Hi Barry,
On Fri, Jun 26, 2026 at 10:56:21AM -0700, Barry K. Nathan wrote:
(cc Dmitry Torokhov because this is related to two of your commits)
On 6/25/26 6:03 AM, Greg Kroah-Hartman wrote:
This is the start of the stable review cycle for the 7.1.2 release. There are 21 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.2-rc1.g... or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below.
thanks,
greg k-h
Unfortunately, 7.1.2-rc1 breaks the Synaptics touchpad on my Lenovo ThinkPad T14 Gen 1 -- the pointer no longer moves when I touch the touchpad. Potentially relevant line from dmesg:
rmi4_f01 rmi4-00.fn01: found RMI device, manufacturer: Synaptics, product: TM3471-020, fw id: 3972349
Dmitry Torokhovdmitry.torokhov@gmail.com Input: rmi4 - refactor register descriptor parsing
Dmitry Torokhovdmitry.torokhov@gmail.com Input: rmi4 - fix register descriptor address calculation
Both of these patches seem bad in my testing. Either one, individually, causes the pointer to no longer move when I touch the touchpad. If I revert both of them, then my touchpad works again.
I have not yet tested 7.0.14-rc1 or 6.18.37-rc1. However, the problem also reproduces on current mainline as of this writing (commit 51cb1aa1250c36269474b8b6ca6b6319e170f5a5).
Could you please try applying this debug patch and send me dmesg?
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c index 49a59da6a841..65095257e3c3 100644 --- a/drivers/input/rmi4/rmi_driver.c +++ b/drivers/input/rmi4/rmi_driver.c @@ -569,27 +569,35 @@ static int rmi_parse_register_desc_item(struct rmi_register_desc_item *item, unsigned int map_offset = 0; int b;
- if (offset >= size) + if (offset >= size) { + pr_err("%s: error: offset >= size (%d >= %zu)\n", __func__, offset, size); return -EIO; + }
item->reg_size = buf[offset++]; if (item->reg_size == 0) { - if (size - offset < 2) + if (size - offset < 2) { + pr_err("%s: error: size - offset < 2 (%zu - %d < 2)\n", __func__, size, offset); return -EIO; + } item->reg_size = get_unaligned_le16(&buf[offset]); offset += 2; }
if (item->reg_size == 0) { - if (size - offset < 4) + if (size - offset < 4) { + pr_err("%s: error: size - offset < 4 (%zu - %d < 4)\n", __func__, size, offset); return -EIO; + } item->reg_size = get_unaligned_le32(&buf[offset]); offset += 4; }
do { - if (offset >= size) + if (offset >= size) { + pr_err("%s: error in loop: offset >= size (%d >= %zu)\n", __func__, offset, size); return -EIO; + }
for (b = 0; b < 7; b++) { if (buf[offset] & BIT(b)) { @@ -625,9 +633,11 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr, * The first register of the register descriptor is the size of * the register descriptor's presence register. */ + pr_info("%s: starting read at addr 0x%04x\n", __func__, addr); ret = rmi_read(d, addr, &size_presence_reg); if (ret) return ret; + pr_info("%s: size_presence_reg = %d\n", __func__, size_presence_reg); ++addr;
if (size_presence_reg < 1 || size_presence_reg > RMI_REG_DESC_PRESENCE_REGS_MAX) @@ -643,7 +653,10 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr, ret = rmi_read_block(d, addr, buf, size_presence_reg); if (ret) return ret; + pr_info("%s: presence reg: %*ph\n", __func__, (int)size_presence_reg, buf); + addr += size_presence_reg; + pr_info("%s: advanced addr to 0x%04x (after skipping presence reg)\n", __func__, addr);
if (buf[0] == 0) { if (size_presence_reg < 3) @@ -654,6 +667,7 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr, presence_offset = 1; rdesc->struct_size = buf[0]; } + pr_info("%s: struct_size = %ld\n", __func__, rdesc->struct_size);
memset(presence_map, 0, sizeof(presence_map)); map_offset = 0; @@ -670,6 +684,7 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
rdesc->num_registers = bitmap_weight(presence_map, RMI_REG_DESC_PRESENCE_BITS); + pr_info("%s: num_registers = %d\n", __func__, rdesc->num_registers);
rdesc->registers = devm_kcalloc(&d->dev, rdesc->num_registers, @@ -693,10 +708,14 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr, * register and a bitmap of all subpackets contained in the packet * register. */ + pr_info("%s: reading struct_buf from addr 0x%04x, size %ld\n", __func__, addr, rdesc->struct_size); ret = rmi_read_block(d, addr, struct_buf, rdesc->struct_size); if (ret) return ret;
+ print_hex_dump(KERN_INFO, "rmi_struct: ", DUMP_PREFIX_OFFSET, 16, 1, + struct_buf, rdesc->struct_size, false); + reg = find_first_bit(presence_map, RMI_REG_DESC_PRESENCE_BITS); offset = 0; for (i = 0; i < rdesc->num_registers; i++) { @@ -712,9 +731,8 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr, item->reg = reg; offset += item_size;
- rmi_dbg(RMI_DEBUG_CORE, &d->dev, - "%s: reg: %d reg size: %u subpackets: %d\n", __func__, - item->reg, item->reg_size, item->num_subpackets); + pr_info("%s: parsed item %d: reg: %d reg size: %u subpackets: %d\n", __func__, + i, item->reg, item->reg_size, item->num_subpackets);
reg = find_next_bit(presence_map, RMI_REG_DESC_PRESENCE_BITS, reg + 1);