Merge pull request #4821 from RichardWGNR/issue-4816

embassy-stm32: Automatic FDCAN bus off recovery

3 files changed, 25 insertions, 4 deletions

diff --git a/embassy-stm32/CHANGELOG.md b/embassy-stm32/CHANGELOG.md
index 99808c233..4e55e1034 100644
--- a/embassy-stm32/CHANGELOG.md
+++ b/embassy-stm32/CHANGELOG.md
@@ -38,6 +38,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - change: timer: added output compare values
 - feat: timer: add ability to set master mode
 - fix: usart: fix race condition in ringbuffered usart
+- feat: stm32/fdcan: add ability to control automatic recovery from bus off ([#4821](https://github.com/embassy-rs/embassy/pull/4821))
 
 ## 0.4.0 - 2025-08-26
 
diff --git a/embassy-stm32/src/can/fd/config.rs b/embassy-stm32/src/can/fd/config.rs
index e08349f02..4fe634ce4 100644
--- a/embassy-stm32/src/can/fd/config.rs
+++ b/embassy-stm32/src/can/fd/config.rs
@@ -360,6 +360,8 @@ pub struct FdCanConfig {
     pub global_filter: GlobalFilter,
     /// TX buffer mode (FIFO or priority queue)
     pub tx_buffer_mode: TxBufferMode,
+    /// Automatic recovery from bus off state
+    pub automatic_bus_off_recovery: bool,
 }
 
 impl FdCanConfig {
@@ -456,6 +458,16 @@ impl FdCanConfig {
         self.tx_buffer_mode = txbm;
         self
     }
+
+    /// Enables or disables automatic recovery from bus off state
+    ///
+    /// Automatic recovery is performed by clearing the INIT bit in the CCCR register if
+    /// the BO bit is active in the IR register in the IT0 interrupt.
+    #[inline]
+    pub const fn set_automatic_bus_off_recovery(mut self, enabled: bool) -> Self {
+        self.automatic_bus_off_recovery = enabled;
+        self
+    }
 }
 
 impl Default for FdCanConfig {
@@ -474,6 +486,7 @@ impl Default for FdCanConfig {
             timestamp_source: TimestampSource::None,
             global_filter: GlobalFilter::default(),
             tx_buffer_mode: TxBufferMode::Priority,
+            automatic_bus_off_recovery: true,
         }
     }
 }
diff --git a/embassy-stm32/src/can/fdcan.rs b/embassy-stm32/src/can/fdcan.rs
index a142a6d63..9883aff57 100644
--- a/embassy-stm32/src/can/fdcan.rs
+++ b/embassy-stm32/src/can/fdcan.rs
@@ -53,7 +53,7 @@ impl<T: Instance> interrupt::typelevel::Handler<T::IT0Interrupt> for IT0Interrup
             regs.ir().write(|w| w.set_tefn(true));
         }
 
-        T::info().state.lock(|s| {
+        let recover_from_bo = T::info().state.lock(|s| {
             let state = s.borrow_mut();
             match &state.tx_mode {
                 TxMode::NonBuffered(waker) => waker.wake(),
@@ -85,11 +85,15 @@ impl<T: Instance> interrupt::typelevel::Handler<T::IT0Interrupt> for IT0Interrup
             if ir.rfn(1) {
                 state.rx_mode.on_interrupt::<T>(1, state.ns_per_timer_tick);
             }
+
+            state.automatic_bus_off_recovery
         });
 
         if ir.bo() {
             regs.ir().write(|w| w.set_bo(true));
-            if regs.psr().read().bo() {
+            if let Some(true) = recover_from_bo
+                && regs.psr().read().bo()
+            {
                 // Initiate bus-off recovery sequence by resetting CCCR.INIT
                 regs.cccr().modify(|w| w.set_init(false));
             }
@@ -263,7 +267,9 @@ impl<'d> CanConfigurator<'d> {
     pub fn start(self, mode: OperatingMode) -> Can<'d> {
         let ns_per_timer_tick = calc_ns_per_timer_tick(&self.info, self.periph_clock, self.config.frame_transmit);
         self.info.state.lock(|s| {
-            s.borrow_mut().ns_per_timer_tick = ns_per_timer_tick;
+            let mut state = s.borrow_mut();
+            state.ns_per_timer_tick = ns_per_timer_tick;
+            state.automatic_bus_off_recovery = Some(self.config.automatic_bus_off_recovery);
         });
         self.info.regs.into_mode(self.config, mode);
         Can {
@@ -861,7 +867,7 @@ struct State {
     sender_instance_count: usize,
     tx_pin_port: Option<u8>,
     rx_pin_port: Option<u8>,
-
+    automatic_bus_off_recovery: Option<bool>, // controlled by CanConfigurator::start()
     pub err_waker: AtomicWaker,
 }
 
@@ -876,6 +882,7 @@ impl State {
             sender_instance_count: 0,
             tx_pin_port: None,
             rx_pin_port: None,
+            automatic_bus_off_recovery: None,
         }
     }
 }