[PATCH v2 0/3] Input: synaptics - enable SMBus for ThinkPad P14s Gen 2i (LEN2072)

[PATCH v2 0/3] Input: synaptics - enable SMBus for ThinkPad P14s Gen 2i (LEN2072)

[Dmitry Mikushin]

The ThinkPad P14s Gen 2i touchpad (Synaptics TM3471-030, LEN2072) is
not on the SMBus passlist and runs in PS/2 mode. Forcing RMI4 alone
does not help: the F12 attention handler reads the whole 79-byte data
packet over SMBus on every frame, which caps the report rate at about
43 Hz and loses fast swipes.

Patch 1 fixes the size passed to rmi_f12_process_objects(), which
counted from the start of the data packet instead of from Data1.
Patch 2 makes F12 read only the registers up to and including Data1,
raising the report rate to about 65 Hz on this machine. Patch 3 then
adds LEN2072 to smbus_pnp_ids and should not be applied without
patch 2.

Tested on a ThinkPad P14s Gen 2i (20VX) on 7.2.9, including s2idle
suspend/resume and the TrackPoint on the RMI4 pass-through port. On
this device Data1 is the first data register, so patch 1 does not
change its behavior.

Changes in v2:
- New patch 1. Sashiko pointed out that with patch 2 alone, on devices
  where Data1 is not at offset 0, rmi_f12_process_objects() could parse
  bytes past the end of what was read. The underlying off-by-
  data1_offset bound predates this series, so it is fixed separately
  with a Fixes: tag.
- No changes to patches 2 and 3.

v1: https://lore.kernel.org/all/20261026093118.2312302-1-dmitry@kernelgen.org/

Dmitry Mikushin (3):
  Input: synaptics-rmi4 - f12: pass Data1-relative size to
    process_objects
  Input: synaptics-rmi4 - f12: read only the object data on attention
  Input: synaptics - add LEN2072 to smbus_pnp_ids for ThinkPad P14s Gen
    2i

 drivers/input/mouse/synaptics.c |  1 +
 drivers/input/rmi4/rmi_f12.c    | 20 +++++++++++++++++---
 2 files changed, 18 insertions(+), 3 deletions(-)

-- 
2.56.0

[PATCH v2 1/3] Input: synaptics-rmi4 - f12: pass Data1-relative size to process_objects

[Dmitry Mikushin]

rmi_f12_process_objects() gets a pointer to Data1 and limits the number
of objects it parses by the size it is given, but rmi_f12_attention()
passes valid_bytes, which counts from the start of the F12 data packet
rather than from Data1. When Data1 is not the first data register,
the bound is too large by data1_offset bytes.

On the attention data path valid_bytes can be smaller than the full
packet, so objects may be parsed from beyond the bytes that were
actually received. Pass the number of valid bytes starting at Data1,
and skip object processing if Data1 was not received at all.

Fixes: 6d0dbeae71f0 ("Input: synaptics-rmi4 - handle incomplete input data")
Signed-off-by: Dmitry Mikushin <dmitry@kernelgen.org>
---
 drivers/input/rmi4/rmi_f12.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/input/rmi4/rmi_f12.c b/drivers/input/rmi4/rmi_f12.c
index 841884d967a3..34f24de34465 100644
--- a/drivers/input/rmi4/rmi_f12.c
+++ b/drivers/input/rmi4/rmi_f12.c
@@ -278,9 +278,9 @@ static irqreturn_t rmi_f12_attention(int irq, void *ctx)
 		}
 	}
 
-	if (f12->data1)
+	if (f12->data1 && valid_bytes > f12->data1_offset)
 		rmi_f12_process_objects(f12, &sensor->data_pkt[f12->data1_offset],
-					valid_bytes);
+					valid_bytes - f12->data1_offset);
 
 	input_mt_sync_frame(sensor->input);
 
-- 
2.56.0

[PATCH v2 2/3] Input: synaptics-rmi4 - f12: read only the object data on attention

[Dmitry Mikushin]

When F12 data is not supplied by the transport as attention data, the
attention handler reads the whole F12 data packet on every interrupt,
although only Data1 (the object reports) is consumed. The remaining
data registers are never used.

On SMBus this transfer is the dominant per-frame cost. On a ThinkPad
P14s Gen 2i with a Synaptics TM3471-030 (i801 SMBus) the F12 data
packet is 79 bytes, of which Data1 is the first 32. Reading 79 bytes
takes about 17.4 ms and reading 32 bytes about 7.3 ms. With the full
read the touchpad reports at about 43 Hz (median 23.0 ms between
frames), and fast swipes yield only a handful of frames, so they are
mostly lost to pointer acceleration and smoothing.
Reading only Data1 raises the report rate to about 65 Hz (median
15.3 ms between frames), measured with a finger on the same machine.

Compute the size of the leading registers up to and including Data1 at
probe time and read only that much. The attention data path (hid-rmi)
is unchanged.

Signed-off-by: Dmitry Mikushin <dmitry@kernelgen.org>
---
 drivers/input/rmi4/rmi_f12.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/input/rmi4/rmi_f12.c b/drivers/input/rmi4/rmi_f12.c
index 34f24de34465..b3cd72d5bea6 100644
--- a/drivers/input/rmi4/rmi_f12.c
+++ b/drivers/input/rmi4/rmi_f12.c
@@ -58,6 +58,8 @@ struct f12_data {
 	const struct rmi_register_desc_item *data15;
 	u16 data15_offset;
 
+	u32 read_size;
+
 	unsigned long irq_mask[];
 };
 
@@ -269,8 +271,9 @@ static irqreturn_t rmi_f12_attention(int irq, void *ctx)
 		drvdata->attn_data.data += valid_bytes;
 		drvdata->attn_data.size -= valid_bytes;
 	} else {
+		valid_bytes = f12->read_size;
 		retval = rmi_read_block(rmi_dev, f12->data_addr,
-					sensor->data_pkt, sensor->pkt_size);
+					sensor->data_pkt, valid_bytes);
 		if (retval < 0) {
 			dev_err(&fn->dev, "Failed to read object data. Code: %d.\n",
 				retval);
@@ -529,6 +532,17 @@ static int rmi_f12_probe(struct rmi_function *fn)
 		data_offset += item->reg_size;
 	}
 
+	/*
+	 * Only Data1 (object reports) is consumed when the data registers
+	 * are read from the device, so do not read the remaining registers
+	 * on every attention. On SMBus this transfer dominates the per-frame
+	 * cost and therefore limits the report rate.
+	 */
+	f12->read_size = sensor->pkt_size;
+	if (f12->data1)
+		f12->read_size = min_t(u32, sensor->pkt_size,
+				       f12->data1_offset + f12->data1->reg_size);
+
 	/* allocate the in-kernel tracking buffers */
 	sensor->tracking_pos = devm_kcalloc(&fn->dev, sensor->nbr_fingers,
 					    sizeof(*sensor->tracking_pos),
-- 
2.56.0

[PATCH v2 3/3] Input: synaptics - add LEN2072 to smbus_pnp_ids for ThinkPad P14s Gen 2i

[Dmitry Mikushin]

The ThinkPad P14s Gen 2i (20VX) has a Synaptics TM3471-030 touchpad
(PNP ID LEN2072, firmware 3324237) that supports SMBus/RMI4, but it is
not in smbus_pnp_ids[], so psmouse drives it in legacy PS/2 mode. There
it is limited to two tracked contacts and shares the i8042 channel with
the TrackPoint.

With psmouse.synaptics_intertouch=1 the touchpad binds to rmi4 at SMBus
address 0x2c, reports four contacts, and the TrackPoint keeps working
through the RMI4 pass-through port. Suspend/resume (s2idle) works.

Add LEN2072 to the smbus_pnp_ids[] passlist.

Signed-off-by: Dmitry Mikushin <dmitry@kernelgen.org>
---
 drivers/input/mouse/synaptics.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 1ed9261bff2b..b007e642ea76 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -194,6 +194,7 @@ static const char * const smbus_pnp_ids[] = {
 	"LEN2058", /* E490 */
 	"LEN205b", /* T490 */
 	"LEN2068", /* T14 Gen 1 */
+	"LEN2072", /* P14s Gen 2i */
 	"SYN1221", /* TUXEDO InfinityBook Pro 14 v5 */
 	"SYN3003", /* HP EliteBook 850 G1 */
 	"SYN3015", /* HP EliteBook 840 G2 */
-- 
2.56.0

Re: [PATCH v2 0/3] Input: synaptics - enable SMBus for ThinkPad P14s Gen 2i (LEN2072)

[Dmitry Torokhov]

On Mon, Oct 26, 2026 at 03:26:45PM +0100, Dmitry Mikushin wrote:
> The ThinkPad P14s Gen 2i touchpad (Synaptics TM3471-030, LEN2072) is
> not on the SMBus passlist and runs in PS/2 mode. Forcing RMI4 alone
> does not help: the F12 attention handler reads the whole 79-byte data
> packet over SMBus on every frame, which caps the report rate at about
> 43 Hz and loses fast swipes.
> 
> Patch 1 fixes the size passed to rmi_f12_process_objects(), which
> counted from the start of the data packet instead of from Data1.
> Patch 2 makes F12 read only the registers up to and including Data1,
> raising the report rate to about 65 Hz on this machine. Patch 3 then
> adds LEN2072 to smbus_pnp_ids and should not be applied without
> patch 2.
> 
> Tested on a ThinkPad P14s Gen 2i (20VX) on 7.2.9, including s2idle
> suspend/resume and the TrackPoint on the RMI4 pass-through port. On
> this device Data1 is the first data register, so patch 1 does not
> change its behavior.
> 
> Changes in v2:
> - New patch 1. Sashiko pointed out that with patch 2 alone, on devices
>   where Data1 is not at offset 0, rmi_f12_process_objects() could parse
>   bytes past the end of what was read. The underlying off-by-
>   data1_offset bound predates this series, so it is fixed separately
>   with a Fixes: tag.
> - No changes to patches 2 and 3.

Applied the lot, thank you.

-- 
Dmitry