Subject: [PATCH v5 0/3] w1: add UART w1 bus driver

Hello!

This patch contains a driver for a 1-Wire bus over UART. The driver
utilizes the UART interface via the Serial Device Bus to create the
1-Wire timing patterns.

Changes in v5:
- dt-binding: allow child object for onewire and use prefix -bps for
baud rate configuration.
- use type u8 for a byte, instead of unsigned char
- use constants (NSEC_PER_SEC, BITS_PER_BYTE)
- make delay computation from packet time more coherent
- Link to v4: https://lore.kernel.org/r/[email protected]
Thanks Jiri, Krzysztof and Rob for the review.

Changes in v4:
- rework baud-rate configuration: also check max bit-time, support higher
baud-rates by adding a delay to complete 1-Wire cycle.
- dt-binding w1-uart: specify baud-rates for 1-Wire operations
- Link to v3: https://lore.kernel.org/r/[email protected]

Changes in v3:
- improve baud-rate configuration: use specific limits for 1-Wire
reset, touch-0 and touch-1 operation, compute in nanoseconds.
- remove unused header atomic.h
- use function instead of macro to compute bit-time from baud-rate
- switch to b4 util to publish patch: missing recipients
- Link to v2: https://lore.kernel.org/lkml/[email protected]

Changes in v2:
- add documentation for dt-binding
- allow onewire as serial child node
- support different baud-rates: The driver requests a baud-rate (9600
for reset and 115200 for write/read) and tries to adapt the
transmitted byte according to the actual baud-rate returned from
serdev.
- fix locking problem for serdev-receive and w1-master reset/touch: The
received byte is now protected with a mutex - instead of the atomic,
which was used before due to the concurrent store and load.
- explicit error in serdev-receive: Receiving more than one byte results
in an error, since the w1-uart driver is the only writer, it writes a
single-byte and should receive a single byte.
- fix variable names, errno-returns, wrong define CONFIG_OF
- fix log flooding
- fix driver remove (error-path for rxtx-function)
- Link to v1: https://lore.kernel.org/all/[email protected]
Krzysztof, thank your very much for your feedback!

It was tested on a "Raspberry Pi 3 Model B+" with a DS18B20 and on a
"Variscite DART-6UL" with a DS18S20 temperature sensor.

Content:
- Patch 1: device tree binding 1-Wire
- Patch 2: allow onewire as serial child node
- Patch 3: driver and documentation

The patch was created against the w1 subsytem tree (branch w1-next):
Link: https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-w1.git/

The checkpatch.pl script reported the following error - which I am not
sure how to fix:
WARNING: added, moved or deleted file(s), does MAINTAINERS need
updating?

The technical details for 1-Wire over UART are in the document:
Link: https://www.analog.com/en/technical-articles/using-a-uart-to-implement-a-1wire-bus-master.html

In short, the UART peripheral must support full-duplex and operate in
open-drain mode. The timing patterns are generated by a specific
combination of baud-rate and transmitted byte, which corresponds to a
1-Wire read bit, write bit or reset pulse.

For instance the timing pattern for a 1-Wire reset and presence detect
uses the baud-rate 9600, i.e. 104.2 us per bit. The transmitted byte
0xf0 over UART (least significant bit first, start-bit low) sets the
reset low time for 1-Wire to 521 us. A present 1-Wire device changes the
received byte by pulling the line low, which is used by the driver to
evaluate the result of the 1-Wire operation.

Similar for a 1-Wire read bit or write bit, which uses the baud-rate
115200, i.e. 8.7 us per bit. The transmitted byte 0x00 is used for a
Write-0 operation and the byte 0xff for Read-0, Read-1 and Write-1.

Hope the driver is helpful.

Thanks,
Christoph

---
Christoph Winklhofer (3):
dt-bindings: w1: UART 1-Wire bus
dt-bindings: serial: allow onewire as child node
w1: add UART w1 bus driver

.../devicetree/bindings/serial/serial.yaml | 2 +-
Documentation/devicetree/bindings/w1/w1-uart.yaml | 60 +++
Documentation/w1/masters/index.rst | 1 +
Documentation/w1/masters/w1-uart.rst | 54 +++
drivers/w1/masters/Kconfig | 10 +
drivers/w1/masters/Makefile | 1 +
drivers/w1/masters/w1-uart.c | 402 +++++++++++++++++++++
7 files changed, 529 insertions(+), 1 deletion(-)
---
base-commit: 6613476e225e090cc9aad49be7fa504e290dd33d
change-id: 20240104-w1-uart-ee8685a15a50

Best regards,
--
Christoph Winklhofer <[email protected]>



Subject: [PATCH v5 1/3] dt-bindings: w1: UART 1-Wire bus

From: Christoph Winklhofer <[email protected]>

Add device tree binding for UART 1-Wire bus.

Signed-off-by: Christoph Winklhofer <[email protected]>
---
Documentation/devicetree/bindings/w1/w1-uart.yaml | 60 +++++++++++++++++++++++
1 file changed, 60 insertions(+)

diff --git a/Documentation/devicetree/bindings/w1/w1-uart.yaml b/Documentation/devicetree/bindings/w1/w1-uart.yaml
new file mode 100644
index 000000000000..7173820c78f9
--- /dev/null
+++ b/Documentation/devicetree/bindings/w1/w1-uart.yaml
@@ -0,0 +1,60 @@
+# SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/w1/w1-uart.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: UART 1-Wire Bus
+
+maintainers:
+ - Christoph Winklhofer <[email protected]>
+
+description: |
+ UART 1-wire bus. Utilizes the UART interface via the Serial Device Bus
+ to create the 1-Wire timing patterns.
+
+ The UART peripheral must support full-duplex and operate in open-drain
+ mode. The timing patterns are generated by a specific combination of
+ baud-rate and transmitted byte, which corresponds to a 1-Wire read bit,
+ write bit or reset pulse.
+
+ The default baud-rate for reset and presence detection is 9600 and for
+ a 1-Wire read or write operation 115200. In case the actual baud-rate
+ is different from the requested one, the transmitted byte is adapted
+ to generate the 1-Wire timing patterns.
+
+ https://www.analog.com/en/technical-articles/using-a-uart-to-implement-a-1wire-bus-master.html
+
+
+properties:
+ compatible:
+ const: w1-uart
+
+ reset-bps:
+ default: 9600
+ description:
+ The baud rate for the 1-Wire reset and presence detect.
+
+ write-0-bps:
+ default: 115200
+ description:
+ The baud rate for the 1-Wire write-0 cycle.
+
+ write-1-bps:
+ default: 115200
+ description:
+ The baud rate for the 1-Wire write-1 and read cycle.
+
+required:
+ - compatible
+
+additionalProperties:
+ type: object
+
+examples:
+ - |
+ serial {
+ onewire {
+ compatible = "w1-uart";
+ };
+ };

--
2.43.0


Subject: [PATCH v5 2/3] dt-bindings: serial: allow onewire as child node

From: Christoph Winklhofer <[email protected]>

The UART 1-Wire bus utilizes the Serial Device Bus to create the 1-wire
timing patterns.

Acked-by: Rob Herring <[email protected]>
Signed-off-by: Christoph Winklhofer <[email protected]>
---
Documentation/devicetree/bindings/serial/serial.yaml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Documentation/devicetree/bindings/serial/serial.yaml b/Documentation/devicetree/bindings/serial/serial.yaml
index 65804ca274ae..ffc9198ae214 100644
--- a/Documentation/devicetree/bindings/serial/serial.yaml
+++ b/Documentation/devicetree/bindings/serial/serial.yaml
@@ -88,7 +88,7 @@ properties:
TX FIFO threshold configuration (in bytes).

patternProperties:
- "^(bluetooth|bluetooth-gnss|gnss|gps|mcu)$":
+ "^(bluetooth|bluetooth-gnss|gnss|gps|mcu|onewire)$":
if:
type: object
then:

--
2.43.0


Subject: [PATCH v5 3/3] w1: add UART w1 bus driver

From: Christoph Winklhofer <[email protected]>

Add a UART 1-Wire bus driver. The driver utilizes the UART interface via
the Serial Device Bus to create the 1-Wire timing patterns. The driver
was tested on a "Raspberry Pi 3B" with a DS18B20 and on a "Variscite
DART-6UL" with a DS18S20 temperature sensor.

The 1-Wire timing pattern and the corresponding UART baud-rate with the
interpretation of the transferred bytes are described in the document:

Link: https://www.analog.com/en/technical-articles/using-a-uart-to-implement-a-1wire-bus-master.html

In short, the UART peripheral must support full-duplex and operate in
open-drain mode. The timing patterns are generated by a specific
combination of baud-rate and transmitted byte, which corresponds to a
1-Wire read bit, write bit or reset.

Signed-off-by: Christoph Winklhofer <[email protected]>
---
Documentation/w1/masters/index.rst | 1 +
Documentation/w1/masters/w1-uart.rst | 54 +++++
drivers/w1/masters/Kconfig | 10 +
drivers/w1/masters/Makefile | 1 +
drivers/w1/masters/w1-uart.c | 402 +++++++++++++++++++++++++++++++++++
5 files changed, 468 insertions(+)

diff --git a/Documentation/w1/masters/index.rst b/Documentation/w1/masters/index.rst
index 4442a98850ad..cc40189909fd 100644
--- a/Documentation/w1/masters/index.rst
+++ b/Documentation/w1/masters/index.rst
@@ -12,3 +12,4 @@
mxc-w1
omap-hdq
w1-gpio
+ w1-uart
diff --git a/Documentation/w1/masters/w1-uart.rst b/Documentation/w1/masters/w1-uart.rst
new file mode 100644
index 000000000000..8d0f122178d4
--- /dev/null
+++ b/Documentation/w1/masters/w1-uart.rst
@@ -0,0 +1,54 @@
+.. SPDX-License-Identifier: GPL-2.0-or-later
+
+=====================
+Kernel driver w1-uart
+=====================
+
+Author: Christoph Winklhofer <[email protected]>
+
+
+Description
+-----------
+
+UART 1-Wire bus driver. The driver utilizes the UART interface via the
+Serial Device Bus to create the 1-Wire timing patterns as described in
+the document `"Using a UART to Implement a 1-Wire Bus Master"`_.
+
+.. _"Using a UART to Implement a 1-Wire Bus Master": https://www.analog.com/en/technical-articles/using-a-uart-to-implement-a-1wire-bus-master.html
+
+In short, the UART peripheral must support full-duplex and operate in
+open-drain mode. The timing patterns are generated by a specific
+combination of baud-rate and transmitted byte, which corresponds to a
+1-Wire read bit, write bit or reset pulse.
+
+For instance the timing pattern for a 1-Wire reset and presence detect uses
+the baud-rate 9600, i.e. 104.2 us per bit. The transmitted byte 0xf0 over
+UART (least significant bit first, start-bit low) sets the reset low time
+for 1-Wire to 521 us. A present 1-Wire device changes the received byte by
+pulling the line low, which is used by the driver to evaluate the result of
+the 1-Wire operation.
+
+Similar for a 1-Wire read bit or write bit, which uses the baud-rate
+115200, i.e. 8.7 us per bit. The transmitted byte 0x80 is used for a
+Write-0 operation (low time 69.6us) and the byte 0xff for Read-0, Read-1
+and Write-1 (low time 8.7us).
+
+The default baud-rate for reset and presence detection is 9600 and for
+a 1-Wire read or write operation 115200. In case the actual baud-rate
+is different from the requested one, the transmitted byte is adapted
+to generate the 1-Wire timing patterns.
+
+
+Usage
+-----
+
+Specify the UART 1-wire bus in the device tree by adding the single child
+onewire to the serial node (e.g. uart0). For example:
+::
+
+ @uart0 {
+ ...
+ onewire {
+ compatible = "w1-uart";
+ };
+ };
diff --git a/drivers/w1/masters/Kconfig b/drivers/w1/masters/Kconfig
index 513c0b114337..e6049a75b35b 100644
--- a/drivers/w1/masters/Kconfig
+++ b/drivers/w1/masters/Kconfig
@@ -78,5 +78,15 @@ config W1_MASTER_SGI
This support is also available as a module. If so, the module
will be called sgi_w1.

+config W1_MASTER_UART
+ tristate "UART 1-wire driver"
+ depends on SERIAL_DEV_BUS
+ help
+ Say Y here if you want to communicate with your 1-wire devices using
+ UART interface.
+
+ This support is also available as a module. If so, the module
+ will be called w1-uart.
+
endmenu

diff --git a/drivers/w1/masters/Makefile b/drivers/w1/masters/Makefile
index 6c5a21f9b88c..227f80987e69 100644
--- a/drivers/w1/masters/Makefile
+++ b/drivers/w1/masters/Makefile
@@ -12,3 +12,4 @@ obj-$(CONFIG_W1_MASTER_MXC) += mxc_w1.o
obj-$(CONFIG_W1_MASTER_GPIO) += w1-gpio.o
obj-$(CONFIG_HDQ_MASTER_OMAP) += omap_hdq.o
obj-$(CONFIG_W1_MASTER_SGI) += sgi_w1.o
+obj-$(CONFIG_W1_MASTER_UART) += w1-uart.o
diff --git a/drivers/w1/masters/w1-uart.c b/drivers/w1/masters/w1-uart.c
new file mode 100644
index 000000000000..2dc5e5266638
--- /dev/null
+++ b/drivers/w1/masters/w1-uart.c
@@ -0,0 +1,402 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * w1-uart - UART 1-Wire bus driver
+ *
+ * Uses the UART interface (via Serial Device Bus) to create the 1-Wire
+ * timing patterns. Implements the following 1-Wire master interface:
+ *
+ * - reset_bus: requests baud-rate 9600
+ *
+ * - touch_bit: requests baud-rate 115200
+ *
+ * Author: Christoph Winklhofer <[email protected]>
+ */
+
+#include <linux/completion.h>
+#include <linux/delay.h>
+#include <linux/jiffies.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/of.h>
+#include <linux/serdev.h>
+#include <linux/w1.h>
+
+/* UART packet contains start and stop bit */
+#define W1_UART_BITS_PER_PACKET (BITS_PER_BYTE + 2)
+
+#define W1_UART_TIMEOUT msecs_to_jiffies(500)
+
+/*
+ * struct w1_uart_config - configuration for 1-Wire operation
+ *
+ * @baudrate: baud-rate returned from serdev
+ * @delay_us: delay to complete a 1-Wire cycle (in us)
+ * @tx_byte: byte to generate 1-Wire timing pattern
+ */
+struct w1_uart_config {
+ unsigned int baudrate;
+ unsigned int delay_us;
+ u8 tx_byte;
+};
+
+struct w1_uart_device {
+ struct serdev_device *serdev;
+ struct w1_bus_master bus;
+
+ struct w1_uart_config cfg_reset;
+ struct w1_uart_config cfg_touch_0;
+ struct w1_uart_config cfg_touch_1;
+
+ struct completion rx_byte_received;
+ int rx_err;
+ u8 rx_byte;
+
+ struct mutex mutex;
+};
+
+/*
+ * struct w1_uart_limits - limits for 1-Wire operations
+ *
+ * @baudrate: Requested baud-rate to create 1-Wire timing pattern
+ * @bit_min_us: minimum time for a bit (in us)
+ * @bit_max_us: maximum time for a bit (in us)
+ * @sample_us: timespan to sample 1-Wire response
+ * @cycle_us: duration of the 1-Wire cycle
+ */
+struct w1_uart_limits {
+ unsigned int baudrate;
+ unsigned int bit_min_us;
+ unsigned int bit_max_us;
+ unsigned int sample_us;
+ unsigned int cycle_us;
+};
+
+static inline unsigned int baud_to_bit_ns(unsigned int baud)
+{
+ return NSEC_PER_SEC / baud;
+}
+
+static inline unsigned int to_ns(unsigned int us)
+{
+ return us * NSEC_PER_USEC;
+}
+
+/*
+ * Set baud-rate, delay and tx-byte to create a 1-Wire pulse and adapt
+ * the tx-byte according to the actual baud-rate.
+ *
+ * Reject when:
+ * - time for a bit outside min/max range
+ * - a 1-Wire response is not detectable for sent byte
+ */
+static int w1_uart_set_config(struct serdev_device *serdev,
+ const struct w1_uart_limits *limits,
+ struct w1_uart_config *w1cfg)
+{
+ unsigned int packet_ns;
+ unsigned int bits_low;
+ unsigned int bit_ns;
+ unsigned int low_ns;
+
+ w1cfg->baudrate = serdev_device_set_baudrate(serdev, limits->baudrate);
+ if (w1cfg->baudrate == 0)
+ return -EINVAL;
+
+ /* Compute in nanoseconds for accuracy */
+ bit_ns = baud_to_bit_ns(w1cfg->baudrate);
+ bits_low = to_ns(limits->bit_min_us) / bit_ns;
+ /* start bit is always low */
+ low_ns = bit_ns * (bits_low + 1);
+
+ if (low_ns < to_ns(limits->bit_min_us))
+ return -EINVAL;
+
+ if (low_ns > to_ns(limits->bit_max_us))
+ return -EINVAL;
+
+ /* 1-Wire response detectable for sent byte */
+ if (limits->sample_us > 0 &&
+ bit_ns * BITS_PER_BYTE < low_ns + to_ns(limits->sample_us))
+ return -EINVAL;
+
+ /* delay: 1-Wire cycle takes longer than the UART packet */
+ packet_ns = bit_ns * W1_UART_BITS_PER_PACKET;
+ w1cfg->delay_us = 0;
+ if (to_ns(limits->cycle_us) > packet_ns)
+ w1cfg->delay_us =
+ (to_ns(limits->cycle_us) - packet_ns) / NSEC_PER_USEC;
+
+ /* byte to create 1-Wire pulse */
+ w1cfg->tx_byte = 0xff << bits_low;
+
+ return 0;
+}
+
+/*
+ * Configuration for reset and presence detect
+ * - bit_min_us is 480us, add margin and use 485us
+ * - limits for sample time 60us-75us, use 65us
+ */
+static int w1_uart_set_config_reset(struct w1_uart_device *w1dev)
+{
+ struct serdev_device *serdev = w1dev->serdev;
+ struct device_node *np = serdev->dev.of_node;
+
+ struct w1_uart_limits limits = { .baudrate = 9600,
+ .bit_min_us = 485,
+ .bit_max_us = 640,
+ .sample_us = 65,
+ .cycle_us = 960 };
+
+ of_property_read_u32(np, "reset-bps", &limits.baudrate);
+
+ return w1_uart_set_config(serdev, &limits, &w1dev->cfg_reset);
+}
+
+/*
+ * Configuration for write-0 cycle (touch bit 0)
+ * - bit_min_us is 60us, add margin and use 65us
+ * - no sampling required, sample_us = 0
+ */
+static int w1_uart_set_config_touch_0(struct w1_uart_device *w1dev)
+{
+ struct serdev_device *serdev = w1dev->serdev;
+ struct device_node *np = serdev->dev.of_node;
+
+ struct w1_uart_limits limits = { .baudrate = 115200,
+ .bit_min_us = 65,
+ .bit_max_us = 120,
+ .sample_us = 0,
+ .cycle_us = 70 };
+
+ of_property_read_u32(np, "write-0-bps", &limits.baudrate);
+
+ return w1_uart_set_config(serdev, &limits, &w1dev->cfg_touch_0);
+}
+
+/*
+ * Configuration for write-1 and read cycle (touch bit 1)
+ * - bit_min_us is 5us, add margin and use 6us
+ * - limits for sample time 5us-15us, use 15us
+ */
+static int w1_uart_set_config_touch_1(struct w1_uart_device *w1dev)
+{
+ struct serdev_device *serdev = w1dev->serdev;
+ struct device_node *np = serdev->dev.of_node;
+
+ struct w1_uart_limits limits = { .baudrate = 115200,
+ .bit_min_us = 6,
+ .bit_max_us = 15,
+ .sample_us = 15,
+ .cycle_us = 70 };
+
+ of_property_read_u32(np, "write-1-bps", &limits.baudrate);
+
+ return w1_uart_set_config(serdev, &limits, &w1dev->cfg_touch_1);
+}
+
+/*
+ * Configure and open the serial device
+ */
+static int w1_uart_serdev_open(struct w1_uart_device *w1dev)
+{
+ struct serdev_device *serdev = w1dev->serdev;
+ struct device *dev = &serdev->dev;
+ int ret;
+
+ ret = devm_serdev_device_open(dev, serdev);
+ if (ret < 0)
+ return ret;
+
+ ret = serdev_device_set_parity(serdev, SERDEV_PARITY_NONE);
+ if (ret < 0) {
+ dev_err(dev, "set parity failed\n");
+ return ret;
+ }
+
+ ret = w1_uart_set_config_reset(w1dev);
+ if (ret < 0) {
+ dev_err(dev, "config for reset failed\n");
+ return ret;
+ }
+
+ ret = w1_uart_set_config_touch_0(w1dev);
+ if (ret < 0) {
+ dev_err(dev, "config for touch-0 failed\n");
+ return ret;
+ }
+
+ ret = w1_uart_set_config_touch_1(w1dev);
+ if (ret < 0) {
+ dev_err(dev, "config for touch-1 failed\n");
+ return ret;
+ }
+
+ serdev_device_set_flow_control(serdev, false);
+
+ return 0;
+}
+
+/*
+ * Send one byte (tx_byte) and read one byte (rx_byte) via serdev.
+ */
+static int w1_uart_serdev_tx_rx(struct w1_uart_device *w1dev,
+ const struct w1_uart_config *w1cfg, u8 *rx_byte)
+{
+ struct serdev_device *serdev = w1dev->serdev;
+ int ret;
+
+ serdev_device_write_flush(serdev);
+ serdev_device_set_baudrate(serdev, w1cfg->baudrate);
+
+ /* write and immediately read one byte */
+ reinit_completion(&w1dev->rx_byte_received);
+ ret = serdev_device_write_buf(serdev, &w1cfg->tx_byte, 1);
+ if (ret != 1)
+ return -EIO;
+ ret = wait_for_completion_interruptible_timeout(
+ &w1dev->rx_byte_received, W1_UART_TIMEOUT);
+ if (ret <= 0)
+ return -EIO;
+
+ /* locking could fail during driver remove or when serdev is
+ * unexpectedly in the receive callback.
+ */
+ if (!mutex_trylock(&w1dev->mutex))
+ return -EIO;
+
+ ret = w1dev->rx_err;
+ if (ret == 0)
+ *rx_byte = w1dev->rx_byte;
+
+ if (w1cfg->delay_us > 0)
+ fsleep(w1cfg->delay_us);
+
+ mutex_unlock(&w1dev->mutex);
+
+ return ret;
+}
+
+static ssize_t w1_uart_serdev_receive_buf(struct serdev_device *serdev,
+ const u8 *buf, size_t count)
+{
+ struct w1_uart_device *w1dev = serdev_device_get_drvdata(serdev);
+
+ mutex_lock(&w1dev->mutex);
+
+ /* sent a single byte and receive one single byte */
+ if (count == 1) {
+ w1dev->rx_byte = buf[0];
+ w1dev->rx_err = 0;
+ } else {
+ w1dev->rx_err = -EIO;
+ }
+
+ mutex_unlock(&w1dev->mutex);
+ complete(&w1dev->rx_byte_received);
+
+ return count;
+}
+
+static const struct serdev_device_ops w1_uart_serdev_ops = {
+ .receive_buf = w1_uart_serdev_receive_buf,
+ .write_wakeup = serdev_device_write_wakeup,
+};
+
+/*
+ * 1-wire reset and presence detect: A present slave will manipulate
+ * the received byte by pulling the 1-Wire low.
+ */
+static u8 w1_uart_reset_bus(void *data)
+{
+ struct w1_uart_device *w1dev = data;
+ const struct w1_uart_config *w1cfg = &w1dev->cfg_reset;
+ int ret;
+ u8 val;
+
+ ret = w1_uart_serdev_tx_rx(w1dev, w1cfg, &val);
+ if (ret < 0)
+ return -1;
+
+ /* Device present (0) or no device (1) */
+ return val != w1cfg->tx_byte ? 0 : 1;
+}
+
+/*
+ * 1-Wire read and write cycle: Only the read-0 manipulates the
+ * received byte, all others left the line untouched.
+ */
+static u8 w1_uart_touch_bit(void *data, u8 bit)
+{
+ struct w1_uart_device *w1dev = data;
+ const struct w1_uart_config *w1cfg = bit ? &w1dev->cfg_touch_1 :
+ &w1dev->cfg_touch_0;
+ int ret;
+ u8 val;
+
+ ret = w1_uart_serdev_tx_rx(w1dev, w1cfg, &val);
+
+ /* return inactive bus state on error */
+ if (ret < 0)
+ return 1;
+
+ return val == w1cfg->tx_byte ? 1 : 0;
+}
+
+static int w1_uart_probe(struct serdev_device *serdev)
+{
+ struct device *dev = &serdev->dev;
+ struct w1_uart_device *w1dev;
+ int ret;
+
+ w1dev = devm_kzalloc(dev, sizeof(*w1dev), GFP_KERNEL);
+ if (!w1dev)
+ return -ENOMEM;
+ w1dev->bus.data = w1dev;
+ w1dev->bus.reset_bus = w1_uart_reset_bus;
+ w1dev->bus.touch_bit = w1_uart_touch_bit;
+ w1dev->serdev = serdev;
+
+ init_completion(&w1dev->rx_byte_received);
+ mutex_init(&w1dev->mutex);
+
+ ret = w1_uart_serdev_open(w1dev);
+ if (ret < 0)
+ return ret;
+ serdev_device_set_drvdata(serdev, w1dev);
+ serdev_device_set_client_ops(serdev, &w1_uart_serdev_ops);
+
+ return w1_add_master_device(&w1dev->bus);
+}
+
+static void w1_uart_remove(struct serdev_device *serdev)
+{
+ struct w1_uart_device *w1dev = serdev_device_get_drvdata(serdev);
+
+ mutex_lock(&w1dev->mutex);
+
+ w1_remove_master_device(&w1dev->bus);
+
+ mutex_unlock(&w1dev->mutex);
+}
+
+static const struct of_device_id w1_uart_of_match[] = {
+ { .compatible = "w1-uart" },
+ {},
+};
+MODULE_DEVICE_TABLE(of, w1_uart_of_match);
+
+static struct serdev_device_driver w1_uart_driver = {
+ .driver = {
+ .name = "w1-uart",
+ .of_match_table = w1_uart_of_match,
+ },
+ .probe = w1_uart_probe,
+ .remove = w1_uart_remove,
+};
+
+module_serdev_device_driver(w1_uart_driver);
+
+MODULE_DESCRIPTION("UART w1 bus driver");
+MODULE_AUTHOR("Christoph Winklhofer <[email protected]>");
+MODULE_LICENSE("GPL");

--
2.43.0


2024-01-30 22:52:14

by Rob Herring (Arm)

[permalink] [raw]
Subject: Re: [PATCH v5 1/3] dt-bindings: w1: UART 1-Wire bus


On Fri, 26 Jan 2024 16:42:03 +0100, Christoph Winklhofer wrote:
> Add device tree binding for UART 1-Wire bus.
>
> Signed-off-by: Christoph Winklhofer <[email protected]>
> ---
> Documentation/devicetree/bindings/w1/w1-uart.yaml | 60 +++++++++++++++++++++++
> 1 file changed, 60 insertions(+)
>

Reviewed-by: Rob Herring <[email protected]>


2024-01-31 13:16:08

by Krzysztof Kozlowski

[permalink] [raw]
Subject: Re: [PATCH v5 3/3] w1: add UART w1 bus driver

On 26/01/2024 16:42, Christoph Winklhofer via B4 Relay wrote:
> From: Christoph Winklhofer <[email protected]>
>
> Add a UART 1-Wire bus driver. The driver utilizes the UART interface via
> the Serial Device Bus to create the 1-Wire timing patterns. The driver
> was tested on a "Raspberry Pi 3B" with a DS18B20 and on a "Variscite
> DART-6UL" with a DS18S20 temperature sensor.
>

..

> + * struct w1_uart_config - configuration for 1-Wire operation
> + *
> + * @baudrate: baud-rate returned from serdev
> + * @delay_us: delay to complete a 1-Wire cycle (in us)
> + * @tx_byte: byte to generate 1-Wire timing pattern
> + */
> +struct w1_uart_config {
> + unsigned int baudrate;
> + unsigned int delay_us;
> + u8 tx_byte;
> +};
> +
> +struct w1_uart_device {
> + struct serdev_device *serdev;
> + struct w1_bus_master bus;
> +
> + struct w1_uart_config cfg_reset;
> + struct w1_uart_config cfg_touch_0;
> + struct w1_uart_config cfg_touch_1;
> +
> + struct completion rx_byte_received;
> + int rx_err;
> + u8 rx_byte;
> +

Missing documentation of mutex scope. What does it protect?

> + struct mutex mutex;
> +};
> +

..

> +/*
> + * Send one byte (tx_byte) and read one byte (rx_byte) via serdev.
> + */
> +static int w1_uart_serdev_tx_rx(struct w1_uart_device *w1dev,
> + const struct w1_uart_config *w1cfg, u8 *rx_byte)
> +{
> + struct serdev_device *serdev = w1dev->serdev;
> + int ret;
> +
> + serdev_device_write_flush(serdev);
> + serdev_device_set_baudrate(serdev, w1cfg->baudrate);
> +
> + /* write and immediately read one byte */
> + reinit_completion(&w1dev->rx_byte_received);
> + ret = serdev_device_write_buf(serdev, &w1cfg->tx_byte, 1);
> + if (ret != 1)
> + return -EIO;
> + ret = wait_for_completion_interruptible_timeout(
> + &w1dev->rx_byte_received, W1_UART_TIMEOUT);
> + if (ret <= 0)
> + return -EIO;
> +
> + /* locking could fail during driver remove or when serdev is

It's not netdev, so:
/*
*

> + * unexpectedly in the receive callback.
> + */
> + if (!mutex_trylock(&w1dev->mutex))
> + return -EIO;
> +
> + ret = w1dev->rx_err;
> + if (ret == 0)
> + *rx_byte = w1dev->rx_byte;
> +
> + if (w1cfg->delay_us > 0)
> + fsleep(w1cfg->delay_us);
> +
> + mutex_unlock(&w1dev->mutex);
> +
> + return ret;
> +}
> +
> +static ssize_t w1_uart_serdev_receive_buf(struct serdev_device *serdev,
> + const u8 *buf, size_t count)
> +{
> + struct w1_uart_device *w1dev = serdev_device_get_drvdata(serdev);
> +
> + mutex_lock(&w1dev->mutex);
> +
> + /* sent a single byte and receive one single byte */
> + if (count == 1) {
> + w1dev->rx_byte = buf[0];
> + w1dev->rx_err = 0;
> + } else {
> + w1dev->rx_err = -EIO;
> + }
> +
> + mutex_unlock(&w1dev->mutex);
> + complete(&w1dev->rx_byte_received);
> +
> + return count;
> +}
> +
> +static const struct serdev_device_ops w1_uart_serdev_ops = {
> + .receive_buf = w1_uart_serdev_receive_buf,
> + .write_wakeup = serdev_device_write_wakeup,
> +};
> +
> +/*
> + * 1-wire reset and presence detect: A present slave will manipulate
> + * the received byte by pulling the 1-Wire low.
> + */
> +static u8 w1_uart_reset_bus(void *data)
> +{
> + struct w1_uart_device *w1dev = data;
> + const struct w1_uart_config *w1cfg = &w1dev->cfg_reset;
> + int ret;
> + u8 val;
> +
> + ret = w1_uart_serdev_tx_rx(w1dev, w1cfg, &val);
> + if (ret < 0)
> + return -1;
> +
> + /* Device present (0) or no device (1) */
> + return val != w1cfg->tx_byte ? 0 : 1;
> +}
> +
> +/*
> + * 1-Wire read and write cycle: Only the read-0 manipulates the
> + * received byte, all others left the line untouched.
> + */
> +static u8 w1_uart_touch_bit(void *data, u8 bit)
> +{
> + struct w1_uart_device *w1dev = data;
> + const struct w1_uart_config *w1cfg = bit ? &w1dev->cfg_touch_1 :
> + &w1dev->cfg_touch_0;
> + int ret;
> + u8 val;
> +
> + ret = w1_uart_serdev_tx_rx(w1dev, w1cfg, &val);
> +
> + /* return inactive bus state on error */
> + if (ret < 0)
> + return 1;
> +
> + return val == w1cfg->tx_byte ? 1 : 0;
> +}
> +
> +static int w1_uart_probe(struct serdev_device *serdev)
> +{
> + struct device *dev = &serdev->dev;
> + struct w1_uart_device *w1dev;
> + int ret;
> +
> + w1dev = devm_kzalloc(dev, sizeof(*w1dev), GFP_KERNEL);
> + if (!w1dev)
> + return -ENOMEM;
> + w1dev->bus.data = w1dev;
> + w1dev->bus.reset_bus = w1_uart_reset_bus;
> + w1dev->bus.touch_bit = w1_uart_touch_bit;
> + w1dev->serdev = serdev;
> +
> + init_completion(&w1dev->rx_byte_received);
> + mutex_init(&w1dev->mutex);
> +
> + ret = w1_uart_serdev_open(w1dev);
> + if (ret < 0)
> + return ret;
> + serdev_device_set_drvdata(serdev, w1dev);
> + serdev_device_set_client_ops(serdev, &w1_uart_serdev_ops);
> +
> + return w1_add_master_device(&w1dev->bus);
> +}
> +
> +static void w1_uart_remove(struct serdev_device *serdev)
> +{
> + struct w1_uart_device *w1dev = serdev_device_get_drvdata(serdev);
> +
> + mutex_lock(&w1dev->mutex);
> +
> + w1_remove_master_device(&w1dev->bus);
> +
> + mutex_unlock(&w1dev->mutex);

This is still suspicious. You do not have serdev_device_close and you
want to protect from concurrent access but it looks insufficient.

This code assumes that:

w1_uart_remove()
<-- here concurrent read/write might start
mutex_lock()
w1_remove_master_device()
mutex_unlock()
<-- now w1_uart_serdev_tx_rx() or w1_uart_serdev_receive_buf() can be
executed, but device is removed. So what's the point of the mutex here?

What exactly is protected by the mutex? So far it looks like only some
contents of w1dev, but it does not matter, because it that memory is
still valid at this point.

After describing what is protected we can think whether it is really
protected...


>

Best regards,
Krzysztof


2024-01-31 13:19:39

by Krzysztof Kozlowski

[permalink] [raw]
Subject: Re: [PATCH v5 2/3] dt-bindings: serial: allow onewire as child node

On 26/01/2024 16:42, Christoph Winklhofer via B4 Relay wrote:
> From: Christoph Winklhofer <[email protected]>
>
> The UART 1-Wire bus utilizes the Serial Device Bus to create the 1-wire
> timing patterns.
>
> Acked-by: Rob Herring <[email protected]>
> Signed-off-by: Christoph Winklhofer <[email protected]>
> ---
> Documentation/devicetree/bindings/serial/serial.yaml | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>

If there is going to be resend, please reverse the patches because
that's dependency of #1.

Best regards,
Krzysztof


2024-02-01 07:29:21

by Christoph Winklhofer

[permalink] [raw]
Subject: Re: [PATCH v5 3/3] w1: add UART w1 bus driver

On Wed, Jan 31, 2024 at 02:12:34PM +0100, Krzysztof Kozlowski wrote:
> On 26/01/2024 16:42, Christoph Winklhofer via B4 Relay wrote:
> > From: Christoph Winklhofer <[email protected]>
> >
> > Add a UART 1-Wire bus driver. The driver utilizes the UART interface via
> > the Serial Device Bus to create the 1-Wire timing patterns. The driver
> > was tested on a "Raspberry Pi 3B" with a DS18B20 and on a "Variscite
> > DART-6UL" with a DS18S20 temperature sensor.
> >
>
> ...
>
> > + * struct w1_uart_config - configuration for 1-Wire operation
> > + *
> > + * @baudrate: baud-rate returned from serdev
> > + * @delay_us: delay to complete a 1-Wire cycle (in us)
> > + * @tx_byte: byte to generate 1-Wire timing pattern
> > + */
> > +struct w1_uart_config {
> > + unsigned int baudrate;
> > + unsigned int delay_us;
> > + u8 tx_byte;
> > +};
> > +
> > +struct w1_uart_device {
> > + struct serdev_device *serdev;
> > + struct w1_bus_master bus;
> > +
> > + struct w1_uart_config cfg_reset;
> > + struct w1_uart_config cfg_touch_0;
> > + struct w1_uart_config cfg_touch_1;
> > +
> > + struct completion rx_byte_received;
> > + int rx_err;
> > + u8 rx_byte;
> > +
>
> Missing documentation of mutex scope. What does it protect?
>

The mutex should protect concurrent access to rx_err and rx_byte. It
would be not be required in the good case: a write is initiated solely
by the w1-callbacks in 'w1_uart_serdev_tx_rx' and a completion is used
to wait for the result of serdev-receive.

However, in case the UART is not configured as a loop, a serdev-receive
may occur when w1_uart_serdev_tx_rx evaluates rx_err and rx_byte in
w1_uart_serdev_tx_rx, so it is protected - however, I will try to find
a better way to detect such an error.

In addition, the w1-callbacks should also return during a 'remove' (with
the mutex_try_lock) - see comment on that below.

> > + struct mutex mutex;
> > +};
> > +
>
> ...
>
> > +/*
> > + * Send one byte (tx_byte) and read one byte (rx_byte) via serdev.
> > + */
> > +static int w1_uart_serdev_tx_rx(struct w1_uart_device *w1dev,
> > + const struct w1_uart_config *w1cfg, u8 *rx_byte)
> > +{
> > + struct serdev_device *serdev = w1dev->serdev;
> > + int ret;
> > +
> > + serdev_device_write_flush(serdev);
> > + serdev_device_set_baudrate(serdev, w1cfg->baudrate);
> > +
> > + /* write and immediately read one byte */
> > + reinit_completion(&w1dev->rx_byte_received);
> > + ret = serdev_device_write_buf(serdev, &w1cfg->tx_byte, 1);
> > + if (ret != 1)
> > + return -EIO;
> > + ret = wait_for_completion_interruptible_timeout(
> > + &w1dev->rx_byte_received, W1_UART_TIMEOUT);
> > + if (ret <= 0)
> > + return -EIO;
> > +
> > + /* locking could fail during driver remove or when serdev is
>
> It's not netdev, so:
> /*
> *
>

Ok.

> > + * unexpectedly in the receive callback.
> > + */
> > + if (!mutex_trylock(&w1dev->mutex))
> > + return -EIO;
> > +
> > + ret = w1dev->rx_err;
> > + if (ret == 0)
> > + *rx_byte = w1dev->rx_byte;
> > +
> > + if (w1cfg->delay_us > 0)
> > + fsleep(w1cfg->delay_us);
> > +
> > + mutex_unlock(&w1dev->mutex);
> > +
> > + return ret;
> > +}
> > +
> > +static ssize_t w1_uart_serdev_receive_buf(struct serdev_device *serdev,
> > + const u8 *buf, size_t count)
> > +{
> > + struct w1_uart_device *w1dev = serdev_device_get_drvdata(serdev);
> > +
> > + mutex_lock(&w1dev->mutex);
> > +
> > + /* sent a single byte and receive one single byte */
> > + if (count == 1) {
> > + w1dev->rx_byte = buf[0];
> > + w1dev->rx_err = 0;
> > + } else {
> > + w1dev->rx_err = -EIO;
> > + }
> > +
> > + mutex_unlock(&w1dev->mutex);
> > + complete(&w1dev->rx_byte_received);
> > +
> > + return count;
> > +}
> > +
> > +static const struct serdev_device_ops w1_uart_serdev_ops = {
> > + .receive_buf = w1_uart_serdev_receive_buf,
> > + .write_wakeup = serdev_device_write_wakeup,
> > +};
> > +
> > +/*
> > + * 1-wire reset and presence detect: A present slave will manipulate
> > + * the received byte by pulling the 1-Wire low.
> > + */
> > +static u8 w1_uart_reset_bus(void *data)
> > +{
> > + struct w1_uart_device *w1dev = data;
> > + const struct w1_uart_config *w1cfg = &w1dev->cfg_reset;
> > + int ret;
> > + u8 val;
> > +
> > + ret = w1_uart_serdev_tx_rx(w1dev, w1cfg, &val);
> > + if (ret < 0)
> > + return -1;
> > +
> > + /* Device present (0) or no device (1) */
> > + return val != w1cfg->tx_byte ? 0 : 1;
> > +}
> > +
> > +/*
> > + * 1-Wire read and write cycle: Only the read-0 manipulates the
> > + * received byte, all others left the line untouched.
> > + */
> > +static u8 w1_uart_touch_bit(void *data, u8 bit)
> > +{
> > + struct w1_uart_device *w1dev = data;
> > + const struct w1_uart_config *w1cfg = bit ? &w1dev->cfg_touch_1 :
> > + &w1dev->cfg_touch_0;
> > + int ret;
> > + u8 val;
> > +
> > + ret = w1_uart_serdev_tx_rx(w1dev, w1cfg, &val);
> > +
> > + /* return inactive bus state on error */
> > + if (ret < 0)
> > + return 1;
> > +
> > + return val == w1cfg->tx_byte ? 1 : 0;
> > +}
> > +
> > +static int w1_uart_probe(struct serdev_device *serdev)
> > +{
> > + struct device *dev = &serdev->dev;
> > + struct w1_uart_device *w1dev;
> > + int ret;
> > +
> > + w1dev = devm_kzalloc(dev, sizeof(*w1dev), GFP_KERNEL);
> > + if (!w1dev)
> > + return -ENOMEM;
> > + w1dev->bus.data = w1dev;
> > + w1dev->bus.reset_bus = w1_uart_reset_bus;
> > + w1dev->bus.touch_bit = w1_uart_touch_bit;
> > + w1dev->serdev = serdev;
> > +
> > + init_completion(&w1dev->rx_byte_received);
> > + mutex_init(&w1dev->mutex);
> > +
> > + ret = w1_uart_serdev_open(w1dev);
> > + if (ret < 0)
> > + return ret;
> > + serdev_device_set_drvdata(serdev, w1dev);
> > + serdev_device_set_client_ops(serdev, &w1_uart_serdev_ops);
> > +
> > + return w1_add_master_device(&w1dev->bus);
> > +}
> > +
> > +static void w1_uart_remove(struct serdev_device *serdev)
> > +{
> > + struct w1_uart_device *w1dev = serdev_device_get_drvdata(serdev);
> > +
> > + mutex_lock(&w1dev->mutex);
> > +
> > + w1_remove_master_device(&w1dev->bus);
> > +
> > + mutex_unlock(&w1dev->mutex);
>
> This is still suspicious. You do not have serdev_device_close and you
> want to protect from concurrent access but it looks insufficient.
>
> This code assumes that:
>
> w1_uart_remove()
> <-- here concurrent read/write might start
> mutex_lock()
> w1_remove_master_device()
> mutex_unlock()
> <-- now w1_uart_serdev_tx_rx() or w1_uart_serdev_receive_buf() can be
> executed, but device is removed. So what's the point of the mutex here?
>
> What exactly is protected by the mutex? So far it looks like only some
> contents of w1dev, but it does not matter, because it that memory is
> still valid at this point.
>
> After describing what is protected we can think whether it is really
> protected...
>
>
> >
>
> Best regards,
> Krzysztof
>

Yes, it is still suspicious, sorry..

After w1_uart_remove, serdev is closed and w1dev is released. Therefore
the w1-callback (w1_uart_serdev_tx_rx) must be finished before returning
from w1_uart_remove. That was the intention with the lock and trylock.

I thought that after w1_remove_master_device, the w1-callback
(w1_uart_serdev_tx_rx) is finished which is not the case. I will check
the working of w1_remove_master_device, probably it requires a lock to
a mutex from w1-bus.

Many thanks for your review and pointing the things out!

Kind regards,
Christoph

2024-02-01 09:38:17

by Krzysztof Kozlowski

[permalink] [raw]
Subject: Re: [PATCH v5 3/3] w1: add UART w1 bus driver

On 01/02/2024 08:29, Christoph Winklhofer wrote:
>>> +
>>> +static void w1_uart_remove(struct serdev_device *serdev)
>>> +{
>>> + struct w1_uart_device *w1dev = serdev_device_get_drvdata(serdev);
>>> +
>>> + mutex_lock(&w1dev->mutex);
>>> +
>>> + w1_remove_master_device(&w1dev->bus);
>>> +
>>> + mutex_unlock(&w1dev->mutex);
>>
>> This is still suspicious. You do not have serdev_device_close and you
>> want to protect from concurrent access but it looks insufficient.
>>
>> This code assumes that:
>>
>> w1_uart_remove()
>> <-- here concurrent read/write might start
>> mutex_lock()
>> w1_remove_master_device()
>> mutex_unlock()
>> <-- now w1_uart_serdev_tx_rx() or w1_uart_serdev_receive_buf() can be
>> executed, but device is removed. So what's the point of the mutex here?
>>
>> What exactly is protected by the mutex? So far it looks like only some
>> contents of w1dev, but it does not matter, because it that memory is
>> still valid at this point.
>>
>> After describing what is protected we can think whether it is really
>> protected...
>>
>>
>>>
>>
>> Best regards,
>> Krzysztof
>>
>
> Yes, it is still suspicious, sorry..
>
> After w1_uart_remove, serdev is closed and w1dev is released. Therefore
> the w1-callback (w1_uart_serdev_tx_rx) must be finished before returning

I did not even go to end of w1_uart_remove(). In my code above, that
thread is still in w1_uart_remove(), just after unlocking mutex.

> from w1_uart_remove. That was the intention with the lock and trylock.

Then it does not look really protected. To be honest, w1-gpio and other
drivers also might have a race here. You can test it by adding long
sleeps in read/write paths and then trying to unbind device. Maybe this
should be fixed everywhere, but this mutex here brings more questions.


Best regards,
Krzysztof


2024-02-02 19:23:53

by Christoph Winklhofer

[permalink] [raw]
Subject: Re: [PATCH v5 3/3] w1: add UART w1 bus driver

On Thu, Feb 01, 2024 at 10:35:32AM +0100, Krzysztof Kozlowski wrote:
> On 01/02/2024 08:29, Christoph Winklhofer wrote:
> >>> +
> >>> +static void w1_uart_remove(struct serdev_device *serdev)
> >>> +{
> >>> + struct w1_uart_device *w1dev = serdev_device_get_drvdata(serdev);
> >>> +
> >>> + mutex_lock(&w1dev->mutex);
> >>> +
> >>> + w1_remove_master_device(&w1dev->bus);
> >>> +
> >>> + mutex_unlock(&w1dev->mutex);
> >>
> >> This is still suspicious. You do not have serdev_device_close and you
> >> want to protect from concurrent access but it looks insufficient.
> >>
> >> This code assumes that:
> >>
> >> w1_uart_remove()
> >> <-- here concurrent read/write might start
> >> mutex_lock()
> >> w1_remove_master_device()
> >> mutex_unlock()
> >> <-- now w1_uart_serdev_tx_rx() or w1_uart_serdev_receive_buf() can be
> >> executed, but device is removed. So what's the point of the mutex here?
> >>
> >> What exactly is protected by the mutex? So far it looks like only some
> >> contents of w1dev, but it does not matter, because it that memory is
> >> still valid at this point.
> >>
> >> After describing what is protected we can think whether it is really
> >> protected...
> >>
> >>
> >>>
> >>
> >> Best regards,
> >> Krzysztof
> >>
> >
> > Yes, it is still suspicious, sorry..
> >
> > After w1_uart_remove, serdev is closed and w1dev is released. Therefore
> > the w1-callback (w1_uart_serdev_tx_rx) must be finished before returning
>
> I did not even go to end of w1_uart_remove(). In my code above, that
> thread is still in w1_uart_remove(), just after unlocking mutex.
>

Ok, I looked more closely at the underlying w1-code and think it is
sufficient to only call w1_remove_master_device() in w1_uart_remove.
This function waits until all slaves have finished their work, so
w1_uart_serdev_tx_rx finished too. The lock is not required.

Hence, I will use the mutex only to protected concurrent access of
serdev and w1-callbacks (for rx_byte and rx_err).

> > from w1_uart_remove. That was the intention with the lock and trylock.
>
> Then it does not look really protected. To be honest, w1-gpio and other
> drivers also might have a race here. You can test it by adding long
> sleeps in read/write paths and then trying to unbind device. Maybe this
> should be fixed everywhere, but this mutex here brings more questions.
>

I added a delay, unbind takes longer but works without problems when its
done during a temperature read.

IMO also the other drivers should be fine. From w1_int.c: The w1_master
is ref-counted and released when it is unused (2). In w1_slave_detach
(1), the slaves decrement this count, perform specific clean up (in
remove_slave) and remove sysfs entries.

w1_int.c:

void __w1_remove_master_device(struct w1_master *dev)
..
list_for_each_entry_safe(sl, sln, &dev->slist, w1_slave_entry) {
mutex_unlock(&dev->list_mutex);
w1_slave_detach(sl); (1)
..
while (atomic_read(&dev->refcnt)) { (2)
..
}
..
w1_free_dev(dev);

For example w1_therm waits in remove_slave until its w1-operations are
done. The other slave-drivers (e.g. w1_ds2405.c) use w1-operations in
their sysfs-callback and I suppose that sysfs-removal waits until the
sysfs-read is finished.

Kind regards,
Christoph