Re: [PATCH] HID: i2c-hid: add reset quirk for Lenovo Yoga Slim 7x Gen 11 keyboard

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] An embedded struct field (not cacheline-aligned) is passed to a DMA-safe I2C transfer.
--

commit 6f11ed5908d69555e4526207fed1941b2bc9d3c9
Author: Oleg Keri <okerixx@gmail.com>

HID: i2c-hid: add reset quirk for Lenovo Yoga Slim 7x Gen 11 keyboard
    
The ITE controller behind the keyboard of the Lenovo Yoga Slim 7x Gen 11
(048d:83db) carries out a reset but never raises the interrupt that
acknowledges it. This commit sets I2C_HID_QUIRK_NO_IRQ_AFTER_RESET for it.

> diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
> index 0ff07fdab442a..ad8d9f329404a 100644
> --- a/drivers/hid/i2c-hid/i2c-hid-core.c
> +++ b/drivers/hid/i2c-hid/i2c-hid-core.c
> @@ -126,6 +126,8 @@ static const struct i2c_hid_quirks {
>  		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
>  	{ I2C_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_VOYO_WINPAD_A15,
>  		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
> +	{ USB_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_G11_KEYBOARD,
> +		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
>  	{ I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_3118,
>  		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },

[Severity: Critical]
This is a pre-existing issue, but does i2c_hid_fetch_hid_descriptor()
pass an unaligned embedded struct field to a DMA-safe I2C transfer?

Looking at i2c_hid_fetch_hid_descriptor(), it reads the HID descriptor into
ihid->hdesc:

drivers/hid/i2c-hid/i2c-hid-core.c:i2c_hid_fetch_hid_descriptor() {
    ...
	error = i2c_hid_read_register(ihid,
				      ihid->wHIDDescRegister,
				      &ihid->hdesc,
				      sizeof(ihid->hdesc));
    ...
}

This buffer is passed down to i2c_hid_xfer(), which forces the message to
bypass I2C bounce buffering by explicitly setting I2C_M_DMA_SAFE:

drivers/hid/i2c-hid/i2c-hid-core.c:i2c_hid_xfer() {
    ...
		msgs[n].flags = (client->flags & I2C_M_TEN) |
				I2C_M_RD | I2C_M_DMA_SAFE;
		msgs[n].len = recv_len;
		msgs[n].buf = recv_buf;
    ...
}

Because ihid->hdesc is an embedded field that shares a cacheline with other
members of struct i2c_hid, processing this message via a DMA-capable I2C
controller violates the I2C subsystem rule against passing
non-cacheline-aligned buffers to I2C_M_DMA_SAFE.

Could this result in DMA cacheline sharing corruption of adjacent fields when
the cacheline is invalidated upon transfer completion during local probe
execution?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908091926.5773-1-okerixx@gmail.com?part=1