[PATCH v5 0/5] i3c: add i3cdev module to expose i3c dev in /dev
From: Sam Agazaryan
Date: Mon Sep 21 2026 - 19:07:33 EST
This patch series introduces the i3cdev module, exposing unbound I3C
target devices to userspace via character device nodes (/dev/bus/i3c/*),
along with the i3ctransfer userspace utility in tools/i3c/.
Userspace access to I3C targets is needed for devices that do not have a
kernel driver bound to them, such as targets in ROM/bootloader recovery
mode (e.g., OCP Secure Firmware Recovery v1.1 and Caliptra Silicon Root of
Trust recovery flows), as well as hardware bring-up and diagnostics.
When a kernel driver later binds to an I3C device (for example via
dynamic module loading), i3cdev automatically detaches via the
BUS_NOTIFY_BIND_DRIVER notifier so kernel drivers always take
precedence.
Testing status:
This v5 series has been compile-tested across all modified I3C controller
drivers with W=1. Posting v5 now so collaborators and controller owners
can test the unified UAPI and actual_len updates on their respective
hardware and provide Tested-by tags while we complete final hardware
verification of the v5 updates on our platform.
Changes in v5:
- Updated Patch 2/5 ("i3c: master: add i3c_for_each_dev helper"):
- Dropped mutex_lock(&i3c_core_lock) around bus_for_each_dev() to avoid
lock inversion and deadlock with external callbacks (sashiko-bot).
- Added Patch 3/5 ("i3c: use actual_len for read transfers"):
- Clarified @actual_len kerneldoc in <linux/i3c/device.h>
(Adrian Hunter).
- Incorporated Meagan Lloyd's controller updates (adi, dw, cdns,
mipi-i3c-hci, renesas) so all I3C controller drivers populate
xfer->actual_len on reads without mutating xfer->len
(Adrian Hunter, Meagan Lloyd).
- Updated mctp-i3c to read xfer.actual_len instead of xfer.len
(Adrian Hunter).
- Updated Patch 4/5 ("i3c: add i3cdev module to expose i3c dev in /dev"):
- Unified the UAPI around struct i3c_ioc_xfer and I3C_IOC_XFER(N) in
<uapi/linux/i3c/i3cdev.h>, supporting both SDR and HDR modes via a
mode field and union { __u8 rnw; __u8 cmd; } (Frank Li).
- Added __u16 actual_len to struct i3c_ioc_xfer and updated
i3cdev_do_xfer() to copy actual_len bytes to userspace and write
actual_len back to userspace via put_user() on read transfers
(Adrian Hunter, Frank Li).
- Tracked active i3cdev instances in a private list (i3cdev_list)
instead of using i3cdev_set_drvdata()/i3cdev_get_drvdata() so i3cdev
never clobbers client drivers' dev->driver_data (Meagan Lloyd).
- Validated direction field and verified that reserved padding pad[2] is
zeroed (Greg KH).
- Clamped read()/write() byte count to type_max(xfers.len) (u16) to
prevent silent integer truncation and unbounded kernel allocations
(sashiko-bot).
- Used ida_alloc_max() capped to MINORMASK to prevent minor number
overflow (sashiko-bot).
- Added i3cdev_attach_lock mutex and idempotency check in
i3cdev_attach()/i3cdev_detach() to serialize concurrent attach/detach
calls (sashiko-bot).
- Updated bus notifier to handle BUS_NOTIFY_DRIVER_NOT_BOUND and return
NOTIFY_OK instead of raw errno values (sashiko-bot).
- Added Patch 5/5 ("tools: i3c: add i3ctransfer utility"):
- Added tools/i3c/i3ctransfer.c (adapted from Vitor Soares's
i3c-tools) updated for struct i3c_ioc_xfer, supporting SDR and HDR
(-m, -c) modes and reporting actual_len bytes on reads
(Wolfram Sang).
- Note to Vitor Soares: Since your original i3ctransfer commit in
i3c-tools did not include a Signed-off-by tag, could you please
reply with your Signed-off-by / Acked-by for Patch 5/5?
Changes in v4:
- Dropped dev_open count tracking and used cdev_device_add/del with
mutex locking to prevent use-after-free on detach
(Greg KH, Wolfram Sang).
- Fixed 32/64-bit UAPI alignment and added compat_ptr_ioctl.
- Switched to dynamic minor allocation via IDA.
Sam Agazaryan (2):
i3c: use actual_len for read transfers
tools: i3c: add i3ctransfer utility
Vitor Soares (3):
i3c: master: export i3c_masterdev_type
i3c: master: add i3c_for_each_dev helper
i3c: add i3cdev module to expose i3c dev in /dev
MAINTAINERS | 2 +
drivers/i3c/Kconfig | 11 +
drivers/i3c/Makefile | 1 +
drivers/i3c/i3cdev.c | 491 +++++++++++++++++++++++++
drivers/i3c/internals.h | 4 +
drivers/i3c/master.c | 9 +-
drivers/i3c/master/adi-i3c-master.c | 5 +-
drivers/i3c/master/dw-i3c-master.c | 2 +-
drivers/i3c/master/i3c-master-cdns.c | 5 +-
drivers/i3c/master/mipi-i3c-hci/core.c | 2 +-
drivers/i3c/master/renesas-i3c.c | 3 +
drivers/net/mctp/mctp-i3c.c | 10 +-
include/linux/i3c/device.h | 2 +-
include/uapi/linux/i3c/i3cdev.h | 57 +++
tools/Makefile | 13 +-
tools/i3c/Build | 1 +
tools/i3c/Makefile | 58 +++
tools/i3c/i3ctransfer.c | 307 ++++++++++++++++
18 files changed, 966 insertions(+), 17 deletions(-)
create mode 100644 drivers/i3c/i3cdev.c
create mode 100644 include/uapi/linux/i3c/i3cdev.h
create mode 100644 tools/i3c/Build
create mode 100644 tools/i3c/Makefile
create mode 100644 tools/i3c/i3ctransfer.c
--
2.55.0.1082.g2b9226bbc0-goog