[PATCH] HID: i2c-hid: add reset quirk for Lenovo Yoga Slim 7x Gen 11 keyboard

[PATCH] HID: i2c-hid: add reset quirk for Lenovo Yoga Slim 7x Gen 11 keyboard

[Oleg Keri]

The ITE controller behind the keyboard of the Lenovo Yoga Slim 7x Gen 11
(048d:83db) carries out a reset but never raises the interrupt that
acknowledges it. i2c_hid_finish_hwreset() therefore waits out its full
one second timeout and logs "device did not ack reset within 1000 ms" on
every probe and every resume, before the keyboard comes up regardless.

Set I2C_HID_QUIRK_NO_IRQ_AFTER_RESET for it, as is already done for
several other ITE parts, so the reset is followed by a fixed 100 ms sleep
instead.

Signed-off-by: Oleg Keri <okerixx@gmail.com>
---
 drivers/hid/hid-ids.h              | 1 +
 drivers/hid/i2c-hid/i2c-hid-core.c | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index b3aca5aa9176..2e9d0fc41ed0 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -765,6 +765,7 @@
 #define I2C_DEVICE_ID_ITE_LENOVO_LEGION_Y720	0x837a
 #define USB_DEVICE_ID_ITE_LENOVO_YOGA900	0x8396
 #define I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_KEYBOARD	0x8987
+#define I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_G11_KEYBOARD	0x83db
 #define USB_DEVICE_ID_ITE8595		0x8595
 #define USB_DEVICE_ID_ITE_MEDION_E1239T	0xce50
 
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 0ff07fdab442..ad8d9f329404 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -126,6 +126,8 @@ static const struct i2c_hid_quirks {
 		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
 	{ I2C_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_VOYO_WINPAD_A15,
 		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
+	{ USB_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_G11_KEYBOARD,
+		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
 	{ I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_3118,
 		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
 	{ USB_VENDOR_ID_ALPS_JP, HID_ANY_ID,
-- 
2.55.0

base-commit: 5e036ce12de91c6fd674dad33b169c6150be2a7a

Re: [PATCH] HID: i2c-hid: add reset quirk for Lenovo Yoga Slim 7x Gen 11 keyboard

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] An embedded struct field (not cacheline-aligned) is passed to a DMA-safe I2C transfer.
--

commit 6f11ed5908d69555e4526207fed1941b2bc9d3c9
Author: Oleg Keri <okerixx@gmail.com>

HID: i2c-hid: add reset quirk for Lenovo Yoga Slim 7x Gen 11 keyboard
    
The ITE controller behind the keyboard of the Lenovo Yoga Slim 7x Gen 11
(048d:83db) carries out a reset but never raises the interrupt that
acknowledges it. This commit sets I2C_HID_QUIRK_NO_IRQ_AFTER_RESET for it.

> diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
> index 0ff07fdab442a..ad8d9f329404a 100644
> --- a/drivers/hid/i2c-hid/i2c-hid-core.c
> +++ b/drivers/hid/i2c-hid/i2c-hid-core.c
> @@ -126,6 +126,8 @@ static const struct i2c_hid_quirks {
>  		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
>  	{ I2C_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_VOYO_WINPAD_A15,
>  		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
> +	{ USB_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_G11_KEYBOARD,
> +		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
>  	{ I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_3118,
>  		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },

[Severity: Critical]
This is a pre-existing issue, but does i2c_hid_fetch_hid_descriptor()
pass an unaligned embedded struct field to a DMA-safe I2C transfer?

Looking at i2c_hid_fetch_hid_descriptor(), it reads the HID descriptor into
ihid->hdesc:

drivers/hid/i2c-hid/i2c-hid-core.c:i2c_hid_fetch_hid_descriptor() {
    ...
	error = i2c_hid_read_register(ihid,
				      ihid->wHIDDescRegister,
				      &ihid->hdesc,
				      sizeof(ihid->hdesc));
    ...
}

This buffer is passed down to i2c_hid_xfer(), which forces the message to
bypass I2C bounce buffering by explicitly setting I2C_M_DMA_SAFE:

drivers/hid/i2c-hid/i2c-hid-core.c:i2c_hid_xfer() {
    ...
		msgs[n].flags = (client->flags & I2C_M_TEN) |
				I2C_M_RD | I2C_M_DMA_SAFE;
		msgs[n].len = recv_len;
		msgs[n].buf = recv_buf;
    ...
}

Because ihid->hdesc is an embedded field that shares a cacheline with other
members of struct i2c_hid, processing this message via a DMA-capable I2C
controller violates the I2C subsystem rule against passing
non-cacheline-aligned buffers to I2C_M_DMA_SAFE.

Could this result in DMA cacheline sharing corruption of adjacent fields when
the cacheline is invalidated upon transfer completion during local probe
execution?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908091926.5773-1-okerixx@gmail.com?part=1

Re: [PATCH] HID: i2c-hid: add reset quirk for Lenovo Yoga Slim 7x Gen 11 keyboard

[Jiri Kosina]

On Tue, 8 Sep 2026, Oleg Keri wrote:

> The ITE controller behind the keyboard of the Lenovo Yoga Slim 7x Gen 11
> (048d:83db) carries out a reset but never raises the interrupt that
> acknowledges it. i2c_hid_finish_hwreset() therefore waits out its full
> one second timeout and logs "device did not ack reset within 1000 ms" on
> every probe and every resume, before the keyboard comes up regardless.
> 
> Set I2C_HID_QUIRK_NO_IRQ_AFTER_RESET for it, as is already done for
> several other ITE parts, so the reset is followed by a fixed 100 ms sleep
> instead.
> 
> Signed-off-by: Oleg Keri <okerixx@gmail.com>

Applied, thank you.

-- 
Jiri Kosina
SUSE Labs