Re: [PATCH 7.1 00/21] 7.1.2-rc1 review
From: Dmitry Torokhov
Date: Fri Jun 26 2026 - 15:56:36 EST
Hi Barry,
On Fri, Jun 26, 2026 at 10:56:21AM -0700, Barry K. Nathan wrote:
> (cc Dmitry Torokhov because this is related to two of your commits)
>
> On 6/25/26 6:03 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 7.1.2 release.
> > There are 21 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.2-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
> >
>
> Unfortunately, 7.1.2-rc1 breaks the Synaptics touchpad on my Lenovo
> ThinkPad T14 Gen 1 -- the pointer no longer moves when I touch the
> touchpad. Potentially relevant line from dmesg:
>
> rmi4_f01 rmi4-00.fn01: found RMI device, manufacturer: Synaptics, product: TM3471-020, fw id: 3972349
>
> > Dmitry Torokhov<dmitry.torokhov@xxxxxxxxx>
> > Input: rmi4 - refactor register descriptor parsing
> >
> > Dmitry Torokhov<dmitry.torokhov@xxxxxxxxx>
> > Input: rmi4 - fix register descriptor address calculation
>
> Both of these patches seem bad in my testing. Either one, individually,
> causes the pointer to no longer move when I touch the touchpad. If I
> revert both of them, then my touchpad works again.
>
> I have not yet tested 7.0.14-rc1 or 6.18.37-rc1. However, the problem
> also reproduces on current mainline as of this writing (commit
> 51cb1aa1250c36269474b8b6ca6b6319e170f5a5).
Could you please try applying this debug patch and send me dmesg?
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index 49a59da6a841..65095257e3c3 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -569,27 +569,35 @@ static int rmi_parse_register_desc_item(struct rmi_register_desc_item *item,
unsigned int map_offset = 0;
int b;
- if (offset >= size)
+ if (offset >= size) {
+ pr_err("%s: error: offset >= size (%d >= %zu)\n", __func__, offset, size);
return -EIO;
+ }
item->reg_size = buf[offset++];
if (item->reg_size == 0) {
- if (size - offset < 2)
+ if (size - offset < 2) {
+ pr_err("%s: error: size - offset < 2 (%zu - %d < 2)\n", __func__, size, offset);
return -EIO;
+ }
item->reg_size = get_unaligned_le16(&buf[offset]);
offset += 2;
}
if (item->reg_size == 0) {
- if (size - offset < 4)
+ if (size - offset < 4) {
+ pr_err("%s: error: size - offset < 4 (%zu - %d < 4)\n", __func__, size, offset);
return -EIO;
+ }
item->reg_size = get_unaligned_le32(&buf[offset]);
offset += 4;
}
do {
- if (offset >= size)
+ if (offset >= size) {
+ pr_err("%s: error in loop: offset >= size (%d >= %zu)\n", __func__, offset, size);
return -EIO;
+ }
for (b = 0; b < 7; b++) {
if (buf[offset] & BIT(b)) {
@@ -625,9 +633,11 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
* The first register of the register descriptor is the size of
* the register descriptor's presence register.
*/
+ pr_info("%s: starting read at addr 0x%04x\n", __func__, addr);
ret = rmi_read(d, addr, &size_presence_reg);
if (ret)
return ret;
+ pr_info("%s: size_presence_reg = %d\n", __func__, size_presence_reg);
++addr;
if (size_presence_reg < 1 || size_presence_reg > RMI_REG_DESC_PRESENCE_REGS_MAX)
@@ -643,7 +653,10 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
ret = rmi_read_block(d, addr, buf, size_presence_reg);
if (ret)
return ret;
+ pr_info("%s: presence reg: %*ph\n", __func__, (int)size_presence_reg, buf);
+
addr += size_presence_reg;
+ pr_info("%s: advanced addr to 0x%04x (after skipping presence reg)\n", __func__, addr);
if (buf[0] == 0) {
if (size_presence_reg < 3)
@@ -654,6 +667,7 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
presence_offset = 1;
rdesc->struct_size = buf[0];
}
+ pr_info("%s: struct_size = %ld\n", __func__, rdesc->struct_size);
memset(presence_map, 0, sizeof(presence_map));
map_offset = 0;
@@ -670,6 +684,7 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
rdesc->num_registers = bitmap_weight(presence_map,
RMI_REG_DESC_PRESENCE_BITS);
+ pr_info("%s: num_registers = %d\n", __func__, rdesc->num_registers);
rdesc->registers = devm_kcalloc(&d->dev,
rdesc->num_registers,
@@ -693,10 +708,14 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
* register and a bitmap of all subpackets contained in the packet
* register.
*/
+ pr_info("%s: reading struct_buf from addr 0x%04x, size %ld\n", __func__, addr, rdesc->struct_size);
ret = rmi_read_block(d, addr, struct_buf, rdesc->struct_size);
if (ret)
return ret;
+ print_hex_dump(KERN_INFO, "rmi_struct: ", DUMP_PREFIX_OFFSET, 16, 1,
+ struct_buf, rdesc->struct_size, false);
+
reg = find_first_bit(presence_map, RMI_REG_DESC_PRESENCE_BITS);
offset = 0;
for (i = 0; i < rdesc->num_registers; i++) {
@@ -712,9 +731,8 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
item->reg = reg;
offset += item_size;
- rmi_dbg(RMI_DEBUG_CORE, &d->dev,
- "%s: reg: %d reg size: %u subpackets: %d\n", __func__,
- item->reg, item->reg_size, item->num_subpackets);
+ pr_info("%s: parsed item %d: reg: %d reg size: %u subpackets: %d\n", __func__,
+ i, item->reg, item->reg_size, item->num_subpackets);
reg = find_next_bit(presence_map,
RMI_REG_DESC_PRESENCE_BITS, reg + 1);
>
--
Dmitry