[PATCH v5 0/5] i3c: add i3cdev module to expose i3c dev in /dev

[PATCH v5 0/5] i3c: add i3cdev module to expose i3c dev in /dev

[Sam Agazaryan]

This patch series introduces the i3cdev module, exposing unbound I3C
target devices to userspace via character device nodes (/dev/bus/i3c/*),
along with the i3ctransfer userspace utility in tools/i3c/.

Userspace access to I3C targets is needed for devices that do not have a
kernel driver bound to them, such as targets in ROM/bootloader recovery
mode (e.g., OCP Secure Firmware Recovery v1.1 and Caliptra Silicon Root of
Trust recovery flows), as well as hardware bring-up and diagnostics.

When a kernel driver later binds to an I3C device (for example via
dynamic module loading), i3cdev automatically detaches via the
BUS_NOTIFY_BIND_DRIVER notifier so kernel drivers always take
precedence.

Testing status:
This v5 series has been compile-tested across all modified I3C controller
drivers with W=1. Posting v5 now so collaborators and controller owners
can test the unified UAPI and actual_len updates on their respective
hardware and provide Tested-by tags while we complete final hardware
verification of the v5 updates on our platform.

Changes in v5:
- Updated Patch 2/5 ("i3c: master: add i3c_for_each_dev helper"):
  - Dropped mutex_lock(&i3c_core_lock) around bus_for_each_dev() to avoid
    lock inversion and deadlock with external callbacks (sashiko-bot).
- Added Patch 3/5 ("i3c: use actual_len for read transfers"):
  - Clarified @actual_len kerneldoc in <linux/i3c/device.h>
    (Adrian Hunter).
  - Incorporated Meagan Lloyd's controller updates (adi, dw, cdns,
    mipi-i3c-hci, renesas) so all I3C controller drivers populate
    xfer->actual_len on reads without mutating xfer->len
    (Adrian Hunter, Meagan Lloyd).
  - Updated mctp-i3c to read xfer.actual_len instead of xfer.len
    (Adrian Hunter).
- Updated Patch 4/5 ("i3c: add i3cdev module to expose i3c dev in /dev"):
  - Unified the UAPI around struct i3c_ioc_xfer and I3C_IOC_XFER(N) in
    <uapi/linux/i3c/i3cdev.h>, supporting both SDR and HDR modes via a
    mode field and union { __u8 rnw; __u8 cmd; } (Frank Li).
  - Added __u16 actual_len to struct i3c_ioc_xfer and updated
    i3cdev_do_xfer() to copy actual_len bytes to userspace and write
    actual_len back to userspace via put_user() on read transfers
    (Adrian Hunter, Frank Li).
  - Tracked active i3cdev instances in a private list (i3cdev_list)
    instead of using i3cdev_set_drvdata()/i3cdev_get_drvdata() so i3cdev
    never clobbers client drivers' dev->driver_data (Meagan Lloyd).
  - Validated direction field and verified that reserved padding pad[2] is
    zeroed (Greg KH).
  - Clamped read()/write() byte count to type_max(xfers.len) (u16) to
    prevent silent integer truncation and unbounded kernel allocations
    (sashiko-bot).
  - Used ida_alloc_max() capped to MINORMASK to prevent minor number
    overflow (sashiko-bot).
  - Added i3cdev_attach_lock mutex and idempotency check in
    i3cdev_attach()/i3cdev_detach() to serialize concurrent attach/detach
    calls (sashiko-bot).
  - Updated bus notifier to handle BUS_NOTIFY_DRIVER_NOT_BOUND and return
    NOTIFY_OK instead of raw errno values (sashiko-bot).
- Added Patch 5/5 ("tools: i3c: add i3ctransfer utility"):
  - Added tools/i3c/i3ctransfer.c (adapted from Vitor Soares's
    i3c-tools) updated for struct i3c_ioc_xfer, supporting SDR and HDR
    (-m, -c) modes and reporting actual_len bytes on reads
    (Wolfram Sang).
  - Note to Vitor Soares: Since your original i3ctransfer commit in
    i3c-tools did not include a Signed-off-by tag, could you please
    reply with your Signed-off-by / Acked-by for Patch 5/5?

Changes in v4:
- Dropped dev_open count tracking and used cdev_device_add/del with
  mutex locking to prevent use-after-free on detach
  (Greg KH, Wolfram Sang).
- Fixed 32/64-bit UAPI alignment and added compat_ptr_ioctl.
- Switched to dynamic minor allocation via IDA.

Sam Agazaryan (2):
  i3c: use actual_len for read transfers
  tools: i3c: add i3ctransfer utility

Vitor Soares (3):
  i3c: master: export i3c_masterdev_type
  i3c: master: add i3c_for_each_dev helper
  i3c: add i3cdev module to expose i3c dev in /dev

 MAINTAINERS                            |   2 +
 drivers/i3c/Kconfig                    |  11 +
 drivers/i3c/Makefile                   |   1 +
 drivers/i3c/i3cdev.c                   | 491 +++++++++++++++++++++++++
 drivers/i3c/internals.h                |   4 +
 drivers/i3c/master.c                   |   9 +-
 drivers/i3c/master/adi-i3c-master.c    |   5 +-
 drivers/i3c/master/dw-i3c-master.c     |   2 +-
 drivers/i3c/master/i3c-master-cdns.c   |   5 +-
 drivers/i3c/master/mipi-i3c-hci/core.c |   2 +-
 drivers/i3c/master/renesas-i3c.c       |   3 +
 drivers/net/mctp/mctp-i3c.c            |  10 +-
 include/linux/i3c/device.h             |   2 +-
 include/uapi/linux/i3c/i3cdev.h        |  57 +++
 tools/Makefile                         |  13 +-
 tools/i3c/Build                        |   1 +
 tools/i3c/Makefile                     |  58 +++
 tools/i3c/i3ctransfer.c                | 307 ++++++++++++++++
 18 files changed, 966 insertions(+), 17 deletions(-)
 create mode 100644 drivers/i3c/i3cdev.c
 create mode 100644 include/uapi/linux/i3c/i3cdev.h
 create mode 100644 tools/i3c/Build
 create mode 100644 tools/i3c/Makefile
 create mode 100644 tools/i3c/i3ctransfer.c

-- 
2.55.0.1082.g2b9226bbc0-goog

[PATCH v5 1/5] i3c: master: export i3c_masterdev_type

[Sam Agazaryan]

From: Vitor Soares <vitor.soares@toradex.com>

Export i3c_masterdev_type so i3cdev module can verify if an i3c device
is a master.

Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
Signed-off-by: Sam Agazaryan <samagazaryan@google.com>
---
 drivers/i3c/internals.h | 2 ++
 drivers/i3c/master.c    | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/i3c/internals.h b/drivers/i3c/internals.h
index 86a36b951e0d..cbc00c862104 100644
--- a/drivers/i3c/internals.h
+++ b/drivers/i3c/internals.h
@@ -11,6 +11,8 @@
 #include <linux/i3c/master.h>
 #include <linux/io.h>
 
+extern const struct device_type i3c_masterdev_type;
+
 int __must_check i3c_bus_rpm_get(struct i3c_bus *bus);
 void i3c_bus_rpm_put(struct i3c_bus *bus);
 bool i3c_bus_rpm_ibi_allowed(struct i3c_bus *bus);
diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index afcd7a21a3e6..e8a9f8c3041e 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -864,9 +864,10 @@ static void i3c_masterdev_release(struct device *dev)
 	i3c_master_free_i3c_dev(master->this);
 }
 
-static const struct device_type i3c_masterdev_type = {
+const struct device_type i3c_masterdev_type = {
 	.groups	= i3c_masterdev_groups,
 };
+EXPORT_SYMBOL_GPL(i3c_masterdev_type);
 
 static void i3c_master_shutdown(struct i3c_master_controller *master)
 {
-- 
2.55.0.1082.g2b9226bbc0-goog

[PATCH v5 2/5] i3c: master: add i3c_for_each_dev helper

[Sam Agazaryan]

From: Vitor Soares <vitor.soares@toradex.com>

Introduce i3c_for_each_dev(), an i3c device iterator for use by i3cdev.

Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
Signed-off-by: Sam Agazaryan <samagazaryan@google.com>
---
 drivers/i3c/internals.h | 2 ++
 drivers/i3c/master.c    | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/drivers/i3c/internals.h b/drivers/i3c/internals.h
index cbc00c862104..3c53a5108b81 100644
--- a/drivers/i3c/internals.h
+++ b/drivers/i3c/internals.h
@@ -79,4 +79,6 @@ static inline struct i3c_master_controller *i3c_bus_to_i3c_master(struct i3c_bus
 	return container_of(i3cbus, struct i3c_master_controller, bus);
 }
 
+int i3c_for_each_dev(void *data, int (*fn)(struct device *, void *));
+
 #endif /* I3C_INTERNAL_H */
diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index e8a9f8c3041e..07540ea73aec 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -4011,6 +4011,12 @@ void i3c_dev_free_ibi_locked(struct i3c_dev_desc *dev)
 }
 EXPORT_SYMBOL_GPL(i3c_dev_free_ibi_locked);
 
+int i3c_for_each_dev(void *data, int (*fn)(struct device *, void *))
+{
+	return bus_for_each_dev(&i3c_bus_type, NULL, data, fn);
+}
+EXPORT_SYMBOL_GPL(i3c_for_each_dev);
+
 static int __init i3c_init(void)
 {
 	int res;
-- 
2.55.0.1082.g2b9226bbc0-goog

[PATCH v5 3/5] i3c: use actual_len for read transfers

[Sam Agazaryan]

Currently only the amd and svc I3C controller drivers populate
i3c_xfer.actual_len on reads, while dw-i3c-master and mipi-i3c-hci
overwrite i3c_xfer.len with the received byte count and leave actual_len
as 0. Because of this inconsistency, mctp-i3c reads xfer.len instead of
xfer.actual_len, making it fail on controllers that do not mutate len.

Unify read length reporting across the subsystem:
- Clarify in <linux/i3c/device.h> that actual_len reflects the actual
  number of bytes transferred on reads.
- Update adi, cdns, dw, mipi-i3c-hci, and renesas controller drivers to
  populate actual_len on read transfers without mutating len.
- Update mctp-i3c to read xfer.actual_len instead of xfer.len.

Co-developed-by: Meagan Lloyd <meaganlloyd@linux.microsoft.com>
Signed-off-by: Meagan Lloyd <meaganlloyd@linux.microsoft.com>
Signed-off-by: Sam Agazaryan <samagazaryan@google.com>
---
 drivers/i3c/master/adi-i3c-master.c    |  5 ++++-
 drivers/i3c/master/dw-i3c-master.c     |  2 +-
 drivers/i3c/master/i3c-master-cdns.c   |  5 ++++-
 drivers/i3c/master/mipi-i3c-hci/core.c |  2 +-
 drivers/i3c/master/renesas-i3c.c       |  3 +++
 drivers/net/mctp/mctp-i3c.c            | 10 +++++-----
 include/linux/i3c/device.h             |  2 +-
 7 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/drivers/i3c/master/adi-i3c-master.c b/drivers/i3c/master/adi-i3c-master.c
index b35386260350..d033bfd4ecc2 100644
--- a/drivers/i3c/master/adi-i3c-master.c
+++ b/drivers/i3c/master/adi-i3c-master.c
@@ -412,8 +412,11 @@ static int adi_i3c_master_i3c_xfers(struct i3c_dev_desc *dev,
 
 	ret = xfer->ret;
 
-	for (i = 0; i < nxfers; i++)
+	for (i = 0; i < nxfers; i++) {
 		xfers[i].err = adi_i3c_cmd_get_err(&xfer->cmds[i]);
+		if (xfers[i].rnw)
+			xfers[i].actual_len = xfer->cmds[i].rx_len;
+	}
 
 	return ret;
 }
diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
index 4563d8761ba0..28e8eb293747 100644
--- a/drivers/i3c/master/dw-i3c-master.c
+++ b/drivers/i3c/master/dw-i3c-master.c
@@ -1029,7 +1029,7 @@ static int dw_i3c_master_i3c_xfers(struct i3c_dev_desc *dev,
 		struct dw_i3c_cmd *cmd = &xfer->cmds[i];
 
 		if (i3c_xfers[i].rnw)
-			i3c_xfers[i].len = cmd->rx_len;
+			i3c_xfers[i].actual_len = cmd->rx_len;
 	}
 
 	ret = xfer->ret;
diff --git a/drivers/i3c/master/i3c-master-cdns.c b/drivers/i3c/master/i3c-master-cdns.c
index 2d98c1ce9b12..331062c10b31 100644
--- a/drivers/i3c/master/i3c-master-cdns.c
+++ b/drivers/i3c/master/i3c-master-cdns.c
@@ -795,8 +795,11 @@ static int cdns_i3c_master_i3c_xfers(struct i3c_dev_desc *dev,
 
 	ret = cdns_xfer->ret;
 
-	for (i = 0; i < nxfers; i++)
+	for (i = 0; i < nxfers; i++) {
 		xfers[i].err = cdns_i3c_cmd_get_err(&cdns_xfer->cmds[i]);
+		if (xfers[i].rnw)
+			xfers[i].actual_len = cdns_xfer->cmds[i].rx_len;
+	}
 
 	cdns_i3c_master_free_xfer(cdns_xfer);
 
diff --git a/drivers/i3c/master/mipi-i3c-hci/core.c b/drivers/i3c/master/mipi-i3c-hci/core.c
index dadf049bd4b5..f74c02fab9e3 100644
--- a/drivers/i3c/master/mipi-i3c-hci/core.c
+++ b/drivers/i3c/master/mipi-i3c-hci/core.c
@@ -509,7 +509,7 @@ static int i3c_hci_i3c_xfers(struct i3c_dev_desc *dev,
 		goto out;
 	for (i = 0; i < nxfers; i++) {
 		if (i3c_xfers[i].rnw)
-			i3c_xfers[i].len = RESP_DATA_LENGTH(xfer[i].response);
+			i3c_xfers[i].actual_len = RESP_DATA_LENGTH(xfer[i].response);
 		if (RESP_STATUS(xfer[i].response) != RESP_SUCCESS) {
 			ret = -EIO;
 			goto out;
diff --git a/drivers/i3c/master/renesas-i3c.c b/drivers/i3c/master/renesas-i3c.c
index 28c0927a0179..a3dcb4cd9b0e 100644
--- a/drivers/i3c/master/renesas-i3c.c
+++ b/drivers/i3c/master/renesas-i3c.c
@@ -918,6 +918,9 @@ static int renesas_i3c_i3c_xfers(struct i3c_dev_desc *dev, struct i3c_xfer *i3c_
 		time_left = renesas_i3c_wait_xfer(i3c, xfer);
 		if (!time_left)
 			xfer_failed = true;
+
+		if (i3c_xfers[i].rnw)
+			i3c_xfers[i].actual_len = cmd->rx_count;
 	}
 
 	if (xfer_failed)
diff --git a/drivers/net/mctp/mctp-i3c.c b/drivers/net/mctp/mctp-i3c.c
index 6d2bbae7477b..5f94c11a1712 100644
--- a/drivers/net/mctp/mctp-i3c.c
+++ b/drivers/net/mctp/mctp-i3c.c
@@ -131,12 +131,12 @@ static int mctp_i3c_read(struct mctp_i3c_device *mi)
 	if (rc < 0)
 		goto err;
 
-	if (WARN_ON_ONCE(xfer.len > mi->mrl)) {
+	if (WARN_ON_ONCE(xfer.actual_len > mi->mrl)) {
 		/* Bad i3c bus driver */
 		rc = -EIO;
 		goto err;
 	}
-	if (xfer.len < MCTP_I3C_MINLEN) {
+	if (xfer.actual_len < MCTP_I3C_MINLEN) {
 		stats->rx_length_errors++;
 		rc = -EIO;
 		goto err;
@@ -145,15 +145,15 @@ static int mctp_i3c_read(struct mctp_i3c_device *mi)
 	/* check PEC, including address byte */
 	addr = mi->addr << 1 | 1;
 	pec = i2c_smbus_pec(0, &addr, 1);
-	pec = i2c_smbus_pec(pec, xfer.data.in, xfer.len - 1);
-	if (pec != ((u8 *)xfer.data.in)[xfer.len - 1]) {
+	pec = i2c_smbus_pec(pec, xfer.data.in, xfer.actual_len - 1);
+	if (pec != ((u8 *)xfer.data.in)[xfer.actual_len - 1]) {
 		stats->rx_crc_errors++;
 		rc = -EINVAL;
 		goto err;
 	}
 
 	/* Remove PEC */
-	skb_trim(skb, xfer.len - 1);
+	skb_trim(skb, xfer.actual_len - 1);
 
 	cb = __mctp_cb(skb);
 	cb->halen = PID_SIZE;
diff --git a/include/linux/i3c/device.h b/include/linux/i3c/device.h
index 971d53349b6f..f868a7bf2bc9 100644
--- a/include/linux/i3c/device.h
+++ b/include/linux/i3c/device.h
@@ -59,7 +59,7 @@ enum i3c_xfer_mode {
  * @rnw: encodes the transfer direction. true for a read, false for a write
  * @cmd: Read/Write command in HDR mode, read: 0x80 - 0xff, write: 0x00 - 0x7f
  * @len: transfer length in bytes of the transfer
- * @actual_len: actual length in bytes are transferred by the controller
+ * @actual_len: actual length in bytes transferred by the controller on read
  * @data: input/output buffer
  * @data.in: input buffer. Must point to a DMA-able buffer
  * @data.out: output buffer. Must point to a DMA-able buffer
-- 
2.55.0.1082.g2b9226bbc0-goog

[PATCH v5 4/5] i3c: add i3cdev module to expose i3c dev in /dev

[Sam Agazaryan]

From: Vitor Soares <vitor.soares@toradex.com>

Add userspace character device support for I3C transfers via /dev.

The module allows userspace programs to interact directly with I3C
targets that do not have a kernel driver bound to them, such as devices
in ROM/bootloader recovery mode (e.g. OCP Secure Firmware Recovery v1.1
and Caliptra Silicon Root of Trust recovery flows).

Features:
  - Dynamically exposes /dev/bus/i3c/<device> character devices for I3C
    devices when unbound from kernel drivers.
  - Dynamically allocates character device minor numbers using the IDA
    allocator.
  - Implements SDR and HDR transfers via I3C_IOC_XFER ioctl with 64-bit
    aligned UAPI data structures and actual_len read reporting.
  - Supports compat_ptr_ioctl for 32-bit userspace on 64-bit kernels.
  - Uses cdev_device_add/cdev_device_del with device refcounting to ensure
    safe lifecycle management and prevent use-after-free on driver detach.

Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
Co-developed-by: Oleksandr Shulzhenko <oleksandr.shulzhenko.viktorovych@intel.com>
Signed-off-by: Oleksandr Shulzhenko <oleksandr.shulzhenko.viktorovych@intel.com>
Co-developed-by: Sam Agazaryan <samagazaryan@google.com>
Signed-off-by: Sam Agazaryan <samagazaryan@google.com>
---
 MAINTAINERS                     |   1 +
 drivers/i3c/Kconfig             |  11 +
 drivers/i3c/Makefile            |   1 +
 drivers/i3c/i3cdev.c            | 491 ++++++++++++++++++++++++++++++++
 include/uapi/linux/i3c/i3cdev.h |  57 ++++
 5 files changed, 561 insertions(+)
 create mode 100644 drivers/i3c/i3cdev.c
 create mode 100644 include/uapi/linux/i3c/i3cdev.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 81a9a02c919d..30a5cb12c4f0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -12364,6 +12364,7 @@ F:	Documentation/driver-api/i3c
 F:	drivers/i3c/
 F:	include/dt-bindings/i3c/
 F:	include/linux/i3c/
+F:	include/uapi/linux/i3c/
 
 IBM Operation Panel Input Driver
 M:	Eddie James <eajames@linux.ibm.com>
diff --git a/drivers/i3c/Kconfig b/drivers/i3c/Kconfig
index 626c54b386d5..166875837ec6 100644
--- a/drivers/i3c/Kconfig
+++ b/drivers/i3c/Kconfig
@@ -20,6 +20,17 @@ menuconfig I3C
 	  will be called i3c.
 
 if I3C
+
+config I3CDEV
+	tristate "I3C device interface"
+	help
+	  Say Y here to use i3c-* device files, usually found in the /dev
+	  directory on your system.  They make it possible to have user-space
+	  programs use the I3C devices.
+
+	  This support is also available as a module.  If so, the module
+	  will be called i3cdev.
+
 source "drivers/i3c/master/Kconfig"
 endif # I3C
 
diff --git a/drivers/i3c/Makefile b/drivers/i3c/Makefile
index 11982efbc6d9..606d422841b2 100644
--- a/drivers/i3c/Makefile
+++ b/drivers/i3c/Makefile
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
 i3c-y				:= device.o master.o
 obj-$(CONFIG_I3C)		+= i3c.o
+obj-$(CONFIG_I3CDEV)		+= i3cdev.o
 obj-$(CONFIG_I3C)		+= master/
diff --git a/drivers/i3c/i3cdev.c b/drivers/i3c/i3cdev.c
new file mode 100644
index 000000000000..309ce8181209
--- /dev/null
+++ b/drivers/i3c/i3cdev.c
@@ -0,0 +1,491 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2020 Synopsys, Inc. and/or its affiliates.
+ * Copyright (c) 2026 Google LLC
+ *
+ * Author: Vitor Soares <soares@synopsys.com>
+ * Author: Sam Agazaryan <samagazaryan@google.com>
+ */
+
+#include <linux/cdev.h>
+#include <linux/cleanup.h>
+#include <linux/compat.h>
+#include <linux/device.h>
+#include <linux/fs.h>
+#include <linux/init.h>
+#include <linux/jiffies.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/module.h>
+#include <linux/notifier.h>
+#include <linux/overflow.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+
+#include <linux/i3c/i3cdev.h>
+
+#include "internals.h"
+
+struct i3cdev_data {
+	struct list_head list;
+	struct i3c_device *i3c;
+	struct device dev;
+	struct mutex xfer_lock; /* prevent detach while transferring */
+	struct cdev cdev;
+	int id;
+};
+
+static DEFINE_IDA(i3cdev_ida);
+static LIST_HEAD(i3cdev_list);
+static DEFINE_MUTEX(i3cdev_attach_lock);
+static dev_t i3cdev_number;
+#define I3C_MINORS (MINORMASK + 1)
+
+static void i3cdev_dev_release(struct device *dev)
+{
+	struct i3cdev_data *i3cdev = container_of(dev, struct i3cdev_data, dev);
+
+	ida_free(&i3cdev_ida, i3cdev->id);
+	kfree(i3cdev);
+}
+
+static struct i3cdev_data *i3cdev_get_by_i3c(struct i3c_device *i3c)
+{
+	struct i3cdev_data *i3cdev;
+
+	list_for_each_entry(i3cdev, &i3cdev_list, list) {
+		if (i3cdev->i3c == i3c)
+			return i3cdev;
+	}
+
+	return NULL;
+}
+
+static struct i3cdev_data *get_free_i3cdev(struct i3c_device *i3c)
+{
+	struct i3cdev_data *i3cdev;
+	int id;
+
+	id = ida_alloc_max(&i3cdev_ida, MINORMASK, GFP_KERNEL);
+	if (id < 0) {
+		pr_err("i3cdev: no minor number available!\n");
+		return ERR_PTR(id);
+	}
+
+	i3cdev = kzalloc_obj(*i3cdev, GFP_KERNEL);
+	if (!i3cdev) {
+		ida_free(&i3cdev_ida, id);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	i3cdev->i3c = i3c;
+	i3cdev->id = id;
+	list_add_tail(&i3cdev->list, &i3cdev_list);
+
+	return i3cdev;
+}
+
+static ssize_t
+i3cdev_read(struct file *file, char __user *buf, size_t count, loff_t *f_pos)
+{
+	char *tmp __free(kfree) = NULL;
+	struct i3cdev_data *i3cdev = file->private_data;
+	struct i3c_xfer xfers = {
+		.rnw = true,
+	};
+	struct i3c_device *i3c;
+	int ret;
+
+	count = min_t(size_t, count, type_max(xfers.len));
+	xfers.len = count;
+
+	tmp = kzalloc(count, GFP_KERNEL);
+	if (!tmp)
+		return -ENOMEM;
+
+	guard(mutex)(&i3cdev->xfer_lock);
+	i3c = i3cdev->i3c;
+	if (!i3c || i3c->dev.driver)
+		return -ENODEV;
+
+	xfers.data.in = tmp;
+
+	dev_dbg(&i3c->dev, "Reading %zu bytes.\n", count);
+
+	ret = i3c_device_do_xfers(i3c, &xfers, 1, I3C_SDR);
+	if (ret)
+		return ret;
+
+	if (copy_to_user(buf, tmp, xfers.actual_len))
+		return -EFAULT;
+
+	return xfers.actual_len;
+}
+
+static ssize_t
+i3cdev_write(struct file *file, const char __user *buf, size_t count,
+	     loff_t *f_pos)
+{
+	void *tmp __free(kfree) = NULL;
+	struct i3cdev_data *i3cdev = file->private_data;
+	struct i3c_xfer xfers = {
+		.rnw = false,
+	};
+	struct i3c_device *i3c;
+	int ret;
+
+	count = min_t(size_t, count, type_max(xfers.len));
+	xfers.len = count;
+
+	tmp = memdup_user(buf, count);
+	if (IS_ERR(tmp))
+		return PTR_ERR(tmp);
+
+	guard(mutex)(&i3cdev->xfer_lock);
+	i3c = i3cdev->i3c;
+	if (!i3c || i3c->dev.driver)
+		return -ENODEV;
+
+	xfers.data.out = tmp;
+
+	dev_dbg(&i3c->dev, "Writing %zu bytes.\n", count);
+
+	ret = i3c_device_do_xfers(i3c, &xfers, 1, I3C_SDR);
+	if (ret)
+		return ret;
+
+	return count;
+}
+
+static int
+i3cdev_do_xfer(struct i3c_device *dev, struct i3c_ioc_xfer *xfers,
+	       struct i3c_ioc_xfer __user *u_xfers, unsigned int nxfers)
+{
+	struct i3c_xfer *k_xfers __free(kfree) = NULL;
+	enum i3c_xfer_mode mode = xfers[0].mode;
+	u8 **data_ptrs;
+	int i, j, nalloc, ret = 0;
+
+	/* Since we have nxfers we may allocate k_xfer + *data_ptrs together */
+	k_xfers = kcalloc(nxfers, sizeof(*k_xfers) + sizeof(*data_ptrs),
+			  GFP_KERNEL);
+	if (!k_xfers)
+		return -ENOMEM;
+
+	/* set data_ptrs to be after nxfers * i3c_xfer */
+	data_ptrs = (void *)k_xfers + (nxfers * sizeof(*k_xfers));
+
+	for (i = 0; i < nxfers; i++) {
+		bool is_read;
+
+		if (xfers[i].mode != mode) {
+			ret = -EINVAL;
+			break;
+		}
+
+		if (memchr_inv(xfers[i].pad, 0, sizeof(xfers[i].pad))) {
+			ret = -EINVAL;
+			break;
+		}
+
+		if (mode == I3C_SDR) {
+			if (xfers[i].rnw != I3C_DEV_DIR_WRITE &&
+			    xfers[i].rnw != I3C_DEV_DIR_READ) {
+				ret = -EINVAL;
+				break;
+			}
+			is_read = xfers[i].rnw == I3C_DEV_DIR_READ;
+		} else {
+			is_read = xfers[i].cmd & 0x80;
+		}
+
+		if (is_read) {
+			data_ptrs[i] = kzalloc(xfers[i].len, GFP_KERNEL);
+			if (!data_ptrs[i]) {
+				ret = -ENOMEM;
+				break;
+			}
+			k_xfers[i].data.in = data_ptrs[i];
+		} else {
+			data_ptrs[i] = memdup_user(u64_to_user_ptr(xfers[i].data),
+						   xfers[i].len);
+			if (IS_ERR(data_ptrs[i])) {
+				ret = PTR_ERR(data_ptrs[i]);
+				break;
+			}
+			k_xfers[i].data.out = data_ptrs[i];
+		}
+
+		k_xfers[i].cmd = xfers[i].cmd;
+		k_xfers[i].len = xfers[i].len;
+	}
+	nalloc = i;
+
+	if (ret < 0)
+		goto err_free_mem;
+
+	ret = i3c_device_do_xfers(dev, k_xfers, nxfers, mode);
+	if (ret)
+		goto err_free_mem;
+
+	for (i = 0; i < nxfers; i++) {
+		bool is_read = (mode == I3C_SDR) ?
+			       (xfers[i].rnw == I3C_DEV_DIR_READ) :
+			       (xfers[i].cmd & 0x80);
+
+		if (is_read) {
+			if (copy_to_user(u64_to_user_ptr(xfers[i].data),
+					 data_ptrs[i], k_xfers[i].actual_len) ||
+			    put_user(k_xfers[i].actual_len,
+				     &u_xfers[i].actual_len)) {
+				ret = -EFAULT;
+				break;
+			}
+		}
+	}
+
+err_free_mem:
+	for (j = 0; j < nalloc; j++)
+		kfree(data_ptrs[j]);
+	return ret;
+}
+
+static struct i3c_ioc_xfer *
+i3cdev_get_ioc_xfer(unsigned int cmd, struct i3c_ioc_xfer __user *u_xfers,
+		    unsigned int *nxfers)
+{
+	u32 tmp = _IOC_SIZE(cmd);
+
+	if ((tmp % sizeof(struct i3c_ioc_xfer)) != 0)
+		return ERR_PTR(-EINVAL);
+
+	*nxfers = tmp / sizeof(struct i3c_ioc_xfer);
+	if (*nxfers == 0)
+		return ERR_PTR(-EINVAL);
+
+	return memdup_user(u_xfers, tmp);
+}
+
+static int
+i3cdev_ioc_xfer(struct i3c_device *i3c, unsigned int cmd,
+		struct i3c_ioc_xfer __user *u_xfers)
+{
+	struct i3c_ioc_xfer *k_xfers __free(kfree) = NULL;
+	unsigned int nxfers;
+
+	k_xfers = i3cdev_get_ioc_xfer(cmd, u_xfers, &nxfers);
+	if (IS_ERR(k_xfers))
+		return PTR_ERR(k_xfers);
+
+	return i3cdev_do_xfer(i3c, k_xfers, u_xfers, nxfers);
+}
+
+static long
+i3cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+	struct i3cdev_data *i3cdev = file->private_data;
+	struct i3c_device *i3c;
+
+	if (_IOC_TYPE(cmd) != I3C_DEV_IOC_MAGIC)
+		return -ENOTTY;
+
+	/* Use the xfer_lock to prevent device detach during ioctl call */
+	guard(mutex)(&i3cdev->xfer_lock);
+	i3c = i3cdev->i3c;
+	if (!i3c || i3c->dev.driver)
+		return -ENODEV;
+
+	dev_dbg(&i3c->dev, "ioctl, cmd=0x%02x, arg=0x%02lx\n", cmd, arg);
+
+	/* Check command number and direction */
+	if (_IOC_NR(cmd) == _IOC_NR(I3C_IOC_XFER(0)) &&
+	    _IOC_DIR(cmd) == (_IOC_READ | _IOC_WRITE))
+		return i3cdev_ioc_xfer(i3c, cmd,
+				       (struct i3c_ioc_xfer __user *)arg);
+
+	return -ENOTTY;
+}
+
+static int i3cdev_open(struct inode *inode, struct file *file)
+{
+	struct i3cdev_data *i3cdev = container_of(inode->i_cdev,
+						  struct i3cdev_data,
+						  cdev);
+	file->private_data = i3cdev;
+
+	return 0;
+}
+
+static int i3cdev_release(struct inode *inode, struct file *file)
+{
+	file->private_data = NULL;
+
+	return 0;
+}
+
+static const struct file_operations i3cdev_fops = {
+	.owner		= THIS_MODULE,
+	.read		= i3cdev_read,
+	.write		= i3cdev_write,
+	.unlocked_ioctl	= i3cdev_ioctl,
+	.compat_ioctl	= compat_ptr_ioctl,
+	.open		= i3cdev_open,
+	.release	= i3cdev_release,
+};
+
+/* ------------------------------------------------------------------------- */
+
+static const struct class i3cdev_class = {
+	.name = "i3cdev",
+};
+
+static int i3cdev_attach(struct device *dev, void *dummy)
+{
+	struct i3cdev_data *i3cdev;
+	struct i3c_device *i3c;
+	int res;
+
+	if (dev->type == &i3c_masterdev_type)
+		return 0;
+
+	i3c = dev_to_i3cdev(dev);
+
+	guard(mutex)(&i3cdev_attach_lock);
+	if (dev->driver || i3cdev_get_by_i3c(i3c))
+		return 0;
+
+	/* Get a device */
+	i3cdev = get_free_i3cdev(i3c);
+	if (IS_ERR(i3cdev))
+		return PTR_ERR(i3cdev);
+
+	mutex_init(&i3cdev->xfer_lock);
+	cdev_init(&i3cdev->cdev, &i3cdev_fops);
+	i3cdev->cdev.owner = THIS_MODULE;
+
+	device_initialize(&i3cdev->dev);
+	i3cdev->dev.devt = MKDEV(MAJOR(i3cdev_number), i3cdev->id);
+	i3cdev->dev.class = &i3cdev_class;
+	i3cdev->dev.parent = &i3c->dev;
+	i3cdev->dev.release = i3cdev_dev_release;
+
+	res = dev_set_name(&i3cdev->dev, "bus!i3c!%s", dev_name(&i3c->dev));
+	if (res)
+		goto error_put_dev;
+
+	res = cdev_device_add(&i3cdev->cdev, &i3cdev->dev);
+	if (res)
+		goto error_put_dev;
+
+	pr_debug("i3cdev: I3C device [%s] registered as minor %d\n",
+		 dev_name(&i3c->dev), i3cdev->id);
+	return 0;
+
+error_put_dev:
+	list_del(&i3cdev->list);
+	put_device(&i3cdev->dev);
+	return res;
+}
+
+static int i3cdev_detach(struct device *dev, void *dummy)
+{
+	struct i3cdev_data *i3cdev;
+	struct i3c_device *i3c;
+
+	if (dev->type == &i3c_masterdev_type)
+		return 0;
+
+	i3c = dev_to_i3cdev(dev);
+
+	guard(mutex)(&i3cdev_attach_lock);
+	i3cdev = i3cdev_get_by_i3c(i3c);
+	if (!i3cdev)
+		return 0;
+
+	list_del(&i3cdev->list);
+
+	/* Prevent transfers while cdev removal */
+	scoped_guard(mutex, &i3cdev->xfer_lock)
+		i3cdev->i3c = NULL;
+
+	cdev_device_del(&i3cdev->cdev, &i3cdev->dev);
+	put_device(&i3cdev->dev);
+
+	pr_debug("i3cdev: device [%s] unregistered\n", dev_name(&i3c->dev));
+
+	return 0;
+}
+
+static int i3cdev_notifier_call(struct notifier_block *nb,
+				unsigned long action,
+				void *data)
+{
+	struct device *dev = data;
+
+	switch (action) {
+	case BUS_NOTIFY_ADD_DEVICE:
+	case BUS_NOTIFY_UNBOUND_DRIVER:
+	case BUS_NOTIFY_DRIVER_NOT_BOUND:
+		i3cdev_attach(dev, NULL);
+		break;
+	case BUS_NOTIFY_DEL_DEVICE:
+	case BUS_NOTIFY_REMOVED_DEVICE:
+	case BUS_NOTIFY_BIND_DRIVER:
+		i3cdev_detach(dev, NULL);
+		break;
+	}
+
+	return NOTIFY_OK;
+}
+
+static struct notifier_block i3cdev_notifier = {
+	.notifier_call = i3cdev_notifier_call,
+};
+
+static int __init i3cdev_init(void)
+{
+	int res;
+
+	/* Dynamically request unused major number */
+	res = alloc_chrdev_region(&i3cdev_number, 0, I3C_MINORS, "i3c");
+	if (res)
+		goto out;
+
+	/* Register device class to populate sysfs entries */
+	res = class_register(&i3cdev_class);
+	if (res)
+		goto out_unreg_chrdev;
+
+	/* Keep track of busses which have devices to add or remove later */
+	res = bus_register_notifier(&i3c_bus_type, &i3cdev_notifier);
+	if (res)
+		goto out_unreg_class;
+
+	/* Bind to already existing device without driver right away */
+	i3c_for_each_dev(NULL, i3cdev_attach);
+
+	return 0;
+
+out_unreg_class:
+	class_unregister(&i3cdev_class);
+out_unreg_chrdev:
+	unregister_chrdev_region(i3cdev_number, I3C_MINORS);
+out:
+	pr_err("%s: Driver Initialisation failed\n", __FILE__);
+	return res;
+}
+
+static void __exit i3cdev_exit(void)
+{
+	bus_unregister_notifier(&i3c_bus_type, &i3cdev_notifier);
+	i3c_for_each_dev(NULL, i3cdev_detach);
+	class_unregister(&i3cdev_class);
+	unregister_chrdev_region(i3cdev_number, I3C_MINORS);
+}
+
+MODULE_AUTHOR("Vitor Soares <soares@synopsys.com>");
+MODULE_DESCRIPTION("I3C /dev entries driver");
+MODULE_LICENSE("GPL");
+
+module_init(i3cdev_init);
+module_exit(i3cdev_exit);
diff --git a/include/uapi/linux/i3c/i3cdev.h b/include/uapi/linux/i3c/i3cdev.h
new file mode 100644
index 000000000000..69e901017378
--- /dev/null
+++ b/include/uapi/linux/i3c/i3cdev.h
@@ -0,0 +1,57 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2020 Synopsys, Inc. and/or its affiliates.
+ * Copyright (c) 2026 Google LLC
+ *
+ * Author: Vitor Soares <vitor.soares@synopsys.com>
+ */
+
+#ifndef _UAPI_I3C_DEV_H_
+#define _UAPI_I3C_DEV_H_
+
+#include <linux/types.h>
+#include <linux/ioctl.h>
+
+/* IOCTL commands */
+#define I3C_DEV_IOC_MAGIC	0x07
+
+#define I3C_DEV_DIR_WRITE	0
+#define I3C_DEV_DIR_READ	1
+
+#define I3C_XFER_MODE_HDR_DDR	0
+#define I3C_XFER_MODE_HDR_TSP	1
+#define I3C_XFER_MODE_HDR_TSL	2
+#define I3C_XFER_MODE_SDR	31
+
+/**
+ * struct i3c_ioc_xfer - I3C ioctl transfer
+ * @data: Holds pointer to userspace buffer with transmit/receive data.
+ * @len: Length of data buffer, in bytes.
+ * @actual_len: Actual length of data transferred on read, in bytes (output).
+ * @rnw: Transfer direction for SDR mode (I3C_DEV_DIR_WRITE or I3C_DEV_DIR_READ).
+ * @cmd: Command byte for HDR mode (0x00-0x7f write, 0x80-0xff read).
+ * @mode: Transfer mode (I3C_XFER_MODE_SDR, I3C_XFER_MODE_HDR_DDR, etc.).
+ * @pad: Reserved for future extensions; must be zeroed.
+ */
+struct i3c_ioc_xfer {
+	__u64 data;
+	__u16 len;
+	__u16 actual_len;
+	union {
+		__u8 rnw;
+		__u8 cmd;
+	};
+	__u8 mode;
+	__u8 pad[2];
+};
+
+#define __I3C_XFER_SIZE(type)	\
+	((((sizeof(struct i3c_ioc_xfer)) * (type)) < (1 << _IOC_SIZEBITS)) \
+	? ((sizeof(struct i3c_ioc_xfer)) * (type)) : 0)
+
+#define I3C_XFER_SIZE(N)	__I3C_XFER_SIZE(N)
+
+#define I3C_IOC_XFER(N)	\
+	_IOC(_IOC_READ | _IOC_WRITE, I3C_DEV_IOC_MAGIC, 30, I3C_XFER_SIZE(N))
+
+#endif
-- 
2.55.0.1082.g2b9226bbc0-goog

[PATCH v5 5/5] tools: i3c: add i3ctransfer utility

[Sam Agazaryan]

Add the i3ctransfer userspace utility to tools/i3c/ for testing and
interacting with I3C target devices via /dev/bus/i3c/* character
devices.

Based on the i3ctransfer tool from i3c-tools by Vitor Soares, updated
for the unified I3C_IOC_XFER UAPI (struct i3c_ioc_xfer):
  - Supports SDR and HDR (HDR-DDR, HDR-TSP, HDR-TSL) transfer modes
    via -m/--mode and -c/--command options.
  - Reports actual_len bytes received on read transfers.

Signed-off-by: Sam Agazaryan <samagazaryan@google.com>
---
Note to Vitor Soares:
  This patch ports your GPL-2.0 i3ctransfer utility from i3c-tools into
  tools/i3c/ and updates it for struct i3c_ioc_xfer (SDR/HDR modes and
  actual_len read reporting). Since the original GitHub commit did not
  include a Signed-off-by tag, could you please reply with your
  Signed-off-by or Acked-by so we can properly record your sign-off?

 MAINTAINERS             |   1 +
 tools/Makefile          |  13 +-
 tools/i3c/Build         |   1 +
 tools/i3c/Makefile      |  58 ++++++++
 tools/i3c/i3ctransfer.c | 307 ++++++++++++++++++++++++++++++++++++++++
 5 files changed, 374 insertions(+), 6 deletions(-)
 create mode 100644 tools/i3c/Build
 create mode 100644 tools/i3c/Makefile
 create mode 100644 tools/i3c/i3ctransfer.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 30a5cb12c4f0..8a4166ebc9dc 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -12365,6 +12365,7 @@ F:	drivers/i3c/
 F:	include/dt-bindings/i3c/
 F:	include/linux/i3c/
 F:	include/uapi/linux/i3c/
+F:	tools/i3c/
 
 IBM Operation Panel Input Driver
 M:	Eddie James <eajames@linux.ibm.com>
diff --git a/tools/Makefile b/tools/Makefile
index cb40961a740f..7c17e7555fd7 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -20,6 +20,7 @@ help:
 	@echo '  freefall               - laptop accelerometer program for disk protection'
 	@echo '  gpio                   - GPIO tools'
 	@echo '  hv                     - tools used when in Hyper-V clients'
+	@echo '  i3c                    - I3C tools'
 	@echo '  iio                    - IIO tools'
 	@echo '  intel-speed-select     - Intel Speed Select tool'
 	@echo '  kvm_stat               - top-like utility for displaying kvm statistics'
@@ -70,7 +71,7 @@ acpi: FORCE
 cpupower: FORCE
 	$(call descend,power/$@)
 
-counter dma firewire hv guest bootconfig spi usb virtio mm bpf iio gpio objtool leds wmi firmware debugging tracing: FORCE
+counter dma firewire hv guest bootconfig spi usb virtio mm bpf i3c iio gpio objtool leds wmi firmware debugging tracing: FORCE
 	$(call descend,$@)
 
 bpf/%: FORCE
@@ -126,7 +127,7 @@ ynl: FORCE
 all: acpi counter cpupower dma gpio hv firewire \
 		perf selftests bootconfig spi turbostat usb \
 		virtio mm bpf x86_energy_perf_policy \
-		tmon freefall iio objtool kvm_stat wmi \
+		tmon freefall i3c iio objtool kvm_stat wmi \
 		debugging tracing thermal thermometer thermal-engine ynl
 
 acpi_install:
@@ -135,7 +136,7 @@ acpi_install:
 cpupower_install:
 	$(call descend,power/$(@:_install=),install)
 
-counter_install dma_install firewire_install gpio_install hv_install iio_install perf_install bootconfig_install spi_install usb_install virtio_install mm_install bpf_install objtool_install wmi_install debugging_install tracing_install:
+counter_install dma_install firewire_install gpio_install hv_install i3c_install iio_install perf_install bootconfig_install spi_install usb_install virtio_install mm_install bpf_install objtool_install wmi_install debugging_install tracing_install:
 	$(call descend,$(@:_install=),install)
 
 selftests_install:
@@ -166,7 +167,7 @@ ynl_install:
 	$(call descend,net/$(@:_install=),install)
 
 install: acpi_install counter_install cpupower_install dma_install gpio_install \
-		hv_install firewire_install iio_install \
+		hv_install firewire_install i3c_install iio_install \
 		perf_install selftests_install turbostat_install usb_install \
 		virtio_install mm_install bpf_install x86_energy_perf_policy_install \
 		tmon_install freefall_install objtool_install kvm_stat_install \
@@ -179,7 +180,7 @@ acpi_clean:
 cpupower_clean:
 	$(call descend,power/cpupower,clean)
 
-counter_clean dma_clean hv_clean firewire_clean bootconfig_clean spi_clean usb_clean virtio_clean mm_clean wmi_clean bpf_clean iio_clean gpio_clean objtool_clean leds_clean firmware_clean debugging_clean tracing_clean:
+counter_clean dma_clean hv_clean firewire_clean bootconfig_clean spi_clean usb_clean virtio_clean mm_clean wmi_clean bpf_clean i3c_clean iio_clean gpio_clean objtool_clean leds_clean firmware_clean debugging_clean tracing_clean:
 	$(call descend,$(@:_clean=),clean)
 
 libapi_clean:
@@ -227,7 +228,7 @@ ynl_clean:
 
 clean: acpi_clean counter_clean cpupower_clean dma_clean hv_clean firewire_clean \
 		perf_clean selftests_clean turbostat_clean bootconfig_clean spi_clean usb_clean virtio_clean \
-		mm_clean bpf_clean iio_clean x86_energy_perf_policy_clean tmon_clean \
+		mm_clean bpf_clean i3c_clean iio_clean x86_energy_perf_policy_clean tmon_clean \
 		freefall_clean build_clean libbpf_clean libsubcmd_clean \
 		gpio_clean objtool_clean leds_clean wmi_clean firmware_clean debugging_clean \
 		intel-speed-select_clean tracing_clean thermal_clean thermometer_clean thermal-engine_clean \
diff --git a/tools/i3c/Build b/tools/i3c/Build
new file mode 100644
index 000000000000..6a22328ad983
--- /dev/null
+++ b/tools/i3c/Build
@@ -0,0 +1 @@
+i3ctransfer-y += i3ctransfer.o
diff --git a/tools/i3c/Makefile b/tools/i3c/Makefile
new file mode 100644
index 000000000000..43ce8769185b
--- /dev/null
+++ b/tools/i3c/Makefile
@@ -0,0 +1,58 @@
+# SPDX-License-Identifier: GPL-2.0-only
+include ../scripts/Makefile.include
+
+bindir ?= /usr/bin
+
+ifeq ($(srctree),)
+srctree := $(patsubst %/,%,$(dir $(CURDIR)))
+srctree := $(patsubst %/,%,$(dir $(srctree)))
+endif
+
+# Do not use make's built-in rules
+# (this improves performance and avoids hard-to-debug behaviour);
+MAKEFLAGS += -r
+
+CFLAGS += -O2 -Wall -g -D_GNU_SOURCE -I$(OUTPUT)include
+
+ALL_TARGETS := i3ctransfer
+ALL_PROGRAMS := $(patsubst %,$(OUTPUT)%,$(ALL_TARGETS))
+
+all: $(ALL_PROGRAMS)
+
+export srctree OUTPUT CC LD CFLAGS
+include $(srctree)/tools/build/Makefile.include
+
+#
+# We need the following to be outside of kernel tree
+#
+$(OUTPUT)include/linux/i3c: ../../include/uapi/linux/i3c
+	mkdir -p $(OUTPUT)include/linux/i3c 2>&1 || true
+	ln -sf $(CURDIR)/../../include/uapi/linux/i3c/i3cdev.h $@
+
+prepare: $(OUTPUT)include/linux/i3c
+
+#
+# i3ctransfer
+#
+I3CTRANSFER_IN := $(OUTPUT)i3ctransfer-in.o
+$(I3CTRANSFER_IN): prepare FORCE
+	$(Q)$(MAKE) $(build)=i3ctransfer
+$(OUTPUT)i3ctransfer: $(I3CTRANSFER_IN)
+	$(QUIET_LINK)$(CC) $(CFLAGS) $(LDFLAGS) $< -o $@
+
+clean:
+	rm -f $(ALL_PROGRAMS)
+	rm -rf $(OUTPUT)include/
+	find $(or $(OUTPUT),.) -name '*.o' -delete
+	find $(or $(OUTPUT),.) -name '\.*.o.d' -delete
+	find $(or $(OUTPUT),.) -name '\.*.o.cmd' -delete
+
+install: $(ALL_PROGRAMS)
+	install -d -m 755 $(DESTDIR)$(bindir);		\
+	for program in $(ALL_PROGRAMS); do		\
+		install $$program $(DESTDIR)$(bindir);	\
+	done
+
+FORCE:
+
+.PHONY: all install clean FORCE prepare
diff --git a/tools/i3c/i3ctransfer.c b/tools/i3c/i3ctransfer.c
new file mode 100644
index 000000000000..a5b071e63530
--- /dev/null
+++ b/tools/i3c/i3ctransfer.c
@@ -0,0 +1,307 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 Synopsys, Inc. and/or its affiliates.
+ * Copyright (c) 2026 Google LLC
+ *
+ * Author: Vitor Soares <vitor.soares@synopsys.com>
+ */
+
+#include <ctype.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <getopt.h>
+#include <limits.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+#include <linux/i3c/i3cdev.h>
+
+#define VERSION "0.2"
+
+static const char *sopts = "d:m:c:r:w:vh";
+static const struct option lopts[] = {
+	{"device",		required_argument,	NULL,	'd' },
+	{"mode",		required_argument,	NULL,	'm' },
+	{"command",		required_argument,	NULL,	'c' },
+	{"read",		required_argument,	NULL,	'r' },
+	{"write",		required_argument,	NULL,	'w' },
+	{"help",		no_argument,		NULL,	'h' },
+	{"version",		no_argument,		NULL,	'v' },
+	{0, 0, 0, 0}
+};
+
+static void print_usage(const char *name)
+{
+	fprintf(stderr, "usage: %s options...\n", name);
+	fprintf(stderr, "  options:\n");
+	fprintf(stderr, "    -d --device  <dev>    device to use.\n");
+	fprintf(stderr,
+		"    -m --mode    <mode>   sdr (default), hdr-ddr, hdr-tsp, hdr-tsl.\n");
+	fprintf(stderr,
+		"    -c --command <cmd>    HDR command byte (0x00-0x7f W, 0x80-0xff R).\n");
+	fprintf(stderr, "    -r --read    <len>    read data length in bytes.\n");
+	fprintf(stderr,
+		"    -w --write   <block>  write comma-separated bytes (e.g. 0x01,0x02).\n");
+	fprintf(stderr, "    -h --help             output usage message and exit.\n");
+	fprintf(stderr, "    -v --version          output version number and exit.\n");
+}
+
+static int parse_mode(const char *arg, uint8_t *mode)
+{
+	char *endptr;
+	long val;
+
+	if (!strcmp(arg, "sdr")) {
+		*mode = I3C_XFER_MODE_SDR;
+		return 0;
+	}
+	if (!strcmp(arg, "hdr-ddr") || !strcmp(arg, "ddr")) {
+		*mode = I3C_XFER_MODE_HDR_DDR;
+		return 0;
+	}
+	if (!strcmp(arg, "hdr-tsp") || !strcmp(arg, "tsp")) {
+		*mode = I3C_XFER_MODE_HDR_TSP;
+		return 0;
+	}
+	if (!strcmp(arg, "hdr-tsl") || !strcmp(arg, "tsl")) {
+		*mode = I3C_XFER_MODE_HDR_TSL;
+		return 0;
+	}
+
+	val = strtol(arg, &endptr, 0);
+	if (*endptr == '\0' &&
+	    (val == I3C_XFER_MODE_HDR_DDR ||
+	     val == I3C_XFER_MODE_HDR_TSP ||
+	     val == I3C_XFER_MODE_HDR_TSL ||
+	     val == I3C_XFER_MODE_SDR)) {
+		*mode = (uint8_t)val;
+		return 0;
+	}
+
+	fprintf(stderr, "Error: invalid transfer mode '%s'\n", arg);
+	return -1;
+}
+
+static int rx_args_to_xfer(struct i3c_ioc_xfer *xfer, char *arg,
+			   uint8_t mode, int cmd)
+{
+	char *endptr;
+	uint8_t *tmp;
+	long len;
+
+	len = strtol(arg, &endptr, 0);
+	if (*endptr != '\0' || len <= 0 || len > UINT16_MAX) {
+		fprintf(stderr, "Error: invalid read length '%s'\n", arg);
+		return -1;
+	}
+
+	if (mode == I3C_XFER_MODE_SDR) {
+		xfer->rnw = I3C_DEV_DIR_READ;
+	} else {
+		if (cmd < 0 || !(cmd & 0x80)) {
+			fprintf(stderr,
+				"Error: HDR read requires command (-c) in range 0x80..0xff\n");
+			return -1;
+		}
+		xfer->cmd = (uint8_t)cmd;
+	}
+
+	tmp = calloc(len, sizeof(uint8_t));
+	if (!tmp)
+		return -1;
+
+	xfer->mode = mode;
+	xfer->len = (uint16_t)len;
+	xfer->data = (uintptr_t)tmp;
+
+	return 0;
+}
+
+static int w_args_to_xfer(struct i3c_ioc_xfer *xfer, char *arg,
+			  uint8_t mode, int cmd)
+{
+	char *data_ptrs[256];
+	int len, i = 0;
+	uint8_t *tmp;
+
+	if (mode == I3C_XFER_MODE_SDR) {
+		xfer->rnw = I3C_DEV_DIR_WRITE;
+	} else {
+		if (cmd < 0 || (cmd & 0x80)) {
+			fprintf(stderr,
+				"Error: HDR write requires command (-c) in range 0x00..0x7f\n");
+			return -1;
+		}
+		xfer->cmd = (uint8_t)cmd;
+	}
+
+	data_ptrs[i] = strtok(arg, ",");
+	while (data_ptrs[i] && i < 255)
+		data_ptrs[++i] = strtok(NULL, ",");
+
+	if (i == 0) {
+		fprintf(stderr, "Error: empty write data block\n");
+		return -1;
+	}
+
+	tmp = calloc(i, sizeof(uint8_t));
+	if (!tmp)
+		return -1;
+
+	for (len = 0; len < i; len++) {
+		char *endptr;
+		long val = strtol(data_ptrs[len], &endptr, 0);
+
+		if (*endptr != '\0' || val < 0 || val > UINT8_MAX) {
+			fprintf(stderr, "Error: invalid byte value '%s'\n",
+				data_ptrs[len]);
+			free(tmp);
+			return -1;
+		}
+		tmp[len] = (uint8_t)val;
+	}
+
+	xfer->mode = mode;
+	xfer->len = (uint16_t)len;
+	xfer->data = (uintptr_t)tmp;
+
+	return 0;
+}
+
+static void print_rx_data(const struct i3c_ioc_xfer *xfer)
+{
+	const uint8_t *tmp = (const uint8_t *)(uintptr_t)xfer->data;
+	int i;
+
+	fprintf(stdout, "  received data (%u bytes):\n", xfer->actual_len);
+	for (i = 0; i < xfer->actual_len; i++)
+		fprintf(stdout, "    0x%02x\n", tmp[i]);
+}
+
+int main(int argc, char *argv[])
+{
+	uint8_t mode = I3C_XFER_MODE_SDR;
+	struct i3c_ioc_xfer *xfers;
+	char *device = NULL;
+	int file, ret, opt, i;
+	int nxfers = 0;
+	int cmd = -1;
+
+	while ((opt = getopt_long(argc, argv, sopts, lopts, NULL)) != EOF) {
+		switch (opt) {
+		case 'h':
+			print_usage(argv[0]);
+			return EXIT_SUCCESS;
+		case 'v':
+			fprintf(stderr, "%s - %s\n", argv[0], VERSION);
+			return EXIT_SUCCESS;
+		case 'd':
+			device = optarg;
+			break;
+		case 'm':
+			if (parse_mode(optarg, &mode))
+				return EXIT_FAILURE;
+			break;
+		case 'c': {
+			char *endptr;
+			long val = strtol(optarg, &endptr, 0);
+
+			if (*endptr != '\0' || val < 0 || val > UINT8_MAX) {
+				fprintf(stderr, "Error: invalid command '%s'\n",
+					optarg);
+				return EXIT_FAILURE;
+			}
+			cmd = (int)val;
+			break;
+		}
+		case 'r':
+		case 'w':
+			nxfers++;
+			break;
+		default:
+			print_usage(argv[0]);
+			return EXIT_FAILURE;
+		}
+	}
+
+	if (!device || nxfers == 0) {
+		print_usage(argv[0]);
+		return EXIT_FAILURE;
+	}
+
+	file = open(device, O_RDWR);
+	if (file < 0) {
+		fprintf(stderr, "Error: failed to open %s: %s\n",
+			device, strerror(errno));
+		return EXIT_FAILURE;
+	}
+
+	xfers = calloc(nxfers, sizeof(*xfers));
+	if (!xfers) {
+		close(file);
+		return EXIT_FAILURE;
+	}
+
+	optind = 1;
+	nxfers = 0;
+	cmd = -1;
+
+	while ((opt = getopt_long(argc, argv, sopts, lopts, NULL)) != EOF) {
+		switch (opt) {
+		case 'h':
+		case 'v':
+		case 'd':
+		case 'm':
+			break;
+		case 'c':
+			cmd = (int)strtol(optarg, NULL, 0);
+			break;
+		case 'r':
+			if (rx_args_to_xfer(&xfers[nxfers], optarg, mode, cmd)) {
+				ret = EXIT_FAILURE;
+				goto err_free;
+			}
+			nxfers++;
+			break;
+		case 'w':
+			if (w_args_to_xfer(&xfers[nxfers], optarg, mode, cmd)) {
+				ret = EXIT_FAILURE;
+				goto err_free;
+			}
+			nxfers++;
+			break;
+		}
+	}
+
+	if (ioctl(file, I3C_IOC_XFER(nxfers), xfers) < 0) {
+		fprintf(stderr, "Error: transfer failed: %s\n", strerror(errno));
+		ret = EXIT_FAILURE;
+		goto err_free;
+	}
+
+	for (i = 0; i < nxfers; i++) {
+		bool is_read = (mode == I3C_XFER_MODE_SDR) ?
+			       (xfers[i].rnw == I3C_DEV_DIR_READ) :
+			       (xfers[i].cmd & 0x80);
+
+		fprintf(stdout, "Success on message %d\n", i);
+		if (is_read)
+			print_rx_data(&xfers[i]);
+	}
+
+	ret = EXIT_SUCCESS;
+
+err_free:
+	for (i = 0; i < nxfers; i++)
+		free((void *)(uintptr_t)xfers[i].data);
+	free(xfers);
+	close(file);
+
+	return ret;
+}
-- 
2.55.0.1082.g2b9226bbc0-goog

Re: [PATCH v5 3/5] i3c: use actual_len for read transfers

[Adrian Hunter]

On 22/09/2026 02:06, Sam Agazaryan wrote:
> Currently only the amd and svc I3C controller drivers populate
> i3c_xfer.actual_len on reads, while dw-i3c-master and mipi-i3c-hci
> overwrite i3c_xfer.len with the received byte count and leave actual_len
> as 0. Because of this inconsistency, mctp-i3c reads xfer.len instead of
> xfer.actual_len, making it fail on controllers that do not mutate len.
> 
> Unify read length reporting across the subsystem:
> - Clarify in <linux/i3c/device.h> that actual_len reflects the actual
>   number of bytes transferred on reads.
> - Update adi, cdns, dw, mipi-i3c-hci, and renesas controller drivers to
>   populate actual_len on read transfers without mutating len.
> - Update mctp-i3c to read xfer.actual_len instead of xfer.len.
> 
> Co-developed-by: Meagan Lloyd <meaganlloyd@linux.microsoft.com>
> Signed-off-by: Meagan Lloyd <meaganlloyd@linux.microsoft.com>
> Signed-off-by: Sam Agazaryan <samagazaryan@google.com>

Looks good.

1 issue from Sashiko:

	https://sashiko.dev/#/patchset/20260921230603.2518652-1-samagazaryan%40google.com?part=3

Also i3c_dev_do_xfers_locked() should probably clamp actual_len to len.

> ---
>  drivers/i3c/master/adi-i3c-master.c    |  5 ++++-
>  drivers/i3c/master/dw-i3c-master.c     |  2 +-
>  drivers/i3c/master/i3c-master-cdns.c   |  5 ++++-
>  drivers/i3c/master/mipi-i3c-hci/core.c |  2 +-
>  drivers/i3c/master/renesas-i3c.c       |  3 +++
>  drivers/net/mctp/mctp-i3c.c            | 10 +++++-----
>  include/linux/i3c/device.h             |  2 +-
>  7 files changed, 19 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/i3c/master/adi-i3c-master.c b/drivers/i3c/master/adi-i3c-master.c
> index b35386260350..d033bfd4ecc2 100644
> --- a/drivers/i3c/master/adi-i3c-master.c
> +++ b/drivers/i3c/master/adi-i3c-master.c
> @@ -412,8 +412,11 @@ static int adi_i3c_master_i3c_xfers(struct i3c_dev_desc *dev,
>  
>  	ret = xfer->ret;
>  
> -	for (i = 0; i < nxfers; i++)
> +	for (i = 0; i < nxfers; i++) {
>  		xfers[i].err = adi_i3c_cmd_get_err(&xfer->cmds[i]);
> +		if (xfers[i].rnw)
> +			xfers[i].actual_len = xfer->cmds[i].rx_len;
> +	}
>  
>  	return ret;
>  }
> diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
> index 4563d8761ba0..28e8eb293747 100644
> --- a/drivers/i3c/master/dw-i3c-master.c
> +++ b/drivers/i3c/master/dw-i3c-master.c
> @@ -1029,7 +1029,7 @@ static int dw_i3c_master_i3c_xfers(struct i3c_dev_desc *dev,
>  		struct dw_i3c_cmd *cmd = &xfer->cmds[i];
>  
>  		if (i3c_xfers[i].rnw)
> -			i3c_xfers[i].len = cmd->rx_len;
> +			i3c_xfers[i].actual_len = cmd->rx_len;
>  	}
>  
>  	ret = xfer->ret;
> diff --git a/drivers/i3c/master/i3c-master-cdns.c b/drivers/i3c/master/i3c-master-cdns.c
> index 2d98c1ce9b12..331062c10b31 100644
> --- a/drivers/i3c/master/i3c-master-cdns.c
> +++ b/drivers/i3c/master/i3c-master-cdns.c
> @@ -795,8 +795,11 @@ static int cdns_i3c_master_i3c_xfers(struct i3c_dev_desc *dev,
>  
>  	ret = cdns_xfer->ret;
>  
> -	for (i = 0; i < nxfers; i++)
> +	for (i = 0; i < nxfers; i++) {
>  		xfers[i].err = cdns_i3c_cmd_get_err(&cdns_xfer->cmds[i]);
> +		if (xfers[i].rnw)
> +			xfers[i].actual_len = cdns_xfer->cmds[i].rx_len;
> +	}
>  
>  	cdns_i3c_master_free_xfer(cdns_xfer);
>  
> diff --git a/drivers/i3c/master/mipi-i3c-hci/core.c b/drivers/i3c/master/mipi-i3c-hci/core.c
> index dadf049bd4b5..f74c02fab9e3 100644
> --- a/drivers/i3c/master/mipi-i3c-hci/core.c
> +++ b/drivers/i3c/master/mipi-i3c-hci/core.c
> @@ -509,7 +509,7 @@ static int i3c_hci_i3c_xfers(struct i3c_dev_desc *dev,
>  		goto out;
>  	for (i = 0; i < nxfers; i++) {
>  		if (i3c_xfers[i].rnw)
> -			i3c_xfers[i].len = RESP_DATA_LENGTH(xfer[i].response);
> +			i3c_xfers[i].actual_len = RESP_DATA_LENGTH(xfer[i].response);
>  		if (RESP_STATUS(xfer[i].response) != RESP_SUCCESS) {
>  			ret = -EIO;
>  			goto out;
> diff --git a/drivers/i3c/master/renesas-i3c.c b/drivers/i3c/master/renesas-i3c.c
> index 28c0927a0179..a3dcb4cd9b0e 100644
> --- a/drivers/i3c/master/renesas-i3c.c
> +++ b/drivers/i3c/master/renesas-i3c.c
> @@ -918,6 +918,9 @@ static int renesas_i3c_i3c_xfers(struct i3c_dev_desc *dev, struct i3c_xfer *i3c_
>  		time_left = renesas_i3c_wait_xfer(i3c, xfer);
>  		if (!time_left)
>  			xfer_failed = true;
> +
> +		if (i3c_xfers[i].rnw)
> +			i3c_xfers[i].actual_len = cmd->rx_count;
>  	}
>  
>  	if (xfer_failed)
> diff --git a/drivers/net/mctp/mctp-i3c.c b/drivers/net/mctp/mctp-i3c.c
> index 6d2bbae7477b..5f94c11a1712 100644
> --- a/drivers/net/mctp/mctp-i3c.c
> +++ b/drivers/net/mctp/mctp-i3c.c
> @@ -131,12 +131,12 @@ static int mctp_i3c_read(struct mctp_i3c_device *mi)
>  	if (rc < 0)
>  		goto err;
>  
> -	if (WARN_ON_ONCE(xfer.len > mi->mrl)) {
> +	if (WARN_ON_ONCE(xfer.actual_len > mi->mrl)) {
>  		/* Bad i3c bus driver */
>  		rc = -EIO;
>  		goto err;
>  	}
> -	if (xfer.len < MCTP_I3C_MINLEN) {
> +	if (xfer.actual_len < MCTP_I3C_MINLEN) {
>  		stats->rx_length_errors++;
>  		rc = -EIO;
>  		goto err;
> @@ -145,15 +145,15 @@ static int mctp_i3c_read(struct mctp_i3c_device *mi)
>  	/* check PEC, including address byte */
>  	addr = mi->addr << 1 | 1;
>  	pec = i2c_smbus_pec(0, &addr, 1);
> -	pec = i2c_smbus_pec(pec, xfer.data.in, xfer.len - 1);
> -	if (pec != ((u8 *)xfer.data.in)[xfer.len - 1]) {
> +	pec = i2c_smbus_pec(pec, xfer.data.in, xfer.actual_len - 1);
> +	if (pec != ((u8 *)xfer.data.in)[xfer.actual_len - 1]) {
>  		stats->rx_crc_errors++;
>  		rc = -EINVAL;
>  		goto err;
>  	}
>  
>  	/* Remove PEC */
> -	skb_trim(skb, xfer.len - 1);
> +	skb_trim(skb, xfer.actual_len - 1);
>  
>  	cb = __mctp_cb(skb);
>  	cb->halen = PID_SIZE;
> diff --git a/include/linux/i3c/device.h b/include/linux/i3c/device.h
> index 971d53349b6f..f868a7bf2bc9 100644
> --- a/include/linux/i3c/device.h
> +++ b/include/linux/i3c/device.h
> @@ -59,7 +59,7 @@ enum i3c_xfer_mode {
>   * @rnw: encodes the transfer direction. true for a read, false for a write
>   * @cmd: Read/Write command in HDR mode, read: 0x80 - 0xff, write: 0x00 - 0x7f
>   * @len: transfer length in bytes of the transfer
> - * @actual_len: actual length in bytes are transferred by the controller
> + * @actual_len: actual length in bytes transferred by the controller on read
>   * @data: input/output buffer
>   * @data.in: input buffer. Must point to a DMA-able buffer
>   * @data.out: output buffer. Must point to a DMA-able buffer