Update v6.1 patches

Changes:
 - Big IPTS/ITHC update:
   - Update IPTS driver to its latest version. This switches the
     interface from a custom device interface to hidraw.
   - Include ITHC driver to support touchscreen and pen on newer
     generation devices.

   Note: Both require an updated IPTSd version.

 - Rebase onto 6.1.9

Links:
 - kernel: https://github.com/linux-surface/kernel/commit/db042d733971f965a4124882dded0e7f85f75942
 - ipts: https://github.com/linux-surface/intel-precise-touch/commit/8abe26863ae77aab278d070a8a4604f00b6ec698
 - ithc: https://github.com/quo/ithc-linux/commit/55803a23ac040410bf67628f8cbd658f366972ef

configs/surface-6.1.config

@@ -25,12 +25,13 @@ CONFIG_CHARGER_SURFACE=m
 CONFIG_SURFACE_HOTPLUG=m
 
 #
-# IPTS touchscreen
+# IPTS and ITHC touchscreen
 #
-# This only enables the user interface for IPTS data.
+# This only enables the user interface for IPTS/ITHC data.
 # For the touchscreen to work, you need to install iptsd.
 #
-CONFIG_MISC_IPTS=m
+CONFIG_HID_IPTS=m
+CONFIG_HID_ITHC=m
 
 #
 # Cameras: IPU3

patches/6.1/0001-surface3-oemb.patch

@@ -1,4 +1,4 @@
-From e209bd87d08869950b9fbccb1b1a52ae46cca2ee Mon Sep 17 00:00:00 2001
+From 23aa5e79237a32749fae59f6c57b72b91b3f7d8c Mon Sep 17 00:00:00 2001
 From: Tsuchiya Yuto <kitakar@gmail.com>
 Date: Sun, 18 Oct 2020 16:42:44 +0900
 Subject: [PATCH] (surface3-oemb) add DMI matches for Surface 3 with broken DMI

patches/6.1/0002-mwifiex.patch

@@ -1,4 +1,4 @@
-From 807126f1fee9adc792b657e503e2377c9474368f Mon Sep 17 00:00:00 2001
+From 433c150583548550a4f7d70555327ad4841439f5 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jonas=20Dre=C3=9Fler?= <verdre@v0yd.nl>
 Date: Tue, 3 Nov 2020 13:28:04 +0100
 Subject: [PATCH] mwifiex: Add quirk resetting the PCI bridge on MS Surface
@@ -165,7 +165,7 @@ index d6ff964aec5b..5d30ae39d65e 100644
 -- 
 2.39.1
 
-From f004292d23fe1371e1ce2c3e7782cc661164195c Mon Sep 17 00:00:00 2001
+From 9213544f2bdb8da9f418603c0dec038b5f60827e Mon Sep 17 00:00:00 2001
 From: Tsuchiya Yuto <kitakar@gmail.com>
 Date: Sun, 4 Oct 2020 00:11:49 +0900
 Subject: [PATCH] mwifiex: pcie: disable bridge_d3 for Surface gen4+
@@ -320,7 +320,7 @@ index 5d30ae39d65e..c14eb56eb911 100644
 -- 
 2.39.1
 
-From 86af49b1d4ec2d7faae0a6f8798d11aa90215481 Mon Sep 17 00:00:00 2001
+From 432e8b738082459dff82013f75145c9aa31ce4c9 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jonas=20Dre=C3=9Fler?= <verdre@v0yd.nl>
 Date: Thu, 25 Mar 2021 11:33:02 +0100
 Subject: [PATCH] Bluetooth: btusb: Lower passive lescan interval on Marvell

patches/6.1/0003-ath10k.patch

@@ -1,4 +1,4 @@
-From f22fbfa5abbca831ccbf4217adda1b8d50ee3954 Mon Sep 17 00:00:00 2001
+From 06a33cf28d8fcd107f431bb6f6574cf7500156ff Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
 Date: Sat, 27 Feb 2021 00:45:52 +0100
 Subject: [PATCH] ath10k: Add module parameters to override board files

patches/6.1/0004-ipts.patch

@@ -1,4 +1,4 @@
-From 2c2d01dbe82ccd154da707a53f5dab45b37300aa Mon Sep 17 00:00:00 2001
+From c478dcf8c11deacc16b2d9a80c26af3c22ccdd3e Mon Sep 17 00:00:00 2001
 From: Dorian Stoll <dorian.stoll@tmsp.io>
 Date: Thu, 30 Jul 2020 13:21:53 +0200
 Subject: [PATCH] misc: mei: Add missing IPTS device IDs
@@ -36,76 +36,197 @@ index 5bf0d50d55a0..c13864512229 100644
 -- 
 2.39.1
 
-From 0d59af85033cbff1496b6a4de1a5dce755c0b30f Mon Sep 17 00:00:00 2001
+From 25bccbb65a0f464a6da0913f3485270e2c840d76 Mon Sep 17 00:00:00 2001
+From: Liban Hannan <liban.p@gmail.com>
+Date: Tue, 12 Apr 2022 23:31:12 +0100
+Subject: [PATCH] iommu: ipts: use IOMMU passthrough mode for IPTS
+
+Adds a quirk so that IOMMU uses passthrough mode for the IPTS device.
+Otherwise, when IOMMU is enabled, IPTS produces DMAR errors like:
+
+DMAR: [DMA Read NO_PASID] Request device [00:16.4] fault addr
+0x104ea3000 [fault reason 0x06] PTE Read access is not set
+
+This is very similar to the bug described at:
+https://bugs.launchpad.net/bugs/1958004
+
+Fixed with the following patch which this patch basically copies:
+https://launchpadlibrarian.net/586396847/43255ca.diff
+Patchset: ipts
+---
+ drivers/iommu/intel/iommu.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index 644ca49e8cf8..408c321b929a 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -37,6 +37,8 @@
+ #define IS_GFX_DEVICE(pdev) ((pdev->class >> 16) == PCI_BASE_CLASS_DISPLAY)
+ #define IS_USB_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_SERIAL_USB)
+ #define IS_ISA_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA)
++#define IS_IPTS(pdev) ((pdev)->vendor == PCI_VENDOR_ID_INTEL &&	\
++			    ((pdev)->device == 0x9d3e))
+ #define IS_AZALIA(pdev) ((pdev)->vendor == 0x8086 && (pdev)->device == 0x3a3e)
+ 
+ #define IOAPIC_RANGE_START	(0xfee00000)
+@@ -286,12 +288,14 @@ int intel_iommu_enabled = 0;
+ EXPORT_SYMBOL_GPL(intel_iommu_enabled);
+ 
+ static int dmar_map_gfx = 1;
++static int dmar_map_ipts = 1;
+ static int intel_iommu_superpage = 1;
+ static int iommu_identity_mapping;
+ static int iommu_skip_te_disable;
+ 
+ #define IDENTMAP_GFX		2
+ #define IDENTMAP_AZALIA		4
++#define IDENTMAP_IPTS		16
+ 
+ const struct iommu_ops intel_iommu_ops;
+ 
+@@ -2630,6 +2634,9 @@ static int device_def_domain_type(struct device *dev)
+ 
+ 		if ((iommu_identity_mapping & IDENTMAP_GFX) && IS_GFX_DEVICE(pdev))
+ 			return IOMMU_DOMAIN_IDENTITY;
++
++		if ((iommu_identity_mapping & IDENTMAP_IPTS) && IS_IPTS(pdev))
++			return IOMMU_DOMAIN_IDENTITY;
+ 	}
+ 
+ 	return 0;
+@@ -3019,6 +3026,9 @@ static int __init init_dmars(void)
+ 	if (!dmar_map_gfx)
+ 		iommu_identity_mapping |= IDENTMAP_GFX;
+ 
++	if (!dmar_map_ipts)
++		iommu_identity_mapping |= IDENTMAP_IPTS;
++
+ 	check_tylersburg_isoch();
+ 
+ 	ret = si_domain_init(hw_pass_through);
+@@ -4774,6 +4784,17 @@ static void quirk_iommu_igfx(struct pci_dev *dev)
+ 	dmar_map_gfx = 0;
+ }
+ 
++static void quirk_iommu_ipts(struct pci_dev *dev)
++{
++	if (!IS_IPTS(dev))
++		return;
++
++	if (risky_device(dev))
++		return;
++
++	pci_info(dev, "Passthrough IOMMU for IPTS\n");
++	dmar_map_ipts = 0;
++}
+ /* G4x/GM45 integrated gfx dmar support is totally busted. */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_igfx);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e00, quirk_iommu_igfx);
+@@ -4809,6 +4830,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1632, quirk_iommu_igfx);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x163A, quirk_iommu_igfx);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x163D, quirk_iommu_igfx);
+ 
++/* disable IPTS dmar support */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9D3E, quirk_iommu_ipts);
++
+ static void quirk_iommu_rwbf(struct pci_dev *dev)
+ {
+ 	if (risky_device(dev))
+-- 
+2.39.1
+
+From f7a9a34b94d87014af3d459a7abe67189c02348c Mon Sep 17 00:00:00 2001
 From: Dorian Stoll <dorian.stoll@tmsp.io>
-Date: Thu, 6 Aug 2020 11:20:41 +0200
-Subject: [PATCH] misc: Add support for Intel Precise Touch & Stylus
+Date: Sun, 11 Dec 2022 12:00:59 +0100
+Subject: [PATCH] hid: Add support for Intel Precise Touch and Stylus
 
-Based on linux-surface/intel-precise-touch@3f362c
+Based on linux-surface/intel-precise-touch@8abe268
 
 Signed-off-by: Dorian Stoll <dorian.stoll@tmsp.io>
 Patchset: ipts
 ---
- drivers/misc/Kconfig          |   1 +
- drivers/misc/Makefile         |   1 +
- drivers/misc/ipts/Kconfig     |  17 ++
- drivers/misc/ipts/Makefile    |  12 ++
- drivers/misc/ipts/context.h   |  47 +++++
- drivers/misc/ipts/control.c   | 113 +++++++++++
- drivers/misc/ipts/control.h   |  24 +++
- drivers/misc/ipts/mei.c       | 125 ++++++++++++
- drivers/misc/ipts/protocol.h  | 347 ++++++++++++++++++++++++++++++++++
- drivers/misc/ipts/receiver.c  | 224 ++++++++++++++++++++++
- drivers/misc/ipts/receiver.h  |  16 ++
- drivers/misc/ipts/resources.c | 128 +++++++++++++
- drivers/misc/ipts/resources.h |  17 ++
- drivers/misc/ipts/uapi.c      | 208 ++++++++++++++++++++
- drivers/misc/ipts/uapi.h      |  47 +++++
- 15 files changed, 1327 insertions(+)
- create mode 100644 drivers/misc/ipts/Kconfig
- create mode 100644 drivers/misc/ipts/Makefile
- create mode 100644 drivers/misc/ipts/context.h
- create mode 100644 drivers/misc/ipts/control.c
- create mode 100644 drivers/misc/ipts/control.h
- create mode 100644 drivers/misc/ipts/mei.c
- create mode 100644 drivers/misc/ipts/protocol.h
- create mode 100644 drivers/misc/ipts/receiver.c
- create mode 100644 drivers/misc/ipts/receiver.h
- create mode 100644 drivers/misc/ipts/resources.c
- create mode 100644 drivers/misc/ipts/resources.h
- create mode 100644 drivers/misc/ipts/uapi.c
- create mode 100644 drivers/misc/ipts/uapi.h
+ drivers/hid/Kconfig            |   2 +
+ drivers/hid/Makefile           |   2 +
+ drivers/hid/ipts/Kconfig       |  14 +
+ drivers/hid/ipts/Makefile      |  14 +
+ drivers/hid/ipts/cmd.c         |  62 +++++
+ drivers/hid/ipts/cmd.h         |  61 ++++
+ drivers/hid/ipts/context.h     |  51 ++++
+ drivers/hid/ipts/control.c     | 495 +++++++++++++++++++++++++++++++++
+ drivers/hid/ipts/control.h     | 127 +++++++++
+ drivers/hid/ipts/desc.h        |  81 ++++++
+ drivers/hid/ipts/hid.c         | 348 +++++++++++++++++++++++
+ drivers/hid/ipts/hid.h         |  22 ++
+ drivers/hid/ipts/main.c        | 127 +++++++++
+ drivers/hid/ipts/mei.c         | 189 +++++++++++++
+ drivers/hid/ipts/mei.h         |  67 +++++
+ drivers/hid/ipts/receiver.c    | 249 +++++++++++++++++
+ drivers/hid/ipts/receiver.h    |  17 ++
+ drivers/hid/ipts/resources.c   | 108 +++++++
+ drivers/hid/ipts/resources.h   |  39 +++
+ drivers/hid/ipts/spec-data.h   | 100 +++++++
+ drivers/hid/ipts/spec-device.h | 285 +++++++++++++++++++
+ drivers/hid/ipts/spec-hid.h    |  35 +++
+ drivers/hid/ipts/thread.c      |  85 ++++++
+ drivers/hid/ipts/thread.h      |  60 ++++
+ 24 files changed, 2640 insertions(+)
+ create mode 100644 drivers/hid/ipts/Kconfig
+ create mode 100644 drivers/hid/ipts/Makefile
+ create mode 100644 drivers/hid/ipts/cmd.c
+ create mode 100644 drivers/hid/ipts/cmd.h
+ create mode 100644 drivers/hid/ipts/context.h
+ create mode 100644 drivers/hid/ipts/control.c
+ create mode 100644 drivers/hid/ipts/control.h
+ create mode 100644 drivers/hid/ipts/desc.h
+ create mode 100644 drivers/hid/ipts/hid.c
+ create mode 100644 drivers/hid/ipts/hid.h
+ create mode 100644 drivers/hid/ipts/main.c
+ create mode 100644 drivers/hid/ipts/mei.c
+ create mode 100644 drivers/hid/ipts/mei.h
+ create mode 100644 drivers/hid/ipts/receiver.c
+ create mode 100644 drivers/hid/ipts/receiver.h
+ create mode 100644 drivers/hid/ipts/resources.c
+ create mode 100644 drivers/hid/ipts/resources.h
+ create mode 100644 drivers/hid/ipts/spec-data.h
+ create mode 100644 drivers/hid/ipts/spec-device.h
+ create mode 100644 drivers/hid/ipts/spec-hid.h
+ create mode 100644 drivers/hid/ipts/thread.c
+ create mode 100644 drivers/hid/ipts/thread.h
 
-diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
-index 358ad56f6524..1fd6f755f98b 100644
---- a/drivers/misc/Kconfig
-+++ b/drivers/misc/Kconfig
-@@ -514,4 +514,5 @@ source "drivers/misc/habanalabs/Kconfig"
- source "drivers/misc/uacce/Kconfig"
- source "drivers/misc/pvpanic/Kconfig"
- source "drivers/misc/mchp_pci1xxxx/Kconfig"
-+source "drivers/misc/ipts/Kconfig"
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 185a077d59cd..1523ccdf73b5 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -1290,4 +1290,6 @@ source "drivers/hid/amd-sfh-hid/Kconfig"
+ 
+ source "drivers/hid/surface-hid/Kconfig"
+ 
++source "drivers/hid/ipts/Kconfig"
++
  endmenu
-diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
-index ac9b3e757ba1..5a82ffe77911 100644
---- a/drivers/misc/Makefile
-+++ b/drivers/misc/Makefile
-@@ -62,3 +62,4 @@ obj-$(CONFIG_HI6421V600_IRQ)	+= hi6421v600-irq.o
- obj-$(CONFIG_OPEN_DICE)		+= open-dice.o
- obj-$(CONFIG_GP_PCI1XXXX)	+= mchp_pci1xxxx/
- obj-$(CONFIG_VCPU_STALL_DETECTOR)	+= vcpu_stall_detector.o
-+obj-$(CONFIG_MISC_IPTS)		+= ipts/
-diff --git a/drivers/misc/ipts/Kconfig b/drivers/misc/ipts/Kconfig
+diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
+index e8014c1a2f8b..e48300bcea9b 100644
+--- a/drivers/hid/Makefile
++++ b/drivers/hid/Makefile
+@@ -164,3 +164,5 @@ obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER)	+= intel-ish-hid/
+ obj-$(CONFIG_AMD_SFH_HID)       += amd-sfh-hid/
+ 
+ obj-$(CONFIG_SURFACE_HID_CORE)  += surface-hid/
++
++obj-$(CONFIG_HID_IPTS)          += ipts/
+diff --git a/drivers/hid/ipts/Kconfig b/drivers/hid/ipts/Kconfig
 new file mode 100644
-index 000000000000..83e2a930c396
+index 000000000000..297401bd388d
 --- /dev/null
-+++ b/drivers/misc/ipts/Kconfig
-@@ -0,0 +1,17 @@
++++ b/drivers/hid/ipts/Kconfig
+@@ -0,0 +1,14 @@
 +# SPDX-License-Identifier: GPL-2.0-or-later
 +
-+config MISC_IPTS
++config HID_IPTS
 +	tristate "Intel Precise Touch & Stylus"
 +	depends on INTEL_MEI
++	depends on HID
 +	help
 +	  Say Y here if your system has a touchscreen using Intels
 +	  Precise Touch & Stylus (IPTS) technology.
@@ -114,1490 +235,2754 @@ index 000000000000..83e2a930c396
 +
 +	  To compile this driver as a module, choose M here: the
 +	  module will be called ipts.
-+
-+	  Building this driver alone will not give you a working touchscreen.
-+	  It only exposed a userspace API that can be used by a daemon to
-+	  receive and process data from the touchscreen hardware.
-diff --git a/drivers/misc/ipts/Makefile b/drivers/misc/ipts/Makefile
+diff --git a/drivers/hid/ipts/Makefile b/drivers/hid/ipts/Makefile
 new file mode 100644
-index 000000000000..8f58b9adbc94
+index 000000000000..0fe655bccdc0
 --- /dev/null
-+++ b/drivers/misc/ipts/Makefile
-@@ -0,0 +1,12 @@
++++ b/drivers/hid/ipts/Makefile
+@@ -0,0 +1,14 @@
 +# SPDX-License-Identifier: GPL-2.0-or-later
 +#
 +# Makefile for the IPTS touchscreen driver
 +#
 +
-+obj-$(CONFIG_MISC_IPTS) += ipts.o
-+ipts-objs := control.o
++obj-$(CONFIG_HID_IPTS) += ipts.o
++ipts-objs := cmd.o
++ipts-objs += control.o
++ipts-objs += hid.o
++ipts-objs += main.o
 +ipts-objs += mei.o
 +ipts-objs += receiver.o
 +ipts-objs += resources.o
-+ipts-objs += uapi.o
-+
-diff --git a/drivers/misc/ipts/context.h b/drivers/misc/ipts/context.h
-new file mode 100644
-index 000000000000..f4b06a2d3f72
---- /dev/null
-+++ b/drivers/misc/ipts/context.h
-@@ -0,0 +1,47 @@
-+/* SPDX-License-Identifier: GPL-2.0-or-later */
-+/*
-+ * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
-+ *
-+ * Linux driver for Intel Precise Touch & Stylus
-+ */
-+
-+#ifndef _IPTS_CONTEXT_H_
-+#define _IPTS_CONTEXT_H_
-+
-+#include <linux/cdev.h>
-+#include <linux/device.h>
-+#include <linux/mei_cl_bus.h>
-+#include <linux/types.h>
-+
-+#include "protocol.h"
-+
-+enum ipts_host_status {
-+	IPTS_HOST_STATUS_STARTING,
-+	IPTS_HOST_STATUS_STARTED,
-+	IPTS_HOST_STATUS_STOPPING,
-+	IPTS_HOST_STATUS_STOPPED,
-+};
-+
-+struct ipts_buffer_info {
-+	u8 *address;
-+	dma_addr_t dma_address;
-+};
-+
-+struct ipts_context {
-+	struct mei_cl_device *cldev;
-+	struct device *dev;
-+
-+	bool restart;
-+	enum ipts_host_status status;
-+	struct ipts_get_device_info_rsp device_info;
-+
-+	struct ipts_buffer_info data[IPTS_BUFFERS];
-+	struct ipts_buffer_info doorbell;
-+
-+	struct ipts_buffer_info feedback[IPTS_BUFFERS];
-+	struct ipts_buffer_info workqueue;
-+	struct ipts_buffer_info host2me;
-+};
-+
-+#endif /* _IPTS_CONTEXT_H_ */
-diff --git a/drivers/misc/ipts/control.c b/drivers/misc/ipts/control.c
++ipts-objs += thread.o
+diff --git a/drivers/hid/ipts/cmd.c b/drivers/hid/ipts/cmd.c
 new file mode 100644
-index 000000000000..a1d1f97a13d7
+index 000000000000..7fd69271ccd5
 --- /dev/null
-+++ b/drivers/misc/ipts/control.c
-@@ -0,0 +1,113 @@
++++ b/drivers/hid/ipts/cmd.c
+@@ -0,0 +1,62 @@
 +// SPDX-License-Identifier: GPL-2.0-or-later
 +/*
 + * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
++ * Copyright (c) 2020-2023 Dorian Stoll
 + *
 + * Linux driver for Intel Precise Touch & Stylus
 + */
 +
-+#include <linux/mei_cl_bus.h>
++#include <linux/errno.h>
++#include <linux/types.h>
 +
++#include "cmd.h"
 +#include "context.h"
-+#include "protocol.h"
-+#include "resources.h"
-+#include "uapi.h"
++#include "mei.h"
++#include "spec-device.h"
 +
-+int ipts_control_send(struct ipts_context *ipts, u32 code, void *payload,
-+		      size_t size)
++int ipts_cmd_recv_timeout(struct ipts_context *ipts, enum ipts_command_code code,
++			  struct ipts_response *rsp, u64 timeout)
 +{
-+	int ret;
-+	struct ipts_command cmd;
-+
-+	memset(&cmd, 0, sizeof(struct ipts_command));
-+	cmd.code = code;
++	int ret = 0;
 +
-+	if (payload && size > 0)
-+		memcpy(&cmd.payload, payload, size);
++	if (!ipts)
++		return -EFAULT;
 +
-+	ret = mei_cldev_send(ipts->cldev, (u8 *)&cmd, sizeof(cmd.code) + size);
-+	if (ret >= 0)
-+		return 0;
++	if (!rsp)
++		return -EFAULT;
 +
 +	/*
-+	 * During shutdown the device might get pulled away from below our feet.
-+	 * Dont log an error in this case, because it will confuse people.
++	 * In a response, the command code will have the most significant bit flipped to 1.
++	 * If code is passed to ipts_mei_recv as is, no messages will be received.
 +	 */
-+	if (ret != -ENODEV || ipts->status != IPTS_HOST_STATUS_STOPPING)
-+		dev_err(ipts->dev, "Error while sending: 0x%X:%d\n", code, ret);
-+
-+	return ret;
-+}
++	ret = ipts_mei_recv(&ipts->mei, code | IPTS_RSP_BIT, rsp, timeout);
++	if (ret < 0)
++		return ret;
 +
-+int ipts_control_send_feedback(struct ipts_context *ipts, u32 buffer)
-+{
-+	struct ipts_feedback_cmd cmd;
++	dev_dbg(ipts->dev, "Received 0x%02X with status 0x%02X\n", code, rsp->status);
 +
-+	memset(&cmd, 0, sizeof(struct ipts_feedback_cmd));
-+	cmd.buffer = buffer;
++	/*
++	 * Some devices will always return this error.
++	 * It is allowed to ignore it and to try continuing.
++	 */
++	if (rsp->status == IPTS_STATUS_COMPAT_CHECK_FAIL)
++		rsp->status = IPTS_STATUS_SUCCESS;
 +
-+	return ipts_control_send(ipts, IPTS_CMD_FEEDBACK, &cmd,
-+				 sizeof(struct ipts_feedback_cmd));
++	return 0;
 +}
 +
-+int ipts_control_set_feature(struct ipts_context *ipts, u8 report, u8 value)
++int ipts_cmd_send(struct ipts_context *ipts, enum ipts_command_code code, void *data, size_t size)
 +{
-+	struct ipts_feedback_buffer *feedback;
-+
-+	memset(ipts->host2me.address, 0, ipts->device_info.feedback_size);
-+	feedback = (struct ipts_feedback_buffer *)ipts->host2me.address;
++	struct ipts_command cmd = { 0 };
 +
-+	feedback->cmd_type = IPTS_FEEDBACK_CMD_TYPE_NONE;
-+	feedback->data_type = IPTS_FEEDBACK_DATA_TYPE_SET_FEATURES;
-+	feedback->buffer = IPTS_HOST2ME_BUFFER;
-+	feedback->size = 2;
-+	feedback->payload[0] = report;
-+	feedback->payload[1] = value;
-+
-+	return ipts_control_send_feedback(ipts, IPTS_HOST2ME_BUFFER);
-+}
++	if (!ipts)
++		return -EFAULT;
 +
-+int ipts_control_start(struct ipts_context *ipts)
-+{
-+	if (ipts->status != IPTS_HOST_STATUS_STOPPED)
-+		return -EBUSY;
++	cmd.cmd = code;
 +
-+	dev_info(ipts->dev, "Starting IPTS\n");
-+	ipts->status = IPTS_HOST_STATUS_STARTING;
-+	ipts->restart = false;
++	if (data && size > 0)
++		memcpy(cmd.payload, data, size);
 +
-+	ipts_uapi_link(ipts);
-+	return ipts_control_send(ipts, IPTS_CMD_GET_DEVICE_INFO, NULL, 0);
++	dev_dbg(ipts->dev, "Sending 0x%02X with %ld bytes payload\n", code, size);
++	return ipts_mei_send(&ipts->mei, &cmd, sizeof(cmd.cmd) + size);
 +}
+diff --git a/drivers/hid/ipts/cmd.h b/drivers/hid/ipts/cmd.h
+new file mode 100644
+index 000000000000..924758ffee67
+--- /dev/null
++++ b/drivers/hid/ipts/cmd.h
+@@ -0,0 +1,61 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2020-2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
++ */
 +
-+int ipts_control_stop(struct ipts_context *ipts)
-+{
-+	int ret;
-+
-+	if (ipts->status == IPTS_HOST_STATUS_STOPPING)
-+		return -EBUSY;
++#ifndef IPTS_CMD_H
++#define IPTS_CMD_H
 +
-+	if (ipts->status == IPTS_HOST_STATUS_STOPPED)
-+		return -EBUSY;
++#include <linux/types.h>
 +
-+	dev_info(ipts->dev, "Stopping IPTS\n");
-+	ipts->status = IPTS_HOST_STATUS_STOPPING;
++#include "context.h"
++#include "spec-device.h"
 +
-+	ipts_uapi_unlink();
-+	ipts_resources_free(ipts);
++/*
++ * The default timeout for receiving responses
++ */
++#define IPTS_CMD_DEFAULT_TIMEOUT 1000
 +
-+	ret = ipts_control_send_feedback(ipts, 0);
-+	if (ret == -ENODEV)
-+		ipts->status = IPTS_HOST_STATUS_STOPPED;
++/*
++ * ipts_cmd_recv_timeout() - Receives a response to a command.
++ * @ipts: The IPTS driver context.
++ * @code: The type of the command / response.
++ * @rsp: The address that the received response will be copied to.
++ * @timeout: How many milliseconds the function will wait at most.
++ *
++ * A negative timeout means to wait forever.
++ *
++ * Returns: 0 on success, <0 on error, -EAGAIN if no response has been received.
++ */
++int ipts_cmd_recv_timeout(struct ipts_context *ipts, enum ipts_command_code code,
++			  struct ipts_response *rsp, u64 timeout);
 +
-+	return ret;
++/*
++ * ipts_cmd_recv() - Receives a response to a command.
++ * @ipts: The IPTS driver context.
++ * @code: The type of the command / response.
++ * @rsp: The address that the received response will be copied to.
++ *
++ * Returns: 0 on success, <0 on error, -EAGAIN if no response has been received.
++ */
++static inline int ipts_cmd_recv(struct ipts_context *ipts, enum ipts_command_code code,
++				struct ipts_response *rsp)
++{
++	return ipts_cmd_recv_timeout(ipts, code, rsp, IPTS_CMD_DEFAULT_TIMEOUT);
 +}
 +
-+int ipts_control_restart(struct ipts_context *ipts)
-+{
-+	if (ipts->restart)
-+		return -EBUSY;
++/*
++ * ipts_cmd_send() - Executes a command on the device.
++ * @ipts: The IPTS driver context.
++ * @code: The type of the command to execute.
++ * @data: The payload containing parameters for the command.
++ * @size: The size of the payload.
++ *
++ * Returns: 0 on success, <0 on error.
++ */
++int ipts_cmd_send(struct ipts_context *ipts, enum ipts_command_code code, void *data, size_t size);
 +
-+	ipts->restart = true;
-+	return ipts_control_stop(ipts);
-+}
-diff --git a/drivers/misc/ipts/control.h b/drivers/misc/ipts/control.h
++#endif /* IPTS_CMD_H */
+diff --git a/drivers/hid/ipts/context.h b/drivers/hid/ipts/context.h
 new file mode 100644
-index 000000000000..2c44e9e0e99f
+index 000000000000..3450a95e66ee
 --- /dev/null
-+++ b/drivers/misc/ipts/control.h
-@@ -0,0 +1,24 @@
++++ b/drivers/hid/ipts/context.h
+@@ -0,0 +1,51 @@
 +/* SPDX-License-Identifier: GPL-2.0-or-later */
 +/*
 + * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
++ * Copyright (c) 2020-2023 Dorian Stoll
 + *
 + * Linux driver for Intel Precise Touch & Stylus
 + */
 +
-+#ifndef _IPTS_CONTROL_H_
-+#define _IPTS_CONTROL_H_
++#ifndef IPTS_CONTEXT_H
++#define IPTS_CONTEXT_H
 +
++#include <linux/completion.h>
++#include <linux/device.h>
++#include <linux/hid.h>
++#include <linux/mei_cl_bus.h>
++#include <linux/mutex.h>
++#include <linux/sched.h>
 +#include <linux/types.h>
 +
-+#include "context.h"
++#include "mei.h"
++#include "resources.h"
++#include "spec-device.h"
++#include "thread.h"
 +
-+int ipts_control_send(struct ipts_context *ipts, u32 cmd, void *payload,
-+		      size_t size);
-+int ipts_control_send_feedback(struct ipts_context *ipts, u32 buffer);
-+int ipts_control_set_feature(struct ipts_context *ipts, u8 report, u8 value);
-+int ipts_control_start(struct ipts_context *ipts);
-+int ipts_control_restart(struct ipts_context *ipts);
-+int ipts_control_stop(struct ipts_context *ipts);
++struct ipts_context {
++	struct device *dev;
++	struct ipts_mei mei;
++
++	enum ipts_mode mode;
++
++	/*
++	 * Prevents concurrent GET_FEATURE reports.
++	 */
++	struct mutex feature_lock;
++	struct completion feature_event;
++
++	/*
++	 * These are not inside of struct ipts_resources
++	 * because they don't own the memory they point to.
++	 */
++	struct ipts_buffer feature_report;
++	struct ipts_buffer descriptor;
++
++	struct hid_device *hid;
++	struct ipts_device_info info;
++	struct ipts_resources resources;
++
++	struct ipts_thread receiver_loop;
++};
 +
-+#endif /* _IPTS_CONTROL_H_ */
-diff --git a/drivers/misc/ipts/mei.c b/drivers/misc/ipts/mei.c
++#endif /* IPTS_CONTEXT_H */
+diff --git a/drivers/hid/ipts/control.c b/drivers/hid/ipts/control.c
 new file mode 100644
-index 000000000000..59ecf13e00d2
+index 000000000000..2f61500b5119
 --- /dev/null
-+++ b/drivers/misc/ipts/mei.c
-@@ -0,0 +1,125 @@
++++ b/drivers/hid/ipts/control.c
+@@ -0,0 +1,495 @@
 +// SPDX-License-Identifier: GPL-2.0-or-later
 +/*
 + * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
++ * Copyright (c) 2020-2023 Dorian Stoll
 + *
 + * Linux driver for Intel Precise Touch & Stylus
 + */
 +
 +#include <linux/delay.h>
-+#include <linux/dma-mapping.h>
-+#include <linux/mei_cl_bus.h>
-+#include <linux/mod_devicetable.h>
-+#include <linux/module.h>
-+#include <linux/slab.h>
++#include <linux/dev_printk.h>
++#include <linux/errno.h>
++#include <linux/kernel.h>
++#include <linux/kthread.h>
++#include <linux/types.h>
 +
++#include "cmd.h"
 +#include "context.h"
 +#include "control.h"
-+#include "protocol.h"
++#include "desc.h"
++#include "hid.h"
 +#include "receiver.h"
-+#include "uapi.h"
++#include "resources.h"
++#include "spec-data.h"
++#include "spec-device.h"
 +
-+static int ipts_mei_set_dma_mask(struct mei_cl_device *cldev)
++static int ipts_control_get_device_info(struct ipts_context *ipts, struct ipts_device_info *info)
 +{
-+	int ret;
-+
-+	ret = dma_coerce_mask_and_coherent(&cldev->dev, DMA_BIT_MASK(64));
-+	if (!ret)
-+		return 0;
-+
-+	return dma_coerce_mask_and_coherent(&cldev->dev, DMA_BIT_MASK(32));
-+}
++	int ret = 0;
++	struct ipts_response rsp = { 0 };
 +
-+static int ipts_mei_probe(struct mei_cl_device *cldev,
-+			  const struct mei_cl_device_id *id)
-+{
-+	int ret;
-+	struct ipts_context *ipts;
++	if (!ipts)
++		return -EFAULT;
 +
-+	if (ipts_mei_set_dma_mask(cldev)) {
-+		dev_err(&cldev->dev, "Failed to set DMA mask for IPTS\n");
++	if (!info)
 +		return -EFAULT;
-+	}
 +
-+	ret = mei_cldev_enable(cldev);
++	ret = ipts_cmd_send(ipts, IPTS_CMD_GET_DEVICE_INFO, NULL, 0);
 +	if (ret) {
-+		dev_err(&cldev->dev, "Failed to enable MEI device: %d\n", ret);
++		dev_err(ipts->dev, "GET_DEVICE_INFO: send failed: %d\n", ret);
 +		return ret;
 +	}
 +
-+	ipts = kzalloc(sizeof(*ipts), GFP_KERNEL);
-+	if (!ipts) {
-+		mei_cldev_disable(cldev);
-+		return -ENOMEM;
++	ret = ipts_cmd_recv(ipts, IPTS_CMD_GET_DEVICE_INFO, &rsp);
++	if (ret) {
++		dev_err(ipts->dev, "GET_DEVICE_INFO: recv failed: %d\n", ret);
++		return ret;
 +	}
 +
-+	ipts->cldev = cldev;
-+	ipts->dev = &cldev->dev;
-+	ipts->status = IPTS_HOST_STATUS_STOPPED;
-+
-+	mei_cldev_set_drvdata(cldev, ipts);
-+	mei_cldev_register_rx_cb(cldev, ipts_receiver_callback);
++	if (rsp.status != IPTS_STATUS_SUCCESS) {
++		dev_err(ipts->dev, "GET_DEVICE_INFO: cmd failed: %d\n", rsp.status);
++		return -EBADR;
++	}
 +
-+	return ipts_control_start(ipts);
++	memcpy(info, rsp.payload, sizeof(*info));
++	return 0;
 +}
 +
-+static void ipts_mei_remove(struct mei_cl_device *cldev)
++static int ipts_control_set_mode(struct ipts_context *ipts, enum ipts_mode mode)
 +{
-+	int i;
-+	struct ipts_context *ipts = mei_cldev_get_drvdata(cldev);
++	int ret = 0;
++	struct ipts_set_mode cmd = { 0 };
++	struct ipts_response rsp = { 0 };
 +
-+	ipts_control_stop(ipts);
++	if (!ipts)
++		return -EFAULT;
 +
-+	for (i = 0; i < 20; i++) {
-+		if (ipts->status == IPTS_HOST_STATUS_STOPPED)
-+			break;
++	cmd.mode = mode;
 +
-+		msleep(25);
++	ret = ipts_cmd_send(ipts, IPTS_CMD_SET_MODE, &cmd, sizeof(cmd));
++	if (ret) {
++		dev_err(ipts->dev, "SET_MODE: send failed: %d\n", ret);
++		return ret;
 +	}
 +
-+	mei_cldev_disable(cldev);
-+	kfree(ipts);
-+}
++	ret = ipts_cmd_recv(ipts, IPTS_CMD_SET_MODE, &rsp);
++	if (ret) {
++		dev_err(ipts->dev, "SET_MODE: recv failed: %d\n", ret);
++		return ret;
++	}
 +
-+static struct mei_cl_device_id ipts_mei_device_id_table[] = {
-+	{ "", IPTS_MEI_UUID, MEI_CL_VERSION_ANY },
-+	{},
-+};
-+MODULE_DEVICE_TABLE(mei, ipts_mei_device_id_table);
++	if (rsp.status != IPTS_STATUS_SUCCESS) {
++		dev_err(ipts->dev, "SET_MODE: cmd failed: %d\n", rsp.status);
++		return -EBADR;
++	}
 +
-+static struct mei_cl_driver ipts_mei_driver = {
-+	.id_table = ipts_mei_device_id_table,
-+	.name = "ipts",
-+	.probe = ipts_mei_probe,
-+	.remove = ipts_mei_remove,
-+};
++	return 0;
++}
 +
-+static int __init ipts_mei_init(void)
++static int ipts_control_set_mem_window(struct ipts_context *ipts, struct ipts_resources *res)
 +{
-+	int ret;
++	int ret = 0;
++	struct ipts_mem_window cmd = { 0 };
++	struct ipts_response rsp = { 0 };
 +
-+	ret = ipts_uapi_init();
++	if (!ipts)
++		return -EFAULT;
++
++	if (!res)
++		return -EFAULT;
++
++	for (int i = 0; i < IPTS_BUFFERS; i++) {
++		cmd.data_addr_lower[i] = lower_32_bits(res->data[i].dma_address);
++		cmd.data_addr_upper[i] = upper_32_bits(res->data[i].dma_address);
++		cmd.feedback_addr_lower[i] = lower_32_bits(res->feedback[i].dma_address);
++		cmd.feedback_addr_upper[i] = upper_32_bits(res->feedback[i].dma_address);
++	}
++
++	cmd.workqueue_addr_lower = lower_32_bits(res->workqueue.dma_address);
++	cmd.workqueue_addr_upper = upper_32_bits(res->workqueue.dma_address);
++
++	cmd.doorbell_addr_lower = lower_32_bits(res->doorbell.dma_address);
++	cmd.doorbell_addr_upper = upper_32_bits(res->doorbell.dma_address);
++
++	cmd.hid2me_addr_lower = lower_32_bits(res->hid2me.dma_address);
++	cmd.hid2me_addr_upper = upper_32_bits(res->hid2me.dma_address);
++
++	cmd.workqueue_size = IPTS_WORKQUEUE_SIZE;
++	cmd.workqueue_item_size = IPTS_WORKQUEUE_ITEM_SIZE;
++
++	ret = ipts_cmd_send(ipts, IPTS_CMD_SET_MEM_WINDOW, &cmd, sizeof(cmd));
++	if (ret) {
++		dev_err(ipts->dev, "SET_MEM_WINDOW: send failed: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_cmd_recv(ipts, IPTS_CMD_SET_MEM_WINDOW, &rsp);
++	if (ret) {
++		dev_err(ipts->dev, "SET_MEM_WINDOW: recv failed: %d\n", ret);
++		return ret;
++	}
++
++	if (rsp.status != IPTS_STATUS_SUCCESS) {
++		dev_err(ipts->dev, "SET_MEM_WINDOW: cmd failed: %d\n", rsp.status);
++		return -EBADR;
++	}
++
++	return 0;
++}
++
++static int ipts_control_get_descriptor(struct ipts_context *ipts)
++{
++	int ret = 0;
++	struct ipts_data_header *header = NULL;
++	struct ipts_get_descriptor cmd = { 0 };
++	struct ipts_response rsp = { 0 };
++
++	if (!ipts)
++		return -EFAULT;
++
++	if (!ipts->resources.descriptor.address)
++		return -EFAULT;
++
++	memset(ipts->resources.descriptor.address, 0, ipts->resources.descriptor.size);
++
++	cmd.addr_lower = lower_32_bits(ipts->resources.descriptor.dma_address);
++	cmd.addr_upper = upper_32_bits(ipts->resources.descriptor.dma_address);
++	cmd.magic = 8;
++
++	ret = ipts_cmd_send(ipts, IPTS_CMD_GET_DESCRIPTOR, &cmd, sizeof(cmd));
++	if (ret) {
++		dev_err(ipts->dev, "GET_DESCRIPTOR: send failed: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_cmd_recv(ipts, IPTS_CMD_GET_DESCRIPTOR, &rsp);
++	if (ret) {
++		dev_err(ipts->dev, "GET_DESCRIPTOR: recv failed: %d\n", ret);
++		return ret;
++	}
++
++	if (rsp.status != IPTS_STATUS_SUCCESS) {
++		dev_err(ipts->dev, "GET_DESCRIPTOR: cmd failed: %d\n", rsp.status);
++		return -EBADR;
++	}
++
++	header = (struct ipts_data_header *)ipts->resources.descriptor.address;
++
++	if (header->type == IPTS_DATA_TYPE_DESCRIPTOR) {
++		ipts->descriptor.address = &header->data[8];
++		ipts->descriptor.size = header->size - 8;
++
++		return 0;
++	}
++
++	return -ENODATA;
++}
++
++int ipts_control_request_flush(struct ipts_context *ipts)
++{
++	int ret = 0;
++	struct ipts_quiesce_io cmd = { 0 };
++
++	if (!ipts)
++		return -EFAULT;
++
++	ret = ipts_cmd_send(ipts, IPTS_CMD_QUIESCE_IO, &cmd, sizeof(cmd));
 +	if (ret)
++		dev_err(ipts->dev, "QUIESCE_IO: send failed: %d\n", ret);
++
++	return ret;
++}
++
++int ipts_control_wait_flush(struct ipts_context *ipts)
++{
++	int ret = 0;
++	struct ipts_response rsp = { 0 };
++
++	if (!ipts)
++		return -EFAULT;
++
++	ret = ipts_cmd_recv(ipts, IPTS_CMD_QUIESCE_IO, &rsp);
++	if (ret) {
++		dev_err(ipts->dev, "QUIESCE_IO: recv failed: %d\n", ret);
 +		return ret;
++	}
++
++	if (rsp.status == IPTS_STATUS_TIMEOUT)
++		return -EAGAIN;
++
++	if (rsp.status != IPTS_STATUS_SUCCESS) {
++		dev_err(ipts->dev, "QUIESCE_IO: cmd failed: %d\n", rsp.status);
++		return -EBADR;
++	}
++
++	return 0;
++}
++
++int ipts_control_request_data(struct ipts_context *ipts)
++{
++	int ret = 0;
++
++	if (!ipts)
++		return -EFAULT;
++
++	ret = ipts_cmd_send(ipts, IPTS_CMD_READY_FOR_DATA, NULL, 0);
++	if (ret)
++		dev_err(ipts->dev, "READY_FOR_DATA: send failed: %d\n", ret);
++
++	return ret;
++}
++
++int ipts_control_wait_data(struct ipts_context *ipts, bool shutdown)
++{
++	int ret = 0;
++	struct ipts_response rsp = { 0 };
++
++	if (!ipts)
++		return -EFAULT;
++
++	if (!shutdown)
++		ret = ipts_cmd_recv_timeout(ipts, IPTS_CMD_READY_FOR_DATA, &rsp, 0);
++	else
++		ret = ipts_cmd_recv(ipts, IPTS_CMD_READY_FOR_DATA, &rsp);
 +
-+	ret = mei_cldev_driver_register(&ipts_mei_driver);
 +	if (ret) {
-+		ipts_uapi_free();
++		if (ret != -EAGAIN)
++			dev_err(ipts->dev, "READY_FOR_DATA: recv failed: %d\n", ret);
++
 +		return ret;
 +	}
 +
++	/*
++	 * During shutdown, it is possible that the sensor has already been disabled.
++	 */
++	if (rsp.status == IPTS_STATUS_SENSOR_DISABLED)
++		return 0;
++
++	if (rsp.status == IPTS_STATUS_TIMEOUT)
++		return -EAGAIN;
++
++	if (rsp.status != IPTS_STATUS_SUCCESS) {
++		dev_err(ipts->dev, "READY_FOR_DATA: cmd failed: %d\n", rsp.status);
++		return -EBADR;
++	}
++
 +	return 0;
 +}
 +
-+static void __exit ipts_mei_exit(void)
++int ipts_control_send_feedback(struct ipts_context *ipts, u32 buffer)
 +{
-+	mei_cldev_driver_unregister(&ipts_mei_driver);
-+	ipts_uapi_free();
++	int ret = 0;
++	struct ipts_feedback cmd = { 0 };
++	struct ipts_response rsp = { 0 };
++
++	if (!ipts)
++		return -EFAULT;
++
++	cmd.buffer = buffer;
++
++	ret = ipts_cmd_send(ipts, IPTS_CMD_FEEDBACK, &cmd, sizeof(cmd));
++	if (ret) {
++		dev_err(ipts->dev, "FEEDBACK: send failed: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_cmd_recv(ipts, IPTS_CMD_FEEDBACK, &rsp);
++	if (ret) {
++		dev_err(ipts->dev, "FEEDBACK: recv failed: %d\n", ret);
++		return ret;
++	}
++
++	/*
++	 * We don't know what feedback data looks like so we are sending zeros.
++	 * See also ipts_control_refill_buffer.
++	 */
++	if (rsp.status == IPTS_STATUS_INVALID_PARAMS)
++		return 0;
++
++	if (rsp.status != IPTS_STATUS_SUCCESS) {
++		dev_err(ipts->dev, "FEEDBACK: cmd failed: %d\n", rsp.status);
++		return -EBADR;
++	}
++
++	return 0;
 +}
 +
-+MODULE_DESCRIPTION("IPTS touchscreen driver");
-+MODULE_AUTHOR("Dorian Stoll <dorian.stoll@tmsp.io>");
-+MODULE_LICENSE("GPL");
++int ipts_control_hid2me_feedback(struct ipts_context *ipts, enum ipts_feedback_cmd_type cmd,
++				 enum ipts_feedback_data_type type, void *data, size_t size)
++{
++	struct ipts_feedback_header *header = NULL;
++
++	if (!ipts)
++		return -EFAULT;
++
++	if (!ipts->resources.hid2me.address)
++		return -EFAULT;
++
++	memset(ipts->resources.hid2me.address, 0, ipts->resources.hid2me.size);
++	header = (struct ipts_feedback_header *)ipts->resources.hid2me.address;
++
++	header->cmd_type = cmd;
++	header->data_type = type;
++	header->size = size;
++	header->buffer = IPTS_HID2ME_BUFFER;
++
++	if (size + sizeof(*header) > ipts->resources.hid2me.size)
++		return -EINVAL;
++
++	if (data && size > 0)
++		memcpy(header->payload, data, size);
++
++	return ipts_control_send_feedback(ipts, IPTS_HID2ME_BUFFER);
++}
 +
-+module_init(ipts_mei_init);
-+module_exit(ipts_mei_exit);
-diff --git a/drivers/misc/ipts/protocol.h b/drivers/misc/ipts/protocol.h
++static inline int ipts_control_reset_sensor(struct ipts_context *ipts)
++{
++	return ipts_control_hid2me_feedback(ipts, IPTS_FEEDBACK_CMD_TYPE_SOFT_RESET,
++					    IPTS_FEEDBACK_DATA_TYPE_VENDOR, NULL, 0);
++}
++
++int ipts_control_start(struct ipts_context *ipts)
++{
++	int ret = 0;
++	struct ipts_device_info info = { 0 };
++
++	if (!ipts)
++		return -EFAULT;
++
++	dev_info(ipts->dev, "Starting IPTS\n");
++
++	ret = ipts_control_get_device_info(ipts, &info);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to get device info: %d\n", ret);
++		return ret;
++	}
++
++	ipts->info = info;
++
++	ret = ipts_resources_init(&ipts->resources, ipts->dev, info.data_size, info.feedback_size);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to allocate buffers: %d", ret);
++		return ret;
++	}
++
++	dev_info(ipts->dev, "IPTS EDS Version: %d\n", info.intf_eds);
++
++	/*
++	 * Handle newer devices
++	 */
++	if (info.intf_eds > 1) {
++		/*
++		 * Fetching the descriptor will only work on newer devices.
++		 * For older devices, a fallback descriptor will be used.
++		 */
++		ret = ipts_control_get_descriptor(ipts);
++		if (ret) {
++			dev_err(ipts->dev, "Failed to fetch HID descriptor: %d\n", ret);
++			return ret;
++		}
++
++		/*
++		 * Newer devices can be directly initialized in doorbell mode.
++		 */
++		ipts->mode = IPTS_MODE_DOORBELL;
++	}
++
++	ret = ipts_control_set_mode(ipts, ipts->mode);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to set mode: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_control_set_mem_window(ipts, &ipts->resources);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to set memory window: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_receiver_start(ipts);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to start receiver: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_control_request_data(ipts);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to request data: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_hid_init(ipts, info);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to initialize HID device: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static int _ipts_control_stop(struct ipts_context *ipts)
++{
++	int ret = 0;
++
++	if (!ipts)
++		return -EFAULT;
++
++	dev_info(ipts->dev, "Stopping IPTS\n");
++
++	ret = ipts_receiver_stop(ipts);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to stop receiver: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_control_reset_sensor(ipts);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to reset sensor: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_resources_free(&ipts->resources);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to free resources: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++int ipts_control_stop(struct ipts_context *ipts)
++{
++	int ret = 0;
++
++	ret = _ipts_control_stop(ipts);
++	if (ret)
++		return ret;
++
++	ret = ipts_hid_free(ipts);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to free HID device: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++int ipts_control_restart(struct ipts_context *ipts)
++{
++	int ret = 0;
++
++	ret = _ipts_control_stop(ipts);
++	if (ret)
++		return ret;
++
++	/*
++	 * Give the sensor some time to come back from resetting
++	 */
++	msleep(1000);
++
++	ret = ipts_control_start(ipts);
++	if (ret)
++		return ret;
++
++	return 0;
++}
+diff --git a/drivers/hid/ipts/control.h b/drivers/hid/ipts/control.h
 new file mode 100644
-index 000000000000..c3458904a94d
+index 000000000000..744bb92d682a
 --- /dev/null
-+++ b/drivers/misc/ipts/protocol.h
-@@ -0,0 +1,347 @@
++++ b/drivers/hid/ipts/control.h
+@@ -0,0 +1,127 @@
 +/* SPDX-License-Identifier: GPL-2.0-or-later */
 +/*
 + * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
++ * Copyright (c) 2020-2023 Dorian Stoll
 + *
 + * Linux driver for Intel Precise Touch & Stylus
 + */
 +
-+#ifndef _IPTS_PROTOCOL_H_
-+#define _IPTS_PROTOCOL_H_
++#ifndef IPTS_CONTROL_H
++#define IPTS_CONTROL_H
 +
 +#include <linux/types.h>
 +
-+/*
-+ * The MEI client ID for IPTS functionality.
-+ */
-+#define IPTS_MEI_UUID                                                          \
-+	UUID_LE(0x3e8d0870, 0x271a, 0x4208, 0x8e, 0xb5, 0x9a, 0xcb, 0x94,      \
-+		0x02, 0xae, 0x04)
++#include "context.h"
++#include "spec-data.h"
++#include "spec-device.h"
 +
 +/*
-+ * Queries the device for vendor specific information.
++ * ipts_control_request_flush() - Stop the data flow.
++ * @ipts: The IPTS driver context.
++ *
++ * Runs the command to stop the data flow on the device.
++ * All outstanding data needs to be acknowledged using feedback before the command will return.
 + *
-+ * The command must not contain any payload.
-+ * The response will contain struct ipts_get_device_info_rsp as payload.
++ * Returns: 0 on success, <0 on error.
 + */
-+#define IPTS_CMD_GET_DEVICE_INFO 0x00000001
-+#define IPTS_RSP_GET_DEVICE_INFO 0x80000001
++int ipts_control_request_flush(struct ipts_context *ipts);
 +
 +/*
-+ * Sets the mode that IPTS will operate in.
++ * ipts_control_wait_flush() - Wait until data flow has been stopped.
++ * @ipts: The IPTS driver context.
 + *
-+ * The command must contain struct ipts_set_mode_cmd as payload.
-+ * The response will not contain any payload.
++ * Returns: 0 on success, <0 on error.
 + */
-+#define IPTS_CMD_SET_MODE 0x00000002
-+#define IPTS_RSP_SET_MODE 0x80000002
++int ipts_control_wait_flush(struct ipts_context *ipts);
 +
 +/*
-+ * Configures the memory buffers that the ME will use
-+ * for passing data to the host.
++ * ipts_control_wait_flush() - Notify the device that the driver can receive new data.
++ * @ipts: The IPTS driver context.
 + *
-+ * The command must contain struct ipts_set_mem_window_cmd as payload.
-+ * The response will not contain any payload.
++ * Returns: 0 on success, <0 on error.
 + */
-+#define IPTS_CMD_SET_MEM_WINDOW 0x00000003
-+#define IPTS_RSP_SET_MEM_WINDOW 0x80000003
++int ipts_control_request_data(struct ipts_context *ipts);
 +
 +/*
-+ * Signals that the host is ready to receive data to the ME.
++ * ipts_control_wait_data() - Wait until new data is available.
++ * @ipts: The IPTS driver context.
++ * @block: Whether to block execution until data is available.
 + *
-+ * The command must not contain any payload.
-+ * The response will not contain any payload.
++ * In doorbell mode, this function will never return while the data flow is active. Instead,
++ * the doorbell will be incremented when new data is available.
++ *
++ * Returns: 0 on success, <0 on error, -EAGAIN if no data is available.
 + */
-+#define IPTS_CMD_READY_FOR_DATA 0x00000005
-+#define IPTS_RSP_READY_FOR_DATA 0x80000005
++int ipts_control_wait_data(struct ipts_context *ipts, bool block);
 +
 +/*
-+ * Signals that a buffer can be refilled to the ME.
++ * ipts_control_send_feedback() - Submits a feedback buffer to the device.
++ * @ipts: The IPTS driver context.
++ * @buffer: The ID of the buffer containing feedback data.
 + *
-+ * The command must contain struct ipts_feedback_cmd as payload.
-+ * The response will not contain any payload.
++ * Returns: 0 on success, <0 on error.
 + */
-+#define IPTS_CMD_FEEDBACK 0x00000006
-+#define IPTS_RSP_FEEDBACK 0x80000006
++int ipts_control_send_feedback(struct ipts_context *ipts, u32 buffer);
 +
 +/*
-+ * Resets the data flow from the ME to the hosts and
-+ * clears the buffers that were set with SET_MEM_WINDOW.
++ * ipts_control_hid2me_feedback() - Sends HID2ME feedback, a special type of feedback.
++ * @ipts: The IPTS driver context.
++ * @cmd: The command that will be run on the device.
++ * @type: The type of the payload that is sent to the device.
++ * @data: The payload of the feedback command.
++ * @size: The size of the payload.
 + *
-+ * The command must not contain any payload.
-+ * The response will not contain any payload.
++ * HID2ME feedback is a special type of feedback, because it allows interfacing with
++ * the HID API of the device at any moment, without requiring a buffer that has to
++ * be acknowledged.
++ *
++ * Returns: 0 on success, <0 on error.
 + */
-+#define IPTS_CMD_CLEAR_MEM_WINDOW 0x00000007
-+#define IPTS_RSP_CLEAR_MEM_WINDOW 0x80000007
++int ipts_control_hid2me_feedback(struct ipts_context *ipts, enum ipts_feedback_cmd_type cmd,
++				 enum ipts_feedback_data_type type, void *data, size_t size);
 +
 +/*
-+ * Instructs the ME to reset the touch sensor.
++ * ipts_control_refill_buffer() - Acknowledges that data in a buffer has been processed.
++ * @ipts: The IPTS driver context.
++ * @buffer: The buffer that has been processed and can be refilled.
 + *
-+ * The command must contain struct ipts_reset_sensor_cmd as payload.
-+ * The response will not contain any payload.
++ * Returns: 0 on success, <0 on error.
 + */
-+#define IPTS_CMD_RESET_SENSOR 0x0000000B
-+#define IPTS_RSP_RESET_SENSOR 0x8000000B
++static inline int ipts_control_refill_buffer(struct ipts_context *ipts, u32 buffer)
++{
++	/*
++	 * IPTS expects structured data in the feedback buffer matching the buffer that will be
++	 * refilled. We don't know what that data looks like, so we just keep the buffer empty.
++	 * This results in an INVALID_PARAMS error, but the buffer gets refilled without an issue.
++	 * Sending a minimal structure with the buffer ID fixes the error, but breaks refilling
++	 * the buffers on some devices.
++	 */
 +
-+/**
-+ * enum ipts_status - Possible status codes returned by IPTS commands.
-+ * @IPTS_STATUS_SUCCESS:                 Operation completed successfully.
-+ * @IPTS_STATUS_INVALID_PARAMS:          Command contained a payload with invalid parameters.
-+ * @IPTS_STATUS_ACCESS_DENIED:           ME could not validate buffer addresses supplied by host.
-+ * @IPTS_STATUS_CMD_SIZE_ERROR:          Command contains an invalid payload.
-+ * @IPTS_STATUS_NOT_READY:               Buffer addresses have not been set.
-+ * @IPTS_STATUS_REQUEST_OUTSTANDING:     There is an outstanding command of the same type.
-+ *                                       The host must wait for a response before sending another
-+ *                                       command of the same type.
-+ * @IPTS_STATUS_NO_SENSOR_FOUND:         No sensor could be found. Either no sensor is connected, it
-+ *                                       has not been initialized yet, or the system is improperly
-+ *                                       configured.
-+ * @IPTS_STATUS_OUT_OF_MEMORY:           Not enough free memory for requested operation.
-+ * @IPTS_STATUS_INTERNAL_ERROR:          An unexpected error occurred.
-+ * @IPTS_STATUS_SENSOR_DISABLED:         The sensor has been disabled and must be reinitialized.
-+ * @IPTS_STATUS_COMPAT_CHECK_FAIL:       Compatibility revision check between sensor and ME failed.
-+ *                                       The host can ignore this error and attempt to continue.
-+ * @IPTS_STATUS_SENSOR_EXPECTED_RESET:   The sensor went through a reset initiated by ME or host.
-+ * @IPTS_STATUS_SENSOR_UNEXPECTED_RESET: The sensor went through an unexpected reset.
-+ * @IPTS_STATUS_RESET_FAILED:            Requested sensor reset failed to complete.
-+ * @IPTS_STATUS_TIMEOUT:                 The operation timed out.
-+ * @IPTS_STATUS_TEST_MODE_FAIL:          Test mode pattern did not match expected values.
-+ * @IPTS_STATUS_SENSOR_FAIL_FATAL:       The sensor reported a fatal error during reset sequence.
-+ *                                       Further progress is not possible.
-+ * @IPTS_STATUS_SENSOR_FAIL_NONFATAL:    The sensor reported a fatal error during reset sequence.
-+ *                                       The host can attempt to continue.
-+ * @IPTS_STATUS_INVALID_DEVICE_CAPS:     The device reported invalid capabilities.
-+ * @IPTS_STATUS_QUIESCE_IO_IN_PROGRESS:  Command cannot be completed until Quiesce IO is done.
-+ */
-+enum ipts_status {
-+	IPTS_STATUS_SUCCESS = 0,
-+	IPTS_STATUS_INVALID_PARAMS = 1,
-+	IPTS_STATUS_ACCESS_DENIED = 2,
-+	IPTS_STATUS_CMD_SIZE_ERROR = 3,
-+	IPTS_STATUS_NOT_READY = 4,
-+	IPTS_STATUS_REQUEST_OUTSTANDING = 5,
-+	IPTS_STATUS_NO_SENSOR_FOUND = 6,
-+	IPTS_STATUS_OUT_OF_MEMORY = 7,
-+	IPTS_STATUS_INTERNAL_ERROR = 8,
-+	IPTS_STATUS_SENSOR_DISABLED = 9,
-+	IPTS_STATUS_COMPAT_CHECK_FAIL = 10,
-+	IPTS_STATUS_SENSOR_EXPECTED_RESET = 11,
-+	IPTS_STATUS_SENSOR_UNEXPECTED_RESET = 12,
-+	IPTS_STATUS_RESET_FAILED = 13,
-+	IPTS_STATUS_TIMEOUT = 14,
-+	IPTS_STATUS_TEST_MODE_FAIL = 15,
-+	IPTS_STATUS_SENSOR_FAIL_FATAL = 16,
-+	IPTS_STATUS_SENSOR_FAIL_NONFATAL = 17,
-+	IPTS_STATUS_INVALID_DEVICE_CAPS = 18,
-+	IPTS_STATUS_QUIESCE_IO_IN_PROGRESS = 19,
-+};
++	return ipts_control_send_feedback(ipts, buffer);
++}
 +
 +/*
-+ * The amount of buffers that is used for IPTS
++ * ipts_control_start() - Initialized the device and starts the data flow.
++ * @ipts: The IPTS driver context.
++ *
++ * Returns: 0 on success, <0 on error.
 + */
-+#define IPTS_BUFFERS 16
++int ipts_control_start(struct ipts_context *ipts);
 +
 +/*
-+ * The special buffer ID that is used for direct host2me feedback.
++ * ipts_control_stop() - Stops the data flow and resets the device.
++ * @ipts: The IPTS driver context.
++ *
++ * Returns: 0 on success, <0 on error.
 + */
-+#define IPTS_HOST2ME_BUFFER IPTS_BUFFERS
++int ipts_control_stop(struct ipts_context *ipts);
 +
-+/**
-+ * enum ipts_mode - Operation mode for IPTS hardware
-+ * @IPTS_MODE_SINGLETOUCH: Fallback that supports only one finger and no stylus.
-+ *                         The data is received as a HID report with ID 64.
-+ * @IPTS_MODE_MULTITOUCH:  The "proper" operation mode for IPTS. It will return
-+ *                         stylus data as well as capacitive heatmap touch data.
-+ *                         This data needs to be processed in userspace.
++/*
++ * ipts_control_restart() - Stops the device and starts it again.
++ * @ipts: The IPTS driver context.
++ *
++ * Returns: 0 on success, <0 on error.
 + */
-+enum ipts_mode {
-+	IPTS_MODE_SINGLETOUCH = 0,
-+	IPTS_MODE_MULTITOUCH = 1,
-+};
++int ipts_control_restart(struct ipts_context *ipts);
 +
-+/**
-+ * struct ipts_set_mode_cmd - Payload for the SET_MODE command.
-+ * @mode: The mode that IPTS should operate in.
++#endif /* IPTS_CONTROL_H */
+diff --git a/drivers/hid/ipts/desc.h b/drivers/hid/ipts/desc.h
+new file mode 100644
+index 000000000000..c058974a03a1
+--- /dev/null
++++ b/drivers/hid/ipts/desc.h
+@@ -0,0 +1,81 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2022-2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
 + */
-+struct ipts_set_mode_cmd {
-+	enum ipts_mode mode;
-+	u8 reserved[12];
-+} __packed;
 +
-+#define IPTS_WORKQUEUE_SIZE	 8192
-+#define IPTS_WORKQUEUE_ITEM_SIZE 16
++#ifndef IPTS_DESC_H
++#define IPTS_DESC_H
 +
-+/**
-+ * struct ipts_set_mem_window_cmd - Payload for the SET_MEM_WINDOW command.
-+ * @data_buffer_addr_lower:     Lower 32 bits of the data buffer addresses.
-+ * @data_buffer_addr_upper:     Upper 32 bits of the data buffer addresses.
-+ * @workqueue_addr_lower:       Lower 32 bits of the workqueue buffer address.
-+ * @workqueue_addr_upper:       Upper 32 bits of the workqueue buffer address.
-+ * @doorbell_addr_lower:        Lower 32 bits of the doorbell buffer address.
-+ * @doorbell_addr_upper:        Upper 32 bits of the doorbell buffer address.
-+ * @feedback_buffer_addr_lower: Lower 32 bits of the feedback buffer addresses.
-+ * @feedback_buffer_addr_upper: Upper 32 bits of the feedback buffer addresses.
-+ * @host2me_addr_lower:         Lower 32 bits of the host2me buffer address.
-+ * @host2me_addr_upper:         Upper 32 bits of the host2me buffer address.
-+ * @workqueue_item_size:        Magic value. (IPTS_WORKQUEUE_ITEM_SIZE)
-+ * @workqueue_size:             Magic value. (IPTS_WORKQUEUE_SIZE)
-+ *
-+ * The data buffers are buffers that get filled with touch data by the ME.
-+ * The doorbell buffer is a u32 that gets incremented by the ME once a data
-+ * buffer has been filled with new data.
-+ *
-+ * The other buffers are required for using GuC submission with binary
-+ * firmware. Since support for GuC submission has been dropped from i915,
-+ * they are not used anymore, but they need to be allocated and passed,
-+ * otherwise the hardware will refuse to start.
-+ */
-+struct ipts_set_mem_window_cmd {
-+	u32 data_buffer_addr_lower[IPTS_BUFFERS];
-+	u32 data_buffer_addr_upper[IPTS_BUFFERS];
-+	u32 workqueue_addr_lower;
-+	u32 workqueue_addr_upper;
-+	u32 doorbell_addr_lower;
-+	u32 doorbell_addr_upper;
-+	u32 feedback_buffer_addr_lower[IPTS_BUFFERS];
-+	u32 feedback_buffer_addr_upper[IPTS_BUFFERS];
-+	u32 host2me_addr_lower;
-+	u32 host2me_addr_upper;
-+	u32 host2me_size;
-+	u8 reserved1;
-+	u8 workqueue_item_size;
-+	u16 workqueue_size;
-+	u8 reserved[32];
-+} __packed;
++#include <linux/types.h>
 +
-+/**
-+ * struct ipts_feedback_cmd - Payload for the FEEDBACK command.
-+ * @buffer: The buffer that the ME should refill.
++#define IPTS_HID_REPORT_SINGLETOUCH 64
++#define IPTS_HID_REPORT_DATA	    65
++#define IPTS_HID_REPORT_SET_MODE    66
++
++#define IPTS_HID_REPORT_DATA_SIZE 7485
++
++/*
++ * HID descriptor for singletouch data.
++ * This descriptor should be present on all IPTS devices.
 + */
-+struct ipts_feedback_cmd {
-+	u32 buffer;
-+	u8 reserved[12];
-+} __packed;
++static const u8 ipts_singletouch_descriptor[] = {
++	0x05, 0x0D,	  /*  Usage Page (Digitizer),            */
++	0x09, 0x04,	  /*  Usage (Touchscreen),               */
++	0xA1, 0x01,	  /*  Collection (Application),          */
++	0x85, 0x40,	  /*      Report ID (64),                */
++	0x09, 0x42,	  /*      Usage (Tip Switch),            */
++	0x15, 0x00,	  /*      Logical Minimum (0),           */
++	0x25, 0x01,	  /*      Logical Maximum (1),           */
++	0x75, 0x01,	  /*      Report Size (1),               */
++	0x95, 0x01,	  /*      Report Count (1),              */
++	0x81, 0x02,	  /*      Input (Variable),              */
++	0x95, 0x07,	  /*      Report Count (7),              */
++	0x81, 0x03,	  /*      Input (Constant, Variable),    */
++	0x05, 0x01,	  /*      Usage Page (Desktop),          */
++	0x09, 0x30,	  /*      Usage (X),                     */
++	0x75, 0x10,	  /*      Report Size (16),              */
++	0x95, 0x01,	  /*      Report Count (1),              */
++	0xA4,		  /*      Push,                          */
++	0x55, 0x0E,	  /*      Unit Exponent (14),            */
++	0x65, 0x11,	  /*      Unit (Centimeter),             */
++	0x46, 0x76, 0x0B, /*      Physical Maximum (2934),       */
++	0x26, 0xFF, 0x7F, /*      Logical Maximum (32767),       */
++	0x81, 0x02,	  /*      Input (Variable),              */
++	0x09, 0x31,	  /*      Usage (Y),                     */
++	0x46, 0x74, 0x06, /*      Physical Maximum (1652),       */
++	0x26, 0xFF, 0x7F, /*      Logical Maximum (32767),       */
++	0x81, 0x02,	  /*      Input (Variable),              */
++	0xB4,		  /*      Pop,                           */
++	0xC0,		  /*  End Collection                     */
++};
 +
-+/**
-+ * enum ipts_feedback_cmd_type - Commands that can be executed on the sensor through feedback.
++/*
++ * Fallback HID descriptor for older devices that do not have
++ * the ability to query their HID descriptor.
 + */
-+enum ipts_feedback_cmd_type {
-+	IPTS_FEEDBACK_CMD_TYPE_NONE = 0,
-+	IPTS_FEEDBACK_CMD_TYPE_SOFT_RESET = 1,
-+	IPTS_FEEDBACK_CMD_TYPE_GOTO_ARMED = 2,
-+	IPTS_FEEDBACK_CMD_TYPE_GOTO_SENSING = 3,
-+	IPTS_FEEDBACK_CMD_TYPE_GOTO_SLEEP = 4,
-+	IPTS_FEEDBACK_CMD_TYPE_GOTO_DOZE = 5,
-+	IPTS_FEEDBACK_CMD_TYPE_HARD_RESET = 6,
++static const u8 ipts_fallback_descriptor[] = {
++	0x05, 0x0D,	  /*  Usage Page (Digitizer),            */
++	0x09, 0x0F,	  /*  Usage (Capacitive Hm Digitizer),   */
++	0xA1, 0x01,	  /*  Collection (Application),          */
++	0x85, 0x41,	  /*      Report ID (65),                */
++	0x09, 0x56,	  /*      Usage (Scan Time),             */
++	0x95, 0x01,	  /*      Report Count (1),              */
++	0x75, 0x10,	  /*      Report Size (16),              */
++	0x81, 0x02,	  /*      Input (Variable),              */
++	0x09, 0x61,	  /*      Usage (Gesture Char Quality),  */
++	0x75, 0x08,	  /*      Report Size (8),               */
++	0x96, 0x3D, 0x1D, /*      Report Count (7485),           */
++	0x81, 0x03,	  /*      Input (Constant, Variable),    */
++	0x85, 0x42,	  /*      Report ID (66),                */
++	0x06, 0x00, 0xFF, /*      Usage Page (FF00h),            */
++	0x09, 0xC8,	  /*      Usage (C8h),                   */
++	0x75, 0x08,	  /*      Report Size (8),               */
++	0x95, 0x01,	  /*      Report Count (1),              */
++	0xB1, 0x02,	  /*      Feature (Variable),            */
++	0xC0,		  /*  End Collection,                    */
 +};
 +
-+/**
-+ * enum ipts_feedback_data_type - Describes the data that a feedback buffer contains.
-+ * @IPTS_FEEDBACK_DATA_TYPE_VENDOR:        The buffer contains vendor specific feedback.
-+ * @IPTS_FEEDBACK_DATA_TYPE_SET_FEATURES:  The buffer contains a HID set features command.
-+ * @IPTS_FEEDBACK_DATA_TYPE_GET_FEATURES:  The buffer contains a HID get features command.
-+ * @IPTS_FEEDBACK_DATA_TYPE_OUTPUT_REPORT: The buffer contains a HID output report.
-+ * @IPTS_FEEDBACK_DATA_TYPE_STORE_DATA:    The buffer contains calibration data for the sensor.
++#endif /* IPTS_DESC_H */
+diff --git a/drivers/hid/ipts/hid.c b/drivers/hid/ipts/hid.c
+new file mode 100644
+index 000000000000..6782394e8dde
+--- /dev/null
++++ b/drivers/hid/ipts/hid.c
+@@ -0,0 +1,348 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2022-2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
 + */
-+enum ipts_feedback_data_type {
-+	IPTS_FEEDBACK_DATA_TYPE_VENDOR = 0,
-+	IPTS_FEEDBACK_DATA_TYPE_SET_FEATURES = 1,
-+	IPTS_FEEDBACK_DATA_TYPE_GET_FEATURES = 2,
-+	IPTS_FEEDBACK_DATA_TYPE_OUTPUT_REPORT = 3,
-+	IPTS_FEEDBACK_DATA_TYPE_STORE_DATA = 4,
++
++#include <linux/completion.h>
++#include <linux/gfp.h>
++#include <linux/hid.h>
++#include <linux/mutex.h>
++#include <linux/slab.h>
++#include <linux/types.h>
++
++#include "context.h"
++#include "control.h"
++#include "desc.h"
++#include "hid.h"
++#include "spec-data.h"
++#include "spec-device.h"
++#include "spec-hid.h"
++
++static int ipts_hid_start(struct hid_device *hid)
++{
++	return 0;
++}
++
++static void ipts_hid_stop(struct hid_device *hid)
++{
++}
++
++static int ipts_hid_switch_mode(struct ipts_context *ipts, enum ipts_mode mode)
++{
++	if (!ipts)
++		return -EFAULT;
++
++	if (ipts->mode == mode)
++		return 0;
++
++	/*
++	 * This is only allowed on older devices.
++	 */
++	if (ipts->info.intf_eds > 1)
++		return 0;
++
++	ipts->mode = mode;
++	return ipts_control_restart(ipts);
++}
++
++static int ipts_hid_parse(struct hid_device *hid)
++{
++	int ret = 0;
++	struct ipts_context *ipts = NULL;
++
++	bool has_native_descriptor = false;
++
++	u8 *buffer = NULL;
++	size_t size = 0;
++
++	if (!hid)
++		return -ENODEV;
++
++	ipts = hid->driver_data;
++
++	if (!ipts)
++		return -EFAULT;
++
++	size = sizeof(ipts_singletouch_descriptor);
++	has_native_descriptor = ipts->descriptor.address && ipts->descriptor.size > 0;
++
++	if (has_native_descriptor)
++		size += ipts->descriptor.size;
++	else
++		size += sizeof(ipts_fallback_descriptor);
++
++	buffer = kzalloc(size, GFP_KERNEL);
++	if (!buffer)
++		return -ENOMEM;
++
++	memcpy(buffer, ipts_singletouch_descriptor, sizeof(ipts_singletouch_descriptor));
++
++	if (has_native_descriptor) {
++		memcpy(&buffer[sizeof(ipts_singletouch_descriptor)], ipts->descriptor.address,
++		       ipts->descriptor.size);
++	} else {
++		memcpy(&buffer[sizeof(ipts_singletouch_descriptor)], ipts_fallback_descriptor,
++		       sizeof(ipts_fallback_descriptor));
++	}
++
++	ret = hid_parse_report(hid, buffer, size);
++	kfree(buffer);
++
++	if (ret) {
++		dev_err(ipts->dev, "Failed to parse HID descriptor: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static int ipts_hid_get_feature(struct ipts_context *ipts, unsigned char reportnum, __u8 *buf,
++				size_t size, enum ipts_feedback_data_type type)
++{
++	int ret = 0;
++
++	if (!ipts)
++		return -EFAULT;
++
++	if (!buf)
++		return -EFAULT;
++
++	mutex_lock(&ipts->feature_lock);
++
++	memset(buf, 0, size);
++	buf[0] = reportnum;
++
++	memset(&ipts->feature_report, 0, sizeof(ipts->feature_report));
++	reinit_completion(&ipts->feature_event);
++
++	ret = ipts_control_hid2me_feedback(ipts, IPTS_FEEDBACK_CMD_TYPE_NONE, type, buf, size);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to send hid2me feedback: %d\n", ret);
++		goto out;
++	}
++
++	ret = wait_for_completion_timeout(&ipts->feature_event, msecs_to_jiffies(5000));
++	if (ret == 0) {
++		dev_warn(ipts->dev, "GET_FEATURES timed out!\n");
++		ret = -EIO;
++		goto out;
++	}
++
++	if (!ipts->feature_report.address) {
++		ret = -EFAULT;
++		goto out;
++	}
++
++	if (ipts->feature_report.size > size) {
++		ret = -ETOOSMALL;
++		goto out;
++	}
++
++	ret = ipts->feature_report.size;
++	memcpy(buf, ipts->feature_report.address, ipts->feature_report.size);
++
++out:
++	mutex_unlock(&ipts->feature_lock);
++	return ret;
++}
++
++static int ipts_hid_set_feature(struct ipts_context *ipts, unsigned char reportnum, __u8 *buf,
++				size_t size, enum ipts_feedback_data_type type)
++{
++	int ret = 0;
++
++	if (!ipts)
++		return -EFAULT;
++
++	if (!buf)
++		return -EFAULT;
++
++	buf[0] = reportnum;
++
++	ret = ipts_control_hid2me_feedback(ipts, IPTS_FEEDBACK_CMD_TYPE_NONE, type, buf, size);
++	if (ret)
++		dev_err(ipts->dev, "Failed to send hid2me feedback: %d\n", ret);
++
++	return ret;
++}
++
++static int ipts_hid_raw_request(struct hid_device *hid, unsigned char reportnum, __u8 *buf,
++				size_t size, unsigned char rtype, int reqtype)
++{
++	int ret = 0;
++	struct ipts_context *ipts = NULL;
++
++	enum ipts_feedback_data_type type = IPTS_FEEDBACK_DATA_TYPE_VENDOR;
++
++	if (!hid)
++		return -ENODEV;
++
++	ipts = hid->driver_data;
++
++	if (!ipts)
++		return -EFAULT;
++
++	if (!buf)
++		return -EFAULT;
++
++	if (rtype == HID_OUTPUT_REPORT && reqtype == HID_REQ_SET_REPORT)
++		type = IPTS_FEEDBACK_DATA_TYPE_OUTPUT_REPORT;
++	else if (rtype == HID_FEATURE_REPORT && reqtype == HID_REQ_GET_REPORT)
++		type = IPTS_FEEDBACK_DATA_TYPE_GET_FEATURES;
++	else if (rtype == HID_FEATURE_REPORT && reqtype == HID_REQ_SET_REPORT)
++		type = IPTS_FEEDBACK_DATA_TYPE_SET_FEATURES;
++	else
++		return -EIO;
++
++	// Implemente mode switching report for older devices without native HID support
++	if (type == IPTS_FEEDBACK_DATA_TYPE_SET_FEATURES && reportnum == IPTS_HID_REPORT_SET_MODE) {
++		ret = ipts_hid_switch_mode(ipts, buf[1]);
++		if (ret) {
++			dev_err(ipts->dev, "Failed to switch modes: %d\n", ret);
++			return ret;
++		}
++	}
++
++	if (reqtype == HID_REQ_GET_REPORT)
++		return ipts_hid_get_feature(ipts, reportnum, buf, size, type);
++	else
++		return ipts_hid_set_feature(ipts, reportnum, buf, size, type);
++}
++
++static int ipts_hid_output_report(struct hid_device *hid, __u8 *data, size_t size)
++{
++	struct ipts_context *ipts = NULL;
++
++	if (!hid)
++		return -ENODEV;
++
++	ipts = hid->driver_data;
++
++	return ipts_control_hid2me_feedback(ipts, IPTS_FEEDBACK_CMD_TYPE_NONE,
++					    IPTS_FEEDBACK_DATA_TYPE_OUTPUT_REPORT, data, size);
++}
++
++static struct hid_ll_driver ipts_hid_driver = {
++	.start = ipts_hid_start,
++	.stop = ipts_hid_stop,
++	.open = ipts_hid_start,
++	.close = ipts_hid_stop,
++	.parse = ipts_hid_parse,
++	.raw_request = ipts_hid_raw_request,
++	.output_report = ipts_hid_output_report,
 +};
 +
-+/**
-+ * struct ipts_feedback_buffer - The contents of an IPTS feedback buffer.
-+ * @cmd_type: A command that should be executed on the sensor.
-+ * @size: The size of the payload to be written.
-+ * @buffer: The ID of the buffer that contains this feedback data.
-+ * @protocol: The protocol version of the EDS.
-+ * @data_type: The type of payload that the buffer contains.
-+ * @spi_offset: The offset at which to write the payload data.
-+ * @payload: Payload for the feedback command, or 0 if no payload is sent.
-+ */
-+struct ipts_feedback_buffer {
-+	enum ipts_feedback_cmd_type cmd_type;
-+	u32 size;
-+	u32 buffer;
-+	u32 protocol;
-+	enum ipts_feedback_data_type data_type;
-+	u32 spi_offset;
-+	u8 reserved[40];
-+	u8 payload[];
-+} __packed;
++int ipts_hid_input_data(struct ipts_context *ipts, u32 buffer)
++{
++	int ret = 0;
++	u8 *temp = NULL;
++	struct ipts_hid_header *frame = NULL;
++	struct ipts_data_header *header = NULL;
 +
-+/**
-+ * enum ipts_reset_type - Possible ways of resetting the touch sensor
-+ * @IPTS_RESET_TYPE_HARD: Perform hardware reset using GPIO pin.
-+ * @IPTS_RESET_TYPE_SOFT: Perform software reset using SPI interface.
++	if (!ipts)
++		return -EFAULT;
++
++	if (!ipts->hid)
++		return -ENODEV;
++
++	header = (struct ipts_data_header *)ipts->resources.data[buffer].address;
++
++	if (!header)
++		return -EFAULT;
++
++	if (header->size == 0)
++		return 0;
++
++	if (header->type == IPTS_DATA_TYPE_HID)
++		return hid_input_report(ipts->hid, HID_INPUT_REPORT, header->data, header->size, 1);
++
++	if (header->type == IPTS_DATA_TYPE_GET_FEATURES) {
++		ipts->feature_report.address = header->data;
++		ipts->feature_report.size = header->size;
++
++		complete_all(&ipts->feature_event);
++		return 0;
++	}
++
++	if (header->type != IPTS_DATA_TYPE_FRAME)
++		return 0;
++
++	if (header->size + 3 + sizeof(struct ipts_hid_header) > IPTS_HID_REPORT_DATA_SIZE)
++		return -ERANGE;
++
++	temp = kzalloc(IPTS_HID_REPORT_DATA_SIZE, GFP_KERNEL);
++	if (!temp)
++		return -ENOMEM;
++
++	/*
++	 * Synthesize a HID report matching the devices that natively send HID reports
++	 */
++	temp[0] = IPTS_HID_REPORT_DATA;
++
++	frame = (struct ipts_hid_header *)&temp[3];
++	frame->type = IPTS_HID_FRAME_TYPE_RAW;
++	frame->size = header->size + sizeof(*frame);
++
++	memcpy(frame->data, header->data, header->size);
++
++	ret = hid_input_report(ipts->hid, HID_INPUT_REPORT, temp, IPTS_HID_REPORT_DATA_SIZE, 1);
++	kfree(temp);
++
++	return ret;
++}
++
++int ipts_hid_init(struct ipts_context *ipts, struct ipts_device_info info)
++{
++	int ret = 0;
++
++	if (!ipts)
++		return -EFAULT;
++
++	if (ipts->hid)
++		return 0;
++
++	ipts->hid = hid_allocate_device();
++	if (IS_ERR(ipts->hid)) {
++		int err = PTR_ERR(ipts->hid);
++
++		dev_err(ipts->dev, "Failed to allocate HID device: %d\n", err);
++		return err;
++	}
++
++	ipts->hid->driver_data = ipts;
++	ipts->hid->dev.parent = ipts->dev;
++	ipts->hid->ll_driver = &ipts_hid_driver;
++
++	ipts->hid->vendor = info.vendor;
++	ipts->hid->product = info.product;
++	ipts->hid->group = HID_GROUP_MULTITOUCH;
++
++	snprintf(ipts->hid->name, sizeof(ipts->hid->name), "IPTS %04X:%04X", info.vendor,
++		 info.product);
++
++	ret = hid_add_device(ipts->hid);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to add HID device: %d\n", ret);
++		ipts_hid_free(ipts);
++		return ret;
++	}
++
++	return 0;
++}
++
++int ipts_hid_free(struct ipts_context *ipts)
++{
++	if (!ipts)
++		return -EFAULT;
++
++	if (!ipts->hid)
++		return 0;
++
++	hid_destroy_device(ipts->hid);
++	ipts->hid = NULL;
++
++	return 0;
++}
+diff --git a/drivers/hid/ipts/hid.h b/drivers/hid/ipts/hid.h
+new file mode 100644
+index 000000000000..62bf3cd48608
+--- /dev/null
++++ b/drivers/hid/ipts/hid.h
+@@ -0,0 +1,22 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2022-2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
 + */
-+enum ipts_reset_type {
-+	IPTS_RESET_TYPE_HARD = 0,
-+	IPTS_RESET_TYPE_SOFT = 1,
-+};
 +
-+/**
-+ * struct ipts_reset_sensor_cmd - Payload for the RESET_SENSOR command.
-+ * @type: What type of reset should be performed.
-+ */
-+struct ipts_reset_sensor_cmd {
-+	enum ipts_reset_type type;
-+	u8 reserved[4];
-+} __packed;
++#ifndef IPTS_HID_H
++#define IPTS_HID_H
++
++#include <linux/types.h>
++
++#include "context.h"
++#include "spec-device.h"
++
++int ipts_hid_input_data(struct ipts_context *ipts, u32 buffer);
++
++int ipts_hid_init(struct ipts_context *ipts, struct ipts_device_info info);
++int ipts_hid_free(struct ipts_context *ipts);
++
++#endif /* IPTS_HID_H */
+diff --git a/drivers/hid/ipts/main.c b/drivers/hid/ipts/main.c
+new file mode 100644
+index 000000000000..0f20c6c08c38
+--- /dev/null
++++ b/drivers/hid/ipts/main.c
+@@ -0,0 +1,127 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2020-2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
++ */
++
++#include <linux/completion.h>
++#include <linux/delay.h>
++#include <linux/device.h>
++#include <linux/dma-mapping.h>
++#include <linux/mei_cl_bus.h>
++#include <linux/mod_devicetable.h>
++#include <linux/module.h>
++#include <linux/mutex.h>
++#include <linux/slab.h>
++#include <linux/stddef.h>
++#include <linux/types.h>
++
++#include "context.h"
++#include "control.h"
++#include "mei.h"
++#include "receiver.h"
++#include "spec-device.h"
++
++/*
++ * The MEI client ID for IPTS functionality.
++ */
++#define IPTS_ID UUID_LE(0x3e8d0870, 0x271a, 0x4208, 0x8e, 0xb5, 0x9a, 0xcb, 0x94, 0x02, 0xae, 0x04)
++
++static int ipts_set_dma_mask(struct mei_cl_device *cldev)
++{
++	if (!cldev)
++		return -EFAULT;
++
++	if (!dma_coerce_mask_and_coherent(&cldev->dev, DMA_BIT_MASK(64)))
++		return 0;
++
++	return dma_coerce_mask_and_coherent(&cldev->dev, DMA_BIT_MASK(32));
++}
++
++static int ipts_probe(struct mei_cl_device *cldev, const struct mei_cl_device_id *id)
++{
++	int ret = 0;
++	struct ipts_context *ipts = NULL;
++
++	if (!cldev)
++		return -EFAULT;
++
++	ret = ipts_set_dma_mask(cldev);
++	if (ret) {
++		dev_err(&cldev->dev, "Failed to set DMA mask for IPTS: %d\n", ret);
++		return ret;
++	}
++
++	ret = mei_cldev_enable(cldev);
++	if (ret) {
++		dev_err(&cldev->dev, "Failed to enable MEI device: %d\n", ret);
++		return ret;
++	}
++
++	ipts = devm_kzalloc(&cldev->dev, sizeof(*ipts), GFP_KERNEL);
++	if (!ipts) {
++		mei_cldev_disable(cldev);
++		return -ENOMEM;
++	}
++
++	ret = ipts_mei_init(&ipts->mei, cldev);
++	if (ret) {
++		dev_err(&cldev->dev, "Failed to init MEI bus logic: %d\n", ret);
++		return ret;
++	}
++
++	ipts->dev = &cldev->dev;
++	ipts->mode = IPTS_MODE_EVENT;
++
++	mutex_init(&ipts->feature_lock);
++	init_completion(&ipts->feature_event);
++
++	mei_cldev_set_drvdata(cldev, ipts);
++
++	ret = ipts_control_start(ipts);
++	if (ret) {
++		dev_err(&cldev->dev, "Failed to start IPTS: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static void ipts_remove(struct mei_cl_device *cldev)
++{
++	int ret = 0;
++	struct ipts_context *ipts = NULL;
++
++	if (!cldev) {
++		pr_err("MEI device is NULL!");
++		return;
++	}
++
++	ipts = mei_cldev_get_drvdata(cldev);
++
++	ret = ipts_control_stop(ipts);
++	if (ret)
++		dev_err(&cldev->dev, "Failed to stop IPTS: %d\n", ret);
++
++	mei_cldev_disable(cldev);
++}
++
++static struct mei_cl_device_id ipts_device_id_table[] = {
++	{ .uuid = IPTS_ID, .version = MEI_CL_VERSION_ANY },
++	{},
++};
++MODULE_DEVICE_TABLE(mei, ipts_device_id_table);
++
++static struct mei_cl_driver ipts_driver = {
++	.id_table = ipts_device_id_table,
++	.name = "ipts",
++	.probe = ipts_probe,
++	.remove = ipts_remove,
++};
++module_mei_cl_driver(ipts_driver);
++
++MODULE_DESCRIPTION("IPTS touchscreen driver");
++MODULE_AUTHOR("Dorian Stoll <dorian.stoll@tmsp.io>");
++MODULE_LICENSE("GPL");
+diff --git a/drivers/hid/ipts/mei.c b/drivers/hid/ipts/mei.c
+new file mode 100644
+index 000000000000..26666fd99b0c
+--- /dev/null
++++ b/drivers/hid/ipts/mei.c
+@@ -0,0 +1,189 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
++ */
++
++#include <linux/device.h>
++#include <linux/errno.h>
++#include <linux/jiffies.h>
++#include <linux/list.h>
++#include <linux/mei_cl_bus.h>
++#include <linux/printk.h>
++#include <linux/rwsem.h>
++#include <linux/types.h>
++#include <linux/wait.h>
++
++#include "context.h"
++#include "mei.h"
++
++static void locked_list_add(struct list_head *new, struct list_head *head,
++			    struct rw_semaphore *lock)
++{
++	down_write(lock);
++	list_add(new, head);
++	up_write(lock);
++}
++
++static void locked_list_del(struct list_head *entry, struct rw_semaphore *lock)
++{
++	down_write(lock);
++	list_del(entry);
++	up_write(lock);
++}
++
++static void ipts_mei_incoming(struct mei_cl_device *cldev)
++{
++	ssize_t ret = 0;
++	struct ipts_mei_message *entry = NULL;
++	struct ipts_context *ipts = NULL;
++
++	if (!cldev) {
++		pr_err("MEI device is NULL!");
++		return;
++	}
++
++	ipts = mei_cldev_get_drvdata(cldev);
++	if (!ipts) {
++		pr_err("IPTS driver context is NULL!");
++		return;
++	}
++
++	entry = devm_kzalloc(ipts->dev, sizeof(*entry), GFP_KERNEL);
++	if (!entry)
++		return;
++
++	INIT_LIST_HEAD(&entry->list);
++
++	do {
++		ret = mei_cldev_recv(cldev, (u8 *)&entry->rsp, sizeof(entry->rsp));
++	} while (ret == -EINTR);
++
++	if (ret < 0) {
++		dev_err(ipts->dev, "Error while reading response: %ld\n", ret);
++		return;
++	}
++
++	if (ret == 0) {
++		dev_err(ipts->dev, "Received empty response\n");
++		return;
++	}
++
++	locked_list_add(&entry->list, &ipts->mei.messages, &ipts->mei.message_lock);
++	wake_up_all(&ipts->mei.message_queue);
++}
++
++static int ipts_mei_search(struct ipts_mei *mei, enum ipts_command_code code,
++			   struct ipts_response *rsp)
++{
++	struct ipts_mei_message *entry = NULL;
++
++	if (!mei)
++		return -EFAULT;
++
++	if (!rsp)
++		return -EFAULT;
++
++	down_read(&mei->message_lock);
++
++	/*
++	 * Iterate over the list of received messages, and check if there is one
++	 * matching the requested command code.
++	 */
++	list_for_each_entry(entry, &mei->messages, list) {
++		if (entry->rsp.cmd == code)
++			break;
++	}
++
++	up_read(&mei->message_lock);
++
++	/*
++	 * If entry is not the list head, this means that the loop above has been stopped early,
++	 * and that we found a matching element. We drop the message from the list and return it.
++	 */
++	if (!list_entry_is_head(entry, &mei->messages, list)) {
++		locked_list_del(&entry->list, &mei->message_lock);
++
++		*rsp = entry->rsp;
++		devm_kfree(&mei->cldev->dev, entry);
++
++		return 0;
++	}
++
++	return -EAGAIN;
++}
++
++int ipts_mei_recv(struct ipts_mei *mei, enum ipts_command_code code, struct ipts_response *rsp,
++		  u64 timeout)
++{
++	int ret = 0;
++
++	if (!mei)
++		return -EFAULT;
++
++	/*
++	 * A timeout of 0 means check and return immideately.
++	 */
++	if (timeout == 0)
++		return ipts_mei_search(mei, code, rsp);
++
++	/*
++	 * A timeout of less than 0 means to wait forever.
++	 */
++	if (timeout < 0) {
++		wait_event(mei->message_queue, ipts_mei_search(mei, code, rsp) == 0);
++		return 0;
++	}
++
++	ret = wait_event_timeout(mei->message_queue, ipts_mei_search(mei, code, rsp) == 0,
++				 msecs_to_jiffies(timeout));
++
++	if (ret > 0)
++		return 0;
++
++	return -EAGAIN;
++}
++
++int ipts_mei_send(struct ipts_mei *mei, void *data, size_t length)
++{
++	int ret = 0;
++
++	if (!mei)
++		return -EFAULT;
++
++	if (!mei->cldev)
++		return -EFAULT;
++
++	if (!data)
++		return -EFAULT;
++
++	do {
++		ret = mei_cldev_send(mei->cldev, (u8 *)data, length);
++	} while (ret == -EINTR);
++
++	if (ret < 0)
++		return ret;
++
++	return 0;
++}
++
++int ipts_mei_init(struct ipts_mei *mei, struct mei_cl_device *cldev)
++{
++	if (!mei)
++		return -EFAULT;
++
++	if (!cldev)
++		return -EFAULT;
++
++	mei->cldev = cldev;
++
++	INIT_LIST_HEAD(&mei->messages);
++	init_waitqueue_head(&mei->message_queue);
++	init_rwsem(&mei->message_lock);
++
++	mei_cldev_register_rx_cb(cldev, ipts_mei_incoming);
++
++	return 0;
++}
+diff --git a/drivers/hid/ipts/mei.h b/drivers/hid/ipts/mei.h
+new file mode 100644
+index 000000000000..eadacae54c40
+--- /dev/null
++++ b/drivers/hid/ipts/mei.h
+@@ -0,0 +1,67 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
++ */
++
++#ifndef IPTS_MEI_H
++#define IPTS_MEI_H
++
++#include <linux/list.h>
++#include <linux/mei_cl_bus.h>
++#include <linux/rwsem.h>
++#include <linux/types.h>
++#include <linux/wait.h>
++
++#include "spec-device.h"
++
++struct ipts_mei_message {
++	struct list_head list;
++	struct ipts_response rsp;
++};
++
++struct ipts_mei {
++	struct mei_cl_device *cldev;
++
++	struct list_head messages;
++
++	wait_queue_head_t message_queue;
++	struct rw_semaphore message_lock;
++};
++
++/*
++ * ipts_mei_recv() - Receive data from a MEI device.
++ * @mei: The IPTS MEI device context.
++ * @code: The IPTS command code to look for.
++ * @rsp: The address that the received data will be copied to.
++ * @timeout: How many milliseconds the function will wait at most.
++ *
++ * A negative timeout means to wait forever.
++ *
++ * Returns: 0 on success, <0 on error, -EAGAIN if no response has been received.
++ */
++int ipts_mei_recv(struct ipts_mei *mei, enum ipts_command_code code, struct ipts_response *rsp,
++		  u64 timeout);
++
++/*
++ * ipts_mei_send() - Send data to a MEI device.
++ * @ipts: The IPTS MEI device context.
++ * @data: The data to send.
++ * @size: The size of the data.
++ *
++ * Returns: 0 on success, <0 on error.
++ */
++int ipts_mei_send(struct ipts_mei *mei, void *data, size_t length);
++
++/*
++ * ipts_mei_init() - Initialize the MEI device context.
++ * @mei: The MEI device context to initialize.
++ * @cldev: The MEI device the context will be bound to.
++ *
++ * Returns: 0 on success, <0 on error.
++ */
++int ipts_mei_init(struct ipts_mei *mei, struct mei_cl_device *cldev);
++
++#endif /* IPTS_MEI_H */
+diff --git a/drivers/hid/ipts/receiver.c b/drivers/hid/ipts/receiver.c
+new file mode 100644
+index 000000000000..77234f9e0e17
+--- /dev/null
++++ b/drivers/hid/ipts/receiver.c
+@@ -0,0 +1,249 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2020-2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
++ */
++
++#include <linux/delay.h>
++#include <linux/err.h>
++#include <linux/kthread.h>
++#include <linux/time64.h>
++#include <linux/timekeeping.h>
++#include <linux/types.h>
++
++#include "cmd.h"
++#include "context.h"
++#include "control.h"
++#include "hid.h"
++#include "resources.h"
++#include "spec-device.h"
++#include "thread.h"
++
++static void ipts_receiver_next_doorbell(struct ipts_context *ipts)
++{
++	u32 *doorbell = (u32 *)ipts->resources.doorbell.address;
++	*doorbell = *doorbell + 1;
++}
++
++static u32 ipts_receiver_current_doorbell(struct ipts_context *ipts)
++{
++	u32 *doorbell = (u32 *)ipts->resources.doorbell.address;
++	return *doorbell;
++}
++
++static void ipts_receiver_backoff(time64_t last, u32 n)
++{
++	/*
++	 * If the last change was less than n seconds ago,
++	 * sleep for a shorter period so that new data can be
++	 * processed quickly. If there was no change for more than
++	 * n seconds, sleep longer to avoid wasting CPU cycles.
++	 */
++	if (last + n > ktime_get_seconds())
++		msleep(20);
++	else
++		msleep(200);
++}
++
++static int ipts_receiver_event_loop(struct ipts_thread *thread)
++{
++	int ret = 0;
++	u32 buffer = 0;
++
++	struct ipts_context *ipts = NULL;
++	time64_t last = ktime_get_seconds();
++
++	if (!thread)
++		return -EFAULT;
++
++	ipts = thread->data;
++
++	if (!ipts)
++		return -EFAULT;
++
++	dev_info(ipts->dev, "IPTS running in event mode\n");
++
++	while (!ipts_thread_should_stop(thread)) {
++		for (int i = 0; i < IPTS_BUFFERS; i++) {
++			ret = ipts_control_wait_data(ipts, false);
++			if (ret == -EAGAIN)
++				break;
++
++			if (ret) {
++				dev_err(ipts->dev, "Failed to wait for data: %d\n", ret);
++				continue;
++			}
++
++			buffer = ipts_receiver_current_doorbell(ipts) % IPTS_BUFFERS;
++			ipts_receiver_next_doorbell(ipts);
++
++			ret = ipts_hid_input_data(ipts, buffer);
++			if (ret)
++				dev_err(ipts->dev, "Failed to process buffer: %d\n", ret);
++
++			ret = ipts_control_refill_buffer(ipts, buffer);
++			if (ret)
++				dev_err(ipts->dev, "Failed to send feedback: %d\n", ret);
++
++			ret = ipts_control_request_data(ipts);
++			if (ret)
++				dev_err(ipts->dev, "Failed to request data: %d\n", ret);
++
++			last = ktime_get_seconds();
++		}
++
++		ipts_receiver_backoff(last, 5);
++	}
++
++	ret = ipts_control_request_flush(ipts);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to request flush: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_control_wait_data(ipts, true);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to wait for data: %d\n", ret);
++
++		if (ret != -EAGAIN)
++			return ret;
++		else
++			return 0;
++	}
++
++	ret = ipts_control_wait_flush(ipts);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to wait for flush: %d\n", ret);
++
++		if (ret != -EAGAIN)
++			return ret;
++		else
++			return 0;
++	}
++
++	return 0;
++}
++
++static int ipts_receiver_doorbell_loop(struct ipts_thread *thread)
++{
++	int ret = 0;
++	u32 buffer = 0;
++
++	u32 doorbell = 0;
++	u32 lastdb = 0;
 +
-+/**
-+ * struct ipts_command - A message sent from the host to the ME.
-+ * @code:    The message code describing the command. (see IPTS_CMD_*)
-+ * @payload: Payload for the command, or 0 if no payload is required.
-+ */
-+struct ipts_command {
-+	u32 code;
-+	u8 payload[320];
-+} __packed;
++	struct ipts_context *ipts = NULL;
++	time64_t last = ktime_get_seconds();
 +
-+/**
-+ * struct ipts_device_info - Payload for the GET_DEVICE_INFO response.
-+ * @vendor_id:     Vendor ID of the touch sensor.
-+ * @device_id:     Device ID of the touch sensor.
-+ * @hw_rev:        Hardware revision of the touch sensor.
-+ * @fw_rev:        Firmware revision of the touch sensor.
-+ * @data_size:     Required size of one data buffer.
-+ * @feedback_size: Required size of one feedback buffer.
-+ * @mode:          Current operation mode of IPTS.
-+ * @max_contacts:  The amount of concurrent touches supported by the sensor.
-+ */
-+struct ipts_get_device_info_rsp {
-+	u16 vendor_id;
-+	u16 device_id;
-+	u32 hw_rev;
-+	u32 fw_rev;
-+	u32 data_size;
-+	u32 feedback_size;
-+	enum ipts_mode mode;
-+	u8 max_contacts;
-+	u8 reserved[19];
-+} __packed;
++	if (!thread)
++		return -EFAULT;
 +
-+/**
-+ * struct ipts_feedback_rsp - Payload for the FEEDBACK response.
-+ * @buffer: The buffer that has received feedback.
-+ */
-+struct ipts_feedback_rsp {
-+	u32 buffer;
-+} __packed;
++	ipts = thread->data;
 +
-+/**
-+ * struct ipts_response - A message sent from the ME to the host.
-+ * @code:    The message code describing the response. (see IPTS_RSP_*)
-+ * @status:  The status code returned by the command.
-+ * @payload: Payload returned by the command.
-+ */
-+struct ipts_response {
-+	u32 code;
-+	enum ipts_status status;
-+	u8 payload[80];
-+} __packed;
++	if (!ipts)
++		return -EFAULT;
 +
-+#endif /* _IPTS_PROTOCOL_H_ */
-diff --git a/drivers/misc/ipts/receiver.c b/drivers/misc/ipts/receiver.c
-new file mode 100644
-index 000000000000..23dca13c2139
---- /dev/null
-+++ b/drivers/misc/ipts/receiver.c
-@@ -0,0 +1,224 @@
-+// SPDX-License-Identifier: GPL-2.0-or-later
-+/*
-+ * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
-+ *
-+ * Linux driver for Intel Precise Touch & Stylus
-+ */
++	dev_info(ipts->dev, "IPTS running in doorbell mode\n");
 +
-+#include <linux/mei_cl_bus.h>
-+#include <linux/moduleparam.h>
-+#include <linux/types.h>
++	while (true) {
++		if (ipts_thread_should_stop(thread)) {
++			ret = ipts_control_request_flush(ipts);
++			if (ret) {
++				dev_err(ipts->dev, "Failed to request flush: %d\n", ret);
++				return ret;
++			}
++		}
 +
-+#include "context.h"
-+#include "control.h"
-+#include "protocol.h"
-+#include "resources.h"
++		doorbell = ipts_receiver_current_doorbell(ipts);
 +
-+/*
-+ * Temporary parameter to guard gen7 multitouch mode.
-+ * Remove once gen7 has stable iptsd support.
-+ */
-+static bool gen7mt;
-+module_param(gen7mt, bool, 0644);
++		/*
++		 * After filling up one of the data buffers, IPTS will increment
++		 * the doorbell. The value of the doorbell stands for the *next*
++		 * buffer that IPTS is going to fill.
++		 */
++		while (lastdb != doorbell) {
++			buffer = lastdb % IPTS_BUFFERS;
 +
-+static int ipts_receiver_handle_get_device_info(struct ipts_context *ipts,
-+						struct ipts_response *rsp)
-+{
-+	struct ipts_set_mode_cmd cmd;
++			ret = ipts_hid_input_data(ipts, buffer);
++			if (ret)
++				dev_err(ipts->dev, "Failed to process buffer: %d\n", ret);
 +
-+	memcpy(&ipts->device_info, rsp->payload,
-+	       sizeof(struct ipts_get_device_info_rsp));
++			ret = ipts_control_refill_buffer(ipts, buffer);
++			if (ret)
++				dev_err(ipts->dev, "Failed to send feedback: %d\n", ret);
 +
-+	memset(&cmd, 0, sizeof(struct ipts_set_mode_cmd));
-+	cmd.mode = IPTS_MODE_MULTITOUCH;
++			last = ktime_get_seconds();
++			lastdb++;
++		}
 +
-+	return ipts_control_send(ipts, IPTS_CMD_SET_MODE, &cmd,
-+				 sizeof(struct ipts_set_mode_cmd));
-+}
++		if (ipts_thread_should_stop(thread))
++			break;
 +
-+static int ipts_receiver_handle_set_mode(struct ipts_context *ipts)
-+{
-+	int i, ret;
-+	struct ipts_set_mem_window_cmd cmd;
++		ipts_receiver_backoff(last, 5);
++	}
 +
-+	ret = ipts_resources_alloc(ipts);
++	ret = ipts_control_wait_data(ipts, true);
 +	if (ret) {
-+		dev_err(ipts->dev, "Failed to allocate resources\n");
-+		return ret;
++		dev_err(ipts->dev, "Failed to wait for data: %d\n", ret);
++
++		if (ret != -EAGAIN)
++			return ret;
++		else
++			return 0;
 +	}
 +
-+	memset(&cmd, 0, sizeof(struct ipts_set_mem_window_cmd));
++	ret = ipts_control_wait_flush(ipts);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to wait for flush: %d\n", ret);
++
++		if (ret != -EAGAIN)
++			return ret;
++		else
++			return 0;
++	}
 +
-+	for (i = 0; i < IPTS_BUFFERS; i++) {
-+		cmd.data_buffer_addr_lower[i] =
-+			lower_32_bits(ipts->data[i].dma_address);
++	return 0;
++}
 +
-+		cmd.data_buffer_addr_upper[i] =
-+			upper_32_bits(ipts->data[i].dma_address);
++int ipts_receiver_start(struct ipts_context *ipts)
++{
++	int ret = 0;
 +
-+		cmd.feedback_buffer_addr_lower[i] =
-+			lower_32_bits(ipts->feedback[i].dma_address);
++	if (!ipts)
++		return -EFAULT;
 +
-+		cmd.feedback_buffer_addr_upper[i] =
-+			upper_32_bits(ipts->feedback[i].dma_address);
++	if (ipts->mode == IPTS_MODE_EVENT) {
++		ret = ipts_thread_start(&ipts->receiver_loop, ipts_receiver_event_loop, ipts,
++					"ipts_event");
++	} else if (ipts->mode == IPTS_MODE_DOORBELL) {
++		ret = ipts_thread_start(&ipts->receiver_loop, ipts_receiver_doorbell_loop, ipts,
++					"ipts_doorbell");
++	} else {
++		ret = -EINVAL;
 +	}
 +
-+	cmd.workqueue_addr_lower = lower_32_bits(ipts->workqueue.dma_address);
-+	cmd.workqueue_addr_upper = upper_32_bits(ipts->workqueue.dma_address);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to start receiver loop: %d\n", ret);
++		return ret;
++	}
 +
-+	cmd.doorbell_addr_lower = lower_32_bits(ipts->doorbell.dma_address);
-+	cmd.doorbell_addr_upper = upper_32_bits(ipts->doorbell.dma_address);
++	return 0;
++}
 +
-+	cmd.host2me_addr_lower = lower_32_bits(ipts->host2me.dma_address);
-+	cmd.host2me_addr_upper = upper_32_bits(ipts->host2me.dma_address);
++int ipts_receiver_stop(struct ipts_context *ipts)
++{
++	int ret = 0;
 +
-+	cmd.workqueue_size = IPTS_WORKQUEUE_SIZE;
-+	cmd.workqueue_item_size = IPTS_WORKQUEUE_ITEM_SIZE;
++	if (!ipts)
++		return -EFAULT;
++
++	ret = ipts_thread_stop(&ipts->receiver_loop);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to stop receiver loop: %d\n", ret);
++		return ret;
++	}
 +
-+	return ipts_control_send(ipts, IPTS_CMD_SET_MEM_WINDOW, &cmd,
-+				 sizeof(struct ipts_set_mem_window_cmd));
++	return 0;
 +}
+diff --git a/drivers/hid/ipts/receiver.h b/drivers/hid/ipts/receiver.h
+new file mode 100644
+index 000000000000..96070f34fbca
+--- /dev/null
++++ b/drivers/hid/ipts/receiver.h
+@@ -0,0 +1,17 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2020-2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
++ */
 +
-+static int ipts_receiver_handle_set_mem_window(struct ipts_context *ipts)
-+{
-+	int ret;
++#ifndef IPTS_RECEIVER_H
++#define IPTS_RECEIVER_H
 +
-+	dev_info(ipts->dev, "Device %04hX:%04hX ready\n",
-+		 ipts->device_info.vendor_id, ipts->device_info.device_id);
-+	ipts->status = IPTS_HOST_STATUS_STARTED;
++#include "context.h"
 +
-+	ret = ipts_control_send(ipts, IPTS_CMD_READY_FOR_DATA, NULL, 0);
-+	if (ret)
-+		return ret;
++int ipts_receiver_start(struct ipts_context *ipts);
++int ipts_receiver_stop(struct ipts_context *ipts);
 +
-+	if (!gen7mt)
-+		return 0;
++#endif /* IPTS_RECEIVER_H */
+diff --git a/drivers/hid/ipts/resources.c b/drivers/hid/ipts/resources.c
+new file mode 100644
+index 000000000000..80ba5885bb55
+--- /dev/null
++++ b/drivers/hid/ipts/resources.c
+@@ -0,0 +1,108 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2020-2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
++ */
 +
-+	return ipts_control_set_feature(ipts, 0x5, 0x1);
-+}
++#include <linux/dma-mapping.h>
++#include <linux/types.h>
 +
-+static int ipts_receiver_handle_feedback(struct ipts_context *ipts,
-+					 struct ipts_response *rsp)
++#include "resources.h"
++#include "spec-device.h"
++
++static int ipts_resources_alloc_buffer(struct ipts_buffer *buffer, struct device *dev, size_t size)
 +{
-+	struct ipts_feedback_rsp feedback;
++	if (!buffer)
++		return -EFAULT;
 +
-+	if (ipts->status != IPTS_HOST_STATUS_STOPPING)
++	if (buffer->address)
 +		return 0;
 +
-+	memcpy(&feedback, rsp->payload, sizeof(feedback));
++	buffer->address = dma_alloc_coherent(dev, size, &buffer->dma_address, GFP_KERNEL);
++
++	if (!buffer->address)
++		return -ENOMEM;
 +
-+	if (feedback.buffer < IPTS_BUFFERS - 1)
-+		return ipts_control_send_feedback(ipts, feedback.buffer + 1);
++	buffer->size = size;
++	buffer->device = dev;
 +
-+	return ipts_control_send(ipts, IPTS_CMD_CLEAR_MEM_WINDOW, NULL, 0);
++	return 0;
 +}
 +
-+static int ipts_receiver_handle_clear_mem_window(struct ipts_context *ipts)
++static void ipts_resources_free_buffer(struct ipts_buffer *buffer)
 +{
-+	ipts->status = IPTS_HOST_STATUS_STOPPED;
++	if (!buffer->address)
++		return;
 +
-+	if (ipts->restart)
-+		return ipts_control_start(ipts);
++	dma_free_coherent(buffer->device, buffer->size, buffer->address, buffer->dma_address);
 +
-+	return 0;
-+}
++	buffer->address = NULL;
++	buffer->size = 0;
 +
-+static bool ipts_receiver_sensor_was_reset(u32 status)
-+{
-+	return status == IPTS_STATUS_SENSOR_EXPECTED_RESET ||
-+	       status == IPTS_STATUS_SENSOR_UNEXPECTED_RESET;
++	buffer->dma_address = 0;
++	buffer->device = NULL;
 +}
 +
-+static bool ipts_receiver_handle_error(struct ipts_context *ipts,
-+				       struct ipts_response *rsp)
++int ipts_resources_init(struct ipts_resources *res, struct device *dev, size_t ds, size_t fs)
 +{
-+	bool error;
-+
-+	switch (rsp->status) {
-+	case IPTS_STATUS_SUCCESS:
-+	case IPTS_STATUS_COMPAT_CHECK_FAIL:
-+		error = false;
-+		break;
-+	case IPTS_STATUS_INVALID_PARAMS:
-+		error = rsp->code != IPTS_RSP_FEEDBACK;
-+		break;
-+	case IPTS_STATUS_SENSOR_DISABLED:
-+		error = ipts->status != IPTS_HOST_STATUS_STOPPING;
-+		break;
-+	default:
-+		error = true;
-+		break;
-+	}
-+
-+	if (!error)
-+		return false;
++	int ret = 0;
 +
-+	dev_err(ipts->dev, "Command 0x%08x failed: %d\n", rsp->code,
-+		rsp->status);
++	if (!res)
++		return -EFAULT;
 +
-+	if (ipts_receiver_sensor_was_reset(rsp->status)) {
-+		dev_err(ipts->dev, "Sensor was reset\n");
++	for (int i = 0; i < IPTS_BUFFERS; i++) {
++		ret = ipts_resources_alloc_buffer(&res->data[i], dev, ds);
++		if (ret)
++			goto err;
++	}
 +
-+		if (ipts_control_restart(ipts))
-+			dev_err(ipts->dev, "Failed to restart IPTS\n");
++	for (int i = 0; i < IPTS_BUFFERS; i++) {
++		ret = ipts_resources_alloc_buffer(&res->feedback[i], dev, fs);
++		if (ret)
++			goto err;
 +	}
 +
-+	return true;
-+}
++	ret = ipts_resources_alloc_buffer(&res->doorbell, dev, sizeof(u32));
++	if (ret)
++		goto err;
 +
-+static void ipts_receiver_handle_response(struct ipts_context *ipts,
-+					  struct ipts_response *rsp)
-+{
-+	int ret;
++	ret = ipts_resources_alloc_buffer(&res->workqueue, dev, sizeof(u32));
++	if (ret)
++		goto err;
 +
-+	if (ipts_receiver_handle_error(ipts, rsp))
-+		return;
++	ret = ipts_resources_alloc_buffer(&res->hid2me, dev, fs);
++	if (ret)
++		goto err;
 +
-+	switch (rsp->code) {
-+	case IPTS_RSP_GET_DEVICE_INFO:
-+		ret = ipts_receiver_handle_get_device_info(ipts, rsp);
-+		break;
-+	case IPTS_RSP_SET_MODE:
-+		ret = ipts_receiver_handle_set_mode(ipts);
-+		break;
-+	case IPTS_RSP_SET_MEM_WINDOW:
-+		ret = ipts_receiver_handle_set_mem_window(ipts);
-+		break;
-+	case IPTS_RSP_FEEDBACK:
-+		ret = ipts_receiver_handle_feedback(ipts, rsp);
-+		break;
-+	case IPTS_RSP_CLEAR_MEM_WINDOW:
-+		ret = ipts_receiver_handle_clear_mem_window(ipts);
-+		break;
-+	default:
-+		ret = 0;
-+		break;
-+	}
-+
-+	if (!ret)
-+		return;
++	ret = ipts_resources_alloc_buffer(&res->descriptor, dev, ds + 8);
++	if (ret)
++		goto err;
++
++	return 0;
 +
-+	dev_err(ipts->dev, "Error while handling response 0x%08x: %d\n",
-+		rsp->code, ret);
++err:
 +
-+	if (ipts_control_stop(ipts))
-+		dev_err(ipts->dev, "Failed to stop IPTS\n");
++	ipts_resources_free(res);
++	return ret;
 +}
 +
-+void ipts_receiver_callback(struct mei_cl_device *cldev)
++int ipts_resources_free(struct ipts_resources *res)
 +{
-+	int ret;
-+	struct ipts_response rsp;
-+	struct ipts_context *ipts;
++	if (!res)
++		return -EFAULT;
 +
-+	ipts = mei_cldev_get_drvdata(cldev);
++	for (int i = 0; i < IPTS_BUFFERS; i++)
++		ipts_resources_free_buffer(&res->data[i]);
 +
-+	ret = mei_cldev_recv(cldev, (u8 *)&rsp, sizeof(struct ipts_response));
-+	if (ret <= 0) {
-+		dev_err(ipts->dev, "Error while reading response: %d\n", ret);
-+		return;
-+	}
++	for (int i = 0; i < IPTS_BUFFERS; i++)
++		ipts_resources_free_buffer(&res->feedback[i]);
++
++	ipts_resources_free_buffer(&res->doorbell);
++	ipts_resources_free_buffer(&res->workqueue);
++	ipts_resources_free_buffer(&res->hid2me);
++	ipts_resources_free_buffer(&res->descriptor);
 +
-+	ipts_receiver_handle_response(ipts, &rsp);
++	return 0;
 +}
-diff --git a/drivers/misc/ipts/receiver.h b/drivers/misc/ipts/receiver.h
+diff --git a/drivers/hid/ipts/resources.h b/drivers/hid/ipts/resources.h
 new file mode 100644
-index 000000000000..7f075afa7ef8
+index 000000000000..6cbb24a8a054
 --- /dev/null
-+++ b/drivers/misc/ipts/receiver.h
-@@ -0,0 +1,16 @@
++++ b/drivers/hid/ipts/resources.h
+@@ -0,0 +1,39 @@
 +/* SPDX-License-Identifier: GPL-2.0-or-later */
 +/*
 + * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
++ * Copyright (c) 2020-2023 Dorian Stoll
 + *
 + * Linux driver for Intel Precise Touch & Stylus
 + */
 +
-+#ifndef _IPTS_RECEIVER_H_
-+#define _IPTS_RECEIVER_H_
++#ifndef IPTS_RESOURCES_H
++#define IPTS_RESOURCES_H
 +
-+#include <linux/mei_cl_bus.h>
++#include <linux/device.h>
++#include <linux/types.h>
++
++#include "spec-device.h"
++
++struct ipts_buffer {
++	u8 *address;
++	size_t size;
++
++	dma_addr_t dma_address;
++	struct device *device;
++};
 +
-+void ipts_receiver_callback(struct mei_cl_device *cldev);
++struct ipts_resources {
++	struct ipts_buffer data[IPTS_BUFFERS];
++	struct ipts_buffer feedback[IPTS_BUFFERS];
 +
-+#endif /* _IPTS_RECEIVER_H_ */
-diff --git a/drivers/misc/ipts/resources.c b/drivers/misc/ipts/resources.c
++	struct ipts_buffer doorbell;
++	struct ipts_buffer workqueue;
++	struct ipts_buffer hid2me;
++
++	struct ipts_buffer descriptor;
++};
++
++int ipts_resources_init(struct ipts_resources *res, struct device *dev, size_t ds, size_t fs);
++int ipts_resources_free(struct ipts_resources *res);
++
++#endif /* IPTS_RESOURCES_H */
+diff --git a/drivers/hid/ipts/spec-data.h b/drivers/hid/ipts/spec-data.h
 new file mode 100644
-index 000000000000..8e3a2409e438
+index 000000000000..e8dd98895a7e
 --- /dev/null
-+++ b/drivers/misc/ipts/resources.c
-@@ -0,0 +1,128 @@
-+// SPDX-License-Identifier: GPL-2.0-or-later
++++ b/drivers/hid/ipts/spec-data.h
+@@ -0,0 +1,100 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
 +/*
 + * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
++ * Copyright (c) 2020-2023 Dorian Stoll
 + *
 + * Linux driver for Intel Precise Touch & Stylus
 + */
 +
-+#include <linux/dma-mapping.h>
++#ifndef IPTS_SPEC_DATA_H
++#define IPTS_SPEC_DATA_H
 +
-+#include "context.h"
++#include <linux/build_bug.h>
++#include <linux/types.h>
 +
-+void ipts_resources_free(struct ipts_context *ipts)
-+{
-+	int i;
-+	struct ipts_buffer_info *buffers;
++/**
++ * enum ipts_feedback_cmd_type - Commands that can be executed on the sensor through feedback.
++ */
++enum ipts_feedback_cmd_type {
++	IPTS_FEEDBACK_CMD_TYPE_NONE = 0,
++	IPTS_FEEDBACK_CMD_TYPE_SOFT_RESET = 1,
++	IPTS_FEEDBACK_CMD_TYPE_GOTO_ARMED = 2,
++	IPTS_FEEDBACK_CMD_TYPE_GOTO_SENSING = 3,
++	IPTS_FEEDBACK_CMD_TYPE_GOTO_SLEEP = 4,
++	IPTS_FEEDBACK_CMD_TYPE_GOTO_DOZE = 5,
++	IPTS_FEEDBACK_CMD_TYPE_HARD_RESET = 6,
++};
 +
-+	u32 data_buffer_size = ipts->device_info.data_size;
-+	u32 feedback_buffer_size = ipts->device_info.feedback_size;
++/**
++ * enum ipts_feedback_data_type - Defines what data a feedback buffer contains.
++ * @IPTS_FEEDBACK_DATA_TYPE_VENDOR:        The buffer contains vendor specific feedback.
++ * @IPTS_FEEDBACK_DATA_TYPE_SET_FEATURES:  The buffer contains a HID set features report.
++ * @IPTS_FEEDBACK_DATA_TYPE_GET_FEATURES:  The buffer contains a HID get features report.
++ * @IPTS_FEEDBACK_DATA_TYPE_OUTPUT_REPORT: The buffer contains a HID output report.
++ * @IPTS_FEEDBACK_DATA_TYPE_STORE_DATA:    The buffer contains calibration data for the sensor.
++ */
++enum ipts_feedback_data_type {
++	IPTS_FEEDBACK_DATA_TYPE_VENDOR = 0,
++	IPTS_FEEDBACK_DATA_TYPE_SET_FEATURES = 1,
++	IPTS_FEEDBACK_DATA_TYPE_GET_FEATURES = 2,
++	IPTS_FEEDBACK_DATA_TYPE_OUTPUT_REPORT = 3,
++	IPTS_FEEDBACK_DATA_TYPE_STORE_DATA = 4,
++};
 +
-+	buffers = ipts->data;
-+	for (i = 0; i < IPTS_BUFFERS; i++) {
-+		if (!buffers[i].address)
-+			continue;
++/**
++ * struct ipts_feedback_header - Header that is prefixed to the data in a feedback buffer.
++ * @cmd_type:   A command that should be executed on the sensor.
++ * @size:       The size of the payload to be written.
++ * @buffer:     The ID of the buffer that contains this feedback data.
++ * @protocol:   The protocol version of the EDS.
++ * @data_type:  The type of data that the buffer contains.
++ * @spi_offset: The offset at which to write the payload data to the sensor.
++ * @payload:    Payload for the feedback command, or 0 if no payload is sent.
++ */
++struct ipts_feedback_header {
++	enum ipts_feedback_cmd_type cmd_type;
++	u32 size;
++	u32 buffer;
++	u32 protocol;
++	enum ipts_feedback_data_type data_type;
++	u32 spi_offset;
++	u8 reserved[40];
++	u8 payload[];
++} __packed;
 +
-+		dma_free_coherent(ipts->dev, data_buffer_size,
-+				  buffers[i].address, buffers[i].dma_address);
++static_assert(sizeof(struct ipts_feedback_header) == 64);
 +
-+		buffers[i].address = NULL;
-+		buffers[i].dma_address = 0;
-+	}
++/**
++ * enum ipts_data_type - Defines what type of data a buffer contains.
++ * @IPTS_DATA_TYPE_FRAME:        Raw data frame.
++ * @IPTS_DATA_TYPE_ERROR:        Error data.
++ * @IPTS_DATA_TYPE_VENDOR:       Vendor specific data.
++ * @IPTS_DATA_TYPE_HID:          A HID report.
++ * @IPTS_DATA_TYPE_GET_FEATURES: The response to a GET_FEATURES HID2ME command.
++ */
++enum ipts_data_type {
++	IPTS_DATA_TYPE_FRAME = 0x00,
++	IPTS_DATA_TYPE_ERROR = 0x01,
++	IPTS_DATA_TYPE_VENDOR = 0x02,
++	IPTS_DATA_TYPE_HID = 0x03,
++	IPTS_DATA_TYPE_GET_FEATURES = 0x04,
++	IPTS_DATA_TYPE_DESCRIPTOR = 0x05,
++};
 +
-+	buffers = ipts->feedback;
-+	for (i = 0; i < IPTS_BUFFERS; i++) {
-+		if (!buffers[i].address)
-+			continue;
++/**
++ * struct ipts_data_header - Header that is prefixed to the data in a data buffer.
++ * @type: What data the buffer contains.
++ * @size: How much data the buffer contains.
++ * @buffer: Which buffer the data is in.
++ */
++struct ipts_data_header {
++	enum ipts_data_type type;
++	u32 size;
++	u32 buffer;
++	u8 reserved[52];
++	u8 data[];
++} __packed;
 +
-+		dma_free_coherent(ipts->dev, feedback_buffer_size,
-+				  buffers[i].address, buffers[i].dma_address);
++static_assert(sizeof(struct ipts_data_header) == 64);
 +
-+		buffers[i].address = NULL;
-+		buffers[i].dma_address = 0;
-+	}
++#endif /* IPTS_SPEC_DATA_H */
+diff --git a/drivers/hid/ipts/spec-device.h b/drivers/hid/ipts/spec-device.h
+new file mode 100644
+index 000000000000..93f673d981f7
+--- /dev/null
++++ b/drivers/hid/ipts/spec-device.h
+@@ -0,0 +1,285 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2020-2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
++ */
 +
-+	if (ipts->doorbell.address) {
-+		dma_free_coherent(ipts->dev, sizeof(u32),
-+				  ipts->doorbell.address,
-+				  ipts->doorbell.dma_address);
++#ifndef IPTS_SPEC_DEVICE_H
++#define IPTS_SPEC_DEVICE_H
 +
-+		ipts->doorbell.address = NULL;
-+		ipts->doorbell.dma_address = 0;
-+	}
++#include <linux/build_bug.h>
++#include <linux/types.h>
++
++/*
++ * The amount of buffers that IPTS can use for data transfer.
++ */
++#define IPTS_BUFFERS 16
 +
-+	if (ipts->workqueue.address) {
-+		dma_free_coherent(ipts->dev, sizeof(u32),
-+				  ipts->workqueue.address,
-+				  ipts->workqueue.dma_address);
++/*
++ * The buffer ID that is used for HID2ME feedback
++ */
++#define IPTS_HID2ME_BUFFER IPTS_BUFFERS
 +
-+		ipts->workqueue.address = NULL;
-+		ipts->workqueue.dma_address = 0;
-+	}
++/**
++ * enum ipts_command - Commands that can be sent to the IPTS hardware.
++ * @IPTS_CMD_GET_DEVICE_INFO:  Retrieves vendor information from the device.
++ * @IPTS_CMD_SET_MODE:         Changes the mode that the device will operate in.
++ * @IPTS_CMD_SET_MEM_WINDOW:   Configures memory buffers for passing data between device and driver.
++ * @IPTS_CMD_QUIESCE_IO:       Stops the data flow from the device to the driver.
++ * @IPTS_CMD_READY_FOR_DATA:   Informs the device that the driver is ready to receive data.
++ * @IPTS_CMD_FEEDBACK:         Informs the device that a buffer was processed and can be refilled.
++ * @IPTS_CMD_CLEAR_MEM_WINDOW: Stops the data flow and clears the buffer addresses on the device.
++ * @IPTS_CMD_RESET_SENSOR:     Resets the sensor to its default state.
++ * @IPTS_CMD_GET_DESCRIPTOR:   Retrieves the HID descriptor of the device.
++ */
++enum ipts_command_code {
++	IPTS_CMD_GET_DEVICE_INFO = 0x01,
++	IPTS_CMD_SET_MODE = 0x02,
++	IPTS_CMD_SET_MEM_WINDOW = 0x03,
++	IPTS_CMD_QUIESCE_IO = 0x04,
++	IPTS_CMD_READY_FOR_DATA = 0x05,
++	IPTS_CMD_FEEDBACK = 0x06,
++	IPTS_CMD_CLEAR_MEM_WINDOW = 0x07,
++	IPTS_CMD_RESET_SENSOR = 0x0B,
++	IPTS_CMD_GET_DESCRIPTOR = 0x0F,
++};
++
++/**
++ * enum ipts_status - Possible status codes returned by the IPTS device.
++ * @IPTS_STATUS_SUCCESS:                 Operation completed successfully.
++ * @IPTS_STATUS_INVALID_PARAMS:          Command contained an invalid payload.
++ * @IPTS_STATUS_ACCESS_DENIED:           ME could not validate a buffer address.
++ * @IPTS_STATUS_CMD_SIZE_ERROR:          Command contains an invalid payload.
++ * @IPTS_STATUS_NOT_READY:               Buffer addresses have not been set.
++ * @IPTS_STATUS_REQUEST_OUTSTANDING:     There is an outstanding command of the same type.
++ * @IPTS_STATUS_NO_SENSOR_FOUND:         No sensor could be found.
++ * @IPTS_STATUS_OUT_OF_MEMORY:           Not enough free memory for requested operation.
++ * @IPTS_STATUS_INTERNAL_ERROR:          An unexpected error occurred.
++ * @IPTS_STATUS_SENSOR_DISABLED:         The sensor has been disabled and must be reinitialized.
++ * @IPTS_STATUS_COMPAT_CHECK_FAIL:       Compatibility revision check between sensor and ME failed.
++ *                                       The host can ignore this error and attempt to continue.
++ * @IPTS_STATUS_SENSOR_EXPECTED_RESET:   The sensor went through a reset initiated by the driver.
++ * @IPTS_STATUS_SENSOR_UNEXPECTED_RESET: The sensor went through an unexpected reset.
++ * @IPTS_STATUS_RESET_FAILED:            Requested sensor reset failed to complete.
++ * @IPTS_STATUS_TIMEOUT:                 The operation timed out.
++ * @IPTS_STATUS_TEST_MODE_FAIL:          Test mode pattern did not match expected values.
++ * @IPTS_STATUS_SENSOR_FAIL_FATAL:       The sensor reported an error during reset sequence.
++ *                                       Further progress is not possible.
++ * @IPTS_STATUS_SENSOR_FAIL_NONFATAL:    The sensor reported an error during reset sequence.
++ *                                       The driver can attempt to continue.
++ * @IPTS_STATUS_INVALID_DEVICE_CAPS:     The device reported invalid capabilities.
++ * @IPTS_STATUS_QUIESCE_IO_IN_PROGRESS:  Command cannot be completed until Quiesce IO is done.
++ */
++enum ipts_status {
++	IPTS_STATUS_SUCCESS = 0x00,
++	IPTS_STATUS_INVALID_PARAMS = 0x01,
++	IPTS_STATUS_ACCESS_DENIED = 0x02,
++	IPTS_STATUS_CMD_SIZE_ERROR = 0x03,
++	IPTS_STATUS_NOT_READY = 0x04,
++	IPTS_STATUS_REQUEST_OUTSTANDING = 0x05,
++	IPTS_STATUS_NO_SENSOR_FOUND = 0x06,
++	IPTS_STATUS_OUT_OF_MEMORY = 0x07,
++	IPTS_STATUS_INTERNAL_ERROR = 0x08,
++	IPTS_STATUS_SENSOR_DISABLED = 0x09,
++	IPTS_STATUS_COMPAT_CHECK_FAIL = 0x0A,
++	IPTS_STATUS_SENSOR_EXPECTED_RESET = 0x0B,
++	IPTS_STATUS_SENSOR_UNEXPECTED_RESET = 0x0C,
++	IPTS_STATUS_RESET_FAILED = 0x0D,
++	IPTS_STATUS_TIMEOUT = 0x0E,
++	IPTS_STATUS_TEST_MODE_FAIL = 0x0F,
++	IPTS_STATUS_SENSOR_FAIL_FATAL = 0x10,
++	IPTS_STATUS_SENSOR_FAIL_NONFATAL = 0x11,
++	IPTS_STATUS_INVALID_DEVICE_CAPS = 0x12,
++	IPTS_STATUS_QUIESCE_IO_IN_PROGRESS = 0x13,
++};
++
++/**
++ * struct ipts_command - Message that is sent to the device for calling a command.
++ * @cmd:     The command that will be called.
++ * @payload: Payload containing parameters for the called command.
++ */
++struct ipts_command {
++	enum ipts_command_code cmd;
++	u8 payload[320];
++} __packed;
++
++static_assert(sizeof(struct ipts_command) == 324);
++
++/**
++ * enum ipts_mode - Configures what data the device produces and how its sent.
++ * @IPTS_MODE_EVENT:    The device will send an event once a buffer was filled.
++ *                      Older devices will return singletouch data in this mode.
++ * @IPTS_MODE_DOORBELL: The device will notify the driver by incrementing the doorbell value.
++ *                      Older devices will return multitouch data in this mode.
++ */
++enum ipts_mode {
++	IPTS_MODE_EVENT = 0x00,
++	IPTS_MODE_DOORBELL = 0x01,
++};
++
++/**
++ * struct ipts_set_mode - Payload for the SET_MODE command.
++ * @mode: Changes the mode that IPTS will operate in.
++ */
++struct ipts_set_mode {
++	enum ipts_mode mode;
++	u8 reserved[12];
++} __packed;
++
++static_assert(sizeof(struct ipts_set_mode) == 16);
++
++#define IPTS_WORKQUEUE_SIZE	 8192
++#define IPTS_WORKQUEUE_ITEM_SIZE 16
 +
-+	if (ipts->host2me.address) {
-+		dma_free_coherent(ipts->dev, feedback_buffer_size,
-+				  ipts->host2me.address,
-+				  ipts->host2me.dma_address);
++/**
++ * struct ipts_mem_window - Payload for the SET_MEM_WINDOW command.
++ * @data_addr_lower:      Lower 32 bits of the data buffer addresses.
++ * @data_addr_upper:      Upper 32 bits of the data buffer addresses.
++ * @workqueue_addr_lower: Lower 32 bits of the workqueue buffer address.
++ * @workqueue_addr_upper: Upper 32 bits of the workqueue buffer address.
++ * @doorbell_addr_lower:  Lower 32 bits of the doorbell buffer address.
++ * @doorbell_addr_upper:  Upper 32 bits of the doorbell buffer address.
++ * @feedbackaddr_lower:   Lower 32 bits of the feedback buffer addresses.
++ * @feedbackaddr_upper:   Upper 32 bits of the feedback buffer addresses.
++ * @hid2me_addr_lower:    Lower 32 bits of the hid2me buffer address.
++ * @hid2me_addr_upper:    Upper 32 bits of the hid2me buffer address.
++ * @hid2me_size:          Size of the hid2me feedback buffer.
++ * @workqueue_item_size:  Magic value. Must be 16.
++ * @workqueue_size:       Magic value. Must be 8192.
++ *
++ * The workqueue related items in this struct are required for using
++ * GuC submission with binary processing firmware. Since this driver does
++ * not use GuC submission and instead exports raw data to userspace, these
++ * items are not actually used, but they need to be allocated and passed
++ * to the device, otherwise initialization will fail.
++ */
++struct ipts_mem_window {
++	u32 data_addr_lower[IPTS_BUFFERS];
++	u32 data_addr_upper[IPTS_BUFFERS];
++	u32 workqueue_addr_lower;
++	u32 workqueue_addr_upper;
++	u32 doorbell_addr_lower;
++	u32 doorbell_addr_upper;
++	u32 feedback_addr_lower[IPTS_BUFFERS];
++	u32 feedback_addr_upper[IPTS_BUFFERS];
++	u32 hid2me_addr_lower;
++	u32 hid2me_addr_upper;
++	u32 hid2me_size;
++	u8 reserved1;
++	u8 workqueue_item_size;
++	u16 workqueue_size;
++	u8 reserved[32];
++} __packed;
 +
-+		ipts->host2me.address = NULL;
-+		ipts->host2me.dma_address = 0;
-+	}
-+}
++static_assert(sizeof(struct ipts_mem_window) == 320);
 +
-+int ipts_resources_alloc(struct ipts_context *ipts)
-+{
-+	int i;
-+	struct ipts_buffer_info *buffers;
++/**
++ * struct ipts_quiesce_io - Payload for the QUIESCE_IO command.
++ */
++struct ipts_quiesce_io {
++	u8 reserved[12];
++} __packed;
 +
-+	u32 data_buffer_size = ipts->device_info.data_size;
-+	u32 feedback_buffer_size = ipts->device_info.feedback_size;
++static_assert(sizeof(struct ipts_quiesce_io) == 12);
 +
-+	buffers = ipts->data;
-+	for (i = 0; i < IPTS_BUFFERS; i++) {
-+		buffers[i].address =
-+			dma_alloc_coherent(ipts->dev, data_buffer_size,
-+					   &buffers[i].dma_address, GFP_KERNEL);
++/**
++ * struct ipts_feedback - Payload for the FEEDBACK command.
++ * @buffer: The buffer that the device should refill.
++ */
++struct ipts_feedback {
++	u32 buffer;
++	u8 reserved[12];
++} __packed;
 +
-+		if (!buffers[i].address)
-+			goto release_resources;
-+	}
++static_assert(sizeof(struct ipts_feedback) == 16);
 +
-+	buffers = ipts->feedback;
-+	for (i = 0; i < IPTS_BUFFERS; i++) {
-+		buffers[i].address =
-+			dma_alloc_coherent(ipts->dev, feedback_buffer_size,
-+					   &buffers[i].dma_address, GFP_KERNEL);
++/**
++ * enum ipts_reset_type - Possible ways of resetting the device.
++ * @IPTS_RESET_TYPE_HARD: Perform hardware reset using GPIO pin.
++ * @IPTS_RESET_TYPE_SOFT: Perform software reset using SPI command.
++ */
++enum ipts_reset_type {
++	IPTS_RESET_TYPE_HARD = 0x00,
++	IPTS_RESET_TYPE_SOFT = 0x01,
++};
 +
-+		if (!buffers[i].address)
-+			goto release_resources;
-+	}
++/**
++ * struct ipts_reset - Payload for the RESET_SENSOR command.
++ * @type: How the device should get reset.
++ */
++struct ipts_reset_sensor {
++	enum ipts_reset_type type;
++	u8 reserved[4];
++} __packed;
 +
-+	ipts->doorbell.address =
-+		dma_alloc_coherent(ipts->dev, sizeof(u32),
-+				   &ipts->doorbell.dma_address, GFP_KERNEL);
++static_assert(sizeof(struct ipts_reset_sensor) == 8);
 +
-+	if (!ipts->doorbell.address)
-+		goto release_resources;
++/**
++ * struct ipts_get_descriptor - Payload for the GET_DESCRIPTOR command.
++ * @addr_lower: The lower 32 bits of the descriptor buffer address.
++ * @addr_upper: The upper 32 bits of the descriptor buffer address.
++ * @magic:      A magic value. Must be 8.
++ */
++struct ipts_get_descriptor {
++	u32 addr_lower;
++	u32 addr_upper;
++	u32 magic;
++	u8 reserved[12];
++} __packed;
 +
-+	ipts->workqueue.address =
-+		dma_alloc_coherent(ipts->dev, sizeof(u32),
-+				   &ipts->workqueue.dma_address, GFP_KERNEL);
++static_assert(sizeof(struct ipts_get_descriptor) == 24);
 +
-+	if (!ipts->workqueue.address)
-+		goto release_resources;
++/*
++ * The type of a response is indicated by a
++ * command code, with the most significant bit flipped to 1.
++ */
++#define IPTS_RSP_BIT BIT(31)
 +
-+	ipts->host2me.address =
-+		dma_alloc_coherent(ipts->dev, feedback_buffer_size,
-+				   &ipts->host2me.dma_address, GFP_KERNEL);
++/**
++ * struct ipts_response - Data returned from the device in response to a command.
++ * @cmd:     The command that this response answers (IPTS_RSP_BIT will be 1).
++ * @status:  The return code of the command.
++ * @payload: The data that was produced by the command.
++ */
++struct ipts_response {
++	enum ipts_command_code cmd;
++	enum ipts_status status;
++	u8 payload[80];
++} __packed;
 +
-+	if (!ipts->workqueue.address)
-+		goto release_resources;
++static_assert(sizeof(struct ipts_response) == 88);
 +
-+	return 0;
++/**
++ * struct ipts_device_info - Vendor information of the IPTS device.
++ * @vendor:        Vendor ID of this device.
++ * @product:       Product ID of this device.
++ * @hw_version:    Hardware revision of this device.
++ * @fw_version:    Firmware revision of this device.
++ * @data_size:     Requested size for a data buffer.
++ * @feedback_size: Requested size for a feedback buffer.
++ * @mode:          Mode that the device currently operates in.
++ * @max_contacts:  Maximum amount of concurrent touches the sensor can process.
++ */
++struct ipts_device_info {
++	u16 vendor;
++	u16 product;
++	u32 hw_version;
++	u32 fw_version;
++	u32 data_size;
++	u32 feedback_size;
++	enum ipts_mode mode;
++	u8 max_contacts;
++	u8 reserved1[3];
++	u8 sensor_min_eds;
++	u8 sensor_maj_eds;
++	u8 me_min_eds;
++	u8 me_maj_eds;
++	u8 intf_eds;
++	u8 reserved2[11];
++} __packed;
 +
-+release_resources:
++static_assert(sizeof(struct ipts_device_info) == 44);
 +
-+	ipts_resources_free(ipts);
-+	return -ENOMEM;
-+}
-diff --git a/drivers/misc/ipts/resources.h b/drivers/misc/ipts/resources.h
++#endif /* IPTS_SPEC_DEVICE_H */
+diff --git a/drivers/hid/ipts/spec-hid.h b/drivers/hid/ipts/spec-hid.h
 new file mode 100644
-index 000000000000..fdac0eee9156
+index 000000000000..ea70f29ff00c
 --- /dev/null
-+++ b/drivers/misc/ipts/resources.h
-@@ -0,0 +1,17 @@
++++ b/drivers/hid/ipts/spec-hid.h
+@@ -0,0 +1,35 @@
 +/* SPDX-License-Identifier: GPL-2.0-or-later */
 +/*
 + * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
++ * Copyright (c) 2020-2023 Dorian Stoll
 + *
 + * Linux driver for Intel Precise Touch & Stylus
 + */
 +
-+#ifndef _IPTS_RESOURCES_H_
-+#define _IPTS_RESOURCES_H_
++#ifndef IPTS_SPEC_HID_H
++#define IPTS_SPEC_HID_H
 +
-+#include "context.h"
++#include <linux/build_bug.h>
++#include <linux/types.h>
++
++/*
++ * Made-up type for passing raw IPTS data in a HID report.
++ */
++#define IPTS_HID_FRAME_TYPE_RAW 0xEE
++
++/**
++ * struct ipts_hid_frame - Header that is prefixed to raw IPTS data wrapped in a HID report.
++ * @size: Size of the data inside the report, including this header.
++ * @type: What type of data does this report contain.
++ */
++struct ipts_hid_header {
++	u32 size;
++	u8 reserved1;
++	u8 type;
++	u8 reserved2;
++	u8 data[];
++} __packed;
 +
-+int ipts_resources_alloc(struct ipts_context *ipts);
-+void ipts_resources_free(struct ipts_context *ipts);
++static_assert(sizeof(struct ipts_hid_header) == 7);
 +
-+#endif /* _IPTS_RESOURCES_H_ */
-diff --git a/drivers/misc/ipts/uapi.c b/drivers/misc/ipts/uapi.c
++#endif /* IPTS_SPEC_HID_H */
+diff --git a/drivers/hid/ipts/thread.c b/drivers/hid/ipts/thread.c
 new file mode 100644
-index 000000000000..598f0710ad64
+index 000000000000..8b46f775c107
 --- /dev/null
-+++ b/drivers/misc/ipts/uapi.c
-@@ -0,0 +1,208 @@
++++ b/drivers/hid/ipts/thread.c
+@@ -0,0 +1,85 @@
 +// SPDX-License-Identifier: GPL-2.0-or-later
 +/*
 + * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
++ * Copyright (c) 2023 Dorian Stoll
 + *
 + * Linux driver for Intel Precise Touch & Stylus
 + */
 +
-+#include <linux/cdev.h>
-+#include <linux/delay.h>
-+#include <linux/device.h>
-+#include <linux/fs.h>
-+#include <linux/types.h>
-+#include <linux/uaccess.h>
-+
-+#include "context.h"
-+#include "control.h"
-+#include "protocol.h"
-+#include "uapi.h"
++#include <linux/completion.h>
++#include <linux/err.h>
++#include <linux/kthread.h>
++#include <linux/mutex.h>
 +
-+struct ipts_uapi uapi;
++#include "thread.h"
 +
-+static ssize_t ipts_uapi_read(struct file *file, char __user *buf, size_t count,
-+			      loff_t *offset)
++bool ipts_thread_should_stop(struct ipts_thread *thread)
 +{
-+	int buffer;
-+	int maxbytes;
-+	struct ipts_context *ipts = uapi.ipts;
-+
-+	buffer = MINOR(file->f_path.dentry->d_inode->i_rdev);
-+
-+	if (!ipts || ipts->status != IPTS_HOST_STATUS_STARTED)
-+		return -ENODEV;
-+
-+	maxbytes = ipts->device_info.data_size - *offset;
-+	if (maxbytes <= 0 || count > maxbytes)
-+		return -EINVAL;
-+
-+	if (copy_to_user(buf, ipts->data[buffer].address + *offset, count))
-+		return -EFAULT;
++	if (!thread)
++		return false;
 +
-+	return count;
++	return READ_ONCE(thread->should_stop);
 +}
 +
-+static long ipts_uapi_ioctl_get_device_ready(struct ipts_context *ipts,
-+					     unsigned long arg)
++static int ipts_thread_runner(void *data)
 +{
-+	void __user *buffer = (void __user *)arg;
-+	u8 ready = 0;
++	int ret = 0;
++	struct ipts_thread *thread = data;
 +
-+	if (ipts)
-+		ready = ipts->status == IPTS_HOST_STATUS_STARTED;
-+
-+	if (copy_to_user(buffer, &ready, sizeof(u8)))
++	if (!thread)
 +		return -EFAULT;
 +
-+	return 0;
-+}
-+
-+static long ipts_uapi_ioctl_get_device_info(struct ipts_context *ipts,
-+					    unsigned long arg)
-+{
-+	struct ipts_device_info info;
-+	void __user *buffer = (void __user *)arg;
-+
-+	if (!ipts || ipts->status != IPTS_HOST_STATUS_STARTED)
-+		return -ENODEV;
-+
-+	info.vendor = ipts->device_info.vendor_id;
-+	info.product = ipts->device_info.device_id;
-+	info.version = ipts->device_info.fw_rev;
-+	info.buffer_size = ipts->device_info.data_size;
-+	info.max_contacts = ipts->device_info.max_contacts;
-+
-+	if (copy_to_user(buffer, &info, sizeof(struct ipts_device_info)))
++	if (!thread->threadfn)
 +		return -EFAULT;
 +
-+	return 0;
-+}
-+
-+static long ipts_uapi_ioctl_get_doorbell(struct ipts_context *ipts,
-+					 unsigned long arg)
-+{
-+	void __user *buffer = (void __user *)arg;
-+
-+	if (!ipts || ipts->status != IPTS_HOST_STATUS_STARTED)
-+		return -ENODEV;
-+
-+	if (copy_to_user(buffer, ipts->doorbell.address, sizeof(u32)))
-+		return -EFAULT;
++	ret = thread->threadfn(thread);
++	complete_all(&thread->done);
 +
-+	return 0;
++	return ret;
 +}
 +
-+static long ipts_uapi_ioctl_send_feedback(struct ipts_context *ipts,
-+					  struct file *file)
++int ipts_thread_start(struct ipts_thread *thread, int (*threadfn)(struct ipts_thread *thread),
++		      void *data, const char *name)
 +{
-+	int ret;
-+	u32 buffer;
-+
-+	if (!ipts || ipts->status != IPTS_HOST_STATUS_STARTED)
-+		return -ENODEV;
-+
-+	buffer = MINOR(file->f_path.dentry->d_inode->i_rdev);
-+
-+	ret = ipts_control_send_feedback(ipts, buffer);
-+	if (ret)
++	if (!thread)
 +		return -EFAULT;
 +
-+	return 0;
-+}
-+
-+static long ipts_uapi_ioctl_send_reset(struct ipts_context *ipts)
-+{
-+	int ret;
-+	struct ipts_reset_sensor_cmd cmd;
-+
-+	if (!ipts || ipts->status != IPTS_HOST_STATUS_STARTED)
-+		return -ENODEV;
-+
-+	memset(&cmd, 0, sizeof(struct ipts_reset_sensor_cmd));
-+	cmd.type = IPTS_RESET_TYPE_SOFT;
-+
-+	ret = ipts_control_send(ipts, IPTS_CMD_RESET_SENSOR, &cmd,
-+				sizeof(struct ipts_reset_sensor_cmd));
-+
-+	if (ret)
++	if (!threadfn)
 +		return -EFAULT;
 +
-+	return 0;
-+}
-+
-+static long ipts_uapi_ioctl(struct file *file, unsigned int cmd,
-+			    unsigned long arg)
-+{
-+	struct ipts_context *ipts = uapi.ipts;
-+
-+	switch (cmd) {
-+	case IPTS_IOCTL_GET_DEVICE_READY:
-+		return ipts_uapi_ioctl_get_device_ready(ipts, arg);
-+	case IPTS_IOCTL_GET_DEVICE_INFO:
-+		return ipts_uapi_ioctl_get_device_info(ipts, arg);
-+	case IPTS_IOCTL_GET_DOORBELL:
-+		return ipts_uapi_ioctl_get_doorbell(ipts, arg);
-+	case IPTS_IOCTL_SEND_FEEDBACK:
-+		return ipts_uapi_ioctl_send_feedback(ipts, file);
-+	case IPTS_IOCTL_SEND_RESET:
-+		return ipts_uapi_ioctl_send_reset(ipts);
-+	default:
-+		return -ENOTTY;
-+	}
-+}
-+
-+static const struct file_operations ipts_uapi_fops = {
-+	.owner = THIS_MODULE,
-+	.read = ipts_uapi_read,
-+	.unlocked_ioctl = ipts_uapi_ioctl,
-+#ifdef CONFIG_COMPAT
-+	.compat_ioctl = ipts_uapi_ioctl,
-+#endif
-+};
++	init_completion(&thread->done);
 +
-+void ipts_uapi_link(struct ipts_context *ipts)
-+{
-+	uapi.ipts = ipts;
-+}
++	thread->data = data;
++	thread->should_stop = false;
++	thread->threadfn = threadfn;
 +
-+void ipts_uapi_unlink(void)
-+{
-+	uapi.ipts = NULL;
++	thread->thread = kthread_run(ipts_thread_runner, thread, name);
++	return PTR_ERR_OR_ZERO(thread->thread);
 +}
 +
-+int ipts_uapi_init(void)
++int ipts_thread_stop(struct ipts_thread *thread)
 +{
-+	int i, major;
-+
-+	alloc_chrdev_region(&uapi.dev, 0, IPTS_BUFFERS, "ipts");
-+	uapi.class = class_create(THIS_MODULE, "ipts");
-+
-+	major = MAJOR(uapi.dev);
-+
-+	cdev_init(&uapi.cdev, &ipts_uapi_fops);
-+	uapi.cdev.owner = THIS_MODULE;
-+	cdev_add(&uapi.cdev, MKDEV(major, 0), IPTS_BUFFERS);
++	int ret = 0;
 +
-+	for (i = 0; i < IPTS_BUFFERS; i++) {
-+		device_create(uapi.class, NULL, MKDEV(major, i), NULL,
-+			      "ipts/%d", i);
-+	}
++	if (!thread)
++		return -EFAULT;
 +
-+	return 0;
-+}
++	if (!thread->thread)
++		return 0;
 +
-+void ipts_uapi_free(void)
-+{
-+	int i;
-+	int major;
++	WRITE_ONCE(thread->should_stop, true);
 +
-+	major = MAJOR(uapi.dev);
++	/*
++	 * Make sure that the write has gone through before waiting.
++	 */
++	wmb();
 +
-+	for (i = 0; i < IPTS_BUFFERS; i++)
-+		device_destroy(uapi.class, MKDEV(major, i));
++	wait_for_completion(&thread->done);
++	ret = kthread_stop(thread->thread);
 +
-+	cdev_del(&uapi.cdev);
++	thread->thread = NULL;
++	thread->data = NULL;
++	thread->threadfn = NULL;
 +
-+	unregister_chrdev_region(MKDEV(major, 0), MINORMASK);
-+	class_destroy(uapi.class);
++	return ret;
 +}
-diff --git a/drivers/misc/ipts/uapi.h b/drivers/misc/ipts/uapi.h
+diff --git a/drivers/hid/ipts/thread.h b/drivers/hid/ipts/thread.h
 new file mode 100644
-index 000000000000..53fb86a88f97
+index 000000000000..a314843599fc
 --- /dev/null
-+++ b/drivers/misc/ipts/uapi.h
-@@ -0,0 +1,47 @@
++++ b/drivers/hid/ipts/thread.h
+@@ -0,0 +1,60 @@
 +/* SPDX-License-Identifier: GPL-2.0-or-later */
 +/*
 + * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
++ * Copyright (c) 2023 Dorian Stoll
 + *
 + * Linux driver for Intel Precise Touch & Stylus
 + */
 +
-+#ifndef _IPTS_UAPI_H_
-+#define _IPTS_UAPI_H_
-+
-+#include <linux/types.h>
++#ifndef IPTS_THREAD_H
++#define IPTS_THREAD_H
 +
-+#include "context.h"
++#include <linux/completion.h>
++#include <linux/mutex.h>
++#include <linux/sched.h>
 +
-+struct ipts_uapi {
-+	dev_t dev;
-+	struct class *class;
-+	struct cdev cdev;
++/*
++ * This wrapper over kthread is necessary, because calling kthread_stop makes it impossible
++ * to issue MEI commands from that thread while it shuts itself down. By using a custom
++ * boolean variable and a completion object, we can call kthread_stop only when the thread
++ * already finished all of its work and has returned.
++ */
++struct ipts_thread {
++	struct task_struct *thread;
 +
-+	struct ipts_context *ipts;
-+};
++	bool should_stop;
++	struct completion done;
 +
-+struct ipts_device_info {
-+	__u16 vendor;
-+	__u16 product;
-+	__u32 version;
-+	__u32 buffer_size;
-+	__u8 max_contacts;
-+
-+	/* For future expansion */
-+	__u8 reserved[19];
++	void *data;
++	int (*threadfn)(struct ipts_thread *thread);
 +};
 +
-+#define IPTS_IOCTL_GET_DEVICE_READY _IOR(0x86, 0x01, __u8)
-+#define IPTS_IOCTL_GET_DEVICE_INFO  _IOR(0x86, 0x02, struct ipts_device_info)
-+#define IPTS_IOCTL_GET_DOORBELL	    _IOR(0x86, 0x03, __u32)
-+#define IPTS_IOCTL_SEND_FEEDBACK    _IO(0x86, 0x04)
-+#define IPTS_IOCTL_SEND_RESET	    _IO(0x86, 0x05)
-+
-+void ipts_uapi_link(struct ipts_context *ipts);
-+void ipts_uapi_unlink(void);
-+
-+int ipts_uapi_init(void);
-+void ipts_uapi_free(void);
-+
-+#endif /* _IPTS_UAPI_H_ */
--- 
-2.39.1
-
-From 93797032614d485639d977647d64ff6a2448280a Mon Sep 17 00:00:00 2001
-From: Liban Hannan <liban.p@gmail.com>
-Date: Tue, 12 Apr 2022 23:31:12 +0100
-Subject: [PATCH] iommu: ipts: use IOMMU passthrough mode for IPTS
-
-Adds a quirk so that IOMMU uses passthrough mode for the IPTS device.
-Otherwise, when IOMMU is enabled, IPTS produces DMAR errors like:
-
-DMAR: [DMA Read NO_PASID] Request device [00:16.4] fault addr
-0x104ea3000 [fault reason 0x06] PTE Read access is not set
-
-This is very similar to the bug described at:
-https://bugs.launchpad.net/bugs/1958004
-
-Fixed with the following patch which this patch basically copies:
-https://launchpadlibrarian.net/586396847/43255ca.diff
-Patchset: ipts
----
- drivers/iommu/intel/iommu.c | 24 ++++++++++++++++++++++++
- 1 file changed, 24 insertions(+)
-
-diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
-index 644ca49e8cf8..408c321b929a 100644
---- a/drivers/iommu/intel/iommu.c
-+++ b/drivers/iommu/intel/iommu.c
-@@ -37,6 +37,8 @@
- #define IS_GFX_DEVICE(pdev) ((pdev->class >> 16) == PCI_BASE_CLASS_DISPLAY)
- #define IS_USB_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_SERIAL_USB)
- #define IS_ISA_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA)
-+#define IS_IPTS(pdev) ((pdev)->vendor == PCI_VENDOR_ID_INTEL &&	\
-+			    ((pdev)->device == 0x9d3e))
- #define IS_AZALIA(pdev) ((pdev)->vendor == 0x8086 && (pdev)->device == 0x3a3e)
- 
- #define IOAPIC_RANGE_START	(0xfee00000)
-@@ -286,12 +288,14 @@ int intel_iommu_enabled = 0;
- EXPORT_SYMBOL_GPL(intel_iommu_enabled);
- 
- static int dmar_map_gfx = 1;
-+static int dmar_map_ipts = 1;
- static int intel_iommu_superpage = 1;
- static int iommu_identity_mapping;
- static int iommu_skip_te_disable;
- 
- #define IDENTMAP_GFX		2
- #define IDENTMAP_AZALIA		4
-+#define IDENTMAP_IPTS		16
- 
- const struct iommu_ops intel_iommu_ops;
- 
-@@ -2630,6 +2634,9 @@ static int device_def_domain_type(struct device *dev)
- 
- 		if ((iommu_identity_mapping & IDENTMAP_GFX) && IS_GFX_DEVICE(pdev))
- 			return IOMMU_DOMAIN_IDENTITY;
-+
-+		if ((iommu_identity_mapping & IDENTMAP_IPTS) && IS_IPTS(pdev))
-+			return IOMMU_DOMAIN_IDENTITY;
- 	}
- 
- 	return 0;
-@@ -3019,6 +3026,9 @@ static int __init init_dmars(void)
- 	if (!dmar_map_gfx)
- 		iommu_identity_mapping |= IDENTMAP_GFX;
- 
-+	if (!dmar_map_ipts)
-+		iommu_identity_mapping |= IDENTMAP_IPTS;
-+
- 	check_tylersburg_isoch();
- 
- 	ret = si_domain_init(hw_pass_through);
-@@ -4774,6 +4784,17 @@ static void quirk_iommu_igfx(struct pci_dev *dev)
- 	dmar_map_gfx = 0;
- }
- 
-+static void quirk_iommu_ipts(struct pci_dev *dev)
-+{
-+	if (!IS_IPTS(dev))
-+		return;
++/*
++ * ipts_thread_should_stop() - Returns true if the thread is asked to terminate.
++ * @thread: The current thread.
++ *
++ * Returns: true if the thread should stop, false if not.
++ */
++bool ipts_thread_should_stop(struct ipts_thread *thread);
 +
-+	if (risky_device(dev))
-+		return;
++/*
++ * ipts_thread_start() - Starts an IPTS thread.
++ * @thread: The thread to initialize and start.
++ * @threadfn: The function to execute.
++ * @data: An argument that will be passed to threadfn.
++ * @name: The name of the new thread.
++ *
++ * Returns: 0 on success, <0 on error.
++ */
++int ipts_thread_start(struct ipts_thread *thread, int (*threadfn)(struct ipts_thread *thread),
++		      void *data, const char name[]);
 +
-+	pci_info(dev, "Passthrough IOMMU for IPTS\n");
-+	dmar_map_ipts = 0;
-+}
- /* G4x/GM45 integrated gfx dmar support is totally busted. */
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_igfx);
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e00, quirk_iommu_igfx);
-@@ -4809,6 +4830,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1632, quirk_iommu_igfx);
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x163A, quirk_iommu_igfx);
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x163D, quirk_iommu_igfx);
- 
-+/* disable IPTS dmar support */
-+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9D3E, quirk_iommu_ipts);
++/*
++ * ipts_thread_stop() - Asks the thread to terminate and waits until it has finished.
++ * @thread: The thread that should stop.
++ *
++ * Returns: The return value of the thread function.
++ */
++int ipts_thread_stop(struct ipts_thread *thread);
 +
- static void quirk_iommu_rwbf(struct pci_dev *dev)
- {
- 	if (risky_device(dev))
++#endif /* IPTS_THREAD_H */
 -- 
 2.39.1
 

patches/6.1/0005-ithc.patch

@@ -0,0 +1,1433 @@
+From 9b5e6f3c5ec3c5d1020d280f06cb21998a75dd8c Mon Sep 17 00:00:00 2001
+From: Dorian Stoll <dorian.stoll@tmsp.io>
+Date: Sun, 11 Dec 2022 12:03:38 +0100
+Subject: [PATCH] iommu: intel: Disable source id verification for ITHC
+
+Signed-off-by: Dorian Stoll <dorian.stoll@tmsp.io>
+Patchset: ithc
+---
+ drivers/iommu/intel/irq_remapping.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/iommu/intel/irq_remapping.c b/drivers/iommu/intel/irq_remapping.c
+index 5962bb5027d0..86fa129d10d4 100644
+--- a/drivers/iommu/intel/irq_remapping.c
++++ b/drivers/iommu/intel/irq_remapping.c
+@@ -396,6 +396,22 @@ static int set_msi_sid(struct irte *irte, struct pci_dev *dev)
+ 	data.busmatch_count = 0;
+ 	pci_for_each_dma_alias(dev, set_msi_sid_cb, &data);
+ 
++	/*
++	 * The Intel Touch Host Controller is at 00:10.6, but for some reason
++	 * the MSI interrupts have request id 01:05.0.
++	 * Disable id verification to work around this.
++	 * FIXME Find proper fix or turn this into a quirk.
++	 */
++	if (dev->vendor == PCI_VENDOR_ID_INTEL && (dev->class >> 8) == PCI_CLASS_INPUT_PEN) {
++		switch(dev->device) {
++		case 0x98d0: case 0x98d1: // LKF
++		case 0xa0d0: case 0xa0d1: // TGL LP
++		case 0x43d0: case 0x43d1: // TGL H
++			set_irte_sid(irte, SVT_NO_VERIFY, SQ_ALL_16, 0);
++			return 0;
++		}
++	}
++
+ 	/*
+ 	 * DMA alias provides us with a PCI device and alias.  The only case
+ 	 * where the it will return an alias on a different bus than the
+-- 
+2.39.1
+
+From a0f2ca87dfa5ef12934a2d58f6cdf5ec5439d8a8 Mon Sep 17 00:00:00 2001
+From: Dorian Stoll <dorian.stoll@tmsp.io>
+Date: Sun, 11 Dec 2022 12:10:54 +0100
+Subject: [PATCH] hid: Add support for Intel Touch Host Controller
+
+Based on quo/ithc-linux@55803a2
+
+Signed-off-by: Dorian Stoll <dorian.stoll@tmsp.io>
+Patchset: ithc
+---
+ drivers/hid/Kconfig           |   2 +
+ drivers/hid/Makefile          |   1 +
+ drivers/hid/ithc/Kbuild       |   6 +
+ drivers/hid/ithc/Kconfig      |  12 +
+ drivers/hid/ithc/ithc-debug.c |  96 ++++++
+ drivers/hid/ithc/ithc-dma.c   | 258 ++++++++++++++++
+ drivers/hid/ithc/ithc-dma.h   |  67 +++++
+ drivers/hid/ithc/ithc-main.c  | 534 ++++++++++++++++++++++++++++++++++
+ drivers/hid/ithc/ithc-regs.c  |  64 ++++
+ drivers/hid/ithc/ithc-regs.h  | 186 ++++++++++++
+ drivers/hid/ithc/ithc.h       |  60 ++++
+ 11 files changed, 1286 insertions(+)
+ create mode 100644 drivers/hid/ithc/Kbuild
+ create mode 100644 drivers/hid/ithc/Kconfig
+ create mode 100644 drivers/hid/ithc/ithc-debug.c
+ create mode 100644 drivers/hid/ithc/ithc-dma.c
+ create mode 100644 drivers/hid/ithc/ithc-dma.h
+ create mode 100644 drivers/hid/ithc/ithc-main.c
+ create mode 100644 drivers/hid/ithc/ithc-regs.c
+ create mode 100644 drivers/hid/ithc/ithc-regs.h
+ create mode 100644 drivers/hid/ithc/ithc.h
+
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 1523ccdf73b5..b7030071ac0c 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -1292,4 +1292,6 @@ source "drivers/hid/surface-hid/Kconfig"
+ 
+ source "drivers/hid/ipts/Kconfig"
+ 
++source "drivers/hid/ithc/Kconfig"
++
+ endmenu
+diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
+index e48300bcea9b..8ef7308b0f9d 100644
+--- a/drivers/hid/Makefile
++++ b/drivers/hid/Makefile
+@@ -166,3 +166,4 @@ obj-$(CONFIG_AMD_SFH_HID)       += amd-sfh-hid/
+ obj-$(CONFIG_SURFACE_HID_CORE)  += surface-hid/
+ 
+ obj-$(CONFIG_HID_IPTS)          += ipts/
++obj-$(CONFIG_HID_ITHC)          += ithc/
+diff --git a/drivers/hid/ithc/Kbuild b/drivers/hid/ithc/Kbuild
+new file mode 100644
+index 000000000000..aea83f2ac07b
+--- /dev/null
++++ b/drivers/hid/ithc/Kbuild
+@@ -0,0 +1,6 @@
++obj-$(CONFIG_HID_ITHC) := ithc.o
++
++ithc-objs := ithc-main.o ithc-regs.o ithc-dma.o ithc-debug.o
++
++ccflags-y := -std=gnu11 -Wno-declaration-after-statement
++
+diff --git a/drivers/hid/ithc/Kconfig b/drivers/hid/ithc/Kconfig
+new file mode 100644
+index 000000000000..ede713023609
+--- /dev/null
++++ b/drivers/hid/ithc/Kconfig
+@@ -0,0 +1,12 @@
++config HID_ITHC
++	tristate "Intel Touch Host Controller"
++	depends on PCI
++	depends on HID
++	help
++	  Say Y here if your system has a touchscreen using Intels
++	  Touch Host Controller (ITHC / IPTS) technology.
++
++	  If unsure say N.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called ithc.
+diff --git a/drivers/hid/ithc/ithc-debug.c b/drivers/hid/ithc/ithc-debug.c
+new file mode 100644
+index 000000000000..57bf125c45bd
+--- /dev/null
++++ b/drivers/hid/ithc/ithc-debug.c
+@@ -0,0 +1,96 @@
++#include "ithc.h"
++
++void ithc_log_regs(struct ithc *ithc) {
++	if (!ithc->prev_regs) return;
++	u32 __iomem *cur = (__iomem void*)ithc->regs;
++	u32 *prev = (void*)ithc->prev_regs;
++	for (int i = 1024; i < sizeof *ithc->regs / 4; i++) {
++		u32 x = readl(cur + i);
++		if (x != prev[i]) {
++			pci_info(ithc->pci, "reg %04x: %08x -> %08x\n", i * 4, prev[i], x);
++			prev[i] = x;
++		}
++	}
++}
++
++static ssize_t ithc_debugfs_cmd_write(struct file *f, const char __user *buf, size_t len, loff_t *offset) {
++	struct ithc *ithc = file_inode(f)->i_private;
++	char cmd[256];
++	if (!ithc || !ithc->pci) return -ENODEV;
++	if (!len) return -EINVAL;
++	if (len >= sizeof cmd) return -EINVAL;
++	if (copy_from_user(cmd, buf, len)) return -EFAULT;
++	cmd[len] = 0;
++	if (cmd[len-1] == '\n') cmd[len-1] = 0;
++	pci_info(ithc->pci, "debug command: %s\n", cmd);
++	u32 n = 0;
++	const char *s = cmd + 1;
++	u32 a[32];
++	while (*s && *s != '\n') {
++		if (n >= ARRAY_SIZE(a)) return -EINVAL;
++		if (*s++ != ' ') return -EINVAL;
++		char *e;
++		a[n++] = simple_strtoul(s, &e, 0);
++		if (e == s) return -EINVAL;
++		s = e;
++	}
++	ithc_log_regs(ithc);
++	switch(cmd[0]) {
++	case 'x': // reset
++		ithc_reset(ithc);
++		break;
++	case 'w': // write register: offset mask value
++		if (n != 3 || (a[0] & 3)) return -EINVAL;
++		pci_info(ithc->pci, "debug write 0x%04x = 0x%08x (mask 0x%08x)\n", a[0], a[2], a[1]);
++		bitsl(((__iomem u32 *)ithc->regs) + a[0] / 4, a[1], a[2]);
++		break;
++	case 'r': // read register: offset
++		if (n != 1 || (a[0] & 3)) return -EINVAL;
++		pci_info(ithc->pci, "debug read 0x%04x = 0x%08x\n", a[0], readl(((__iomem u32 *)ithc->regs) + a[0] / 4));
++		break;
++	case 's': // spi command: cmd offset len data...
++		// read config: s 4 0 64 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
++		// set touch cfg: s 6 12 4 XX
++		if (n < 3 || a[2] > (n - 3) * 4) return -EINVAL;
++		pci_info(ithc->pci, "debug spi command %u with %u bytes of data\n", a[0], a[2]);
++		if (!CHECK(ithc_spi_command, ithc, a[0], a[1], a[2], a + 3))
++			for (u32 i = 0; i < (a[2] + 3) / 4; i++) pci_info(ithc->pci, "resp %u = 0x%08x\n", i, a[3+i]);
++		break;
++	case 'd': // dma command: cmd len data...
++		// get report descriptor: d 7 8 0 0
++		// enable multitouch: d 3 2 0x0105
++		if (n < 2 || a[1] > (n - 2) * 4) return -EINVAL;
++		pci_info(ithc->pci, "debug dma command %u with %u bytes of data\n", a[0], a[1]);
++		if (ithc_dma_tx(ithc, a[0], a[1], a + 2)) pci_err(ithc->pci, "dma tx failed\n");
++		break;
++	default:
++		return -EINVAL;
++	}
++	ithc_log_regs(ithc);
++	return len;
++}
++
++static const struct file_operations ithc_debugfops_cmd = {
++	.owner = THIS_MODULE,
++	.write = ithc_debugfs_cmd_write,
++};
++
++static void ithc_debugfs_devres_release(struct device *dev, void *res) {
++	struct dentry **dbgm = res;
++	if (*dbgm) debugfs_remove_recursive(*dbgm);
++}
++
++int ithc_debug_init(struct ithc *ithc) {
++	struct dentry **dbgm = devres_alloc(ithc_debugfs_devres_release, sizeof *dbgm, GFP_KERNEL);
++	if (!dbgm) return -ENOMEM;
++	devres_add(&ithc->pci->dev, dbgm);
++	struct dentry *dbg = debugfs_create_dir(DEVNAME, NULL);
++	if (IS_ERR(dbg)) return PTR_ERR(dbg);
++	*dbgm = dbg;
++
++	struct dentry *cmd = debugfs_create_file("cmd", 0220, dbg, ithc, &ithc_debugfops_cmd);
++	if (IS_ERR(cmd)) return PTR_ERR(cmd);
++
++	return 0;
++}
++
+diff --git a/drivers/hid/ithc/ithc-dma.c b/drivers/hid/ithc/ithc-dma.c
+new file mode 100644
+index 000000000000..7e89b3496918
+--- /dev/null
++++ b/drivers/hid/ithc/ithc-dma.c
+@@ -0,0 +1,258 @@
++#include "ithc.h"
++
++static int ithc_dma_prd_alloc(struct ithc *ithc, struct ithc_dma_prd_buffer *p, unsigned num_buffers, unsigned num_pages, enum dma_data_direction dir) {
++	p->num_pages = num_pages;
++	p->dir = dir;
++	p->size = round_up(num_buffers * num_pages * sizeof(struct ithc_phys_region_desc), PAGE_SIZE);
++	p->addr = dmam_alloc_coherent(&ithc->pci->dev, p->size, &p->dma_addr, GFP_KERNEL);
++	if (!p->addr) return -ENOMEM;
++	if (p->dma_addr & (PAGE_SIZE - 1)) return -EFAULT;
++	return 0;
++}
++
++struct ithc_sg_table {
++	void *addr;
++	struct sg_table sgt;
++	enum dma_data_direction dir;
++};
++static void ithc_dma_sgtable_free(struct sg_table *sgt) {
++	struct scatterlist *sg;
++	int i;
++	for_each_sgtable_sg(sgt, sg, i) {
++		struct page *p = sg_page(sg);
++		if (p) __free_page(p);
++	}
++	sg_free_table(sgt);
++}
++static void ithc_dma_data_devres_release(struct device *dev, void *res) {
++	struct ithc_sg_table *sgt = res;
++	if (sgt->addr) vunmap(sgt->addr);
++	dma_unmap_sgtable(dev, &sgt->sgt, sgt->dir, 0);
++	ithc_dma_sgtable_free(&sgt->sgt);
++}
++
++static int ithc_dma_data_alloc(struct ithc* ithc, struct ithc_dma_prd_buffer *prds, struct ithc_dma_data_buffer *b) {
++	// We don't use dma_alloc_coherent for data buffers, because they don't have to be contiguous (we can use one PRD per page) or coherent (they are unidirectional).
++	// Instead we use an sg_table of individually allocated pages (5.13 has dma_alloc_noncontiguous for this, but we'd like to support 5.10 for now).
++	struct page *pages[16];
++	if (prds->num_pages == 0 || prds->num_pages > ARRAY_SIZE(pages)) return -EINVAL;
++	b->active_idx = -1;
++	struct ithc_sg_table *sgt = devres_alloc(ithc_dma_data_devres_release, sizeof *sgt, GFP_KERNEL);
++	if (!sgt) return -ENOMEM;
++	sgt->dir = prds->dir;
++	if (!sg_alloc_table(&sgt->sgt, prds->num_pages, GFP_KERNEL)) {
++		struct scatterlist *sg;
++		int i;
++		bool ok = true;
++		for_each_sgtable_sg(&sgt->sgt, sg, i) {
++			struct page *p = pages[i] = alloc_page(GFP_KERNEL | __GFP_ZERO); // don't need __GFP_DMA for PCI DMA
++			if (!p) { ok = false; break; }
++			sg_set_page(sg, p, PAGE_SIZE, 0);
++		}
++		if (ok && !dma_map_sgtable(&ithc->pci->dev, &sgt->sgt, prds->dir, 0)) {
++			devres_add(&ithc->pci->dev, sgt);
++			b->sgt = &sgt->sgt;
++			b->addr = sgt->addr = vmap(pages, prds->num_pages, 0, PAGE_KERNEL);
++			if (!b->addr) return -ENOMEM;
++			return 0;
++		}
++		ithc_dma_sgtable_free(&sgt->sgt);
++	}
++	devres_free(sgt);
++	return -ENOMEM;
++}
++
++static int ithc_dma_data_buffer_put(struct ithc *ithc, struct ithc_dma_prd_buffer *prds, struct ithc_dma_data_buffer *b, unsigned idx) {
++	struct ithc_phys_region_desc *prd = prds->addr;
++	prd += idx * prds->num_pages;
++	if (b->active_idx >= 0) { pci_err(ithc->pci, "buffer already active\n"); return -EINVAL; }
++	b->active_idx = idx;
++	if (prds->dir == DMA_TO_DEVICE) {
++		if (b->data_size > PAGE_SIZE) return -EINVAL;
++		prd->addr = sg_dma_address(b->sgt->sgl) >> 10;
++		prd->size = b->data_size | PRD_FLAG_END;
++		flush_kernel_vmap_range(b->addr, b->data_size);
++	} else if (prds->dir == DMA_FROM_DEVICE) {
++		struct scatterlist *sg;
++		int i;
++		for_each_sgtable_dma_sg(b->sgt, sg, i) {
++			prd->addr = sg_dma_address(sg) >> 10;
++			prd->size = sg_dma_len(sg);
++			prd++;
++		}
++		prd[-1].size |= PRD_FLAG_END;
++	}
++	dma_wmb(); // for the prds
++	dma_sync_sgtable_for_device(&ithc->pci->dev, b->sgt, prds->dir);
++	return 0;
++}
++
++static int ithc_dma_data_buffer_get(struct ithc *ithc, struct ithc_dma_prd_buffer *prds, struct ithc_dma_data_buffer *b, unsigned idx) {
++	struct ithc_phys_region_desc *prd = prds->addr;
++	prd += idx * prds->num_pages;
++	if (b->active_idx != idx) { pci_err(ithc->pci, "wrong buffer index\n"); return -EINVAL; }
++	b->active_idx = -1;
++	if (prds->dir == DMA_FROM_DEVICE) {
++		dma_rmb(); // for the prds
++		b->data_size = 0;
++		struct scatterlist *sg;
++		int i;
++		for_each_sgtable_dma_sg(b->sgt, sg, i) {
++			unsigned size = prd->size;
++			b->data_size += size & PRD_SIZE_MASK;
++			if (size & PRD_FLAG_END) break;
++			if ((size & PRD_SIZE_MASK) != sg_dma_len(sg)) { pci_err(ithc->pci, "truncated prd\n"); break; }
++			prd++;
++		}
++		invalidate_kernel_vmap_range(b->addr, b->data_size);
++	}
++	dma_sync_sgtable_for_cpu(&ithc->pci->dev, b->sgt, prds->dir);
++	return 0;
++}
++
++int ithc_dma_rx_init(struct ithc *ithc, u8 channel, const char *devname) {
++	struct ithc_dma_rx *rx = &ithc->dma_rx[channel];
++	mutex_init(&rx->mutex);
++	u32 buf_size = DEVCFG_DMA_RX_SIZE(ithc->config.dma_buf_sizes);
++	unsigned num_pages = (buf_size + PAGE_SIZE - 1) / PAGE_SIZE;
++	pci_dbg(ithc->pci, "allocating rx buffers: num = %u, size = %u, pages = %u\n", NUM_RX_BUF, buf_size, num_pages);
++	CHECK_RET(ithc_dma_prd_alloc, ithc, &rx->prds, NUM_RX_BUF, num_pages, DMA_FROM_DEVICE);
++	for (unsigned i = 0; i < NUM_RX_BUF; i++)
++		CHECK_RET(ithc_dma_data_alloc, ithc, &rx->prds, &rx->bufs[i]);
++	writeb(DMA_RX_CONTROL2_RESET, &ithc->regs->dma_rx[channel].control2);
++	lo_hi_writeq(rx->prds.dma_addr, &ithc->regs->dma_rx[channel].addr);
++	writeb(NUM_RX_BUF - 1, &ithc->regs->dma_rx[channel].num_bufs);
++	writeb(num_pages - 1, &ithc->regs->dma_rx[channel].num_prds);
++	u8 head = readb(&ithc->regs->dma_rx[channel].head);
++	if (head) { pci_err(ithc->pci, "head is nonzero (%u)\n", head); return -EIO; }
++	for (unsigned i = 0; i < NUM_RX_BUF; i++)
++		CHECK_RET(ithc_dma_data_buffer_put, ithc, &rx->prds, &rx->bufs[i], i);
++	writeb(head ^ DMA_RX_WRAP_FLAG, &ithc->regs->dma_rx[channel].tail);
++	return 0;
++}
++void ithc_dma_rx_enable(struct ithc *ithc, u8 channel) {
++	bitsb_set(&ithc->regs->dma_rx[channel].control, DMA_RX_CONTROL_ENABLE | DMA_RX_CONTROL_IRQ_ERROR | DMA_RX_CONTROL_IRQ_DATA);
++	CHECK(waitl, ithc, &ithc->regs->dma_rx[1].status, DMA_RX_STATUS_ENABLED, DMA_RX_STATUS_ENABLED);
++}
++
++int ithc_dma_tx_init(struct ithc *ithc) {
++	struct ithc_dma_tx *tx = &ithc->dma_tx;
++	mutex_init(&tx->mutex);
++	tx->max_size = DEVCFG_DMA_TX_SIZE(ithc->config.dma_buf_sizes);
++	unsigned num_pages = (tx->max_size + PAGE_SIZE - 1) / PAGE_SIZE;
++	pci_dbg(ithc->pci, "allocating tx buffers: size = %u, pages = %u\n", tx->max_size, num_pages);
++	CHECK_RET(ithc_dma_prd_alloc, ithc, &tx->prds, 1, num_pages, DMA_TO_DEVICE);
++	CHECK_RET(ithc_dma_data_alloc, ithc, &tx->prds, &tx->buf);
++	lo_hi_writeq(tx->prds.dma_addr, &ithc->regs->dma_tx.addr);
++	writeb(num_pages - 1, &ithc->regs->dma_tx.num_prds);
++	CHECK_RET(ithc_dma_data_buffer_put, ithc, &ithc->dma_tx.prds, &ithc->dma_tx.buf, 0);
++	return 0;
++}
++
++static int ithc_dma_rx_process_buf(struct ithc *ithc, struct ithc_dma_data_buffer *data, u8 channel, u8 buf) {
++	if (buf >= NUM_RX_BUF) {
++		pci_err(ithc->pci, "invalid dma ringbuffer index\n");
++		return -EINVAL;
++	}
++	ithc_set_active(ithc);
++	u32 len = data->data_size;
++	struct ithc_dma_rx_header *hdr = data->addr;
++	u8 *hiddata = (void *)(hdr + 1);
++	if (len >= sizeof *hdr && hdr->code == DMA_RX_CODE_RESET) {
++		CHECK(ithc_reset, ithc);
++	} else if (len < sizeof *hdr || len != sizeof *hdr + hdr->data_size) {
++		if (hdr->code == DMA_RX_CODE_INPUT_REPORT) {
++			// When the CPU enters a low power state during DMA, we can get truncated messages.
++			// Typically this will be a single touch HID report that is only 1 byte, or a multitouch report that is 257 bytes.
++			// See also ithc_set_active().
++		} else {
++			pci_err(ithc->pci, "invalid dma rx data! channel %u, buffer %u, size %u, code %u, data size %u\n", channel, buf, len, hdr->code, hdr->data_size);
++			print_hex_dump_debug(DEVNAME " data: ", DUMP_PREFIX_OFFSET, 32, 1, hdr, min(len, 0x400u), 0);
++		}
++	} else if (hdr->code == DMA_RX_CODE_REPORT_DESCRIPTOR && hdr->data_size > 8) {
++		CHECK(hid_parse_report, ithc->hid, hiddata + 8, hdr->data_size - 8);
++		WRITE_ONCE(ithc->hid_parse_done, true);
++		wake_up(&ithc->wait_hid_parse);
++	} else if (hdr->code == DMA_RX_CODE_INPUT_REPORT) {
++		CHECK(hid_input_report, ithc->hid, HID_INPUT_REPORT, hiddata, hdr->data_size, 1);
++	} else if (hdr->code == DMA_RX_CODE_FEATURE_REPORT) {
++		bool done = false;
++		mutex_lock(&ithc->hid_get_feature_mutex);
++		if (ithc->hid_get_feature_buf) {
++			if (hdr->data_size < ithc->hid_get_feature_size) ithc->hid_get_feature_size = hdr->data_size;
++			memcpy(ithc->hid_get_feature_buf, hiddata, ithc->hid_get_feature_size);
++			ithc->hid_get_feature_buf = NULL;
++			done = true;
++		}
++		mutex_unlock(&ithc->hid_get_feature_mutex);
++		if (done) wake_up(&ithc->wait_hid_get_feature);
++		else CHECK(hid_input_report, ithc->hid, HID_FEATURE_REPORT, hiddata, hdr->data_size, 1);
++	} else {
++		pci_dbg(ithc->pci, "unhandled dma rx data! channel %u, buffer %u, size %u, code %u\n", channel, buf, len, hdr->code);
++		print_hex_dump_debug(DEVNAME " data: ", DUMP_PREFIX_OFFSET, 32, 1, hdr, min(len, 0x400u), 0);
++	}
++	return 0;
++}
++
++static int ithc_dma_rx_unlocked(struct ithc *ithc, u8 channel) {
++	struct ithc_dma_rx *rx = &ithc->dma_rx[channel];
++	unsigned n = rx->num_received;
++	u8 head_wrap = readb(&ithc->regs->dma_rx[channel].head);
++	while (1) {
++		u8 tail = n % NUM_RX_BUF;
++		u8 tail_wrap = tail | ((n / NUM_RX_BUF) & 1 ? 0 : DMA_RX_WRAP_FLAG);
++		writeb(tail_wrap, &ithc->regs->dma_rx[channel].tail);
++		// ringbuffer is full if tail_wrap == head_wrap
++		// ringbuffer is empty if tail_wrap == head_wrap ^ WRAP_FLAG
++		if (tail_wrap == (head_wrap ^ DMA_RX_WRAP_FLAG)) return 0;
++
++		// take the buffer that the device just filled
++		struct ithc_dma_data_buffer *b = &rx->bufs[n % NUM_RX_BUF];
++		CHECK_RET(ithc_dma_data_buffer_get, ithc, &rx->prds, b, tail);
++		rx->num_received = ++n;
++
++		// process data
++		CHECK(ithc_dma_rx_process_buf, ithc, b, channel, tail);
++
++		// give the buffer back to the device
++		CHECK_RET(ithc_dma_data_buffer_put, ithc, &rx->prds, b, tail);
++	}
++}
++int ithc_dma_rx(struct ithc *ithc, u8 channel) {
++	struct ithc_dma_rx *rx = &ithc->dma_rx[channel];
++	mutex_lock(&rx->mutex);
++	int ret = ithc_dma_rx_unlocked(ithc, channel);
++	mutex_unlock(&rx->mutex);
++	return ret;
++}
++
++static int ithc_dma_tx_unlocked(struct ithc *ithc, u32 cmdcode, u32 datasize, void *data) {
++	pci_dbg(ithc->pci, "dma tx command %u, size %u\n", cmdcode, datasize);
++	struct ithc_dma_tx_header *hdr;
++	u8 padding = datasize & 3 ? 4 - (datasize & 3) : 0;
++	unsigned fullsize = sizeof *hdr + datasize + padding;
++	if (fullsize > ithc->dma_tx.max_size || fullsize > PAGE_SIZE) return -EINVAL;
++	CHECK_RET(ithc_dma_data_buffer_get, ithc, &ithc->dma_tx.prds, &ithc->dma_tx.buf, 0);
++
++	ithc->dma_tx.buf.data_size = fullsize;
++	hdr = ithc->dma_tx.buf.addr;
++	hdr->code = cmdcode;
++	hdr->data_size = datasize;
++	u8 *dest = (void *)(hdr + 1);
++	memcpy(dest, data, datasize);
++	dest += datasize;
++	for (u8 p = 0; p < padding; p++) *dest++ = 0;
++	CHECK_RET(ithc_dma_data_buffer_put, ithc, &ithc->dma_tx.prds, &ithc->dma_tx.buf, 0);
++
++	bitsb_set(&ithc->regs->dma_tx.control, DMA_TX_CONTROL_SEND);
++	CHECK_RET(waitb, ithc, &ithc->regs->dma_tx.control, DMA_TX_CONTROL_SEND, 0);
++	writel(DMA_TX_STATUS_DONE, &ithc->regs->dma_tx.status);
++	return 0;
++}
++int ithc_dma_tx(struct ithc *ithc, u32 cmdcode, u32 datasize, void *data) {
++	mutex_lock(&ithc->dma_tx.mutex);
++	int ret = ithc_dma_tx_unlocked(ithc, cmdcode, datasize, data);
++	mutex_unlock(&ithc->dma_tx.mutex);
++	return ret;
++}
++
+diff --git a/drivers/hid/ithc/ithc-dma.h b/drivers/hid/ithc/ithc-dma.h
+new file mode 100644
+index 000000000000..d9f2c19a13f3
+--- /dev/null
++++ b/drivers/hid/ithc/ithc-dma.h
+@@ -0,0 +1,67 @@
++#define PRD_SIZE_MASK            0xffffff
++#define PRD_FLAG_END             0x1000000
++#define PRD_FLAG_SUCCESS         0x2000000
++#define PRD_FLAG_ERROR           0x4000000
++
++struct ithc_phys_region_desc {
++	u64 addr; // physical addr/1024
++	u32 size; // num bytes, PRD_FLAG_END marks last prd for data split over multiple prds
++	u32 unused;
++};
++
++#define DMA_RX_CODE_INPUT_REPORT          3
++#define DMA_RX_CODE_FEATURE_REPORT        4
++#define DMA_RX_CODE_REPORT_DESCRIPTOR     5
++#define DMA_RX_CODE_RESET                 7
++
++struct ithc_dma_rx_header {
++	u32 code;
++	u32 data_size;
++	u32 _unknown[14];
++};
++
++#define DMA_TX_CODE_SET_FEATURE           3
++#define DMA_TX_CODE_GET_FEATURE           4
++#define DMA_TX_CODE_OUTPUT_REPORT         5
++#define DMA_TX_CODE_GET_REPORT_DESCRIPTOR 7
++
++struct ithc_dma_tx_header {
++	u32 code;
++	u32 data_size;
++};
++
++struct ithc_dma_prd_buffer {
++	void *addr;
++	dma_addr_t dma_addr;
++	u32 size;
++	u32 num_pages; // per data buffer
++	enum dma_data_direction dir;
++};
++
++struct ithc_dma_data_buffer {
++	void *addr;
++	struct sg_table *sgt;
++	int active_idx;
++	u32 data_size;
++};
++
++struct ithc_dma_tx {
++	struct mutex mutex;
++	u32 max_size;
++	struct ithc_dma_prd_buffer prds;
++	struct ithc_dma_data_buffer buf;
++};
++
++struct ithc_dma_rx {
++	struct mutex mutex;
++	u32 num_received;
++	struct ithc_dma_prd_buffer prds;
++	struct ithc_dma_data_buffer bufs[NUM_RX_BUF];
++};
++
++int ithc_dma_rx_init(struct ithc *ithc, u8 channel, const char *devname);
++void ithc_dma_rx_enable(struct ithc *ithc, u8 channel);
++int ithc_dma_tx_init(struct ithc *ithc);
++int ithc_dma_rx(struct ithc *ithc, u8 channel);
++int ithc_dma_tx(struct ithc *ithc, u32 cmdcode, u32 datasize, void *cmddata);
++
+diff --git a/drivers/hid/ithc/ithc-main.c b/drivers/hid/ithc/ithc-main.c
+new file mode 100644
+index 000000000000..09512b9cb4d3
+--- /dev/null
++++ b/drivers/hid/ithc/ithc-main.c
+@@ -0,0 +1,534 @@
++#include "ithc.h"
++
++MODULE_DESCRIPTION("Intel Touch Host Controller driver");
++MODULE_LICENSE("Dual BSD/GPL");
++
++// Lakefield
++#define PCI_DEVICE_ID_INTEL_THC_LKF_PORT1    0x98d0
++#define PCI_DEVICE_ID_INTEL_THC_LKF_PORT2    0x98d1
++// Tiger Lake
++#define PCI_DEVICE_ID_INTEL_THC_TGL_LP_PORT1 0xa0d0
++#define PCI_DEVICE_ID_INTEL_THC_TGL_LP_PORT2 0xa0d1
++#define PCI_DEVICE_ID_INTEL_THC_TGL_H_PORT1  0x43d0
++#define PCI_DEVICE_ID_INTEL_THC_TGL_H_PORT2  0x43d1
++// Alder Lake
++#define PCI_DEVICE_ID_INTEL_THC_ADL_S_PORT1  0x7ad8
++#define PCI_DEVICE_ID_INTEL_THC_ADL_S_PORT2  0x7ad9
++#define PCI_DEVICE_ID_INTEL_THC_ADL_P_PORT1  0x51d0
++#define PCI_DEVICE_ID_INTEL_THC_ADL_P_PORT2  0x51d1
++#define PCI_DEVICE_ID_INTEL_THC_ADL_M_PORT1  0x54d0
++#define PCI_DEVICE_ID_INTEL_THC_ADL_M_PORT2  0x54d1
++// Raptor Lake
++#define PCI_DEVICE_ID_INTEL_THC_RPL_S_PORT1  0x7a58
++#define PCI_DEVICE_ID_INTEL_THC_RPL_S_PORT2  0x7a59
++// Meteor Lake
++#define PCI_DEVICE_ID_INTEL_THC_MTL_PORT1    0x7e48
++#define PCI_DEVICE_ID_INTEL_THC_MTL_PORT2    0x7e4a
++
++static const struct pci_device_id ithc_pci_tbl[] = {
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_LKF_PORT1) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_LKF_PORT2) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_TGL_LP_PORT1) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_TGL_LP_PORT2) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_TGL_H_PORT1) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_TGL_H_PORT2) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_ADL_S_PORT1) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_ADL_S_PORT2) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_ADL_P_PORT1) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_ADL_P_PORT2) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_ADL_M_PORT1) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_ADL_M_PORT2) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_RPL_S_PORT1) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_RPL_S_PORT2) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_MTL_PORT1) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_MTL_PORT2) },
++	{}
++};
++MODULE_DEVICE_TABLE(pci, ithc_pci_tbl);
++
++// Module parameters
++
++static bool ithc_use_polling = false;
++module_param_named(poll, ithc_use_polling, bool, 0);
++MODULE_PARM_DESC(poll, "Use polling instead of interrupts");
++
++static bool ithc_use_rx0 = false;
++module_param_named(rx0, ithc_use_rx0, bool, 0);
++MODULE_PARM_DESC(rx0, "Use DMA RX channel 0");
++
++static bool ithc_use_rx1 = true;
++module_param_named(rx1, ithc_use_rx1, bool, 0);
++MODULE_PARM_DESC(rx1, "Use DMA RX channel 1");
++
++static bool ithc_log_regs_enabled = false;
++module_param_named(logregs, ithc_log_regs_enabled, bool, 0);
++MODULE_PARM_DESC(logregs, "Log changes in register values (for debugging)");
++
++// Sysfs attributes
++
++static bool ithc_is_config_valid(struct ithc *ithc) {
++	return ithc->config.device_id == DEVCFG_DEVICE_ID_TIC;
++}
++
++static ssize_t vendor_show(struct device *dev, struct device_attribute *attr, char *buf) {
++	struct ithc *ithc = dev_get_drvdata(dev);
++	if (!ithc || !ithc_is_config_valid(ithc)) return -ENODEV;
++	return sprintf(buf, "0x%04x", ithc->config.vendor_id);
++}
++static DEVICE_ATTR_RO(vendor);
++static ssize_t product_show(struct device *dev, struct device_attribute *attr, char *buf) {
++	struct ithc *ithc = dev_get_drvdata(dev);
++	if (!ithc || !ithc_is_config_valid(ithc)) return -ENODEV;
++	return sprintf(buf, "0x%04x", ithc->config.product_id);
++}
++static DEVICE_ATTR_RO(product);
++static ssize_t revision_show(struct device *dev, struct device_attribute *attr, char *buf) {
++	struct ithc *ithc = dev_get_drvdata(dev);
++	if (!ithc || !ithc_is_config_valid(ithc)) return -ENODEV;
++	return sprintf(buf, "%u", ithc->config.revision);
++}
++static DEVICE_ATTR_RO(revision);
++static ssize_t fw_version_show(struct device *dev, struct device_attribute *attr, char *buf) {
++	struct ithc *ithc = dev_get_drvdata(dev);
++	if (!ithc || !ithc_is_config_valid(ithc)) return -ENODEV;
++	u32 v = ithc->config.fw_version;
++	return sprintf(buf, "%i.%i.%i.%i", v >> 24, v >> 16 & 0xff, v >> 8 & 0xff, v & 0xff);
++}
++static DEVICE_ATTR_RO(fw_version);
++
++static const struct attribute_group *ithc_attribute_groups[] = {
++	&(const struct attribute_group){
++		.name = DEVNAME,
++		.attrs = (struct attribute *[]){
++			&dev_attr_vendor.attr,
++			&dev_attr_product.attr,
++			&dev_attr_revision.attr,
++			&dev_attr_fw_version.attr,
++			NULL
++		},
++	},
++	NULL
++};
++
++// HID setup
++
++static int ithc_hid_start(struct hid_device *hdev) { return 0; }
++static void ithc_hid_stop(struct hid_device *hdev) { }
++static int ithc_hid_open(struct hid_device *hdev) { return 0; }
++static void ithc_hid_close(struct hid_device *hdev) { }
++
++static int ithc_hid_parse(struct hid_device *hdev) {
++	struct ithc *ithc = hdev->driver_data;
++	u64 val = 0;
++	WRITE_ONCE(ithc->hid_parse_done, false);
++	CHECK_RET(ithc_dma_tx, ithc, DMA_TX_CODE_GET_REPORT_DESCRIPTOR, sizeof val, &val);
++	if (!wait_event_timeout(ithc->wait_hid_parse, READ_ONCE(ithc->hid_parse_done), msecs_to_jiffies(1000))) return -ETIMEDOUT;
++	return 0;
++}
++
++static int ithc_hid_raw_request(struct hid_device *hdev, unsigned char reportnum, __u8 *buf, size_t len, unsigned char rtype, int reqtype) {
++	struct ithc *ithc = hdev->driver_data;
++	if (!buf || !len) return -EINVAL;
++	u32 code;
++	if (rtype == HID_OUTPUT_REPORT && reqtype == HID_REQ_SET_REPORT) code = DMA_TX_CODE_OUTPUT_REPORT;
++	else if (rtype == HID_FEATURE_REPORT && reqtype == HID_REQ_SET_REPORT) code = DMA_TX_CODE_SET_FEATURE;
++	else if (rtype == HID_FEATURE_REPORT && reqtype == HID_REQ_GET_REPORT) code = DMA_TX_CODE_GET_FEATURE;
++	else {
++		pci_err(ithc->pci, "unhandled hid request %i %i for report id %i\n", rtype, reqtype, reportnum);
++		return -EINVAL;
++	}
++	buf[0] = reportnum;
++	if (reqtype == HID_REQ_GET_REPORT) {
++		mutex_lock(&ithc->hid_get_feature_mutex);
++		ithc->hid_get_feature_buf = buf;
++		ithc->hid_get_feature_size = len;
++		mutex_unlock(&ithc->hid_get_feature_mutex);
++		int r = CHECK(ithc_dma_tx, ithc, code, 1, buf);
++		if (!r) {
++			r = wait_event_interruptible_timeout(ithc->wait_hid_get_feature, !ithc->hid_get_feature_buf, msecs_to_jiffies(1000));
++			if (!r) r = -ETIMEDOUT;
++			else if (r < 0) r = -EINTR;
++			else r = 0;
++		}
++		mutex_lock(&ithc->hid_get_feature_mutex);
++		ithc->hid_get_feature_buf = NULL;
++		if (!r) r = ithc->hid_get_feature_size;
++		mutex_unlock(&ithc->hid_get_feature_mutex);
++		return r;
++	}
++	CHECK_RET(ithc_dma_tx, ithc, code, len, buf);
++	return 0;
++}
++
++static struct hid_ll_driver ithc_ll_driver = {
++	.start = ithc_hid_start,
++	.stop = ithc_hid_stop,
++	.open = ithc_hid_open,
++	.close = ithc_hid_close,
++	.parse = ithc_hid_parse,
++	.raw_request = ithc_hid_raw_request,
++};
++
++static void ithc_hid_devres_release(struct device *dev, void *res) {
++	struct hid_device **hidm = res;
++	if (*hidm) hid_destroy_device(*hidm);
++}
++
++static int ithc_hid_init(struct ithc *ithc) {
++	struct hid_device **hidm = devres_alloc(ithc_hid_devres_release, sizeof *hidm, GFP_KERNEL);
++	if (!hidm) return -ENOMEM;
++	devres_add(&ithc->pci->dev, hidm);
++	struct hid_device *hid = hid_allocate_device();
++	if (IS_ERR(hid)) return PTR_ERR(hid);
++	*hidm = hid;
++
++	strscpy(hid->name, DEVFULLNAME, sizeof(hid->name));
++	strscpy(hid->phys, ithc->phys, sizeof(hid->phys));
++	hid->ll_driver = &ithc_ll_driver;
++	hid->bus = BUS_PCI;
++	hid->vendor = ithc->config.vendor_id;
++	hid->product = ithc->config.product_id;
++	hid->version = 0x100;
++	hid->dev.parent = &ithc->pci->dev;
++	hid->driver_data = ithc;
++
++	ithc->hid = hid;
++	return 0;
++}
++
++// Interrupts/polling
++
++static void ithc_activity_timer_callback(struct timer_list *t) {
++	struct ithc *ithc = container_of(t, struct ithc, activity_timer);
++	cpu_latency_qos_update_request(&ithc->activity_qos, PM_QOS_DEFAULT_VALUE);
++}
++
++void ithc_set_active(struct ithc *ithc) {
++	// When CPU usage is very low, the CPU can enter various low power states (C2-C10).
++	// This disrupts DMA, causing truncated DMA messages. ERROR_FLAG_DMA_UNKNOWN_12 will be set when this happens.
++	// The amount of truncated messages can become very high, resulting in user-visible effects (laggy/stuttering cursor).
++	// To avoid this, we use a CPU latency QoS request to prevent the CPU from entering low power states during touch interactions.
++	cpu_latency_qos_update_request(&ithc->activity_qos, 0);
++	mod_timer(&ithc->activity_timer, jiffies + msecs_to_jiffies(1000));
++}
++
++static int ithc_set_device_enabled(struct ithc *ithc, bool enable) {
++	u32 x = ithc->config.touch_cfg = (ithc->config.touch_cfg & ~(u32)DEVCFG_TOUCH_MASK) | DEVCFG_TOUCH_UNKNOWN_2
++		| (enable ? DEVCFG_TOUCH_ENABLE | DEVCFG_TOUCH_UNKNOWN_3 | DEVCFG_TOUCH_UNKNOWN_4 : 0);
++	return ithc_spi_command(ithc, SPI_CMD_CODE_WRITE, offsetof(struct ithc_device_config, touch_cfg), sizeof x, &x);
++}
++
++static void ithc_disable_interrupts(struct ithc *ithc) {
++	writel(0, &ithc->regs->error_control);
++	bitsb(&ithc->regs->spi_cmd.control, SPI_CMD_CONTROL_IRQ, 0);
++	bitsb(&ithc->regs->dma_rx[0].control, DMA_RX_CONTROL_IRQ_UNKNOWN_1 | DMA_RX_CONTROL_IRQ_ERROR | DMA_RX_CONTROL_IRQ_UNKNOWN_4 | DMA_RX_CONTROL_IRQ_DATA, 0);
++	bitsb(&ithc->regs->dma_rx[1].control, DMA_RX_CONTROL_IRQ_UNKNOWN_1 | DMA_RX_CONTROL_IRQ_ERROR | DMA_RX_CONTROL_IRQ_UNKNOWN_4 | DMA_RX_CONTROL_IRQ_DATA, 0);
++	bitsb(&ithc->regs->dma_tx.control, DMA_TX_CONTROL_IRQ, 0);
++}
++
++static void ithc_clear_dma_rx_interrupts(struct ithc *ithc, unsigned channel) {
++	writel(DMA_RX_STATUS_ERROR | DMA_RX_STATUS_UNKNOWN_4 | DMA_RX_STATUS_HAVE_DATA, &ithc->regs->dma_rx[channel].status);
++}
++
++static void ithc_clear_interrupts(struct ithc *ithc) {
++	writel(0xffffffff, &ithc->regs->error_flags);
++	writel(ERROR_STATUS_DMA | ERROR_STATUS_SPI, &ithc->regs->error_status);
++	writel(SPI_CMD_STATUS_DONE | SPI_CMD_STATUS_ERROR, &ithc->regs->spi_cmd.status);
++	ithc_clear_dma_rx_interrupts(ithc, 0);
++	ithc_clear_dma_rx_interrupts(ithc, 1);
++	writel(DMA_TX_STATUS_DONE | DMA_TX_STATUS_ERROR | DMA_TX_STATUS_UNKNOWN_2, &ithc->regs->dma_tx.status);
++}
++
++static void ithc_process(struct ithc *ithc) {
++	ithc_log_regs(ithc);
++
++	// read and clear error bits
++	u32 err = readl(&ithc->regs->error_flags);
++	if (err) {
++		if (err & ~ERROR_FLAG_DMA_UNKNOWN_12) pci_err(ithc->pci, "error flags: 0x%08x\n", err);
++		writel(err, &ithc->regs->error_flags);
++	}
++
++	// process DMA rx
++	if (ithc_use_rx0) {
++		ithc_clear_dma_rx_interrupts(ithc, 0);
++		ithc_dma_rx(ithc, 0);
++	}
++	if (ithc_use_rx1) {
++		ithc_clear_dma_rx_interrupts(ithc, 1);
++		ithc_dma_rx(ithc, 1);
++	}
++
++	ithc_log_regs(ithc);
++}
++
++static irqreturn_t ithc_interrupt_thread(int irq, void *arg) {
++	struct ithc *ithc = arg;
++	pci_dbg(ithc->pci, "IRQ! err=%08x/%08x/%08x, cmd=%02x/%08x, rx0=%02x/%08x, rx1=%02x/%08x, tx=%02x/%08x\n",
++		readl(&ithc->regs->error_control), readl(&ithc->regs->error_status), readl(&ithc->regs->error_flags),
++		readb(&ithc->regs->spi_cmd.control), readl(&ithc->regs->spi_cmd.status),
++		readb(&ithc->regs->dma_rx[0].control), readl(&ithc->regs->dma_rx[0].status),
++		readb(&ithc->regs->dma_rx[1].control), readl(&ithc->regs->dma_rx[1].status),
++		readb(&ithc->regs->dma_tx.control), readl(&ithc->regs->dma_tx.status));
++	ithc_process(ithc);
++	return IRQ_HANDLED;
++}
++
++static int ithc_poll_thread(void *arg) {
++	struct ithc *ithc = arg;
++	unsigned sleep = 100;
++	while (!kthread_should_stop()) {
++		u32 n = ithc->dma_rx[1].num_received;
++		ithc_process(ithc);
++		if (n != ithc->dma_rx[1].num_received) sleep = 20;
++		else sleep = min(200u, sleep + (sleep >> 4) + 1);
++		msleep_interruptible(sleep);
++	}
++	return 0;
++}
++
++// Device initialization and shutdown
++
++static void ithc_disable(struct ithc *ithc) {
++	bitsl_set(&ithc->regs->control_bits, CONTROL_QUIESCE);
++	CHECK(waitl, ithc, &ithc->regs->control_bits, CONTROL_IS_QUIESCED, CONTROL_IS_QUIESCED);
++	bitsl(&ithc->regs->control_bits, CONTROL_NRESET, 0);
++	bitsb(&ithc->regs->spi_cmd.control, SPI_CMD_CONTROL_SEND, 0);
++	bitsb(&ithc->regs->dma_tx.control, DMA_TX_CONTROL_SEND, 0);
++	bitsb(&ithc->regs->dma_rx[0].control, DMA_RX_CONTROL_ENABLE, 0);
++	bitsb(&ithc->regs->dma_rx[1].control, DMA_RX_CONTROL_ENABLE, 0);
++	ithc_disable_interrupts(ithc);
++	ithc_clear_interrupts(ithc);
++}
++
++static int ithc_init_device(struct ithc *ithc) {
++	ithc_log_regs(ithc);
++	bool was_enabled = (readl(&ithc->regs->control_bits) & CONTROL_NRESET) != 0;
++	ithc_disable(ithc);
++	CHECK_RET(waitl, ithc, &ithc->regs->control_bits, CONTROL_READY, CONTROL_READY);
++	ithc_set_spi_config(ithc, 10, 0);
++	bitsl_set(&ithc->regs->dma_rx[0].unknown_init_bits, 0x80000000); // seems to help with reading config
++
++	if (was_enabled) if (msleep_interruptible(100)) return -EINTR;
++	bitsl(&ithc->regs->control_bits, CONTROL_QUIESCE, 0);
++	CHECK_RET(waitl, ithc, &ithc->regs->control_bits, CONTROL_IS_QUIESCED, 0);
++	for (int retries = 0; ; retries++) {
++		ithc_log_regs(ithc);
++		bitsl_set(&ithc->regs->control_bits, CONTROL_NRESET);
++		if (!waitl(ithc, &ithc->regs->state, 0xf, 2)) break;
++		if (retries > 5) {
++			pci_err(ithc->pci, "too many retries, failed to reset device\n");
++			return -ETIMEDOUT;
++		}
++		pci_err(ithc->pci, "invalid state, retrying reset\n");
++		bitsl(&ithc->regs->control_bits, CONTROL_NRESET, 0);
++		if (msleep_interruptible(1000)) return -EINTR;
++	}
++	ithc_log_regs(ithc);
++
++	CHECK(waitl, ithc, &ithc->regs->dma_rx[0].status, DMA_RX_STATUS_UNKNOWN_4, DMA_RX_STATUS_UNKNOWN_4);
++
++	// read config
++	for (int retries = 0; ; retries++) {
++		ithc_log_regs(ithc);
++		memset(&ithc->config, 0, sizeof ithc->config);
++		CHECK_RET(ithc_spi_command, ithc, SPI_CMD_CODE_READ, 0, sizeof ithc->config, &ithc->config);
++		u32 *p = (void *)&ithc->config;
++		pci_info(ithc->pci, "config: %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x\n",
++			p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7], p[8], p[9], p[10], p[11], p[12], p[13], p[14], p[15]);
++		if (ithc_is_config_valid(ithc)) break;
++		if (retries > 10) {
++			pci_err(ithc->pci, "failed to read config, unknown device ID 0x%08x\n", ithc->config.device_id);
++			return -EIO;
++		}
++		pci_err(ithc->pci, "failed to read config, retrying\n");
++		if (msleep_interruptible(100)) return -EINTR;
++	}
++	ithc_log_regs(ithc);
++
++	CHECK_RET(ithc_set_spi_config, ithc, DEVCFG_SPI_MAX_FREQ(ithc->config.spi_config), DEVCFG_SPI_MODE(ithc->config.spi_config));
++	CHECK_RET(ithc_set_device_enabled, ithc, true);
++	ithc_log_regs(ithc);
++	return 0;
++}
++
++int ithc_reset(struct ithc *ithc) {
++	// FIXME This should probably do devres_release_group()+ithc_start(). But because this is called during DMA
++	// processing, that would have to be done asynchronously (schedule_work()?). And with extra locking?
++	pci_err(ithc->pci, "reset\n");
++	CHECK(ithc_init_device, ithc);
++	if (ithc_use_rx0) ithc_dma_rx_enable(ithc, 0);
++	if (ithc_use_rx1) ithc_dma_rx_enable(ithc, 1);
++	ithc_log_regs(ithc);
++	pci_dbg(ithc->pci, "reset completed\n");
++	return 0;
++}
++
++static void ithc_stop(void *res) {
++	struct ithc *ithc = res;
++	pci_dbg(ithc->pci, "stopping\n");
++	ithc_log_regs(ithc);
++	if (ithc->poll_thread) CHECK(kthread_stop, ithc->poll_thread);
++	if (ithc->irq >= 0) disable_irq(ithc->irq);
++	CHECK(ithc_set_device_enabled, ithc, false);
++	ithc_disable(ithc);
++	del_timer_sync(&ithc->activity_timer);
++	cpu_latency_qos_remove_request(&ithc->activity_qos);
++	// clear dma config
++	for(unsigned i = 0; i < 2; i++) {
++		CHECK(waitl, ithc, &ithc->regs->dma_rx[i].status, DMA_RX_STATUS_ENABLED, 0);
++		lo_hi_writeq(0, &ithc->regs->dma_rx[i].addr);
++		writeb(0, &ithc->regs->dma_rx[i].num_bufs);
++		writeb(0, &ithc->regs->dma_rx[i].num_prds);
++	}
++	lo_hi_writeq(0, &ithc->regs->dma_tx.addr);
++	writeb(0, &ithc->regs->dma_tx.num_prds);
++	ithc_log_regs(ithc);
++	pci_dbg(ithc->pci, "stopped\n");
++}
++
++static void ithc_clear_drvdata(void *res) {
++	struct pci_dev *pci = res;
++	pci_set_drvdata(pci, NULL);
++}
++
++static int ithc_start(struct pci_dev *pci) {
++	pci_dbg(pci, "starting\n");
++	if (pci_get_drvdata(pci)) {
++		pci_err(pci, "device already initialized\n");
++		return -EINVAL;
++	}
++	if (!devres_open_group(&pci->dev, ithc_start, GFP_KERNEL)) return -ENOMEM;
++
++	struct ithc *ithc = devm_kzalloc(&pci->dev, sizeof *ithc, GFP_KERNEL);
++	if (!ithc) return -ENOMEM;
++	ithc->irq = -1;
++	ithc->pci = pci;
++	snprintf(ithc->phys, sizeof ithc->phys, "pci-%s/" DEVNAME, pci_name(pci));
++	init_waitqueue_head(&ithc->wait_hid_parse);
++	init_waitqueue_head(&ithc->wait_hid_get_feature);
++	mutex_init(&ithc->hid_get_feature_mutex);
++	pci_set_drvdata(pci, ithc);
++	CHECK_RET(devm_add_action_or_reset, &pci->dev, ithc_clear_drvdata, pci);
++	if (ithc_log_regs_enabled) ithc->prev_regs = devm_kzalloc(&pci->dev, sizeof *ithc->prev_regs, GFP_KERNEL);
++
++	CHECK_RET(pcim_enable_device, pci);
++	pci_set_master(pci);
++	CHECK_RET(pcim_iomap_regions, pci, BIT(0), DEVNAME " regs");
++	CHECK_RET(dma_set_mask_and_coherent, &pci->dev, DMA_BIT_MASK(64));
++	CHECK_RET(pci_set_power_state, pci, PCI_D0);
++	ithc->regs = pcim_iomap_table(pci)[0];
++
++	if (!ithc_use_polling) {
++		CHECK_RET(pci_alloc_irq_vectors, pci, 1, 1, PCI_IRQ_MSI | PCI_IRQ_MSIX);
++		ithc->irq = CHECK(pci_irq_vector, pci, 0);
++		if (ithc->irq < 0) return ithc->irq;
++	}
++
++	CHECK_RET(ithc_init_device, ithc);
++	CHECK(devm_device_add_groups, &pci->dev, ithc_attribute_groups);
++	if (ithc_use_rx0) CHECK_RET(ithc_dma_rx_init, ithc, 0, ithc_use_rx1 ? DEVNAME "0" : DEVNAME);
++	if (ithc_use_rx1) CHECK_RET(ithc_dma_rx_init, ithc, 1, ithc_use_rx0 ? DEVNAME "1" : DEVNAME);
++	CHECK_RET(ithc_dma_tx_init, ithc);
++
++	CHECK_RET(ithc_hid_init, ithc);
++
++	cpu_latency_qos_add_request(&ithc->activity_qos, PM_QOS_DEFAULT_VALUE);
++	timer_setup(&ithc->activity_timer, ithc_activity_timer_callback, 0);
++
++	// add ithc_stop callback AFTER setting up DMA buffers, so that polling/irqs/DMA are disabled BEFORE the buffers are freed
++	CHECK_RET(devm_add_action_or_reset, &pci->dev, ithc_stop, ithc);
++
++	if (ithc_use_polling) {
++		pci_info(pci, "using polling instead of irq\n");
++		// use a thread instead of simple timer because we want to be able to sleep
++		ithc->poll_thread = kthread_run(ithc_poll_thread, ithc, DEVNAME "poll");
++		if (IS_ERR(ithc->poll_thread)) {
++			int err = PTR_ERR(ithc->poll_thread);
++			ithc->poll_thread = NULL;
++			return err;
++		}
++	} else {
++		CHECK_RET(devm_request_threaded_irq, &pci->dev, ithc->irq, NULL, ithc_interrupt_thread, IRQF_TRIGGER_HIGH | IRQF_ONESHOT, DEVNAME, ithc);
++	}
++
++	if (ithc_use_rx0) ithc_dma_rx_enable(ithc, 0);
++	if (ithc_use_rx1) ithc_dma_rx_enable(ithc, 1);
++
++	// hid_add_device can only be called after irq/polling is started and DMA is enabled, because it calls ithc_hid_parse which reads the report descriptor via DMA
++	CHECK_RET(hid_add_device, ithc->hid);
++
++	CHECK(ithc_debug_init, ithc);
++
++	pci_dbg(pci, "started\n");
++	return 0;
++}
++
++static int ithc_probe(struct pci_dev *pci, const struct pci_device_id *id) {
++	pci_dbg(pci, "device probe\n");
++	return ithc_start(pci);
++}
++
++static void ithc_remove(struct pci_dev *pci) {
++	pci_dbg(pci, "device remove\n");
++	// all cleanup is handled by devres
++}
++
++static int ithc_suspend(struct device *dev) {
++	struct pci_dev *pci = to_pci_dev(dev);
++	pci_dbg(pci, "pm suspend\n");
++	devres_release_group(dev, ithc_start);
++	return 0;
++}
++
++static int ithc_resume(struct device *dev) {
++	struct pci_dev *pci = to_pci_dev(dev);
++	pci_dbg(pci, "pm resume\n");
++	return ithc_start(pci);
++}
++
++static int ithc_freeze(struct device *dev) {
++	struct pci_dev *pci = to_pci_dev(dev);
++	pci_dbg(pci, "pm freeze\n");
++	devres_release_group(dev, ithc_start);
++	return 0;
++}
++
++static int ithc_thaw(struct device *dev) {
++	struct pci_dev *pci = to_pci_dev(dev);
++	pci_dbg(pci, "pm thaw\n");
++	return ithc_start(pci);
++}
++
++static int ithc_restore(struct device *dev) {
++	struct pci_dev *pci = to_pci_dev(dev);
++	pci_dbg(pci, "pm restore\n");
++	return ithc_start(pci);
++}
++
++static struct pci_driver ithc_driver = {
++	.name = DEVNAME,
++	.id_table = ithc_pci_tbl,
++	.probe = ithc_probe,
++	.remove = ithc_remove,
++	.driver.pm = &(const struct dev_pm_ops) {
++		.suspend = ithc_suspend,
++		.resume = ithc_resume,
++		.freeze = ithc_freeze,
++		.thaw = ithc_thaw,
++		.restore = ithc_restore,
++	},
++	//.dev_groups = ithc_attribute_groups, // could use this (since 5.14), however the attributes won't have valid values until config has been read anyway
++};
++
++static int __init ithc_init(void) {
++	return pci_register_driver(&ithc_driver);
++}
++
++static void __exit ithc_exit(void) {
++	pci_unregister_driver(&ithc_driver);
++}
++
++module_init(ithc_init);
++module_exit(ithc_exit);
++
+diff --git a/drivers/hid/ithc/ithc-regs.c b/drivers/hid/ithc/ithc-regs.c
+new file mode 100644
+index 000000000000..85d567b05761
+--- /dev/null
++++ b/drivers/hid/ithc/ithc-regs.c
+@@ -0,0 +1,64 @@
++#include "ithc.h"
++
++#define reg_num(r) (0x1fff & (u16)(__force u64)(r))
++
++void bitsl(__iomem u32 *reg, u32 mask, u32 val) {
++	if (val & ~mask) pr_err("register 0x%x: invalid value 0x%x for bitmask 0x%x\n", reg_num(reg), val, mask);
++	writel((readl(reg) & ~mask) | (val & mask), reg);
++}
++
++void bitsb(__iomem u8 *reg, u8 mask, u8 val) {
++	if (val & ~mask) pr_err("register 0x%x: invalid value 0x%x for bitmask 0x%x\n", reg_num(reg), val, mask);
++	writeb((readb(reg) & ~mask) | (val & mask), reg);
++}
++
++int waitl(struct ithc *ithc, __iomem u32 *reg, u32 mask, u32 val) {
++	pci_dbg(ithc->pci, "waiting for reg 0x%04x mask 0x%08x val 0x%08x\n", reg_num(reg), mask, val);
++	u32 x;
++	if (readl_poll_timeout(reg, x, (x & mask) == val, 200, 1000*1000)) {
++		pci_err(ithc->pci, "timed out waiting for reg 0x%04x mask 0x%08x val 0x%08x\n", reg_num(reg), mask, val);
++		return -ETIMEDOUT;
++	}
++	pci_dbg(ithc->pci, "done waiting\n");
++	return 0;
++}
++
++int waitb(struct ithc *ithc, __iomem u8 *reg, u8 mask, u8 val) {
++	pci_dbg(ithc->pci, "waiting for reg 0x%04x mask 0x%02x val 0x%02x\n", reg_num(reg), mask, val);
++	u8 x;
++	if (readb_poll_timeout(reg, x, (x & mask) == val, 200, 1000*1000)) {
++		pci_err(ithc->pci, "timed out waiting for reg 0x%04x mask 0x%02x val 0x%02x\n", reg_num(reg), mask, val);
++		return -ETIMEDOUT;
++	}
++	pci_dbg(ithc->pci, "done waiting\n");
++	return 0;
++}
++
++int ithc_set_spi_config(struct ithc *ithc, u8 speed, u8 mode) {
++	pci_dbg(ithc->pci, "setting SPI speed to %i, mode %i\n", speed, mode);
++	if (mode == 3) mode = 2;
++	bitsl(&ithc->regs->spi_config,
++		SPI_CONFIG_MODE(0xff) | SPI_CONFIG_SPEED(0xff) | SPI_CONFIG_UNKNOWN_18(0xff) | SPI_CONFIG_SPEED2(0xff),
++		SPI_CONFIG_MODE(mode) | SPI_CONFIG_SPEED(speed) | SPI_CONFIG_UNKNOWN_18(0) | SPI_CONFIG_SPEED2(speed));
++	return 0;
++}
++
++int ithc_spi_command(struct ithc *ithc, u8 command, u32 offset, u32 size, void *data) {
++	pci_dbg(ithc->pci, "SPI command %u, size %u, offset %u\n", command, size, offset);
++	if (size > sizeof ithc->regs->spi_cmd.data) return -EINVAL;
++	CHECK_RET(waitl, ithc, &ithc->regs->spi_cmd.status, SPI_CMD_STATUS_BUSY, 0);
++	writel(SPI_CMD_STATUS_DONE | SPI_CMD_STATUS_ERROR, &ithc->regs->spi_cmd.status);
++	writeb(command, &ithc->regs->spi_cmd.code);
++	writew(size, &ithc->regs->spi_cmd.size);
++	writel(offset, &ithc->regs->spi_cmd.offset);
++	u32 *p = data, n = (size + 3) / 4;
++	for (u32 i = 0; i < n; i++) writel(p[i], &ithc->regs->spi_cmd.data[i]);
++	bitsb_set(&ithc->regs->spi_cmd.control, SPI_CMD_CONTROL_SEND);
++	CHECK_RET(waitl, ithc, &ithc->regs->spi_cmd.status, SPI_CMD_STATUS_BUSY, 0);
++	if ((readl(&ithc->regs->spi_cmd.status) & (SPI_CMD_STATUS_DONE | SPI_CMD_STATUS_ERROR)) != SPI_CMD_STATUS_DONE) return -EIO;
++	if (readw(&ithc->regs->spi_cmd.size) != size) return -EMSGSIZE;
++	for (u32 i = 0; i < n; i++) p[i] = readl(&ithc->regs->spi_cmd.data[i]);
++	writel(SPI_CMD_STATUS_DONE | SPI_CMD_STATUS_ERROR, &ithc->regs->spi_cmd.status);
++	return 0;
++}
++
+diff --git a/drivers/hid/ithc/ithc-regs.h b/drivers/hid/ithc/ithc-regs.h
+new file mode 100644
+index 000000000000..1a96092ed7ee
+--- /dev/null
++++ b/drivers/hid/ithc/ithc-regs.h
+@@ -0,0 +1,186 @@
++#define CONTROL_QUIESCE                     BIT(1)
++#define CONTROL_IS_QUIESCED                 BIT(2)
++#define CONTROL_NRESET                      BIT(3)
++#define CONTROL_READY                       BIT(29)
++
++#define SPI_CONFIG_MODE(x)                  (((x) & 3) << 2)
++#define SPI_CONFIG_SPEED(x)                 (((x) & 7) << 4)
++#define SPI_CONFIG_UNKNOWN_18(x)            (((x) & 3) << 18)
++#define SPI_CONFIG_SPEED2(x)                (((x) & 0xf) << 20) // high bit = high speed mode?
++
++#define ERROR_CONTROL_UNKNOWN_0             BIT(0)
++#define ERROR_CONTROL_DISABLE_DMA           BIT(1) // clears DMA_RX_CONTROL_ENABLE when a DMA error occurs
++#define ERROR_CONTROL_UNKNOWN_2             BIT(2)
++#define ERROR_CONTROL_UNKNOWN_3             BIT(3)
++#define ERROR_CONTROL_IRQ_DMA_UNKNOWN_9     BIT(9)
++#define ERROR_CONTROL_IRQ_DMA_UNKNOWN_10    BIT(10)
++#define ERROR_CONTROL_IRQ_DMA_UNKNOWN_12    BIT(12)
++#define ERROR_CONTROL_IRQ_DMA_UNKNOWN_13    BIT(13)
++#define ERROR_CONTROL_UNKNOWN_16(x)         (((x) & 0xff) << 16) // spi error code irq?
++#define ERROR_CONTROL_SET_DMA_STATUS        BIT(29) // sets DMA_RX_STATUS_ERROR when a DMA error occurs
++
++#define ERROR_STATUS_DMA                    BIT(28)
++#define ERROR_STATUS_SPI                    BIT(30)
++
++#define ERROR_FLAG_DMA_UNKNOWN_9            BIT(9)
++#define ERROR_FLAG_DMA_UNKNOWN_10           BIT(10)
++#define ERROR_FLAG_DMA_UNKNOWN_12           BIT(12) // set when we receive a truncated DMA message
++#define ERROR_FLAG_DMA_UNKNOWN_13           BIT(13)
++#define ERROR_FLAG_SPI_BUS_TURNAROUND       BIT(16)
++#define ERROR_FLAG_SPI_RESPONSE_TIMEOUT     BIT(17)
++#define ERROR_FLAG_SPI_INTRA_PACKET_TIMEOUT BIT(18)
++#define ERROR_FLAG_SPI_INVALID_RESPONSE     BIT(19)
++#define ERROR_FLAG_SPI_HS_RX_TIMEOUT        BIT(20)
++#define ERROR_FLAG_SPI_TOUCH_IC_INIT        BIT(21)
++
++#define SPI_CMD_CONTROL_SEND                BIT(0) // cleared by device when sending is complete
++#define SPI_CMD_CONTROL_IRQ                 BIT(1)
++
++#define SPI_CMD_CODE_READ                   4
++#define SPI_CMD_CODE_WRITE                  6
++
++#define SPI_CMD_STATUS_DONE                 BIT(0)
++#define SPI_CMD_STATUS_ERROR                BIT(1)
++#define SPI_CMD_STATUS_BUSY                 BIT(3)
++
++#define DMA_TX_CONTROL_SEND                 BIT(0) // cleared by device when sending is complete
++#define DMA_TX_CONTROL_IRQ                  BIT(3)
++
++#define DMA_TX_STATUS_DONE                  BIT(0)
++#define DMA_TX_STATUS_ERROR                 BIT(1)
++#define DMA_TX_STATUS_UNKNOWN_2             BIT(2)
++#define DMA_TX_STATUS_UNKNOWN_3             BIT(3) // busy?
++
++#define DMA_RX_CONTROL_ENABLE               BIT(0)
++#define DMA_RX_CONTROL_IRQ_UNKNOWN_1        BIT(1) // rx1 only?
++#define DMA_RX_CONTROL_IRQ_ERROR            BIT(3) // rx1 only?
++#define DMA_RX_CONTROL_IRQ_UNKNOWN_4        BIT(4) // rx0 only?
++#define DMA_RX_CONTROL_IRQ_DATA             BIT(5)
++
++#define DMA_RX_CONTROL2_UNKNOWN_5           BIT(5) // rx0 only?
++#define DMA_RX_CONTROL2_RESET               BIT(7) // resets ringbuffer indices
++
++#define DMA_RX_WRAP_FLAG                    BIT(7)
++
++#define DMA_RX_STATUS_ERROR                 BIT(3)
++#define DMA_RX_STATUS_UNKNOWN_4             BIT(4) // set in rx0 after using CONTROL_NRESET when it becomes possible to read config (can take >100ms)
++#define DMA_RX_STATUS_HAVE_DATA             BIT(5)
++#define DMA_RX_STATUS_ENABLED               BIT(8)
++
++#define COUNTER_RESET                       BIT(31)
++
++struct ithc_registers {
++	/* 0000 */ u32 _unknown_0000[1024];
++	/* 1000 */ u32 _unknown_1000;
++	/* 1004 */ u32 _unknown_1004;
++	/* 1008 */ u32 control_bits;
++	/* 100c */ u32 _unknown_100c;
++	/* 1010 */ u32 spi_config;
++	/* 1014 */ u32 _unknown_1014[3];
++	/* 1020 */ u32 error_control;
++	/* 1024 */ u32 error_status; // write to clear
++	/* 1028 */ u32 error_flags; // write to clear
++	/* 102c */ u32 _unknown_102c[5];
++	struct {
++		/* 1040 */ u8 control;
++		/* 1041 */ u8 code;
++		/* 1042 */ u16 size;
++		/* 1044 */ u32 status; // write to clear
++		/* 1048 */ u32 offset;
++		/* 104c */ u32 data[16];
++		/* 108c */ u32 _unknown_108c;
++	} spi_cmd;
++	struct {
++		/* 1090 */ u64 addr; // cannot be written with writeq(), must use lo_hi_writeq()
++		/* 1098 */ u8 control;
++		/* 1099 */ u8 _unknown_1099;
++		/* 109a */ u8 _unknown_109a;
++		/* 109b */ u8 num_prds;
++		/* 109c */ u32 status; // write to clear
++	} dma_tx;
++	/* 10a0 */ u32 _unknown_10a0[7];
++	/* 10bc */ u32 state; // is 0xe0000402 (dev config val 0) after CONTROL_NRESET, 0xe0000461 after first touch, 0xe0000401 after DMA_RX_CODE_RESET
++	/* 10c0 */ u32 _unknown_10c0[8];
++	/* 10e0 */ u32 _unknown_10e0_counters[3];
++	/* 10ec */ u32 _unknown_10ec[5];
++	struct {
++		/* 1100/1200 */ u64 addr; // cannot be written with writeq(), must use lo_hi_writeq()
++		/* 1108/1208 */ u8 num_bufs;
++		/* 1109/1209 */ u8 num_prds;
++		/* 110a/120a */ u16 _unknown_110a;
++		/* 110c/120c */ u8 control;
++		/* 110d/120d */ u8 head;
++		/* 110e/120e */ u8 tail;
++		/* 110f/120f */ u8 control2;
++		/* 1110/1210 */ u32 status; // write to clear
++		/* 1114/1214 */ u32 _unknown_1114;
++		/* 1118/1218 */ u64 _unknown_1118_guc_addr;
++		/* 1120/1220 */ u32 _unknown_1120_guc;
++		/* 1124/1224 */ u32 _unknown_1124_guc;
++		/* 1128/1228 */ u32 unknown_init_bits; // bit 2 = guc related, bit 3 = rx1 related, bit 4 = guc related
++		/* 112c/122c */ u32 _unknown_112c;
++		/* 1130/1230 */ u64 _unknown_1130_guc_addr;
++		/* 1138/1238 */ u32 _unknown_1138_guc;
++		/* 113c/123c */ u32 _unknown_113c;
++		/* 1140/1240 */ u32 _unknown_1140_guc;
++		/* 1144/1244 */ u32 _unknown_1144[23];
++		/* 11a0/12a0 */ u32 _unknown_11a0_counters[6];
++		/* 11b8/12b8 */ u32 _unknown_11b8[18];
++	} dma_rx[2];
++};
++static_assert(sizeof(struct ithc_registers) == 0x1300);
++
++#define DEVCFG_DMA_RX_SIZE(x)          ((((x) & 0x3fff) + 1) << 6)
++#define DEVCFG_DMA_TX_SIZE(x)          (((((x) >> 14) & 0x3ff) + 1) << 6)
++
++#define DEVCFG_TOUCH_MASK              0x3f
++#define DEVCFG_TOUCH_ENABLE            BIT(0)
++#define DEVCFG_TOUCH_UNKNOWN_1         BIT(1)
++#define DEVCFG_TOUCH_UNKNOWN_2         BIT(2)
++#define DEVCFG_TOUCH_UNKNOWN_3         BIT(3)
++#define DEVCFG_TOUCH_UNKNOWN_4         BIT(4)
++#define DEVCFG_TOUCH_UNKNOWN_5         BIT(5)
++#define DEVCFG_TOUCH_UNKNOWN_6         BIT(6)
++
++#define DEVCFG_DEVICE_ID_TIC           0x43495424 // "$TIC"
++
++#define DEVCFG_SPI_MAX_FREQ(x)         (((x) >> 1) & 0xf) // high bit = use high speed mode?
++#define DEVCFG_SPI_MODE(x)             (((x) >> 6) & 3)
++#define DEVCFG_SPI_UNKNOWN_8(x)        (((x) >> 8) & 0x3f)
++#define DEVCFG_SPI_NEEDS_HEARTBEAT     BIT(20)
++#define DEVCFG_SPI_HEARTBEAT_INTERVAL  (((x) >> 21) & 7)
++#define DEVCFG_SPI_UNKNOWN_25          BIT(25)
++#define DEVCFG_SPI_UNKNOWN_26          BIT(26)
++#define DEVCFG_SPI_UNKNOWN_27          BIT(27)
++#define DEVCFG_SPI_DELAY               (((x) >> 28) & 7)
++#define DEVCFG_SPI_USE_EXT_READ_CFG    BIT(31)
++
++struct ithc_device_config {
++	u32 _unknown_00;      // 00 = 0xe0000402 (0xe0000401 after DMA_RX_CODE_RESET)
++	u32 _unknown_04;      // 04 = 0x00000000
++	u32 dma_buf_sizes;    // 08 = 0x000a00ff
++	u32 touch_cfg;        // 0c = 0x0000001c
++	u32 _unknown_10;      // 10 = 0x0000001c
++	u32 device_id;        // 14 = 0x43495424 = "$TIC"
++	u32 spi_config;       // 18 = 0xfda00a2e
++	u16 vendor_id;        // 1c = 0x045e = Microsoft Corp.
++	u16 product_id;       // 1e = 0x0c1a
++	u32 revision;         // 20 = 0x00000001
++	u32 fw_version;       // 24 = 0x05008a8b = 5.0.138.139
++	u32 _unknown_28;      // 28 = 0x00000000
++	u32 fw_mode;          // 2c = 0x00000000
++	u32 _unknown_30;      // 30 = 0x00000000
++	u32 _unknown_34;      // 34 = 0x0404035e (u8,u8,u8,u8 = version?)
++	u32 _unknown_38;      // 38 = 0x000001c0 (0x000001c1 after DMA_RX_CODE_RESET)
++	u32 _unknown_3c;      // 3c = 0x00000002
++};
++
++void bitsl(__iomem u32 *reg, u32 mask, u32 val);
++void bitsb(__iomem u8 *reg, u8 mask, u8 val);
++#define bitsl_set(reg, x) bitsl(reg, x, x)
++#define bitsb_set(reg, x) bitsb(reg, x, x)
++int waitl(struct ithc *ithc, __iomem u32 *reg, u32 mask, u32 val);
++int waitb(struct ithc *ithc, __iomem u8 *reg, u8 mask, u8 val);
++int ithc_set_spi_config(struct ithc *ithc, u8 speed, u8 mode);
++int ithc_spi_command(struct ithc *ithc, u8 command, u32 offset, u32 size, void *data);
++
+diff --git a/drivers/hid/ithc/ithc.h b/drivers/hid/ithc/ithc.h
+new file mode 100644
+index 000000000000..6a9b0d480bc1
+--- /dev/null
++++ b/drivers/hid/ithc/ithc.h
+@@ -0,0 +1,60 @@
++#include <linux/module.h>
++#include <linux/input.h>
++#include <linux/hid.h>
++#include <linux/dma-mapping.h>
++#include <linux/highmem.h>
++#include <linux/pci.h>
++#include <linux/io-64-nonatomic-lo-hi.h>
++#include <linux/iopoll.h>
++#include <linux/delay.h>
++#include <linux/kthread.h>
++#include <linux/miscdevice.h>
++#include <linux/debugfs.h>
++#include <linux/poll.h>
++#include <linux/timer.h>
++#include <linux/pm_qos.h>
++
++#define DEVNAME "ithc"
++#define DEVFULLNAME "Intel Touch Host Controller"
++
++#undef pr_fmt
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#define CHECK(fn, ...) ({ int r = fn(__VA_ARGS__); if (r < 0) pci_err(ithc->pci, "%s: %s failed with %i\n", __func__, #fn, r); r; })
++#define CHECK_RET(...) do { int r = CHECK(__VA_ARGS__); if (r < 0) return r; } while(0)
++
++#define NUM_RX_BUF 16
++
++struct ithc;
++
++#include "ithc-regs.h"
++#include "ithc-dma.h"
++
++struct ithc {
++	char phys[32];
++	struct pci_dev *pci;
++	int irq;
++	struct task_struct *poll_thread;
++	struct pm_qos_request activity_qos;
++	struct timer_list activity_timer;
++
++	struct hid_device *hid;
++	bool hid_parse_done;
++	wait_queue_head_t wait_hid_parse;
++	wait_queue_head_t wait_hid_get_feature;
++	struct mutex hid_get_feature_mutex;
++	void *hid_get_feature_buf;
++	size_t hid_get_feature_size;
++
++	struct ithc_registers __iomem *regs;
++	struct ithc_registers *prev_regs; // for debugging
++	struct ithc_device_config config;
++	struct ithc_dma_rx dma_rx[2];
++	struct ithc_dma_tx dma_tx;
++};
++
++int ithc_reset(struct ithc *ithc);
++void ithc_set_active(struct ithc *ithc);
++int ithc_debug_init(struct ithc *ithc);
++void ithc_log_regs(struct ithc *ithc);
++
+-- 
+2.39.1
+

patches/6.1/0005-surface-sam.patch → patches/6.1/0006-surface-sam.patch

@@ -1,4 +1,4 @@
-From d290ffa5b652cbbf0f9d89fa284d5542286a285e Mon Sep 17 00:00:00 2001
+From 5c5fa1a9414a4b1ae16bc7af5c0940b53257237e Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
 Date: Fri, 2 Dec 2022 23:33:20 +0100
 Subject: [PATCH] platform/surface: aggregator: Improve documentation and
@@ -289,7 +289,7 @@ index 45501b6e54e8..5c4ae1a26183 100644
 -- 
 2.39.1
 
-From 9200b29dfce5ec28dba74373a4038c63b6e6feac Mon Sep 17 00:00:00 2001
+From 13cf1fcdfafe787ff673f96e3fa8ce196c5c466e Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
 Date: Fri, 2 Dec 2022 23:33:21 +0100
 Subject: [PATCH] platform/surface: aggregator: Add target and source IDs to
@@ -486,7 +486,7 @@ index 2a2c17771d01..55cc61bba1da 100644
 -- 
 2.39.1
 
-From 9279c3f3d6b2ae3efc9bf350837864df421b3c82 Mon Sep 17 00:00:00 2001
+From 7558c159d840b408065804b66d740ff52fd3825c Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
 Date: Fri, 2 Dec 2022 23:33:22 +0100
 Subject: [PATCH] platform/surface: aggregator_hub: Use target-ID enum instead
@@ -529,7 +529,7 @@ index 43061514be38..62f27cdb6ca8 100644
 -- 
 2.39.1
 
-From 3e63472ff80d775dc2bd204125371436f99c6b13 Mon Sep 17 00:00:00 2001
+From b57521c09754e523fff0b1fce8a351d061380377 Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
 Date: Fri, 2 Dec 2022 23:33:23 +0100
 Subject: [PATCH] platform/surface: aggregator_tabletsw: Use target-ID enum
@@ -581,7 +581,7 @@ index 27d95a6a7851..bd8cd453c393 100644
 -- 
 2.39.1
 
-From 5e27e9534629b3867f6512b1d49f7d6622f538e5 Mon Sep 17 00:00:00 2001
+From ac38b3ca24a7a17ec55fc364c992c06cdad8011c Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
 Date: Fri, 2 Dec 2022 23:33:24 +0100
 Subject: [PATCH] platform/surface: dtx: Use target-ID enum instead of
@@ -679,7 +679,7 @@ index ed36944467f9..0de76a784a35 100644
 -- 
 2.39.1
 
-From ecf46d8a50f1ae2e66f1ae6951a9b28d73abca4e Mon Sep 17 00:00:00 2001
+From a3658f509048591fcce462c4fa7a69030f5f2a2f Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
 Date: Fri, 2 Dec 2022 23:33:26 +0100
 Subject: [PATCH] platform/surface: aggregator: Enforce use of target-ID enum
@@ -915,7 +915,7 @@ index 46c45d1b6368..4da20b7a0ee5 100644
 -- 
 2.39.1
 
-From 780e33c35efd2ae18ddeacf33dc4ed60f1d0975a Mon Sep 17 00:00:00 2001
+From ce70c31c9612629949d933d5ba4086309a7b940f Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
 Date: Fri, 2 Dec 2022 23:33:27 +0100
 Subject: [PATCH] platform/surface: aggregator_registry: Fix target-ID of
@@ -970,7 +970,7 @@ index 023f126121d7..296f72d52e6a 100644
 -- 
 2.39.1
 
-From 111516425f2a2cd0eef9265cfb70de21e97e7887 Mon Sep 17 00:00:00 2001
+From d48e58e62f0cf34197267f1905b7f98259ca5a6e Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
 Date: Tue, 20 Dec 2022 18:56:08 +0100
 Subject: [PATCH] platform/surface: aggregator: Rename top-level request
@@ -1517,7 +1517,7 @@ index 4da20b7a0ee5..1545e5567b15 100644
 -- 
 2.39.1
 
-From 4f6ea2783dac3c33d2b20d5d640a37d446a78f3e Mon Sep 17 00:00:00 2001
+From 60580e724335386ff17b69a9aaf4ef33866ce04f Mon Sep 17 00:00:00 2001
 From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
 Date: Wed, 18 Jan 2023 11:38:23 +0200
 Subject: [PATCH] platform/surface: Switch to use acpi_evaluate_dsm_typed()

patches/6.1/0006-surface-sam-over-hid.patch → patches/6.1/0007-surface-sam-over-hid.patch

@@ -1,4 +1,4 @@
-From 530b9f4a9877371ee7979b6c7e5736f07a88dbc5 Mon Sep 17 00:00:00 2001
+From 38dfeaed0a26f4fffa70427d5293df0d9a98df83 Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
 Date: Sat, 25 Jul 2020 17:19:53 +0200
 Subject: [PATCH] i2c: acpi: Implement RawBytes read access
@@ -110,7 +110,7 @@ index 4dd777cc0c89..b2338618163a 100644
 -- 
 2.39.1
 
-From 289d008855c4a025e3a38a79f540417421b2b4fc Mon Sep 17 00:00:00 2001
+From e24522a4e868a4c66f428692b49397e76e826936 Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
 Date: Sat, 13 Feb 2021 16:41:18 +0100
 Subject: [PATCH] platform/surface: Add driver for Surface Book 1 dGPU switch

patches/6.1/0007-surface-button.patch → patches/6.1/0008-surface-button.patch

@@ -1,4 +1,4 @@
-From 6c110e9561690e917329edf70cfb3cbdb821061b Mon Sep 17 00:00:00 2001
+From befa0b86802aa90fcc2110ce98e15541aba3ecd0 Mon Sep 17 00:00:00 2001
 From: Sachi King <nakato@nakato.io>
 Date: Tue, 5 Oct 2021 00:05:09 +1100
 Subject: [PATCH] Input: soc_button_array - support AMD variant Surface devices
@@ -75,7 +75,7 @@ index 09489380afda..0f02411a60f1 100644
 -- 
 2.39.1
 
-From 289c3004aa7582e0c4041fb12d433b277e0955ae Mon Sep 17 00:00:00 2001
+From 27cc4fc20daad7b4eed075f4de363c9e0b9e8b7b Mon Sep 17 00:00:00 2001
 From: Sachi King <nakato@nakato.io>
 Date: Tue, 5 Oct 2021 00:22:57 +1100
 Subject: [PATCH] platform/surface: surfacepro3_button: don't load on amd

patches/6.1/0008-surface-typecover.patch → patches/6.1/0009-surface-typecover.patch

@@ -1,4 +1,4 @@
-From 0fea1fb65ab4117880dc921c3987c69b73d2e3bb Mon Sep 17 00:00:00 2001
+From 508af47129c868010d1b5508be0aa98bae95ce41 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jonas=20Dre=C3=9Fler?= <verdre@v0yd.nl>
 Date: Thu, 5 Nov 2020 13:09:45 +0100
 Subject: [PATCH] hid/multitouch: Turn off Type Cover keyboard backlight when
@@ -231,7 +231,7 @@ index 372cbdd223e0..fe849df6a948 100644
 -- 
 2.39.1
 
-From b9590f3c749aa5b5ef0af36a03d653cc0a3493c4 Mon Sep 17 00:00:00 2001
+From be35cf4ec5d2a0bd1a11c4539f38bae8e8bcd0da Mon Sep 17 00:00:00 2001
 From: PJungkamp <p.jungkamp@gmail.com>
 Date: Fri, 25 Feb 2022 12:04:25 +0100
 Subject: [PATCH] hid/multitouch: Add support for surface pro type cover tablet

patches/6.1/0009-cameras.patch → patches/6.1/0010-cameras.patch

@@ -1,4 +1,4 @@
-From bab23929e82b78566d2fdac13616155f8fb42538 Mon Sep 17 00:00:00 2001
+From 64636abdc42f29ed3094d75fd8089f57dbae84df Mon Sep 17 00:00:00 2001
 From: Hans de Goede <hdegoede@redhat.com>
 Date: Sun, 10 Oct 2021 20:56:57 +0200
 Subject: [PATCH] ACPI: delay enumeration of devices with a _DEP pointing to an
@@ -74,7 +74,7 @@ index dbfa58e799e2..ccbd3f8b523e 100644
 -- 
 2.39.1
 
-From f4c96c247fb7d0c853d7ff996e673cfba4423891 Mon Sep 17 00:00:00 2001
+From 0cafdc686d5a04558a617330b337fca92980cf74 Mon Sep 17 00:00:00 2001
 From: zouxiaoh <xiaohong.zou@intel.com>
 Date: Fri, 25 Jun 2021 08:52:59 +0800
 Subject: [PATCH] iommu: intel-ipu: use IOMMU passthrough mode for Intel IPUs
@@ -191,7 +191,7 @@ index 408c321b929a..6e58effbe12b 100644
 -- 
 2.39.1
 
-From f89ff4f5168eadf316680bc1b392f8556e4e1576 Mon Sep 17 00:00:00 2001
+From 9a06c70b9885d739c3764ffa59e67ec9cd2fc5fa Mon Sep 17 00:00:00 2001
 From: Daniel Scally <djrscally@gmail.com>
 Date: Sun, 10 Oct 2021 20:57:02 +0200
 Subject: [PATCH] platform/x86: int3472: Enable I2c daisy chain
@@ -228,7 +228,7 @@ index 5b8d1a9620a5..6a0ff035cf20 100644
 -- 
 2.39.1
 
-From af9dd99da0373d9002e94583832ecaf416e86016 Mon Sep 17 00:00:00 2001
+From caffe75b60e8af020d64396acb89cdcd28dbd169 Mon Sep 17 00:00:00 2001
 From: Daniel Scally <djrscally@gmail.com>
 Date: Thu, 28 Oct 2021 21:55:16 +0100
 Subject: [PATCH] media: i2c: Add driver for DW9719 VCM
@@ -732,7 +732,7 @@ index 000000000000..180b04d2a6b3
 -- 
 2.39.1
 
-From 9cda3dd05371ba1b2fec7ccf28784dea5f9851bb Mon Sep 17 00:00:00 2001
+From 2d07ffa30cb8a59392ddd1ab3fb7eb3aa4b8e6b9 Mon Sep 17 00:00:00 2001
 From: Daniel Scally <djrscally@gmail.com>
 Date: Wed, 4 May 2022 23:21:45 +0100
 Subject: [PATCH] media: ipu3-cio2: Move functionality from .complete() to
@@ -847,7 +847,7 @@ index 390bd5ea3472..76339fb842bf 100644
 -- 
 2.39.1
 
-From f0db2c63da4fd2cdbf63a19c16f8f7935518fcdf Mon Sep 17 00:00:00 2001
+From 55a2a464abfbec441776437cd32022ffa83e3861 Mon Sep 17 00:00:00 2001
 From: Daniel Scally <djrscally@gmail.com>
 Date: Thu, 2 Jun 2022 22:15:56 +0100
 Subject: [PATCH] media: ipu3-cio2: Re-add .complete() to ipu3-cio2
@@ -890,7 +890,7 @@ index 76339fb842bf..eb7aa269ec2b 100644
 -- 
 2.39.1
 
-From 4770fef6949ae8bebdce271ce33f0269ba4c13a1 Mon Sep 17 00:00:00 2001
+From 097ca9da260a84635b794201337a531084338ebd Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
 Date: Fri, 15 Jul 2022 23:48:00 +0200
 Subject: [PATCH] drivers/media/i2c: Fix DW9719 dependencies

patches/6.1/0010-amd-gpio.patch → patches/6.1/0011-amd-gpio.patch

@@ -1,4 +1,4 @@
-From 74c8d421521a5a1699b479cdcab3c58432b776dc Mon Sep 17 00:00:00 2001
+From 956b57f8f337df7fd749cc2237be8f8175197927 Mon Sep 17 00:00:00 2001
 From: Sachi King <nakato@nakato.io>
 Date: Sat, 29 May 2021 17:47:38 +1000
 Subject: [PATCH] ACPI: Add quirk for Surface Laptop 4 AMD missing irq 7
@@ -65,7 +65,7 @@ index 907cc98b1938..0116d27b29ea 100644
 -- 
 2.39.1
 
-From 0911f1d9e188e47e57819f667320cd865baef420 Mon Sep 17 00:00:00 2001
+From 1dee97b90576853578e36fe5b55615f5428d7b6b Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
 Date: Thu, 3 Jun 2021 14:04:26 +0200
 Subject: [PATCH] ACPI: Add AMD 13" Surface Laptop 4 model to irq 7 override

patches/6.1/0011-rtc.patch → patches/6.1/0012-rtc.patch

@@ -1,4 +1,4 @@
-From a5f2e7f9d7b7f6e831e229558f6fd39a6d82cf52 Mon Sep 17 00:00:00 2001
+From 5e367b9e5bb01b82c19fe5de50aa5576f2daaf2a Mon Sep 17 00:00:00 2001
 From: "Bart Groeneveld | GPX Solutions B.V" <bart@gpxbv.nl>
 Date: Mon, 5 Dec 2022 16:08:46 +0100
 Subject: [PATCH] acpi: allow usage of acpi_tad on HW-reduced platforms