1 ============================================================================
5 Readme file for the Controller Area Network Protocol Family (aka Socket CAN)
9 1 Overview / What is Socket CAN
11 2 Motivation / Why using the socket API
15 3.2 local loopback of sent frames
16 3.3 network security issues (capabilities)
17 3.4 network problem notifications
19 4 How to use Socket CAN
20 4.1 RAW protocol sockets with can_filters (SOCK_RAW)
21 4.1.1 RAW socket option CAN_RAW_FILTER
22 4.1.2 RAW socket option CAN_RAW_ERR_FILTER
23 4.1.3 RAW socket option CAN_RAW_LOOPBACK
24 4.1.4 RAW socket option CAN_RAW_RECV_OWN_MSGS
25 4.2 Broadcast Manager protocol sockets (SOCK_DGRAM)
26 4.3 connected transport protocols (SOCK_SEQPACKET)
27 4.4 unconnected transport protocols (SOCK_DGRAM)
29 5 Socket CAN core module
30 5.1 can.ko module params
32 5.3 writing own CAN protocol modules
36 6.2 local loopback of sent frames
37 6.3 CAN controller hardware filters
38 6.4 currently supported CAN hardware
43 ============================================================================
45 1. Overview / What is Socket CAN
46 --------------------------------
48 The socketcan package is an implementation of CAN protocols
49 (Controller Area Network) for Linux. CAN is a networking technology
50 which has widespread use in automation, embedded devices, and
51 automotive fields. While there have been other CAN implementations
52 for Linux based on character devices, Socket CAN uses the Berkeley
53 socket API, the Linux network stack and implements the CAN device
54 drivers as network interfaces. The CAN socket API has been designed
55 as similar as possible to the TCP/IP protocols to allow programmers,
56 familiar with network programming, to easily learn how to use CAN
59 2. Motivation / Why using the socket API
60 ----------------------------------------
62 There have been CAN implementations for Linux before Socket CAN so the
63 question arises, why we have started another project. Most existing
64 implementations come as a device driver for some CAN hardware, they
65 are based on character devices and provide comparatively little
66 functionality. Usually, there is only a hardware-specific device
67 driver which provides a character device interface to send and
68 receive raw CAN frames, directly to/from the controller hardware.
69 Queueing of frames and higher-level transport protocols like ISO-TP
70 have to be implemented in user space applications. Also, most
71 character-device implementations support only one single process to
72 open the device at a time, similar to a serial interface. Exchanging
73 the CAN controller requires employment of another device driver and
74 often the need for adaption of large parts of the application to the
77 Socket CAN was designed to overcome all of these limitations. A new
78 protocol family has been implemented which provides a socket interface
79 to user space applications and which builds upon the Linux network
80 layer, so to use all of the provided queueing functionality. A device
81 driver for CAN controller hardware registers itself with the Linux
82 network layer as a network device, so that CAN frames from the
83 controller can be passed up to the network layer and on to the CAN
84 protocol family module and also vice-versa. Also, the protocol family
85 module provides an API for transport protocol modules to register, so
86 that any number of transport protocols can be loaded or unloaded
87 dynamically. In fact, the can core module alone does not provide any
88 protocol and cannot be used without loading at least one additional
89 protocol module. Multiple sockets can be opened at the same time,
90 on different or the same protocol module and they can listen/send
91 frames on different or the same CAN IDs. Several sockets listening on
92 the same interface for frames with the same CAN ID are all passed the
93 same received matching CAN frames. An application wishing to
94 communicate using a specific transport protocol, e.g. ISO-TP, just
95 selects that protocol when opening the socket, and then can read and
96 write application data byte streams, without having to deal with
99 Similar functionality visible from user-space could be provided by a
100 character device, too, but this would lead to a technically inelegant
101 solution for a couple of reasons:
103 * Intricate usage. Instead of passing a protocol argument to
104 socket(2) and using bind(2) to select a CAN interface and CAN ID, an
105 application would have to do all these operations using ioctl(2)s.
107 * Code duplication. A character device cannot make use of the Linux
108 network queueing code, so all that code would have to be duplicated
111 * Abstraction. In most existing character-device implementations, the
112 hardware-specific device driver for a CAN controller directly
113 provides the character device for the application to work with.
114 This is at least very unusual in Unix systems for both, char and
115 block devices. For example you don't have a character device for a
116 certain UART of a serial interface, a certain sound chip in your
117 computer, a SCSI or IDE controller providing access to your hard
118 disk or tape streamer device. Instead, you have abstraction layers
119 which provide a unified character or block device interface to the
120 application on the one hand, and a interface for hardware-specific
121 device drivers on the other hand. These abstractions are provided
122 by subsystems like the tty layer, the audio subsystem or the SCSI
123 and IDE subsystems for the devices mentioned above.
125 The easiest way to implement a CAN device driver is as a character
126 device without such a (complete) abstraction layer, as is done by most
127 existing drivers. The right way, however, would be to add such a
128 layer with all the functionality like registering for certain CAN
129 IDs, supporting several open file descriptors and (de)multiplexing
130 CAN frames between them, (sophisticated) queueing of CAN frames, and
131 providing an API for device drivers to register with. However, then
132 it would be no more difficult, or may be even easier, to use the
133 networking framework provided by the Linux kernel, and this is what
136 The use of the networking framework of the Linux kernel is just the
137 natural and most appropriate way to implement CAN for Linux.
139 3. Socket CAN concept
140 ---------------------
142 As described in chapter 2 it is the main goal of Socket CAN to
143 provide a socket interface to user space applications which builds
144 upon the Linux network layer. In contrast to the commonly known
145 TCP/IP and ethernet networking, the CAN bus is a broadcast-only(!)
146 medium that has no MAC-layer addressing like ethernet. The CAN-identifier
147 (can_id) is used for arbitration on the CAN-bus. Therefore the CAN-IDs
148 have to be chosen uniquely on the bus. When designing a CAN-ECU
149 network the CAN-IDs are mapped to be sent by a specific ECU.
150 For this reason a CAN-ID can be treated best as a kind of source address.
154 The network transparent access of multiple applications leads to the
155 problem that different applications may be interested in the same
156 CAN-IDs from the same CAN network interface. The Socket CAN core
157 module - which implements the protocol family CAN - provides several
158 high efficient receive lists for this reason. If e.g. a user space
159 application opens a CAN RAW socket, the raw protocol module itself
160 requests the (range of) CAN-IDs from the Socket CAN core that are
161 requested by the user. The subscription and unsubscription of
162 CAN-IDs can be done for specific CAN interfaces or for all(!) known
163 CAN interfaces with the can_rx_(un)register() functions provided to
164 CAN protocol modules by the SocketCAN core (see chapter 5).
165 To optimize the CPU usage at runtime the receive lists are split up
166 into several specific lists per device that match the requested
167 filter complexity for a given use-case.
169 3.2 local loopback of sent frames
171 As known from other networking concepts the data exchanging
172 applications may run on the same or different nodes without any
173 change (except for the according addressing information):
175 ___ ___ ___ _______ ___
176 | _ | | _ | | _ | | _ _ | | _ |
177 ||A|| ||B|| ||C|| ||A| |B|| ||C||
178 |___| |___| |___| |_______| |___|
180 -----------------(1)- CAN bus -(2)---------------
182 To ensure that application A receives the same information in the
183 example (2) as it would receive in example (1) there is need for
184 some kind of local loopback of the sent CAN frames on the appropriate
187 The Linux network devices (by default) just can handle the
188 transmission and reception of media dependent frames. Due to the
189 arbritration on the CAN bus the transmission of a low prio CAN-ID
190 may be delayed by the reception of a high prio CAN frame. To
191 reflect the correct* traffic on the node the loopback of the sent
192 data has to be performed right after a successful transmission. If
193 the CAN network interface is not capable of performing the loopback for
194 some reason the SocketCAN core can do this task as a fallback solution.
195 See chapter 6.2 for details (recommended).
197 The loopback functionality is enabled by default to reflect standard
198 networking behaviour for CAN applications. Due to some requests from
199 the RT-SocketCAN group the loopback optionally may be disabled for each
200 separate socket. See sockopts from the CAN RAW sockets in chapter 4.1.
202 * = you really like to have this when you're running analyser tools
203 like 'candump' or 'cansniffer' on the (same) node.
205 3.3 network security issues (capabilities)
207 The Controller Area Network is a local field bus transmitting only
208 broadcast messages without any routing and security concepts.
209 In the majority of cases the user application has to deal with
210 raw CAN frames. Therefore it might be reasonable NOT to restrict
211 the CAN access only to the user root, as known from other networks.
212 Since the currently implemented CAN_RAW and CAN_BCM sockets can only
213 send and receive frames to/from CAN interfaces it does not affect
214 security of others networks to allow all users to access the CAN.
215 To enable non-root users to access CAN_RAW and CAN_BCM protocol
216 sockets the Kconfig options CAN_RAW_USER and/or CAN_BCM_USER may be
217 selected at kernel compile time.
219 3.4 network problem notifications
221 The use of the CAN bus may lead to several problems on the physical
222 and media access control layer. Detecting and logging of these lower
223 layer problems is a vital requirement for CAN users to identify
224 hardware issues on the physical transceiver layer as well as
225 arbitration problems and error frames caused by the different
226 ECUs. The occurrence of detected errors are important for diagnosis
227 and have to be logged together with the exact timestamp. For this
228 reason the CAN interface driver can generate so called Error Frames
229 that can optionally be passed to the user application in the same
230 way as other CAN frames. Whenever an error on the physical layer
231 or the MAC layer is detected (e.g. by the CAN controller) the driver
232 creates an appropriate error frame. Error frames can be requested by
233 the user application using the common CAN filter mechanisms. Inside
234 this filter definition the (interested) type of errors may be
235 selected. The reception of error frames is disabled by default.
237 4. How to use Socket CAN
238 ------------------------
240 Like TCP/IP, you first need to open a socket for communicating over a
241 CAN network. Since Socket CAN implements a new protocol family, you
242 need to pass PF_CAN as the first argument to the socket(2) system
243 call. Currently, there are two CAN protocols to choose from, the raw
244 socket protocol and the broadcast manager (BCM). So to open a socket,
247 s = socket(PF_CAN, SOCK_RAW, CAN_RAW);
251 s = socket(PF_CAN, SOCK_DGRAM, CAN_BCM);
253 respectively. After the successful creation of the socket, you would
254 normally use the bind(2) system call to bind the socket to a CAN
255 interface (which is different from TCP/IP due to different addressing
256 - see chapter 3). After binding (CAN_RAW) or connecting (CAN_BCM)
257 the socket, you can read(2) and write(2) from/to the socket or use
258 send(2), sendto(2), sendmsg(2) and the recv* counterpart operations
259 on the socket as usual. There are also CAN specific socket options
262 The basic CAN frame structure and the sockaddr structure are defined
263 in include/linux/can.h:
266 canid_t can_id; /* 32 bit CAN_ID + EFF/RTR/ERR flags */
267 __u8 can_dlc; /* data length code: 0 .. 8 */
268 __u8 data[8] __attribute__((aligned(8)));
271 The alignment of the (linear) payload data[] to a 64bit boundary
272 allows the user to define own structs and unions to easily access the
273 CAN payload. There is no given byteorder on the CAN bus by
274 default. A read(2) system call on a CAN_RAW socket transfers a
275 struct can_frame to the user space.
277 The sockaddr_can structure has an interface index like the
278 PF_PACKET socket, that also binds to a specific interface:
280 struct sockaddr_can {
281 sa_family_t can_family;
284 /* transport protocol class address info (e.g. ISOTP) */
285 struct { canid_t rx_id, tx_id; } tp;
287 /* reserved for future CAN protocols address information */
291 To determine the interface index an appropriate ioctl() has to
292 be used (example for CAN_RAW sockets without error checking):
295 struct sockaddr_can addr;
298 s = socket(PF_CAN, SOCK_RAW, CAN_RAW);
300 strcpy(ifr.ifr_name, "can0" );
301 ioctl(s, SIOCGIFINDEX, &ifr);
303 addr.can_family = AF_CAN;
304 addr.can_ifindex = ifr.ifr_ifindex;
306 bind(s, (struct sockaddr *)&addr, sizeof(addr));
310 To bind a socket to all(!) CAN interfaces the interface index must
311 be 0 (zero). In this case the socket receives CAN frames from every
312 enabled CAN interface. To determine the originating CAN interface
313 the system call recvfrom(2) may be used instead of read(2). To send
314 on a socket that is bound to 'any' interface sendto(2) is needed to
315 specify the outgoing interface.
317 Reading CAN frames from a bound CAN_RAW socket (see above) consists
318 of reading a struct can_frame:
320 struct can_frame frame;
322 nbytes = read(s, &frame, sizeof(struct can_frame));
325 perror("can raw socket read");
329 /* paraniod check ... */
330 if (nbytes < sizeof(struct can_frame)) {
331 fprintf(stderr, "read: incomplete CAN frame\n");
335 /* do something with the received CAN frame */
337 Writing CAN frames can be done similarly, with the write(2) system call:
339 nbytes = write(s, &frame, sizeof(struct can_frame));
341 When the CAN interface is bound to 'any' existing CAN interface
342 (addr.can_ifindex = 0) it is recommended to use recvfrom(2) if the
343 information about the originating CAN interface is needed:
345 struct sockaddr_can addr;
347 socklen_t len = sizeof(addr);
348 struct can_frame frame;
350 nbytes = recvfrom(s, &frame, sizeof(struct can_frame),
351 0, (struct sockaddr*)&addr, &len);
353 /* get interface name of the received CAN frame */
354 ifr.ifr_ifindex = addr.can_ifindex;
355 ioctl(s, SIOCGIFNAME, &ifr);
356 printf("Received a CAN frame from interface %s", ifr.ifr_name);
358 To write CAN frames on sockets bound to 'any' CAN interface the
359 outgoing interface has to be defined certainly.
361 strcpy(ifr.ifr_name, "can0");
362 ioctl(s, SIOCGIFINDEX, &ifr);
363 addr.can_ifindex = ifr.ifr_ifindex;
364 addr.can_family = AF_CAN;
366 nbytes = sendto(s, &frame, sizeof(struct can_frame),
367 0, (struct sockaddr*)&addr, sizeof(addr));
369 4.1 RAW protocol sockets with can_filters (SOCK_RAW)
371 Using CAN_RAW sockets is extensively comparable to the commonly
372 known access to CAN character devices. To meet the new possibilities
373 provided by the multi user SocketCAN approach, some reasonable
374 defaults are set at RAW socket binding time:
376 - The filters are set to exactly one filter receiving everything
377 - The socket only receives valid data frames (=> no error frames)
378 - The loopback of sent CAN frames is enabled (see chapter 3.2)
379 - The socket does not receive its own sent frames (in loopback mode)
381 These default settings may be changed before or after binding the socket.
382 To use the referenced definitions of the socket options for CAN_RAW
383 sockets, include <linux/can/raw.h>.
385 4.1.1 RAW socket option CAN_RAW_FILTER
387 The reception of CAN frames using CAN_RAW sockets can be controlled
388 by defining 0 .. n filters with the CAN_RAW_FILTER socket option.
390 The CAN filter structure is defined in include/linux/can.h:
397 A filter matches, when
399 <received_can_id> & mask == can_id & mask
401 which is analogous to known CAN controllers hardware filter semantics.
402 The filter can be inverted in this semantic, when the CAN_INV_FILTER
403 bit is set in can_id element of the can_filter structure. In
404 contrast to CAN controller hardware filters the user may set 0 .. n
405 receive filters for each open socket separately:
407 struct can_filter rfilter[2];
409 rfilter[0].can_id = 0x123;
410 rfilter[0].can_mask = CAN_SFF_MASK;
411 rfilter[1].can_id = 0x200;
412 rfilter[1].can_mask = 0x700;
414 setsockopt(s, SOL_CAN_RAW, CAN_RAW_FILTER, &rfilter, sizeof(rfilter));
416 To disable the reception of CAN frames on the selected CAN_RAW socket:
418 setsockopt(s, SOL_CAN_RAW, CAN_RAW_FILTER, NULL, 0);
420 To set the filters to zero filters is quite obsolete as not read
421 data causes the raw socket to discard the received CAN frames. But
422 having this 'send only' use-case we may remove the receive list in the
423 Kernel to save a little (really a very little!) CPU usage.
425 4.1.2 RAW socket option CAN_RAW_ERR_FILTER
427 As described in chapter 3.4 the CAN interface driver can generate so
428 called Error Frames that can optionally be passed to the user
429 application in the same way as other CAN frames. The possible
430 errors are divided into different error classes that may be filtered
431 using the appropriate error mask. To register for every possible
432 error condition CAN_ERR_MASK can be used as value for the error mask.
433 The values for the error mask are defined in linux/can/error.h .
435 can_err_mask_t err_mask = ( CAN_ERR_TX_TIMEOUT | CAN_ERR_BUSOFF );
437 setsockopt(s, SOL_CAN_RAW, CAN_RAW_ERR_FILTER,
438 &err_mask, sizeof(err_mask));
440 4.1.3 RAW socket option CAN_RAW_LOOPBACK
442 To meet multi user needs the local loopback is enabled by default
443 (see chapter 3.2 for details). But in some embedded use-cases
444 (e.g. when only one application uses the CAN bus) this loopback
445 functionality can be disabled (separately for each socket):
447 int loopback = 0; /* 0 = disabled, 1 = enabled (default) */
449 setsockopt(s, SOL_CAN_RAW, CAN_RAW_LOOPBACK, &loopback, sizeof(loopback));
451 4.1.4 RAW socket option CAN_RAW_RECV_OWN_MSGS
453 When the local loopback is enabled, all the sent CAN frames are
454 looped back to the open CAN sockets that registered for the CAN
455 frames' CAN-ID on this given interface to meet the multi user
456 needs. The reception of the CAN frames on the same socket that was
457 sending the CAN frame is assumed to be unwanted and therefore
458 disabled by default. This default behaviour may be changed on
461 int recv_own_msgs = 1; /* 0 = disabled (default), 1 = enabled */
463 setsockopt(s, SOL_CAN_RAW, CAN_RAW_RECV_OWN_MSGS,
464 &recv_own_msgs, sizeof(recv_own_msgs));
466 4.2 Broadcast Manager protocol sockets (SOCK_DGRAM)
467 4.3 connected transport protocols (SOCK_SEQPACKET)
468 4.4 unconnected transport protocols (SOCK_DGRAM)
471 5. Socket CAN core module
472 -------------------------
474 The Socket CAN core module implements the protocol family
475 PF_CAN. CAN protocol modules are loaded by the core module at
476 runtime. The core module provides an interface for CAN protocol
477 modules to subscribe needed CAN IDs (see chapter 3.1).
479 5.1 can.ko module params
481 - stats_timer: To calculate the Socket CAN core statistics
482 (e.g. current/maximum frames per second) this 1 second timer is
483 invoked at can.ko module start time by default. This timer can be
484 disabled by using stattimer=0 on the module comandline.
486 - debug: (removed since SocketCAN SVN r546)
490 As described in chapter 3.1 the Socket CAN core uses several filter
491 lists to deliver received CAN frames to CAN protocol modules. These
492 receive lists, their filters and the count of filter matches can be
493 checked in the appropriate receive list. All entries contain the
494 device and a protocol module identifier:
496 foo@bar:~$ cat /proc/net/can/rcvlist_all
498 receive list 'rx_all':
502 device can_id can_mask function userdata matches ident
503 vcan0 000 00000000 f88e6370 f6c6f400 0 raw
506 In this example an application requests any CAN traffic from vcan0.
508 rcvlist_all - list for unfiltered entries (no filter operations)
509 rcvlist_eff - list for single extended frame (EFF) entries
510 rcvlist_err - list for error frames masks
511 rcvlist_fil - list for mask/value filters
512 rcvlist_inv - list for mask/value filters (inverse semantic)
513 rcvlist_sff - list for single standard frame (SFF) entries
515 Additional procfs files in /proc/net/can
517 stats - Socket CAN core statistics (rx/tx frames, match ratios, ...)
518 reset_stats - manual statistic reset
519 version - prints the Socket CAN core version and the ABI version
521 5.3 writing own CAN protocol modules
523 To implement a new protocol in the protocol family PF_CAN a new
524 protocol has to be defined in include/linux/can.h .
525 The prototypes and definitions to use the Socket CAN core can be
526 accessed by including include/linux/can/core.h .
527 In addition to functions that register the CAN protocol and the
528 CAN device notifier chain there are functions to subscribe CAN
529 frames received by CAN interfaces and to send CAN frames:
531 can_rx_register - subscribe CAN frames from a specific interface
532 can_rx_unregister - unsubscribe CAN frames from a specific interface
533 can_send - transmit a CAN frame (optional with local loopback)
535 For details see the kerneldoc documentation in net/can/af_can.c or
536 the source code of net/can/raw.c or net/can/bcm.c .
538 6. CAN network drivers
539 ----------------------
541 Writing a CAN network device driver is much easier than writing a
542 CAN character device driver. Similar to other known network device
543 drivers you mainly have to deal with:
545 - TX: Put the CAN frame from the socket buffer to the CAN controller.
546 - RX: Put the CAN frame from the CAN controller to the socket buffer.
548 See e.g. at Documentation/networking/netdevices.txt . The differences
549 for writing CAN network device driver are described below:
553 dev->type = ARPHRD_CAN; /* the netdevice hardware type */
554 dev->flags = IFF_NOARP; /* CAN has no arp */
556 dev->mtu = sizeof(struct can_frame);
558 The struct can_frame is the payload of each socket buffer in the
559 protocol family PF_CAN.
561 6.2 local loopback of sent frames
563 As described in chapter 3.2 the CAN network device driver should
564 support a local loopback functionality similar to the local echo
565 e.g. of tty devices. In this case the driver flag IFF_ECHO has to be
566 set to prevent the PF_CAN core from locally echoing sent frames
567 (aka loopback) as fallback solution:
569 dev->flags = (IFF_NOARP | IFF_ECHO);
571 6.3 CAN controller hardware filters
573 To reduce the interrupt load on deep embedded systems some CAN
574 controllers support the filtering of CAN IDs or ranges of CAN IDs.
575 These hardware filter capabilities vary from controller to
576 controller and have to be identified as not feasible in a multi-user
577 networking approach. The use of the very controller specific
578 hardware filters could make sense in a very dedicated use-case, as a
579 filter on driver level would affect all users in the multi-user
580 system. The high efficient filter sets inside the PF_CAN core allow
581 to set different multiple filters for each socket separately.
582 Therefore the use of hardware filters goes to the category 'handmade
583 tuning on deep embedded systems'. The author is running a MPC603e
584 @133MHz with four SJA1000 CAN controllers from 2002 under heavy bus
585 load without any problems ...
587 6.4 currently supported CAN hardware (September 2007)
589 On the project website http://developer.berlios.de/projects/socketcan
590 there are different drivers available:
592 vcan: Virtual CAN interface driver (if no real hardware is available)
593 sja1000: Philips SJA1000 CAN controller (recommended)
594 i82527: Intel i82527 CAN controller
595 mscan: Motorola/Freescale CAN controller (e.g. inside SOC MPC5200)
596 ccan: CCAN controller core (e.g. inside SOC h7202)
597 slcan: For a bunch of CAN adaptors that are attached via a
598 serial line ASCII protocol (for serial / USB adaptors)
600 Additionally the different CAN adaptors (ISA/PCI/PCMCIA/USB/Parport)
601 from PEAK Systemtechnik support the CAN netdevice driver model
602 since Linux driver v6.0: http://www.peak-system.com/linux/index.htm
604 Please check the Mailing Lists on the berlios OSS project website.
606 6.5 todo (September 2007)
608 The configuration interface for CAN network drivers is still an open
609 issue that has not been finalized in the socketcan project. Also the
610 idea of having a library module (candev.ko) that holds functions
611 that are needed by all CAN netdevices is not ready to ship.
612 Your contribution is welcome.
617 Oliver Hartkopp (PF_CAN core, filters, drivers, bcm)
618 Urs Thuermann (PF_CAN core, kernel integration, socket interfaces, raw, vcan)
619 Jan Kizka (RT-SocketCAN core, Socket-API reconciliation)
620 Wolfgang Grandegger (RT-SocketCAN core & drivers, Raw Socket-API reviews)
621 Robert Schwebel (design reviews, PTXdist integration)
622 Marc Kleine-Budde (design reviews, Kernel 2.6 cleanups, drivers)
623 Benedikt Spranger (reviews)
624 Thomas Gleixner (LKML reviews, coding style, posting hints)
625 Andrey Volkov (kernel subtree structure, ioctls, mscan driver)
626 Matthias Brukner (first SJA1000 CAN netdevice implementation Q2/2003)
627 Klaus Hitschler (PEAK driver integration)
628 Uwe Koppe (CAN netdevices with PF_PACKET approach)
629 Michael Schulze (driver layer loopback requirement, RT CAN drivers review)