path: root/SOURCES/linux-surface.patch

From 9916eca4bc0ff2ae5dc36de98b2377e5d839bc41 Mon Sep 17 00:00:00 2001
From: GloriousEggroll <gloriouseggroll@gmail.com>
Date: Wed, 30 Aug 2023 20:24:03 -0600
Subject: [PATCH 05/18] linux-surface

---
 MAINTAINERS                                   |   7 +
 arch/x86/kernel/acpi/boot.c                   |  24 +
 drivers/acpi/acpi_tad.c                       |  35 +-
 drivers/acpi/scan.c                           |   3 +
 drivers/bluetooth/btusb.c                     |  15 +
 drivers/hid/Kconfig                           |   4 +
 drivers/hid/Makefile                          |   3 +
 drivers/hid/hid-multitouch.c                  | 196 ++++++-
 drivers/hid/ipts/Kconfig                      |  14 +
 drivers/hid/ipts/Makefile                     |  16 +
 drivers/hid/ipts/cmd.c                        |  61 ++
 drivers/hid/ipts/cmd.h                        |  60 ++
 drivers/hid/ipts/context.h                    |  52 ++
 drivers/hid/ipts/control.c                    | 486 ++++++++++++++++
 drivers/hid/ipts/control.h                    | 126 +++++
 drivers/hid/ipts/desc.h                       |  80 +++
 drivers/hid/ipts/eds1.c                       | 103 ++++
 drivers/hid/ipts/eds1.h                       |  35 ++
 drivers/hid/ipts/eds2.c                       | 144 +++++
 drivers/hid/ipts/eds2.h                       |  35 ++
 drivers/hid/ipts/hid.c                        | 225 ++++++++
 drivers/hid/ipts/hid.h                        |  24 +
 drivers/hid/ipts/main.c                       | 126 +++++
 drivers/hid/ipts/mei.c                        | 188 ++++++
 drivers/hid/ipts/mei.h                        |  66 +++
 drivers/hid/ipts/receiver.c                   | 250 ++++++++
 drivers/hid/ipts/receiver.h                   |  16 +
 drivers/hid/ipts/resources.c                  | 131 +++++
 drivers/hid/ipts/resources.h                  |  41 ++
 drivers/hid/ipts/spec-data.h                  | 100 ++++
 drivers/hid/ipts/spec-device.h                | 290 ++++++++++
 drivers/hid/ipts/spec-hid.h                   |  34 ++
 drivers/hid/ipts/thread.c                     |  84 +++
 drivers/hid/ipts/thread.h                     |  59 ++
 drivers/hid/ithc/Kbuild                       |   6 +
 drivers/hid/ithc/Kconfig                      |  12 +
 drivers/hid/ithc/ithc-debug.c                 |  96 ++++
 drivers/hid/ithc/ithc-dma.c                   | 258 +++++++++
 drivers/hid/ithc/ithc-dma.h                   |  67 +++
 drivers/hid/ithc/ithc-main.c                  | 534 ++++++++++++++++++
 drivers/hid/ithc/ithc-regs.c                  |  64 +++
 drivers/hid/ithc/ithc-regs.h                  | 186 ++++++
 drivers/hid/ithc/ithc.h                       |  60 ++
 drivers/i2c/i2c-core-acpi.c                   |  35 ++
 drivers/input/misc/soc_button_array.c         |  33 +-
 drivers/iommu/intel/iommu.c                   |  54 ++
 drivers/iommu/intel/irq_remapping.c           |  16 +
 drivers/leds/Kconfig                          |  12 +
 drivers/leds/Makefile                         |   1 +
 drivers/leds/leds-tps68470.c                  | 185 ++++++
 drivers/media/i2c/Kconfig                     |  11 +
 drivers/media/i2c/Makefile                    |   1 +
 drivers/media/i2c/dw9719.c                    | 425 ++++++++++++++
 drivers/media/i2c/ov7251.c                    |   4 +-
 drivers/media/pci/intel/ipu3/ipu3-cio2-main.c |  52 +-
 drivers/media/v4l2-core/v4l2-async.c          |   4 +
 drivers/media/v4l2-core/v4l2-fwnode.c         |   4 -
 drivers/misc/mei/hw-me-regs.h                 |   1 +
 drivers/misc/mei/pci-me.c                     |   1 +
 drivers/net/wireless/ath/ath10k/core.c        |  58 ++
 drivers/net/wireless/marvell/mwifiex/pcie.c   |  19 +
 .../wireless/marvell/mwifiex/pcie_quirks.c    |  37 +-
 .../wireless/marvell/mwifiex/pcie_quirks.h    |   2 +
 drivers/pci/pci-driver.c                      |   3 +
 drivers/pci/quirks.c                          |  36 ++
 drivers/platform/surface/Kconfig              |   7 +
 drivers/platform/surface/Makefile             |   1 +
 drivers/platform/surface/surface3-wmi.c       |   7 +
 drivers/platform/surface/surface_gpe.c        |  17 +
 .../surface/surfacebook1_dgpu_switch.c        | 162 ++++++
 drivers/platform/surface/surfacepro3_button.c |  30 +-
 drivers/platform/x86/intel/int3472/discrete.c |  14 +
 drivers/platform/x86/intel/int3472/tps68470.c |  12 +-
 drivers/usb/core/quirks.c                     |   3 +
 include/linux/mfd/tps68470.h                  |   5 +
 include/linux/pci.h                           |   1 +
 sound/soc/codecs/rt5645.c                     |   9 +
 .../intel/common/soc-acpi-intel-cht-match.c   |   8 +
 78 files changed, 5579 insertions(+), 107 deletions(-)
 create mode 100644 drivers/hid/ipts/Kconfig
 create mode 100644 drivers/hid/ipts/Makefile
 create mode 100644 drivers/hid/ipts/cmd.c
 create mode 100644 drivers/hid/ipts/cmd.h
 create mode 100644 drivers/hid/ipts/context.h
 create mode 100644 drivers/hid/ipts/control.c
 create mode 100644 drivers/hid/ipts/control.h
 create mode 100644 drivers/hid/ipts/desc.h
 create mode 100644 drivers/hid/ipts/eds1.c
 create mode 100644 drivers/hid/ipts/eds1.h
 create mode 100644 drivers/hid/ipts/eds2.c
 create mode 100644 drivers/hid/ipts/eds2.h
 create mode 100644 drivers/hid/ipts/hid.c
 create mode 100644 drivers/hid/ipts/hid.h
 create mode 100644 drivers/hid/ipts/main.c
 create mode 100644 drivers/hid/ipts/mei.c
 create mode 100644 drivers/hid/ipts/mei.h
 create mode 100644 drivers/hid/ipts/receiver.c
 create mode 100644 drivers/hid/ipts/receiver.h
 create mode 100644 drivers/hid/ipts/resources.c
 create mode 100644 drivers/hid/ipts/resources.h
 create mode 100644 drivers/hid/ipts/spec-data.h
 create mode 100644 drivers/hid/ipts/spec-device.h
 create mode 100644 drivers/hid/ipts/spec-hid.h
 create mode 100644 drivers/hid/ipts/thread.c
 create mode 100644 drivers/hid/ipts/thread.h
 create mode 100644 drivers/hid/ithc/Kbuild
 create mode 100644 drivers/hid/ithc/Kconfig
 create mode 100644 drivers/hid/ithc/ithc-debug.c
 create mode 100644 drivers/hid/ithc/ithc-dma.c
 create mode 100644 drivers/hid/ithc/ithc-dma.h
 create mode 100644 drivers/hid/ithc/ithc-main.c
 create mode 100644 drivers/hid/ithc/ithc-regs.c
 create mode 100644 drivers/hid/ithc/ithc-regs.h
 create mode 100644 drivers/hid/ithc/ithc.h
 create mode 100644 drivers/leds/leds-tps68470.c
 create mode 100644 drivers/media/i2c/dw9719.c
 create mode 100644 drivers/platform/surface/surfacebook1_dgpu_switch.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 4cc6bf79f..439cf523b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -6251,6 +6251,13 @@ T:	git git://linuxtv.org/media_tree.git
 F:	Documentation/devicetree/bindings/media/i2c/dongwoon,dw9714.yaml
 F:	drivers/media/i2c/dw9714.c
 
+DONGWOON DW9719 LENS VOICE COIL DRIVER
+M:	Daniel Scally <djrscally@gmail.com>
+L:	linux-media@vger.kernel.org
+S:	Maintained
+T:	git git://linuxtv.org/media_tree.git
+F:	drivers/media/i2c/dw9719.c
+
 DONGWOON DW9768 LENS VOICE COIL DRIVER
 M:	Dongchun Zhu <dongchun.zhu@mediatek.com>
 L:	linux-media@vger.kernel.org
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 53369c577..a7d40015e 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -22,6 +22,7 @@
 #include <linux/efi-bgrt.h>
 #include <linux/serial_core.h>
 #include <linux/pgtable.h>
+#include <linux/dmi.h>
 
 #include <asm/e820/api.h>
 #include <asm/irqdomain.h>
@@ -1256,6 +1257,24 @@ static void __init mp_config_acpi_legacy_irqs(void)
 	}
 }
 
+static const struct dmi_system_id surface_quirk[] __initconst = {
+	{
+		.ident = "Microsoft Surface Laptop 4 (AMD 15\")",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+			DMI_MATCH(DMI_PRODUCT_SKU, "Surface_Laptop_4_1952:1953")
+		},
+	},
+	{
+		.ident = "Microsoft Surface Laptop 4 (AMD 13\")",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+			DMI_MATCH(DMI_PRODUCT_SKU, "Surface_Laptop_4_1958:1959")
+		},
+	},
+	{}
+};
+
 /*
  * Parse IOAPIC related entries in MADT
  * returns 0 on success, < 0 on error
@@ -1311,6 +1330,11 @@ static int __init acpi_parse_madt_ioapic_entries(void)
 		acpi_sci_ioapic_setup(acpi_gbl_FADT.sci_interrupt, 0, 0,
 				      acpi_gbl_FADT.sci_interrupt);
 
+	if (dmi_check_system(surface_quirk)) {
+		pr_warn("Surface hack: Override irq 7\n");
+		mp_override_legacy_irq(7, 3, 3, 7);
+	}
+
 	/* Fill in identity legacy mappings where no override */
 	mp_config_acpi_legacy_irqs();
 
diff --git a/drivers/acpi/acpi_tad.c b/drivers/acpi/acpi_tad.c
index e9b8e8305..944276934 100644
--- a/drivers/acpi/acpi_tad.c
+++ b/drivers/acpi/acpi_tad.c
@@ -432,6 +432,14 @@ static ssize_t caps_show(struct device *dev, struct device_attribute *attr,
 
 static DEVICE_ATTR_RO(caps);
 
+static struct attribute *acpi_tad_attrs[] = {
+	&dev_attr_caps.attr,
+	NULL,
+};
+static const struct attribute_group acpi_tad_attr_group = {
+	.attrs	= acpi_tad_attrs,
+};
+
 static ssize_t ac_alarm_store(struct device *dev, struct device_attribute *attr,
 			      const char *buf, size_t count)
 {
@@ -480,15 +488,14 @@ static ssize_t ac_status_show(struct device *dev, struct device_attribute *attr,
 
 static DEVICE_ATTR_RW(ac_status);
 
-static struct attribute *acpi_tad_attrs[] = {
-	&dev_attr_caps.attr,
+static struct attribute *acpi_tad_ac_attrs[] = {
 	&dev_attr_ac_alarm.attr,
 	&dev_attr_ac_policy.attr,
 	&dev_attr_ac_status.attr,
 	NULL,
 };
-static const struct attribute_group acpi_tad_attr_group = {
-	.attrs	= acpi_tad_attrs,
+static const struct attribute_group acpi_tad_ac_attr_group = {
+	.attrs	= acpi_tad_ac_attrs,
 };
 
 static ssize_t dc_alarm_store(struct device *dev, struct device_attribute *attr,
@@ -563,13 +570,18 @@ static int acpi_tad_remove(struct platform_device *pdev)
 
 	pm_runtime_get_sync(dev);
 
+	if (dd->capabilities & ACPI_TAD_AC_WAKE)
+		sysfs_remove_group(&dev->kobj, &acpi_tad_ac_attr_group);
+
 	if (dd->capabilities & ACPI_TAD_DC_WAKE)
 		sysfs_remove_group(&dev->kobj, &acpi_tad_dc_attr_group);
 
 	sysfs_remove_group(&dev->kobj, &acpi_tad_attr_group);
 
-	acpi_tad_disable_timer(dev, ACPI_TAD_AC_TIMER);
-	acpi_tad_clear_status(dev, ACPI_TAD_AC_TIMER);
+	if (dd->capabilities & ACPI_TAD_AC_WAKE) {
+		acpi_tad_disable_timer(dev, ACPI_TAD_AC_TIMER);
+		acpi_tad_clear_status(dev, ACPI_TAD_AC_TIMER);
+	}
 	if (dd->capabilities & ACPI_TAD_DC_WAKE) {
 		acpi_tad_disable_timer(dev, ACPI_TAD_DC_TIMER);
 		acpi_tad_clear_status(dev, ACPI_TAD_DC_TIMER);
@@ -604,11 +616,6 @@ static int acpi_tad_probe(struct platform_device *pdev)
 		return -ENODEV;
 	}
 
-	if (!acpi_has_method(handle, "_PRW")) {
-		dev_info(dev, "Missing _PRW\n");
-		return -ENODEV;
-	}
-
 	dd = devm_kzalloc(dev, sizeof(*dd), GFP_KERNEL);
 	if (!dd)
 		return -ENOMEM;
@@ -637,6 +644,12 @@ static int acpi_tad_probe(struct platform_device *pdev)
 	if (ret)
 		goto fail;
 
+	if (caps & ACPI_TAD_AC_WAKE) {
+		ret = sysfs_create_group(&dev->kobj, &acpi_tad_ac_attr_group);
+		if (ret)
+			goto fail;
+	}
+
 	if (caps & ACPI_TAD_DC_WAKE) {
 		ret = sysfs_create_group(&dev->kobj, &acpi_tad_dc_attr_group);
 		if (ret)
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 7e9de6e3e..50ceddfe7 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -2114,6 +2114,9 @@ static acpi_status acpi_bus_check_add_2(acpi_handle handle, u32 lvl_not_used,
 
 static void acpi_default_enumeration(struct acpi_device *device)
 {
+	if (!acpi_dev_ready_for_enumeration(device))
+		return;
+
 	/*
 	 * Do not enumerate devices with enumeration_by_parent flag set as
 	 * they will be enumerated by their respective parents.
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 764d176e9..cd6ee1f0f 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -65,6 +65,7 @@ static struct usb_driver btusb_driver;
 #define BTUSB_INTEL_BROKEN_INITIAL_NCMD BIT(25)
 #define BTUSB_INTEL_NO_WBS_SUPPORT	BIT(26)
 #define BTUSB_ACTIONS_SEMI		BIT(27)
+#define BTUSB_LOWER_LESCAN_INTERVAL	BIT(28)
 
 static const struct usb_device_id btusb_table[] = {
 	/* Generic Bluetooth USB device */
@@ -468,6 +469,7 @@ static const struct usb_device_id blacklist_table[] = {
 	{ USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
 	{ USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
 	{ USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL },
+	{ USB_DEVICE(0x1286, 0x204c), .driver_info = BTUSB_LOWER_LESCAN_INTERVAL },
 
 	/* Intel Bluetooth devices */
 	{ USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_COMBINED },
@@ -4302,6 +4304,19 @@ static int btusb_probe(struct usb_interface *intf,
 	if (id->driver_info & BTUSB_MARVELL)
 		hdev->set_bdaddr = btusb_set_bdaddr_marvell;
 
+	/* The Marvell 88W8897 combined wifi and bluetooth card is known for
+	 * very bad bt+wifi coexisting performance.
+	 *
+	 * Decrease the passive BT Low Energy scan interval a bit
+	 * (0x0190 * 0.625 msec = 250 msec) and make the scan window shorter
+	 * (0x000a * 0,625 msec = 6.25 msec). This allows for significantly
+	 * higher wifi throughput while passively scanning for BT LE devices.
+	 */
+	if (id->driver_info & BTUSB_LOWER_LESCAN_INTERVAL) {
+		hdev->le_scan_interval = 0x0190;
+		hdev->le_scan_window = 0x000a;
+	}
+
 	if (IS_ENABLED(CONFIG_BT_HCIBTUSB_MTK) &&
 	    (id->driver_info & BTUSB_MEDIATEK)) {
 		hdev->setup = btusb_mtk_setup;
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index e11c1c803..0b58bd30a 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -1334,4 +1334,8 @@ source "drivers/hid/amd-sfh-hid/Kconfig"
 
 source "drivers/hid/surface-hid/Kconfig"
 
+source "drivers/hid/ipts/Kconfig"
+
+source "drivers/hid/ithc/Kconfig"
+
 endif # HID_SUPPORT
diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
index 7a9e16015..656a0783c 100644
--- a/drivers/hid/Makefile
+++ b/drivers/hid/Makefile
@@ -168,3 +168,6 @@ obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER)	+= intel-ish-hid/
 obj-$(CONFIG_AMD_SFH_HID)       += amd-sfh-hid/
 
 obj-$(CONFIG_SURFACE_HID_CORE)  += surface-hid/
+
+obj-$(CONFIG_HID_IPTS)          += ipts/
+obj-$(CONFIG_HID_ITHC)          += ithc/
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index e31be0cb8..508a250ff 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -34,7 +34,10 @@
 #include <linux/device.h>
 #include <linux/hid.h>
 #include <linux/module.h>
+#include <linux/pm_runtime.h>
 #include <linux/slab.h>
+#include <linux/suspend.h>
+#include <linux/usb.h>
 #include <linux/input/mt.h>
 #include <linux/jiffies.h>
 #include <linux/string.h>
@@ -47,6 +50,7 @@ MODULE_DESCRIPTION("HID multitouch panels");
 MODULE_LICENSE("GPL");
 
 #include "hid-ids.h"
+#include "usbhid/usbhid.h"
 
 /* quirks to control the device */
 #define MT_QUIRK_NOT_SEEN_MEANS_UP	BIT(0)
@@ -72,12 +76,18 @@ MODULE_LICENSE("GPL");
 #define MT_QUIRK_FORCE_MULTI_INPUT	BIT(20)
 #define MT_QUIRK_DISABLE_WAKEUP		BIT(21)
 #define MT_QUIRK_ORIENTATION_INVERT	BIT(22)
+#define MT_QUIRK_HAS_TYPE_COVER_BACKLIGHT	BIT(23)
+#define MT_QUIRK_HAS_TYPE_COVER_TABLET_MODE_SWITCH	BIT(24)
 
 #define MT_INPUTMODE_TOUCHSCREEN	0x02
 #define MT_INPUTMODE_TOUCHPAD		0x03
 
 #define MT_BUTTONTYPE_CLICKPAD		0
 
+#define MS_TYPE_COVER_FEATURE_REPORT_USAGE	0xff050086
+#define MS_TYPE_COVER_TABLET_MODE_SWITCH_USAGE	0xff050072
+#define MS_TYPE_COVER_APPLICATION	0xff050050
+
 enum latency_mode {
 	HID_LATENCY_NORMAL = 0,
 	HID_LATENCY_HIGH = 1,
@@ -169,6 +179,8 @@ struct mt_device {
 
 	struct list_head applications;
 	struct list_head reports;
+
+	struct notifier_block pm_notifier;
 };
 
 static void mt_post_parse_default_settings(struct mt_device *td,
@@ -213,6 +225,7 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app);
 #define MT_CLS_GOOGLE				0x0111
 #define MT_CLS_RAZER_BLADE_STEALTH		0x0112
 #define MT_CLS_SMART_TECH			0x0113
+#define MT_CLS_WIN_8_MS_SURFACE_TYPE_COVER	0x0114
 
 #define MT_DEFAULT_MAXCONTACT	10
 #define MT_MAX_MAXCONTACT	250
@@ -397,6 +410,17 @@ static const struct mt_class mt_classes[] = {
 			MT_QUIRK_CONTACT_CNT_ACCURATE |
 			MT_QUIRK_SEPARATE_APP_REPORT,
 	},
+	{ .name = MT_CLS_WIN_8_MS_SURFACE_TYPE_COVER,
+		.quirks = MT_QUIRK_HAS_TYPE_COVER_BACKLIGHT |
+			MT_QUIRK_HAS_TYPE_COVER_TABLET_MODE_SWITCH |
+			MT_QUIRK_ALWAYS_VALID |
+			MT_QUIRK_IGNORE_DUPLICATES |
+			MT_QUIRK_HOVERING |
+			MT_QUIRK_CONTACT_CNT_ACCURATE |
+			MT_QUIRK_STICKY_FINGERS |
+			MT_QUIRK_WIN8_PTP_BUTTONS,
+		.export_all_inputs = true
+	},
 	{ }
 };
 
@@ -1370,6 +1394,9 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
 	    field->application != HID_CP_CONSUMER_CONTROL &&
 	    field->application != HID_GD_WIRELESS_RADIO_CTLS &&
 	    field->application != HID_GD_SYSTEM_MULTIAXIS &&
+	    !(field->application == MS_TYPE_COVER_APPLICATION &&
+	      application->quirks & MT_QUIRK_HAS_TYPE_COVER_TABLET_MODE_SWITCH &&
+	      usage->hid == MS_TYPE_COVER_TABLET_MODE_SWITCH_USAGE) &&
 	    !(field->application == HID_VD_ASUS_CUSTOM_MEDIA_KEYS &&
 	      application->quirks & MT_QUIRK_ASUS_CUSTOM_UP))
 		return -1;
@@ -1397,6 +1424,21 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
 		return 1;
 	}
 
+	/*
+	 * The Microsoft Surface Pro Typecover has a non-standard HID
+	 * tablet mode switch on a vendor specific usage page with vendor
+	 * specific usage.
+	 */
+	if (field->application == MS_TYPE_COVER_APPLICATION &&
+	    application->quirks & MT_QUIRK_HAS_TYPE_COVER_TABLET_MODE_SWITCH &&
+	    usage->hid == MS_TYPE_COVER_TABLET_MODE_SWITCH_USAGE) {
+		usage->type = EV_SW;
+		usage->code = SW_TABLET_MODE;
+		*max = SW_MAX;
+		*bit = hi->input->swbit;
+		return 1;
+	}
+
 	if (rdata->is_mt_collection)
 		return mt_touch_input_mapping(hdev, hi, field, usage, bit, max,
 					      application);
@@ -1418,6 +1460,7 @@ static int mt_input_mapped(struct hid_device *hdev, struct hid_input *hi,
 {
 	struct mt_device *td = hid_get_drvdata(hdev);
 	struct mt_report_data *rdata;
+	struct input_dev *input;
 
 	rdata = mt_find_report_data(td, field->report);
 	if (rdata && rdata->is_mt_collection) {
@@ -1425,6 +1468,19 @@ static int mt_input_mapped(struct hid_device *hdev, struct hid_input *hi,
 		return -1;
 	}
 
+	/*
+	 * We own an input device which acts as a tablet mode switch for
+	 * the Surface Pro Typecover.
+	 */
+	if (field->application == MS_TYPE_COVER_APPLICATION &&
+	    rdata->application->quirks & MT_QUIRK_HAS_TYPE_COVER_TABLET_MODE_SWITCH &&
+	    usage->hid == MS_TYPE_COVER_TABLET_MODE_SWITCH_USAGE) {
+		input = hi->input;
+		input_set_capability(input, EV_SW, SW_TABLET_MODE);
+		input_report_switch(input, SW_TABLET_MODE, 0);
+		return -1;
+	}
+
 	/* let hid-core decide for the others */
 	return 0;
 }
@@ -1434,11 +1490,21 @@ static int mt_event(struct hid_device *hid, struct hid_field *field,
 {
 	struct mt_device *td = hid_get_drvdata(hid);
 	struct mt_report_data *rdata;
+	struct input_dev *input;
 
 	rdata = mt_find_report_data(td, field->report);
 	if (rdata && rdata->is_mt_collection)
 		return mt_touch_event(hid, field, usage, value);
 
+	if (field->application == MS_TYPE_COVER_APPLICATION &&
+	    rdata->application->quirks & MT_QUIRK_HAS_TYPE_COVER_TABLET_MODE_SWITCH &&
+	    usage->hid == MS_TYPE_COVER_TABLET_MODE_SWITCH_USAGE) {
+		input = field->hidinput->input;
+		input_report_switch(input, SW_TABLET_MODE, (value & 0xFF) != 0x22);
+		input_sync(input);
+		return 1;
+	}
+
 	return 0;
 }
 
@@ -1591,6 +1657,42 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app)
 		app->quirks &= ~MT_QUIRK_CONTACT_CNT_ACCURATE;
 }
 
+static int get_type_cover_field(struct hid_report_enum *rep_enum,
+				struct hid_field **field, int usage)
+{
+	struct hid_report *rep;
+	struct hid_field *cur_field;
+	int i, j;
+
+	list_for_each_entry(rep, &rep_enum->report_list, list) {
+		for (i = 0; i < rep->maxfield; i++) {
+			cur_field = rep->field[i];
+			if (cur_field->application != MS_TYPE_COVER_APPLICATION)
+				continue;
+			for (j = 0; j < cur_field->maxusage; j++) {
+				if (cur_field->usage[j].hid == usage) {
+					*field = cur_field;
+					return true;
+				}
+			}
+		}
+	}
+	return false;
+}
+
+static void request_type_cover_tablet_mode_switch(struct hid_device *hdev)
+{
+	struct hid_field *field;
+
+	if (get_type_cover_field(&hdev->report_enum[HID_INPUT_REPORT],
+				 &field,
+				 MS_TYPE_COVER_TABLET_MODE_SWITCH_USAGE)) {
+		hid_hw_request(hdev, field->report, HID_REQ_GET_REPORT);
+	} else {
+		hid_err(hdev, "couldn't find tablet mode field\n");
+	}
+}
+
 static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
 {
 	struct mt_device *td = hid_get_drvdata(hdev);
@@ -1640,6 +1742,13 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
 		/* force BTN_STYLUS to allow tablet matching in udev */
 		__set_bit(BTN_STYLUS, hi->input->keybit);
 		break;
+	case MS_TYPE_COVER_APPLICATION:
+		if (td->mtclass.quirks & MT_QUIRK_HAS_TYPE_COVER_TABLET_MODE_SWITCH) {
+			suffix = "Tablet Mode Switch";
+			request_type_cover_tablet_mode_switch(hdev);
+			break;
+		}
+		fallthrough;
 	default:
 		suffix = "UNKNOWN";
 		break;
@@ -1728,6 +1837,46 @@ static void mt_expired_timeout(struct timer_list *t)
 	clear_bit_unlock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);
 }
 
+static void update_keyboard_backlight(struct hid_device *hdev, bool enabled)
+{
+	struct usb_device *udev = hid_to_usb_dev(hdev);
+	struct hid_field *field = NULL;
+
+	/* Wake up the device in case it's already suspended */
+	pm_runtime_get_sync(&udev->dev);
+
+	if (!get_type_cover_field(&hdev->report_enum[HID_FEATURE_REPORT],
+				  &field,
+				  MS_TYPE_COVER_FEATURE_REPORT_USAGE)) {
+		hid_err(hdev, "couldn't find backlight field\n");
+		goto out;
+	}
+
+	field->value[field->index] = enabled ? 0x01ff00ff : 0x00ff00ff;
+	hid_hw_request(hdev, field->report, HID_REQ_SET_REPORT);
+
+out:
+	pm_runtime_put_sync(&udev->dev);
+}
+
+static int mt_pm_notifier(struct notifier_block *notifier,
+			  unsigned long pm_event,
+			  void *unused)
+{
+	struct mt_device *td =
+		container_of(notifier, struct mt_device, pm_notifier);
+	struct hid_device *hdev = td->hdev;
+
+	if (td->mtclass.quirks & MT_QUIRK_HAS_TYPE_COVER_BACKLIGHT) {
+		if (pm_event == PM_SUSPEND_PREPARE)
+			update_keyboard_backlight(hdev, 0);
+		else if (pm_event == PM_POST_SUSPEND)
+			update_keyboard_backlight(hdev, 1);
+	}
+
+	return NOTIFY_DONE;
+}
+
 static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
 {
 	int ret, i;
@@ -1751,6 +1900,9 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
 	td->inputmode_value = MT_INPUTMODE_TOUCHSCREEN;
 	hid_set_drvdata(hdev, td);
 
+	td->pm_notifier.notifier_call = mt_pm_notifier;
+	register_pm_notifier(&td->pm_notifier);
+
 	INIT_LIST_HEAD(&td->applications);
 	INIT_LIST_HEAD(&td->reports);
 
@@ -1789,15 +1941,19 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
 	timer_setup(&td->release_timer, mt_expired_timeout, 0);
 
 	ret = hid_parse(hdev);
-	if (ret != 0)
+	if (ret != 0) {
+		unregister_pm_notifier(&td->pm_notifier);
 		return ret;
+	}
 
 	if (mtclass->quirks & MT_QUIRK_FIX_CONST_CONTACT_ID)
 		mt_fix_const_fields(hdev, HID_DG_CONTACTID);
 
 	ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
-	if (ret)
+	if (ret) {
+		unregister_pm_notifier(&td->pm_notifier);
 		return ret;
+	}
 
 	ret = sysfs_create_group(&hdev->dev.kobj, &mt_attribute_group);
 	if (ret)
@@ -1826,13 +1982,24 @@ static int mt_suspend(struct hid_device *hdev, pm_message_t state)
 
 static int mt_reset_resume(struct hid_device *hdev)
 {
+	struct mt_device *td = hid_get_drvdata(hdev);
+
 	mt_release_contacts(hdev);
 	mt_set_modes(hdev, HID_LATENCY_NORMAL, true, true);
+
+	/* Request an update on the typecover folding state on resume
+	 * after reset.
+	 */
+	if (td->mtclass.quirks & MT_QUIRK_HAS_TYPE_COVER_TABLET_MODE_SWITCH)
+		request_type_cover_tablet_mode_switch(hdev);
+
 	return 0;
 }
 
 static int mt_resume(struct hid_device *hdev)
 {
+	struct mt_device *td = hid_get_drvdata(hdev);
+
 	/* Some Elan legacy devices require SET_IDLE to be set on resume.
 	 * It should be safe to send it to other devices too.
 	 * Tested on 3M, Stantum, Cypress, Zytronic, eGalax, and Elan panels. */
@@ -1841,6 +2008,10 @@ static int mt_resume(struct hid_device *hdev)
 
 	mt_set_modes(hdev, HID_LATENCY_NORMAL, true, true);
 
+	/* Request an update on the typecover folding state on resume. */
+	if (td->mtclass.quirks & MT_QUIRK_HAS_TYPE_COVER_TABLET_MODE_SWITCH)
+		request_type_cover_tablet_mode_switch(hdev);
+
 	return 0;
 }
 #endif
@@ -1848,7 +2019,23 @@ static int mt_resume(struct hid_device *hdev)
 static void mt_remove(struct hid_device *hdev)
 {
 	struct mt_device *td = hid_get_drvdata(hdev);
+	struct hid_field *field;
+	struct input_dev *input;
 
+	/* Reset tablet mode switch on disconnect. */
+	if (td->mtclass.quirks & MT_QUIRK_HAS_TYPE_COVER_TABLET_MODE_SWITCH) {
+		if (get_type_cover_field(&hdev->report_enum[HID_INPUT_REPORT],
+					 &field,
+					 MS_TYPE_COVER_TABLET_MODE_SWITCH_USAGE)) {
+			input = field->hidinput->input;
+			input_report_switch(input, SW_TABLET_MODE, 0);
+			input_sync(input);
+		} else {
+			hid_err(hdev, "couldn't find tablet mode field\n");
+		}
+	}
+
+	unregister_pm_notifier(&td->pm_notifier);
 	del_timer_sync(&td->release_timer);
 
 	sysfs_remove_group(&hdev->dev.kobj, &mt_attribute_group);
@@ -2226,6 +2413,11 @@ static const struct hid_device_id mt_devices[] = {
 		MT_USB_DEVICE(USB_VENDOR_ID_XIROKU,
 			USB_DEVICE_ID_XIROKU_CSR2) },
 
+	/* Microsoft Surface type cover */
+	{ .driver_data = MT_CLS_WIN_8_MS_SURFACE_TYPE_COVER,
+		HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY,
+			USB_VENDOR_ID_MICROSOFT, 0x09c0) },
+
 	/* Google MT devices */
 	{ .driver_data = MT_CLS_GOOGLE,
 		HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, USB_VENDOR_ID_GOOGLE,
diff --git a/drivers/hid/ipts/Kconfig b/drivers/hid/ipts/Kconfig
new file mode 100644
index 000000000..297401bd3
--- /dev/null
+++ b/drivers/hid/ipts/Kconfig
@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+config HID_IPTS
+	tristate "Intel Precise Touch & Stylus"
+	depends on INTEL_MEI
+	depends on HID
+	help
+	  Say Y here if your system has a touchscreen using Intels
+	  Precise Touch & Stylus (IPTS) technology.
+
+	  If unsure say N.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called ipts.
diff --git a/drivers/hid/ipts/Makefile b/drivers/hid/ipts/Makefile
new file mode 100644
index 000000000..883896f68
--- /dev/null
+++ b/drivers/hid/ipts/Makefile
@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Makefile for the IPTS touchscreen driver
+#
+
+obj-$(CONFIG_HID_IPTS) += ipts.o
+ipts-objs := cmd.o
+ipts-objs += control.o
+ipts-objs += eds1.o
+ipts-objs += eds2.o
+ipts-objs += hid.o
+ipts-objs += main.o
+ipts-objs += mei.o
+ipts-objs += receiver.o
+ipts-objs += resources.o
+ipts-objs += thread.o
diff --git a/drivers/hid/ipts/cmd.c b/drivers/hid/ipts/cmd.c
new file mode 100644
index 000000000..63a4934bb
--- /dev/null
+++ b/drivers/hid/ipts/cmd.c
@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2020-2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#include <linux/errno.h>
+#include <linux/types.h>
+
+#include "cmd.h"
+#include "context.h"
+#include "mei.h"
+#include "spec-device.h"
+
+int ipts_cmd_recv_timeout(struct ipts_context *ipts, enum ipts_command_code code,
+			  struct ipts_response *rsp, u64 timeout)
+{
+	int ret = 0;
+
+	if (!ipts)
+		return -EFAULT;
+
+	if (!rsp)
+		return -EFAULT;
+
+	/*
+	 * In a response, the command code will have the most significant bit flipped to 1.
+	 * If code is passed to ipts_mei_recv as is, no messages will be received.
+	 */
+	ret = ipts_mei_recv(&ipts->mei, code | IPTS_RSP_BIT, rsp, timeout);
+	if (ret < 0)
+		return ret;
+
+	dev_dbg(ipts->dev, "Received 0x%02X with status 0x%02X\n", code, rsp->status);
+
+	/*
+	 * Some devices will always return this error.
+	 * It is allowed to ignore it and to try continuing.
+	 */
+	if (rsp->status == IPTS_STATUS_COMPAT_CHECK_FAIL)
+		rsp->status = IPTS_STATUS_SUCCESS;
+
+	return 0;
+}
+
+int ipts_cmd_send(struct ipts_context *ipts, enum ipts_command_code code, void *data, size_t size)
+{
+	struct ipts_command cmd = { 0 };
+
+	if (!ipts)
+		return -EFAULT;
+
+	cmd.cmd = code;
+
+	if (data && size > 0)
+		memcpy(cmd.payload, data, size);
+
+	dev_dbg(ipts->dev, "Sending 0x%02X with %ld bytes payload\n", code, size);
+	return ipts_mei_send(&ipts->mei, &cmd, sizeof(cmd.cmd) + size);
+}
diff --git a/drivers/hid/ipts/cmd.h b/drivers/hid/ipts/cmd.h
new file mode 100644
index 000000000..2b4079075
--- /dev/null
+++ b/drivers/hid/ipts/cmd.h
@@ -0,0 +1,60 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (c) 2020-2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#ifndef IPTS_CMD_H
+#define IPTS_CMD_H
+
+#include <linux/types.h>
+
+#include "context.h"
+#include "spec-device.h"
+
+/*
+ * The default timeout for receiving responses
+ */
+#define IPTS_CMD_DEFAULT_TIMEOUT 1000
+
+/**
+ * ipts_cmd_recv_timeout() - Receives a response to a command.
+ * @ipts: The IPTS driver context.
+ * @code: The type of the command / response.
+ * @rsp: The address that the received response will be copied to.
+ * @timeout: How many milliseconds the function will wait at most.
+ *
+ * A negative timeout means to wait forever.
+ *
+ * Returns: 0 on success, <0 on error, -EAGAIN if no response has been received.
+ */
+int ipts_cmd_recv_timeout(struct ipts_context *ipts, enum ipts_command_code code,
+			  struct ipts_response *rsp, u64 timeout);
+
+/**
+ * ipts_cmd_recv() - Receives a response to a command.
+ * @ipts: The IPTS driver context.
+ * @code: The type of the command / response.
+ * @rsp: The address that the received response will be copied to.
+ *
+ * Returns: 0 on success, <0 on error, -EAGAIN if no response has been received.
+ */
+static inline int ipts_cmd_recv(struct ipts_context *ipts, enum ipts_command_code code,
+				struct ipts_response *rsp)
+{
+	return ipts_cmd_recv_timeout(ipts, code, rsp, IPTS_CMD_DEFAULT_TIMEOUT);
+}
+
+/**
+ * ipts_cmd_send() - Executes a command on the device.
+ * @ipts: The IPTS driver context.
+ * @code: The type of the command to execute.
+ * @data: The payload containing parameters for the command.
+ * @size: The size of the payload.
+ *
+ * Returns: 0 on success, <0 on error.
+ */
+int ipts_cmd_send(struct ipts_context *ipts, enum ipts_command_code code, void *data, size_t size);
+
+#endif /* IPTS_CMD_H */
diff --git a/drivers/hid/ipts/context.h b/drivers/hid/ipts/context.h
new file mode 100644
index 000000000..ba33259f1
--- /dev/null
+++ b/drivers/hid/ipts/context.h
@@ -0,0 +1,52 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (c) 2020-2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#ifndef IPTS_CONTEXT_H
+#define IPTS_CONTEXT_H
+
+#include <linux/completion.h>
+#include <linux/device.h>
+#include <linux/hid.h>
+#include <linux/mei_cl_bus.h>
+#include <linux/mutex.h>
+#include <linux/sched.h>
+#include <linux/types.h>
+
+#include "mei.h"
+#include "resources.h"
+#include "spec-device.h"
+#include "thread.h"
+
+struct ipts_context {
+	struct device *dev;
+	struct ipts_mei mei;
+
+	enum ipts_mode mode;
+
+	/*
+	 * Prevents concurrent GET_FEATURE reports.
+	 */
+	struct mutex feature_lock;
+	struct completion feature_event;
+
+	/*
+	 * These are not inside of struct ipts_resources
+	 * because they don't own the memory they point to.
+	 */
+	struct ipts_buffer feature_report;
+	struct ipts_buffer descriptor;
+
+	bool hid_active;
+	struct hid_device *hid;
+
+	struct ipts_device_info info;
+	struct ipts_resources resources;
+
+	struct ipts_thread receiver_loop;
+};
+
+#endif /* IPTS_CONTEXT_H */
diff --git a/drivers/hid/ipts/control.c b/drivers/hid/ipts/control.c
new file mode 100644
index 000000000..5360842d2
--- /dev/null
+++ b/drivers/hid/ipts/control.c
@@ -0,0 +1,486 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2020-2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#include <linux/delay.h>
+#include <linux/dev_printk.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/types.h>
+
+#include "cmd.h"
+#include "context.h"
+#include "control.h"
+#include "desc.h"
+#include "hid.h"
+#include "receiver.h"
+#include "resources.h"
+#include "spec-data.h"
+#include "spec-device.h"
+
+static int ipts_control_get_device_info(struct ipts_context *ipts, struct ipts_device_info *info)
+{
+	int ret = 0;
+	struct ipts_response rsp = { 0 };
+
+	if (!ipts)
+		return -EFAULT;
+
+	if (!info)
+		return -EFAULT;
+
+	ret = ipts_cmd_send(ipts, IPTS_CMD_GET_DEVICE_INFO, NULL, 0);
+	if (ret) {
+		dev_err(ipts->dev, "GET_DEVICE_INFO: send failed: %d\n", ret);
+		return ret;
+	}
+
+	ret = ipts_cmd_recv(ipts, IPTS_CMD_GET_DEVICE_INFO, &rsp);
+	if (ret) {
+		dev_err(ipts->dev, "GET_DEVICE_INFO: recv failed: %d\n", ret);
+		return ret;
+	}
+
+	if (rsp.status != IPTS_STATUS_SUCCESS) {
+		dev_err(ipts->dev, "GET_DEVICE_INFO: cmd failed: %d\n", rsp.status);
+		return -EBADR;
+	}
+
+	memcpy(info, rsp.payload, sizeof(*info));
+	return 0;
+}
+
+static int ipts_control_set_mode(struct ipts_context *ipts, enum ipts_mode mode)
+{
+	int ret = 0;
+	struct ipts_set_mode cmd = { 0 };
+	struct ipts_response rsp = { 0 };
+
+	if (!ipts)
+		return -EFAULT;
+
+	cmd.mode = mode;
+
+	ret = ipts_cmd_send(ipts, IPTS_CMD_SET_MODE, &cmd, sizeof(cmd));
+	if (ret) {
+		dev_err(ipts->dev, "SET_MODE: send failed: %d\n", ret);
+		return ret;
+	}
+
+	ret = ipts_cmd_recv(ipts, IPTS_CMD_SET_MODE, &rsp);
+	if (ret) {
+		dev_err(ipts->dev, "SET_MODE: recv failed: %d\n", ret);
+		return ret;
+	}
+
+	if (rsp.status != IPTS_STATUS_SUCCESS) {
+		dev_err(ipts->dev, "SET_MODE: cmd failed: %d\n", rsp.status);
+		return -EBADR;
+	}
+
+	return 0;
+}
+
+static int ipts_control_set_mem_window(struct ipts_context *ipts, struct ipts_resources *res)
+{
+	int i = 0;
+	int ret = 0;
+	struct ipts_mem_window cmd = { 0 };
+	struct ipts_response rsp = { 0 };
+
+	if (!ipts)
+		return -EFAULT;
+
+	if (!res)
+		return -EFAULT;
+
+	for (i = 0; i < IPTS_BUFFERS; i++) {
+		cmd.data_addr_lower[i] = lower_32_bits(res->data[i].dma_address);
+		cmd.data_addr_upper[i] = upper_32_bits(res->data[i].dma_address);
+		cmd.feedback_addr_lower[i] = lower_32_bits(res->feedback[i].dma_address);
+		cmd.feedback_addr_upper[i] = upper_32_bits(res->feedback[i].dma_address);
+	}
+
+	cmd.workqueue_addr_lower = lower_32_bits(res->workqueue.dma_address);
+	cmd.workqueue_addr_upper = upper_32_bits(res->workqueue.dma_address);
+
+	cmd.doorbell_addr_lower = lower_32_bits(res->doorbell.dma_address);
+	cmd.doorbell_addr_upper = upper_32_bits(res->doorbell.dma_address);
+
+	cmd.hid2me_addr_lower = lower_32_bits(res->hid2me.dma_address);
+	cmd.hid2me_addr_upper = upper_32_bits(res->hid2me.dma_address);
+
+	cmd.workqueue_size = IPTS_WORKQUEUE_SIZE;
+	cmd.workqueue_item_size = IPTS_WORKQUEUE_ITEM_SIZE;
+
+	ret = ipts_cmd_send(ipts, IPTS_CMD_SET_MEM_WINDOW, &cmd, sizeof(cmd));
+	if (ret) {
+		dev_err(ipts->dev, "SET_MEM_WINDOW: send failed: %d\n", ret);
+		return ret;
+	}
+
+	ret = ipts_cmd_recv(ipts, IPTS_CMD_SET_MEM_WINDOW, &rsp);
+	if (ret) {
+		dev_err(ipts->dev, "SET_MEM_WINDOW: recv failed: %d\n", ret);
+		return ret;
+	}
+
+	if (rsp.status != IPTS_STATUS_SUCCESS) {
+		dev_err(ipts->dev, "SET_MEM_WINDOW: cmd failed: %d\n", rsp.status);
+		return -EBADR;
+	}
+
+	return 0;
+}
+
+static int ipts_control_get_descriptor(struct ipts_context *ipts)
+{
+	int ret = 0;
+	struct ipts_data_header *header = NULL;
+	struct ipts_get_descriptor cmd = { 0 };
+	struct ipts_response rsp = { 0 };
+
+	if (!ipts)
+		return -EFAULT;
+
+	if (!ipts->resources.descriptor.address)
+		return -EFAULT;
+
+	memset(ipts->resources.descriptor.address, 0, ipts->resources.descriptor.size);
+
+	cmd.addr_lower = lower_32_bits(ipts->resources.descriptor.dma_address);
+	cmd.addr_upper = upper_32_bits(ipts->resources.descriptor.dma_address);
+	cmd.magic = 8;
+
+	ret = ipts_cmd_send(ipts, IPTS_CMD_GET_DESCRIPTOR, &cmd, sizeof(cmd));
+	if (ret) {
+		dev_err(ipts->dev, "GET_DESCRIPTOR: send failed: %d\n", ret);
+		return ret;
+	}
+
+	ret = ipts_cmd_recv(ipts, IPTS_CMD_GET_DESCRIPTOR, &rsp);
+	if (ret) {
+		dev_err(ipts->dev, "GET_DESCRIPTOR: recv failed: %d\n", ret);
+		return ret;
+	}
+
+	if (rsp.status != IPTS_STATUS_SUCCESS) {
+		dev_err(ipts->dev, "GET_DESCRIPTOR: cmd failed: %d\n", rsp.status);
+		return -EBADR;
+	}
+
+	header = (struct ipts_data_header *)ipts->resources.descriptor.address;
+
+	if (header->type == IPTS_DATA_TYPE_DESCRIPTOR) {
+		ipts->descriptor.address = &header->data[8];
+		ipts->descriptor.size = header->size - 8;
+
+		return 0;
+	}
+
+	return -ENODATA;
+}
+
+int ipts_control_request_flush(struct ipts_context *ipts)
+{
+	int ret = 0;
+	struct ipts_quiesce_io cmd = { 0 };
+
+	if (!ipts)
+		return -EFAULT;
+
+	ret = ipts_cmd_send(ipts, IPTS_CMD_QUIESCE_IO, &cmd, sizeof(cmd));
+	if (ret)
+		dev_err(ipts->dev, "QUIESCE_IO: send failed: %d\n", ret);
+
+	return ret;
+}
+
+int ipts_control_wait_flush(struct ipts_context *ipts)
+{
+	int ret = 0;
+	struct ipts_response rsp = { 0 };
+
+	if (!ipts)
+		return -EFAULT;
+
+	ret = ipts_cmd_recv(ipts, IPTS_CMD_QUIESCE_IO, &rsp);
+	if (ret) {
+		dev_err(ipts->dev, "QUIESCE_IO: recv failed: %d\n", ret);
+		return ret;
+	}
+
+	if (rsp.status == IPTS_STATUS_TIMEOUT)
+		return -EAGAIN;
+
+	if (rsp.status != IPTS_STATUS_SUCCESS) {
+		dev_err(ipts->dev, "QUIESCE_IO: cmd failed: %d\n", rsp.status);
+		return -EBADR;
+	}
+
+	return 0;
+}
+
+int ipts_control_request_data(struct ipts_context *ipts)
+{
+	int ret = 0;
+
+	if (!ipts)
+		return -EFAULT;
+
+	ret = ipts_cmd_send(ipts, IPTS_CMD_READY_FOR_DATA, NULL, 0);
+	if (ret)
+		dev_err(ipts->dev, "READY_FOR_DATA: send failed: %d\n", ret);
+
+	return ret;
+}
+
+int ipts_control_wait_data(struct ipts_context *ipts, bool shutdown)
+{
+	int ret = 0;
+	struct ipts_response rsp = { 0 };
+
+	if (!ipts)
+		return -EFAULT;
+
+	if (!shutdown)
+		ret = ipts_cmd_recv_timeout(ipts, IPTS_CMD_READY_FOR_DATA, &rsp, 0);
+	else
+		ret = ipts_cmd_recv(ipts, IPTS_CMD_READY_FOR_DATA, &rsp);
+
+	if (ret) {
+		if (ret != -EAGAIN)
+			dev_err(ipts->dev, "READY_FOR_DATA: recv failed: %d\n", ret);
+
+		return ret;
+	}
+
+	/*
+	 * During shutdown, it is possible that the sensor has already been disabled.
+	 */
+	if (rsp.status == IPTS_STATUS_SENSOR_DISABLED)
+		return 0;
+
+	if (rsp.status == IPTS_STATUS_TIMEOUT)
+		return -EAGAIN;
+
+	if (rsp.status != IPTS_STATUS_SUCCESS) {
+		dev_err(ipts->dev, "READY_FOR_DATA: cmd failed: %d\n", rsp.status);
+		return -EBADR;
+	}
+
+	return 0;
+}
+
+int ipts_control_send_feedback(struct ipts_context *ipts, u32 buffer)
+{
+	int ret = 0;
+	struct ipts_feedback cmd = { 0 };
+	struct ipts_response rsp = { 0 };
+
+	if (!ipts)
+		return -EFAULT;
+
+	cmd.buffer = buffer;
+
+	ret = ipts_cmd_send(ipts, IPTS_CMD_FEEDBACK, &cmd, sizeof(cmd));
+	if (ret) {
+		dev_err(ipts->dev, "FEEDBACK: send failed: %d\n", ret);
+		return ret;
+	}
+
+	ret = ipts_cmd_recv(ipts, IPTS_CMD_FEEDBACK, &rsp);
+	if (ret) {
+		dev_err(ipts->dev, "FEEDBACK: recv failed: %d\n", ret);
+		return ret;
+	}
+
+	/*
+	 * We don't know what feedback data looks like so we are sending zeros.
+	 * See also ipts_control_refill_buffer.
+	 */
+	if (rsp.status == IPTS_STATUS_INVALID_PARAMS)
+		return 0;
+
+	if (rsp.status != IPTS_STATUS_SUCCESS) {
+		dev_err(ipts->dev, "FEEDBACK: cmd failed: %d\n", rsp.status);
+		return -EBADR;
+	}
+
+	return 0;
+}
+
+int ipts_control_hid2me_feedback(struct ipts_context *ipts, enum ipts_feedback_cmd_type cmd,
+				 enum ipts_feedback_data_type type, void *data, size_t size)
+{
+	struct ipts_feedback_header *header = NULL;
+
+	if (!ipts)
+		return -EFAULT;
+
+	if (!ipts->resources.hid2me.address)
+		return -EFAULT;
+
+	memset(ipts->resources.hid2me.address, 0, ipts->resources.hid2me.size);
+	header = (struct ipts_feedback_header *)ipts->resources.hid2me.address;
+
+	header->cmd_type = cmd;
+	header->data_type = type;
+	header->size = size;
+	header->buffer = IPTS_HID2ME_BUFFER;
+
+	if (size + sizeof(*header) > ipts->resources.hid2me.size)
+		return -EINVAL;
+
+	if (data && size > 0)
+		memcpy(header->payload, data, size);
+
+	return ipts_control_send_feedback(ipts, IPTS_HID2ME_BUFFER);
+}
+
+int ipts_control_start(struct ipts_context *ipts)
+{
+	int ret = 0;
+	struct ipts_device_info info = { 0 };
+
+	if (!ipts)
+		return -EFAULT;
+
+	dev_info(ipts->dev, "Starting IPTS\n");
+
+	ret = ipts_control_get_device_info(ipts, &info);
+	if (ret) {
+		dev_err(ipts->dev, "Failed to get device info: %d\n", ret);
+		return ret;
+	}
+
+	ipts->info = info;
+
+	ret = ipts_resources_init(&ipts->resources, ipts->dev, info.data_size, info.feedback_size);
+	if (ret) {
+		dev_err(ipts->dev, "Failed to allocate buffers: %d", ret);
+		return ret;
+	}
+
+	dev_info(ipts->dev, "IPTS EDS Version: %d\n", info.intf_eds);
+
+	/*
+	 * Handle newer devices
+	 */
+	if (info.intf_eds > 1) {
+		/*
+		 * Fetching the descriptor will only work on newer devices.
+		 * For older devices, a fallback descriptor will be used.
+		 */
+		ret = ipts_control_get_descriptor(ipts);
+		if (ret) {
+			dev_err(ipts->dev, "Failed to fetch HID descriptor: %d\n", ret);
+			return ret;
+		}
+
+		/*
+		 * Newer devices can be directly initialized in polling mode.
+		 */
+		ipts->mode = IPTS_MODE_POLL;
+	}
+
+	ret = ipts_control_set_mode(ipts, ipts->mode);
+	if (ret) {
+		dev_err(ipts->dev, "Failed to set mode: %d\n", ret);
+		return ret;
+	}
+
+	ret = ipts_control_set_mem_window(ipts, &ipts->resources);
+	if (ret) {
+		dev_err(ipts->dev, "Failed to set memory window: %d\n", ret);
+		return ret;
+	}
+
+	ret = ipts_receiver_start(ipts);
+	if (ret) {
+		dev_err(ipts->dev, "Failed to start receiver: %d\n", ret);
+		return ret;
+	}
+
+	ret = ipts_control_request_data(ipts);
+	if (ret) {
+		dev_err(ipts->dev, "Failed to request data: %d\n", ret);
+		return ret;
+	}
+
+	ipts_hid_enable(ipts);
+
+	ret = ipts_hid_init(ipts, info);
+	if (ret) {
+		dev_err(ipts->dev, "Failed to initialize HID device: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+static int _ipts_control_stop(struct ipts_context *ipts)
+{
+	int ret = 0;
+
+	if (!ipts)
+		return -EFAULT;
+
+	ipts_hid_disable(ipts);
+	dev_info(ipts->dev, "Stopping IPTS\n");
+
+	ret = ipts_receiver_stop(ipts);
+	if (ret) {
+		dev_err(ipts->dev, "Failed to stop receiver: %d\n", ret);
+		return ret;
+	}
+
+	ret = ipts_resources_free(&ipts->resources);
+	if (ret) {
+		dev_err(ipts->dev, "Failed to free resources: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+int ipts_control_stop(struct ipts_context *ipts)
+{
+	int ret = 0;
+
+	ret = _ipts_control_stop(ipts);
+	if (ret)
+		return ret;
+
+	ret = ipts_hid_free(ipts);
+	if (ret) {
+		dev_err(ipts->dev, "Failed to free HID device: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+int ipts_control_restart(struct ipts_context *ipts)
+{
+	int ret = 0;
+
+	ret = _ipts_control_stop(ipts);
+	if (ret)
+		return ret;
+
+	/*
+	 * Wait a second to give the sensor time to fully shut down.
+	 */
+	msleep(1000);
+
+	ret = ipts_control_start(ipts);
+	if (ret)
+		return ret;
+
+	return 0;
+}
diff --git a/drivers/hid/ipts/control.h b/drivers/hid/ipts/control.h
new file mode 100644
index 000000000..26629c514
--- /dev/null
+++ b/drivers/hid/ipts/control.h
@@ -0,0 +1,126 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (c) 2020-2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#ifndef IPTS_CONTROL_H
+#define IPTS_CONTROL_H
+
+#include <linux/types.h>
+
+#include "context.h"
+#include "spec-data.h"
+#include "spec-device.h"
+
+/**
+ * ipts_control_request_flush() - Stop the data flow.
+ * @ipts: The IPTS driver context.
+ *
+ * Runs the command to stop the data flow on the device.
+ * All outstanding data needs to be acknowledged using feedback before the command will return.
+ *
+ * Returns: 0 on success, <0 on error.
+ */
+int ipts_control_request_flush(struct ipts_context *ipts);
+
+/**
+ * ipts_control_wait_flush() - Wait until data flow has been stopped.
+ * @ipts: The IPTS driver context.
+ *
+ * Returns: 0 on success, <0 on error.
+ */
+int ipts_control_wait_flush(struct ipts_context *ipts);
+
+/**
+ * ipts_control_wait_flush() - Notify the device that the driver can receive new data.
+ * @ipts: The IPTS driver context.
+ *
+ * Returns: 0 on success, <0 on error.
+ */
+int ipts_control_request_data(struct ipts_context *ipts);
+
+/**
+ * ipts_control_wait_data() - Wait until new data is available.
+ * @ipts: The IPTS driver context.
+ * @block: Whether to block execution until data is available.
+ *
+ * In poll mode, this function will never return while the data flow is active. Instead,
+ * the poll will be incremented when new data is available.
+ *
+ * Returns: 0 on success, <0 on error, -EAGAIN if no data is available.
+ */
+int ipts_control_wait_data(struct ipts_context *ipts, bool block);
+
+/**
+ * ipts_control_send_feedback() - Submits a feedback buffer to the device.
+ * @ipts: The IPTS driver context.
+ * @buffer: The ID of the buffer containing feedback data.
+ *
+ * Returns: 0 on success, <0 on error.
+ */
+int ipts_control_send_feedback(struct ipts_context *ipts, u32 buffer);
+
+/**
+ * ipts_control_hid2me_feedback() - Sends HID2ME feedback, a special type of feedback.
+ * @ipts: The IPTS driver context.
+ * @cmd: The command that will be run on the device.
+ * @type: The type of the payload that is sent to the device.
+ * @data: The payload of the feedback command.
+ * @size: The size of the payload.
+ *
+ * HID2ME feedback is a special type of feedback, because it allows interfacing with
+ * the HID API of the device at any moment, without requiring a buffer that has to
+ * be acknowledged.
+ *
+ * Returns: 0 on success, <0 on error.
+ */
+int ipts_control_hid2me_feedback(struct ipts_context *ipts, enum ipts_feedback_cmd_type cmd,
+				 enum ipts_feedback_data_type type, void *data, size_t size);
+
+/**
+ * ipts_control_refill_buffer() - Acknowledges that data in a buffer has been processed.
+ * @ipts: The IPTS driver context.
+ * @buffer: The buffer that has been processed and can be refilled.
+ *
+ * Returns: 0 on success, <0 on error.
+ */
+static inline int ipts_control_refill_buffer(struct ipts_context *ipts, u32 buffer)
+{
+	/*
+	 * IPTS expects structured data in the feedback buffer matching the buffer that will be
+	 * refilled. We don't know what that data looks like, so we just keep the buffer empty.
+	 * This results in an INVALID_PARAMS error, but the buffer gets refilled without an issue.
+	 * Sending a minimal structure with the buffer ID fixes the error, but breaks refilling
+	 * the buffers on some devices.
+	 */
+
+	return ipts_control_send_feedback(ipts, buffer);
+}
+
+/**
+ * ipts_control_start() - Initialized the device and starts the data flow.
+ * @ipts: The IPTS driver context.
+ *
+ * Returns: 0 on success, <0 on error.
+ */
+int ipts_control_start(struct ipts_context *ipts);
+
+/**
+ * ipts_control_stop() - Stops the data flow and resets the device.
+ * @ipts: The IPTS driver context.
+ *
+ * Returns: 0 on success, <0 on error.
+ */
+int ipts_control_stop(struct ipts_context *ipts);
+
+/**
+ * ipts_control_restart() - Stops the device and starts it again.
+ * @ipts: The IPTS driver context.
+ *
+ * Returns: 0 on success, <0 on error.
+ */
+int ipts_control_restart(struct ipts_context *ipts);
+
+#endif /* IPTS_CONTROL_H */
diff --git a/drivers/hid/ipts/desc.h b/drivers/hid/ipts/desc.h
new file mode 100644
index 000000000..307438c7c
--- /dev/null
+++ b/drivers/hid/ipts/desc.h
@@ -0,0 +1,80 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (c) 2022-2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#ifndef IPTS_DESC_H
+#define IPTS_DESC_H
+
+#include <linux/types.h>
+
+#define IPTS_HID_REPORT_SINGLETOUCH 64
+#define IPTS_HID_REPORT_DATA	    65
+#define IPTS_HID_REPORT_SET_MODE    66
+
+#define IPTS_HID_REPORT_DATA_SIZE 7485
+
+/*
+ * HID descriptor for singletouch data.
+ * This descriptor should be present on all IPTS devices.
+ */
+static const u8 ipts_singletouch_descriptor[] = {
+	0x05, 0x0D,	  /*  Usage Page (Digitizer),            */
+	0x09, 0x04,	  /*  Usage (Touchscreen),               */
+	0xA1, 0x01,	  /*  Collection (Application),          */
+	0x85, 0x40,	  /*      Report ID (64),                */
+	0x09, 0x42,	  /*      Usage (Tip Switch),            */
+	0x15, 0x00,	  /*      Logical Minimum (0),           */
+	0x25, 0x01,	  /*      Logical Maximum (1),           */
+	0x75, 0x01,	  /*      Report Size (1),               */
+	0x95, 0x01,	  /*      Report Count (1),              */
+	0x81, 0x02,	  /*      Input (Variable),              */
+	0x95, 0x07,	  /*      Report Count (7),              */
+	0x81, 0x03,	  /*      Input (Constant, Variable),    */
+	0x05, 0x01,	  /*      Usage Page (Desktop),          */
+	0x09, 0x30,	  /*      Usage (X),                     */
+	0x75, 0x10,	  /*      Report Size (16),              */
+	0x95, 0x01,	  /*      Report Count (1),              */
+	0xA4,		  /*      Push,                          */
+	0x55, 0x0E,	  /*      Unit Exponent (14),            */
+	0x65, 0x11,	  /*      Unit (Centimeter),             */
+	0x46, 0x76, 0x0B, /*      Physical Maximum (2934),       */
+	0x26, 0xFF, 0x7F, /*      Logical Maximum (32767),       */
+	0x81, 0x02,	  /*      Input (Variable),              */
+	0x09, 0x31,	  /*      Usage (Y),                     */
+	0x46, 0x74, 0x06, /*      Physical Maximum (1652),       */
+	0x26, 0xFF, 0x7F, /*      Logical Maximum (32767),       */
+	0x81, 0x02,	  /*      Input (Variable),              */
+	0xB4,		  /*      Pop,                           */
+	0xC0,		  /*  End Collection                     */
+};
+
+/*
+ * Fallback HID descriptor for older devices that do not have
+ * the ability to query their HID descriptor.
+ */
+static const u8 ipts_fallback_descriptor[] = {
+	0x05, 0x0D,	  /*  Usage Page (Digitizer),            */
+	0x09, 0x0F,	  /*  Usage (Capacitive Hm Digitizer),   */
+	0xA1, 0x01,	  /*  Collection (Application),          */
+	0x85, 0x41,	  /*      Report ID (65),                */
+	0x09, 0x56,	  /*      Usage (Scan Time),             */
+	0x95, 0x01,	  /*      Report Count (1),              */
+	0x75, 0x10,	  /*      Report Size (16),              */
+	0x81, 0x02,	  /*      Input (Variable),              */
+	0x09, 0x61,	  /*      Usage (Gesture Char Quality),  */
+	0x75, 0x08,	  /*      Report Size (8),               */
+	0x96, 0x3D, 0x1D, /*      Report Count (7485),           */
+	0x81, 0x03,	  /*      Input (Constant, Variable),    */
+	0x85, 0x42,	  /*      Report ID (66),                */
+	0x06, 0x00, 0xFF, /*      Usage Page (FF00h),            */
+	0x09, 0xC8,	  /*      Usage (C8h),                   */
+	0x75, 0x08,	  /*      Report Size (8),               */
+	0x95, 0x01,	  /*      Report Count (1),              */
+	0xB1, 0x02,	  /*      Feature (Variable),            */
+	0xC0,		  /*  End Collection,                    */
+};
+
+#endif /* IPTS_DESC_H */
diff --git a/drivers/hid/ipts/eds1.c b/drivers/hid/ipts/eds1.c
new file mode 100644
index 000000000..ecbb3a8bd
--- /dev/null
+++ b/drivers/hid/ipts/eds1.c
@@ -0,0 +1,103 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#include <linux/err.h>
+#include <linux/gfp.h>
+#include <linux/hid.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+
+#include "context.h"
+#include "control.h"
+#include "desc.h"
+#include "spec-device.h"
+
+int ipts_eds1_get_descriptor(struct ipts_context *ipts, u8 **desc_buffer, size_t *desc_size)
+{
+	size_t size = 0;
+	u8 *buffer = NULL;
+
+	if (!ipts)
+		return -EFAULT;
+
+	if (!desc_buffer)
+		return -EFAULT;
+
+	if (!desc_size)
+		return -EFAULT;
+
+	size = sizeof(ipts_singletouch_descriptor) + sizeof(ipts_fallback_descriptor);
+
+	buffer = kzalloc(size, GFP_KERNEL);
+	if (!buffer)
+		return -ENOMEM;
+
+	memcpy(buffer, ipts_singletouch_descriptor, sizeof(ipts_singletouch_descriptor));
+	memcpy(&buffer[sizeof(ipts_singletouch_descriptor)], ipts_fallback_descriptor,
+	       sizeof(ipts_fallback_descriptor));
+
+	*desc_size = size;
+	*desc_buffer = buffer;
+
+	return 0;
+}
+
+static int ipts_eds1_switch_mode(struct ipts_context *ipts, enum ipts_mode mode)
+{
+	int ret = 0;
+
+	if (!ipts)
+		return -EFAULT;
+
+	if (ipts->mode == mode)
+		return 0;
+
+	ipts->mode = mode;
+
+	ret = ipts_control_restart(ipts);
+	if (ret)
+		dev_err(ipts->dev, "Failed to switch modes: %d\n", ret);
+
+	return ret;
+}
+
+int ipts_eds1_raw_request(struct ipts_context *ipts, u8 *buffer, size_t size, u8 report_id,
+			  enum hid_report_type report_type, enum hid_class_request request_type)
+{
+	int ret = 0;
+
+	if (!ipts)
+		return -EFAULT;
+
+	if (!buffer)
+		return -EFAULT;
+
+	if (report_id != IPTS_HID_REPORT_SET_MODE)
+		return -EIO;
+
+	if (report_type != HID_FEATURE_REPORT)
+		return -EIO;
+
+	if (size != 2)
+		return -EINVAL;
+
+	/*
+	 * Implement mode switching report for older devices without native HID support.
+	 */
+
+	if (request_type == HID_REQ_GET_REPORT) {
+		memset(buffer, 0, size);
+		buffer[0] = report_id;
+		buffer[1] = ipts->mode;
+	} else if (request_type == HID_REQ_SET_REPORT) {
+		return ipts_eds1_switch_mode(ipts, buffer[1]);
+	} else {
+		return -EIO;
+	}
+
+	return ret;
+}
diff --git a/drivers/hid/ipts/eds1.h b/drivers/hid/ipts/eds1.h
new file mode 100644
index 000000000..eeeb6575e
--- /dev/null
+++ b/drivers/hid/ipts/eds1.h
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#include <linux/hid.h>
+#include <linux/types.h>
+
+#include "context.h"
+
+/**
+ * ipts_eds1_get_descriptor() - Assembles the HID descriptor of the device.
+ * @ipts: The IPTS driver context.
+ * @desc_buffer: A pointer to the location where the address of the allocated buffer is stored.
+ * @desc_size: A pointer to the location where the size of the allocated buffer is stored.
+ *
+ * Returns: 0 on success, <0 on error.
+ */
+int ipts_eds1_get_descriptor(struct ipts_context *ipts, u8 **desc_buffer, size_t *desc_size);
+
+/**
+ * ipts_eds1_raw_request() - Executes an output or feature report on the device.
+ * @ipts: The IPTS driver context.
+ * @buffer: The buffer containing the report.
+ * @size: The size of the buffer.
+ * @report_id: The HID report ID.
+ * @report_type: Whether this report is an output or a feature report.
+ * @request_type: Whether this report requests or sends data.
+ *
+ * Returns: 0 on success, <0 on error.
+ */
+int ipts_eds1_raw_request(struct ipts_context *ipts, u8 *buffer, size_t size, u8 report_id,
+			  enum hid_report_type report_type, enum hid_class_request request_type);
diff --git a/drivers/hid/ipts/eds2.c b/drivers/hid/ipts/eds2.c
new file mode 100644
index 000000000..198dc65d7
--- /dev/null
+++ b/drivers/hid/ipts/eds2.c
@@ -0,0 +1,144 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#include <linux/completion.h>
+#include <linux/err.h>
+#include <linux/gfp.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+
+#include "context.h"
+#include "control.h"
+#include "desc.h"
+#include "spec-data.h"
+
+int ipts_eds2_get_descriptor(struct ipts_context *ipts, u8 **desc_buffer, size_t *desc_size)
+{
+	size_t size = 0;
+	u8 *buffer = NULL;
+
+	if (!ipts)
+		return -EFAULT;
+
+	if (!desc_buffer)
+		return -EFAULT;
+
+	if (!desc_size)
+		return -EFAULT;
+
+	size = sizeof(ipts_singletouch_descriptor) + ipts->descriptor.size;
+
+	buffer = kzalloc(size, GFP_KERNEL);
+	if (!buffer)
+		return -ENOMEM;
+
+	memcpy(buffer, ipts_singletouch_descriptor, sizeof(ipts_singletouch_descriptor));
+	memcpy(&buffer[sizeof(ipts_singletouch_descriptor)], ipts->descriptor.address,
+	       ipts->descriptor.size);
+
+	*desc_size = size;
+	*desc_buffer = buffer;
+
+	return 0;
+}
+
+static int ipts_eds2_get_feature(struct ipts_context *ipts, u8 *buffer, size_t size, u8 report_id,
+				 enum ipts_feedback_data_type type)
+{
+	int ret = 0;
+
+	if (!ipts)
+		return -EFAULT;
+
+	if (!buffer)
+		return -EFAULT;
+
+	mutex_lock(&ipts->feature_lock);
+
+	memset(buffer, 0, size);
+	buffer[0] = report_id;
+
+	memset(&ipts->feature_report, 0, sizeof(ipts->feature_report));
+	reinit_completion(&ipts->feature_event);
+
+	ret = ipts_control_hid2me_feedback(ipts, IPTS_FEEDBACK_CMD_TYPE_NONE, type, buffer, size);
+	if (ret) {
+		dev_err(ipts->dev, "Failed to send hid2me feedback: %d\n", ret);
+		goto out;
+	}
+
+	ret = wait_for_completion_timeout(&ipts->feature_event, msecs_to_jiffies(5000));
+	if (ret == 0) {
+		dev_warn(ipts->dev, "GET_FEATURES timed out!\n");
+		ret = -EIO;
+		goto out;
+	}
+
+	if (!ipts->feature_report.address) {
+		ret = -EFAULT;
+		goto out;
+	}
+
+	if (ipts->feature_report.size > size) {
+		ret = -ETOOSMALL;
+		goto out;
+	}
+
+	ret = ipts->feature_report.size;
+	memcpy(buffer, ipts->feature_report.address, ipts->feature_report.size);
+
+out:
+	mutex_unlock(&ipts->feature_lock);
+	return ret;
+}
+
+static int ipts_eds2_set_feature(struct ipts_context *ipts, u8 *buffer, size_t size, u8 report_id,
+				 enum ipts_feedback_data_type type)
+{
+	int ret = 0;
+
+	if (!ipts)
+		return -EFAULT;
+
+	if (!buffer)
+		return -EFAULT;
+
+	buffer[0] = report_id;
+
+	ret = ipts_control_hid2me_feedback(ipts, IPTS_FEEDBACK_CMD_TYPE_NONE, type, buffer, size);
+	if (ret)
+		dev_err(ipts->dev, "Failed to send hid2me feedback: %d\n", ret);
+
+	return ret;
+}
+
+int ipts_eds2_raw_request(struct ipts_context *ipts, u8 *buffer, size_t size, u8 report_id,
+			  enum hid_report_type report_type, enum hid_class_request request_type)
+{
+	enum ipts_feedback_data_type feedback_type = IPTS_FEEDBACK_DATA_TYPE_VENDOR;
+
+	if (!ipts)
+		return -EFAULT;
+
+	if (!buffer)
+		return -EFAULT;
+
+	if (report_type == HID_OUTPUT_REPORT && request_type == HID_REQ_SET_REPORT)
+		feedback_type = IPTS_FEEDBACK_DATA_TYPE_OUTPUT_REPORT;
+	else if (report_type == HID_FEATURE_REPORT && request_type == HID_REQ_GET_REPORT)
+		feedback_type = IPTS_FEEDBACK_DATA_TYPE_GET_FEATURES;
+	else if (report_type == HID_FEATURE_REPORT && request_type == HID_REQ_SET_REPORT)
+		feedback_type = IPTS_FEEDBACK_DATA_TYPE_SET_FEATURES;
+	else
+		return -EIO;
+
+	if (request_type == HID_REQ_GET_REPORT)
+		return ipts_eds2_get_feature(ipts, buffer, size, report_id, feedback_type);
+	else
+		return ipts_eds2_set_feature(ipts, buffer, size, report_id, feedback_type);
+}
diff --git a/drivers/hid/ipts/eds2.h b/drivers/hid/ipts/eds2.h
new file mode 100644
index 000000000..064e37169
--- /dev/null
+++ b/drivers/hid/ipts/eds2.h
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#include <linux/hid.h>
+#include <linux/types.h>
+
+#include "context.h"
+
+/**
+ * ipts_eds2_get_descriptor() - Assembles the HID descriptor of the device.
+ * @ipts: The IPTS driver context.
+ * @desc_buffer: A pointer to the location where the address of the allocated buffer is stored.
+ * @desc_size: A pointer to the location where the size of the allocated buffer is stored.
+ *
+ * Returns: 0 on success, <0 on error.
+ */
+int ipts_eds2_get_descriptor(struct ipts_context *ipts, u8 **desc_buffer, size_t *desc_size);
+
+/**
+ * ipts_eds2_raw_request() - Executes an output or feature report on the device.
+ * @ipts: The IPTS driver context.
+ * @buffer: The buffer containing the report.
+ * @size: The size of the buffer.
+ * @report_id: The HID report ID.
+ * @report_type: Whether this report is an output or a feature report.
+ * @request_type: Whether this report requests or sends data.
+ *
+ * Returns: 0 on success, <0 on error.
+ */
+int ipts_eds2_raw_request(struct ipts_context *ipts, u8 *buffer, size_t size, u8 report_id,
+			  enum hid_report_type report_type, enum hid_class_request request_type);
diff --git a/drivers/hid/ipts/hid.c b/drivers/hid/ipts/hid.c
new file mode 100644
index 000000000..e34a1a4f9
--- /dev/null
+++ b/drivers/hid/ipts/hid.c
@@ -0,0 +1,225 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2022-2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#include <linux/completion.h>
+#include <linux/err.h>
+#include <linux/gfp.h>
+#include <linux/hid.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+
+#include "context.h"
+#include "desc.h"
+#include "eds1.h"
+#include "eds2.h"
+#include "hid.h"
+#include "spec-data.h"
+#include "spec-hid.h"
+
+void ipts_hid_enable(struct ipts_context *ipts)
+{
+	WRITE_ONCE(ipts->hid_active, true);
+}
+
+void ipts_hid_disable(struct ipts_context *ipts)
+{
+	WRITE_ONCE(ipts->hid_active, false);
+}
+
+static int ipts_hid_start(struct hid_device *hid)
+{
+	return 0;
+}
+
+static void ipts_hid_stop(struct hid_device *hid)
+{
+}
+
+static int ipts_hid_parse(struct hid_device *hid)
+{
+	int ret = 0;
+	struct ipts_context *ipts = NULL;
+
+	u8 *buffer = NULL;
+	size_t size = 0;
+
+	if (!hid)
+		return -ENODEV;
+
+	ipts = hid->driver_data;
+
+	if (!ipts)
+		return -EFAULT;
+
+	if (!READ_ONCE(ipts->hid_active))
+		return -ENODEV;
+
+	if (ipts->info.intf_eds == 1)
+		ret = ipts_eds1_get_descriptor(ipts, &buffer, &size);
+	else
+		ret = ipts_eds2_get_descriptor(ipts, &buffer, &size);
+
+	if (ret) {
+		dev_err(ipts->dev, "Failed to allocate HID descriptor: %d\n", ret);
+		return ret;
+	}
+
+	ret = hid_parse_report(hid, buffer, size);
+	kfree(buffer);
+
+	if (ret) {
+		dev_err(ipts->dev, "Failed to parse HID descriptor: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+static int ipts_hid_raw_request(struct hid_device *hid, unsigned char report_id, __u8 *buffer,
+				size_t size, unsigned char report_type, int request_type)
+{
+	struct ipts_context *ipts = NULL;
+
+	if (!hid)
+		return -ENODEV;
+
+	ipts = hid->driver_data;
+
+	if (!ipts)
+		return -EFAULT;
+
+	if (!READ_ONCE(ipts->hid_active))
+		return -ENODEV;
+
+	if (ipts->info.intf_eds == 1) {
+		return ipts_eds1_raw_request(ipts, buffer, size, report_id, report_type,
+					     request_type);
+	} else {
+		return ipts_eds2_raw_request(ipts, buffer, size, report_id, report_type,
+					     request_type);
+	}
+}
+
+static struct hid_ll_driver ipts_hid_driver = {
+	.start = ipts_hid_start,
+	.stop = ipts_hid_stop,
+	.open = ipts_hid_start,
+	.close = ipts_hid_stop,
+	.parse = ipts_hid_parse,
+	.raw_request = ipts_hid_raw_request,
+};
+
+int ipts_hid_input_data(struct ipts_context *ipts, u32 buffer)
+{
+	u8 *temp = NULL;
+	struct ipts_hid_header *frame = NULL;
+	struct ipts_data_header *header = NULL;
+
+	if (!ipts)
+		return -EFAULT;
+
+	if (!ipts->hid)
+		return -ENODEV;
+
+	if (!READ_ONCE(ipts->hid_active))
+		return -ENODEV;
+
+	header = (struct ipts_data_header *)ipts->resources.data[buffer].address;
+
+	temp = ipts->resources.report.address;
+	memset(temp, 0, ipts->resources.report.size);
+
+	if (!header)
+		return -EFAULT;
+
+	if (header->size == 0)
+		return 0;
+
+	if (header->type == IPTS_DATA_TYPE_HID)
+		return hid_input_report(ipts->hid, HID_INPUT_REPORT, header->data, header->size, 1);
+
+	if (header->type == IPTS_DATA_TYPE_GET_FEATURES) {
+		ipts->feature_report.address = header->data;
+		ipts->feature_report.size = header->size;
+
+		complete_all(&ipts->feature_event);
+		return 0;
+	}
+
+	if (header->type != IPTS_DATA_TYPE_FRAME)
+		return 0;
+
+	if (header->size + 3 + sizeof(struct ipts_hid_header) > IPTS_HID_REPORT_DATA_SIZE)
+		return -ERANGE;
+
+	/*
+	 * Synthesize a HID report matching the devices that natively send HID reports
+	 */
+	temp[0] = IPTS_HID_REPORT_DATA;
+
+	frame = (struct ipts_hid_header *)&temp[3];
+	frame->type = IPTS_HID_FRAME_TYPE_RAW;
+	frame->size = header->size + sizeof(*frame);
+
+	memcpy(frame->data, header->data, header->size);
+
+	return hid_input_report(ipts->hid, HID_INPUT_REPORT, temp, IPTS_HID_REPORT_DATA_SIZE, 1);
+}
+
+int ipts_hid_init(struct ipts_context *ipts, struct ipts_device_info info)
+{
+	int ret = 0;
+
+	if (!ipts)
+		return -EFAULT;
+
+	if (ipts->hid)
+		return 0;
+
+	ipts->hid = hid_allocate_device();
+	if (IS_ERR(ipts->hid)) {
+		int err = PTR_ERR(ipts->hid);
+
+		dev_err(ipts->dev, "Failed to allocate HID device: %d\n", err);
+		return err;
+	}
+
+	ipts->hid->driver_data = ipts;
+	ipts->hid->dev.parent = ipts->dev;
+	ipts->hid->ll_driver = &ipts_hid_driver;
+
+	ipts->hid->vendor = info.vendor;
+	ipts->hid->product = info.product;
+	ipts->hid->group = HID_GROUP_GENERIC;
+
+	snprintf(ipts->hid->name, sizeof(ipts->hid->name), "IPTS %04X:%04X", info.vendor,
+		 info.product);
+
+	ret = hid_add_device(ipts->hid);
+	if (ret) {
+		dev_err(ipts->dev, "Failed to add HID device: %d\n", ret);
+		ipts_hid_free(ipts);
+		return ret;
+	}
+
+	return 0;
+}
+
+int ipts_hid_free(struct ipts_context *ipts)
+{
+	if (!ipts)
+		return -EFAULT;
+
+	if (!ipts->hid)
+		return 0;
+
+	hid_destroy_device(ipts->hid);
+	ipts->hid = NULL;
+
+	return 0;
+}
diff --git a/drivers/hid/ipts/hid.h b/drivers/hid/ipts/hid.h
new file mode 100644
index 000000000..1ebe77447
--- /dev/null
+++ b/drivers/hid/ipts/hid.h
@@ -0,0 +1,24 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (c) 2022-2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#ifndef IPTS_HID_H
+#define IPTS_HID_H
+
+#include <linux/types.h>
+
+#include "context.h"
+#include "spec-device.h"
+
+void ipts_hid_enable(struct ipts_context *ipts);
+void ipts_hid_disable(struct ipts_context *ipts);
+
+int ipts_hid_input_data(struct ipts_context *ipts, u32 buffer);
+
+int ipts_hid_init(struct ipts_context *ipts, struct ipts_device_info info);
+int ipts_hid_free(struct ipts_context *ipts);
+
+#endif /* IPTS_HID_H */
diff --git a/drivers/hid/ipts/main.c b/drivers/hid/ipts/main.c
new file mode 100644
index 000000000..fb5b5c13e
--- /dev/null
+++ b/drivers/hid/ipts/main.c
@@ -0,0 +1,126 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2020-2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#include <linux/completion.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/dma-mapping.h>
+#include <linux/mei_cl_bus.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/stddef.h>
+#include <linux/types.h>
+
+#include "context.h"
+#include "control.h"
+#include "mei.h"
+#include "receiver.h"
+#include "spec-device.h"
+
+/*
+ * The MEI client ID for IPTS functionality.
+ */
+#define IPTS_ID UUID_LE(0x3e8d0870, 0x271a, 0x4208, 0x8e, 0xb5, 0x9a, 0xcb, 0x94, 0x02, 0xae, 0x04)
+
+static int ipts_set_dma_mask(struct mei_cl_device *cldev)
+{
+	if (!cldev)
+		return -EFAULT;
+
+	if (!dma_coerce_mask_and_coherent(&cldev->dev, DMA_BIT_MASK(64)))
+		return 0;
+
+	return dma_coerce_mask_and_coherent(&cldev->dev, DMA_BIT_MASK(32));
+}
+
+static int ipts_probe(struct mei_cl_device *cldev, const struct mei_cl_device_id *id)
+{
+	int ret = 0;
+	struct ipts_context *ipts = NULL;
+
+	if (!cldev)
+		return -EFAULT;
+
+	ret = ipts_set_dma_mask(cldev);
+	if (ret) {
+		dev_err(&cldev->dev, "Failed to set DMA mask for IPTS: %d\n", ret);
+		return ret;
+	}
+
+	ret = mei_cldev_enable(cldev);
+	if (ret) {
+		dev_err(&cldev->dev, "Failed to enable MEI device: %d\n", ret);
+		return ret;
+	}
+
+	ipts = devm_kzalloc(&cldev->dev, sizeof(*ipts), GFP_KERNEL);
+	if (!ipts) {
+		mei_cldev_disable(cldev);
+		return -ENOMEM;
+	}
+
+	ret = ipts_mei_init(&ipts->mei, cldev);
+	if (ret) {
+		dev_err(&cldev->dev, "Failed to init MEI bus logic: %d\n", ret);
+		return ret;
+	}
+
+	ipts->dev = &cldev->dev;
+	ipts->mode = IPTS_MODE_EVENT;
+
+	mutex_init(&ipts->feature_lock);
+	init_completion(&ipts->feature_event);
+
+	mei_cldev_set_drvdata(cldev, ipts);
+
+	ret = ipts_control_start(ipts);
+	if (ret) {
+		dev_err(&cldev->dev, "Failed to start IPTS: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+static void ipts_remove(struct mei_cl_device *cldev)
+{
+	int ret = 0;
+	struct ipts_context *ipts = NULL;
+
+	if (!cldev) {
+		pr_err("MEI device is NULL!");
+		return;
+	}
+
+	ipts = mei_cldev_get_drvdata(cldev);
+
+	ret = ipts_control_stop(ipts);
+	if (ret)
+		dev_err(&cldev->dev, "Failed to stop IPTS: %d\n", ret);
+
+	mei_cldev_disable(cldev);
+}
+
+static struct mei_cl_device_id ipts_device_id_table[] = {
+	{ .uuid = IPTS_ID, .version = MEI_CL_VERSION_ANY },
+	{},
+};
+MODULE_DEVICE_TABLE(mei, ipts_device_id_table);
+
+static struct mei_cl_driver ipts_driver = {
+	.id_table = ipts_device_id_table,
+	.name = "ipts",
+	.probe = ipts_probe,
+	.remove = ipts_remove,
+};
+module_mei_cl_driver(ipts_driver);
+
+MODULE_DESCRIPTION("IPTS touchscreen driver");
+MODULE_AUTHOR("Dorian Stoll <dorian.stoll@tmsp.io>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/hid/ipts/mei.c b/drivers/hid/ipts/mei.c
new file mode 100644
index 000000000..1e0395cea
--- /dev/null
+++ b/drivers/hid/ipts/mei.c
@@ -0,0 +1,188 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#include <linux/device.h>
+#include <linux/errno.h>
+#include <linux/jiffies.h>
+#include <linux/list.h>
+#include <linux/mei_cl_bus.h>
+#include <linux/printk.h>
+#include <linux/rwsem.h>
+#include <linux/types.h>
+#include <linux/wait.h>
+
+#include "context.h"
+#include "mei.h"
+
+static void locked_list_add(struct list_head *new, struct list_head *head,
+			    struct rw_semaphore *lock)
+{
+	down_write(lock);
+	list_add(new, head);
+	up_write(lock);
+}
+
+static void locked_list_del(struct list_head *entry, struct rw_semaphore *lock)
+{
+	down_write(lock);
+	list_del(entry);
+	up_write(lock);
+}
+
+static void ipts_mei_incoming(struct mei_cl_device *cldev)
+{
+	ssize_t ret = 0;
+	struct ipts_mei_message *entry = NULL;
+	struct ipts_context *ipts = NULL;
+
+	if (!cldev) {
+		pr_err("MEI device is NULL!");
+		return;
+	}
+
+	ipts = mei_cldev_get_drvdata(cldev);
+	if (!ipts) {
+		pr_err("IPTS driver context is NULL!");
+		return;
+	}
+
+	entry = devm_kzalloc(ipts->dev, sizeof(*entry), GFP_KERNEL);
+	if (!entry)
+		return;
+
+	INIT_LIST_HEAD(&entry->list);
+
+	do {
+		ret = mei_cldev_recv(cldev, (u8 *)&entry->rsp, sizeof(entry->rsp));
+	} while (ret == -EINTR);
+
+	if (ret < 0) {
+		dev_err(ipts->dev, "Error while reading response: %ld\n", ret);
+		return;
+	}
+
+	if (ret == 0) {
+		dev_err(ipts->dev, "Received empty response\n");
+		return;
+	}
+
+	locked_list_add(&entry->list, &ipts->mei.messages, &ipts->mei.message_lock);
+	wake_up_all(&ipts->mei.message_queue);
+}
+
+static int ipts_mei_search(struct ipts_mei *mei, enum ipts_command_code code,
+			   struct ipts_response *rsp)
+{
+	struct ipts_mei_message *entry = NULL;
+
+	if (!mei)
+		return -EFAULT;
+
+	if (!rsp)
+		return -EFAULT;
+
+	down_read(&mei->message_lock);
+
+	/*
+	 * Iterate over the list of received messages, and check if there is one
+	 * matching the requested command code.
+	 */
+	list_for_each_entry(entry, &mei->messages, list) {
+		if (entry->rsp.cmd == code)
+			break;
+	}
+
+	up_read(&mei->message_lock);
+
+	/*
+	 * If entry is not the list head, this means that the loop above has been stopped early,
+	 * and that we found a matching element. We drop the message from the list and return it.
+	 */
+	if (!list_entry_is_head(entry, &mei->messages, list)) {
+		locked_list_del(&entry->list, &mei->message_lock);
+
+		*rsp = entry->rsp;
+		devm_kfree(&mei->cldev->dev, entry);
+
+		return 0;
+	}
+
+	return -EAGAIN;
+}
+
+int ipts_mei_recv(struct ipts_mei *mei, enum ipts_command_code code, struct ipts_response *rsp,
+		  u64 timeout)
+{
+	int ret = 0;
+
+	if (!mei)
+		return -EFAULT;
+
+	/*
+	 * A timeout of 0 means check and return immideately.
+	 */
+	if (timeout == 0)
+		return ipts_mei_search(mei, code, rsp);
+
+	/*
+	 * A timeout of less than 0 means to wait forever.
+	 */
+	if (timeout < 0) {
+		wait_event(mei->message_queue, ipts_mei_search(mei, code, rsp) == 0);
+		return 0;
+	}
+
+	ret = wait_event_timeout(mei->message_queue, ipts_mei_search(mei, code, rsp) == 0,
+				 msecs_to_jiffies(timeout));
+
+	if (ret > 0)
+		return 0;
+
+	return -EAGAIN;
+}
+
+int ipts_mei_send(struct ipts_mei *mei, void *data, size_t length)
+{
+	int ret = 0;
+
+	if (!mei)
+		return -EFAULT;
+
+	if (!mei->cldev)
+		return -EFAULT;
+
+	if (!data)
+		return -EFAULT;
+
+	do {
+		ret = mei_cldev_send(mei->cldev, (u8 *)data, length);
+	} while (ret == -EINTR);
+
+	if (ret < 0)
+		return ret;
+
+	return 0;
+}
+
+int ipts_mei_init(struct ipts_mei *mei, struct mei_cl_device *cldev)
+{
+	if (!mei)
+		return -EFAULT;
+
+	if (!cldev)
+		return -EFAULT;
+
+	mei->cldev = cldev;
+
+	INIT_LIST_HEAD(&mei->messages);
+	init_waitqueue_head(&mei->message_queue);
+	init_rwsem(&mei->message_lock);
+
+	mei_cldev_register_rx_cb(cldev, ipts_mei_incoming);
+
+	return 0;
+}
diff --git a/drivers/hid/ipts/mei.h b/drivers/hid/ipts/mei.h
new file mode 100644
index 000000000..973bade6b
--- /dev/null
+++ b/drivers/hid/ipts/mei.h
@@ -0,0 +1,66 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (c) 2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#ifndef IPTS_MEI_H
+#define IPTS_MEI_H
+
+#include <linux/list.h>
+#include <linux/mei_cl_bus.h>
+#include <linux/rwsem.h>
+#include <linux/types.h>
+#include <linux/wait.h>
+
+#include "spec-device.h"
+
+struct ipts_mei_message {
+	struct list_head list;
+	struct ipts_response rsp;
+};
+
+struct ipts_mei {
+	struct mei_cl_device *cldev;
+
+	struct list_head messages;
+
+	wait_queue_head_t message_queue;
+	struct rw_semaphore message_lock;
+};
+
+/**
+ * ipts_mei_recv() - Receive data from a MEI device.
+ * @mei: The IPTS MEI device context.
+ * @code: The IPTS command code to look for.
+ * @rsp: The address that the received data will be copied to.
+ * @timeout: How many milliseconds the function will wait at most.
+ *
+ * A negative timeout means to wait forever.
+ *
+ * Returns: 0 on success, <0 on error, -EAGAIN if no response has been received.
+ */
+int ipts_mei_recv(struct ipts_mei *mei, enum ipts_command_code code, struct ipts_response *rsp,
+		  u64 timeout);
+
+/**
+ * ipts_mei_send() - Send data to a MEI device.
+ * @ipts: The IPTS MEI device context.
+ * @data: The data to send.
+ * @size: The size of the data.
+ *
+ * Returns: 0 on success, <0 on error.
+ */
+int ipts_mei_send(struct ipts_mei *mei, void *data, size_t length);
+
+/**
+ * ipts_mei_init() - Initialize the MEI device context.
+ * @mei: The MEI device context to initialize.
+ * @cldev: The MEI device the context will be bound to.
+ *
+ * Returns: 0 on success, <0 on error.
+ */
+int ipts_mei_init(struct ipts_mei *mei, struct mei_cl_device *cldev);
+
+#endif /* IPTS_MEI_H */
diff --git a/drivers/hid/ipts/receiver.c b/drivers/hid/ipts/receiver.c
new file mode 100644
index 000000000..ef66c3c9d
--- /dev/null
+++ b/drivers/hid/ipts/receiver.c
@@ -0,0 +1,250 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2020-2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/kthread.h>
+#include <linux/time64.h>
+#include <linux/timekeeping.h>
+#include <linux/types.h>
+
+#include "cmd.h"
+#include "context.h"
+#include "control.h"
+#include "hid.h"
+#include "resources.h"
+#include "spec-device.h"
+#include "thread.h"
+
+static void ipts_receiver_next_doorbell(struct ipts_context *ipts)
+{
+	u32 *doorbell = (u32 *)ipts->resources.doorbell.address;
+	*doorbell = *doorbell + 1;
+}
+
+static u32 ipts_receiver_current_doorbell(struct ipts_context *ipts)
+{
+	u32 *doorbell = (u32 *)ipts->resources.doorbell.address;
+	return *doorbell;
+}
+
+static void ipts_receiver_backoff(time64_t last, u32 n)
+{
+	/*
+	 * If the last change was less than n seconds ago,
+	 * sleep for a shorter period so that new data can be
+	 * processed quickly. If there was no change for more than
+	 * n seconds, sleep longer to avoid wasting CPU cycles.
+	 */
+	if (last + n > ktime_get_seconds())
+		usleep_range(1 * USEC_PER_MSEC, 5 * USEC_PER_MSEC);
+	else
+		msleep(200);
+}
+
+static int ipts_receiver_event_loop(struct ipts_thread *thread)
+{
+	int ret = 0;
+	u32 buffer = 0;
+
+	struct ipts_context *ipts = NULL;
+	time64_t last = ktime_get_seconds();
+
+	if (!thread)
+		return -EFAULT;
+
+	ipts = thread->data;
+
+	if (!ipts)
+		return -EFAULT;
+
+	dev_info(ipts->dev, "IPTS running in event mode\n");
+
+	while (!ipts_thread_should_stop(thread)) {
+		int i = 0;
+
+		for (i = 0; i < IPTS_BUFFERS; i++) {
+			ret = ipts_control_wait_data(ipts, false);
+			if (ret == -EAGAIN)
+				break;
+
+			if (ret) {
+				dev_err(ipts->dev, "Failed to wait for data: %d\n", ret);
+				continue;
+			}
+
+			buffer = ipts_receiver_current_doorbell(ipts) % IPTS_BUFFERS;
+			ipts_receiver_next_doorbell(ipts);
+
+			ret = ipts_hid_input_data(ipts, buffer);
+			if (ret)
+				dev_err(ipts->dev, "Failed to process buffer: %d\n", ret);
+
+			ret = ipts_control_refill_buffer(ipts, buffer);
+			if (ret)
+				dev_err(ipts->dev, "Failed to send feedback: %d\n", ret);
+
+			ret = ipts_control_request_data(ipts);
+			if (ret)
+				dev_err(ipts->dev, "Failed to request data: %d\n", ret);
+
+			last = ktime_get_seconds();
+		}
+
+		ipts_receiver_backoff(last, 5);
+	}
+
+	ret = ipts_control_request_flush(ipts);
+	if (ret) {
+		dev_err(ipts->dev, "Failed to request flush: %d\n", ret);
+		return ret;
+	}
+
+	ret = ipts_control_wait_data(ipts, true);
+	if (ret) {
+		dev_err(ipts->dev, "Failed to wait for data: %d\n", ret);
+
+		if (ret != -EAGAIN)
+			return ret;
+		else
+			return 0;
+	}
+
+	ret = ipts_control_wait_flush(ipts);
+	if (ret) {
+		dev_err(ipts->dev, "Failed to wait for flush: %d\n", ret);
+
+		if (ret != -EAGAIN)
+			return ret;
+		else
+			return 0;
+	}
+
+	return 0;
+}
+
+static int ipts_receiver_poll_loop(struct ipts_thread *thread)
+{
+	int ret = 0;
+	u32 buffer = 0;
+
+	u32 doorbell = 0;
+	u32 lastdb = 0;
+
+	struct ipts_context *ipts = NULL;
+	time64_t last = ktime_get_seconds();
+
+	if (!thread)
+		return -EFAULT;
+
+	ipts = thread->data;
+
+	if (!ipts)
+		return -EFAULT;
+
+	dev_info(ipts->dev, "IPTS running in poll mode\n");
+
+	while (true) {
+		if (ipts_thread_should_stop(thread)) {
+			ret = ipts_control_request_flush(ipts);
+			if (ret) {
+				dev_err(ipts->dev, "Failed to request flush: %d\n", ret);
+				return ret;
+			}
+		}
+
+		doorbell = ipts_receiver_current_doorbell(ipts);
+
+		/*
+		 * After filling up one of the data buffers, IPTS will increment
+		 * the doorbell. The value of the doorbell stands for the *next*
+		 * buffer that IPTS is going to fill.
+		 */
+		while (lastdb != doorbell) {
+			buffer = lastdb % IPTS_BUFFERS;
+
+			ret = ipts_hid_input_data(ipts, buffer);
+			if (ret)
+				dev_err(ipts->dev, "Failed to process buffer: %d\n", ret);
+
+			ret = ipts_control_refill_buffer(ipts, buffer);
+			if (ret)
+				dev_err(ipts->dev, "Failed to send feedback: %d\n", ret);
+
+			last = ktime_get_seconds();
+			lastdb++;
+		}
+
+		if (ipts_thread_should_stop(thread))
+			break;
+
+		ipts_receiver_backoff(last, 5);
+	}
+
+	ret = ipts_control_wait_data(ipts, true);
+	if (ret) {
+		dev_err(ipts->dev, "Failed to wait for data: %d\n", ret);
+
+		if (ret != -EAGAIN)
+			return ret;
+		else
+			return 0;
+	}
+
+	ret = ipts_control_wait_flush(ipts);
+	if (ret) {
+		dev_err(ipts->dev, "Failed to wait for flush: %d\n", ret);
+
+		if (ret != -EAGAIN)
+			return ret;
+		else
+			return 0;
+	}
+
+	return 0;
+}
+
+int ipts_receiver_start(struct ipts_context *ipts)
+{
+	int ret = 0;
+
+	if (!ipts)
+		return -EFAULT;
+
+	if (ipts->mode == IPTS_MODE_EVENT) {
+		ret = ipts_thread_start(&ipts->receiver_loop, ipts_receiver_event_loop, ipts,
+					"ipts_event");
+	} else if (ipts->mode == IPTS_MODE_POLL) {
+		ret = ipts_thread_start(&ipts->receiver_loop, ipts_receiver_poll_loop, ipts,
+					"ipts_poll");
+	} else {
+		ret = -EINVAL;
+	}
+
+	if (ret) {
+		dev_err(ipts->dev, "Failed to start receiver loop: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+int ipts_receiver_stop(struct ipts_context *ipts)
+{
+	int ret = 0;
+
+	if (!ipts)
+		return -EFAULT;
+
+	ret = ipts_thread_stop(&ipts->receiver_loop);
+	if (ret) {
+		dev_err(ipts->dev, "Failed to stop receiver loop: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
diff --git a/drivers/hid/ipts/receiver.h b/drivers/hid/ipts/receiver.h
new file mode 100644
index 000000000..3de7da62d
--- /dev/null
+++ b/drivers/hid/ipts/receiver.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (c) 2020-2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#ifndef IPTS_RECEIVER_H
+#define IPTS_RECEIVER_H
+
+#include "context.h"
+
+int ipts_receiver_start(struct ipts_context *ipts);
+int ipts_receiver_stop(struct ipts_context *ipts);
+
+#endif /* IPTS_RECEIVER_H */
diff --git a/drivers/hid/ipts/resources.c b/drivers/hid/ipts/resources.c
new file mode 100644
index 000000000..cc14653b2
--- /dev/null
+++ b/drivers/hid/ipts/resources.c
@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2020-2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#include <linux/dma-mapping.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+
+#include "desc.h"
+#include "resources.h"
+#include "spec-device.h"
+
+static int ipts_resources_alloc_buffer(struct ipts_buffer *buffer, struct device *dev, size_t size)
+{
+	if (!buffer)
+		return -EFAULT;
+
+	if (buffer->address)
+		return 0;
+
+	buffer->address = dma_alloc_coherent(dev, size, &buffer->dma_address, GFP_KERNEL);
+
+	if (!buffer->address)
+		return -ENOMEM;
+
+	buffer->size = size;
+	buffer->device = dev;
+
+	return 0;
+}
+
+static void ipts_resources_free_buffer(struct ipts_buffer *buffer)
+{
+	if (!buffer->address)
+		return;
+
+	dma_free_coherent(buffer->device, buffer->size, buffer->address, buffer->dma_address);
+
+	buffer->address = NULL;
+	buffer->size = 0;
+
+	buffer->dma_address = 0;
+	buffer->device = NULL;
+}
+
+int ipts_resources_init(struct ipts_resources *res, struct device *dev, size_t ds, size_t fs)
+{
+	int ret = 0;
+
+	/*
+	 * Some compilers (AOSP clang) complain about a redefined
+	 * variable when this is declared inside of the for loop.
+	 */
+	int i = 0;
+
+	if (!res)
+		return -EFAULT;
+
+	for (i = 0; i < IPTS_BUFFERS; i++) {
+		ret = ipts_resources_alloc_buffer(&res->data[i], dev, ds);
+		if (ret)
+			goto err;
+	}
+
+	for (i = 0; i < IPTS_BUFFERS; i++) {
+		ret = ipts_resources_alloc_buffer(&res->feedback[i], dev, fs);
+		if (ret)
+			goto err;
+	}
+
+	ret = ipts_resources_alloc_buffer(&res->doorbell, dev, sizeof(u32));
+	if (ret)
+		goto err;
+
+	ret = ipts_resources_alloc_buffer(&res->workqueue, dev, sizeof(u32));
+	if (ret)
+		goto err;
+
+	ret = ipts_resources_alloc_buffer(&res->hid2me, dev, fs);
+	if (ret)
+		goto err;
+
+	ret = ipts_resources_alloc_buffer(&res->descriptor, dev, ds + 8);
+	if (ret)
+		goto err;
+
+	if (!res->report.address) {
+		res->report.size = IPTS_HID_REPORT_DATA_SIZE;
+		res->report.address = kzalloc(res->report.size, GFP_KERNEL);
+
+		if (!res->report.address) {
+			ret = -ENOMEM;
+			goto err;
+		}
+	}
+
+	return 0;
+
+err:
+
+	ipts_resources_free(res);
+	return ret;
+}
+
+int ipts_resources_free(struct ipts_resources *res)
+{
+	int i = 0;
+
+	if (!res)
+		return -EFAULT;
+
+	for (i = 0; i < IPTS_BUFFERS; i++)
+		ipts_resources_free_buffer(&res->data[i]);
+
+	for (i = 0; i < IPTS_BUFFERS; i++)
+		ipts_resources_free_buffer(&res->feedback[i]);
+
+	ipts_resources_free_buffer(&res->doorbell);
+	ipts_resources_free_buffer(&res->workqueue);
+	ipts_resources_free_buffer(&res->hid2me);
+	ipts_resources_free_buffer(&res->descriptor);
+
+	kfree(res->report.address);
+	res->report.address = NULL;
+	res->report.size = 0;
+
+	return 0;
+}
diff --git a/drivers/hid/ipts/resources.h b/drivers/hid/ipts/resources.h
new file mode 100644
index 000000000..2068e1328
--- /dev/null
+++ b/drivers/hid/ipts/resources.h
@@ -0,0 +1,41 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (c) 2020-2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#ifndef IPTS_RESOURCES_H
+#define IPTS_RESOURCES_H
+
+#include <linux/device.h>
+#include <linux/types.h>
+
+#include "spec-device.h"
+
+struct ipts_buffer {
+	u8 *address;
+	size_t size;
+
+	dma_addr_t dma_address;
+	struct device *device;
+};
+
+struct ipts_resources {
+	struct ipts_buffer data[IPTS_BUFFERS];
+	struct ipts_buffer feedback[IPTS_BUFFERS];
+
+	struct ipts_buffer doorbell;
+	struct ipts_buffer workqueue;
+	struct ipts_buffer hid2me;
+
+	struct ipts_buffer descriptor;
+
+	// Buffer for synthesizing HID reports
+	struct ipts_buffer report;
+};
+
+int ipts_resources_init(struct ipts_resources *res, struct device *dev, size_t ds, size_t fs);
+int ipts_resources_free(struct ipts_resources *res);
+
+#endif /* IPTS_RESOURCES_H */
diff --git a/drivers/hid/ipts/spec-data.h b/drivers/hid/ipts/spec-data.h
new file mode 100644
index 000000000..e8dd98895
--- /dev/null
+++ b/drivers/hid/ipts/spec-data.h
@@ -0,0 +1,100 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (c) 2016 Intel Corporation
+ * Copyright (c) 2020-2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#ifndef IPTS_SPEC_DATA_H
+#define IPTS_SPEC_DATA_H
+
+#include <linux/build_bug.h>
+#include <linux/types.h>
+
+/**
+ * enum ipts_feedback_cmd_type - Commands that can be executed on the sensor through feedback.
+ */
+enum ipts_feedback_cmd_type {
+	IPTS_FEEDBACK_CMD_TYPE_NONE = 0,
+	IPTS_FEEDBACK_CMD_TYPE_SOFT_RESET = 1,
+	IPTS_FEEDBACK_CMD_TYPE_GOTO_ARMED = 2,
+	IPTS_FEEDBACK_CMD_TYPE_GOTO_SENSING = 3,
+	IPTS_FEEDBACK_CMD_TYPE_GOTO_SLEEP = 4,
+	IPTS_FEEDBACK_CMD_TYPE_GOTO_DOZE = 5,
+	IPTS_FEEDBACK_CMD_TYPE_HARD_RESET = 6,
+};
+
+/**
+ * enum ipts_feedback_data_type - Defines what data a feedback buffer contains.
+ * @IPTS_FEEDBACK_DATA_TYPE_VENDOR:        The buffer contains vendor specific feedback.
+ * @IPTS_FEEDBACK_DATA_TYPE_SET_FEATURES:  The buffer contains a HID set features report.
+ * @IPTS_FEEDBACK_DATA_TYPE_GET_FEATURES:  The buffer contains a HID get features report.
+ * @IPTS_FEEDBACK_DATA_TYPE_OUTPUT_REPORT: The buffer contains a HID output report.
+ * @IPTS_FEEDBACK_DATA_TYPE_STORE_DATA:    The buffer contains calibration data for the sensor.
+ */
+enum ipts_feedback_data_type {
+	IPTS_FEEDBACK_DATA_TYPE_VENDOR = 0,
+	IPTS_FEEDBACK_DATA_TYPE_SET_FEATURES = 1,
+	IPTS_FEEDBACK_DATA_TYPE_GET_FEATURES = 2,
+	IPTS_FEEDBACK_DATA_TYPE_OUTPUT_REPORT = 3,
+	IPTS_FEEDBACK_DATA_TYPE_STORE_DATA = 4,
+};
+
+/**
+ * struct ipts_feedback_header - Header that is prefixed to the data in a feedback buffer.
+ * @cmd_type:   A command that should be executed on the sensor.
+ * @size:       The size of the payload to be written.
+ * @buffer:     The ID of the buffer that contains this feedback data.
+ * @protocol:   The protocol version of the EDS.
+ * @data_type:  The type of data that the buffer contains.
+ * @spi_offset: The offset at which to write the payload data to the sensor.
+ * @payload:    Payload for the feedback command, or 0 if no payload is sent.
+ */
+struct ipts_feedback_header {
+	enum ipts_feedback_cmd_type cmd_type;
+	u32 size;
+	u32 buffer;
+	u32 protocol;
+	enum ipts_feedback_data_type data_type;
+	u32 spi_offset;
+	u8 reserved[40];
+	u8 payload[];
+} __packed;
+
+static_assert(sizeof(struct ipts_feedback_header) == 64);
+
+/**
+ * enum ipts_data_type - Defines what type of data a buffer contains.
+ * @IPTS_DATA_TYPE_FRAME:        Raw data frame.
+ * @IPTS_DATA_TYPE_ERROR:        Error data.
+ * @IPTS_DATA_TYPE_VENDOR:       Vendor specific data.
+ * @IPTS_DATA_TYPE_HID:          A HID report.
+ * @IPTS_DATA_TYPE_GET_FEATURES: The response to a GET_FEATURES HID2ME command.
+ */
+enum ipts_data_type {
+	IPTS_DATA_TYPE_FRAME = 0x00,
+	IPTS_DATA_TYPE_ERROR = 0x01,
+	IPTS_DATA_TYPE_VENDOR = 0x02,
+	IPTS_DATA_TYPE_HID = 0x03,
+	IPTS_DATA_TYPE_GET_FEATURES = 0x04,
+	IPTS_DATA_TYPE_DESCRIPTOR = 0x05,
+};
+
+/**
+ * struct ipts_data_header - Header that is prefixed to the data in a data buffer.
+ * @type: What data the buffer contains.
+ * @size: How much data the buffer contains.
+ * @buffer: Which buffer the data is in.
+ */
+struct ipts_data_header {
+	enum ipts_data_type type;
+	u32 size;
+	u32 buffer;
+	u8 reserved[52];
+	u8 data[];
+} __packed;
+
+static_assert(sizeof(struct ipts_data_header) == 64);
+
+#endif /* IPTS_SPEC_DATA_H */
diff --git a/drivers/hid/ipts/spec-device.h b/drivers/hid/ipts/spec-device.h
new file mode 100644
index 000000000..41845f9d9
--- /dev/null
+++ b/drivers/hid/ipts/spec-device.h
@@ -0,0 +1,290 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (c) 2016 Intel Corporation
+ * Copyright (c) 2020-2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#ifndef IPTS_SPEC_DEVICE_H
+#define IPTS_SPEC_DEVICE_H
+
+#include <linux/build_bug.h>
+#include <linux/types.h>
+
+/*
+ * The amount of buffers that IPTS can use for data transfer.
+ */
+#define IPTS_BUFFERS 16
+
+/*
+ * The buffer ID that is used for HID2ME feedback
+ */
+#define IPTS_HID2ME_BUFFER IPTS_BUFFERS
+
+/**
+ * enum ipts_command - Commands that can be sent to the IPTS hardware.
+ * @IPTS_CMD_GET_DEVICE_INFO:  Retrieves vendor information from the device.
+ * @IPTS_CMD_SET_MODE:         Changes the mode that the device will operate in.
+ * @IPTS_CMD_SET_MEM_WINDOW:   Configures memory buffers for passing data between device and driver.
+ * @IPTS_CMD_QUIESCE_IO:       Stops the data flow from the device to the driver.
+ * @IPTS_CMD_READY_FOR_DATA:   Informs the device that the driver is ready to receive data.
+ * @IPTS_CMD_FEEDBACK:         Informs the device that a buffer was processed and can be refilled.
+ * @IPTS_CMD_CLEAR_MEM_WINDOW: Stops the data flow and clears the buffer addresses on the device.
+ * @IPTS_CMD_RESET_SENSOR:     Resets the sensor to its default state.
+ * @IPTS_CMD_GET_DESCRIPTOR:   Retrieves the HID descriptor of the device.
+ */
+enum ipts_command_code {
+	IPTS_CMD_GET_DEVICE_INFO = 0x01,
+	IPTS_CMD_SET_MODE = 0x02,
+	IPTS_CMD_SET_MEM_WINDOW = 0x03,
+	IPTS_CMD_QUIESCE_IO = 0x04,
+	IPTS_CMD_READY_FOR_DATA = 0x05,
+	IPTS_CMD_FEEDBACK = 0x06,
+	IPTS_CMD_CLEAR_MEM_WINDOW = 0x07,
+	IPTS_CMD_RESET_SENSOR = 0x0B,
+	IPTS_CMD_GET_DESCRIPTOR = 0x0F,
+};
+
+/**
+ * enum ipts_status - Possible status codes returned by the IPTS device.
+ * @IPTS_STATUS_SUCCESS:                 Operation completed successfully.
+ * @IPTS_STATUS_INVALID_PARAMS:          Command contained an invalid payload.
+ * @IPTS_STATUS_ACCESS_DENIED:           ME could not validate a buffer address.
+ * @IPTS_STATUS_CMD_SIZE_ERROR:          Command contains an invalid payload.
+ * @IPTS_STATUS_NOT_READY:               Buffer addresses have not been set.
+ * @IPTS_STATUS_REQUEST_OUTSTANDING:     There is an outstanding command of the same type.
+ * @IPTS_STATUS_NO_SENSOR_FOUND:         No sensor could be found.
+ * @IPTS_STATUS_OUT_OF_MEMORY:           Not enough free memory for requested operation.
+ * @IPTS_STATUS_INTERNAL_ERROR:          An unexpected error occurred.
+ * @IPTS_STATUS_SENSOR_DISABLED:         The sensor has been disabled and must be reinitialized.
+ * @IPTS_STATUS_COMPAT_CHECK_FAIL:       Compatibility revision check between sensor and ME failed.
+ *                                       The host can ignore this error and attempt to continue.
+ * @IPTS_STATUS_SENSOR_EXPECTED_RESET:   The sensor went through a reset initiated by the driver.
+ * @IPTS_STATUS_SENSOR_UNEXPECTED_RESET: The sensor went through an unexpected reset.
+ * @IPTS_STATUS_RESET_FAILED:            Requested sensor reset failed to complete.
+ * @IPTS_STATUS_TIMEOUT:                 The operation timed out.
+ * @IPTS_STATUS_TEST_MODE_FAIL:          Test mode pattern did not match expected values.
+ * @IPTS_STATUS_SENSOR_FAIL_FATAL:       The sensor reported an error during reset sequence.
+ *                                       Further progress is not possible.
+ * @IPTS_STATUS_SENSOR_FAIL_NONFATAL:    The sensor reported an error during reset sequence.
+ *                                       The driver can attempt to continue.
+ * @IPTS_STATUS_INVALID_DEVICE_CAPS:     The device reported invalid capabilities.
+ * @IPTS_STATUS_QUIESCE_IO_IN_PROGRESS:  Command cannot be completed until Quiesce IO is done.
+ */
+enum ipts_status {
+	IPTS_STATUS_SUCCESS = 0x00,
+	IPTS_STATUS_INVALID_PARAMS = 0x01,
+	IPTS_STATUS_ACCESS_DENIED = 0x02,
+	IPTS_STATUS_CMD_SIZE_ERROR = 0x03,
+	IPTS_STATUS_NOT_READY = 0x04,
+	IPTS_STATUS_REQUEST_OUTSTANDING = 0x05,
+	IPTS_STATUS_NO_SENSOR_FOUND = 0x06,
+	IPTS_STATUS_OUT_OF_MEMORY = 0x07,
+	IPTS_STATUS_INTERNAL_ERROR = 0x08,
+	IPTS_STATUS_SENSOR_DISABLED = 0x09,
+	IPTS_STATUS_COMPAT_CHECK_FAIL = 0x0A,
+	IPTS_STATUS_SENSOR_EXPECTED_RESET = 0x0B,
+	IPTS_STATUS_SENSOR_UNEXPECTED_RESET = 0x0C,
+	IPTS_STATUS_RESET_FAILED = 0x0D,
+	IPTS_STATUS_TIMEOUT = 0x0E,
+	IPTS_STATUS_TEST_MODE_FAIL = 0x0F,
+	IPTS_STATUS_SENSOR_FAIL_FATAL = 0x10,
+	IPTS_STATUS_SENSOR_FAIL_NONFATAL = 0x11,
+	IPTS_STATUS_INVALID_DEVICE_CAPS = 0x12,
+	IPTS_STATUS_QUIESCE_IO_IN_PROGRESS = 0x13,
+};
+
+/**
+ * struct ipts_command - Message that is sent to the device for calling a command.
+ * @cmd:     The command that will be called.
+ * @payload: Payload containing parameters for the called command.
+ */
+struct ipts_command {
+	enum ipts_command_code cmd;
+	u8 payload[320];
+} __packed;
+
+static_assert(sizeof(struct ipts_command) == 324);
+
+/**
+ * enum ipts_mode - Configures what data the device produces and how its sent.
+ * @IPTS_MODE_EVENT: The device will send an event once a buffer was filled.
+ *                   Older devices will return singletouch data in this mode.
+ * @IPTS_MODE_POLL:  The device will notify the driver by incrementing the doorbell value.
+ *                   Older devices will return multitouch data in this mode.
+ */
+enum ipts_mode {
+	IPTS_MODE_EVENT = 0x00,
+	IPTS_MODE_POLL = 0x01,
+};
+
+/**
+ * struct ipts_set_mode - Payload for the SET_MODE command.
+ * @mode: Changes the mode that IPTS will operate in.
+ */
+struct ipts_set_mode {
+	enum ipts_mode mode;
+	u8 reserved[12];
+} __packed;
+
+static_assert(sizeof(struct ipts_set_mode) == 16);
+
+#define IPTS_WORKQUEUE_SIZE	 8192
+#define IPTS_WORKQUEUE_ITEM_SIZE 16
+
+/**
+ * struct ipts_mem_window - Payload for the SET_MEM_WINDOW command.
+ * @data_addr_lower:      Lower 32 bits of the data buffer addresses.
+ * @data_addr_upper:      Upper 32 bits of the data buffer addresses.
+ * @workqueue_addr_lower: Lower 32 bits of the workqueue buffer address.
+ * @workqueue_addr_upper: Upper 32 bits of the workqueue buffer address.
+ * @doorbell_addr_lower:  Lower 32 bits of the doorbell buffer address.
+ * @doorbell_addr_upper:  Upper 32 bits of the doorbell buffer address.
+ * @feedbackaddr_lower:   Lower 32 bits of the feedback buffer addresses.
+ * @feedbackaddr_upper:   Upper 32 bits of the feedback buffer addresses.
+ * @hid2me_addr_lower:    Lower 32 bits of the hid2me buffer address.
+ * @hid2me_addr_upper:    Upper 32 bits of the hid2me buffer address.
+ * @hid2me_size:          Size of the hid2me feedback buffer.
+ * @workqueue_item_size:  Magic value. Must be 16.
+ * @workqueue_size:       Magic value. Must be 8192.
+ *
+ * The workqueue related items in this struct are required for using
+ * GuC submission with binary processing firmware. Since this driver does
+ * not use GuC submission and instead exports raw data to userspace, these
+ * items are not actually used, but they need to be allocated and passed
+ * to the device, otherwise initialization will fail.
+ */
+struct ipts_mem_window {
+	u32 data_addr_lower[IPTS_BUFFERS];
+	u32 data_addr_upper[IPTS_BUFFERS];
+	u32 workqueue_addr_lower;
+	u32 workqueue_addr_upper;
+	u32 doorbell_addr_lower;
+	u32 doorbell_addr_upper;
+	u32 feedback_addr_lower[IPTS_BUFFERS];
+	u32 feedback_addr_upper[IPTS_BUFFERS];
+	u32 hid2me_addr_lower;
+	u32 hid2me_addr_upper;
+	u32 hid2me_size;
+	u8 reserved1;
+	u8 workqueue_item_size;
+	u16 workqueue_size;
+	u8 reserved[32];
+} __packed;
+
+static_assert(sizeof(struct ipts_mem_window) == 320);
+
+/**
+ * struct ipts_quiesce_io - Payload for the QUIESCE_IO command.
+ */
+struct ipts_quiesce_io {
+	u8 reserved[12];
+} __packed;
+
+static_assert(sizeof(struct ipts_quiesce_io) == 12);
+
+/**
+ * struct ipts_feedback - Payload for the FEEDBACK command.
+ * @buffer: The buffer that the device should refill.
+ */
+struct ipts_feedback {
+	u32 buffer;
+	u8 reserved[12];
+} __packed;
+
+static_assert(sizeof(struct ipts_feedback) == 16);
+
+/**
+ * enum ipts_reset_type - Possible ways of resetting the device.
+ * @IPTS_RESET_TYPE_HARD: Perform hardware reset using GPIO pin.
+ * @IPTS_RESET_TYPE_SOFT: Perform software reset using SPI command.
+ */
+enum ipts_reset_type {
+	IPTS_RESET_TYPE_HARD = 0x00,
+	IPTS_RESET_TYPE_SOFT = 0x01,
+};
+
+/**
+ * struct ipts_reset - Payload for the RESET_SENSOR command.
+ * @type: How the device should get reset.
+ */
+struct ipts_reset_sensor {
+	enum ipts_reset_type type;
+	u8 reserved[4];
+} __packed;
+
+static_assert(sizeof(struct ipts_reset_sensor) == 8);
+
+/**
+ * struct ipts_get_descriptor - Payload for the GET_DESCRIPTOR command.
+ * @addr_lower: The lower 32 bits of the descriptor buffer address.
+ * @addr_upper: The upper 32 bits of the descriptor buffer address.
+ * @magic:      A magic value. Must be 8.
+ */
+struct ipts_get_descriptor {
+	u32 addr_lower;
+	u32 addr_upper;
+	u32 magic;
+	u8 reserved[12];
+} __packed;
+
+static_assert(sizeof(struct ipts_get_descriptor) == 24);
+
+/*
+ * The type of a response is indicated by a
+ * command code, with the most significant bit flipped to 1.
+ */
+#define IPTS_RSP_BIT BIT(31)
+
+/**
+ * struct ipts_response - Data returned from the device in response to a command.
+ * @cmd:     The command that this response answers (IPTS_RSP_BIT will be 1).
+ * @status:  The return code of the command.
+ * @payload: The data that was produced by the command.
+ */
+struct ipts_response {
+	enum ipts_command_code cmd;
+	enum ipts_status status;
+	u8 payload[80];
+} __packed;
+
+static_assert(sizeof(struct ipts_response) == 88);
+
+/**
+ * struct ipts_device_info - Vendor information of the IPTS device.
+ * @vendor:         Vendor ID of this device.
+ * @product:        Product ID of this device.
+ * @hw_version:     Hardware revision of this device.
+ * @fw_version:     Firmware revision of this device.
+ * @data_size:      Requested size for a data buffer.
+ * @feedback_size:  Requested size for a feedback buffer.
+ * @mode:           Mode that the device currently operates in.
+ * @max_contacts:   Maximum amount of concurrent touches the sensor can process.
+ * @sensor_min_eds: The minimum EDS version supported by the sensor.
+ * @sensor_max_eds: The maximum EDS version supported by the sensor.
+ * @me_min_eds:     The minimum EDS version supported by the ME for communicating with the sensor.
+ * @me_max_eds:     The maximum EDS version supported by the ME for communicating with the sensor.
+ * @intf_eds:       The EDS version implemented by the interface between ME and host.
+ */
+struct ipts_device_info {
+	u16 vendor;
+	u16 product;
+	u32 hw_version;
+	u32 fw_version;
+	u32 data_size;
+	u32 feedback_size;
+	enum ipts_mode mode;
+	u8 max_contacts;
+	u8 reserved1[3];
+	u8 sensor_min_eds;
+	u8 sensor_maj_eds;
+	u8 me_min_eds;
+	u8 me_maj_eds;
+	u8 intf_eds;
+	u8 reserved2[11];
+} __packed;
+
+static_assert(sizeof(struct ipts_device_info) == 44);
+
+#endif /* IPTS_SPEC_DEVICE_H */
diff --git a/drivers/hid/ipts/spec-hid.h b/drivers/hid/ipts/spec-hid.h
new file mode 100644
index 000000000..5a58d4a0a
--- /dev/null
+++ b/drivers/hid/ipts/spec-hid.h
@@ -0,0 +1,34 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (c) 2020-2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#ifndef IPTS_SPEC_HID_H
+#define IPTS_SPEC_HID_H
+
+#include <linux/build_bug.h>
+#include <linux/types.h>
+
+/*
+ * Made-up type for passing raw IPTS data in a HID report.
+ */
+#define IPTS_HID_FRAME_TYPE_RAW 0xEE
+
+/**
+ * struct ipts_hid_frame - Header that is prefixed to raw IPTS data wrapped in a HID report.
+ * @size: Size of the data inside the report, including this header.
+ * @type: What type of data does this report contain.
+ */
+struct ipts_hid_header {
+	u32 size;
+	u8 reserved1;
+	u8 type;
+	u8 reserved2;
+	u8 data[];
+} __packed;
+
+static_assert(sizeof(struct ipts_hid_header) == 7);
+
+#endif /* IPTS_SPEC_HID_H */
diff --git a/drivers/hid/ipts/thread.c b/drivers/hid/ipts/thread.c
new file mode 100644
index 000000000..355e92bea
--- /dev/null
+++ b/drivers/hid/ipts/thread.c
@@ -0,0 +1,84 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#include <linux/completion.h>
+#include <linux/err.h>
+#include <linux/kthread.h>
+#include <linux/mutex.h>
+
+#include "thread.h"
+
+bool ipts_thread_should_stop(struct ipts_thread *thread)
+{
+	if (!thread)
+		return false;
+
+	return READ_ONCE(thread->should_stop);
+}
+
+static int ipts_thread_runner(void *data)
+{
+	int ret = 0;
+	struct ipts_thread *thread = data;
+
+	if (!thread)
+		return -EFAULT;
+
+	if (!thread->threadfn)
+		return -EFAULT;
+
+	ret = thread->threadfn(thread);
+	complete_all(&thread->done);
+
+	return ret;
+}
+
+int ipts_thread_start(struct ipts_thread *thread, int (*threadfn)(struct ipts_thread *thread),
+		      void *data, const char *name)
+{
+	if (!thread)
+		return -EFAULT;
+
+	if (!threadfn)
+		return -EFAULT;
+
+	init_completion(&thread->done);
+
+	thread->data = data;
+	thread->should_stop = false;
+	thread->threadfn = threadfn;
+
+	thread->thread = kthread_run(ipts_thread_runner, thread, name);
+	return PTR_ERR_OR_ZERO(thread->thread);
+}
+
+int ipts_thread_stop(struct ipts_thread *thread)
+{
+	int ret = 0;
+
+	if (!thread)
+		return -EFAULT;
+
+	if (!thread->thread)
+		return 0;
+
+	WRITE_ONCE(thread->should_stop, true);
+
+	/*
+	 * Make sure that the write has gone through before waiting.
+	 */
+	wmb();
+
+	wait_for_completion(&thread->done);
+	ret = kthread_stop(thread->thread);
+
+	thread->thread = NULL;
+	thread->data = NULL;
+	thread->threadfn = NULL;
+
+	return ret;
+}
diff --git a/drivers/hid/ipts/thread.h b/drivers/hid/ipts/thread.h
new file mode 100644
index 000000000..1f966b8b3
--- /dev/null
+++ b/drivers/hid/ipts/thread.h
@@ -0,0 +1,59 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (c) 2023 Dorian Stoll
+ *
+ * Linux driver for Intel Precise Touch & Stylus
+ */
+
+#ifndef IPTS_THREAD_H
+#define IPTS_THREAD_H
+
+#include <linux/completion.h>
+#include <linux/mutex.h>
+#include <linux/sched.h>
+
+/*
+ * This wrapper over kthread is necessary, because calling kthread_stop makes it impossible
+ * to issue MEI commands from that thread while it shuts itself down. By using a custom
+ * boolean variable and a completion object, we can call kthread_stop only when the thread
+ * already finished all of its work and has returned.
+ */
+struct ipts_thread {
+	struct task_struct *thread;
+
+	bool should_stop;
+	struct completion done;
+
+	void *data;
+	int (*threadfn)(struct ipts_thread *thread);
+};
+
+/**
+ * ipts_thread_should_stop() - Returns true if the thread is asked to terminate.
+ * @thread: The current thread.
+ *
+ * Returns: true if the thread should stop, false if not.
+ */
+bool ipts_thread_should_stop(struct ipts_thread *thread);
+
+/**
+ * ipts_thread_start() - Starts an IPTS thread.
+ * @thread: The thread to initialize and start.
+ * @threadfn: The function to execute.
+ * @data: An argument that will be passed to threadfn.
+ * @name: The name of the new thread.
+ *
+ * Returns: 0 on success, <0 on error.
+ */
+int ipts_thread_start(struct ipts_thread *thread, int (*threadfn)(struct ipts_thread *thread),
+		      void *data, const char name[]);
+
+/**
+ * ipts_thread_stop() - Asks the thread to terminate and waits until it has finished.
+ * @thread: The thread that should stop.
+ *
+ * Returns: The return value of the thread function.
+ */
+int ipts_thread_stop(struct ipts_thread *thread);
+
+#endif /* IPTS_THREAD_H */
diff --git a/drivers/hid/ithc/Kbuild b/drivers/hid/ithc/Kbuild
new file mode 100644
index 000000000..aea83f2ac
--- /dev/null
+++ b/drivers/hid/ithc/Kbuild
@@ -0,0 +1,6 @@
+obj-$(CONFIG_HID_ITHC) := ithc.o
+
+ithc-objs := ithc-main.o ithc-regs.o ithc-dma.o ithc-debug.o
+
+ccflags-y := -std=gnu11 -Wno-declaration-after-statement
+
diff --git a/drivers/hid/ithc/Kconfig b/drivers/hid/ithc/Kconfig
new file mode 100644
index 000000000..ede713023
--- /dev/null
+++ b/drivers/hid/ithc/Kconfig
@@ -0,0 +1,12 @@
+config HID_ITHC
+	tristate "Intel Touch Host Controller"
+	depends on PCI
+	depends on HID
+	help
+	  Say Y here if your system has a touchscreen using Intels
+	  Touch Host Controller (ITHC / IPTS) technology.
+
+	  If unsure say N.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called ithc.
diff --git a/drivers/hid/ithc/ithc-debug.c b/drivers/hid/ithc/ithc-debug.c
new file mode 100644
index 000000000..57bf125c4
--- /dev/null
+++ b/drivers/hid/ithc/ithc-debug.c
@@ -0,0 +1,96 @@
+#include "ithc.h"
+
+void ithc_log_regs(struct ithc *ithc) {
+	if (!ithc->prev_regs) return;
+	u32 __iomem *cur = (__iomem void*)ithc->regs;
+	u32 *prev = (void*)ithc->prev_regs;
+	for (int i = 1024; i < sizeof *ithc->regs / 4; i++) {
+		u32 x = readl(cur + i);
+		if (x != prev[i]) {
+			pci_info(ithc->pci, "reg %04x: %08x -> %08x\n", i * 4, prev[i], x);
+			prev[i] = x;
+		}
+	}
+}
+
+static ssize_t ithc_debugfs_cmd_write(struct file *f, const char __user *buf, size_t len, loff_t *offset) {
+	struct ithc *ithc = file_inode(f)->i_private;
+	char cmd[256];
+	if (!ithc || !ithc->pci) return -ENODEV;
+	if (!len) return -EINVAL;
+	if (len >= sizeof cmd) return -EINVAL;
+	if (copy_from_user(cmd, buf, len)) return -EFAULT;
+	cmd[len] = 0;
+	if (cmd[len-1] == '\n') cmd[len-1] = 0;
+	pci_info(ithc->pci, "debug command: %s\n", cmd);
+	u32 n = 0;
+	const char *s = cmd + 1;
+	u32 a[32];
+	while (*s && *s != '\n') {
+		if (n >= ARRAY_SIZE(a)) return -EINVAL;
+		if (*s++ != ' ') return -EINVAL;
+		char *e;
+		a[n++] = simple_strtoul(s, &e, 0);
+		if (e == s) return -EINVAL;
+		s = e;
+	}
+	ithc_log_regs(ithc);
+	switch(cmd[0]) {
+	case 'x': // reset
+		ithc_reset(ithc);
+		break;
+	case 'w': // write register: offset mask value
+		if (n != 3 || (a[0] & 3)) return -EINVAL;
+		pci_info(ithc->pci, "debug write 0x%04x = 0x%08x (mask 0x%08x)\n", a[0], a[2], a[1]);
+		bitsl(((__iomem u32 *)ithc->regs) + a[0] / 4, a[1], a[2]);
+		break;
+	case 'r': // read register: offset
+		if (n != 1 || (a[0] & 3)) return -EINVAL;
+		pci_info(ithc->pci, "debug read 0x%04x = 0x%08x\n", a[0], readl(((__iomem u32 *)ithc->regs) + a[0] / 4));
+		break;
+	case 's': // spi command: cmd offset len data...
+		// read config: s 4 0 64 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
+		// set touch cfg: s 6 12 4 XX
+		if (n < 3 || a[2] > (n - 3) * 4) return -EINVAL;
+		pci_info(ithc->pci, "debug spi command %u with %u bytes of data\n", a[0], a[2]);
+		if (!CHECK(ithc_spi_command, ithc, a[0], a[1], a[2], a + 3))
+			for (u32 i = 0; i < (a[2] + 3) / 4; i++) pci_info(ithc->pci, "resp %u = 0x%08x\n", i, a[3+i]);
+		break;
+	case 'd': // dma command: cmd len data...
+		// get report descriptor: d 7 8 0 0
+		// enable multitouch: d 3 2 0x0105
+		if (n < 2 || a[1] > (n - 2) * 4) return -EINVAL;
+		pci_info(ithc->pci, "debug dma command %u with %u bytes of data\n", a[0], a[1]);
+		if (ithc_dma_tx(ithc, a[0], a[1], a + 2)) pci_err(ithc->pci, "dma tx failed\n");
+		break;
+	default:
+		return -EINVAL;
+	}
+	ithc_log_regs(ithc);
+	return len;
+}
+
+static const struct file_operations ithc_debugfops_cmd = {
+	.owner = THIS_MODULE,
+	.write = ithc_debugfs_cmd_write,
+};
+
+static void ithc_debugfs_devres_release(struct device *dev, void *res) {
+	struct dentry **dbgm = res;
+	if (*dbgm) debugfs_remove_recursive(*dbgm);
+}
+
+int ithc_debug_init(struct ithc *ithc) {
+	struct dentry **dbgm = devres_alloc(ithc_debugfs_devres_release, sizeof *dbgm, GFP_KERNEL);
+	if (!dbgm) return -ENOMEM;
+	devres_add(&ithc->pci->dev, dbgm);
+	struct dentry *dbg = debugfs_create_dir(DEVNAME, NULL);
+	if (IS_ERR(dbg)) return PTR_ERR(dbg);
+	*dbgm = dbg;
+
+	struct dentry *cmd = debugfs_create_file("cmd", 0220, dbg, ithc, &ithc_debugfops_cmd);
+	if (IS_ERR(cmd)) return PTR_ERR(cmd);
+
+	return 0;
+}
+
diff --git a/drivers/hid/ithc/ithc-dma.c b/drivers/hid/ithc/ithc-dma.c
new file mode 100644
index 000000000..7e89b3496
--- /dev/null
+++ b/drivers/hid/ithc/ithc-dma.c
@@ -0,0 +1,258 @@
+#include "ithc.h"
+
+static int ithc_dma_prd_alloc(struct ithc *ithc, struct ithc_dma_prd_buffer *p, unsigned num_buffers, unsigned num_pages, enum dma_data_direction dir) {
+	p->num_pages = num_pages;
+	p->dir = dir;
+	p->size = round_up(num_buffers * num_pages * sizeof(struct ithc_phys_region_desc), PAGE_SIZE);
+	p->addr = dmam_alloc_coherent(&ithc->pci->dev, p->size, &p->dma_addr, GFP_KERNEL);
+	if (!p->addr) return -ENOMEM;
+	if (p->dma_addr & (PAGE_SIZE - 1)) return -EFAULT;
+	return 0;
+}
+
+struct ithc_sg_table {
+	void *addr;
+	struct sg_table sgt;
+	enum dma_data_direction dir;
+};
+static void ithc_dma_sgtable_free(struct sg_table *sgt) {
+	struct scatterlist *sg;
+	int i;
+	for_each_sgtable_sg(sgt, sg, i) {
+		struct page *p = sg_page(sg);
+		if (p) __free_page(p);
+	}
+	sg_free_table(sgt);
+}
+static void ithc_dma_data_devres_release(struct device *dev, void *res) {
+	struct ithc_sg_table *sgt = res;
+	if (sgt->addr) vunmap(sgt->addr);
+	dma_unmap_sgtable(dev, &sgt->sgt, sgt->dir, 0);
+	ithc_dma_sgtable_free(&sgt->sgt);
+}
+
+static int ithc_dma_data_alloc(struct ithc* ithc, struct ithc_dma_prd_buffer *prds, struct ithc_dma_data_buffer *b) {
+	// We don't use dma_alloc_coherent for data buffers, because they don't have to be contiguous (we can use one PRD per page) or coherent (they are unidirectional).
+	// Instead we use an sg_table of individually allocated pages (5.13 has dma_alloc_noncontiguous for this, but we'd like to support 5.10 for now).
+	struct page *pages[16];
+	if (prds->num_pages == 0 || prds->num_pages > ARRAY_SIZE(pages)) return -EINVAL;
+	b->active_idx = -1;
+	struct ithc_sg_table *sgt = devres_alloc(ithc_dma_data_devres_release, sizeof *sgt, GFP_KERNEL);
+	if (!sgt) return -ENOMEM;
+	sgt->dir = prds->dir;
+	if (!sg_alloc_table(&sgt->sgt, prds->num_pages, GFP_KERNEL)) {
+		struct scatterlist *sg;
+		int i;
+		bool ok = true;
+		for_each_sgtable_sg(&sgt->sgt, sg, i) {
+			struct page *p = pages[i] = alloc_page(GFP_KERNEL | __GFP_ZERO); // don't need __GFP_DMA for PCI DMA
+			if (!p) { ok = false; break; }
+			sg_set_page(sg, p, PAGE_SIZE, 0);
+		}
+		if (ok && !dma_map_sgtable(&ithc->pci->dev, &sgt->sgt, prds->dir, 0)) {
+			devres_add(&ithc->pci->dev, sgt);
+			b->sgt = &sgt->sgt;
+			b->addr = sgt->addr = vmap(pages, prds->num_pages, 0, PAGE_KERNEL);
+			if (!b->addr) return -ENOMEM;
+			return 0;
+		}
+		ithc_dma_sgtable_free(&sgt->sgt);
+	}
+	devres_free(sgt);
+	return -ENOMEM;
+}
+
+static int ithc_dma_data_buffer_put(struct ithc *ithc, struct ithc_dma_prd_buffer *prds, struct ithc_dma_data_buffer *b, unsigned idx) {
+	struct ithc_phys_region_desc *prd = prds->addr;
+	prd += idx * prds->num_pages;
+	if (b->active_idx >= 0) { pci_err(ithc->pci, "buffer already active\n"); return -EINVAL; }
+	b->active_idx = idx;
+	if (prds->dir == DMA_TO_DEVICE) {
+		if (b->data_size > PAGE_SIZE) return -EINVAL;
+		prd->addr = sg_dma_address(b->sgt->sgl) >> 10;
+		prd->size = b->data_size | PRD_FLAG_END;
+		flush_kernel_vmap_range(b->addr, b->data_size);
+	} else if (prds->dir == DMA_FROM_DEVICE) {
+		struct scatterlist *sg;
+		int i;
+		for_each_sgtable_dma_sg(b->sgt, sg, i) {
+			prd->addr = sg_dma_address(sg) >> 10;
+			prd->size = sg_dma_len(sg);
+			prd++;
+		}
+		prd[-1].size |= PRD_FLAG_END;
+	}
+	dma_wmb(); // for the prds
+	dma_sync_sgtable_for_device(&ithc->pci->dev, b->sgt, prds->dir);
+	return 0;
+}
+
+static int ithc_dma_data_buffer_get(struct ithc *ithc, struct ithc_dma_prd_buffer *prds, struct ithc_dma_data_buffer *b, unsigned idx) {
+	struct ithc_phys_region_desc *prd = prds->addr;
+	prd += idx * prds->num_pages;
+	if (b->active_idx != idx) { pci_err(ithc->pci, "wrong buffer index\n"); return -EINVAL; }
+	b->active_idx = -1;
+	if (prds->dir == DMA_FROM_DEVICE) {
+		dma_rmb(); // for the prds
+		b->data_size = 0;
+		struct scatterlist *sg;
+		int i;
+		for_each_sgtable_dma_sg(b->sgt, sg, i) {
+			unsigned size = prd->size;
+			b->data_size += size & PRD_SIZE_MASK;
+			if (size & PRD_FLAG_END) break;
+			if ((size & PRD_SIZE_MASK) != sg_dma_len(sg)) { pci_err(ithc->pci, "truncated prd\n"); break; }
+			prd++;
+		}
+		invalidate_kernel_vmap_range(b->addr, b->data_size);
+	}
+	dma_sync_sgtable_for_cpu(&ithc->pci->dev, b->sgt, prds->dir);
+	return 0;
+}
+
+int ithc_dma_rx_init(struct ithc *ithc, u8 channel, const char *devname) {
+	struct ithc_dma_rx *rx = &ithc->dma_rx[channel];
+	mutex_init(&rx->mutex);
+	u32 buf_size = DEVCFG_DMA_RX_SIZE(ithc->config.dma_buf_sizes);
+	unsigned num_pages = (buf_size + PAGE_SIZE - 1) / PAGE_SIZE;
+	pci_dbg(ithc->pci, "allocating rx buffers: num = %u, size = %u, pages = %u\n", NUM_RX_BUF, buf_size, num_pages);
+	CHECK_RET(ithc_dma_prd_alloc, ithc, &rx->prds, NUM_RX_BUF, num_pages, DMA_FROM_DEVICE);
+	for (unsigned i = 0; i < NUM_RX_BUF; i++)
+		CHECK_RET(ithc_dma_data_alloc, ithc, &rx->prds, &rx->bufs[i]);
+	writeb(DMA_RX_CONTROL2_RESET, &ithc->regs->dma_rx[channel].control2);
+	lo_hi_writeq(rx->prds.dma_addr, &ithc->regs->dma_rx[channel].addr);
+	writeb(NUM_RX_BUF - 1, &ithc->regs->dma_rx[channel].num_bufs);
+	writeb(num_pages - 1, &ithc->regs->dma_rx[channel].num_prds);
+	u8 head = readb(&ithc->regs->dma_rx[channel].head);
+	if (head) { pci_err(ithc->pci, "head is nonzero (%u)\n", head); return -EIO; }
+	for (unsigned i = 0; i < NUM_RX_BUF; i++)
+		CHECK_RET(ithc_dma_data_buffer_put, ithc, &rx->prds, &rx->bufs[i], i);
+	writeb(head ^ DMA_RX_WRAP_FLAG, &ithc->regs->dma_rx[channel].tail);
+	return 0;
+}
+void ithc_dma_rx_enable(struct ithc *ithc, u8 channel) {
+	bitsb_set(&ithc->regs->dma_rx[channel].control, DMA_RX_CONTROL_ENABLE | DMA_RX_CONTROL_IRQ_ERROR | DMA_RX_CONTROL_IRQ_DATA);
+	CHECK(waitl, ithc, &ithc->regs->dma_rx[1].status, DMA_RX_STATUS_ENABLED, DMA_RX_STATUS_ENABLED);
+}
+
+int ithc_dma_tx_init(struct ithc *ithc) {
+	struct ithc_dma_tx *tx = &ithc->dma_tx;
+	mutex_init(&tx->mutex);
+	tx->max_size = DEVCFG_DMA_TX_SIZE(ithc->config.dma_buf_sizes);
+	unsigned num_pages = (tx->max_size + PAGE_SIZE - 1) / PAGE_SIZE;
+	pci_dbg(ithc->pci, "allocating tx buffers: size = %u, pages = %u\n", tx->max_size, num_pages);
+	CHECK_RET(ithc_dma_prd_alloc, ithc, &tx->prds, 1, num_pages, DMA_TO_DEVICE);
+	CHECK_RET(ithc_dma_data_alloc, ithc, &tx->prds, &tx->buf);
+	lo_hi_writeq(tx->prds.dma_addr, &ithc->regs->dma_tx.addr);
+	writeb(num_pages - 1, &ithc->regs->dma_tx.num_prds);
+	CHECK_RET(ithc_dma_data_buffer_put, ithc, &ithc->dma_tx.prds, &ithc->dma_tx.buf, 0);
+	return 0;
+}
+
+static int ithc_dma_rx_process_buf(struct ithc *ithc, struct ithc_dma_data_buffer *data, u8 channel, u8 buf) {
+	if (buf >= NUM_RX_BUF) {
+		pci_err(ithc->pci, "invalid dma ringbuffer index\n");
+		return -EINVAL;
+	}
+	ithc_set_active(ithc);
+	u32 len = data->data_size;
+	struct ithc_dma_rx_header *hdr = data->addr;
+	u8 *hiddata = (void *)(hdr + 1);
+	if (len >= sizeof *hdr && hdr->code == DMA_RX_CODE_RESET) {
+		CHECK(ithc_reset, ithc);
+	} else if (len < sizeof *hdr || len != sizeof *hdr + hdr->data_size) {
+		if (hdr->code == DMA_RX_CODE_INPUT_REPORT) {
+			// When the CPU enters a low power state during DMA, we can get truncated messages.
+			// Typically this will be a single touch HID report that is only 1 byte, or a multitouch report that is 257 bytes.
+			// See also ithc_set_active().
+		} else {
+			pci_err(ithc->pci, "invalid dma rx data! channel %u, buffer %u, size %u, code %u, data size %u\n", channel, buf, len, hdr->code, hdr->data_size);
+			print_hex_dump_debug(DEVNAME " data: ", DUMP_PREFIX_OFFSET, 32, 1, hdr, min(len, 0x400u), 0);
+		}
+	} else if (hdr->code == DMA_RX_CODE_REPORT_DESCRIPTOR && hdr->data_size > 8) {
+		CHECK(hid_parse_report, ithc->hid, hiddata + 8, hdr->data_size - 8);
+		WRITE_ONCE(ithc->hid_parse_done, true);
+		wake_up(&ithc->wait_hid_parse);
+	} else if (hdr->code == DMA_RX_CODE_INPUT_REPORT) {
+		CHECK(hid_input_report, ithc->hid, HID_INPUT_REPORT, hiddata, hdr->data_size, 1);
+	} else if (hdr->code == DMA_RX_CODE_FEATURE_REPORT) {
+		bool done = false;
+		mutex_lock(&ithc->hid_get_feature_mutex);
+		if (ithc->hid_get_feature_buf) {
+			if (hdr->data_size < ithc->hid_get_feature_size) ithc->hid_get_feature_size = hdr->data_size;
+			memcpy(ithc->hid_get_feature_buf, hiddata, ithc->hid_get_feature_size);
+			ithc->hid_get_feature_buf = NULL;
+			done = true;
+		}
+		mutex_unlock(&ithc->hid_get_feature_mutex);
+		if (done) wake_up(&ithc->wait_hid_get_feature);
+		else CHECK(hid_input_report, ithc->hid, HID_FEATURE_REPORT, hiddata, hdr->data_size, 1);
+	} else {
+		pci_dbg(ithc->pci, "unhandled dma rx data! channel %u, buffer %u, size %u, code %u\n", channel, buf, len, hdr->code);
+		print_hex_dump_debug(DEVNAME " data: ", DUMP_PREFIX_OFFSET, 32, 1, hdr, min(len, 0x400u), 0);
+	}
+	return 0;
+}
+
+static int ithc_dma_rx_unlocked(struct ithc *ithc, u8 channel) {
+	struct ithc_dma_rx *rx = &ithc->dma_rx[channel];
+	unsigned n = rx->num_received;
+	u8 head_wrap = readb(&ithc->regs->dma_rx[channel].head);
+	while (1) {
+		u8 tail = n % NUM_RX_BUF;
+		u8 tail_wrap = tail | ((n / NUM_RX_BUF) & 1 ? 0 : DMA_RX_WRAP_FLAG);
+		writeb(tail_wrap, &ithc->regs->dma_rx[channel].tail);
+		// ringbuffer is full if tail_wrap == head_wrap
+		// ringbuffer is empty if tail_wrap == head_wrap ^ WRAP_FLAG
+		if (tail_wrap == (head_wrap ^ DMA_RX_WRAP_FLAG)) return 0;
+
+		// take the buffer that the device just filled
+		struct ithc_dma_data_buffer *b = &rx->bufs[n % NUM_RX_BUF];
+		CHECK_RET(ithc_dma_data_buffer_get, ithc, &rx->prds, b, tail);
+		rx->num_received = ++n;
+
+		// process data
+		CHECK(ithc_dma_rx_process_buf, ithc, b, channel, tail);
+
+		// give the buffer back to the device
+		CHECK_RET(ithc_dma_data_buffer_put, ithc, &rx->prds, b, tail);
+	}
+}
+int ithc_dma_rx(struct ithc *ithc, u8 channel) {
+	struct ithc_dma_rx *rx = &ithc->dma_rx[channel];
+	mutex_lock(&rx->mutex);
+	int ret = ithc_dma_rx_unlocked(ithc, channel);
+	mutex_unlock(&rx->mutex);
+	return ret;
+}
+
+static int ithc_dma_tx_unlocked(struct ithc *ithc, u32 cmdcode, u32 datasize, void *data) {
+	pci_dbg(ithc->pci, "dma tx command %u, size %u\n", cmdcode, datasize);
+	struct ithc_dma_tx_header *hdr;
+	u8 padding = datasize & 3 ? 4 - (datasize & 3) : 0;
+	unsigned fullsize = sizeof *hdr + datasize + padding;
+	if (fullsize > ithc->dma_tx.max_size || fullsize > PAGE_SIZE) return -EINVAL;
+	CHECK_RET(ithc_dma_data_buffer_get, ithc, &ithc->dma_tx.prds, &ithc->dma_tx.buf, 0);
+
+	ithc->dma_tx.buf.data_size = fullsize;
+	hdr = ithc->dma_tx.buf.addr;
+	hdr->code = cmdcode;
+	hdr->data_size = datasize;
+	u8 *dest = (void *)(hdr + 1);
+	memcpy(dest, data, datasize);
+	dest += datasize;
+	for (u8 p = 0; p < padding; p++) *dest++ = 0;
+	CHECK_RET(ithc_dma_data_buffer_put, ithc, &ithc->dma_tx.prds, &ithc->dma_tx.buf, 0);
+
+	bitsb_set(&ithc->regs->dma_tx.control, DMA_TX_CONTROL_SEND);
+	CHECK_RET(waitb, ithc, &ithc->regs->dma_tx.control, DMA_TX_CONTROL_SEND, 0);
+	writel(DMA_TX_STATUS_DONE, &ithc->regs->dma_tx.status);
+	return 0;
+}
+int ithc_dma_tx(struct ithc *ithc, u32 cmdcode, u32 datasize, void *data) {
+	mutex_lock(&ithc->dma_tx.mutex);
+	int ret = ithc_dma_tx_unlocked(ithc, cmdcode, datasize, data);
+	mutex_unlock(&ithc->dma_tx.mutex);
+	return ret;
+}
+
diff --git a/drivers/hid/ithc/ithc-dma.h b/drivers/hid/ithc/ithc-dma.h
new file mode 100644
index 000000000..d9f2c19a1
--- /dev/null
+++ b/drivers/hid/ithc/ithc-dma.h
@@ -0,0 +1,67 @@
+#define PRD_SIZE_MASK            0xffffff
+#define PRD_FLAG_END             0x1000000
+#define PRD_FLAG_SUCCESS         0x2000000
+#define PRD_FLAG_ERROR           0x4000000
+
+struct ithc_phys_region_desc {
+	u64 addr; // physical addr/1024
+	u32 size; // num bytes, PRD_FLAG_END marks last prd for data split over multiple prds
+	u32 unused;
+};
+
+#define DMA_RX_CODE_INPUT_REPORT          3
+#define DMA_RX_CODE_FEATURE_REPORT        4
+#define DMA_RX_CODE_REPORT_DESCRIPTOR     5
+#define DMA_RX_CODE_RESET                 7
+
+struct ithc_dma_rx_header {
+	u32 code;
+	u32 data_size;
+	u32 _unknown[14];
+};
+
+#define DMA_TX_CODE_SET_FEATURE           3
+#define DMA_TX_CODE_GET_FEATURE           4
+#define DMA_TX_CODE_OUTPUT_REPORT         5
+#define DMA_TX_CODE_GET_REPORT_DESCRIPTOR 7
+
+struct ithc_dma_tx_header {
+	u32 code;
+	u32 data_size;
+};
+
+struct ithc_dma_prd_buffer {
+	void *addr;
+	dma_addr_t dma_addr;
+	u32 size;
+	u32 num_pages; // per data buffer
+	enum dma_data_direction dir;
+};
+
+struct ithc_dma_data_buffer {
+	void *addr;
+	struct sg_table *sgt;
+	int active_idx;
+	u32 data_size;
+};
+
+struct ithc_dma_tx {
+	struct mutex mutex;
+	u32 max_size;
+	struct ithc_dma_prd_buffer prds;
+	struct ithc_dma_data_buffer buf;
+};
+
+struct ithc_dma_rx {
+	struct mutex mutex;
+	u32 num_received;
+	struct ithc_dma_prd_buffer prds;
+	struct ithc_dma_data_buffer bufs[NUM_RX_BUF];
+};
+
+int ithc_dma_rx_init(struct ithc *ithc, u8 channel, const char *devname);
+void ithc_dma_rx_enable(struct ithc *ithc, u8 channel);
+int ithc_dma_tx_init(struct ithc *ithc);
+int ithc_dma_rx(struct ithc *ithc, u8 channel);
+int ithc_dma_tx(struct ithc *ithc, u32 cmdcode, u32 datasize, void *cmddata);
+
diff --git a/drivers/hid/ithc/ithc-main.c b/drivers/hid/ithc/ithc-main.c
new file mode 100644
index 000000000..09512b9cb
--- /dev/null
+++ b/drivers/hid/ithc/ithc-main.c
@@ -0,0 +1,534 @@
+#include "ithc.h"
+
+MODULE_DESCRIPTION("Intel Touch Host Controller driver");
+MODULE_LICENSE("Dual BSD/GPL");
+
+// Lakefield
+#define PCI_DEVICE_ID_INTEL_THC_LKF_PORT1    0x98d0
+#define PCI_DEVICE_ID_INTEL_THC_LKF_PORT2    0x98d1
+// Tiger Lake
+#define PCI_DEVICE_ID_INTEL_THC_TGL_LP_PORT1 0xa0d0
+#define PCI_DEVICE_ID_INTEL_THC_TGL_LP_PORT2 0xa0d1
+#define PCI_DEVICE_ID_INTEL_THC_TGL_H_PORT1  0x43d0
+#define PCI_DEVICE_ID_INTEL_THC_TGL_H_PORT2  0x43d1
+// Alder Lake
+#define PCI_DEVICE_ID_INTEL_THC_ADL_S_PORT1  0x7ad8
+#define PCI_DEVICE_ID_INTEL_THC_ADL_S_PORT2  0x7ad9
+#define PCI_DEVICE_ID_INTEL_THC_ADL_P_PORT1  0x51d0
+#define PCI_DEVICE_ID_INTEL_THC_ADL_P_PORT2  0x51d1
+#define PCI_DEVICE_ID_INTEL_THC_ADL_M_PORT1  0x54d0
+#define PCI_DEVICE_ID_INTEL_THC_ADL_M_PORT2  0x54d1
+// Raptor Lake
+#define PCI_DEVICE_ID_INTEL_THC_RPL_S_PORT1  0x7a58
+#define PCI_DEVICE_ID_INTEL_THC_RPL_S_PORT2  0x7a59
+// Meteor Lake
+#define PCI_DEVICE_ID_INTEL_THC_MTL_PORT1    0x7e48
+#define PCI_DEVICE_ID_INTEL_THC_MTL_PORT2    0x7e4a
+
+static const struct pci_device_id ithc_pci_tbl[] = {
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_LKF_PORT1) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_LKF_PORT2) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_TGL_LP_PORT1) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_TGL_LP_PORT2) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_TGL_H_PORT1) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_TGL_H_PORT2) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_ADL_S_PORT1) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_ADL_S_PORT2) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_ADL_P_PORT1) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_ADL_P_PORT2) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_ADL_M_PORT1) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_ADL_M_PORT2) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_RPL_S_PORT1) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_RPL_S_PORT2) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_MTL_PORT1) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_MTL_PORT2) },
+	{}
+};
+MODULE_DEVICE_TABLE(pci, ithc_pci_tbl);
+
+// Module parameters
+
+static bool ithc_use_polling = false;
+module_param_named(poll, ithc_use_polling, bool, 0);
+MODULE_PARM_DESC(poll, "Use polling instead of interrupts");
+
+static bool ithc_use_rx0 = false;
+module_param_named(rx0, ithc_use_rx0, bool, 0);
+MODULE_PARM_DESC(rx0, "Use DMA RX channel 0");
+
+static bool ithc_use_rx1 = true;
+module_param_named(rx1, ithc_use_rx1, bool, 0);
+MODULE_PARM_DESC(rx1, "Use DMA RX channel 1");
+
+static bool ithc_log_regs_enabled = false;
+module_param_named(logregs, ithc_log_regs_enabled, bool, 0);
+MODULE_PARM_DESC(logregs, "Log changes in register values (for debugging)");
+
+// Sysfs attributes
+
+static bool ithc_is_config_valid(struct ithc *ithc) {
+	return ithc->config.device_id == DEVCFG_DEVICE_ID_TIC;
+}
+
+static ssize_t vendor_show(struct device *dev, struct device_attribute *attr, char *buf) {
+	struct ithc *ithc = dev_get_drvdata(dev);
+	if (!ithc || !ithc_is_config_valid(ithc)) return -ENODEV;
+	return sprintf(buf, "0x%04x", ithc->config.vendor_id);
+}
+static DEVICE_ATTR_RO(vendor);
+static ssize_t product_show(struct device *dev, struct device_attribute *attr, char *buf) {
+	struct ithc *ithc = dev_get_drvdata(dev);
+	if (!ithc || !ithc_is_config_valid(ithc)) return -ENODEV;
+	return sprintf(buf, "0x%04x", ithc->config.product_id);
+}
+static DEVICE_ATTR_RO(product);
+static ssize_t revision_show(struct device *dev, struct device_attribute *attr, char *buf) {
+	struct ithc *ithc = dev_get_drvdata(dev);
+	if (!ithc || !ithc_is_config_valid(ithc)) return -ENODEV;
+	return sprintf(buf, "%u", ithc->config.revision);
+}
+static DEVICE_ATTR_RO(revision);
+static ssize_t fw_version_show(struct device *dev, struct device_attribute *attr, char *buf) {
+	struct ithc *ithc = dev_get_drvdata(dev);
+	if (!ithc || !ithc_is_config_valid(ithc)) return -ENODEV;
+	u32 v = ithc->config.fw_version;
+	return sprintf(buf, "%i.%i.%i.%i", v >> 24, v >> 16 & 0xff, v >> 8 & 0xff, v & 0xff);
+}
+static DEVICE_ATTR_RO(fw_version);
+
+static const struct attribute_group *ithc_attribute_groups[] = {
+	&(const struct attribute_group){
+		.name = DEVNAME,
+		.attrs = (struct attribute *[]){
+			&dev_attr_vendor.attr,
+			&dev_attr_product.attr,
+			&dev_attr_revision.attr,
+			&dev_attr_fw_version.attr,
+			NULL
+		},
+	},
+	NULL
+};
+
+// HID setup
+
+static int ithc_hid_start(struct hid_device *hdev) { return 0; }
+static void ithc_hid_stop(struct hid_device *hdev) { }
+static int ithc_hid_open(struct hid_device *hdev) { return 0; }
+static void ithc_hid_close(struct hid_device *hdev) { }
+
+static int ithc_hid_parse(struct hid_device *hdev) {
+	struct ithc *ithc = hdev->driver_data;
+	u64 val = 0;
+	WRITE_ONCE(ithc->hid_parse_done, false);
+	CHECK_RET(ithc_dma_tx, ithc, DMA_TX_CODE_GET_REPORT_DESCRIPTOR, sizeof val, &val);
+	if (!wait_event_timeout(ithc->wait_hid_parse, READ_ONCE(ithc->hid_parse_done), msecs_to_jiffies(1000))) return -ETIMEDOUT;
+	return 0;
+}
+
+static int ithc_hid_raw_request(struct hid_device *hdev, unsigned char reportnum, __u8 *buf, size_t len, unsigned char rtype, int reqtype) {
+	struct ithc *ithc = hdev->driver_data;
+	if (!buf || !len) return -EINVAL;
+	u32 code;
+	if (rtype == HID_OUTPUT_REPORT && reqtype == HID_REQ_SET_REPORT) code = DMA_TX_CODE_OUTPUT_REPORT;
+	else if (rtype == HID_FEATURE_REPORT && reqtype == HID_REQ_SET_REPORT) code = DMA_TX_CODE_SET_FEATURE;
+	else if (rtype == HID_FEATURE_REPORT && reqtype == HID_REQ_GET_REPORT) code = DMA_TX_CODE_GET_FEATURE;
+	else {
+		pci_err(ithc->pci, "unhandled hid request %i %i for report id %i\n", rtype, reqtype, reportnum);
+		return -EINVAL;
+	}
+	buf[0] = reportnum;
+	if (reqtype == HID_REQ_GET_REPORT) {
+		mutex_lock(&ithc->hid_get_feature_mutex);
+		ithc->hid_get_feature_buf = buf;
+		ithc->hid_get_feature_size = len;
+		mutex_unlock(&ithc->hid_get_feature_mutex);
+		int r = CHECK(ithc_dma_tx, ithc, code, 1, buf);
+		if (!r) {
+			r = wait_event_interruptible_timeout(ithc->wait_hid_get_feature, !ithc->hid_get_feature_buf, msecs_to_jiffies(1000));
+			if (!r) r = -ETIMEDOUT;
+			else if (r < 0) r = -EINTR;
+			else r = 0;
+		}
+		mutex_lock(&ithc->hid_get_feature_mutex);
+		ithc->hid_get_feature_buf = NULL;
+		if (!r) r = ithc->hid_get_feature_size;
+		mutex_unlock(&ithc->hid_get_feature_mutex);
+		return r;
+	}
+	CHECK_RET(ithc_dma_tx, ithc, code, len, buf);
+	return 0;
+}
+
+static struct hid_ll_driver ithc_ll_driver = {
+	.start = ithc_hid_start,
+	.stop = ithc_hid_stop,
+	.open = ithc_hid_open,
+	.close = ithc_hid_close,
+	.parse = ithc_hid_parse,
+	.raw_request = ithc_hid_raw_request,
+};
+
+static void ithc_hid_devres_release(struct device *dev, void *res) {
+	struct hid_device **hidm = res;
+	if (*hidm) hid_destroy_device(*hidm);
+}
+
+static int ithc_hid_init(struct ithc *ithc) {
+	struct hid_device **hidm = devres_alloc(ithc_hid_devres_release, sizeof *hidm, GFP_KERNEL);
+	if (!hidm) return -ENOMEM;
+	devres_add(&ithc->pci->dev, hidm);
+	struct hid_device *hid = hid_allocate_device();
+	if (IS_ERR(hid)) return PTR_ERR(hid);
+	*hidm = hid;
+
+	strscpy(hid->name, DEVFULLNAME, sizeof(hid->name));
+	strscpy(hid->phys, ithc->phys, sizeof(hid->phys));
+	hid->ll_driver = &ithc_ll_driver;
+	hid->bus = BUS_PCI;
+	hid->vendor = ithc->config.vendor_id;
+	hid->product = ithc->config.product_id;
+	hid->version = 0x100;
+	hid->dev.parent = &ithc->pci->dev;
+	hid->driver_data = ithc;
+
+	ithc->hid = hid;
+	return 0;
+}
+
+// Interrupts/polling
+
+static void ithc_activity_timer_callback(struct timer_list *t) {
+	struct ithc *ithc = container_of(t, struct ithc, activity_timer);
+	cpu_latency_qos_update_request(&ithc->activity_qos, PM_QOS_DEFAULT_VALUE);
+}
+
+void ithc_set_active(struct ithc *ithc) {
+	// When CPU usage is very low, the CPU can enter various low power states (C2-C10).
+	// This disrupts DMA, causing truncated DMA messages. ERROR_FLAG_DMA_UNKNOWN_12 will be set when this happens.
+	// The amount of truncated messages can become very high, resulting in user-visible effects (laggy/stuttering cursor).
+	// To avoid this, we use a CPU latency QoS request to prevent the CPU from entering low power states during touch interactions.
+	cpu_latency_qos_update_request(&ithc->activity_qos, 0);
+	mod_timer(&ithc->activity_timer, jiffies + msecs_to_jiffies(1000));
+}
+
+static int ithc_set_device_enabled(struct ithc *ithc, bool enable) {
+	u32 x = ithc->config.touch_cfg = (ithc->config.touch_cfg & ~(u32)DEVCFG_TOUCH_MASK) | DEVCFG_TOUCH_UNKNOWN_2
+		| (enable ? DEVCFG_TOUCH_ENABLE | DEVCFG_TOUCH_UNKNOWN_3 | DEVCFG_TOUCH_UNKNOWN_4 : 0);
+	return ithc_spi_command(ithc, SPI_CMD_CODE_WRITE, offsetof(struct ithc_device_config, touch_cfg), sizeof x, &x);
+}
+
+static void ithc_disable_interrupts(struct ithc *ithc) {
+	writel(0, &ithc->regs->error_control);
+	bitsb(&ithc->regs->spi_cmd.control, SPI_CMD_CONTROL_IRQ, 0);
+	bitsb(&ithc->regs->dma_rx[0].control, DMA_RX_CONTROL_IRQ_UNKNOWN_1 | DMA_RX_CONTROL_IRQ_ERROR | DMA_RX_CONTROL_IRQ_UNKNOWN_4 | DMA_RX_CONTROL_IRQ_DATA, 0);
+	bitsb(&ithc->regs->dma_rx[1].control, DMA_RX_CONTROL_IRQ_UNKNOWN_1 | DMA_RX_CONTROL_IRQ_ERROR | DMA_RX_CONTROL_IRQ_UNKNOWN_4 | DMA_RX_CONTROL_IRQ_DATA, 0);
+	bitsb(&ithc->regs->dma_tx.control, DMA_TX_CONTROL_IRQ, 0);
+}
+
+static void ithc_clear_dma_rx_interrupts(struct ithc *ithc, unsigned channel) {
+	writel(DMA_RX_STATUS_ERROR | DMA_RX_STATUS_UNKNOWN_4 | DMA_RX_STATUS_HAVE_DATA, &ithc->regs->dma_rx[channel].status);
+}
+
+static void ithc_clear_interrupts(struct ithc *ithc) {
+	writel(0xffffffff, &ithc->regs->error_flags);
+	writel(ERROR_STATUS_DMA | ERROR_STATUS_SPI, &ithc->regs->error_status);
+	writel(SPI_CMD_STATUS_DONE | SPI_CMD_STATUS_ERROR, &ithc->regs->spi_cmd.status);
+	ithc_clear_dma_rx_interrupts(ithc, 0);
+	ithc_clear_dma_rx_interrupts(ithc, 1);
+	writel(DMA_TX_STATUS_DONE | DMA_TX_STATUS_ERROR | DMA_TX_STATUS_UNKNOWN_2, &ithc->regs->dma_tx.status);
+}
+
+static void ithc_process(struct ithc *ithc) {
+	ithc_log_regs(ithc);
+
+	// read and clear error bits
+	u32 err = readl(&ithc->regs->error_flags);
+	if (err) {
+		if (err & ~ERROR_FLAG_DMA_UNKNOWN_12) pci_err(ithc->pci, "error flags: 0x%08x\n", err);
+		writel(err, &ithc->regs->error_flags);
+	}
+
+	// process DMA rx
+	if (ithc_use_rx0) {
+		ithc_clear_dma_rx_interrupts(ithc, 0);
+		ithc_dma_rx(ithc, 0);
+	}
+	if (ithc_use_rx1) {
+		ithc_clear_dma_rx_interrupts(ithc, 1);
+		ithc_dma_rx(ithc, 1);
+	}
+
+	ithc_log_regs(ithc);
+}
+
+static irqreturn_t ithc_interrupt_thread(int irq, void *arg) {
+	struct ithc *ithc = arg;
+	pci_dbg(ithc->pci, "IRQ! err=%08x/%08x/%08x, cmd=%02x/%08x, rx0=%02x/%08x, rx1=%02x/%08x, tx=%02x/%08x\n",
+		readl(&ithc->regs->error_control), readl(&ithc->regs->error_status), readl(&ithc->regs->error_flags),
+		readb(&ithc->regs->spi_cmd.control), readl(&ithc->regs->spi_cmd.status),
+		readb(&ithc->regs->dma_rx[0].control), readl(&ithc->regs->dma_rx[0].status),
+		readb(&ithc->regs->dma_rx[1].control), readl(&ithc->regs->dma_rx[1].status),
+		readb(&ithc->regs->dma_tx.control), readl(&ithc->regs->dma_tx.status));
+	ithc_process(ithc);
+	return IRQ_HANDLED;
+}
+
+static int ithc_poll_thread(void *arg) {
+	struct ithc *ithc = arg;
+	unsigned sleep = 100;
+	while (!kthread_should_stop()) {
+		u32 n = ithc->dma_rx[1].num_received;
+		ithc_process(ithc);
+		if (n != ithc->dma_rx[1].num_received) sleep = 20;
+		else sleep = min(200u, sleep + (sleep >> 4) + 1);
+		msleep_interruptible(sleep);
+	}
+	return 0;
+}
+
+// Device initialization and shutdown
+
+static void ithc_disable(struct ithc *ithc) {
+	bitsl_set(&ithc->regs->control_bits, CONTROL_QUIESCE);
+	CHECK(waitl, ithc, &ithc->regs->control_bits, CONTROL_IS_QUIESCED, CONTROL_IS_QUIESCED);
+	bitsl(&ithc->regs->control_bits, CONTROL_NRESET, 0);
+	bitsb(&ithc->regs->spi_cmd.control, SPI_CMD_CONTROL_SEND, 0);
+	bitsb(&ithc->regs->dma_tx.control, DMA_TX_CONTROL_SEND, 0);
+	bitsb(&ithc->regs->dma_rx[0].control, DMA_RX_CONTROL_ENABLE, 0);
+	bitsb(&ithc->regs->dma_rx[1].control, DMA_RX_CONTROL_ENABLE, 0);
+	ithc_disable_interrupts(ithc);
+	ithc_clear_interrupts(ithc);
+}
+
+static int ithc_init_device(struct ithc *ithc) {
+	ithc_log_regs(ithc);
+	bool was_enabled = (readl(&ithc->regs->control_bits) & CONTROL_NRESET) != 0;
+	ithc_disable(ithc);
+	CHECK_RET(waitl, ithc, &ithc->regs->control_bits, CONTROL_READY, CONTROL_READY);
+	ithc_set_spi_config(ithc, 10, 0);
+	bitsl_set(&ithc->regs->dma_rx[0].unknown_init_bits, 0x80000000); // seems to help with reading config
+
+	if (was_enabled) if (msleep_interruptible(100)) return -EINTR;
+	bitsl(&ithc->regs->control_bits, CONTROL_QUIESCE, 0);
+	CHECK_RET(waitl, ithc, &ithc->regs->control_bits, CONTROL_IS_QUIESCED, 0);
+	for (int retries = 0; ; retries++) {
+		ithc_log_regs(ithc);
+		bitsl_set(&ithc->regs->control_bits, CONTROL_NRESET);
+		if (!waitl(ithc, &ithc->regs->state, 0xf, 2)) break;
+		if (retries > 5) {
+			pci_err(ithc->pci, "too many retries, failed to reset device\n");
+			return -ETIMEDOUT;
+		}
+		pci_err(ithc->pci, "invalid state, retrying reset\n");
+		bitsl(&ithc->regs->control_bits, CONTROL_NRESET, 0);
+		if (msleep_interruptible(1000)) return -EINTR;
+	}
+	ithc_log_regs(ithc);
+
+	CHECK(waitl, ithc, &ithc->regs->dma_rx[0].status, DMA_RX_STATUS_UNKNOWN_4, DMA_RX_STATUS_UNKNOWN_4);
+
+	// read config
+	for (int retries = 0; ; retries++) {
+		ithc_log_regs(ithc);
+		memset(&ithc->config, 0, sizeof ithc->config);
+		CHECK_RET(ithc_spi_command, ithc, SPI_CMD_CODE_READ, 0, sizeof ithc->config, &ithc->config);
+		u32 *p = (void *)&ithc->config;
+		pci_info(ithc->pci, "config: %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x\n",
+			p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7], p[8], p[9], p[10], p[11], p[12], p[13], p[14], p[15]);
+		if (ithc_is_config_valid(ithc)) break;
+		if (retries > 10) {
+			pci_err(ithc->pci, "failed to read config, unknown device ID 0x%08x\n", ithc->config.device_id);
+			return -EIO;
+		}
+		pci_err(ithc->pci, "failed to read config, retrying\n");
+		if (msleep_interruptible(100)) return -EINTR;
+	}
+	ithc_log_regs(ithc);
+
+	CHECK_RET(ithc_set_spi_config, ithc, DEVCFG_SPI_MAX_FREQ(ithc->config.spi_config), DEVCFG_SPI_MODE(ithc->config.spi_config));
+	CHECK_RET(ithc_set_device_enabled, ithc, true);
+	ithc_log_regs(ithc);
+	return 0;
+}
+
+int ithc_reset(struct ithc *ithc) {
+	// FIXME This should probably do devres_release_group()+ithc_start(). But because this is called during DMA
+	// processing, that would have to be done asynchronously (schedule_work()?). And with extra locking?
+	pci_err(ithc->pci, "reset\n");
+	CHECK(ithc_init_device, ithc);
+	if (ithc_use_rx0) ithc_dma_rx_enable(ithc, 0);
+	if (ithc_use_rx1) ithc_dma_rx_enable(ithc, 1);
+	ithc_log_regs(ithc);
+	pci_dbg(ithc->pci, "reset completed\n");
+	return 0;
+}
+
+static void ithc_stop(void *res) {
+	struct ithc *ithc = res;
+	pci_dbg(ithc->pci, "stopping\n");
+	ithc_log_regs(ithc);
+	if (ithc->poll_thread) CHECK(kthread_stop, ithc->poll_thread);
+	if (ithc->irq >= 0) disable_irq(ithc->irq);
+	CHECK(ithc_set_device_enabled, ithc, false);
+	ithc_disable(ithc);
+	del_timer_sync(&ithc->activity_timer);
+	cpu_latency_qos_remove_request(&ithc->activity_qos);
+	// clear dma config
+	for(unsigned i = 0; i < 2; i++) {
+		CHECK(waitl, ithc, &ithc->regs->dma_rx[i].status, DMA_RX_STATUS_ENABLED, 0);
+		lo_hi_writeq(0, &ithc->regs->dma_rx[i].addr);
+		writeb(0, &ithc->regs->dma_rx[i].num_bufs);
+		writeb(0, &ithc->regs->dma_rx[i].num_prds);
+	}
+	lo_hi_writeq(0, &ithc->regs->dma_tx.addr);
+	writeb(0, &ithc->regs->dma_tx.num_prds);
+	ithc_log_regs(ithc);
+	pci_dbg(ithc->pci, "stopped\n");
+}
+
+static void ithc_clear_drvdata(void *res) {
+	struct pci_dev *pci = res;
+	pci_set_drvdata(pci, NULL);
+}
+
+static int ithc_start(struct pci_dev *pci) {
+	pci_dbg(pci, "starting\n");
+	if (pci_get_drvdata(pci)) {
+		pci_err(pci, "device already initialized\n");
+		return -EINVAL;
+	}
+	if (!devres_open_group(&pci->dev, ithc_start, GFP_KERNEL)) return -ENOMEM;
+
+	struct ithc *ithc = devm_kzalloc(&pci->dev, sizeof *ithc, GFP_KERNEL);
+	if (!ithc) return -ENOMEM;
+	ithc->irq = -1;
+	ithc->pci = pci;
+	snprintf(ithc->phys, sizeof ithc->phys, "pci-%s/" DEVNAME, pci_name(pci));
+	init_waitqueue_head(&ithc->wait_hid_parse);
+	init_waitqueue_head(&ithc->wait_hid_get_feature);
+	mutex_init(&ithc->hid_get_feature_mutex);
+	pci_set_drvdata(pci, ithc);
+	CHECK_RET(devm_add_action_or_reset, &pci->dev, ithc_clear_drvdata, pci);
+	if (ithc_log_regs_enabled) ithc->prev_regs = devm_kzalloc(&pci->dev, sizeof *ithc->prev_regs, GFP_KERNEL);
+
+	CHECK_RET(pcim_enable_device, pci);
+	pci_set_master(pci);
+	CHECK_RET(pcim_iomap_regions, pci, BIT(0), DEVNAME " regs");
+	CHECK_RET(dma_set_mask_and_coherent, &pci->dev, DMA_BIT_MASK(64));
+	CHECK_RET(pci_set_power_state, pci, PCI_D0);
+	ithc->regs = pcim_iomap_table(pci)[0];
+
+	if (!ithc_use_polling) {
+		CHECK_RET(pci_alloc_irq_vectors, pci, 1, 1, PCI_IRQ_MSI | PCI_IRQ_MSIX);
+		ithc->irq = CHECK(pci_irq_vector, pci, 0);
+		if (ithc->irq < 0) return ithc->irq;
+	}
+
+	CHECK_RET(ithc_init_device, ithc);
+	CHECK(devm_device_add_groups, &pci->dev, ithc_attribute_groups);
+	if (ithc_use_rx0) CHECK_RET(ithc_dma_rx_init, ithc, 0, ithc_use_rx1 ? DEVNAME "0" : DEVNAME);
+	if (ithc_use_rx1) CHECK_RET(ithc_dma_rx_init, ithc, 1, ithc_use_rx0 ? DEVNAME "1" : DEVNAME);
+	CHECK_RET(ithc_dma_tx_init, ithc);
+
+	CHECK_RET(ithc_hid_init, ithc);
+
+	cpu_latency_qos_add_request(&ithc->activity_qos, PM_QOS_DEFAULT_VALUE);
+	timer_setup(&ithc->activity_timer, ithc_activity_timer_callback, 0);
+
+	// add ithc_stop callback AFTER setting up DMA buffers, so that polling/irqs/DMA are disabled BEFORE the buffers are freed
+	CHECK_RET(devm_add_action_or_reset, &pci->dev, ithc_stop, ithc);
+
+	if (ithc_use_polling) {
+		pci_info(pci, "using polling instead of irq\n");
+		// use a thread instead of simple timer because we want to be able to sleep
+		ithc->poll_thread = kthread_run(ithc_poll_thread, ithc, DEVNAME "poll");
+		if (IS_ERR(ithc->poll_thread)) {
+			int err = PTR_ERR(ithc->poll_thread);
+			ithc->poll_thread = NULL;
+			return err;
+		}
+	} else {
+		CHECK_RET(devm_request_threaded_irq, &pci->dev, ithc->irq, NULL, ithc_interrupt_thread, IRQF_TRIGGER_HIGH | IRQF_ONESHOT, DEVNAME, ithc);
+	}
+
+	if (ithc_use_rx0) ithc_dma_rx_enable(ithc, 0);
+	if (ithc_use_rx1) ithc_dma_rx_enable(ithc, 1);
+
+	// hid_add_device can only be called after irq/polling is started and DMA is enabled, because it calls ithc_hid_parse which reads the report descriptor via DMA
+	CHECK_RET(hid_add_device, ithc->hid);
+
+	CHECK(ithc_debug_init, ithc);
+
+	pci_dbg(pci, "started\n");
+	return 0;
+}
+
+static int ithc_probe(struct pci_dev *pci, const struct pci_device_id *id) {
+	pci_dbg(pci, "device probe\n");
+	return ithc_start(pci);
+}
+
+static void ithc_remove(struct pci_dev *pci) {
+	pci_dbg(pci, "device remove\n");
+	// all cleanup is handled by devres
+}
+
+static int ithc_suspend(struct device *dev) {
+	struct pci_dev *pci = to_pci_dev(dev);
+	pci_dbg(pci, "pm suspend\n");
+	devres_release_group(dev, ithc_start);
+	return 0;
+}
+
+static int ithc_resume(struct device *dev) {
+	struct pci_dev *pci = to_pci_dev(dev);
+	pci_dbg(pci, "pm resume\n");
+	return ithc_start(pci);
+}
+
+static int ithc_freeze(struct device *dev) {
+	struct pci_dev *pci = to_pci_dev(dev);
+	pci_dbg(pci, "pm freeze\n");
+	devres_release_group(dev, ithc_start);
+	return 0;
+}
+
+static int ithc_thaw(struct device *dev) {
+	struct pci_dev *pci = to_pci_dev(dev);
+	pci_dbg(pci, "pm thaw\n");
+	return ithc_start(pci);
+}
+
+static int ithc_restore(struct device *dev) {
+	struct pci_dev *pci = to_pci_dev(dev);
+	pci_dbg(pci, "pm restore\n");
+	return ithc_start(pci);
+}
+
+static struct pci_driver ithc_driver = {
+	.name = DEVNAME,
+	.id_table = ithc_pci_tbl,
+	.probe = ithc_probe,
+	.remove = ithc_remove,
+	.driver.pm = &(const struct dev_pm_ops) {
+		.suspend = ithc_suspend,
+		.resume = ithc_resume,
+		.freeze = ithc_freeze,
+		.thaw = ithc_thaw,
+		.restore = ithc_restore,
+	},
+	//.dev_groups = ithc_attribute_groups, // could use this (since 5.14), however the attributes won't have valid values until config has been read anyway
+};
+
+static int __init ithc_init(void) {
+	return pci_register_driver(&ithc_driver);
+}
+
+static void __exit ithc_exit(void) {
+	pci_unregister_driver(&ithc_driver);
+}
+
+module_init(ithc_init);
+module_exit(ithc_exit);
+
diff --git a/drivers/hid/ithc/ithc-regs.c b/drivers/hid/ithc/ithc-regs.c
new file mode 100644
index 000000000..85d567b05
--- /dev/null
+++ b/drivers/hid/ithc/ithc-regs.c
@@ -0,0 +1,64 @@
+#include "ithc.h"
+
+#define reg_num(r) (0x1fff & (u16)(__force u64)(r))
+
+void bitsl(__iomem u32 *reg, u32 mask, u32 val) {
+	if (val & ~mask) pr_err("register 0x%x: invalid value 0x%x for bitmask 0x%x\n", reg_num(reg), val, mask);
+	writel((readl(reg) & ~mask) | (val & mask), reg);
+}
+
+void bitsb(__iomem u8 *reg, u8 mask, u8 val) {
+	if (val & ~mask) pr_err("register 0x%x: invalid value 0x%x for bitmask 0x%x\n", reg_num(reg), val, mask);
+	writeb((readb(reg) & ~mask) | (val & mask), reg);
+}
+
+int waitl(struct ithc *ithc, __iomem u32 *reg, u32 mask, u32 val) {
+	pci_dbg(ithc->pci, "waiting for reg 0x%04x mask 0x%08x val 0x%08x\n", reg_num(reg), mask, val);
+	u32 x;
+	if (readl_poll_timeout(reg, x, (x & mask) == val, 200, 1000*1000)) {
+		pci_err(ithc->pci, "timed out waiting for reg 0x%04x mask 0x%08x val 0x%08x\n", reg_num(reg), mask, val);
+		return -ETIMEDOUT;
+	}
+	pci_dbg(ithc->pci, "done waiting\n");
+	return 0;
+}
+
+int waitb(struct ithc *ithc, __iomem u8 *reg, u8 mask, u8 val) {
+	pci_dbg(ithc->pci, "waiting for reg 0x%04x mask 0x%02x val 0x%02x\n", reg_num(reg), mask, val);
+	u8 x;
+	if (readb_poll_timeout(reg, x, (x & mask) == val, 200, 1000*1000)) {
+		pci_err(ithc->pci, "timed out waiting for reg 0x%04x mask 0x%02x val 0x%02x\n", reg_num(reg), mask, val);
+		return -ETIMEDOUT;
+	}
+	pci_dbg(ithc->pci, "done waiting\n");
+	return 0;
+}
+
+int ithc_set_spi_config(struct ithc *ithc, u8 speed, u8 mode) {
+	pci_dbg(ithc->pci, "setting SPI speed to %i, mode %i\n", speed, mode);
+	if (mode == 3) mode = 2;
+	bitsl(&ithc->regs->spi_config,
+		SPI_CONFIG_MODE(0xff) | SPI_CONFIG_SPEED(0xff) | SPI_CONFIG_UNKNOWN_18(0xff) | SPI_CONFIG_SPEED2(0xff),
+		SPI_CONFIG_MODE(mode) | SPI_CONFIG_SPEED(speed) | SPI_CONFIG_UNKNOWN_18(0) | SPI_CONFIG_SPEED2(speed));
+	return 0;
+}
+
+int ithc_spi_command(struct ithc *ithc, u8 command, u32 offset, u32 size, void *data) {
+	pci_dbg(ithc->pci, "SPI command %u, size %u, offset %u\n", command, size, offset);
+	if (size > sizeof ithc->regs->spi_cmd.data) return -EINVAL;
+	CHECK_RET(waitl, ithc, &ithc->regs->spi_cmd.status, SPI_CMD_STATUS_BUSY, 0);
+	writel(SPI_CMD_STATUS_DONE | SPI_CMD_STATUS_ERROR, &ithc->regs->spi_cmd.status);
+	writeb(command, &ithc->regs->spi_cmd.code);
+	writew(size, &ithc->regs->spi_cmd.size);
+	writel(offset, &ithc->regs->spi_cmd.offset);
+	u32 *p = data, n = (size + 3) / 4;
+	for (u32 i = 0; i < n; i++) writel(p[i], &ithc->regs->spi_cmd.data[i]);
+	bitsb_set(&ithc->regs->spi_cmd.control, SPI_CMD_CONTROL_SEND);
+	CHECK_RET(waitl, ithc, &ithc->regs->spi_cmd.status, SPI_CMD_STATUS_BUSY, 0);
+	if ((readl(&ithc->regs->spi_cmd.status) & (SPI_CMD_STATUS_DONE | SPI_CMD_STATUS_ERROR)) != SPI_CMD_STATUS_DONE) return -EIO;
+	if (readw(&ithc->regs->spi_cmd.size) != size) return -EMSGSIZE;
+	for (u32 i = 0; i < n; i++) p[i] = readl(&ithc->regs->spi_cmd.data[i]);
+	writel(SPI_CMD_STATUS_DONE | SPI_CMD_STATUS_ERROR, &ithc->regs->spi_cmd.status);
+	return 0;
+}
+
diff --git a/drivers/hid/ithc/ithc-regs.h b/drivers/hid/ithc/ithc-regs.h
new file mode 100644
index 000000000..1a96092ed
--- /dev/null
+++ b/drivers/hid/ithc/ithc-regs.h
@@ -0,0 +1,186 @@
+#define CONTROL_QUIESCE                     BIT(1)
+#define CONTROL_IS_QUIESCED                 BIT(2)
+#define CONTROL_NRESET                      BIT(3)
+#define CONTROL_READY                       BIT(29)
+
+#define SPI_CONFIG_MODE(x)                  (((x) & 3) << 2)
+#define SPI_CONFIG_SPEED(x)                 (((x) & 7) << 4)
+#define SPI_CONFIG_UNKNOWN_18(x)            (((x) & 3) << 18)
+#define SPI_CONFIG_SPEED2(x)                (((x) & 0xf) << 20) // high bit = high speed mode?
+
+#define ERROR_CONTROL_UNKNOWN_0             BIT(0)
+#define ERROR_CONTROL_DISABLE_DMA           BIT(1) // clears DMA_RX_CONTROL_ENABLE when a DMA error occurs
+#define ERROR_CONTROL_UNKNOWN_2             BIT(2)
+#define ERROR_CONTROL_UNKNOWN_3             BIT(3)
+#define ERROR_CONTROL_IRQ_DMA_UNKNOWN_9     BIT(9)
+#define ERROR_CONTROL_IRQ_DMA_UNKNOWN_10    BIT(10)
+#define ERROR_CONTROL_IRQ_DMA_UNKNOWN_12    BIT(12)
+#define ERROR_CONTROL_IRQ_DMA_UNKNOWN_13    BIT(13)
+#define ERROR_CONTROL_UNKNOWN_16(x)         (((x) & 0xff) << 16) // spi error code irq?
+#define ERROR_CONTROL_SET_DMA_STATUS        BIT(29) // sets DMA_RX_STATUS_ERROR when a DMA error occurs
+
+#define ERROR_STATUS_DMA                    BIT(28)
+#define ERROR_STATUS_SPI                    BIT(30)
+
+#define ERROR_FLAG_DMA_UNKNOWN_9            BIT(9)
+#define ERROR_FLAG_DMA_UNKNOWN_10           BIT(10)
+#define ERROR_FLAG_DMA_UNKNOWN_12           BIT(12) // set when we receive a truncated DMA message
+#define ERROR_FLAG_DMA_UNKNOWN_13           BIT(13)
+#define ERROR_FLAG_SPI_BUS_TURNAROUND       BIT(16)
+#define ERROR_FLAG_SPI_RESPONSE_TIMEOUT     BIT(17)
+#define ERROR_FLAG_SPI_INTRA_PACKET_TIMEOUT BIT(18)
+#define ERROR_FLAG_SPI_INVALID_RESPONSE     BIT(19)
+#define ERROR_FLAG_SPI_HS_RX_TIMEOUT        BIT(20)
+#define ERROR_FLAG_SPI_TOUCH_IC_INIT        BIT(21)
+
+#define SPI_CMD_CONTROL_SEND                BIT(0) // cleared by device when sending is complete
+#define SPI_CMD_CONTROL_IRQ                 BIT(1)
+
+#define SPI_CMD_CODE_READ                   4
+#define SPI_CMD_CODE_WRITE                  6
+
+#define SPI_CMD_STATUS_DONE                 BIT(0)
+#define SPI_CMD_STATUS_ERROR                BIT(1)
+#define SPI_CMD_STATUS_BUSY                 BIT(3)
+
+#define DMA_TX_CONTROL_SEND                 BIT(0) // cleared by device when sending is complete
+#define DMA_TX_CONTROL_IRQ                  BIT(3)
+
+#define DMA_TX_STATUS_DONE                  BIT(0)
+#define DMA_TX_STATUS_ERROR                 BIT(1)
+#define DMA_TX_STATUS_UNKNOWN_2             BIT(2)
+#define DMA_TX_STATUS_UNKNOWN_3             BIT(3) // busy?
+
+#define DMA_RX_CONTROL_ENABLE               BIT(0)
+#define DMA_RX_CONTROL_IRQ_UNKNOWN_1        BIT(1) // rx1 only?
+#define DMA_RX_CONTROL_IRQ_ERROR            BIT(3) // rx1 only?
+#define DMA_RX_CONTROL_IRQ_UNKNOWN_4        BIT(4) // rx0 only?
+#define DMA_RX_CONTROL_IRQ_DATA             BIT(5)
+
+#define DMA_RX_CONTROL2_UNKNOWN_5           BIT(5) // rx0 only?
+#define DMA_RX_CONTROL2_RESET               BIT(7) // resets ringbuffer indices
+
+#define DMA_RX_WRAP_FLAG                    BIT(7)
+
+#define DMA_RX_STATUS_ERROR                 BIT(3)
+#define DMA_RX_STATUS_UNKNOWN_4             BIT(4) // set in rx0 after using CONTROL_NRESET when it becomes possible to read config (can take >100ms)
+#define DMA_RX_STATUS_HAVE_DATA             BIT(5)
+#define DMA_RX_STATUS_ENABLED               BIT(8)
+
+#define COUNTER_RESET                       BIT(31)
+
+struct ithc_registers {
+	/* 0000 */ u32 _unknown_0000[1024];
+	/* 1000 */ u32 _unknown_1000;
+	/* 1004 */ u32 _unknown_1004;
+	/* 1008 */ u32 control_bits;
+	/* 100c */ u32 _unknown_100c;
+	/* 1010 */ u32 spi_config;
+	/* 1014 */ u32 _unknown_1014[3];
+	/* 1020 */ u32 error_control;
+	/* 1024 */ u32 error_status; // write to clear
+	/* 1028 */ u32 error_flags; // write to clear
+	/* 102c */ u32 _unknown_102c[5];
+	struct {
+		/* 1040 */ u8 control;
+		/* 1041 */ u8 code;
+		/* 1042 */ u16 size;
+		/* 1044 */ u32 status; // write to clear
+		/* 1048 */ u32 offset;
+		/* 104c */ u32 data[16];
+		/* 108c */ u32 _unknown_108c;
+	} spi_cmd;
+	struct {
+		/* 1090 */ u64 addr; // cannot be written with writeq(), must use lo_hi_writeq()
+		/* 1098 */ u8 control;
+		/* 1099 */ u8 _unknown_1099;
+		/* 109a */ u8 _unknown_109a;
+		/* 109b */ u8 num_prds;
+		/* 109c */ u32 status; // write to clear
+	} dma_tx;
+	/* 10a0 */ u32 _unknown_10a0[7];
+	/* 10bc */ u32 state; // is 0xe0000402 (dev config val 0) after CONTROL_NRESET, 0xe0000461 after first touch, 0xe0000401 after DMA_RX_CODE_RESET
+	/* 10c0 */ u32 _unknown_10c0[8];
+	/* 10e0 */ u32 _unknown_10e0_counters[3];
+	/* 10ec */ u32 _unknown_10ec[5];
+	struct {
+		/* 1100/1200 */ u64 addr; // cannot be written with writeq(), must use lo_hi_writeq()
+		/* 1108/1208 */ u8 num_bufs;
+		/* 1109/1209 */ u8 num_prds;
+		/* 110a/120a */ u16 _unknown_110a;
+		/* 110c/120c */ u8 control;
+		/* 110d/120d */ u8 head;
+		/* 110e/120e */ u8 tail;
+		/* 110f/120f */ u8 control2;
+		/* 1110/1210 */ u32 status; // write to clear
+		/* 1114/1214 */ u32 _unknown_1114;
+		/* 1118/1218 */ u64 _unknown_1118_guc_addr;
+		/* 1120/1220 */ u32 _unknown_1120_guc;
+		/* 1124/1224 */ u32 _unknown_1124_guc;
+		/* 1128/1228 */ u32 unknown_init_bits; // bit 2 = guc related, bit 3 = rx1 related, bit 4 = guc related
+		/* 112c/122c */ u32 _unknown_112c;
+		/* 1130/1230 */ u64 _unknown_1130_guc_addr;
+		/* 1138/1238 */ u32 _unknown_1138_guc;
+		/* 113c/123c */ u32 _unknown_113c;
+		/* 1140/1240 */ u32 _unknown_1140_guc;
+		/* 1144/1244 */ u32 _unknown_1144[23];
+		/* 11a0/12a0 */ u32 _unknown_11a0_counters[6];
+		/* 11b8/12b8 */ u32 _unknown_11b8[18];
+	} dma_rx[2];
+};
+static_assert(sizeof(struct ithc_registers) == 0x1300);
+
+#define DEVCFG_DMA_RX_SIZE(x)          ((((x) & 0x3fff) + 1) << 6)
+#define DEVCFG_DMA_TX_SIZE(x)          (((((x) >> 14) & 0x3ff) + 1) << 6)
+
+#define DEVCFG_TOUCH_MASK              0x3f
+#define DEVCFG_TOUCH_ENABLE            BIT(0)
+#define DEVCFG_TOUCH_UNKNOWN_1         BIT(1)
+#define DEVCFG_TOUCH_UNKNOWN_2         BIT(2)
+#define DEVCFG_TOUCH_UNKNOWN_3         BIT(3)
+#define DEVCFG_TOUCH_UNKNOWN_4         BIT(4)
+#define DEVCFG_TOUCH_UNKNOWN_5         BIT(5)
+#define DEVCFG_TOUCH_UNKNOWN_6         BIT(6)
+
+#define DEVCFG_DEVICE_ID_TIC           0x43495424 // "$TIC"
+
+#define DEVCFG_SPI_MAX_FREQ(x)         (((x) >> 1) & 0xf) // high bit = use high speed mode?
+#define DEVCFG_SPI_MODE(x)             (((x) >> 6) & 3)
+#define DEVCFG_SPI_UNKNOWN_8(x)        (((x) >> 8) & 0x3f)
+#define DEVCFG_SPI_NEEDS_HEARTBEAT     BIT(20)
+#define DEVCFG_SPI_HEARTBEAT_INTERVAL  (((x) >> 21) & 7)
+#define DEVCFG_SPI_UNKNOWN_25          BIT(25)
+#define DEVCFG_SPI_UNKNOWN_26          BIT(26)
+#define DEVCFG_SPI_UNKNOWN_27          BIT(27)
+#define DEVCFG_SPI_DELAY               (((x) >> 28) & 7)
+#define DEVCFG_SPI_USE_EXT_READ_CFG    BIT(31)
+
+struct ithc_device_config {
+	u32 _unknown_00;      // 00 = 0xe0000402 (0xe0000401 after DMA_RX_CODE_RESET)
+	u32 _unknown_04;      // 04 = 0x00000000
+	u32 dma_buf_sizes;    // 08 = 0x000a00ff
+	u32 touch_cfg;        // 0c = 0x0000001c
+	u32 _unknown_10;      // 10 = 0x0000001c
+	u32 device_id;        // 14 = 0x43495424 = "$TIC"
+	u32 spi_config;       // 18 = 0xfda00a2e
+	u16 vendor_id;        // 1c = 0x045e = Microsoft Corp.
+	u16 product_id;       // 1e = 0x0c1a
+	u32 revision;         // 20 = 0x00000001
+	u32 fw_version;       // 24 = 0x05008a8b = 5.0.138.139
+	u32 _unknown_28;      // 28 = 0x00000000
+	u32 fw_mode;          // 2c = 0x00000000
+	u32 _unknown_30;      // 30 = 0x00000000
+	u32 _unknown_34;      // 34 = 0x0404035e (u8,u8,u8,u8 = version?)
+	u32 _unknown_38;      // 38 = 0x000001c0 (0x000001c1 after DMA_RX_CODE_RESET)
+	u32 _unknown_3c;      // 3c = 0x00000002
+};
+
+void bitsl(__iomem u32 *reg, u32 mask, u32 val);
+void bitsb(__iomem u8 *reg, u8 mask, u8 val);
+#define bitsl_set(reg, x) bitsl(reg, x, x)
+#define bitsb_set(reg, x) bitsb(reg, x, x)
+int waitl(struct ithc *ithc, __iomem u32 *reg, u32 mask, u32 val);
+int waitb(struct ithc *ithc, __iomem u8 *reg, u8 mask, u8 val);
+int ithc_set_spi_config(struct ithc *ithc, u8 speed, u8 mode);
+int ithc_spi_command(struct ithc *ithc, u8 command, u32 offset, u32 size, void *data);
+
diff --git a/drivers/hid/ithc/ithc.h b/drivers/hid/ithc/ithc.h
new file mode 100644
index 000000000..6a9b0d480
--- /dev/null
+++ b/drivers/hid/ithc/ithc.h
@@ -0,0 +1,60 @@
+#include <linux/module.h>
+#include <linux/input.h>
+#include <linux/hid.h>
+#include <linux/dma-mapping.h>
+#include <linux/highmem.h>
+#include <linux/pci.h>
+#include <linux/io-64-nonatomic-lo-hi.h>
+#include <linux/iopoll.h>
+#include <linux/delay.h>
+#include <linux/kthread.h>
+#include <linux/miscdevice.h>
+#include <linux/debugfs.h>
+#include <linux/poll.h>
+#include <linux/timer.h>
+#include <linux/pm_qos.h>
+
+#define DEVNAME "ithc"
+#define DEVFULLNAME "Intel Touch Host Controller"
+
+#undef pr_fmt
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#define CHECK(fn, ...) ({ int r = fn(__VA_ARGS__); if (r < 0) pci_err(ithc->pci, "%s: %s failed with %i\n", __func__, #fn, r); r; })
+#define CHECK_RET(...) do { int r = CHECK(__VA_ARGS__); if (r < 0) return r; } while(0)
+
+#define NUM_RX_BUF 16
+
+struct ithc;
+
+#include "ithc-regs.h"
+#include "ithc-dma.h"
+
+struct ithc {
+	char phys[32];
+	struct pci_dev *pci;
+	int irq;
+	struct task_struct *poll_thread;
+	struct pm_qos_request activity_qos;
+	struct timer_list activity_timer;
+
+	struct hid_device *hid;
+	bool hid_parse_done;
+	wait_queue_head_t wait_hid_parse;
+	wait_queue_head_t wait_hid_get_feature;
+	struct mutex hid_get_feature_mutex;
+	void *hid_get_feature_buf;
+	size_t hid_get_feature_size;
+
+	struct ithc_registers __iomem *regs;
+	struct ithc_registers *prev_regs; // for debugging
+	struct ithc_device_config config;
+	struct ithc_dma_rx dma_rx[2];
+	struct ithc_dma_tx dma_tx;
+};
+
+int ithc_reset(struct ithc *ithc);
+void ithc_set_active(struct ithc *ithc);
+int ithc_debug_init(struct ithc *ithc);
+void ithc_log_regs(struct ithc *ithc);
+
diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
index d6037a328..a290ebc77 100644
--- a/drivers/i2c/i2c-core-acpi.c
+++ b/drivers/i2c/i2c-core-acpi.c
@@ -628,6 +628,28 @@ static int acpi_gsb_i2c_write_bytes(struct i2c_client *client,
 	return (ret == 1) ? 0 : -EIO;
 }
 
+static int acpi_gsb_i2c_write_raw_bytes(struct i2c_client *client,
+		u8 *data, u8 data_len)
+{
+	struct i2c_msg msgs[1];
+	int ret = AE_OK;
+
+	msgs[0].addr = client->addr;
+	msgs[0].flags = client->flags;
+	msgs[0].len = data_len + 1;
+	msgs[0].buf = data;
+
+	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
+
+	if (ret < 0) {
+		dev_err(&client->adapter->dev, "i2c write failed: %d\n", ret);
+		return ret;
+	}
+
+	/* 1 transfer must have completed successfully */
+	return (ret == 1) ? 0 : -EIO;
+}
+
 static acpi_status
 i2c_acpi_space_handler(u32 function, acpi_physical_address command,
 			u32 bits, u64 *value64,
@@ -729,6 +751,19 @@ i2c_acpi_space_handler(u32 function, acpi_physical_address command,
 		}
 		break;
 
+	case ACPI_GSB_ACCESS_ATTRIB_RAW_BYTES:
+		if (action == ACPI_READ) {
+			dev_warn(&adapter->dev,
+				 "protocol 0x%02x not supported for client 0x%02x\n",
+				 accessor_type, client->addr);
+			ret = AE_BAD_PARAMETER;
+			goto err;
+		} else {
+			status = acpi_gsb_i2c_write_raw_bytes(client,
+					gsb->data, info->access_length);
+		}
+		break;
+
 	default:
 		dev_warn(&adapter->dev, "protocol 0x%02x not supported for client 0x%02x\n",
 			 accessor_type, client->addr);
diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c
index e79f54979..2bddbe6e9 100644
--- a/drivers/input/misc/soc_button_array.c
+++ b/drivers/input/misc/soc_button_array.c
@@ -537,8 +537,8 @@ static const struct soc_device_data soc_device_MSHW0028 = {
  * Both, the Surface Pro 4 (surfacepro3_button.c) and the above mentioned
  * devices use MSHW0040 for power and volume buttons, however the way they
  * have to be addressed differs. Make sure that we only load this drivers
- * for the correct devices by checking the OEM Platform Revision provided by
- * the _DSM method.
+ * for the correct devices by checking if the OEM Platform Revision DSM call
+ * exists.
  */
 #define MSHW0040_DSM_REVISION		0x01
 #define MSHW0040_DSM_GET_OMPR		0x02	// get OEM Platform Revision
@@ -549,31 +549,14 @@ static const guid_t MSHW0040_DSM_UUID =
 static int soc_device_check_MSHW0040(struct device *dev)
 {
 	acpi_handle handle = ACPI_HANDLE(dev);
-	union acpi_object *result;
-	u64 oem_platform_rev = 0;	// valid revisions are nonzero
-
-	// get OEM platform revision
-	result = acpi_evaluate_dsm_typed(handle, &MSHW0040_DSM_UUID,
-					 MSHW0040_DSM_REVISION,
-					 MSHW0040_DSM_GET_OMPR, NULL,
-					 ACPI_TYPE_INTEGER);
-
-	if (result) {
-		oem_platform_rev = result->integer.value;
-		ACPI_FREE(result);
-	}
-
-	/*
-	 * If the revision is zero here, the _DSM evaluation has failed. This
-	 * indicates that we have a Pro 4 or Book 1 and this driver should not
-	 * be used.
-	 */
-	if (oem_platform_rev == 0)
-		return -ENODEV;
+	bool exists;
 
-	dev_dbg(dev, "OEM Platform Revision %llu\n", oem_platform_rev);
+	// check if OEM platform revision DSM call exists
+	exists = acpi_check_dsm(handle, &MSHW0040_DSM_UUID,
+				MSHW0040_DSM_REVISION,
+				BIT(MSHW0040_DSM_GET_OMPR));
 
-	return 0;
+	return exists ? 0 : -ENODEV;
 }
 
 /*
diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 5c8c5cdc3..e10b4f625 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -37,6 +37,14 @@
 #define IS_GFX_DEVICE(pdev) ((pdev->class >> 16) == PCI_BASE_CLASS_DISPLAY)
 #define IS_USB_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_SERIAL_USB)
 #define IS_ISA_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA)
+#define IS_INTEL_IPU(pdev) ((pdev)->vendor == PCI_VENDOR_ID_INTEL &&	\
+			   ((pdev)->device == 0x9a19 ||		\
+			    (pdev)->device == 0x9a39 ||		\
+			    (pdev)->device == 0x4e19 ||		\
+			    (pdev)->device == 0x465d ||		\
+			    (pdev)->device == 0x1919))
+#define IS_IPTS(pdev) ((pdev)->vendor == PCI_VENDOR_ID_INTEL &&	\
+			    ((pdev)->device == 0x9d3e))
 #define IS_AZALIA(pdev) ((pdev)->vendor == 0x8086 && (pdev)->device == 0x3a3e)
 
 #define IOAPIC_RANGE_START	(0xfee00000)
@@ -287,12 +295,16 @@ int intel_iommu_enabled = 0;
 EXPORT_SYMBOL_GPL(intel_iommu_enabled);
 
 static int dmar_map_gfx = 1;
+static int dmar_map_ipts = 1;
+static int dmar_map_ipu = 1;
 static int intel_iommu_superpage = 1;
 static int iommu_identity_mapping;
 static int iommu_skip_te_disable;
 
 #define IDENTMAP_GFX		2
 #define IDENTMAP_AZALIA		4
+#define IDENTMAP_IPU		8
+#define IDENTMAP_IPTS		16
 
 const struct iommu_ops intel_iommu_ops;
 
@@ -2548,6 +2560,12 @@ static int device_def_domain_type(struct device *dev)
 
 		if ((iommu_identity_mapping & IDENTMAP_GFX) && IS_GFX_DEVICE(pdev))
 			return IOMMU_DOMAIN_IDENTITY;
+
+		if ((iommu_identity_mapping & IDENTMAP_IPU) && IS_INTEL_IPU(pdev))
+			return IOMMU_DOMAIN_IDENTITY;
+
+		if ((iommu_identity_mapping & IDENTMAP_IPTS) && IS_IPTS(pdev))
+			return IOMMU_DOMAIN_IDENTITY;
 	}
 
 	return 0;
@@ -2855,6 +2873,12 @@ static int __init init_dmars(void)
 	if (!dmar_map_gfx)
 		iommu_identity_mapping |= IDENTMAP_GFX;
 
+	if (!dmar_map_ipu)
+		iommu_identity_mapping |= IDENTMAP_IPU;
+
+	if (!dmar_map_ipts)
+		iommu_identity_mapping |= IDENTMAP_IPTS;
+
 	check_tylersburg_isoch();
 
 	ret = si_domain_init(hw_pass_through);
@@ -4771,6 +4795,30 @@ static void quirk_iommu_igfx(struct pci_dev *dev)
 	dmar_map_gfx = 0;
 }
 
+static void quirk_iommu_ipu(struct pci_dev *dev)
+{
+	if (!IS_INTEL_IPU(dev))
+		return;
+
+	if (risky_device(dev))
+		return;
+
+	pci_info(dev, "Passthrough IOMMU for integrated Intel IPU\n");
+	dmar_map_ipu = 0;
+}
+
+static void quirk_iommu_ipts(struct pci_dev *dev)
+{
+	if (!IS_IPTS(dev))
+		return;
+
+	if (risky_device(dev))
+		return;
+
+	pci_info(dev, "Passthrough IOMMU for IPTS\n");
+	dmar_map_ipts = 0;
+}
+
 /* G4x/GM45 integrated gfx dmar support is totally busted. */
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_igfx);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e00, quirk_iommu_igfx);
@@ -4806,6 +4854,12 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1632, quirk_iommu_igfx);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x163A, quirk_iommu_igfx);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x163D, quirk_iommu_igfx);
 
+/* disable IPU dmar support */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_ANY_ID, quirk_iommu_ipu);
+
+/* disable IPTS dmar support */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9D3E, quirk_iommu_ipts);
+
 static void quirk_iommu_rwbf(struct pci_dev *dev)
 {
 	if (risky_device(dev))
diff --git a/drivers/iommu/intel/irq_remapping.c b/drivers/iommu/intel/irq_remapping.c
index 08f56326e..75218b389 100644
--- a/drivers/iommu/intel/irq_remapping.c
+++ b/drivers/iommu/intel/irq_remapping.c
@@ -386,6 +386,22 @@ static int set_msi_sid(struct irte *irte, struct pci_dev *dev)
 	data.busmatch_count = 0;
 	pci_for_each_dma_alias(dev, set_msi_sid_cb, &data);
 
+	/*
+	 * The Intel Touch Host Controller is at 00:10.6, but for some reason
+	 * the MSI interrupts have request id 01:05.0.
+	 * Disable id verification to work around this.
+	 * FIXME Find proper fix or turn this into a quirk.
+	 */
+	if (dev->vendor == PCI_VENDOR_ID_INTEL && (dev->class >> 8) == PCI_CLASS_INPUT_PEN) {
+		switch(dev->device) {
+		case 0x98d0: case 0x98d1: // LKF
+		case 0xa0d0: case 0xa0d1: // TGL LP
+		case 0x43d0: case 0x43d1: // TGL H
+			set_irte_sid(irte, SVT_NO_VERIFY, SQ_ALL_16, 0);
+			return 0;
+		}
+	}
+
 	/*
 	 * DMA alias provides us with a PCI device and alias.  The only case
 	 * where the it will return an alias on a different bus than the
diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig
index 6046dfeca..385c06e4f 100644
--- a/drivers/leds/Kconfig
+++ b/drivers/leds/Kconfig
@@ -864,6 +864,18 @@ config LEDS_TPS6105X
 	  It is a single boost converter primarily for white LEDs and
 	  audio amplifiers.
 
+config LEDS_TPS68470
+	tristate "LED support for TI TPS68470"
+	depends on LEDS_CLASS
+	depends on INTEL_SKL_INT3472
+	help
+	  This driver supports TPS68470 PMIC with LED chip.
+	  It provides two LED controllers, with the ability to drive 2
+	  indicator LEDs and 2 flash LEDs.
+
+	  To compile this driver as a module, choose M and it will be
+	  called leds-tps68470
+
 config LEDS_IP30
 	tristate "LED support for SGI Octane machines"
 	depends on LEDS_CLASS
diff --git a/drivers/leds/Makefile b/drivers/leds/Makefile
index d71f12265..e2002b535 100644
--- a/drivers/leds/Makefile
+++ b/drivers/leds/Makefile
@@ -83,6 +83,7 @@ obj-$(CONFIG_LEDS_TCA6507)		+= leds-tca6507.o
 obj-$(CONFIG_LEDS_TI_LMU_COMMON)	+= leds-ti-lmu-common.o
 obj-$(CONFIG_LEDS_TLC591XX)		+= leds-tlc591xx.o
 obj-$(CONFIG_LEDS_TPS6105X)		+= leds-tps6105x.o
+obj-$(CONFIG_LEDS_TPS68470)		+= leds-tps68470.o
 obj-$(CONFIG_LEDS_TURRIS_OMNIA)		+= leds-turris-omnia.o
 obj-$(CONFIG_LEDS_WM831X_STATUS)	+= leds-wm831x-status.o
 obj-$(CONFIG_LEDS_WM8350)		+= leds-wm8350.o
diff --git a/drivers/leds/leds-tps68470.c b/drivers/leds/leds-tps68470.c
new file mode 100644
index 000000000..35aeb5db8
--- /dev/null
+++ b/drivers/leds/leds-tps68470.c
@@ -0,0 +1,185 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * LED driver for TPS68470 PMIC
+ *
+ * Copyright (C) 2023 Red Hat
+ *
+ * Authors:
+ *	Kate Hsuan <hpa@redhat.com>
+ */
+
+#include <linux/leds.h>
+#include <linux/mfd/tps68470.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/property.h>
+#include <linux/regmap.h>
+
+
+#define lcdev_to_led(led_cdev) \
+	container_of(led_cdev, struct tps68470_led, lcdev)
+
+#define led_to_tps68470(led, index) \
+	container_of(led, struct tps68470_device, leds[index])
+
+enum tps68470_led_ids {
+	TPS68470_ILED_A,
+	TPS68470_ILED_B,
+	TPS68470_NUM_LEDS
+};
+
+static const char *tps68470_led_names[] = {
+	[TPS68470_ILED_A] = "tps68470-iled_a",
+	[TPS68470_ILED_B] = "tps68470-iled_b",
+};
+
+struct tps68470_led {
+	unsigned int led_id;
+	struct led_classdev lcdev;
+};
+
+struct tps68470_device {
+	struct device *dev;
+	struct regmap *regmap;
+	struct tps68470_led leds[TPS68470_NUM_LEDS];
+};
+
+enum ctrlb_current {
+	CTRLB_2MA	= 0,
+	CTRLB_4MA	= 1,
+	CTRLB_8MA	= 2,
+	CTRLB_16MA	= 3,
+};
+
+static int tps68470_brightness_set(struct led_classdev *led_cdev, enum led_brightness brightness)
+{
+	struct tps68470_led *led = lcdev_to_led(led_cdev);
+	struct tps68470_device *tps68470 = led_to_tps68470(led, led->led_id);
+	struct regmap *regmap = tps68470->regmap;
+
+	switch (led->led_id) {
+	case TPS68470_ILED_A:
+		return regmap_update_bits(regmap, TPS68470_REG_ILEDCTL, TPS68470_ILEDCTL_ENA,
+					  brightness ? TPS68470_ILEDCTL_ENA : 0);
+	case TPS68470_ILED_B:
+		return regmap_update_bits(regmap, TPS68470_REG_ILEDCTL, TPS68470_ILEDCTL_ENB,
+					  brightness ? TPS68470_ILEDCTL_ENB : 0);
+	}
+	return -EINVAL;
+}
+
+static enum led_brightness tps68470_brightness_get(struct led_classdev *led_cdev)
+{
+	struct tps68470_led *led = lcdev_to_led(led_cdev);
+	struct tps68470_device *tps68470 = led_to_tps68470(led, led->led_id);
+	struct regmap *regmap = tps68470->regmap;
+	int ret = 0;
+	int value = 0;
+
+	ret =  regmap_read(regmap, TPS68470_REG_ILEDCTL, &value);
+	if (ret)
+		return dev_err_probe(led_cdev->dev, -EINVAL, "failed on reading register\n");
+
+	switch (led->led_id) {
+	case TPS68470_ILED_A:
+		value = value & TPS68470_ILEDCTL_ENA;
+		break;
+	case TPS68470_ILED_B:
+		value = value & TPS68470_ILEDCTL_ENB;
+		break;
+	}
+
+	return value ? LED_ON : LED_OFF;
+}
+
+
+static int tps68470_ledb_current_init(struct platform_device *pdev,
+				      struct tps68470_device *tps68470)
+{
+	int ret = 0;
+	unsigned int curr;
+
+	/* configure LEDB current if the properties can be got */
+	if (!device_property_read_u32(&pdev->dev, "ti,ledb-current", &curr)) {
+		if (curr > CTRLB_16MA) {
+			dev_err(&pdev->dev,
+				"Invalid LEDB current value: %d\n",
+				curr);
+			return -EINVAL;
+		}
+		ret = regmap_update_bits(tps68470->regmap, TPS68470_REG_ILEDCTL,
+					 TPS68470_ILEDCTL_CTRLB, curr);
+	}
+	return ret;
+}
+
+static int tps68470_leds_probe(struct platform_device *pdev)
+{
+	int i = 0;
+	int ret = 0;
+	struct tps68470_device *tps68470;
+	struct tps68470_led *led;
+	struct led_classdev *lcdev;
+
+	tps68470 = devm_kzalloc(&pdev->dev, sizeof(struct tps68470_device),
+				GFP_KERNEL);
+	if (!tps68470)
+		return -ENOMEM;
+
+	tps68470->dev = &pdev->dev;
+	tps68470->regmap = dev_get_drvdata(pdev->dev.parent);
+
+	for (i = 0; i < TPS68470_NUM_LEDS; i++) {
+		led = &tps68470->leds[i];
+		lcdev = &led->lcdev;
+
+		led->led_id = i;
+
+		lcdev->name = devm_kasprintf(tps68470->dev, GFP_KERNEL, "%s::%s",
+					     tps68470_led_names[i], LED_FUNCTION_INDICATOR);
+		if (!lcdev->name)
+			return -ENOMEM;
+
+		lcdev->max_brightness = 1;
+		lcdev->brightness = 0;
+		lcdev->brightness_set_blocking = tps68470_brightness_set;
+		lcdev->brightness_get = tps68470_brightness_get;
+		lcdev->dev = &pdev->dev;
+
+		ret = devm_led_classdev_register(tps68470->dev, lcdev);
+		if (ret) {
+			dev_err_probe(tps68470->dev, ret,
+				      "error registering led\n");
+			goto err_exit;
+		}
+
+		if (i == TPS68470_ILED_B) {
+			ret = tps68470_ledb_current_init(pdev, tps68470);
+			if (ret)
+				goto err_exit;
+		}
+	}
+
+err_exit:
+	if (ret) {
+		for (i = 0; i < TPS68470_NUM_LEDS; i++) {
+			if (tps68470->leds[i].lcdev.name)
+				devm_led_classdev_unregister(&pdev->dev,
+							     &tps68470->leds[i].lcdev);
+		}
+	}
+
+	return ret;
+}
+static struct platform_driver tps68470_led_driver = {
+	.driver = {
+		   .name = "tps68470-led",
+	},
+	.probe = tps68470_leds_probe,
+};
+
+module_platform_driver(tps68470_led_driver);
+
+MODULE_ALIAS("platform:tps68470-led");
+MODULE_DESCRIPTION("LED driver for TPS68470 PMIC");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
index 226454b6a..ddddf6849 100644
--- a/drivers/media/i2c/Kconfig
+++ b/drivers/media/i2c/Kconfig
@@ -848,6 +848,17 @@ config VIDEO_DW9714
 	  capability. This is designed for linear control of
 	  voice coil motors, controlled via I2C serial interface.
 
+config VIDEO_DW9719
+	tristate "DW9719 lens voice coil support"
+	depends on I2C && VIDEO_DEV
+	select MEDIA_CONTROLLER
+	select VIDEO_V4L2_SUBDEV_API
+	select V4L2_ASYNC
+	help
+	  This is a driver for the DW9719 camera lens voice coil.
+	  This is designed for linear control of  voice coil motors,
+	  controlled via I2C serial interface.
+
 config VIDEO_DW9768
 	tristate "DW9768 lens voice coil support"
 	depends on I2C && VIDEO_DEV
diff --git a/drivers/media/i2c/Makefile b/drivers/media/i2c/Makefile
index c743aeb5d..db1ebf5ca 100644
--- a/drivers/media/i2c/Makefile
+++ b/drivers/media/i2c/Makefile
@@ -29,6 +29,7 @@ obj-$(CONFIG_VIDEO_CS5345) += cs5345.o
 obj-$(CONFIG_VIDEO_CS53L32A) += cs53l32a.o
 obj-$(CONFIG_VIDEO_CX25840) += cx25840/
 obj-$(CONFIG_VIDEO_DW9714) += dw9714.o
+obj-$(CONFIG_VIDEO_DW9719) += dw9719.o
 obj-$(CONFIG_VIDEO_DW9768) += dw9768.o
 obj-$(CONFIG_VIDEO_DW9807_VCM) += dw9807-vcm.o
 obj-$(CONFIG_VIDEO_ET8EK8) += et8ek8/
diff --git a/drivers/media/i2c/dw9719.c b/drivers/media/i2c/dw9719.c
new file mode 100644
index 000000000..180b04d2a
--- /dev/null
+++ b/drivers/media/i2c/dw9719.c
@@ -0,0 +1,425 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (c) 2012 Intel Corporation
+
+/*
+ * Based on linux/modules/camera/drivers/media/i2c/imx/dw9719.c in this repo:
+ * https://github.com/ZenfoneArea/android_kernel_asus_zenfone5
+ */
+
+#include <asm/unaligned.h>
+
+#include <linux/delay.h>
+#include <linux/i2c.h>
+#include <linux/pm_runtime.h>
+#include <linux/regulator/consumer.h>
+#include <linux/types.h>
+
+#include <media/v4l2-common.h>
+#include <media/v4l2-ctrls.h>
+#include <media/v4l2-subdev.h>
+
+#define DW9719_MAX_FOCUS_POS	1023
+#define DW9719_CTRL_STEPS	16
+#define DW9719_CTRL_DELAY_US	1000
+#define DELAY_MAX_PER_STEP_NS	(1000000 * 1023)
+
+#define DW9719_INFO			0
+#define DW9719_ID			0xF1
+#define DW9719_CONTROL			2
+#define DW9719_VCM_CURRENT		3
+
+#define DW9719_MODE			6
+#define DW9719_VCM_FREQ			7
+
+#define DW9719_MODE_SAC3		0x40
+#define DW9719_DEFAULT_VCM_FREQ		0x60
+#define DW9719_ENABLE_RINGING		0x02
+
+#define NUM_REGULATORS			2
+
+#define to_dw9719_device(x) container_of(x, struct dw9719_device, sd)
+
+struct dw9719_device {
+	struct device *dev;
+	struct i2c_client *client;
+	struct regulator_bulk_data regulators[NUM_REGULATORS];
+	struct v4l2_subdev sd;
+
+	struct dw9719_v4l2_ctrls {
+		struct v4l2_ctrl_handler handler;
+		struct v4l2_ctrl *focus;
+	} ctrls;
+};
+
+static int dw9719_i2c_rd8(struct i2c_client *client, u8 reg, u8 *val)
+{
+	struct i2c_msg msg[2];
+	u8 buf[2] = { reg };
+	int ret;
+
+	msg[0].addr = client->addr;
+	msg[0].flags = 0;
+	msg[0].len = 1;
+	msg[0].buf = buf;
+
+	msg[1].addr = client->addr;
+	msg[1].flags = I2C_M_RD;
+	msg[1].len = 1;
+	msg[1].buf = &buf[1];
+	*val = 0;
+
+	ret = i2c_transfer(client->adapter, msg, 2);
+	if (ret < 0)
+		return ret;
+
+	*val = buf[1];
+
+	return 0;
+}
+
+static int dw9719_i2c_wr8(struct i2c_client *client, u8 reg, u8 val)
+{
+	struct i2c_msg msg;
+	int ret;
+
+	u8 buf[2] = { reg, val };
+
+	msg.addr = client->addr;
+	msg.flags = 0;
+	msg.len = sizeof(buf);
+	msg.buf = buf;
+
+	ret = i2c_transfer(client->adapter, &msg, 1);
+
+	return ret < 0 ? ret : 0;
+}
+
+static int dw9719_i2c_wr16(struct i2c_client *client, u8 reg, u16 val)
+{
+	struct i2c_msg msg;
+	u8 buf[3] = { reg };
+	int ret;
+
+	put_unaligned_be16(val, buf + 1);
+
+	msg.addr = client->addr;
+	msg.flags = 0;
+	msg.len = sizeof(buf);
+	msg.buf = buf;
+
+	ret = i2c_transfer(client->adapter, &msg, 1);
+
+	return ret < 0 ? ret : 0;
+}
+
+static int dw9719_detect(struct dw9719_device *dw9719)
+{
+	int ret;
+	u8 val;
+
+	ret = dw9719_i2c_rd8(dw9719->client, DW9719_INFO, &val);
+	if (ret < 0)
+		return ret;
+
+	if (val != DW9719_ID) {
+		dev_err(dw9719->dev, "Failed to detect correct id\n");
+		ret = -ENXIO;
+	}
+
+	return 0;
+}
+
+static int dw9719_power_down(struct dw9719_device *dw9719)
+{
+	return regulator_bulk_disable(NUM_REGULATORS, dw9719->regulators);
+}
+
+static int dw9719_power_up(struct dw9719_device *dw9719)
+{
+	int ret;
+
+	ret = regulator_bulk_enable(NUM_REGULATORS, dw9719->regulators);
+	if (ret)
+		return ret;
+
+	/* Jiggle SCL pin to wake up device */
+	ret = dw9719_i2c_wr8(dw9719->client, DW9719_CONTROL, 1);
+
+	/* Need 100us to transit from SHUTDOWN to STANDBY*/
+	usleep_range(100, 1000);
+
+	ret = dw9719_i2c_wr8(dw9719->client, DW9719_CONTROL,
+			     DW9719_ENABLE_RINGING);
+	if (ret < 0)
+		goto fail_powerdown;
+
+	ret = dw9719_i2c_wr8(dw9719->client, DW9719_MODE, DW9719_MODE_SAC3);
+	if (ret < 0)
+		goto fail_powerdown;
+
+	ret = dw9719_i2c_wr8(dw9719->client, DW9719_VCM_FREQ,
+			     DW9719_DEFAULT_VCM_FREQ);
+	if (ret < 0)
+		goto fail_powerdown;
+
+	return 0;
+
+fail_powerdown:
+	dw9719_power_down(dw9719);
+	return ret;
+}
+
+static int dw9719_t_focus_abs(struct dw9719_device *dw9719, s32 value)
+{
+	int ret;
+
+	value = clamp(value, 0, DW9719_MAX_FOCUS_POS);
+	ret = dw9719_i2c_wr16(dw9719->client, DW9719_VCM_CURRENT, value);
+	if (ret < 0)
+		return ret;
+
+	return 0;
+}
+
+static int dw9719_set_ctrl(struct v4l2_ctrl *ctrl)
+{
+	struct dw9719_device *dw9719 = container_of(ctrl->handler,
+						    struct dw9719_device,
+						    ctrls.handler);
+	int ret;
+
+	/* Only apply changes to the controls if the device is powered up */
+	if (!pm_runtime_get_if_in_use(dw9719->dev))
+		return 0;
+
+	switch (ctrl->id) {
+	case V4L2_CID_FOCUS_ABSOLUTE:
+		ret = dw9719_t_focus_abs(dw9719, ctrl->val);
+		break;
+	default:
+		ret = -EINVAL;
+	}
+
+	pm_runtime_put(dw9719->dev);
+
+	return ret;
+}
+
+static const struct v4l2_ctrl_ops dw9719_ctrl_ops = {
+	.s_ctrl = dw9719_set_ctrl,
+};
+
+static int __maybe_unused dw9719_suspend(struct device *dev)
+{
+	struct v4l2_subdev *sd = dev_get_drvdata(dev);
+	struct dw9719_device *dw9719 = to_dw9719_device(sd);
+	int ret;
+	int val;
+
+	for (val = dw9719->ctrls.focus->val; val >= 0;
+	     val -= DW9719_CTRL_STEPS) {
+		ret = dw9719_t_focus_abs(dw9719, val);
+		if (ret)
+			return ret;
+
+		usleep_range(DW9719_CTRL_DELAY_US, DW9719_CTRL_DELAY_US + 10);
+	}
+
+	return dw9719_power_down(dw9719);
+}
+
+static int __maybe_unused dw9719_resume(struct device *dev)
+{
+	struct v4l2_subdev *sd = dev_get_drvdata(dev);
+	struct dw9719_device *dw9719 = to_dw9719_device(sd);
+	int current_focus = dw9719->ctrls.focus->val;
+	int ret;
+	int val;
+
+	ret = dw9719_power_up(dw9719);
+	if (ret)
+		return ret;
+
+	for (val = current_focus % DW9719_CTRL_STEPS; val < current_focus;
+	     val += DW9719_CTRL_STEPS) {
+		ret = dw9719_t_focus_abs(dw9719, val);
+		if (ret)
+			goto err_power_down;
+
+		usleep_range(DW9719_CTRL_DELAY_US, DW9719_CTRL_DELAY_US + 10);
+	}
+
+	return 0;
+
+err_power_down:
+	dw9719_power_down(dw9719);
+	return ret;
+}
+
+static int dw9719_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
+{
+	return pm_runtime_resume_and_get(sd->dev);
+}
+
+static int dw9719_close(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
+{
+	pm_runtime_put(sd->dev);
+
+	return 0;
+}
+
+static const struct v4l2_subdev_internal_ops dw9719_internal_ops = {
+	.open = dw9719_open,
+	.close = dw9719_close,
+};
+
+static int dw9719_init_controls(struct dw9719_device *dw9719)
+{
+	const struct v4l2_ctrl_ops *ops = &dw9719_ctrl_ops;
+	int ret;
+
+	ret = v4l2_ctrl_handler_init(&dw9719->ctrls.handler, 1);
+	if (ret)
+		return ret;
+
+	dw9719->ctrls.focus = v4l2_ctrl_new_std(&dw9719->ctrls.handler, ops,
+						V4L2_CID_FOCUS_ABSOLUTE, 0,
+						DW9719_MAX_FOCUS_POS, 1, 0);
+
+	if (dw9719->ctrls.handler.error) {
+		dev_err(dw9719->dev, "Error initialising v4l2 ctrls\n");
+		ret = dw9719->ctrls.handler.error;
+		goto err_free_handler;
+	}
+
+	dw9719->sd.ctrl_handler = &dw9719->ctrls.handler;
+
+	return ret;
+
+err_free_handler:
+	v4l2_ctrl_handler_free(&dw9719->ctrls.handler);
+	return ret;
+}
+
+static const struct v4l2_subdev_ops dw9719_ops = { };
+
+static int dw9719_probe(struct i2c_client *client)
+{
+	struct dw9719_device *dw9719;
+	int ret;
+
+	dw9719 = devm_kzalloc(&client->dev, sizeof(*dw9719), GFP_KERNEL);
+	if (!dw9719)
+		return -ENOMEM;
+
+	dw9719->client = client;
+	dw9719->dev = &client->dev;
+
+	dw9719->regulators[0].supply = "vdd";
+	/*
+	 * The DW9719 has only the 1 VDD voltage input, but some PMICs such as
+	 * the TPS68470 PMIC have I2C passthrough capability, to disconnect the
+	 * sensor's I2C pins from the I2C bus when the sensors VSIO (Sensor-IO)
+	 * is off, because some sensors then short these pins to ground;
+	 * and the DW9719 might sit behind this passthrough, this it needs to
+	 * enable VSIO as that will also enable the I2C passthrough.
+	 */
+	dw9719->regulators[1].supply = "vsio";
+
+	ret = devm_regulator_bulk_get(&client->dev, NUM_REGULATORS,
+				      dw9719->regulators);
+	if (ret)
+		return dev_err_probe(&client->dev, ret, "getting regulators\n");
+
+	v4l2_i2c_subdev_init(&dw9719->sd, client, &dw9719_ops);
+	dw9719->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
+	dw9719->sd.internal_ops = &dw9719_internal_ops;
+
+	ret = dw9719_init_controls(dw9719);
+	if (ret)
+		return ret;
+
+	ret = media_entity_pads_init(&dw9719->sd.entity, 0, NULL);
+	if (ret < 0)
+		goto err_free_ctrl_handler;
+
+	dw9719->sd.entity.function = MEDIA_ENT_F_LENS;
+
+	/*
+	 * We need the driver to work in the event that pm runtime is disable in
+	 * the kernel, so power up and verify the chip now. In the event that
+	 * runtime pm is disabled this will leave the chip on, so that the lens
+	 * will work.
+	 */
+
+	ret = dw9719_power_up(dw9719);
+	if (ret)
+		goto err_cleanup_media;
+
+	ret = dw9719_detect(dw9719);
+	if (ret)
+		goto err_powerdown;
+
+	pm_runtime_set_active(&client->dev);
+	pm_runtime_get_noresume(&client->dev);
+	pm_runtime_enable(&client->dev);
+
+	ret = v4l2_async_register_subdev(&dw9719->sd);
+	if (ret < 0)
+		goto err_pm_runtime;
+
+	pm_runtime_set_autosuspend_delay(&client->dev, 1000);
+	pm_runtime_use_autosuspend(&client->dev);
+	pm_runtime_put_autosuspend(&client->dev);
+
+	return ret;
+
+err_pm_runtime:
+	pm_runtime_disable(&client->dev);
+	pm_runtime_put_noidle(&client->dev);
+err_powerdown:
+	dw9719_power_down(dw9719);
+err_cleanup_media:
+	media_entity_cleanup(&dw9719->sd.entity);
+err_free_ctrl_handler:
+	v4l2_ctrl_handler_free(&dw9719->ctrls.handler);
+
+	return ret;
+}
+
+static void dw9719_remove(struct i2c_client *client)
+{
+	struct v4l2_subdev *sd = i2c_get_clientdata(client);
+	struct dw9719_device *dw9719 = container_of(sd, struct dw9719_device,
+						    sd);
+
+	pm_runtime_disable(&client->dev);
+	v4l2_async_unregister_subdev(sd);
+	v4l2_ctrl_handler_free(&dw9719->ctrls.handler);
+	media_entity_cleanup(&dw9719->sd.entity);
+}
+
+static const struct i2c_device_id dw9719_id_table[] = {
+	{ "dw9719" },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, dw9719_id_table);
+
+static const struct dev_pm_ops dw9719_pm_ops = {
+	SET_RUNTIME_PM_OPS(dw9719_suspend, dw9719_resume, NULL)
+};
+
+static struct i2c_driver dw9719_i2c_driver = {
+	.driver = {
+		.name = "dw9719",
+		.pm = &dw9719_pm_ops,
+	},
+	.probe_new = dw9719_probe,
+	.remove = dw9719_remove,
+	.id_table = dw9719_id_table,
+};
+module_i2c_driver(dw9719_i2c_driver);
+
+MODULE_AUTHOR("Daniel Scally <djrscally@gmail.com>");
+MODULE_DESCRIPTION("DW9719 VCM Driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/i2c/ov7251.c b/drivers/media/i2c/ov7251.c
index 675fb37a6..43b30db08 100644
--- a/drivers/media/i2c/ov7251.c
+++ b/drivers/media/i2c/ov7251.c
@@ -1051,7 +1051,7 @@ static int ov7251_s_ctrl(struct v4l2_ctrl *ctrl)
 	case V4L2_CID_EXPOSURE:
 		ret = ov7251_set_exposure(ov7251, ctrl->val);
 		break;
-	case V4L2_CID_GAIN:
+	case V4L2_CID_ANALOGUE_GAIN:
 		ret = ov7251_set_gain(ov7251, ctrl->val);
 		break;
 	case V4L2_CID_TEST_PATTERN:
@@ -1551,7 +1551,7 @@ static int ov7251_init_ctrls(struct ov7251 *ov7251)
 	ov7251->exposure = v4l2_ctrl_new_std(&ov7251->ctrls, &ov7251_ctrl_ops,
 					     V4L2_CID_EXPOSURE, 1, 32, 1, 32);
 	ov7251->gain = v4l2_ctrl_new_std(&ov7251->ctrls, &ov7251_ctrl_ops,
-					 V4L2_CID_GAIN, 16, 1023, 1, 16);
+					 V4L2_CID_ANALOGUE_GAIN, 16, 1023, 1, 16);
 	v4l2_ctrl_new_std_menu_items(&ov7251->ctrls, &ov7251_ctrl_ops,
 				     V4L2_CID_TEST_PATTERN,
 				     ARRAY_SIZE(ov7251_test_pattern_menu) - 1,
diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c
index 34984a747..67a44f6da 100644
--- a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c
@@ -1385,7 +1385,10 @@ static int cio2_notifier_bound(struct v4l2_async_notifier *notifier,
 {
 	struct cio2_device *cio2 = to_cio2_device(notifier);
 	struct sensor_async_subdev *s_asd = to_sensor_asd(asd);
+	struct device *dev = &cio2->pci_dev->dev;
 	struct cio2_queue *q;
+	unsigned int pad;
+	int ret;
 
 	if (cio2->queue[s_asd->csi2.port].sensor)
 		return -EBUSY;
@@ -1396,7 +1399,26 @@ static int cio2_notifier_bound(struct v4l2_async_notifier *notifier,
 	q->sensor = sd;
 	q->csi_rx_base = cio2->base + CIO2_REG_PIPE_BASE(q->csi2.port);
 
-	return 0;
+	for (pad = 0; pad < q->sensor->entity.num_pads; pad++)
+		if (q->sensor->entity.pads[pad].flags &
+					MEDIA_PAD_FL_SOURCE)
+			break;
+
+	if (pad == q->sensor->entity.num_pads) {
+		dev_err(dev, "failed to find src pad for %s\n",
+			q->sensor->name);
+		return -ENXIO;
+	}
+
+	ret = media_create_pad_link(&q->sensor->entity, pad, &q->subdev.entity,
+				    CIO2_PAD_SINK, 0);
+	if (ret) {
+		dev_err(dev, "failed to create link for %s\n",
+			q->sensor->name);
+		return ret;
+	}
+
+	return v4l2_device_register_subdev_nodes(&cio2->v4l2_dev);
 }
 
 /* The .unbind callback */
@@ -1414,34 +1436,6 @@ static void cio2_notifier_unbind(struct v4l2_async_notifier *notifier,
 static int cio2_notifier_complete(struct v4l2_async_notifier *notifier)
 {
 	struct cio2_device *cio2 = to_cio2_device(notifier);
-	struct device *dev = &cio2->pci_dev->dev;
-	struct sensor_async_subdev *s_asd;
-	struct v4l2_async_subdev *asd;
-	struct cio2_queue *q;
-	int ret;
-
-	list_for_each_entry(asd, &cio2->notifier.asd_list, asd_list) {
-		s_asd = to_sensor_asd(asd);
-		q = &cio2->queue[s_asd->csi2.port];
-
-		ret = media_entity_get_fwnode_pad(&q->sensor->entity,
-						  s_asd->asd.match.fwnode,
-						  MEDIA_PAD_FL_SOURCE);
-		if (ret < 0) {
-			dev_err(dev, "no pad for endpoint %pfw (%d)\n",
-				s_asd->asd.match.fwnode, ret);
-			return ret;
-		}
-
-		ret = media_create_pad_link(&q->sensor->entity, ret,
-					    &q->subdev.entity, CIO2_PAD_SINK,
-					    0);
-		if (ret) {
-			dev_err(dev, "failed to create link for %s (endpoint %pfw, error %d)\n",
-				q->sensor->name, s_asd->asd.match.fwnode, ret);
-			return ret;
-		}
-	}
 
 	return v4l2_device_register_subdev_nodes(&cio2->v4l2_dev);
 }
diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c
index b16b5f4cb..33739a979 100644
--- a/drivers/media/v4l2-core/v4l2-async.c
+++ b/drivers/media/v4l2-core/v4l2-async.c
@@ -760,6 +760,10 @@ int v4l2_async_register_subdev(struct v4l2_subdev *sd)
 	struct v4l2_async_notifier *notifier;
 	int ret;
 
+	ret = v4l2_subdev_get_privacy_led(sd);
+	if (ret < 0)
+		return ret;
+
 	/*
 	 * No reference taken. The reference is held by the device
 	 * (struct v4l2_subdev.dev), and async sub-device does not
diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c
index 049c2f200..f8c3e40b2 100644
--- a/drivers/media/v4l2-core/v4l2-fwnode.c
+++ b/drivers/media/v4l2-core/v4l2-fwnode.c
@@ -1304,10 +1304,6 @@ int v4l2_async_register_subdev_sensor(struct v4l2_subdev *sd)
 
 	v4l2_async_nf_init(notifier);
 
-	ret = v4l2_subdev_get_privacy_led(sd);
-	if (ret < 0)
-		goto out_cleanup;
-
 	ret = v4l2_async_nf_parse_fwnode_sensor(sd->dev, notifier);
 	if (ret < 0)
 		goto out_cleanup;
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index bdc65d50b..08723c01d 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -92,6 +92,7 @@
 #define MEI_DEV_ID_CDF        0x18D3  /* Cedar Fork */
 
 #define MEI_DEV_ID_ICP_LP     0x34E0  /* Ice Lake Point LP */
+#define MEI_DEV_ID_ICP_LP_3   0x34E4  /* Ice Lake Point LP 3 (iTouch) */
 #define MEI_DEV_ID_ICP_N      0x38E0  /* Ice Lake Point N */
 
 #define MEI_DEV_ID_JSP_N      0x4DE0  /* Jasper Lake Point N */
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 676d566f3..6b37dd1f8 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -97,6 +97,7 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
 	{MEI_PCI_DEVICE(MEI_DEV_ID_CMP_H_3, MEI_ME_PCH8_ITOUCH_CFG)},
 
 	{MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
+	{MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP_3, MEI_ME_PCH12_CFG)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_ICP_N, MEI_ME_PCH12_CFG)},
 
 	{MEI_PCI_DEVICE(MEI_DEV_ID_TGP_LP, MEI_ME_PCH15_CFG)},
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 6cdb225b7..19c036751 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -38,6 +38,9 @@ static bool fw_diag_log;
 /* frame mode values are mapped as per enum ath10k_hw_txrx_mode */
 unsigned int ath10k_frame_mode = ATH10K_HW_TXRX_NATIVE_WIFI;
 
+static char *override_board = "";
+static char *override_board2 = "";
+
 unsigned long ath10k_coredump_mask = BIT(ATH10K_FW_CRASH_DUMP_REGISTERS) |
 				     BIT(ATH10K_FW_CRASH_DUMP_CE_DATA);
 
@@ -50,6 +53,9 @@ module_param(fw_diag_log, bool, 0644);
 module_param_named(frame_mode, ath10k_frame_mode, uint, 0644);
 module_param_named(coredump_mask, ath10k_coredump_mask, ulong, 0444);
 
+module_param(override_board, charp, 0644);
+module_param(override_board2, charp, 0644);
+
 MODULE_PARM_DESC(debug_mask, "Debugging mask");
 MODULE_PARM_DESC(uart_print, "Uart target debugging");
 MODULE_PARM_DESC(skip_otp, "Skip otp failure for calibration in testmode");
@@ -59,6 +65,9 @@ MODULE_PARM_DESC(frame_mode,
 MODULE_PARM_DESC(coredump_mask, "Bitfield of what to include in firmware crash file");
 MODULE_PARM_DESC(fw_diag_log, "Diag based fw log debugging");
 
+MODULE_PARM_DESC(override_board, "Override for board.bin file");
+MODULE_PARM_DESC(override_board2, "Override for board-2.bin file");
+
 static const struct ath10k_hw_params ath10k_hw_params_list[] = {
 	{
 		.id = QCA988X_HW_2_0_VERSION,
@@ -911,6 +920,42 @@ static int ath10k_init_configure_target(struct ath10k *ar)
 	return 0;
 }
 
+static const char *ath10k_override_board_fw_file(struct ath10k *ar,
+						 const char *file)
+{
+	if (strcmp(file, "board.bin") == 0) {
+		if (strcmp(override_board, "") == 0)
+			return file;
+
+		if (strcmp(override_board, "none") == 0) {
+			dev_info(ar->dev, "firmware override: pretending 'board.bin' does not exist\n");
+			return NULL;
+		}
+
+		dev_info(ar->dev, "firmware override: replacing 'board.bin' with '%s'\n",
+			 override_board);
+
+		return override_board;
+	}
+
+	if (strcmp(file, "board-2.bin") == 0) {
+		if (strcmp(override_board2, "") == 0)
+			return file;
+
+		if (strcmp(override_board2, "none") == 0) {
+			dev_info(ar->dev, "firmware override: pretending 'board-2.bin' does not exist\n");
+			return NULL;
+		}
+
+		dev_info(ar->dev, "firmware override: replacing 'board-2.bin' with '%s'\n",
+			 override_board2);
+
+		return override_board2;
+	}
+
+	return file;
+}
+
 static const struct firmware *ath10k_fetch_fw_file(struct ath10k *ar,
 						   const char *dir,
 						   const char *file)
@@ -925,6 +970,19 @@ static const struct firmware *ath10k_fetch_fw_file(struct ath10k *ar,
 	if (dir == NULL)
 		dir = ".";
 
+	/* HACK: Override board.bin and board-2.bin files if specified.
+	 *
+	 * Some Surface devices perform better with a different board
+	 * configuration. To this end, one would need to replace the board.bin
+	 * file with the modified config and remove the board-2.bin file.
+	 * Unfortunately, that's not a solution that we can easily package. So
+	 * we add module options to perform these overrides here.
+	 */
+
+	file = ath10k_override_board_fw_file(ar, file);
+	if (!file)
+		return ERR_PTR(-ENOENT);
+
 	snprintf(filename, sizeof(filename), "%s/%s", dir, file);
 	ret = firmware_request_nowarn(&fw, filename, ar->dev);
 	ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot fw request '%s': %d\n",
diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
index 9a698a16a..5e1a341f6 100644
--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
+++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
@@ -368,6 +368,7 @@ static int mwifiex_pcie_probe(struct pci_dev *pdev,
 					const struct pci_device_id *ent)
 {
 	struct pcie_service_card *card;
+	struct pci_dev *parent_pdev = pci_upstream_bridge(pdev);
 	int ret;
 
 	pr_debug("info: vendor=0x%4.04X device=0x%4.04X rev=%d\n",
@@ -409,6 +410,12 @@ static int mwifiex_pcie_probe(struct pci_dev *pdev,
 		return -1;
 	}
 
+	/* disable bridge_d3 for Surface gen4+ devices to fix fw crashing
+	 * after suspend
+	 */
+	if (card->quirks & QUIRK_NO_BRIDGE_D3)
+		parent_pdev->bridge_d3 = false;
+
 	return 0;
 }
 
@@ -1762,9 +1769,21 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
 static int mwifiex_pcie_init_fw_port(struct mwifiex_adapter *adapter)
 {
 	struct pcie_service_card *card = adapter->card;
+	struct pci_dev *pdev = card->dev;
+	struct pci_dev *parent_pdev = pci_upstream_bridge(pdev);
 	const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
 	int tx_wrap = card->txbd_wrptr & reg->tx_wrap_mask;
 
+	/* Trigger a function level reset of the PCI bridge device, this makes
+	 * the firmware of PCIe 88W8897 cards stop reporting a fixed LTR value
+	 * that prevents the system from entering package C10 and S0ix powersaving
+	 * states.
+	 * We need to do it here because it must happen after firmware
+	 * initialization and this function is called after that is done.
+	 */
+	if (card->quirks & QUIRK_DO_FLR_ON_BRIDGE)
+		pci_reset_function(parent_pdev);
+
 	/* Write the RX ring read pointer in to reg->rx_rdptr */
 	if (mwifiex_write_reg(adapter, reg->rx_rdptr, card->rxbd_rdptr |
 			      tx_wrap)) {
diff --git a/drivers/net/wireless/marvell/mwifiex/pcie_quirks.c b/drivers/net/wireless/marvell/mwifiex/pcie_quirks.c
index dd6d21f1d..99b024ecb 100644
--- a/drivers/net/wireless/marvell/mwifiex/pcie_quirks.c
+++ b/drivers/net/wireless/marvell/mwifiex/pcie_quirks.c
@@ -13,7 +13,9 @@ static const struct dmi_system_id mwifiex_quirk_table[] = {
 			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
 			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Pro 4"),
 		},
-		.driver_data = (void *)QUIRK_FW_RST_D3COLD,
+		.driver_data = (void *)(QUIRK_FW_RST_D3COLD |
+					QUIRK_DO_FLR_ON_BRIDGE |
+					QUIRK_NO_BRIDGE_D3),
 	},
 	{
 		.ident = "Surface Pro 5",
@@ -22,7 +24,9 @@ static const struct dmi_system_id mwifiex_quirk_table[] = {
 			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
 			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "Surface_Pro_1796"),
 		},
-		.driver_data = (void *)QUIRK_FW_RST_D3COLD,
+		.driver_data = (void *)(QUIRK_FW_RST_D3COLD |
+					QUIRK_DO_FLR_ON_BRIDGE |
+					QUIRK_NO_BRIDGE_D3),
 	},
 	{
 		.ident = "Surface Pro 5 (LTE)",
@@ -31,7 +35,9 @@ static const struct dmi_system_id mwifiex_quirk_table[] = {
 			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
 			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "Surface_Pro_1807"),
 		},
-		.driver_data = (void *)QUIRK_FW_RST_D3COLD,
+		.driver_data = (void *)(QUIRK_FW_RST_D3COLD |
+					QUIRK_DO_FLR_ON_BRIDGE |
+					QUIRK_NO_BRIDGE_D3),
 	},
 	{
 		.ident = "Surface Pro 6",
@@ -39,7 +45,9 @@ static const struct dmi_system_id mwifiex_quirk_table[] = {
 			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
 			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Pro 6"),
 		},
-		.driver_data = (void *)QUIRK_FW_RST_D3COLD,
+		.driver_data = (void *)(QUIRK_FW_RST_D3COLD |
+					QUIRK_DO_FLR_ON_BRIDGE |
+					QUIRK_NO_BRIDGE_D3),
 	},
 	{
 		.ident = "Surface Book 1",
@@ -47,7 +55,9 @@ static const struct dmi_system_id mwifiex_quirk_table[] = {
 			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
 			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Book"),
 		},
-		.driver_data = (void *)QUIRK_FW_RST_D3COLD,
+		.driver_data = (void *)(QUIRK_FW_RST_D3COLD |
+					QUIRK_DO_FLR_ON_BRIDGE |
+					QUIRK_NO_BRIDGE_D3),
 	},
 	{
 		.ident = "Surface Book 2",
@@ -55,7 +65,9 @@ static const struct dmi_system_id mwifiex_quirk_table[] = {
 			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
 			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Book 2"),
 		},
-		.driver_data = (void *)QUIRK_FW_RST_D3COLD,
+		.driver_data = (void *)(QUIRK_FW_RST_D3COLD |
+					QUIRK_DO_FLR_ON_BRIDGE |
+					QUIRK_NO_BRIDGE_D3),
 	},
 	{
 		.ident = "Surface Laptop 1",
@@ -63,7 +75,9 @@ static const struct dmi_system_id mwifiex_quirk_table[] = {
 			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
 			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Laptop"),
 		},
-		.driver_data = (void *)QUIRK_FW_RST_D3COLD,
+		.driver_data = (void *)(QUIRK_FW_RST_D3COLD |
+					QUIRK_DO_FLR_ON_BRIDGE |
+					QUIRK_NO_BRIDGE_D3),
 	},
 	{
 		.ident = "Surface Laptop 2",
@@ -71,7 +85,9 @@ static const struct dmi_system_id mwifiex_quirk_table[] = {
 			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
 			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Laptop 2"),
 		},
-		.driver_data = (void *)QUIRK_FW_RST_D3COLD,
+		.driver_data = (void *)(QUIRK_FW_RST_D3COLD |
+					QUIRK_DO_FLR_ON_BRIDGE |
+					QUIRK_NO_BRIDGE_D3),
 	},
 	{}
 };
@@ -89,6 +105,11 @@ void mwifiex_initialize_quirks(struct pcie_service_card *card)
 		dev_info(&pdev->dev, "no quirks enabled\n");
 	if (card->quirks & QUIRK_FW_RST_D3COLD)
 		dev_info(&pdev->dev, "quirk reset_d3cold enabled\n");
+	if (card->quirks & QUIRK_DO_FLR_ON_BRIDGE)
+		dev_info(&pdev->dev, "quirk do_flr_on_bridge enabled\n");
+	if (card->quirks & QUIRK_NO_BRIDGE_D3)
+		dev_info(&pdev->dev,
+			 "quirk no_brigde_d3 enabled\n");
 }
 
 static void mwifiex_pcie_set_power_d3cold(struct pci_dev *pdev)
diff --git a/drivers/net/wireless/marvell/mwifiex/pcie_quirks.h b/drivers/net/wireless/marvell/mwifiex/pcie_quirks.h
index d6ff964ae..c14eb56eb 100644
--- a/drivers/net/wireless/marvell/mwifiex/pcie_quirks.h
+++ b/drivers/net/wireless/marvell/mwifiex/pcie_quirks.h
@@ -4,6 +4,8 @@
 #include "pcie.h"
 
 #define QUIRK_FW_RST_D3COLD	BIT(0)
+#define QUIRK_DO_FLR_ON_BRIDGE	BIT(1)
+#define QUIRK_NO_BRIDGE_D3	BIT(2)
 
 void mwifiex_initialize_quirks(struct pcie_service_card *card);
 int mwifiex_pcie_reset_d3cold_quirk(struct pci_dev *pdev);
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 55648c5fe..f1402fc70 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -514,6 +514,9 @@ static void pci_device_shutdown(struct device *dev)
 	struct pci_dev *pci_dev = to_pci_dev(dev);
 	struct pci_driver *drv = pci_dev->driver;
 
+	if (pci_dev->no_shutdown)
+		return;
+
 	pm_runtime_resume(dev);
 
 	if (drv && drv->shutdown)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index fc399e56e..f0dbe43d6 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -6162,3 +6162,39 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2d, dpc_log_size);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2f, dpc_log_size);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a31, dpc_log_size);
 #endif
+
+static const struct dmi_system_id no_shutdown_dmi_table[] = {
+	/*
+	 * Systems on which some devices should not be touched during shutdown.
+	 */
+	{
+		.ident = "Microsoft Surface Pro 9",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Surface Pro 9"),
+		},
+	},
+	{
+		.ident = "Microsoft Surface Laptop 5",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Surface Laptop 5"),
+		},
+	},
+	{}
+};
+
+static void quirk_no_shutdown(struct pci_dev *dev)
+{
+	if (!dmi_check_system(no_shutdown_dmi_table))
+		return;
+
+	dev->no_shutdown = 1;
+	pci_info(dev, "disabling shutdown ops for [%04x:%04x]\n",
+		 dev->vendor, dev->device);
+}
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x461e, quirk_no_shutdown);  // Thunderbolt 4 USB Controller
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x461f, quirk_no_shutdown);  // Thunderbolt 4 PCI Express Root Port
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x462f, quirk_no_shutdown);  // Thunderbolt 4 PCI Express Root Port
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x466d, quirk_no_shutdown);  // Thunderbolt 4 NHI
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x46a8, quirk_no_shutdown);  // GPU
diff --git a/drivers/platform/surface/Kconfig b/drivers/platform/surface/Kconfig
index b629e82af..68656e8f3 100644
--- a/drivers/platform/surface/Kconfig
+++ b/drivers/platform/surface/Kconfig
@@ -149,6 +149,13 @@ config SURFACE_AGGREGATOR_TABLET_SWITCH
 	  Select M or Y here, if you want to provide tablet-mode switch input
 	  events on the Surface Pro 8, Surface Pro X, and Surface Laptop Studio.
 
+config SURFACE_BOOK1_DGPU_SWITCH
+	tristate "Surface Book 1 dGPU Switch Driver"
+	depends on SYSFS
+	help
+	  This driver provides a sysfs switch to set the power-state of the
+	  discrete GPU found on the Microsoft Surface Book 1.
+
 config SURFACE_DTX
 	tristate "Surface DTX (Detachment System) Driver"
 	depends on SURFACE_AGGREGATOR
diff --git a/drivers/platform/surface/Makefile b/drivers/platform/surface/Makefile
index 533443309..7efcd0cdb 100644
--- a/drivers/platform/surface/Makefile
+++ b/drivers/platform/surface/Makefile
@@ -12,6 +12,7 @@ obj-$(CONFIG_SURFACE_AGGREGATOR_CDEV)	+= surface_aggregator_cdev.o
 obj-$(CONFIG_SURFACE_AGGREGATOR_HUB)	+= surface_aggregator_hub.o
 obj-$(CONFIG_SURFACE_AGGREGATOR_REGISTRY) += surface_aggregator_registry.o
 obj-$(CONFIG_SURFACE_AGGREGATOR_TABLET_SWITCH) += surface_aggregator_tabletsw.o
+obj-$(CONFIG_SURFACE_BOOK1_DGPU_SWITCH) += surfacebook1_dgpu_switch.o
 obj-$(CONFIG_SURFACE_DTX)		+= surface_dtx.o
 obj-$(CONFIG_SURFACE_GPE)		+= surface_gpe.o
 obj-$(CONFIG_SURFACE_HOTPLUG)		+= surface_hotplug.o
diff --git a/drivers/platform/surface/surface3-wmi.c b/drivers/platform/surface/surface3-wmi.c
index ca4602bcc..490b97310 100644
--- a/drivers/platform/surface/surface3-wmi.c
+++ b/drivers/platform/surface/surface3-wmi.c
@@ -37,6 +37,13 @@ static const struct dmi_system_id surface3_dmi_table[] = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "Surface 3"),
 		},
 	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."),
+			DMI_MATCH(DMI_SYS_VENDOR, "OEMB"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "OEMB"),
+		},
+	},
 #endif
 	{ }
 };
diff --git a/drivers/platform/surface/surface_gpe.c b/drivers/platform/surface/surface_gpe.c
index c219b840d..69c4352e8 100644
--- a/drivers/platform/surface/surface_gpe.c
+++ b/drivers/platform/surface/surface_gpe.c
@@ -41,6 +41,11 @@ static const struct property_entry lid_device_props_l4F[] = {
 	{},
 };
 
+static const struct property_entry lid_device_props_l52[] = {
+	PROPERTY_ENTRY_U32("gpe", 0x52),
+	{},
+};
+
 static const struct property_entry lid_device_props_l57[] = {
 	PROPERTY_ENTRY_U32("gpe", 0x57),
 	{},
@@ -107,6 +112,18 @@ static const struct dmi_system_id dmi_lid_device_table[] = {
 		},
 		.driver_data = (void *)lid_device_props_l4B,
 	},
+	{
+		/*
+		 * We match for SKU here due to product name clash with the ARM
+		 * version.
+		 */
+		.ident = "Surface Pro 9",
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "Surface_Pro_9_2038"),
+		},
+		.driver_data = (void *)lid_device_props_l52,
+	},
 	{
 		.ident = "Surface Book 1",
 		.matches = {
diff --git a/drivers/platform/surface/surfacebook1_dgpu_switch.c b/drivers/platform/surface/surfacebook1_dgpu_switch.c
new file mode 100644
index 000000000..8b816ed8f
--- /dev/null
+++ b/drivers/platform/surface/surfacebook1_dgpu_switch.c
@@ -0,0 +1,162 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/acpi.h>
+#include <linux/platform_device.h>
+
+
+#ifdef pr_fmt
+#undef pr_fmt
+#endif
+#define pr_fmt(fmt) "%s:%s: " fmt, KBUILD_MODNAME, __func__
+
+
+static const guid_t dgpu_sw_guid = GUID_INIT(0x6fd05c69, 0xcde3, 0x49f4,
+	0x95, 0xed, 0xab, 0x16, 0x65, 0x49, 0x80, 0x35);
+
+#define DGPUSW_ACPI_PATH_DSM	"\\_SB_.PCI0.LPCB.EC0_.VGBI"
+#define DGPUSW_ACPI_PATH_HGON	"\\_SB_.PCI0.RP05.HGON"
+#define DGPUSW_ACPI_PATH_HGOF	"\\_SB_.PCI0.RP05.HGOF"
+
+
+static int sb1_dgpu_sw_dsmcall(void)
+{
+	union acpi_object *ret;
+	acpi_handle handle;
+	acpi_status status;
+
+	status = acpi_get_handle(NULL, DGPUSW_ACPI_PATH_DSM, &handle);
+	if (status)
+		return -EINVAL;
+
+	ret = acpi_evaluate_dsm_typed(handle, &dgpu_sw_guid, 1, 1, NULL, ACPI_TYPE_BUFFER);
+	if (!ret)
+		return -EINVAL;
+
+	ACPI_FREE(ret);
+	return 0;
+}
+
+static int sb1_dgpu_sw_hgon(void)
+{
+	struct acpi_buffer buf = {ACPI_ALLOCATE_BUFFER, NULL};
+	acpi_status status;
+
+	status = acpi_evaluate_object(NULL, DGPUSW_ACPI_PATH_HGON, NULL, &buf);
+	if (status) {
+		pr_err("failed to run HGON: %d\n", status);
+		return -EINVAL;
+	}
+
+	if (buf.pointer)
+		ACPI_FREE(buf.pointer);
+
+	pr_info("turned-on dGPU via HGON\n");
+	return 0;
+}
+
+static int sb1_dgpu_sw_hgof(void)
+{
+	struct acpi_buffer buf = {ACPI_ALLOCATE_BUFFER, NULL};
+	acpi_status status;
+
+	status = acpi_evaluate_object(NULL, DGPUSW_ACPI_PATH_HGOF, NULL, &buf);
+	if (status) {
+		pr_err("failed to run HGOF: %d\n", status);
+		return -EINVAL;
+	}
+
+	if (buf.pointer)
+		ACPI_FREE(buf.pointer);
+
+	pr_info("turned-off dGPU via HGOF\n");
+	return 0;
+}
+
+
+static ssize_t dgpu_dsmcall_store(struct device *dev, struct device_attribute *attr,
+				  const char *buf, size_t len)
+{
+	int status, value;
+
+	status = kstrtoint(buf, 0, &value);
+	if (status < 0)
+		return status;
+
+	if (value != 1)
+		return -EINVAL;
+
+	status = sb1_dgpu_sw_dsmcall();
+
+	return status < 0 ? status : len;
+}
+
+static ssize_t dgpu_power_store(struct device *dev, struct device_attribute *attr,
+				const char *buf, size_t len)
+{
+	bool power;
+	int status;
+
+	status = kstrtobool(buf, &power);
+	if (status < 0)
+		return status;
+
+	if (power)
+		status = sb1_dgpu_sw_hgon();
+	else
+		status = sb1_dgpu_sw_hgof();
+
+	return status < 0 ? status : len;
+}
+
+static DEVICE_ATTR_WO(dgpu_dsmcall);
+static DEVICE_ATTR_WO(dgpu_power);
+
+static struct attribute *sb1_dgpu_sw_attrs[] = {
+	&dev_attr_dgpu_dsmcall.attr,
+	&dev_attr_dgpu_power.attr,
+	NULL,
+};
+
+static const struct attribute_group sb1_dgpu_sw_attr_group = {
+	.attrs = sb1_dgpu_sw_attrs,
+};
+
+
+static int sb1_dgpu_sw_probe(struct platform_device *pdev)
+{
+	return sysfs_create_group(&pdev->dev.kobj, &sb1_dgpu_sw_attr_group);
+}
+
+static int sb1_dgpu_sw_remove(struct platform_device *pdev)
+{
+	sysfs_remove_group(&pdev->dev.kobj, &sb1_dgpu_sw_attr_group);
+	return 0;
+}
+
+/*
+ * The dGPU power seems to be actually handled by MSHW0040. However, that is
+ * also the power-/volume-button device with a mainline driver. So let's use
+ * MSHW0041 instead for now, which seems to be the LTCH (latch/DTX) device.
+ */
+static const struct acpi_device_id sb1_dgpu_sw_match[] = {
+	{ "MSHW0041", },
+	{ },
+};
+MODULE_DEVICE_TABLE(acpi, sb1_dgpu_sw_match);
+
+static struct platform_driver sb1_dgpu_sw = {
+	.probe = sb1_dgpu_sw_probe,
+	.remove = sb1_dgpu_sw_remove,
+	.driver = {
+		.name = "surfacebook1_dgpu_switch",
+		.acpi_match_table = sb1_dgpu_sw_match,
+		.probe_type = PROBE_PREFER_ASYNCHRONOUS,
+	},
+};
+module_platform_driver(sb1_dgpu_sw);
+
+MODULE_AUTHOR("Maximilian Luz <luzmaximilian@gmail.com>");
+MODULE_DESCRIPTION("Discrete GPU Power-Switch for Surface Book 1");
+MODULE_LICENSE("GPL");
diff --git a/drivers/platform/surface/surfacepro3_button.c b/drivers/platform/surface/surfacepro3_button.c
index 2755601f9..4240c98ca 100644
--- a/drivers/platform/surface/surfacepro3_button.c
+++ b/drivers/platform/surface/surfacepro3_button.c
@@ -149,7 +149,8 @@ static int surface_button_resume(struct device *dev)
 /*
  * Surface Pro 4 and Surface Book 2 / Surface Pro 2017 use the same device
  * ID (MSHW0040) for the power/volume buttons. Make sure this is the right
- * device by checking for the _DSM method and OEM Platform Revision.
+ * device by checking for the _DSM method and OEM Platform Revision DSM
+ * function.
  *
  * Returns true if the driver should bind to this device, i.e. the device is
  * either MSWH0028 (Pro 3) or MSHW0040 on a Pro 4 or Book 1.
@@ -157,30 +158,11 @@ static int surface_button_resume(struct device *dev)
 static bool surface_button_check_MSHW0040(struct acpi_device *dev)
 {
 	acpi_handle handle = dev->handle;
-	union acpi_object *result;
-	u64 oem_platform_rev = 0;	// valid revisions are nonzero
-
-	// get OEM platform revision
-	result = acpi_evaluate_dsm_typed(handle, &MSHW0040_DSM_UUID,
-					 MSHW0040_DSM_REVISION,
-					 MSHW0040_DSM_GET_OMPR,
-					 NULL, ACPI_TYPE_INTEGER);
-
-	/*
-	 * If evaluating the _DSM fails, the method is not present. This means
-	 * that we have either MSHW0028 or MSHW0040 on Pro 4 or Book 1, so we
-	 * should use this driver. We use revision 0 indicating it is
-	 * unavailable.
-	 */
-
-	if (result) {
-		oem_platform_rev = result->integer.value;
-		ACPI_FREE(result);
-	}
-
-	dev_dbg(&dev->dev, "OEM Platform Revision %llu\n", oem_platform_rev);
 
-	return oem_platform_rev == 0;
+	// make sure that OEM platform revision DSM call does not exist
+	return !acpi_check_dsm(handle, &MSHW0040_DSM_UUID,
+			       MSHW0040_DSM_REVISION,
+			       BIT(MSHW0040_DSM_GET_OMPR));
 }
 
 
diff --git a/drivers/platform/x86/intel/int3472/discrete.c b/drivers/platform/x86/intel/int3472/discrete.c
index e33c2d759..c0c90ae66 100644
--- a/drivers/platform/x86/intel/int3472/discrete.c
+++ b/drivers/platform/x86/intel/int3472/discrete.c
@@ -57,6 +57,9 @@ static int skl_int3472_map_gpio_to_sensor(struct int3472_discrete_device *int347
 					  const char *func, u32 polarity)
 {
 	char *path = agpio->resource_source.string_ptr;
+	const struct acpi_device_id ov7251_ids[] = {
+		{ "INT347E" },
+	};
 	struct gpiod_lookup *table_entry;
 	struct acpi_device *adev;
 	acpi_handle handle;
@@ -67,6 +70,17 @@ static int skl_int3472_map_gpio_to_sensor(struct int3472_discrete_device *int347
 		return -EINVAL;
 	}
 
+	/*
+	 * In addition to the function remap table we need to bulk remap the
+	 * "reset" GPIO for the OmniVision 7251 sensor, as the driver for that
+	 * expects its only GPIO pin to be called "enable" (and to have the
+	 * opposite polarity).
+	 */
+	if (!strcmp(func, "reset") && !acpi_match_device_ids(int3472->sensor, ov7251_ids)) {
+		func = "enable";
+		polarity = GPIO_ACTIVE_HIGH;
+	}
+
 	status = acpi_get_handle(NULL, path, &handle);
 	if (ACPI_FAILURE(status))
 		return -EINVAL;
diff --git a/drivers/platform/x86/intel/int3472/tps68470.c b/drivers/platform/x86/intel/int3472/tps68470.c
index 1e107fd49..423dc5550 100644
--- a/drivers/platform/x86/intel/int3472/tps68470.c
+++ b/drivers/platform/x86/intel/int3472/tps68470.c
@@ -17,7 +17,7 @@
 #define DESIGNED_FOR_CHROMEOS		1
 #define DESIGNED_FOR_WINDOWS		2
 
-#define TPS68470_WIN_MFD_CELL_COUNT	3
+#define TPS68470_WIN_MFD_CELL_COUNT	4
 
 static const struct mfd_cell tps68470_cros[] = {
 	{ .name = "tps68470-gpio" },
@@ -46,6 +46,13 @@ static int tps68470_chip_init(struct device *dev, struct regmap *regmap)
 		return ret;
 	}
 
+	/* Enable I2C daisy chain */
+	ret = regmap_write(regmap, TPS68470_REG_S_I2C_CTL, 0x03);
+	if (ret) {
+		dev_err(dev, "Failed to enable i2c daisy chain\n");
+		return ret;
+	}
+
 	dev_info(dev, "TPS68470 REVID: 0x%02x\n", version);
 
 	return 0;
@@ -193,7 +200,8 @@ static int skl_int3472_tps68470_probe(struct i2c_client *client)
 		cells[1].name = "tps68470-regulator";
 		cells[1].platform_data = (void *)board_data->tps68470_regulator_pdata;
 		cells[1].pdata_size = sizeof(struct tps68470_regulator_platform_data);
-		cells[2].name = "tps68470-gpio";
+		cells[2].name = "tps68470-led";
+		cells[3].name = "tps68470-gpio";
 
 		for (i = 0; i < board_data->n_gpiod_lookups; i++)
 			gpiod_add_lookup_table(board_data->tps68470_gpio_lookup_tables[i]);
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 15e9bd180..0d70461d0 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -220,6 +220,9 @@ static const struct usb_device_id usb_quirk_list[] = {
 	/* Microsoft Surface Dock Ethernet (RTL8153 GigE) */
 	{ USB_DEVICE(0x045e, 0x07c6), .driver_info = USB_QUIRK_NO_LPM },
 
+	/* Microsoft Surface Go 3 Type-Cover */
+	{ USB_DEVICE(0x045e, 0x09b5), .driver_info = USB_QUIRK_DELAY_INIT },
+
 	/* Cherry Stream G230 2.0 (G85-231) and 3.0 (G85-232) */
 	{ USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME },
 
diff --git a/include/linux/mfd/tps68470.h b/include/linux/mfd/tps68470.h
index 7807fa329..2d2abb25b 100644
--- a/include/linux/mfd/tps68470.h
+++ b/include/linux/mfd/tps68470.h
@@ -34,6 +34,7 @@
 #define TPS68470_REG_SGPO		0x22
 #define TPS68470_REG_GPDI		0x26
 #define TPS68470_REG_GPDO		0x27
+#define TPS68470_REG_ILEDCTL		0x28
 #define TPS68470_REG_VCMVAL		0x3C
 #define TPS68470_REG_VAUX1VAL		0x3D
 #define TPS68470_REG_VAUX2VAL		0x3E
@@ -94,4 +95,8 @@
 #define TPS68470_GPIO_MODE_OUT_CMOS	2
 #define TPS68470_GPIO_MODE_OUT_ODRAIN	3
 
+#define TPS68470_ILEDCTL_ENA		BIT(2)
+#define TPS68470_ILEDCTL_ENB		BIT(6)
+#define TPS68470_ILEDCTL_CTRLB		GENMASK(5, 4)
+
 #endif /* __LINUX_MFD_TPS68470_H */
diff --git a/include/linux/pci.h b/include/linux/pci.h
index b9ae5eb4c..c615fff3c 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -464,6 +464,7 @@ struct pci_dev {
 	unsigned int	no_vf_scan:1;		/* Don't scan for VFs after IOV enablement */
 	unsigned int	no_command_memory:1;	/* No PCI_COMMAND_MEMORY */
 	unsigned int	rom_bar_overlap:1;	/* ROM BAR disable broken */
+	unsigned int	no_shutdown:1;		/* Do not touch device on shutdown */
 	pci_dev_flags_t dev_flags;
 	atomic_t	enable_cnt;	/* pci_enable_device has been called */
 
diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
index a506d940a..2766484b8 100644
--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c
@@ -3717,6 +3717,15 @@ static const struct dmi_system_id dmi_platform_data[] = {
 		},
 		.driver_data = (void *)&intel_braswell_platform_data,
 	},
+	{
+		.ident = "Microsoft Surface 3",
+		.matches = {
+			DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."),
+			DMI_MATCH(DMI_SYS_VENDOR, "OEMB"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "OEMB"),
+		},
+		.driver_data = (void *)&intel_braswell_platform_data,
+	},
 	{
 		/*
 		 * Match for the GPDwin which unfortunately uses somewhat
diff --git a/sound/soc/intel/common/soc-acpi-intel-cht-match.c b/sound/soc/intel/common/soc-acpi-intel-cht-match.c
index cdcbf04b8..958305779 100644
--- a/sound/soc/intel/common/soc-acpi-intel-cht-match.c
+++ b/sound/soc/intel/common/soc-acpi-intel-cht-match.c
@@ -27,6 +27,14 @@ static const struct dmi_system_id cht_table[] = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "Surface 3"),
 		},
 	},
+	{
+		.callback = cht_surface_quirk_cb,
+		.matches = {
+			DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."),
+			DMI_MATCH(DMI_SYS_VENDOR, "OEMB"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "OEMB"),
+		},
+	},
 	{ }
 };
 
-- 
2.41.0