From 53f33fd74d3993af0fbb5494b5be709f6ca6b712 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kry=C5=A1tof=20=C4=8Cern=C3=BD?= Date: Fri, 12 Jun 2026 09:55:07 +0200 Subject: [PATCH 1/5] w1: ds2482: add OF device match table MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add an of_device_id table and hook it into the i2c driver so the ds2482/ds2484 can be matched and auto-probed from Device Tree. This allows automatic module loading when instantiated via DT. Signed-off-by: Kryštof Černý Link: https://patch.msgid.link/20260612-w1-of-autoload-v1-1-74e8a17626e6@gmail.com Signed-off-by: Krzysztof Kozlowski --- drivers/w1/masters/ds2482.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/w1/masters/ds2482.c b/drivers/w1/masters/ds2482.c index 0069e6f854d7..9e57c6e487d1 100644 --- a/drivers/w1/masters/ds2482.c +++ b/drivers/w1/masters/ds2482.c @@ -545,9 +545,17 @@ static const struct i2c_device_id ds2482_id[] = { }; MODULE_DEVICE_TABLE(i2c, ds2482_id); +static const struct of_device_id ds2482_of_match[] = { + { .compatible = "maxim,ds2482", }, + { .compatible = "maxim,ds2484", }, + { } +}; +MODULE_DEVICE_TABLE(of, ds2482_of_match); + static struct i2c_driver ds2482_driver = { .driver = { .name = "ds2482", + .of_match_table = ds2482_of_match, }, .probe = ds2482_probe, .remove = ds2482_remove, From faa63a51bea10151952c6b35d66d72ce0d25efa1 Mon Sep 17 00:00:00 2001 From: Eduard Bostina Date: Tue, 30 Jun 2026 12:48:25 +0000 Subject: [PATCH 2/5] dt-bindings: w1: Convert HDQ One Wire to DT schema Convert the Texas Instruments OMAP HDQ One Wire bindings to DT schema. During the conversion, several updates were made to reflect actual hardware usage and resolve dtbs_check warnings: - 'ti,hwmods' has been made optional. - Added 'clocks' and 'clock-names' properties as they are used in actual device trees (e.g., am437x-l4.dtsi). - Added a second example for the AM4372 HDQ controller to demonstrate the clock and interrupt configuration. Signed-off-by: Eduard Bostina Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260630124826.2992529-1-egbostina@gmail.com [krzk: Rename node names to onewire to match convention, fix path in omap-hdq.rst] Signed-off-by: Krzysztof Kozlowski --- .../devicetree/bindings/w1/omap-hdq.txt | 22 ------ .../devicetree/bindings/w1/ti,hdq.yaml | 70 +++++++++++++++++++ Documentation/w1/masters/omap-hdq.rst | 2 +- 3 files changed, 71 insertions(+), 23 deletions(-) delete mode 100644 Documentation/devicetree/bindings/w1/omap-hdq.txt create mode 100644 Documentation/devicetree/bindings/w1/ti,hdq.yaml diff --git a/Documentation/devicetree/bindings/w1/omap-hdq.txt b/Documentation/devicetree/bindings/w1/omap-hdq.txt deleted file mode 100644 index 913c5f91a0f9..000000000000 --- a/Documentation/devicetree/bindings/w1/omap-hdq.txt +++ /dev/null @@ -1,22 +0,0 @@ -* OMAP HDQ One wire bus master controller - -Required properties: -- compatible : should be "ti,omap3-1w" or "ti,am4372-hdq" -- reg : Address and length of the register set for the device -- interrupts : interrupt line. -- ti,hwmods : "hdq1w" - -Optional properties: -- ti,mode: should be "hdq": HDQ mode "1w": one-wire mode. - If not specified HDQ mode is implied. - -Example: - -- From omap3.dtsi - hdqw1w: 1w@480b2000 { - compatible = "ti,omap3-1w"; - reg = <0x480b2000 0x1000>; - interrupts = <58>; - ti,hwmods = "hdq1w"; - ti,mode = "hdq"; - }; diff --git a/Documentation/devicetree/bindings/w1/ti,hdq.yaml b/Documentation/devicetree/bindings/w1/ti,hdq.yaml new file mode 100644 index 000000000000..fd402c0510db --- /dev/null +++ b/Documentation/devicetree/bindings/w1/ti,hdq.yaml @@ -0,0 +1,70 @@ +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) +%YAML 1.2 +--- +$id: http://devicetree.org/schemas/w1/ti,hdq.yaml# +$schema: http://devicetree.org/meta-schemas/core.yaml# + +title: Texas Instruments OMAP HDQ One Wire Bus Master Controller + +maintainers: + - Eduard Bostina + +properties: + compatible: + enum: + - ti,omap3-1w + - ti,am4372-hdq + + reg: + maxItems: 1 + + interrupts: + maxItems: 1 + + clocks: + maxItems: 1 + + clock-names: + items: + - const: fck + + ti,hwmods: + description: Name of the hwmod associated to the hdq + $ref: /schemas/types.yaml#/definitions/string + const: hdq1w + + ti,mode: + description: | + Operation mode. "hdq" for HDQ mode, "1w" for One-Wire mode. + If not specified, HDQ mode is implied. + $ref: /schemas/types.yaml#/definitions/string + enum: + - hdq + - 1w + default: hdq + +required: + - compatible + - reg + - interrupts + +additionalProperties: false + +examples: + - | + #include + onewire@0 { + compatible = "ti,am4372-hdq"; + reg = <0x0 0x1000>; + interrupts = ; + clocks = <&func_12m_clk>; + clock-names = "fck"; + }; + - | + onewire@480b2000 { + compatible = "ti,omap3-1w"; + reg = <0x480b2000 0x1000>; + interrupts = <58>; + ti,hwmods = "hdq1w"; + ti,mode = "hdq"; + }; diff --git a/Documentation/w1/masters/omap-hdq.rst b/Documentation/w1/masters/omap-hdq.rst index 5347b5d9e90a..2ecf572be1a4 100644 --- a/Documentation/w1/masters/omap-hdq.rst +++ b/Documentation/w1/masters/omap-hdq.rst @@ -50,5 +50,5 @@ The driver also supports 1-wire mode. In this mode, there is no need to pass slave ID as parameter. The driver will auto-detect slaves connected to the bus using SEARCH_ROM procedure. 1-wire mode can be selected by setting "ti,mode" property to "1w" in DT (see -Documentation/devicetree/bindings/w1/omap-hdq.txt for more details). +Documentation/devicetree/bindings/w1/ti,hdq.yaml for more details). By default driver is in HDQ mode. From 169ae5e65e5aaf213b6a578f6478a9fd2e523606 Mon Sep 17 00:00:00 2001 From: Maoyi Xie Date: Mon, 29 Jun 2026 20:10:43 +0800 Subject: [PATCH 3/5] w1: ds28e17: reject an oversize length on an I2C block read w1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire to I2C bridge. On an I2C_M_RECV_LEN read, it takes the length from the device. The downstream slave puts a length byte in buf[0]. The driver then reads that many bytes into buf[1] with w1_f19_i2c_read(). buf[0] is controlled by the device and can be 0 to 255. w1_f19_i2c_read() only rejects a zero count. The caller buffer is I2C_SMBUS_BLOCK_MAX + 2, so 34 bytes. A length above 32 makes the read run past it, up to about 222 bytes out of bounds. The SMBus core does check buf[0] against I2C_SMBUS_BLOCK_MAX. That check runs after master_xfer returns. By then the write is already done. i2c-algo-bit rejects an oversize length before it copies, and returns -EPROTO. Reject a length above I2C_SMBUS_BLOCK_MAX at both RECV_LEN sites, the same way i2c-algo-bit does. Fixes: ebc4768ac497 ("add w1_ds28e17 driver for the DS28E17 Onewire to I2C master bridge") Cc: stable@vger.kernel.org Signed-off-by: Maoyi Xie Reviewed-by: Andi Shyti Link: https://patch.msgid.link/20260629121043.199487-1-maoyixie.tju@gmail.com Signed-off-by: Krzysztof Kozlowski --- drivers/w1/slaves/w1_ds28e17.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/w1/slaves/w1_ds28e17.c b/drivers/w1/slaves/w1_ds28e17.c index e53bc41bde3c..b638963d4b59 100644 --- a/drivers/w1/slaves/w1_ds28e17.c +++ b/drivers/w1/slaves/w1_ds28e17.c @@ -389,6 +389,10 @@ static int w1_f19_i2c_master_transfer(struct i2c_adapter *adapter, * another simple read in that case. */ if (msgs[i+1].flags & I2C_M_RECV_LEN) { + if (msgs[i+1].buf[0] > I2C_SMBUS_BLOCK_MAX) { + i = -EPROTO; + goto error; + } result = w1_f19_i2c_read(sl, msgs[i+1].addr, &(msgs[i+1].buf[1]), msgs[i+1].buf[0]); if (result < 0) { @@ -415,6 +419,10 @@ static int w1_f19_i2c_master_transfer(struct i2c_adapter *adapter, * another simple read in that case. */ if (msgs[i].flags & I2C_M_RECV_LEN) { + if (msgs[i].buf[0] > I2C_SMBUS_BLOCK_MAX) { + i = -EPROTO; + goto error; + } result = w1_f19_i2c_read(sl, msgs[i].addr, &(msgs[i].buf[1]), From 73f46553fd74a1fc56eb2e6218ff3a4ea1de43b5 Mon Sep 17 00:00:00 2001 From: Pengpeng Hou Date: Tue, 30 Jun 2026 14:57:38 +0800 Subject: [PATCH 4/5] w1: validate slave string length before checking separator w1_atoreg_num() checks buf[2] for the family/id separator before proving the input contains that byte. Require at least the family and separator prefix before checking the separator. Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/2026063007047999.4-ccfa108-0039-w1-validate-slave-string-le-pengpeng@iscas.ac.cn Signed-off-by: Krzysztof Kozlowski --- drivers/w1/w1.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c index 486f321eadc8..c16946642789 100644 --- a/drivers/w1/w1.c +++ b/drivers/w1/w1.c @@ -403,6 +403,11 @@ static int w1_atoreg_num(struct device *dev, const char *buf, size_t count, const char *error_msg = "bad slave string format, expecting " "ff-dddddddddddd\n"; + if (count < 3) { + dev_err(dev, "%s", error_msg); + return -EINVAL; + } + if (buf[2] != '-') { dev_err(dev, "%s", error_msg); return -EINVAL; From 4d3721b204f961e905714954ff95633337b768e3 Mon Sep 17 00:00:00 2001 From: Babanpreet Singh Date: Tue, 14 Jul 2026 04:10:10 +0000 Subject: [PATCH 5/5] w1: ds2482: Fix signedness bug in ds2482_w1_triplet() ds2482_wait_1wire_idle() returns the status register value (0..255) on success, or a negative value on I2C failure: -1 when selecting the status register fails, or a negative errno from i2c_smbus_read_byte(). ds2482_w1_triplet() feeds that result into "return (status >> 5);" without checking for errors, and the function returns u8. For a negative status the arithmetic shift keeps the sign and the u8 truncation fabricates a triplet result whose meaning depends on the errno value: -1 and -EIO happen to become 0xff, whose set low bits make w1_search() abort, but -ETIMEDOUT (-110 >> 5 = -4) becomes 0xfc - "devices responded on both branches, wrote 1" - and -EOPNOTSUPP (-95 >> 5 = -3) becomes 0xfd - "only the zero branch responded". w1_search() then continues the ROM search with a fabricated direction bit instead of aborting, and the corrupted id is either rejected by the ROM CRC (existing device missed) or registers a phantom slave. The function already defines an in-band error value: status is initialized to (3 << 5), which decodes to 3 (both branch bits set, "no device responded") and makes w1_search() terminate the search when sending the triplet command fails. Decode a negative status to the same value. Found by smatch: drivers/w1/masters/ds2482.c:314 ds2482_w1_triplet() warn: signedness bug returning '(-67108864)' Fixes: baf12ae29ab4 ("[PATCH] W1: Add the DS2482 I2C-to-w1 bridge driver.") Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Babanpreet Singh Link: https://patch.msgid.link/20260714041011.7-1-bbnpreetsingh@gmail.com Signed-off-by: Krzysztof Kozlowski --- drivers/w1/masters/ds2482.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/w1/masters/ds2482.c b/drivers/w1/masters/ds2482.c index 9e57c6e487d1..cbd11bc61274 100644 --- a/drivers/w1/masters/ds2482.c +++ b/drivers/w1/masters/ds2482.c @@ -310,6 +310,10 @@ static u8 ds2482_w1_triplet(void *data, u8 dbit) mutex_unlock(&pdev->access_lock); + /* On bus error, decode to 3 (no device responded) to abort the search */ + if (status < 0) + status = 3 << 5; + /* Decode the status */ return (status >> 5); }