Re: [PATCH 7.1 00/21] 7.1.2-rc1 review

[Dmitry Torokhov <dmitry.torokhov@gmail.com>]

Hi Barry,

On Fri, Jun 26, 2026 at 10:56:21AM -0700, Barry K. Nathan wrote:
> (cc Dmitry Torokhov because this is related to two of your commits)
> 
> On 6/25/26 6:03 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 7.1.2 release.
> > There are 21 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000.
> > Anything received after that time might be too late.
> > 
> > The whole patch series can be found in one patch at:
> > 	https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.2-rc1.gz
> > or in the git tree and branch at:
> > 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y
> > and the diffstat can be found below.
> > 
> > thanks,
> > 
> > greg k-h
> > 
> 
> Unfortunately, 7.1.2-rc1 breaks the Synaptics touchpad on my Lenovo
> ThinkPad T14 Gen 1 -- the pointer no longer moves when I touch the
> touchpad. Potentially relevant line from dmesg:
> 
> rmi4_f01 rmi4-00.fn01: found RMI device, manufacturer: Synaptics, product: TM3471-020, fw id: 3972349
> 
> > Dmitry Torokhov<dmitry.torokhov@gmail.com>
> >      Input: rmi4 - refactor register descriptor parsing
> > 
> > Dmitry Torokhov<dmitry.torokhov@gmail.com>
> >      Input: rmi4 - fix register descriptor address calculation
> 
> Both of these patches seem bad in my testing. Either one, individually,
> causes the pointer to no longer move when I touch the touchpad. If I
> revert both of them, then my touchpad works again.
> 
> I have not yet tested 7.0.14-rc1 or 6.18.37-rc1. However, the problem
> also reproduces on current mainline as of this writing (commit
> 51cb1aa1250c36269474b8b6ca6b6319e170f5a5).

Could you please try applying this debug patch and send me dmesg?

diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index 49a59da6a841..65095257e3c3 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -569,27 +569,35 @@ static int rmi_parse_register_desc_item(struct rmi_register_desc_item *item,
 	unsigned int map_offset = 0;
 	int b;
 
-	if (offset >= size)
+	if (offset >= size) {
+		pr_err("%s: error: offset >= size (%d >= %zu)\n", __func__, offset, size);
 		return -EIO;
+	}
 
 	item->reg_size = buf[offset++];
 	if (item->reg_size == 0) {
-		if (size - offset < 2)
+		if (size - offset < 2) {
+			pr_err("%s: error: size - offset < 2 (%zu - %d < 2)\n", __func__, size, offset);
 			return -EIO;
+		}
 		item->reg_size = get_unaligned_le16(&buf[offset]);
 		offset += 2;
 	}
 
 	if (item->reg_size == 0) {
-		if (size - offset < 4)
+		if (size - offset < 4) {
+			pr_err("%s: error: size - offset < 4 (%zu - %d < 4)\n", __func__, size, offset);
 			return -EIO;
+		}
 		item->reg_size = get_unaligned_le32(&buf[offset]);
 		offset += 4;
 	}
 
 	do {
-		if (offset >= size)
+		if (offset >= size) {
+			pr_err("%s: error in loop: offset >= size (%d >= %zu)\n", __func__, offset, size);
 			return -EIO;
+		}
 
 		for (b = 0; b < 7; b++) {
 			if (buf[offset] & BIT(b)) {
@@ -625,9 +633,11 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
 	 * The first register of the register descriptor is the size of
 	 * the register descriptor's presence register.
 	 */
+	pr_info("%s: starting read at addr 0x%04x\n", __func__, addr);
 	ret = rmi_read(d, addr, &size_presence_reg);
 	if (ret)
 		return ret;
+	pr_info("%s: size_presence_reg = %d\n", __func__, size_presence_reg);
 	++addr;
 
 	if (size_presence_reg < 1 || size_presence_reg > RMI_REG_DESC_PRESENCE_REGS_MAX)
@@ -643,7 +653,10 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
 	ret = rmi_read_block(d, addr, buf, size_presence_reg);
 	if (ret)
 		return ret;
+	pr_info("%s: presence reg: %*ph\n", __func__, (int)size_presence_reg, buf);
+	
 	addr += size_presence_reg;
+	pr_info("%s: advanced addr to 0x%04x (after skipping presence reg)\n", __func__, addr);
 
 	if (buf[0] == 0) {
 		if (size_presence_reg < 3)
@@ -654,6 +667,7 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
 		presence_offset = 1;
 		rdesc->struct_size = buf[0];
 	}
+	pr_info("%s: struct_size = %ld\n", __func__, rdesc->struct_size);
 
 	memset(presence_map, 0, sizeof(presence_map));
 	map_offset = 0;
@@ -670,6 +684,7 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
 
 	rdesc->num_registers = bitmap_weight(presence_map,
 						RMI_REG_DESC_PRESENCE_BITS);
+	pr_info("%s: num_registers = %d\n", __func__, rdesc->num_registers);
 
 	rdesc->registers = devm_kcalloc(&d->dev,
 					rdesc->num_registers,
@@ -693,10 +708,14 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
 	 * register and a bitmap of all subpackets contained in the packet
 	 * register.
 	 */
+	pr_info("%s: reading struct_buf from addr 0x%04x, size %ld\n", __func__, addr, rdesc->struct_size);
 	ret = rmi_read_block(d, addr, struct_buf, rdesc->struct_size);
 	if (ret)
 		return ret;
 
+	print_hex_dump(KERN_INFO, "rmi_struct: ", DUMP_PREFIX_OFFSET, 16, 1,
+		       struct_buf, rdesc->struct_size, false);
+
 	reg = find_first_bit(presence_map, RMI_REG_DESC_PRESENCE_BITS);
 	offset = 0;
 	for (i = 0; i < rdesc->num_registers; i++) {
@@ -712,9 +731,8 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
 		item->reg = reg;
 		offset += item_size;
 
-		rmi_dbg(RMI_DEBUG_CORE, &d->dev,
-			"%s: reg: %d reg size: %u subpackets: %d\n", __func__,
-			item->reg, item->reg_size, item->num_subpackets);
+		pr_info("%s: parsed item %d: reg: %d reg size: %u subpackets: %d\n", __func__,
+			i, item->reg, item->reg_size, item->num_subpackets);
 
 		reg = find_next_bit(presence_map,
 				    RMI_REG_DESC_PRESENCE_BITS, reg + 1);

> 

-- 
Dmitry