linux-kernel - Re: [PATCH] HID: i2c-hid: patch Lenovo Yoga Slim 7x Keyboard rdesc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <lxtbtu5frygbw7qzfaelc63vgientm7d6oo7dt6jeassl3ttbh@f22h223wehbm>
Date: Thu, 9 Oct 2025 09:38:50 +0200
From: Benjamin Tissoires <bentiss@...nel.org>
To: Lauri Tirkkonen <lauri@...ktheplanet.fi>
Cc: Jiri Kosina <jikos@...nel.org>, linux-input@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] HID: i2c-hid: patch Lenovo Yoga Slim 7x Keyboard rdesc

On Oct 09 2025, Lauri Tirkkonen wrote:
> The keyboard of this device has the following in its report description
> for Usage (Keyboard) in Collection (Application):
> 
> 	# 0x15, 0x00,                    //  Logical Minimum (0)                52
> 	# 0x25, 0x65,                    //  Logical Maximum (101)              54
> 	# 0x05, 0x07,                    //  Usage Page (Keyboard)              56
> 	# 0x19, 0x00,                    //  Usage Minimum (0)                  58
> 	# 0x29, 0xdd,                    //  Usage Maximum (221)                60
> 	# 0x81, 0x00,                    //  Input (Data,Arr,Abs)               62
> 
> Since the Usage Min/Max range exceeds the Logical Min/Max range,
> keypresses outside the Logical range are not recognized. This includes,
> for example, the Japanese language keyboard variant's keys for |, _ and
> \.
> 
> Patch the report description to make the Logical range match the Usage
> range, fixing the interpretation of keypresses above 101 on this device.
> 
> Signed-off-by: Lauri Tirkkonen <lauri@...ktheplanet.fi>
> ---
>  drivers/hid/hid-ids.h              |  1 +
>  drivers/hid/i2c-hid/i2c-hid-core.c | 25 +++++++++++++++++++++++++
>  2 files changed, 26 insertions(+)
> 
> diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
> index 5721b8414bbd..bbb932145d2c 100644
> --- a/drivers/hid/hid-ids.h
> +++ b/drivers/hid/hid-ids.h
> @@ -715,6 +715,7 @@
>  #define USB_DEVICE_ID_ITE_LENOVO_YOGA2  0x8350
>  #define I2C_DEVICE_ID_ITE_LENOVO_LEGION_Y720	0x837a
>  #define USB_DEVICE_ID_ITE_LENOVO_YOGA900	0x8396
> +#define I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X	0x8987
>  #define USB_DEVICE_ID_ITE8595		0x8595
>  #define USB_DEVICE_ID_ITE_MEDION_E1239T	0xce50
>  
> diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
> index 63f46a2e5788..d78bd97ec24e 100644
> --- a/drivers/hid/i2c-hid/i2c-hid-core.c
> +++ b/drivers/hid/i2c-hid/i2c-hid-core.c

Why patching i2c-hid-core when this is clearly a logical bug, not a
transport (I2C) bug?

I would rather see this fixup in hid-lenovo.c along with the other
lenovo fixes.

Cheers,
Benjamin

> @@ -740,6 +740,26 @@ static int i2c_hid_raw_request(struct hid_device *hid, unsigned char reportnum,
>  	}
>  }
>  
> +static void patch_lenovo_yoga_slim7x_keyboard_rdesc(struct i2c_hid *ihid,
> +						    char *rdesc,
> +						    unsigned int rsize)
> +{
> +	if (!(rsize == 0xb0 &&
> +	      rdesc[0x34] == 0x15 && rdesc[0x35] == 0x00 && // Logical Minimum (0)
> +	      rdesc[0x36] == 0x25 && rdesc[0x37] == 0x65 && // Logical Maximum (101)
> +	      rdesc[0x38] == 0x05 && rdesc[0x39] == 0x07 && // Usage Page (Keyboard)
> +	      rdesc[0x3a] == 0x19 && rdesc[0x3b] == 0x00 && // Usage Minimum (0)
> +	      rdesc[0x3c] == 0x29 && rdesc[0x3d] == 0xdd))  // Usage Maximum (221)
> +		return;
> +
> +	u8 logical_max = rdesc[0x37];
> +	u8 usage_max = rdesc[0x3d];
> +
> +	rdesc[0x37] = usage_max;
> +	i2c_hid_dbg(ihid, "%s: patched logical max from %u to %u\n", __func__,
> +			logical_max, usage_max);
> +}
> +
>  static int i2c_hid_parse(struct hid_device *hid)
>  {
>  	struct i2c_client *client = hid->driver_data;
> @@ -793,6 +813,11 @@ static int i2c_hid_parse(struct hid_device *hid)
>  		}
>  	}
>  
> +	if (ihid->hid->vendor == USB_VENDOR_ID_ITE &&
> +	    ihid->hid->product == I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X) {
> +		patch_lenovo_yoga_slim7x_keyboard_rdesc(ihid, rdesc, rsize);
> +	}
> +
>  	i2c_hid_dbg(ihid, "Report Descriptor: %*ph\n", rsize, rdesc);
>  
>  	ret = hid_parse_report(hid, rdesc, rsize);
> -- 
> 2.51.0
> 
> -- 
> Lauri Tirkkonen | lotheac @ IRCnet