload);
802 	elm->can.state = CAN_STATE_STOPPED;
803 	can_rx_offload_del(&elm->offload);
804 	close_candev(dev);
805 
806 	return 0;
807 }
808 
809 /* Send a can_frame to a TTY. */
810 static netdev_tx_t can327_netdev_start_xmit(struct sk_buff *skb,
811 					    struct net_device *dev)
812 {
813 	struct can327 *elm = netdev_priv(dev);
814 	struct can_frame *frame = (struct can_frame *)skb->data;
815 
816 	if (can_dropped_invalid_skb(dev, skb))
817 		return NETDEV_TX_OK;
818 
819 	/* We shouldn't get here after a hardware fault:
820 	 * can_bus_off() calls netif_carrier_off()
821 	 */
822 	if (elm->uart_side_failure) {
823 		WARN_ON_ONCE(elm->uart_side_failure);
824 		goto out;
825 	}
826 
827 	netif_stop_queue(dev);
828 
829 	/* BHs are already disabled, so no spin_lock_bh().
830 	 * See Documentation/networking/netdevices.rst
831 	 */
832 	spin_lock(&elm->lock);
833 	can327_send_frame(elm, frame);
834 	spin_unlock(&elm->lock);
835 
836 	dev->stats.tx_packets++;
837 	dev->stats.tx_bytes += frame->can_id & CAN_RTR_FLAG ? 0 : frame->len;
838 
839 	skb_tx_timestamp(skb);
840 
841 out:
842 	kfree_skb(skb);
843 	return NETDEV_TX_OK;
844 }
845 
846 static const struct net_device_ops can327_netdev_ops = {
847 	.ndo_open = can327_netdev_open,
848 	.ndo_stop = can327_netdev_close,
849 	.ndo_start_xmit = can327_netdev_start_xmit,
850 	.ndo_change_mtu = can_change_mtu,
851 };
852 
853 static const struct ethtool_ops can327_ethtool_ops = {
854 	.get_ts_info = ethtool_op_get_ts_info,
855 };
856 
857 static bool can327_is_valid_rx_char(u8 c)
858 {
859 	static const bool lut_char_is_valid['z'] = {
860 		['\r'] = true,
861 		[' '] = true,
862 		['.'] = true,
863 		['0'] = true, true, true, true, true,
864 		['5'] = true, true, true, true, true,
865 		['<'] = true,
866 		[CAN327_READY_CHAR] = true,
867 		['?'] = true,
868 		['A'] = true, true, true, true, true, true, true,
869 		['H'] = true, true, true, true, true, true, true,
870 		['O'] = true, true, true, true, true, true, true,
871 		['V'] = true, true, true, true, true,
872 		['a'] = true,
873 		['b'] = true,
874 		['v'] = true,
875 		[CAN327_DUMMY_CHAR] = true,
876 	};
877 	BUILD_BUG_ON(CAN327_DUMMY_CHAR >= 'z');
878 
879 	return (c < ARRAY_SIZE(lut_char_is_valid) && lut_char_is_valid[c]);
880 }
881 
882 /* Handle incoming ELM327 ASCII data.
883  * This will not be re-entered while running, but other ldisc
884  * functions may be called in parallel.
885  */
886 static void can327_ldisc_rx(struct tty_struct *tty, const unsigned char *cp,
887 			    const char *fp, int count)
888 {
889 	struct can327 *elm = (struct can327 *)tty->disc_data;
890 	size_t first_new_char_idx;
891 
892 	if (elm->uart_side_failure)
893 		return;
894 
895 	spin_lock_bh(&elm->lock);
896 
897 	/* Store old rxfill, so can327_parse_rxbuf() will have
898 	 * the option of skipping already checked characters.
899 	 */
900 	first_new_char_idx = elm->rxfill;
901 
902 	while (count-- && elm->rxfill < CAN327_SIZE_RXBUF) {
903 		if (fp && *fp++) {
904 			netdev_err(elm->dev,
905 				   "Error in received character stream. Check your wiring.");
906 
907 			can327_uart_side_failure(elm);
908 
909 			spin_unlock_bh(&elm->lock);
910 			return;
911 		}
912 
913 		/* Ignore NUL characters, which the PIC microcontroller may
914 		 * inadvertently insert due to a known hardware bug.
915 		 * See ELM327 documentation, which refers to a Microchip PIC
916 		 * bug description.
917 		 */
918 		if (*cp) {
919 			/* Check for stray characters on the UART line.
920 			 * Likely caused by bad hardware.
921 			 */
922 			if (!can327_is_valid_rx_char(*cp)) {
923 				netdev_err(elm->dev,
924 					   "Received illegal character %02x.\n",
925 					   *cp);
926 				can327_uart_side_failure(elm);
927 
928 				spin_unlock_bh(&elm->lock);
929 				return;
930 			}
931 
932 			elm->rxbuf[elm->rxfill++] = *cp;
933 		}
934 
935 		cp++;
936 	}
937 
938 	if (count >= 0) {
939 		netdev_err(elm->dev,
940 			   "Receive buffer overflowed. Bad chip or wiring? count = %i",
941 			   count);
942 
943 		can327_uart_side_failure(elm);
944 
945 		spin_unlock_bh(&elm->lock);
946 		return;
947 	}
948 
949 	can327_parse_rxbuf(elm, first_new_char_idx);
950 	spin_unlock_bh(&elm->lock);
951 }
952 
953 /* Write out remaining transmit buffer.
954  * Scheduled when TTY is writable.
955  */
956 static void can327_ldisc_tx_worker(struct work_struct *work)
957 {
958 	struct can327 *elm = container_of(work, struct can327, tx_work);
959 	ssize_t written;
960 
961 	if (elm->uart_side_failure)
962 		return;
963 
964 	spin_lock_bh(&elm->lock);
965 
966 	if (elm->txleft) {
967 		written = elm->tty->ops->write(elm->tty, elm->txhead,
968 					       elm->txleft);
969 		if (written < 0) {
970 			netdev_err(elm->dev, "Failed to write to tty %s.\n",
971 				   elm->tty->name);
972 			can327_uart_side_failure(elm);
973 
974 			spin_unlock_bh(&elm->lock);
975 			return;
976 		}
977 
978 		elm->txleft -= written;
979 		elm->txhead += written;
980 	}
981 
982 	if (!elm->txleft)
983 		clear_bit(TTY_DO_WRITE_WAKEUP, &elm->tty->flags);
984 
985 	spin_unlock_bh(&elm->lock);
986 }
987 
988 /* Called by the driver when there's room for more data. */
989 static void can327_ldisc_tx_wakeup(struct tty_struct *tty)
990 {
991 	struct can327 *elm = (struct can327 *)tty->disc_data;
992 
993 	schedule_work(&elm->tx_work);
994 }
995 
996 /* ELM327 can only handle bitrates that are integer divisors of 500 kHz,
997  * or 7/8 of that. Divisors are 1 to 64.
998  * Currently we don't implement support for 7/8 rates.
999  */
1000 static const u32 can327_bitrate_const[] = {
1001 	7812,  7936,  8064,  8196,   8333,   8474,   8620,   8771,
1002 	8928,  9090,  9259,  9433,   9615,   9803,   10000,  10204,
1003 	10416, 10638, 10869, 11111,  11363,  11627,  11904,  12195,
1004 	12500, 12820, 13157, 13513,  13888,  14285,  14705,  15151,
1005 	15625, 16129, 16666, 17241,  17857,  18518,  19230,  20000,
1006 	20833, 21739, 22727, 23809,  25000,  26315,  27777,  29411,
1007 	31250, 33333, 35714, 38461,  41666,  45454,  50000,  55555,
1008 	62500, 71428, 83333, 100000, 125000, 166666, 250000, 500000
1009 };
1010 
1011 static int can327_ldisc_open(struct tty_struct *tty)
1012 {
1013 	struct net_device *dev;
1014 	struct can327 *elm;
1015 	int err;
1016 
1017 	if (!capable(CAP_NET_ADMIN))
1018 		return -EPERM;
1019 
1020 	if (!tty->ops->write)
1021 		return -EOPNOTSUPP;
1022 
1023 	dev = alloc_candev(sizeof(struct can327), 0);
1024 	if (!dev)
1025 		return -ENFILE;
1026 	elm = netdev_priv(dev);
1027 
1028 	/* Configure TTY interface */
1029 	tty->receive_room = 65536; /* We don't flow control */
1030 	spin_lock_init(&elm->lock);
1031 	INIT_WORK(&elm->tx_work, can327_ldisc_tx_worker);
1032 
1033 	/* Configure CAN metadata */
1034 	elm->can.bitrate_const = can327_bitrate_const;
1035 	elm->can.bitrate_const_cnt = ARRAY_SIZE(can327_bitrate_const);
1036 	elm->can.ctrlmode_supported = CAN_CTRLMODE_LISTENONLY;
1037 
1038 	/* Configure netdev interface */
1039 	elm->dev = dev;
1040 	dev->netdev_ops = &can327_netdev_ops;
1041 	dev->ethtool_ops = &can327_ethtool_ops;
1042 
1043 	/* Mark ldisc channel as alive */
1044 	elm->tty = tty;
1045 	tty->disc_data = elm;
1046 
1047 	/* Let 'er rip */
1048 	err = register_candev(elm->dev);
1049 	if (err) {
1050 		free_candev(elm->dev);
1051 		return err;
1052 	}
1053 
1054 	netdev_info(elm->dev, "can327 on %s.\n", tty->name);
1055 
1056 	return 0;
1057 }
1058 
1059 /* Close down a can327 channel.
1060  * This means flushing out any pending queues, and then returning.
1061  * This call is serialized against other ldisc functions:
1062  * Once this is called, no other ldisc function of ours is entered.
1063  *
1064  * We also use this function for a hangup event.
1065  */
1066 static void can327_ldisc_close(struct tty_struct *tty)
1067 {
1068 	struct can327 *elm = (struct can327 *)tty->disc_data;
1069 
1070 	/* unregister_netdev() calls .ndo_stop() so we don't have to.
1071 	 * Our .ndo_stop() also flushes the TTY write wakeup handler,
1072 	 * so we can safely set elm->tty = NULL after this.
1073 	 */
1074 	unregister_candev(elm->dev);
1075 
1076 	/* Mark channel as dead */
1077 	spin_lock_bh(&elm->lock);
1078 	tty->disc_data = NULL;
1079 	elm->tty = NULL;
1080 	spin_unlock_bh(&elm->lock);
1081 
1082 	netdev_info(elm->dev, "can327 off %s.\n", tty->name);
1083 
1084 	free_candev(elm->dev);
1085 }
1086 
1087 static int can327_ldisc_ioctl(struct tty_struct *tty, unsigned int cmd,
1088 			      unsigned long arg)
1089 {
1090 	struct can327 *elm = (struct can327 *)tty->disc_data;
1091 	unsigned int tmp;
1092 
1093 	switch (cmd) {
1094 	case SIOCGIFNAME:
1095 		tmp = strnlen(elm->dev->name, IFNAMSIZ - 1) + 1;
1096 		if (copy_to_user((void __user *)arg, elm->dev->name, tmp))
1097 			return -EFAULT;
1098 		return 0;
1099 
1100 	case SIOCSIFHWADDR:
1101 		return -EINVAL;
1102 
1103 	default:
1104 		return tty_mode_ioctl(tty, cmd, arg);
1105 	}
1106 }
1107 
1108 static struct tty_ldisc_ops can327_ldisc = {
1109 	.owner = THIS_MODULE,
1110 	.name = KBUILD_MODNAME,
1111 	.num = N_CAN327,
1112 	.receive_buf = can327_ldisc_rx,
1113 	.write_wakeup = can327_ldisc_tx_wakeup,
1114 	.open = can327_ldisc_open,
1115 	.close = can327_ldisc_close,
1116 	.ioctl = can327_ldisc_ioctl,
1117 };
1118 
1119 static int __init can327_init(void)
1120 {
1121 	int status;
1122 
1123 	status = tty_register_ldisc(&can327_ldisc);
1124 	if (status)
1125 		pr_err("Can't register line discipline\n");
1126 
1127 	return status;
1128 }
1129 
1130 static void __exit can327_exit(void)
1131 {
1132 	/* This will only be called when all channels have been closed by
1133 	 * userspace - tty_ldisc.c takes care of the module's refcount.
1134 	 */
1135 	tty_unregister_ldisc(&can327_ldisc);
1136 }
1137 
1138 module_init(can327_init);
1139 module_exit(can327_exit);
1140 
1141 MODULE_ALIAS_LDISC(N_CAN327);
1142 MODULE_DESCRIPTION("ELM327 based CAN interface");
1143 MODULE_LICENSE("GPL");
1144 MODULE_AUTHOR("Max Staudt <max@enpas.org>");
1145