Re: [PATCH] HID: i2c-hid: add reset quirk for Lenovo Yoga Slim 7x Gen 11 keyboard
flat view
From: sashiko-bot@kernel.org
Date: 2026-09-08 09:26:58
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [Critical] An embedded struct field (not cacheline-aligned) is passed to a DMA-safe I2C transfer.
--
commit 6f11ed5908d69555e4526207fed1941b2bc9d3c9
Author: Oleg Keri [off-list ref]
HID: i2c-hid: add reset quirk for Lenovo Yoga Slim 7x Gen 11 keyboard
The ITE controller behind the keyboard of the Lenovo Yoga Slim 7x Gen 11
(048d:83db) carries out a reset but never raises the interrupt that
acknowledges it. This commit sets I2C_HID_QUIRK_NO_IRQ_AFTER_RESET for it.
quoted hunk ↗ jump to hunk
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c index 0ff07fdab442a..ad8d9f329404a 100644 --- a/drivers/hid/i2c-hid/i2c-hid-core.c +++ b/drivers/hid/i2c-hid/i2c-hid-core.c@@ -126,6 +126,8 @@ static const struct i2c_hid_quirks { I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, { I2C_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_VOYO_WINPAD_A15, I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, + { USB_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_G11_KEYBOARD, + I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_3118, I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
[Severity: Critical]
This is a pre-existing issue, but does i2c_hid_fetch_hid_descriptor()
pass an unaligned embedded struct field to a DMA-safe I2C transfer?
Looking at i2c_hid_fetch_hid_descriptor(), it reads the HID descriptor into
ihid->hdesc:
drivers/hid/i2c-hid/i2c-hid-core.c:i2c_hid_fetch_hid_descriptor() {
...
error = i2c_hid_read_register(ihid,
ihid->wHIDDescRegister,
&ihid->hdesc,
sizeof(ihid->hdesc));
...
}
This buffer is passed down to i2c_hid_xfer(), which forces the message to
bypass I2C bounce buffering by explicitly setting I2C_M_DMA_SAFE:
drivers/hid/i2c-hid/i2c-hid-core.c:i2c_hid_xfer() {
...
msgs[n].flags = (client->flags & I2C_M_TEN) |
I2C_M_RD | I2C_M_DMA_SAFE;
msgs[n].len = recv_len;
msgs[n].buf = recv_buf;
...
}
Because ihid->hdesc is an embedded field that shares a cacheline with other
members of struct i2c_hid, processing this message via a DMA-capable I2C
controller violates the I2C subsystem rule against passing
non-cacheline-aligned buffers to I2C_M_DMA_SAFE.
Could this result in DMA cacheline sharing corruption of adjacent fields when
the cacheline is invalidated upon transfer completion during local probe
execution?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260908091926.5773-1-okerixx@gmail.com?part=1