kernel 6.1.16

1 files changed, 8733 insertions, 1284 deletions

diff --git a/SOURCES/linux-surface.patch b/SOURCES/linux-surface.patch
index a4606e6..5b4309d 100644
--- a/SOURCES/linux-surface.patch
+++ b/SOURCES/linux-surface.patch
@@ -1,4 +1,4 @@
-From 19b8ce192055bdeca49b476a88bd5d694c54bbf7 Mon Sep 17 00:00:00 2001
+From 36dd7450ff34e702af12d3a895810ee9e93abc63 Mon Sep 17 00:00:00 2001
 From: Tsuchiya Yuto <kitakar@gmail.com>
 Date: Sun, 18 Oct 2020 16:42:44 +0900
 Subject: [PATCH] (surface3-oemb) add DMI matches for Surface 3 with broken DMI
@@ -40,7 +40,7 @@ Patchset: surface3-oemb
  3 files changed, 24 insertions(+)
 
 diff --git a/drivers/platform/surface/surface3-wmi.c b/drivers/platform/surface/surface3-wmi.c
-index ca4602bcc7de..490b9731068a 100644
+index ca4602bcc7dea..490b9731068ae 100644
 --- a/drivers/platform/surface/surface3-wmi.c
 +++ b/drivers/platform/surface/surface3-wmi.c
 @@ -37,6 +37,13 @@ static const struct dmi_system_id surface3_dmi_table[] = {
@@ -58,7 +58,7 @@ index ca4602bcc7de..490b9731068a 100644
  	{ }
  };
 diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
-index 620ecbfa4a7a..b07d06d2971a 100644
+index 620ecbfa4a7a8..b07d06d2971a8 100644
 --- a/sound/soc/codecs/rt5645.c
 +++ b/sound/soc/codecs/rt5645.c
 @@ -3717,6 +3717,15 @@ static const struct dmi_system_id dmi_platform_data[] = {
@@ -78,7 +78,7 @@ index 620ecbfa4a7a..b07d06d2971a 100644
  		/*
  		 * Match for the GPDwin which unfortunately uses somewhat
 diff --git a/sound/soc/intel/common/soc-acpi-intel-cht-match.c b/sound/soc/intel/common/soc-acpi-intel-cht-match.c
-index 6beb00858c33..d82d77387a0a 100644
+index 6beb00858c33f..d82d77387a0a6 100644
 --- a/sound/soc/intel/common/soc-acpi-intel-cht-match.c
 +++ b/sound/soc/intel/common/soc-acpi-intel-cht-match.c
 @@ -27,6 +27,14 @@ static const struct dmi_system_id cht_table[] = {
@@ -97,9 +97,9 @@ index 6beb00858c33..d82d77387a0a 100644
  };
  
 -- 
-2.39.0
+2.39.2
 
-From ab8029b679353ff413840f06959039119731599a Mon Sep 17 00:00:00 2001
+From 3651879493891a6b14c68983d4730b6700acb4aa Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jonas=20Dre=C3=9Fler?= <verdre@v0yd.nl>
 Date: Tue, 3 Nov 2020 13:28:04 +0100
 Subject: [PATCH] mwifiex: Add quirk resetting the PCI bridge on MS Surface
@@ -133,7 +133,7 @@ Patchset: mwifiex
  3 files changed, 31 insertions(+), 8 deletions(-)
 
 diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
-index 5dcf61761a16..84be9289caa6 100644
+index 5dcf61761a165..84be9289caa63 100644
 --- a/drivers/net/wireless/marvell/mwifiex/pcie.c
 +++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
 @@ -1762,9 +1762,21 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
@@ -159,7 +159,7 @@ index 5dcf61761a16..84be9289caa6 100644
  	if (mwifiex_write_reg(adapter, reg->rx_rdptr, card->rxbd_rdptr |
  			      tx_wrap)) {
 diff --git a/drivers/net/wireless/marvell/mwifiex/pcie_quirks.c b/drivers/net/wireless/marvell/mwifiex/pcie_quirks.c
-index dd6d21f1dbfd..f46b06f8d643 100644
+index dd6d21f1dbfd7..f46b06f8d6435 100644
 --- a/drivers/net/wireless/marvell/mwifiex/pcie_quirks.c
 +++ b/drivers/net/wireless/marvell/mwifiex/pcie_quirks.c
 @@ -13,7 +13,8 @@ static const struct dmi_system_id mwifiex_quirk_table[] = {
@@ -252,7 +252,7 @@ index dd6d21f1dbfd..f46b06f8d643 100644
  
  static void mwifiex_pcie_set_power_d3cold(struct pci_dev *pdev)
 diff --git a/drivers/net/wireless/marvell/mwifiex/pcie_quirks.h b/drivers/net/wireless/marvell/mwifiex/pcie_quirks.h
-index d6ff964aec5b..5d30ae39d65e 100644
+index d6ff964aec5bf..5d30ae39d65ec 100644
 --- a/drivers/net/wireless/marvell/mwifiex/pcie_quirks.h
 +++ b/drivers/net/wireless/marvell/mwifiex/pcie_quirks.h
 @@ -4,6 +4,7 @@
@@ -264,9 +264,9 @@ index d6ff964aec5b..5d30ae39d65e 100644
  void mwifiex_initialize_quirks(struct pcie_service_card *card);
  int mwifiex_pcie_reset_d3cold_quirk(struct pci_dev *pdev);
 -- 
-2.39.0
+2.39.2
 
-From 38ad493a42fa7e93cee10d17640a39eea0ecba97 Mon Sep 17 00:00:00 2001
+From a239303211cb7eff1a6358c8514065a06032f31c Mon Sep 17 00:00:00 2001
 From: Tsuchiya Yuto <kitakar@gmail.com>
 Date: Sun, 4 Oct 2020 00:11:49 +0900
 Subject: [PATCH] mwifiex: pcie: disable bridge_d3 for Surface gen4+
@@ -288,7 +288,7 @@ Patchset: mwifiex
  3 files changed, 27 insertions(+), 8 deletions(-)
 
 diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
-index 84be9289caa6..98be0d3cc41c 100644
+index 84be9289caa63..98be0d3cc41cf 100644
 --- a/drivers/net/wireless/marvell/mwifiex/pcie.c
 +++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
 @@ -368,6 +368,7 @@ static int mwifiex_pcie_probe(struct pci_dev *pdev,
@@ -313,7 +313,7 @@ index 84be9289caa6..98be0d3cc41c 100644
  }
  
 diff --git a/drivers/net/wireless/marvell/mwifiex/pcie_quirks.c b/drivers/net/wireless/marvell/mwifiex/pcie_quirks.c
-index f46b06f8d643..99b024ecbade 100644
+index f46b06f8d6435..99b024ecbadea 100644
 --- a/drivers/net/wireless/marvell/mwifiex/pcie_quirks.c
 +++ b/drivers/net/wireless/marvell/mwifiex/pcie_quirks.c
 @@ -14,7 +14,8 @@ static const struct dmi_system_id mwifiex_quirk_table[] = {
@@ -407,7 +407,7 @@ index f46b06f8d643..99b024ecbade 100644
  
  static void mwifiex_pcie_set_power_d3cold(struct pci_dev *pdev)
 diff --git a/drivers/net/wireless/marvell/mwifiex/pcie_quirks.h b/drivers/net/wireless/marvell/mwifiex/pcie_quirks.h
-index 5d30ae39d65e..c14eb56eb911 100644
+index 5d30ae39d65ec..c14eb56eb9118 100644
 --- a/drivers/net/wireless/marvell/mwifiex/pcie_quirks.h
 +++ b/drivers/net/wireless/marvell/mwifiex/pcie_quirks.h
 @@ -5,6 +5,7 @@
@@ -419,9 +419,9 @@ index 5d30ae39d65e..c14eb56eb911 100644
  void mwifiex_initialize_quirks(struct pcie_service_card *card);
  int mwifiex_pcie_reset_d3cold_quirk(struct pci_dev *pdev);
 -- 
-2.39.0
+2.39.2
 
-From 73bd3c344cd15dad5095585d51d0f07a7ae0eaf5 Mon Sep 17 00:00:00 2001
+From 7d5b4f5687544cadf760ebe14b28e31253c9e0e2 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jonas=20Dre=C3=9Fler?= <verdre@v0yd.nl>
 Date: Thu, 25 Mar 2021 11:33:02 +0100
 Subject: [PATCH] Bluetooth: btusb: Lower passive lescan interval on Marvell
@@ -457,18 +457,18 @@ Patchset: mwifiex
  1 file changed, 15 insertions(+)
 
 diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
-index 6beafd62d722..633f77fb4f96 100644
+index 952dc9d2404ed..b455885cdc0d8 100644
 --- a/drivers/bluetooth/btusb.c
 +++ b/drivers/bluetooth/btusb.c
-@@ -63,6 +63,7 @@ static struct usb_driver btusb_driver;
- #define BTUSB_INTEL_BROKEN_SHUTDOWN_LED	BIT(24)
+@@ -64,6 +64,7 @@ static struct usb_driver btusb_driver;
  #define BTUSB_INTEL_BROKEN_INITIAL_NCMD BIT(25)
  #define BTUSB_INTEL_NO_WBS_SUPPORT	BIT(26)
-+#define BTUSB_LOWER_LESCAN_INTERVAL	BIT(27)
+ #define BTUSB_ACTIONS_SEMI		BIT(27)
++#define BTUSB_LOWER_LESCAN_INTERVAL	BIT(28)
  
  static const struct usb_device_id btusb_table[] = {
  	/* Generic Bluetooth USB device */
-@@ -382,6 +383,7 @@ static const struct usb_device_id blacklist_table[] = {
+@@ -467,6 +468,7 @@ static const struct usb_device_id blacklist_table[] = {
  	{ USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
  	{ USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
  	{ USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL },
@@ -476,7 +476,7 @@ index 6beafd62d722..633f77fb4f96 100644
  
  	/* Intel Bluetooth devices */
  	{ USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_COMBINED },
-@@ -3862,6 +3864,19 @@ static int btusb_probe(struct usb_interface *intf,
+@@ -3957,6 +3959,19 @@ static int btusb_probe(struct usb_interface *intf,
  	if (id->driver_info & BTUSB_MARVELL)
  		hdev->set_bdaddr = btusb_set_bdaddr_marvell;
  
@@ -497,9 +497,9 @@ index 6beafd62d722..633f77fb4f96 100644
  	    (id->driver_info & BTUSB_MEDIATEK)) {
  		hdev->setup = btusb_mtk_setup;
 -- 
-2.39.0
+2.39.2
 
-From 8516237f9b2afa49f7b8f1d9e5ffc5be4a83c512 Mon Sep 17 00:00:00 2001
+From dbe93645ca7fe34649b6b9c964c18a1bc5e17cac Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
 Date: Sat, 27 Feb 2021 00:45:52 +0100
 Subject: [PATCH] ath10k: Add module parameters to override board files
@@ -521,7 +521,7 @@ Patchset: ath10k
  1 file changed, 58 insertions(+)
 
 diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
-index 5eb131ab916f..67f074a126d1 100644
+index 5eb131ab916fd..67f074a126d1f 100644
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
 @@ -38,6 +38,9 @@ static bool fw_diag_log;
@@ -618,9 +618,9 @@ index 5eb131ab916f..67f074a126d1 100644
  	ret = firmware_request_nowarn(&fw, filename, ar->dev);
  	ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot fw request '%s': %d\n",
 -- 
-2.39.0
+2.39.2
 
-From 42fabf8dcff992959f7e261a13779ba9eb757780 Mon Sep 17 00:00:00 2001
+From 0599e41661359b23763519f74cf74b87a7892df7 Mon Sep 17 00:00:00 2001
 From: Dorian Stoll <dorian.stoll@tmsp.io>
 Date: Thu, 30 Jul 2020 13:21:53 +0200
 Subject: [PATCH] misc: mei: Add missing IPTS device IDs
@@ -632,7 +632,7 @@ Patchset: ipts
  2 files changed, 2 insertions(+)
 
 diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
-index 99966cd3e7d8..67c602919b7e 100644
+index bdc65d50b945f..08723c01d7275 100644
 --- a/drivers/misc/mei/hw-me-regs.h
 +++ b/drivers/misc/mei/hw-me-regs.h
 @@ -92,6 +92,7 @@
@@ -644,7 +644,7 @@ index 99966cd3e7d8..67c602919b7e 100644
  
  #define MEI_DEV_ID_JSP_N      0x4DE0  /* Jasper Lake Point N */
 diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
-index 704cd0caa172..b4dc3fddd20d 100644
+index 5bf0d50d55a00..c13864512229f 100644
 --- a/drivers/misc/mei/pci-me.c
 +++ b/drivers/misc/mei/pci-me.c
 @@ -97,6 +97,7 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
@@ -656,78 +656,199 @@ index 704cd0caa172..b4dc3fddd20d 100644
  
  	{MEI_PCI_DEVICE(MEI_DEV_ID_TGP_LP, MEI_ME_PCH15_CFG)},
 -- 
-2.39.0
+2.39.2
 
-From 72fed1d44ac9a6ba0669e20fd617b6330af1634e Mon Sep 17 00:00:00 2001
+From ca537e0653e2843c08d900d4c3c6bb294b7e7693 Mon Sep 17 00:00:00 2001
+From: Liban Hannan <liban.p@gmail.com>
+Date: Tue, 12 Apr 2022 23:31:12 +0100
+Subject: [PATCH] iommu: ipts: use IOMMU passthrough mode for IPTS
+
+Adds a quirk so that IOMMU uses passthrough mode for the IPTS device.
+Otherwise, when IOMMU is enabled, IPTS produces DMAR errors like:
+
+DMAR: [DMA Read NO_PASID] Request device [00:16.4] fault addr
+0x104ea3000 [fault reason 0x06] PTE Read access is not set
+
+This is very similar to the bug described at:
+https://bugs.launchpad.net/bugs/1958004
+
+Fixed with the following patch which this patch basically copies:
+https://launchpadlibrarian.net/586396847/43255ca.diff
+Patchset: ipts
+---
+ drivers/iommu/intel/iommu.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index d4b5d20bd6dda..3965979c7bd41 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -37,6 +37,8 @@
+ #define IS_GFX_DEVICE(pdev) ((pdev->class >> 16) == PCI_BASE_CLASS_DISPLAY)
+ #define IS_USB_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_SERIAL_USB)
+ #define IS_ISA_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA)
++#define IS_IPTS(pdev) ((pdev)->vendor == PCI_VENDOR_ID_INTEL &&	\
++			    ((pdev)->device == 0x9d3e))
+ #define IS_AZALIA(pdev) ((pdev)->vendor == 0x8086 && (pdev)->device == 0x3a3e)
+ 
+ #define IOAPIC_RANGE_START	(0xfee00000)
+@@ -286,12 +288,14 @@ int intel_iommu_enabled = 0;
+ EXPORT_SYMBOL_GPL(intel_iommu_enabled);
+ 
+ static int dmar_map_gfx = 1;
++static int dmar_map_ipts = 1;
+ static int intel_iommu_superpage = 1;
+ static int iommu_identity_mapping;
+ static int iommu_skip_te_disable;
+ 
+ #define IDENTMAP_GFX		2
+ #define IDENTMAP_AZALIA		4
++#define IDENTMAP_IPTS		16
+ 
+ const struct iommu_ops intel_iommu_ops;
+ 
+@@ -2630,6 +2634,9 @@ static int device_def_domain_type(struct device *dev)
+ 
+ 		if ((iommu_identity_mapping & IDENTMAP_GFX) && IS_GFX_DEVICE(pdev))
+ 			return IOMMU_DOMAIN_IDENTITY;
++
++		if ((iommu_identity_mapping & IDENTMAP_IPTS) && IS_IPTS(pdev))
++			return IOMMU_DOMAIN_IDENTITY;
+ 	}
+ 
+ 	return 0;
+@@ -3019,6 +3026,9 @@ static int __init init_dmars(void)
+ 	if (!dmar_map_gfx)
+ 		iommu_identity_mapping |= IDENTMAP_GFX;
+ 
++	if (!dmar_map_ipts)
++		iommu_identity_mapping |= IDENTMAP_IPTS;
++
+ 	check_tylersburg_isoch();
+ 
+ 	ret = si_domain_init(hw_pass_through);
+@@ -4788,6 +4798,17 @@ static void quirk_iommu_igfx(struct pci_dev *dev)
+ 	dmar_map_gfx = 0;
+ }
+ 
++static void quirk_iommu_ipts(struct pci_dev *dev)
++{
++	if (!IS_IPTS(dev))
++		return;
++
++	if (risky_device(dev))
++		return;
++
++	pci_info(dev, "Passthrough IOMMU for IPTS\n");
++	dmar_map_ipts = 0;
++}
+ /* G4x/GM45 integrated gfx dmar support is totally busted. */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_igfx);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e00, quirk_iommu_igfx);
+@@ -4823,6 +4844,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1632, quirk_iommu_igfx);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x163A, quirk_iommu_igfx);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x163D, quirk_iommu_igfx);
+ 
++/* disable IPTS dmar support */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9D3E, quirk_iommu_ipts);
++
+ static void quirk_iommu_rwbf(struct pci_dev *dev)
+ {
+ 	if (risky_device(dev))
+-- 
+2.39.2
+
+From 6fd49d6f1a0ead6f8e466fbac8f029b169e477f3 Mon Sep 17 00:00:00 2001
 From: Dorian Stoll <dorian.stoll@tmsp.io>
-Date: Thu, 6 Aug 2020 11:20:41 +0200
-Subject: [PATCH] misc: Add support for Intel Precise Touch & Stylus
+Date: Sun, 11 Dec 2022 12:00:59 +0100
+Subject: [PATCH] hid: Add support for Intel Precise Touch and Stylus
 
-Based on linux-surface/intel-precise-touch@3f362c
+Based on linux-surface/intel-precise-touch@8abe268
 
 Signed-off-by: Dorian Stoll <dorian.stoll@tmsp.io>
 Patchset: ipts
 ---
- drivers/misc/Kconfig          |   1 +
- drivers/misc/Makefile         |   1 +
- drivers/misc/ipts/Kconfig     |  17 ++
- drivers/misc/ipts/Makefile    |  12 ++
- drivers/misc/ipts/context.h   |  47 +++++
- drivers/misc/ipts/control.c   | 113 +++++++++++
- drivers/misc/ipts/control.h   |  24 +++
- drivers/misc/ipts/mei.c       | 125 ++++++++++++
- drivers/misc/ipts/protocol.h  | 347 ++++++++++++++++++++++++++++++++++
- drivers/misc/ipts/receiver.c  | 224 ++++++++++++++++++++++
- drivers/misc/ipts/receiver.h  |  16 ++
- drivers/misc/ipts/resources.c | 128 +++++++++++++
- drivers/misc/ipts/resources.h |  17 ++
- drivers/misc/ipts/uapi.c      | 208 ++++++++++++++++++++
- drivers/misc/ipts/uapi.h      |  47 +++++
- 15 files changed, 1327 insertions(+)
- create mode 100644 drivers/misc/ipts/Kconfig
- create mode 100644 drivers/misc/ipts/Makefile
- create mode 100644 drivers/misc/ipts/context.h
- create mode 100644 drivers/misc/ipts/control.c
- create mode 100644 drivers/misc/ipts/control.h
- create mode 100644 drivers/misc/ipts/mei.c
- create mode 100644 drivers/misc/ipts/protocol.h
- create mode 100644 drivers/misc/ipts/receiver.c
- create mode 100644 drivers/misc/ipts/receiver.h
- create mode 100644 drivers/misc/ipts/resources.c
- create mode 100644 drivers/misc/ipts/resources.h
- create mode 100644 drivers/misc/ipts/uapi.c
- create mode 100644 drivers/misc/ipts/uapi.h
-
-diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
-index 358ad56f6524..1fd6f755f98b 100644
---- a/drivers/misc/Kconfig
-+++ b/drivers/misc/Kconfig
-@@ -514,4 +514,5 @@ source "drivers/misc/habanalabs/Kconfig"
- source "drivers/misc/uacce/Kconfig"
- source "drivers/misc/pvpanic/Kconfig"
- source "drivers/misc/mchp_pci1xxxx/Kconfig"
-+source "drivers/misc/ipts/Kconfig"
+ drivers/hid/Kconfig            |   2 +
+ drivers/hid/Makefile           |   2 +
+ drivers/hid/ipts/Kconfig       |  14 +
+ drivers/hid/ipts/Makefile      |  14 +
+ drivers/hid/ipts/cmd.c         |  62 +++++
+ drivers/hid/ipts/cmd.h         |  61 ++++
+ drivers/hid/ipts/context.h     |  51 ++++
+ drivers/hid/ipts/control.c     | 495 +++++++++++++++++++++++++++++++++
+ drivers/hid/ipts/control.h     | 127 +++++++++
+ drivers/hid/ipts/desc.h        |  81 ++++++
+ drivers/hid/ipts/hid.c         | 348 +++++++++++++++++++++++
+ drivers/hid/ipts/hid.h         |  22 ++
+ drivers/hid/ipts/main.c        | 127 +++++++++
+ drivers/hid/ipts/mei.c         | 189 +++++++++++++
+ drivers/hid/ipts/mei.h         |  67 +++++
+ drivers/hid/ipts/receiver.c    | 249 +++++++++++++++++
+ drivers/hid/ipts/receiver.h    |  17 ++
+ drivers/hid/ipts/resources.c   | 108 +++++++
+ drivers/hid/ipts/resources.h   |  39 +++
+ drivers/hid/ipts/spec-data.h   | 100 +++++++
+ drivers/hid/ipts/spec-device.h | 285 +++++++++++++++++++
+ drivers/hid/ipts/spec-hid.h    |  35 +++
+ drivers/hid/ipts/thread.c      |  85 ++++++
+ drivers/hid/ipts/thread.h      |  60 ++++
+ 24 files changed, 2640 insertions(+)
+ create mode 100644 drivers/hid/ipts/Kconfig
+ create mode 100644 drivers/hid/ipts/Makefile
+ create mode 100644 drivers/hid/ipts/cmd.c
+ create mode 100644 drivers/hid/ipts/cmd.h
+ create mode 100644 drivers/hid/ipts/context.h
+ create mode 100644 drivers/hid/ipts/control.c
+ create mode 100644 drivers/hid/ipts/control.h
+ create mode 100644 drivers/hid/ipts/desc.h
+ create mode 100644 drivers/hid/ipts/hid.c
+ create mode 100644 drivers/hid/ipts/hid.h
+ create mode 100644 drivers/hid/ipts/main.c
+ create mode 100644 drivers/hid/ipts/mei.c
+ create mode 100644 drivers/hid/ipts/mei.h
+ create mode 100644 drivers/hid/ipts/receiver.c
+ create mode 100644 drivers/hid/ipts/receiver.h
+ create mode 100644 drivers/hid/ipts/resources.c
+ create mode 100644 drivers/hid/ipts/resources.h
+ create mode 100644 drivers/hid/ipts/spec-data.h
+ create mode 100644 drivers/hid/ipts/spec-device.h
+ create mode 100644 drivers/hid/ipts/spec-hid.h
+ create mode 100644 drivers/hid/ipts/thread.c
+ create mode 100644 drivers/hid/ipts/thread.h
+
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 185a077d59cdd..1523ccdf73b51 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -1290,4 +1290,6 @@ source "drivers/hid/amd-sfh-hid/Kconfig"
+ 
+ source "drivers/hid/surface-hid/Kconfig"
+ 
++source "drivers/hid/ipts/Kconfig"
++
  endmenu
-diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
-index ac9b3e757ba1..5a82ffe77911 100644
---- a/drivers/misc/Makefile
-+++ b/drivers/misc/Makefile
-@@ -62,3 +62,4 @@ obj-$(CONFIG_HI6421V600_IRQ)	+= hi6421v600-irq.o
- obj-$(CONFIG_OPEN_DICE)		+= open-dice.o
- obj-$(CONFIG_GP_PCI1XXXX)	+= mchp_pci1xxxx/
- obj-$(CONFIG_VCPU_STALL_DETECTOR)	+= vcpu_stall_detector.o
-+obj-$(CONFIG_MISC_IPTS)		+= ipts/
-diff --git a/drivers/misc/ipts/Kconfig b/drivers/misc/ipts/Kconfig
+diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
+index e8014c1a2f8b6..e48300bcea9be 100644
+--- a/drivers/hid/Makefile
++++ b/drivers/hid/Makefile
+@@ -164,3 +164,5 @@ obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER)	+= intel-ish-hid/
+ obj-$(CONFIG_AMD_SFH_HID)       += amd-sfh-hid/
+ 
+ obj-$(CONFIG_SURFACE_HID_CORE)  += surface-hid/
++
++obj-$(CONFIG_HID_IPTS)          += ipts/
+diff --git a/drivers/hid/ipts/Kconfig b/drivers/hid/ipts/Kconfig
 new file mode 100644
-index 000000000000..83e2a930c396
+index 0000000000000..297401bd388dd
 --- /dev/null
-+++ b/drivers/misc/ipts/Kconfig
-@@ -0,0 +1,17 @@
++++ b/drivers/hid/ipts/Kconfig
+@@ -0,0 +1,14 @@
 +# SPDX-License-Identifier: GPL-2.0-or-later
 +
-+config MISC_IPTS
++config HID_IPTS
 +	tristate "Intel Precise Touch & Stylus"
 +	depends on INTEL_MEI
++	depends on HID
 +	help
 +	  Say Y here if your system has a touchscreen using Intels
 +	  Precise Touch & Stylus (IPTS) technology.
@@ -736,277 +857,1381 @@ index 000000000000..83e2a930c396
 +
 +	  To compile this driver as a module, choose M here: the
 +	  module will be called ipts.
-+
-+	  Building this driver alone will not give you a working touchscreen.
-+	  It only exposed a userspace API that can be used by a daemon to
-+	  receive and process data from the touchscreen hardware.
-diff --git a/drivers/misc/ipts/Makefile b/drivers/misc/ipts/Makefile
+diff --git a/drivers/hid/ipts/Makefile b/drivers/hid/ipts/Makefile
 new file mode 100644
-index 000000000000..8f58b9adbc94
+index 0000000000000..0fe655bccdc0f
 --- /dev/null
-+++ b/drivers/misc/ipts/Makefile
-@@ -0,0 +1,12 @@
++++ b/drivers/hid/ipts/Makefile
+@@ -0,0 +1,14 @@
 +# SPDX-License-Identifier: GPL-2.0-or-later
 +#
 +# Makefile for the IPTS touchscreen driver
 +#
 +
-+obj-$(CONFIG_MISC_IPTS) += ipts.o
-+ipts-objs := control.o
++obj-$(CONFIG_HID_IPTS) += ipts.o
++ipts-objs := cmd.o
++ipts-objs += control.o
++ipts-objs += hid.o
++ipts-objs += main.o
 +ipts-objs += mei.o
 +ipts-objs += receiver.o
 +ipts-objs += resources.o
-+ipts-objs += uapi.o
++ipts-objs += thread.o
+diff --git a/drivers/hid/ipts/cmd.c b/drivers/hid/ipts/cmd.c
+new file mode 100644
+index 0000000000000..7fd69271ccd52
+--- /dev/null
++++ b/drivers/hid/ipts/cmd.c
+@@ -0,0 +1,62 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2020-2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
++ */
++
++#include <linux/errno.h>
++#include <linux/types.h>
++
++#include "cmd.h"
++#include "context.h"
++#include "mei.h"
++#include "spec-device.h"
++
++int ipts_cmd_recv_timeout(struct ipts_context *ipts, enum ipts_command_code code,
++			  struct ipts_response *rsp, u64 timeout)
++{
++	int ret = 0;
++
++	if (!ipts)
++		return -EFAULT;
++
++	if (!rsp)
++		return -EFAULT;
++
++	/*
++	 * In a response, the command code will have the most significant bit flipped to 1.
++	 * If code is passed to ipts_mei_recv as is, no messages will be received.
++	 */
++	ret = ipts_mei_recv(&ipts->mei, code | IPTS_RSP_BIT, rsp, timeout);
++	if (ret < 0)
++		return ret;
 +
-diff --git a/drivers/misc/ipts/context.h b/drivers/misc/ipts/context.h
++	dev_dbg(ipts->dev, "Received 0x%02X with status 0x%02X\n", code, rsp->status);
++
++	/*
++	 * Some devices will always return this error.
++	 * It is allowed to ignore it and to try continuing.
++	 */
++	if (rsp->status == IPTS_STATUS_COMPAT_CHECK_FAIL)
++		rsp->status = IPTS_STATUS_SUCCESS;
++
++	return 0;
++}
++
++int ipts_cmd_send(struct ipts_context *ipts, enum ipts_command_code code, void *data, size_t size)
++{
++	struct ipts_command cmd = { 0 };
++
++	if (!ipts)
++		return -EFAULT;
++
++	cmd.cmd = code;
++
++	if (data && size > 0)
++		memcpy(cmd.payload, data, size);
++
++	dev_dbg(ipts->dev, "Sending 0x%02X with %ld bytes payload\n", code, size);
++	return ipts_mei_send(&ipts->mei, &cmd, sizeof(cmd.cmd) + size);
++}
+diff --git a/drivers/hid/ipts/cmd.h b/drivers/hid/ipts/cmd.h
 new file mode 100644
-index 000000000000..f4b06a2d3f72
+index 0000000000000..924758ffee671
 --- /dev/null
-+++ b/drivers/misc/ipts/context.h
-@@ -0,0 +1,47 @@
++++ b/drivers/hid/ipts/cmd.h
+@@ -0,0 +1,61 @@
 +/* SPDX-License-Identifier: GPL-2.0-or-later */
 +/*
 + * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
++ * Copyright (c) 2020-2023 Dorian Stoll
 + *
 + * Linux driver for Intel Precise Touch & Stylus
 + */
 +
-+#ifndef _IPTS_CONTEXT_H_
-+#define _IPTS_CONTEXT_H_
++#ifndef IPTS_CMD_H
++#define IPTS_CMD_H
 +
-+#include <linux/cdev.h>
-+#include <linux/device.h>
-+#include <linux/mei_cl_bus.h>
 +#include <linux/types.h>
 +
-+#include "protocol.h"
++#include "context.h"
++#include "spec-device.h"
 +
-+enum ipts_host_status {
-+	IPTS_HOST_STATUS_STARTING,
-+	IPTS_HOST_STATUS_STARTED,
-+	IPTS_HOST_STATUS_STOPPING,
-+	IPTS_HOST_STATUS_STOPPED,
-+};
++/*
++ * The default timeout for receiving responses
++ */
++#define IPTS_CMD_DEFAULT_TIMEOUT 1000
 +
-+struct ipts_buffer_info {
-+	u8 *address;
-+	dma_addr_t dma_address;
-+};
++/*
++ * ipts_cmd_recv_timeout() - Receives a response to a command.
++ * @ipts: The IPTS driver context.
++ * @code: The type of the command / response.
++ * @rsp: The address that the received response will be copied to.
++ * @timeout: How many milliseconds the function will wait at most.
++ *
++ * A negative timeout means to wait forever.
++ *
++ * Returns: 0 on success, <0 on error, -EAGAIN if no response has been received.
++ */
++int ipts_cmd_recv_timeout(struct ipts_context *ipts, enum ipts_command_code code,
++			  struct ipts_response *rsp, u64 timeout);
++
++/*
++ * ipts_cmd_recv() - Receives a response to a command.
++ * @ipts: The IPTS driver context.
++ * @code: The type of the command / response.
++ * @rsp: The address that the received response will be copied to.
++ *
++ * Returns: 0 on success, <0 on error, -EAGAIN if no response has been received.
++ */
++static inline int ipts_cmd_recv(struct ipts_context *ipts, enum ipts_command_code code,
++				struct ipts_response *rsp)
++{
++	return ipts_cmd_recv_timeout(ipts, code, rsp, IPTS_CMD_DEFAULT_TIMEOUT);
++}
++
++/*
++ * ipts_cmd_send() - Executes a command on the device.
++ * @ipts: The IPTS driver context.
++ * @code: The type of the command to execute.
++ * @data: The payload containing parameters for the command.
++ * @size: The size of the payload.
++ *
++ * Returns: 0 on success, <0 on error.
++ */
++int ipts_cmd_send(struct ipts_context *ipts, enum ipts_command_code code, void *data, size_t size);
++
++#endif /* IPTS_CMD_H */
+diff --git a/drivers/hid/ipts/context.h b/drivers/hid/ipts/context.h
+new file mode 100644
+index 0000000000000..3450a95e66ee8
+--- /dev/null
++++ b/drivers/hid/ipts/context.h
+@@ -0,0 +1,51 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2020-2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
++ */
++
++#ifndef IPTS_CONTEXT_H
++#define IPTS_CONTEXT_H
++
++#include <linux/completion.h>
++#include <linux/device.h>
++#include <linux/hid.h>
++#include <linux/mei_cl_bus.h>
++#include <linux/mutex.h>
++#include <linux/sched.h>
++#include <linux/types.h>
++
++#include "mei.h"
++#include "resources.h"
++#include "spec-device.h"
++#include "thread.h"
 +
 +struct ipts_context {
-+	struct mei_cl_device *cldev;
 +	struct device *dev;
++	struct ipts_mei mei;
 +
-+	bool restart;
-+	enum ipts_host_status status;
-+	struct ipts_get_device_info_rsp device_info;
++	enum ipts_mode mode;
 +
-+	struct ipts_buffer_info data[IPTS_BUFFERS];
-+	struct ipts_buffer_info doorbell;
++	/*
++	 * Prevents concurrent GET_FEATURE reports.
++	 */
++	struct mutex feature_lock;
++	struct completion feature_event;
++
++	/*
++	 * These are not inside of struct ipts_resources
++	 * because they don't own the memory they point to.
++	 */
++	struct ipts_buffer feature_report;
++	struct ipts_buffer descriptor;
++
++	struct hid_device *hid;
++	struct ipts_device_info info;
++	struct ipts_resources resources;
 +
-+	struct ipts_buffer_info feedback[IPTS_BUFFERS];
-+	struct ipts_buffer_info workqueue;
-+	struct ipts_buffer_info host2me;
++	struct ipts_thread receiver_loop;
 +};
 +
-+#endif /* _IPTS_CONTEXT_H_ */
-diff --git a/drivers/misc/ipts/control.c b/drivers/misc/ipts/control.c
++#endif /* IPTS_CONTEXT_H */
+diff --git a/drivers/hid/ipts/control.c b/drivers/hid/ipts/control.c
 new file mode 100644
-index 000000000000..a1d1f97a13d7
+index 0000000000000..2f61500b5119c
 --- /dev/null
-+++ b/drivers/misc/ipts/control.c
-@@ -0,0 +1,113 @@
++++ b/drivers/hid/ipts/control.c
+@@ -0,0 +1,495 @@
 +// SPDX-License-Identifier: GPL-2.0-or-later
 +/*
 + * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
++ * Copyright (c) 2020-2023 Dorian Stoll
 + *
 + * Linux driver for Intel Precise Touch & Stylus
 + */
 +
-+#include <linux/mei_cl_bus.h>
++#include <linux/delay.h>
++#include <linux/dev_printk.h>
++#include <linux/errno.h>
++#include <linux/kernel.h>
++#include <linux/kthread.h>
++#include <linux/types.h>
 +
++#include "cmd.h"
 +#include "context.h"
-+#include "protocol.h"
++#include "control.h"
++#include "desc.h"
++#include "hid.h"
++#include "receiver.h"
 +#include "resources.h"
-+#include "uapi.h"
++#include "spec-data.h"
++#include "spec-device.h"
 +
-+int ipts_control_send(struct ipts_context *ipts, u32 code, void *payload,
-+		      size_t size)
++static int ipts_control_get_device_info(struct ipts_context *ipts, struct ipts_device_info *info)
 +{
-+	int ret;
-+	struct ipts_command cmd;
++	int ret = 0;
++	struct ipts_response rsp = { 0 };
++
++	if (!ipts)
++		return -EFAULT;
++
++	if (!info)
++		return -EFAULT;
++
++	ret = ipts_cmd_send(ipts, IPTS_CMD_GET_DEVICE_INFO, NULL, 0);
++	if (ret) {
++		dev_err(ipts->dev, "GET_DEVICE_INFO: send failed: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_cmd_recv(ipts, IPTS_CMD_GET_DEVICE_INFO, &rsp);
++	if (ret) {
++		dev_err(ipts->dev, "GET_DEVICE_INFO: recv failed: %d\n", ret);
++		return ret;
++	}
++
++	if (rsp.status != IPTS_STATUS_SUCCESS) {
++		dev_err(ipts->dev, "GET_DEVICE_INFO: cmd failed: %d\n", rsp.status);
++		return -EBADR;
++	}
++
++	memcpy(info, rsp.payload, sizeof(*info));
++	return 0;
++}
++
++static int ipts_control_set_mode(struct ipts_context *ipts, enum ipts_mode mode)
++{
++	int ret = 0;
++	struct ipts_set_mode cmd = { 0 };
++	struct ipts_response rsp = { 0 };
++
++	if (!ipts)
++		return -EFAULT;
++
++	cmd.mode = mode;
++
++	ret = ipts_cmd_send(ipts, IPTS_CMD_SET_MODE, &cmd, sizeof(cmd));
++	if (ret) {
++		dev_err(ipts->dev, "SET_MODE: send failed: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_cmd_recv(ipts, IPTS_CMD_SET_MODE, &rsp);
++	if (ret) {
++		dev_err(ipts->dev, "SET_MODE: recv failed: %d\n", ret);
++		return ret;
++	}
++
++	if (rsp.status != IPTS_STATUS_SUCCESS) {
++		dev_err(ipts->dev, "SET_MODE: cmd failed: %d\n", rsp.status);
++		return -EBADR;
++	}
++
++	return 0;
++}
++
++static int ipts_control_set_mem_window(struct ipts_context *ipts, struct ipts_resources *res)
++{
++	int ret = 0;
++	struct ipts_mem_window cmd = { 0 };
++	struct ipts_response rsp = { 0 };
++
++	if (!ipts)
++		return -EFAULT;
++
++	if (!res)
++		return -EFAULT;
++
++	for (int i = 0; i < IPTS_BUFFERS; i++) {
++		cmd.data_addr_lower[i] = lower_32_bits(res->data[i].dma_address);
++		cmd.data_addr_upper[i] = upper_32_bits(res->data[i].dma_address);
++		cmd.feedback_addr_lower[i] = lower_32_bits(res->feedback[i].dma_address);
++		cmd.feedback_addr_upper[i] = upper_32_bits(res->feedback[i].dma_address);
++	}
++
++	cmd.workqueue_addr_lower = lower_32_bits(res->workqueue.dma_address);
++	cmd.workqueue_addr_upper = upper_32_bits(res->workqueue.dma_address);
++
++	cmd.doorbell_addr_lower = lower_32_bits(res->doorbell.dma_address);
++	cmd.doorbell_addr_upper = upper_32_bits(res->doorbell.dma_address);
++
++	cmd.hid2me_addr_lower = lower_32_bits(res->hid2me.dma_address);
++	cmd.hid2me_addr_upper = upper_32_bits(res->hid2me.dma_address);
++
++	cmd.workqueue_size = IPTS_WORKQUEUE_SIZE;
++	cmd.workqueue_item_size = IPTS_WORKQUEUE_ITEM_SIZE;
++
++	ret = ipts_cmd_send(ipts, IPTS_CMD_SET_MEM_WINDOW, &cmd, sizeof(cmd));
++	if (ret) {
++		dev_err(ipts->dev, "SET_MEM_WINDOW: send failed: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_cmd_recv(ipts, IPTS_CMD_SET_MEM_WINDOW, &rsp);
++	if (ret) {
++		dev_err(ipts->dev, "SET_MEM_WINDOW: recv failed: %d\n", ret);
++		return ret;
++	}
++
++	if (rsp.status != IPTS_STATUS_SUCCESS) {
++		dev_err(ipts->dev, "SET_MEM_WINDOW: cmd failed: %d\n", rsp.status);
++		return -EBADR;
++	}
++
++	return 0;
++}
++
++static int ipts_control_get_descriptor(struct ipts_context *ipts)
++{
++	int ret = 0;
++	struct ipts_data_header *header = NULL;
++	struct ipts_get_descriptor cmd = { 0 };
++	struct ipts_response rsp = { 0 };
++
++	if (!ipts)
++		return -EFAULT;
++
++	if (!ipts->resources.descriptor.address)
++		return -EFAULT;
++
++	memset(ipts->resources.descriptor.address, 0, ipts->resources.descriptor.size);
 +
-+	memset(&cmd, 0, sizeof(struct ipts_command));
-+	cmd.code = code;
++	cmd.addr_lower = lower_32_bits(ipts->resources.descriptor.dma_address);
++	cmd.addr_upper = upper_32_bits(ipts->resources.descriptor.dma_address);
++	cmd.magic = 8;
 +
-+	if (payload && size > 0)
-+		memcpy(&cmd.payload, payload, size);
++	ret = ipts_cmd_send(ipts, IPTS_CMD_GET_DESCRIPTOR, &cmd, sizeof(cmd));
++	if (ret) {
++		dev_err(ipts->dev, "GET_DESCRIPTOR: send failed: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_cmd_recv(ipts, IPTS_CMD_GET_DESCRIPTOR, &rsp);
++	if (ret) {
++		dev_err(ipts->dev, "GET_DESCRIPTOR: recv failed: %d\n", ret);
++		return ret;
++	}
++
++	if (rsp.status != IPTS_STATUS_SUCCESS) {
++		dev_err(ipts->dev, "GET_DESCRIPTOR: cmd failed: %d\n", rsp.status);
++		return -EBADR;
++	}
++
++	header = (struct ipts_data_header *)ipts->resources.descriptor.address;
++
++	if (header->type == IPTS_DATA_TYPE_DESCRIPTOR) {
++		ipts->descriptor.address = &header->data[8];
++		ipts->descriptor.size = header->size - 8;
 +
-+	ret = mei_cldev_send(ipts->cldev, (u8 *)&cmd, sizeof(cmd.code) + size);
-+	if (ret >= 0)
 +		return 0;
++	}
++
++	return -ENODATA;
++}
++
++int ipts_control_request_flush(struct ipts_context *ipts)
++{
++	int ret = 0;
++	struct ipts_quiesce_io cmd = { 0 };
++
++	if (!ipts)
++		return -EFAULT;
++
++	ret = ipts_cmd_send(ipts, IPTS_CMD_QUIESCE_IO, &cmd, sizeof(cmd));
++	if (ret)
++		dev_err(ipts->dev, "QUIESCE_IO: send failed: %d\n", ret);
++
++	return ret;
++}
++
++int ipts_control_wait_flush(struct ipts_context *ipts)
++{
++	int ret = 0;
++	struct ipts_response rsp = { 0 };
++
++	if (!ipts)
++		return -EFAULT;
++
++	ret = ipts_cmd_recv(ipts, IPTS_CMD_QUIESCE_IO, &rsp);
++	if (ret) {
++		dev_err(ipts->dev, "QUIESCE_IO: recv failed: %d\n", ret);
++		return ret;
++	}
++
++	if (rsp.status == IPTS_STATUS_TIMEOUT)
++		return -EAGAIN;
++
++	if (rsp.status != IPTS_STATUS_SUCCESS) {
++		dev_err(ipts->dev, "QUIESCE_IO: cmd failed: %d\n", rsp.status);
++		return -EBADR;
++	}
++
++	return 0;
++}
++
++int ipts_control_request_data(struct ipts_context *ipts)
++{
++	int ret = 0;
++
++	if (!ipts)
++		return -EFAULT;
++
++	ret = ipts_cmd_send(ipts, IPTS_CMD_READY_FOR_DATA, NULL, 0);
++	if (ret)
++		dev_err(ipts->dev, "READY_FOR_DATA: send failed: %d\n", ret);
++
++	return ret;
++}
++
++int ipts_control_wait_data(struct ipts_context *ipts, bool shutdown)
++{
++	int ret = 0;
++	struct ipts_response rsp = { 0 };
++
++	if (!ipts)
++		return -EFAULT;
++
++	if (!shutdown)
++		ret = ipts_cmd_recv_timeout(ipts, IPTS_CMD_READY_FOR_DATA, &rsp, 0);
++	else
++		ret = ipts_cmd_recv(ipts, IPTS_CMD_READY_FOR_DATA, &rsp);
++
++	if (ret) {
++		if (ret != -EAGAIN)
++			dev_err(ipts->dev, "READY_FOR_DATA: recv failed: %d\n", ret);
++
++		return ret;
++	}
 +
 +	/*
-+	 * During shutdown the device might get pulled away from below our feet.
-+	 * Dont log an error in this case, because it will confuse people.
++	 * During shutdown, it is possible that the sensor has already been disabled.
 +	 */
-+	if (ret != -ENODEV || ipts->status != IPTS_HOST_STATUS_STOPPING)
-+		dev_err(ipts->dev, "Error while sending: 0x%X:%d\n", code, ret);
++	if (rsp.status == IPTS_STATUS_SENSOR_DISABLED)
++		return 0;
 +
-+	return ret;
++	if (rsp.status == IPTS_STATUS_TIMEOUT)
++		return -EAGAIN;
++
++	if (rsp.status != IPTS_STATUS_SUCCESS) {
++		dev_err(ipts->dev, "READY_FOR_DATA: cmd failed: %d\n", rsp.status);
++		return -EBADR;
++	}
++
++	return 0;
 +}
 +
 +int ipts_control_send_feedback(struct ipts_context *ipts, u32 buffer)
 +{
-+	struct ipts_feedback_cmd cmd;
++	int ret = 0;
++	struct ipts_feedback cmd = { 0 };
++	struct ipts_response rsp = { 0 };
++
++	if (!ipts)
++		return -EFAULT;
 +
-+	memset(&cmd, 0, sizeof(struct ipts_feedback_cmd));
 +	cmd.buffer = buffer;
 +
-+	return ipts_control_send(ipts, IPTS_CMD_FEEDBACK, &cmd,
-+				 sizeof(struct ipts_feedback_cmd));
++	ret = ipts_cmd_send(ipts, IPTS_CMD_FEEDBACK, &cmd, sizeof(cmd));
++	if (ret) {
++		dev_err(ipts->dev, "FEEDBACK: send failed: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_cmd_recv(ipts, IPTS_CMD_FEEDBACK, &rsp);
++	if (ret) {
++		dev_err(ipts->dev, "FEEDBACK: recv failed: %d\n", ret);
++		return ret;
++	}
++
++	/*
++	 * We don't know what feedback data looks like so we are sending zeros.
++	 * See also ipts_control_refill_buffer.
++	 */
++	if (rsp.status == IPTS_STATUS_INVALID_PARAMS)
++		return 0;
++
++	if (rsp.status != IPTS_STATUS_SUCCESS) {
++		dev_err(ipts->dev, "FEEDBACK: cmd failed: %d\n", rsp.status);
++		return -EBADR;
++	}
++
++	return 0;
 +}
 +
-+int ipts_control_set_feature(struct ipts_context *ipts, u8 report, u8 value)
++int ipts_control_hid2me_feedback(struct ipts_context *ipts, enum ipts_feedback_cmd_type cmd,
++				 enum ipts_feedback_data_type type, void *data, size_t size)
 +{
-+	struct ipts_feedback_buffer *feedback;
++	struct ipts_feedback_header *header = NULL;
++
++	if (!ipts)
++		return -EFAULT;
 +
-+	memset(ipts->host2me.address, 0, ipts->device_info.feedback_size);
-+	feedback = (struct ipts_feedback_buffer *)ipts->host2me.address;
++	if (!ipts->resources.hid2me.address)
++		return -EFAULT;
++
++	memset(ipts->resources.hid2me.address, 0, ipts->resources.hid2me.size);
++	header = (struct ipts_feedback_header *)ipts->resources.hid2me.address;
++
++	header->cmd_type = cmd;
++	header->data_type = type;
++	header->size = size;
++	header->buffer = IPTS_HID2ME_BUFFER;
++
++	if (size + sizeof(*header) > ipts->resources.hid2me.size)
++		return -EINVAL;
 +
-+	feedback->cmd_type = IPTS_FEEDBACK_CMD_TYPE_NONE;
-+	feedback->data_type = IPTS_FEEDBACK_DATA_TYPE_SET_FEATURES;
-+	feedback->buffer = IPTS_HOST2ME_BUFFER;
-+	feedback->size = 2;
-+	feedback->payload[0] = report;
-+	feedback->payload[1] = value;
++	if (data && size > 0)
++		memcpy(header->payload, data, size);
 +
-+	return ipts_control_send_feedback(ipts, IPTS_HOST2ME_BUFFER);
++	return ipts_control_send_feedback(ipts, IPTS_HID2ME_BUFFER);
++}
++
++static inline int ipts_control_reset_sensor(struct ipts_context *ipts)
++{
++	return ipts_control_hid2me_feedback(ipts, IPTS_FEEDBACK_CMD_TYPE_SOFT_RESET,
++					    IPTS_FEEDBACK_DATA_TYPE_VENDOR, NULL, 0);
 +}
 +
 +int ipts_control_start(struct ipts_context *ipts)
 +{
-+	if (ipts->status != IPTS_HOST_STATUS_STOPPED)
-+		return -EBUSY;
++	int ret = 0;
++	struct ipts_device_info info = { 0 };
++
++	if (!ipts)
++		return -EFAULT;
 +
 +	dev_info(ipts->dev, "Starting IPTS\n");
-+	ipts->status = IPTS_HOST_STATUS_STARTING;
-+	ipts->restart = false;
 +
-+	ipts_uapi_link(ipts);
-+	return ipts_control_send(ipts, IPTS_CMD_GET_DEVICE_INFO, NULL, 0);
++	ret = ipts_control_get_device_info(ipts, &info);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to get device info: %d\n", ret);
++		return ret;
++	}
++
++	ipts->info = info;
++
++	ret = ipts_resources_init(&ipts->resources, ipts->dev, info.data_size, info.feedback_size);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to allocate buffers: %d", ret);
++		return ret;
++	}
++
++	dev_info(ipts->dev, "IPTS EDS Version: %d\n", info.intf_eds);
++
++	/*
++	 * Handle newer devices
++	 */
++	if (info.intf_eds > 1) {
++		/*
++		 * Fetching the descriptor will only work on newer devices.
++		 * For older devices, a fallback descriptor will be used.
++		 */
++		ret = ipts_control_get_descriptor(ipts);
++		if (ret) {
++			dev_err(ipts->dev, "Failed to fetch HID descriptor: %d\n", ret);
++			return ret;
++		}
++
++		/*
++		 * Newer devices can be directly initialized in doorbell mode.
++		 */
++		ipts->mode = IPTS_MODE_DOORBELL;
++	}
++
++	ret = ipts_control_set_mode(ipts, ipts->mode);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to set mode: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_control_set_mem_window(ipts, &ipts->resources);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to set memory window: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_receiver_start(ipts);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to start receiver: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_control_request_data(ipts);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to request data: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_hid_init(ipts, info);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to initialize HID device: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
 +}
 +
-+int ipts_control_stop(struct ipts_context *ipts)
++static int _ipts_control_stop(struct ipts_context *ipts)
 +{
-+	int ret;
-+
-+	if (ipts->status == IPTS_HOST_STATUS_STOPPING)
-+		return -EBUSY;
++	int ret = 0;
 +
-+	if (ipts->status == IPTS_HOST_STATUS_STOPPED)
-+		return -EBUSY;
++	if (!ipts)
++		return -EFAULT;
 +
 +	dev_info(ipts->dev, "Stopping IPTS\n");
-+	ipts->status = IPTS_HOST_STATUS_STOPPING;
 +
-+	ipts_uapi_unlink();
-+	ipts_resources_free(ipts);
++	ret = ipts_receiver_stop(ipts);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to stop receiver: %d\n", ret);
++		return ret;
++	}
 +
-+	ret = ipts_control_send_feedback(ipts, 0);
-+	if (ret == -ENODEV)
-+		ipts->status = IPTS_HOST_STATUS_STOPPED;
++	ret = ipts_control_reset_sensor(ipts);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to reset sensor: %d\n", ret);
++		return ret;
++	}
 +
-+	return ret;
++	ret = ipts_resources_free(&ipts->resources);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to free resources: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++int ipts_control_stop(struct ipts_context *ipts)
++{
++	int ret = 0;
++
++	ret = _ipts_control_stop(ipts);
++	if (ret)
++		return ret;
++
++	ret = ipts_hid_free(ipts);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to free HID device: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
 +}
 +
 +int ipts_control_restart(struct ipts_context *ipts)
 +{
-+	if (ipts->restart)
-+		return -EBUSY;
++	int ret = 0;
 +
-+	ipts->restart = true;
-+	return ipts_control_stop(ipts);
++	ret = _ipts_control_stop(ipts);
++	if (ret)
++		return ret;
++
++	/*
++	 * Give the sensor some time to come back from resetting
++	 */
++	msleep(1000);
++
++	ret = ipts_control_start(ipts);
++	if (ret)
++		return ret;
++
++	return 0;
 +}
-diff --git a/drivers/misc/ipts/control.h b/drivers/misc/ipts/control.h
+diff --git a/drivers/hid/ipts/control.h b/drivers/hid/ipts/control.h
 new file mode 100644
-index 000000000000..2c44e9e0e99f
+index 0000000000000..744bb92d682a0
 --- /dev/null
-+++ b/drivers/misc/ipts/control.h
-@@ -0,0 +1,24 @@
++++ b/drivers/hid/ipts/control.h
+@@ -0,0 +1,127 @@
 +/* SPDX-License-Identifier: GPL-2.0-or-later */
 +/*
 + * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
++ * Copyright (c) 2020-2023 Dorian Stoll
 + *
 + * Linux driver for Intel Precise Touch & Stylus
 + */
 +
-+#ifndef _IPTS_CONTROL_H_
-+#define _IPTS_CONTROL_H_
++#ifndef IPTS_CONTROL_H
++#define IPTS_CONTROL_H
 +
 +#include <linux/types.h>
 +
 +#include "context.h"
++#include "spec-data.h"
++#include "spec-device.h"
++
++/*
++ * ipts_control_request_flush() - Stop the data flow.
++ * @ipts: The IPTS driver context.
++ *
++ * Runs the command to stop the data flow on the device.
++ * All outstanding data needs to be acknowledged using feedback before the command will return.
++ *
++ * Returns: 0 on success, <0 on error.
++ */
++int ipts_control_request_flush(struct ipts_context *ipts);
 +
-+int ipts_control_send(struct ipts_context *ipts, u32 cmd, void *payload,
-+		      size_t size);
++/*
++ * ipts_control_wait_flush() - Wait until data flow has been stopped.
++ * @ipts: The IPTS driver context.
++ *
++ * Returns: 0 on success, <0 on error.
++ */
++int ipts_control_wait_flush(struct ipts_context *ipts);
++
++/*
++ * ipts_control_wait_flush() - Notify the device that the driver can receive new data.
++ * @ipts: The IPTS driver context.
++ *
++ * Returns: 0 on success, <0 on error.
++ */
++int ipts_control_request_data(struct ipts_context *ipts);
++
++/*
++ * ipts_control_wait_data() - Wait until new data is available.
++ * @ipts: The IPTS driver context.
++ * @block: Whether to block execution until data is available.
++ *
++ * In doorbell mode, this function will never return while the data flow is active. Instead,
++ * the doorbell will be incremented when new data is available.
++ *
++ * Returns: 0 on success, <0 on error, -EAGAIN if no data is available.
++ */
++int ipts_control_wait_data(struct ipts_context *ipts, bool block);
++
++/*
++ * ipts_control_send_feedback() - Submits a feedback buffer to the device.
++ * @ipts: The IPTS driver context.
++ * @buffer: The ID of the buffer containing feedback data.
++ *
++ * Returns: 0 on success, <0 on error.
++ */
 +int ipts_control_send_feedback(struct ipts_context *ipts, u32 buffer);
-+int ipts_control_set_feature(struct ipts_context *ipts, u8 report, u8 value);
++
++/*
++ * ipts_control_hid2me_feedback() - Sends HID2ME feedback, a special type of feedback.
++ * @ipts: The IPTS driver context.
++ * @cmd: The command that will be run on the device.
++ * @type: The type of the payload that is sent to the device.
++ * @data: The payload of the feedback command.
++ * @size: The size of the payload.
++ *
++ * HID2ME feedback is a special type of feedback, because it allows interfacing with
++ * the HID API of the device at any moment, without requiring a buffer that has to
++ * be acknowledged.
++ *
++ * Returns: 0 on success, <0 on error.
++ */
++int ipts_control_hid2me_feedback(struct ipts_context *ipts, enum ipts_feedback_cmd_type cmd,
++				 enum ipts_feedback_data_type type, void *data, size_t size);
++
++/*
++ * ipts_control_refill_buffer() - Acknowledges that data in a buffer has been processed.
++ * @ipts: The IPTS driver context.
++ * @buffer: The buffer that has been processed and can be refilled.
++ *
++ * Returns: 0 on success, <0 on error.
++ */
++static inline int ipts_control_refill_buffer(struct ipts_context *ipts, u32 buffer)
++{
++	/*
++	 * IPTS expects structured data in the feedback buffer matching the buffer that will be
++	 * refilled. We don't know what that data looks like, so we just keep the buffer empty.
++	 * This results in an INVALID_PARAMS error, but the buffer gets refilled without an issue.
++	 * Sending a minimal structure with the buffer ID fixes the error, but breaks refilling
++	 * the buffers on some devices.
++	 */
++
++	return ipts_control_send_feedback(ipts, buffer);
++}
++
++/*
++ * ipts_control_start() - Initialized the device and starts the data flow.
++ * @ipts: The IPTS driver context.
++ *
++ * Returns: 0 on success, <0 on error.
++ */
 +int ipts_control_start(struct ipts_context *ipts);
-+int ipts_control_restart(struct ipts_context *ipts);
++
++/*
++ * ipts_control_stop() - Stops the data flow and resets the device.
++ * @ipts: The IPTS driver context.
++ *
++ * Returns: 0 on success, <0 on error.
++ */
 +int ipts_control_stop(struct ipts_context *ipts);
 +
-+#endif /* _IPTS_CONTROL_H_ */
-diff --git a/drivers/misc/ipts/mei.c b/drivers/misc/ipts/mei.c
++/*
++ * ipts_control_restart() - Stops the device and starts it again.
++ * @ipts: The IPTS driver context.
++ *
++ * Returns: 0 on success, <0 on error.
++ */
++int ipts_control_restart(struct ipts_context *ipts);
++
++#endif /* IPTS_CONTROL_H */
+diff --git a/drivers/hid/ipts/desc.h b/drivers/hid/ipts/desc.h
 new file mode 100644
-index 000000000000..59ecf13e00d2
+index 0000000000000..c058974a03a1e
 --- /dev/null
-+++ b/drivers/misc/ipts/mei.c
-@@ -0,0 +1,125 @@
++++ b/drivers/hid/ipts/desc.h
+@@ -0,0 +1,81 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2022-2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
++ */
++
++#ifndef IPTS_DESC_H
++#define IPTS_DESC_H
++
++#include <linux/types.h>
++
++#define IPTS_HID_REPORT_SINGLETOUCH 64
++#define IPTS_HID_REPORT_DATA	    65
++#define IPTS_HID_REPORT_SET_MODE    66
++
++#define IPTS_HID_REPORT_DATA_SIZE 7485
++
++/*
++ * HID descriptor for singletouch data.
++ * This descriptor should be present on all IPTS devices.
++ */
++static const u8 ipts_singletouch_descriptor[] = {
++	0x05, 0x0D,	  /*  Usage Page (Digitizer),            */
++	0x09, 0x04,	  /*  Usage (Touchscreen),               */
++	0xA1, 0x01,	  /*  Collection (Application),          */
++	0x85, 0x40,	  /*      Report ID (64),                */
++	0x09, 0x42,	  /*      Usage (Tip Switch),            */
++	0x15, 0x00,	  /*      Logical Minimum (0),           */
++	0x25, 0x01,	  /*      Logical Maximum (1),           */
++	0x75, 0x01,	  /*      Report Size (1),               */
++	0x95, 0x01,	  /*      Report Count (1),              */
++	0x81, 0x02,	  /*      Input (Variable),              */
++	0x95, 0x07,	  /*      Report Count (7),              */
++	0x81, 0x03,	  /*      Input (Constant, Variable),    */
++	0x05, 0x01,	  /*      Usage Page (Desktop),          */
++	0x09, 0x30,	  /*      Usage (X),                     */
++	0x75, 0x10,	  /*      Report Size (16),              */
++	0x95, 0x01,	  /*      Report Count (1),              */
++	0xA4,		  /*      Push,                          */
++	0x55, 0x0E,	  /*      Unit Exponent (14),            */
++	0x65, 0x11,	  /*      Unit (Centimeter),             */
++	0x46, 0x76, 0x0B, /*      Physical Maximum (2934),       */
++	0x26, 0xFF, 0x7F, /*      Logical Maximum (32767),       */
++	0x81, 0x02,	  /*      Input (Variable),              */
++	0x09, 0x31,	  /*      Usage (Y),                     */
++	0x46, 0x74, 0x06, /*      Physical Maximum (1652),       */
++	0x26, 0xFF, 0x7F, /*      Logical Maximum (32767),       */
++	0x81, 0x02,	  /*      Input (Variable),              */
++	0xB4,		  /*      Pop,                           */
++	0xC0,		  /*  End Collection                     */
++};
++
++/*
++ * Fallback HID descriptor for older devices that do not have
++ * the ability to query their HID descriptor.
++ */
++static const u8 ipts_fallback_descriptor[] = {
++	0x05, 0x0D,	  /*  Usage Page (Digitizer),            */
++	0x09, 0x0F,	  /*  Usage (Capacitive Hm Digitizer),   */
++	0xA1, 0x01,	  /*  Collection (Application),          */
++	0x85, 0x41,	  /*      Report ID (65),                */
++	0x09, 0x56,	  /*      Usage (Scan Time),             */
++	0x95, 0x01,	  /*      Report Count (1),              */
++	0x75, 0x10,	  /*      Report Size (16),              */
++	0x81, 0x02,	  /*      Input (Variable),              */
++	0x09, 0x61,	  /*      Usage (Gesture Char Quality),  */
++	0x75, 0x08,	  /*      Report Size (8),               */
++	0x96, 0x3D, 0x1D, /*      Report Count (7485),           */
++	0x81, 0x03,	  /*      Input (Constant, Variable),    */
++	0x85, 0x42,	  /*      Report ID (66),                */
++	0x06, 0x00, 0xFF, /*      Usage Page (FF00h),            */
++	0x09, 0xC8,	  /*      Usage (C8h),                   */
++	0x75, 0x08,	  /*      Report Size (8),               */
++	0x95, 0x01,	  /*      Report Count (1),              */
++	0xB1, 0x02,	  /*      Feature (Variable),            */
++	0xC0,		  /*  End Collection,                    */
++};
++
++#endif /* IPTS_DESC_H */
+diff --git a/drivers/hid/ipts/hid.c b/drivers/hid/ipts/hid.c
+new file mode 100644
+index 0000000000000..6782394e8dde3
+--- /dev/null
++++ b/drivers/hid/ipts/hid.c
+@@ -0,0 +1,348 @@
 +// SPDX-License-Identifier: GPL-2.0-or-later
 +/*
 + * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
++ * Copyright (c) 2022-2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
++ */
++
++#include <linux/completion.h>
++#include <linux/gfp.h>
++#include <linux/hid.h>
++#include <linux/mutex.h>
++#include <linux/slab.h>
++#include <linux/types.h>
++
++#include "context.h"
++#include "control.h"
++#include "desc.h"
++#include "hid.h"
++#include "spec-data.h"
++#include "spec-device.h"
++#include "spec-hid.h"
++
++static int ipts_hid_start(struct hid_device *hid)
++{
++	return 0;
++}
++
++static void ipts_hid_stop(struct hid_device *hid)
++{
++}
++
++static int ipts_hid_switch_mode(struct ipts_context *ipts, enum ipts_mode mode)
++{
++	if (!ipts)
++		return -EFAULT;
++
++	if (ipts->mode == mode)
++		return 0;
++
++	/*
++	 * This is only allowed on older devices.
++	 */
++	if (ipts->info.intf_eds > 1)
++		return 0;
++
++	ipts->mode = mode;
++	return ipts_control_restart(ipts);
++}
++
++static int ipts_hid_parse(struct hid_device *hid)
++{
++	int ret = 0;
++	struct ipts_context *ipts = NULL;
++
++	bool has_native_descriptor = false;
++
++	u8 *buffer = NULL;
++	size_t size = 0;
++
++	if (!hid)
++		return -ENODEV;
++
++	ipts = hid->driver_data;
++
++	if (!ipts)
++		return -EFAULT;
++
++	size = sizeof(ipts_singletouch_descriptor);
++	has_native_descriptor = ipts->descriptor.address && ipts->descriptor.size > 0;
++
++	if (has_native_descriptor)
++		size += ipts->descriptor.size;
++	else
++		size += sizeof(ipts_fallback_descriptor);
++
++	buffer = kzalloc(size, GFP_KERNEL);
++	if (!buffer)
++		return -ENOMEM;
++
++	memcpy(buffer, ipts_singletouch_descriptor, sizeof(ipts_singletouch_descriptor));
++
++	if (has_native_descriptor) {
++		memcpy(&buffer[sizeof(ipts_singletouch_descriptor)], ipts->descriptor.address,
++		       ipts->descriptor.size);
++	} else {
++		memcpy(&buffer[sizeof(ipts_singletouch_descriptor)], ipts_fallback_descriptor,
++		       sizeof(ipts_fallback_descriptor));
++	}
++
++	ret = hid_parse_report(hid, buffer, size);
++	kfree(buffer);
++
++	if (ret) {
++		dev_err(ipts->dev, "Failed to parse HID descriptor: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static int ipts_hid_get_feature(struct ipts_context *ipts, unsigned char reportnum, __u8 *buf,
++				size_t size, enum ipts_feedback_data_type type)
++{
++	int ret = 0;
++
++	if (!ipts)
++		return -EFAULT;
++
++	if (!buf)
++		return -EFAULT;
++
++	mutex_lock(&ipts->feature_lock);
++
++	memset(buf, 0, size);
++	buf[0] = reportnum;
++
++	memset(&ipts->feature_report, 0, sizeof(ipts->feature_report));
++	reinit_completion(&ipts->feature_event);
++
++	ret = ipts_control_hid2me_feedback(ipts, IPTS_FEEDBACK_CMD_TYPE_NONE, type, buf, size);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to send hid2me feedback: %d\n", ret);
++		goto out;
++	}
++
++	ret = wait_for_completion_timeout(&ipts->feature_event, msecs_to_jiffies(5000));
++	if (ret == 0) {
++		dev_warn(ipts->dev, "GET_FEATURES timed out!\n");
++		ret = -EIO;
++		goto out;
++	}
++
++	if (!ipts->feature_report.address) {
++		ret = -EFAULT;
++		goto out;
++	}
++
++	if (ipts->feature_report.size > size) {
++		ret = -ETOOSMALL;
++		goto out;
++	}
++
++	ret = ipts->feature_report.size;
++	memcpy(buf, ipts->feature_report.address, ipts->feature_report.size);
++
++out:
++	mutex_unlock(&ipts->feature_lock);
++	return ret;
++}
++
++static int ipts_hid_set_feature(struct ipts_context *ipts, unsigned char reportnum, __u8 *buf,
++				size_t size, enum ipts_feedback_data_type type)
++{
++	int ret = 0;
++
++	if (!ipts)
++		return -EFAULT;
++
++	if (!buf)
++		return -EFAULT;
++
++	buf[0] = reportnum;
++
++	ret = ipts_control_hid2me_feedback(ipts, IPTS_FEEDBACK_CMD_TYPE_NONE, type, buf, size);
++	if (ret)
++		dev_err(ipts->dev, "Failed to send hid2me feedback: %d\n", ret);
++
++	return ret;
++}
++
++static int ipts_hid_raw_request(struct hid_device *hid, unsigned char reportnum, __u8 *buf,
++				size_t size, unsigned char rtype, int reqtype)
++{
++	int ret = 0;
++	struct ipts_context *ipts = NULL;
++
++	enum ipts_feedback_data_type type = IPTS_FEEDBACK_DATA_TYPE_VENDOR;
++
++	if (!hid)
++		return -ENODEV;
++
++	ipts = hid->driver_data;
++
++	if (!ipts)
++		return -EFAULT;
++
++	if (!buf)
++		return -EFAULT;
++
++	if (rtype == HID_OUTPUT_REPORT && reqtype == HID_REQ_SET_REPORT)
++		type = IPTS_FEEDBACK_DATA_TYPE_OUTPUT_REPORT;
++	else if (rtype == HID_FEATURE_REPORT && reqtype == HID_REQ_GET_REPORT)
++		type = IPTS_FEEDBACK_DATA_TYPE_GET_FEATURES;
++	else if (rtype == HID_FEATURE_REPORT && reqtype == HID_REQ_SET_REPORT)
++		type = IPTS_FEEDBACK_DATA_TYPE_SET_FEATURES;
++	else
++		return -EIO;
++
++	// Implemente mode switching report for older devices without native HID support
++	if (type == IPTS_FEEDBACK_DATA_TYPE_SET_FEATURES && reportnum == IPTS_HID_REPORT_SET_MODE) {
++		ret = ipts_hid_switch_mode(ipts, buf[1]);
++		if (ret) {
++			dev_err(ipts->dev, "Failed to switch modes: %d\n", ret);
++			return ret;
++		}
++	}
++
++	if (reqtype == HID_REQ_GET_REPORT)
++		return ipts_hid_get_feature(ipts, reportnum, buf, size, type);
++	else
++		return ipts_hid_set_feature(ipts, reportnum, buf, size, type);
++}
++
++static int ipts_hid_output_report(struct hid_device *hid, __u8 *data, size_t size)
++{
++	struct ipts_context *ipts = NULL;
++
++	if (!hid)
++		return -ENODEV;
++
++	ipts = hid->driver_data;
++
++	return ipts_control_hid2me_feedback(ipts, IPTS_FEEDBACK_CMD_TYPE_NONE,
++					    IPTS_FEEDBACK_DATA_TYPE_OUTPUT_REPORT, data, size);
++}
++
++static struct hid_ll_driver ipts_hid_driver = {
++	.start = ipts_hid_start,
++	.stop = ipts_hid_stop,
++	.open = ipts_hid_start,
++	.close = ipts_hid_stop,
++	.parse = ipts_hid_parse,
++	.raw_request = ipts_hid_raw_request,
++	.output_report = ipts_hid_output_report,
++};
++
++int ipts_hid_input_data(struct ipts_context *ipts, u32 buffer)
++{
++	int ret = 0;
++	u8 *temp = NULL;
++	struct ipts_hid_header *frame = NULL;
++	struct ipts_data_header *header = NULL;
++
++	if (!ipts)
++		return -EFAULT;
++
++	if (!ipts->hid)
++		return -ENODEV;
++
++	header = (struct ipts_data_header *)ipts->resources.data[buffer].address;
++
++	if (!header)
++		return -EFAULT;
++
++	if (header->size == 0)
++		return 0;
++
++	if (header->type == IPTS_DATA_TYPE_HID)
++		return hid_input_report(ipts->hid, HID_INPUT_REPORT, header->data, header->size, 1);
++
++	if (header->type == IPTS_DATA_TYPE_GET_FEATURES) {
++		ipts->feature_report.address = header->data;
++		ipts->feature_report.size = header->size;
++
++		complete_all(&ipts->feature_event);
++		return 0;
++	}
++
++	if (header->type != IPTS_DATA_TYPE_FRAME)
++		return 0;
++
++	if (header->size + 3 + sizeof(struct ipts_hid_header) > IPTS_HID_REPORT_DATA_SIZE)
++		return -ERANGE;
++
++	temp = kzalloc(IPTS_HID_REPORT_DATA_SIZE, GFP_KERNEL);
++	if (!temp)
++		return -ENOMEM;
++
++	/*
++	 * Synthesize a HID report matching the devices that natively send HID reports
++	 */
++	temp[0] = IPTS_HID_REPORT_DATA;
++
++	frame = (struct ipts_hid_header *)&temp[3];
++	frame->type = IPTS_HID_FRAME_TYPE_RAW;
++	frame->size = header->size + sizeof(*frame);
++
++	memcpy(frame->data, header->data, header->size);
++
++	ret = hid_input_report(ipts->hid, HID_INPUT_REPORT, temp, IPTS_HID_REPORT_DATA_SIZE, 1);
++	kfree(temp);
++
++	return ret;
++}
++
++int ipts_hid_init(struct ipts_context *ipts, struct ipts_device_info info)
++{
++	int ret = 0;
++
++	if (!ipts)
++		return -EFAULT;
++
++	if (ipts->hid)
++		return 0;
++
++	ipts->hid = hid_allocate_device();
++	if (IS_ERR(ipts->hid)) {
++		int err = PTR_ERR(ipts->hid);
++
++		dev_err(ipts->dev, "Failed to allocate HID device: %d\n", err);
++		return err;
++	}
++
++	ipts->hid->driver_data = ipts;
++	ipts->hid->dev.parent = ipts->dev;
++	ipts->hid->ll_driver = &ipts_hid_driver;
++
++	ipts->hid->vendor = info.vendor;
++	ipts->hid->product = info.product;
++	ipts->hid->group = HID_GROUP_MULTITOUCH;
++
++	snprintf(ipts->hid->name, sizeof(ipts->hid->name), "IPTS %04X:%04X", info.vendor,
++		 info.product);
++
++	ret = hid_add_device(ipts->hid);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to add HID device: %d\n", ret);
++		ipts_hid_free(ipts);
++		return ret;
++	}
++
++	return 0;
++}
++
++int ipts_hid_free(struct ipts_context *ipts)
++{
++	if (!ipts)
++		return -EFAULT;
++
++	if (!ipts->hid)
++		return 0;
++
++	hid_destroy_device(ipts->hid);
++	ipts->hid = NULL;
++
++	return 0;
++}
+diff --git a/drivers/hid/ipts/hid.h b/drivers/hid/ipts/hid.h
+new file mode 100644
+index 0000000000000..62bf3cd486081
+--- /dev/null
++++ b/drivers/hid/ipts/hid.h
+@@ -0,0 +1,22 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2022-2023 Dorian Stoll
 + *
 + * Linux driver for Intel Precise Touch & Stylus
 + */
 +
++#ifndef IPTS_HID_H
++#define IPTS_HID_H
++
++#include <linux/types.h>
++
++#include "context.h"
++#include "spec-device.h"
++
++int ipts_hid_input_data(struct ipts_context *ipts, u32 buffer);
++
++int ipts_hid_init(struct ipts_context *ipts, struct ipts_device_info info);
++int ipts_hid_free(struct ipts_context *ipts);
++
++#endif /* IPTS_HID_H */
+diff --git a/drivers/hid/ipts/main.c b/drivers/hid/ipts/main.c
+new file mode 100644
+index 0000000000000..0f20c6c08c38c
+--- /dev/null
++++ b/drivers/hid/ipts/main.c
+@@ -0,0 +1,127 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2020-2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
++ */
++
++#include <linux/completion.h>
 +#include <linux/delay.h>
++#include <linux/device.h>
 +#include <linux/dma-mapping.h>
 +#include <linux/mei_cl_bus.h>
 +#include <linux/mod_devicetable.h>
 +#include <linux/module.h>
++#include <linux/mutex.h>
 +#include <linux/slab.h>
++#include <linux/stddef.h>
++#include <linux/types.h>
 +
 +#include "context.h"
 +#include "control.h"
-+#include "protocol.h"
++#include "mei.h"
 +#include "receiver.h"
-+#include "uapi.h"
++#include "spec-device.h"
 +
-+static int ipts_mei_set_dma_mask(struct mei_cl_device *cldev)
++/*
++ * The MEI client ID for IPTS functionality.
++ */
++#define IPTS_ID UUID_LE(0x3e8d0870, 0x271a, 0x4208, 0x8e, 0xb5, 0x9a, 0xcb, 0x94, 0x02, 0xae, 0x04)
++
++static int ipts_set_dma_mask(struct mei_cl_device *cldev)
 +{
-+	int ret;
++	if (!cldev)
++		return -EFAULT;
 +
-+	ret = dma_coerce_mask_and_coherent(&cldev->dev, DMA_BIT_MASK(64));
-+	if (!ret)
++	if (!dma_coerce_mask_and_coherent(&cldev->dev, DMA_BIT_MASK(64)))
 +		return 0;
 +
 +	return dma_coerce_mask_and_coherent(&cldev->dev, DMA_BIT_MASK(32));
 +}
 +
-+static int ipts_mei_probe(struct mei_cl_device *cldev,
-+			  const struct mei_cl_device_id *id)
++static int ipts_probe(struct mei_cl_device *cldev, const struct mei_cl_device_id *id)
 +{
-+	int ret;
-+	struct ipts_context *ipts;
++	int ret = 0;
++	struct ipts_context *ipts = NULL;
 +
-+	if (ipts_mei_set_dma_mask(cldev)) {
-+		dev_err(&cldev->dev, "Failed to set DMA mask for IPTS\n");
++	if (!cldev)
 +		return -EFAULT;
++
++	ret = ipts_set_dma_mask(cldev);
++	if (ret) {
++		dev_err(&cldev->dev, "Failed to set DMA mask for IPTS: %d\n", ret);
++		return ret;
 +	}
 +
 +	ret = mei_cldev_enable(cldev);
@@ -1015,1217 +2240,2810 @@ index 000000000000..59ecf13e00d2
 +		return ret;
 +	}
 +
-+	ipts = kzalloc(sizeof(*ipts), GFP_KERNEL);
++	ipts = devm_kzalloc(&cldev->dev, sizeof(*ipts), GFP_KERNEL);
 +	if (!ipts) {
 +		mei_cldev_disable(cldev);
 +		return -ENOMEM;
 +	}
 +
-+	ipts->cldev = cldev;
++	ret = ipts_mei_init(&ipts->mei, cldev);
++	if (ret) {
++		dev_err(&cldev->dev, "Failed to init MEI bus logic: %d\n", ret);
++		return ret;
++	}
++
 +	ipts->dev = &cldev->dev;
-+	ipts->status = IPTS_HOST_STATUS_STOPPED;
++	ipts->mode = IPTS_MODE_EVENT;
++
++	mutex_init(&ipts->feature_lock);
++	init_completion(&ipts->feature_event);
 +
 +	mei_cldev_set_drvdata(cldev, ipts);
-+	mei_cldev_register_rx_cb(cldev, ipts_receiver_callback);
 +
-+	return ipts_control_start(ipts);
++	ret = ipts_control_start(ipts);
++	if (ret) {
++		dev_err(&cldev->dev, "Failed to start IPTS: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
 +}
 +
-+static void ipts_mei_remove(struct mei_cl_device *cldev)
++static void ipts_remove(struct mei_cl_device *cldev)
 +{
-+	int i;
-+	struct ipts_context *ipts = mei_cldev_get_drvdata(cldev);
++	int ret = 0;
++	struct ipts_context *ipts = NULL;
 +
-+	ipts_control_stop(ipts);
++	if (!cldev) {
++		pr_err("MEI device is NULL!");
++		return;
++	}
 +
-+	for (i = 0; i < 20; i++) {
-+		if (ipts->status == IPTS_HOST_STATUS_STOPPED)
-+			break;
++	ipts = mei_cldev_get_drvdata(cldev);
 +
-+		msleep(25);
-+	}
++	ret = ipts_control_stop(ipts);
++	if (ret)
++		dev_err(&cldev->dev, "Failed to stop IPTS: %d\n", ret);
 +
 +	mei_cldev_disable(cldev);
-+	kfree(ipts);
 +}
 +
-+static struct mei_cl_device_id ipts_mei_device_id_table[] = {
-+	{ "", IPTS_MEI_UUID, MEI_CL_VERSION_ANY },
++static struct mei_cl_device_id ipts_device_id_table[] = {
++	{ .uuid = IPTS_ID, .version = MEI_CL_VERSION_ANY },
 +	{},
 +};
-+MODULE_DEVICE_TABLE(mei, ipts_mei_device_id_table);
++MODULE_DEVICE_TABLE(mei, ipts_device_id_table);
 +
-+static struct mei_cl_driver ipts_mei_driver = {
-+	.id_table = ipts_mei_device_id_table,
++static struct mei_cl_driver ipts_driver = {
++	.id_table = ipts_device_id_table,
 +	.name = "ipts",
-+	.probe = ipts_mei_probe,
-+	.remove = ipts_mei_remove,
++	.probe = ipts_probe,
++	.remove = ipts_remove,
 +};
++module_mei_cl_driver(ipts_driver);
 +
-+static int __init ipts_mei_init(void)
++MODULE_DESCRIPTION("IPTS touchscreen driver");
++MODULE_AUTHOR("Dorian Stoll <dorian.stoll@tmsp.io>");
++MODULE_LICENSE("GPL");
+diff --git a/drivers/hid/ipts/mei.c b/drivers/hid/ipts/mei.c
+new file mode 100644
+index 0000000000000..26666fd99b0c7
+--- /dev/null
++++ b/drivers/hid/ipts/mei.c
+@@ -0,0 +1,189 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
++ */
++
++#include <linux/device.h>
++#include <linux/errno.h>
++#include <linux/jiffies.h>
++#include <linux/list.h>
++#include <linux/mei_cl_bus.h>
++#include <linux/printk.h>
++#include <linux/rwsem.h>
++#include <linux/types.h>
++#include <linux/wait.h>
++
++#include "context.h"
++#include "mei.h"
++
++static void locked_list_add(struct list_head *new, struct list_head *head,
++			    struct rw_semaphore *lock)
 +{
-+	int ret;
++	down_write(lock);
++	list_add(new, head);
++	up_write(lock);
++}
 +
-+	ret = ipts_uapi_init();
-+	if (ret)
-+		return ret;
++static void locked_list_del(struct list_head *entry, struct rw_semaphore *lock)
++{
++	down_write(lock);
++	list_del(entry);
++	up_write(lock);
++}
 +
-+	ret = mei_cldev_driver_register(&ipts_mei_driver);
-+	if (ret) {
-+		ipts_uapi_free();
-+		return ret;
++static void ipts_mei_incoming(struct mei_cl_device *cldev)
++{
++	ssize_t ret = 0;
++	struct ipts_mei_message *entry = NULL;
++	struct ipts_context *ipts = NULL;
++
++	if (!cldev) {
++		pr_err("MEI device is NULL!");
++		return;
 +	}
 +
-+	return 0;
++	ipts = mei_cldev_get_drvdata(cldev);
++	if (!ipts) {
++		pr_err("IPTS driver context is NULL!");
++		return;
++	}
++
++	entry = devm_kzalloc(ipts->dev, sizeof(*entry), GFP_KERNEL);
++	if (!entry)
++		return;
++
++	INIT_LIST_HEAD(&entry->list);
++
++	do {
++		ret = mei_cldev_recv(cldev, (u8 *)&entry->rsp, sizeof(entry->rsp));
++	} while (ret == -EINTR);
++
++	if (ret < 0) {
++		dev_err(ipts->dev, "Error while reading response: %ld\n", ret);
++		return;
++	}
++
++	if (ret == 0) {
++		dev_err(ipts->dev, "Received empty response\n");
++		return;
++	}
++
++	locked_list_add(&entry->list, &ipts->mei.messages, &ipts->mei.message_lock);
++	wake_up_all(&ipts->mei.message_queue);
++}
++
++static int ipts_mei_search(struct ipts_mei *mei, enum ipts_command_code code,
++			   struct ipts_response *rsp)
++{
++	struct ipts_mei_message *entry = NULL;
++
++	if (!mei)
++		return -EFAULT;
++
++	if (!rsp)
++		return -EFAULT;
++
++	down_read(&mei->message_lock);
++
++	/*
++	 * Iterate over the list of received messages, and check if there is one
++	 * matching the requested command code.
++	 */
++	list_for_each_entry(entry, &mei->messages, list) {
++		if (entry->rsp.cmd == code)
++			break;
++	}
++
++	up_read(&mei->message_lock);
++
++	/*
++	 * If entry is not the list head, this means that the loop above has been stopped early,
++	 * and that we found a matching element. We drop the message from the list and return it.
++	 */
++	if (!list_entry_is_head(entry, &mei->messages, list)) {
++		locked_list_del(&entry->list, &mei->message_lock);
++
++		*rsp = entry->rsp;
++		devm_kfree(&mei->cldev->dev, entry);
++
++		return 0;
++	}
++
++	return -EAGAIN;
 +}
 +
-+static void __exit ipts_mei_exit(void)
++int ipts_mei_recv(struct ipts_mei *mei, enum ipts_command_code code, struct ipts_response *rsp,
++		  u64 timeout)
 +{
-+	mei_cldev_driver_unregister(&ipts_mei_driver);
-+	ipts_uapi_free();
++	int ret = 0;
++
++	if (!mei)
++		return -EFAULT;
++
++	/*
++	 * A timeout of 0 means check and return immideately.
++	 */
++	if (timeout == 0)
++		return ipts_mei_search(mei, code, rsp);
++
++	/*
++	 * A timeout of less than 0 means to wait forever.
++	 */
++	if (timeout < 0) {
++		wait_event(mei->message_queue, ipts_mei_search(mei, code, rsp) == 0);
++		return 0;
++	}
++
++	ret = wait_event_timeout(mei->message_queue, ipts_mei_search(mei, code, rsp) == 0,
++				 msecs_to_jiffies(timeout));
++
++	if (ret > 0)
++		return 0;
++
++	return -EAGAIN;
 +}
 +
-+MODULE_DESCRIPTION("IPTS touchscreen driver");
-+MODULE_AUTHOR("Dorian Stoll <dorian.stoll@tmsp.io>");
-+MODULE_LICENSE("GPL");
++int ipts_mei_send(struct ipts_mei *mei, void *data, size_t length)
++{
++	int ret = 0;
 +
-+module_init(ipts_mei_init);
-+module_exit(ipts_mei_exit);
-diff --git a/drivers/misc/ipts/protocol.h b/drivers/misc/ipts/protocol.h
++	if (!mei)
++		return -EFAULT;
++
++	if (!mei->cldev)
++		return -EFAULT;
++
++	if (!data)
++		return -EFAULT;
++
++	do {
++		ret = mei_cldev_send(mei->cldev, (u8 *)data, length);
++	} while (ret == -EINTR);
++
++	if (ret < 0)
++		return ret;
++
++	return 0;
++}
++
++int ipts_mei_init(struct ipts_mei *mei, struct mei_cl_device *cldev)
++{
++	if (!mei)
++		return -EFAULT;
++
++	if (!cldev)
++		return -EFAULT;
++
++	mei->cldev = cldev;
++
++	INIT_LIST_HEAD(&mei->messages);
++	init_waitqueue_head(&mei->message_queue);
++	init_rwsem(&mei->message_lock);
++
++	mei_cldev_register_rx_cb(cldev, ipts_mei_incoming);
++
++	return 0;
++}
+diff --git a/drivers/hid/ipts/mei.h b/drivers/hid/ipts/mei.h
 new file mode 100644
-index 000000000000..c3458904a94d
+index 0000000000000..eadacae54c400
 --- /dev/null
-+++ b/drivers/misc/ipts/protocol.h
-@@ -0,0 +1,347 @@
++++ b/drivers/hid/ipts/mei.h
+@@ -0,0 +1,67 @@
 +/* SPDX-License-Identifier: GPL-2.0-or-later */
 +/*
 + * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
++ * Copyright (c) 2023 Dorian Stoll
 + *
 + * Linux driver for Intel Precise Touch & Stylus
 + */
 +
-+#ifndef _IPTS_PROTOCOL_H_
-+#define _IPTS_PROTOCOL_H_
++#ifndef IPTS_MEI_H
++#define IPTS_MEI_H
 +
++#include <linux/list.h>
++#include <linux/mei_cl_bus.h>
++#include <linux/rwsem.h>
 +#include <linux/types.h>
++#include <linux/wait.h>
++
++#include "spec-device.h"
++
++struct ipts_mei_message {
++	struct list_head list;
++	struct ipts_response rsp;
++};
++
++struct ipts_mei {
++	struct mei_cl_device *cldev;
++
++	struct list_head messages;
++
++	wait_queue_head_t message_queue;
++	struct rw_semaphore message_lock;
++};
 +
 +/*
-+ * The MEI client ID for IPTS functionality.
++ * ipts_mei_recv() - Receive data from a MEI device.
++ * @mei: The IPTS MEI device context.
++ * @code: The IPTS command code to look for.
++ * @rsp: The address that the received data will be copied to.
++ * @timeout: How many milliseconds the function will wait at most.
++ *
++ * A negative timeout means to wait forever.
++ *
++ * Returns: 0 on success, <0 on error, -EAGAIN if no response has been received.
 + */
-+#define IPTS_MEI_UUID                                                          \
-+	UUID_LE(0x3e8d0870, 0x271a, 0x4208, 0x8e, 0xb5, 0x9a, 0xcb, 0x94,      \
-+		0x02, 0xae, 0x04)
++int ipts_mei_recv(struct ipts_mei *mei, enum ipts_command_code code, struct ipts_response *rsp,
++		  u64 timeout);
 +
 +/*
-+ * Queries the device for vendor specific information.
++ * ipts_mei_send() - Send data to a MEI device.
++ * @ipts: The IPTS MEI device context.
++ * @data: The data to send.
++ * @size: The size of the data.
 + *
-+ * The command must not contain any payload.
-+ * The response will contain struct ipts_get_device_info_rsp as payload.
++ * Returns: 0 on success, <0 on error.
 + */
-+#define IPTS_CMD_GET_DEVICE_INFO 0x00000001
-+#define IPTS_RSP_GET_DEVICE_INFO 0x80000001
++int ipts_mei_send(struct ipts_mei *mei, void *data, size_t length);
 +
 +/*
-+ * Sets the mode that IPTS will operate in.
++ * ipts_mei_init() - Initialize the MEI device context.
++ * @mei: The MEI device context to initialize.
++ * @cldev: The MEI device the context will be bound to.
 + *
-+ * The command must contain struct ipts_set_mode_cmd as payload.
-+ * The response will not contain any payload.
++ * Returns: 0 on success, <0 on error.
 + */
-+#define IPTS_CMD_SET_MODE 0x00000002
-+#define IPTS_RSP_SET_MODE 0x80000002
++int ipts_mei_init(struct ipts_mei *mei, struct mei_cl_device *cldev);
++
++#endif /* IPTS_MEI_H */
+diff --git a/drivers/hid/ipts/receiver.c b/drivers/hid/ipts/receiver.c
+new file mode 100644
+index 0000000000000..77234f9e0e178
+--- /dev/null
++++ b/drivers/hid/ipts/receiver.c
+@@ -0,0 +1,249 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2020-2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
++ */
++
++#include <linux/delay.h>
++#include <linux/err.h>
++#include <linux/kthread.h>
++#include <linux/time64.h>
++#include <linux/timekeeping.h>
++#include <linux/types.h>
++
++#include "cmd.h"
++#include "context.h"
++#include "control.h"
++#include "hid.h"
++#include "resources.h"
++#include "spec-device.h"
++#include "thread.h"
++
++static void ipts_receiver_next_doorbell(struct ipts_context *ipts)
++{
++	u32 *doorbell = (u32 *)ipts->resources.doorbell.address;
++	*doorbell = *doorbell + 1;
++}
++
++static u32 ipts_receiver_current_doorbell(struct ipts_context *ipts)
++{
++	u32 *doorbell = (u32 *)ipts->resources.doorbell.address;
++	return *doorbell;
++}
++
++static void ipts_receiver_backoff(time64_t last, u32 n)
++{
++	/*
++	 * If the last change was less than n seconds ago,
++	 * sleep for a shorter period so that new data can be
++	 * processed quickly. If there was no change for more than
++	 * n seconds, sleep longer to avoid wasting CPU cycles.
++	 */
++	if (last + n > ktime_get_seconds())
++		msleep(20);
++	else
++		msleep(200);
++}
++
++static int ipts_receiver_event_loop(struct ipts_thread *thread)
++{
++	int ret = 0;
++	u32 buffer = 0;
++
++	struct ipts_context *ipts = NULL;
++	time64_t last = ktime_get_seconds();
++
++	if (!thread)
++		return -EFAULT;
++
++	ipts = thread->data;
++
++	if (!ipts)
++		return -EFAULT;
++
++	dev_info(ipts->dev, "IPTS running in event mode\n");
++
++	while (!ipts_thread_should_stop(thread)) {
++		for (int i = 0; i < IPTS_BUFFERS; i++) {
++			ret = ipts_control_wait_data(ipts, false);
++			if (ret == -EAGAIN)
++				break;
++
++			if (ret) {
++				dev_err(ipts->dev, "Failed to wait for data: %d\n", ret);
++				continue;
++			}
++
++			buffer = ipts_receiver_current_doorbell(ipts) % IPTS_BUFFERS;
++			ipts_receiver_next_doorbell(ipts);
++
++			ret = ipts_hid_input_data(ipts, buffer);
++			if (ret)
++				dev_err(ipts->dev, "Failed to process buffer: %d\n", ret);
++
++			ret = ipts_control_refill_buffer(ipts, buffer);
++			if (ret)
++				dev_err(ipts->dev, "Failed to send feedback: %d\n", ret);
++
++			ret = ipts_control_request_data(ipts);
++			if (ret)
++				dev_err(ipts->dev, "Failed to request data: %d\n", ret);
++
++			last = ktime_get_seconds();
++		}
++
++		ipts_receiver_backoff(last, 5);
++	}
++
++	ret = ipts_control_request_flush(ipts);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to request flush: %d\n", ret);
++		return ret;
++	}
++
++	ret = ipts_control_wait_data(ipts, true);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to wait for data: %d\n", ret);
++
++		if (ret != -EAGAIN)
++			return ret;
++		else
++			return 0;
++	}
++
++	ret = ipts_control_wait_flush(ipts);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to wait for flush: %d\n", ret);
++
++		if (ret != -EAGAIN)
++			return ret;
++		else
++			return 0;
++	}
++
++	return 0;
++}
++
++static int ipts_receiver_doorbell_loop(struct ipts_thread *thread)
++{
++	int ret = 0;
++	u32 buffer = 0;
++
++	u32 doorbell = 0;
++	u32 lastdb = 0;
++
++	struct ipts_context *ipts = NULL;
++	time64_t last = ktime_get_seconds();
++
++	if (!thread)
++		return -EFAULT;
++
++	ipts = thread->data;
++
++	if (!ipts)
++		return -EFAULT;
++
++	dev_info(ipts->dev, "IPTS running in doorbell mode\n");
++
++	while (true) {
++		if (ipts_thread_should_stop(thread)) {
++			ret = ipts_control_request_flush(ipts);
++			if (ret) {
++				dev_err(ipts->dev, "Failed to request flush: %d\n", ret);
++				return ret;
++			}
++		}
++
++		doorbell = ipts_receiver_current_doorbell(ipts);
++
++		/*
++		 * After filling up one of the data buffers, IPTS will increment
++		 * the doorbell. The value of the doorbell stands for the *next*
++		 * buffer that IPTS is going to fill.
++		 */
++		while (lastdb != doorbell) {
++			buffer = lastdb % IPTS_BUFFERS;
++
++			ret = ipts_hid_input_data(ipts, buffer);
++			if (ret)
++				dev_err(ipts->dev, "Failed to process buffer: %d\n", ret);
++
++			ret = ipts_control_refill_buffer(ipts, buffer);
++			if (ret)
++				dev_err(ipts->dev, "Failed to send feedback: %d\n", ret);
++
++			last = ktime_get_seconds();
++			lastdb++;
++		}
++
++		if (ipts_thread_should_stop(thread))
++			break;
++
++		ipts_receiver_backoff(last, 5);
++	}
++
++	ret = ipts_control_wait_data(ipts, true);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to wait for data: %d\n", ret);
++
++		if (ret != -EAGAIN)
++			return ret;
++		else
++			return 0;
++	}
++
++	ret = ipts_control_wait_flush(ipts);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to wait for flush: %d\n", ret);
++
++		if (ret != -EAGAIN)
++			return ret;
++		else
++			return 0;
++	}
++
++	return 0;
++}
++
++int ipts_receiver_start(struct ipts_context *ipts)
++{
++	int ret = 0;
++
++	if (!ipts)
++		return -EFAULT;
++
++	if (ipts->mode == IPTS_MODE_EVENT) {
++		ret = ipts_thread_start(&ipts->receiver_loop, ipts_receiver_event_loop, ipts,
++					"ipts_event");
++	} else if (ipts->mode == IPTS_MODE_DOORBELL) {
++		ret = ipts_thread_start(&ipts->receiver_loop, ipts_receiver_doorbell_loop, ipts,
++					"ipts_doorbell");
++	} else {
++		ret = -EINVAL;
++	}
++
++	if (ret) {
++		dev_err(ipts->dev, "Failed to start receiver loop: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++int ipts_receiver_stop(struct ipts_context *ipts)
++{
++	int ret = 0;
 +
++	if (!ipts)
++		return -EFAULT;
++
++	ret = ipts_thread_stop(&ipts->receiver_loop);
++	if (ret) {
++		dev_err(ipts->dev, "Failed to stop receiver loop: %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
+diff --git a/drivers/hid/ipts/receiver.h b/drivers/hid/ipts/receiver.h
+new file mode 100644
+index 0000000000000..96070f34fbcaa
+--- /dev/null
++++ b/drivers/hid/ipts/receiver.h
+@@ -0,0 +1,17 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
 +/*
-+ * Configures the memory buffers that the ME will use
-+ * for passing data to the host.
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2020-2023 Dorian Stoll
 + *
-+ * The command must contain struct ipts_set_mem_window_cmd as payload.
-+ * The response will not contain any payload.
++ * Linux driver for Intel Precise Touch & Stylus
 + */
-+#define IPTS_CMD_SET_MEM_WINDOW 0x00000003
-+#define IPTS_RSP_SET_MEM_WINDOW 0x80000003
 +
++#ifndef IPTS_RECEIVER_H
++#define IPTS_RECEIVER_H
++
++#include "context.h"
++
++int ipts_receiver_start(struct ipts_context *ipts);
++int ipts_receiver_stop(struct ipts_context *ipts);
++
++#endif /* IPTS_RECEIVER_H */
+diff --git a/drivers/hid/ipts/resources.c b/drivers/hid/ipts/resources.c
+new file mode 100644
+index 0000000000000..80ba5885bb55d
+--- /dev/null
++++ b/drivers/hid/ipts/resources.c
+@@ -0,0 +1,108 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
 +/*
-+ * Signals that the host is ready to receive data to the ME.
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2020-2023 Dorian Stoll
 + *
-+ * The command must not contain any payload.
-+ * The response will not contain any payload.
++ * Linux driver for Intel Precise Touch & Stylus
 + */
-+#define IPTS_CMD_READY_FOR_DATA 0x00000005
-+#define IPTS_RSP_READY_FOR_DATA 0x80000005
 +
++#include <linux/dma-mapping.h>
++#include <linux/types.h>
++
++#include "resources.h"
++#include "spec-device.h"
++
++static int ipts_resources_alloc_buffer(struct ipts_buffer *buffer, struct device *dev, size_t size)
++{
++	if (!buffer)
++		return -EFAULT;
++
++	if (buffer->address)
++		return 0;
++
++	buffer->address = dma_alloc_coherent(dev, size, &buffer->dma_address, GFP_KERNEL);
++
++	if (!buffer->address)
++		return -ENOMEM;
++
++	buffer->size = size;
++	buffer->device = dev;
++
++	return 0;
++}
++
++static void ipts_resources_free_buffer(struct ipts_buffer *buffer)
++{
++	if (!buffer->address)
++		return;
++
++	dma_free_coherent(buffer->device, buffer->size, buffer->address, buffer->dma_address);
++
++	buffer->address = NULL;
++	buffer->size = 0;
++
++	buffer->dma_address = 0;
++	buffer->device = NULL;
++}
++
++int ipts_resources_init(struct ipts_resources *res, struct device *dev, size_t ds, size_t fs)
++{
++	int ret = 0;
++
++	if (!res)
++		return -EFAULT;
++
++	for (int i = 0; i < IPTS_BUFFERS; i++) {
++		ret = ipts_resources_alloc_buffer(&res->data[i], dev, ds);
++		if (ret)
++			goto err;
++	}
++
++	for (int i = 0; i < IPTS_BUFFERS; i++) {
++		ret = ipts_resources_alloc_buffer(&res->feedback[i], dev, fs);
++		if (ret)
++			goto err;
++	}
++
++	ret = ipts_resources_alloc_buffer(&res->doorbell, dev, sizeof(u32));
++	if (ret)
++		goto err;
++
++	ret = ipts_resources_alloc_buffer(&res->workqueue, dev, sizeof(u32));
++	if (ret)
++		goto err;
++
++	ret = ipts_resources_alloc_buffer(&res->hid2me, dev, fs);
++	if (ret)
++		goto err;
++
++	ret = ipts_resources_alloc_buffer(&res->descriptor, dev, ds + 8);
++	if (ret)
++		goto err;
++
++	return 0;
++
++err:
++
++	ipts_resources_free(res);
++	return ret;
++}
++
++int ipts_resources_free(struct ipts_resources *res)
++{
++	if (!res)
++		return -EFAULT;
++
++	for (int i = 0; i < IPTS_BUFFERS; i++)
++		ipts_resources_free_buffer(&res->data[i]);
++
++	for (int i = 0; i < IPTS_BUFFERS; i++)
++		ipts_resources_free_buffer(&res->feedback[i]);
++
++	ipts_resources_free_buffer(&res->doorbell);
++	ipts_resources_free_buffer(&res->workqueue);
++	ipts_resources_free_buffer(&res->hid2me);
++	ipts_resources_free_buffer(&res->descriptor);
++
++	return 0;
++}
+diff --git a/drivers/hid/ipts/resources.h b/drivers/hid/ipts/resources.h
+new file mode 100644
+index 0000000000000..6cbb24a8a0543
+--- /dev/null
++++ b/drivers/hid/ipts/resources.h
+@@ -0,0 +1,39 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
 +/*
-+ * Signals that a buffer can be refilled to the ME.
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2020-2023 Dorian Stoll
 + *
-+ * The command must contain struct ipts_feedback_cmd as payload.
-+ * The response will not contain any payload.
++ * Linux driver for Intel Precise Touch & Stylus
 + */
-+#define IPTS_CMD_FEEDBACK 0x00000006
-+#define IPTS_RSP_FEEDBACK 0x80000006
 +
++#ifndef IPTS_RESOURCES_H
++#define IPTS_RESOURCES_H
++
++#include <linux/device.h>
++#include <linux/types.h>
++
++#include "spec-device.h"
++
++struct ipts_buffer {
++	u8 *address;
++	size_t size;
++
++	dma_addr_t dma_address;
++	struct device *device;
++};
++
++struct ipts_resources {
++	struct ipts_buffer data[IPTS_BUFFERS];
++	struct ipts_buffer feedback[IPTS_BUFFERS];
++
++	struct ipts_buffer doorbell;
++	struct ipts_buffer workqueue;
++	struct ipts_buffer hid2me;
++
++	struct ipts_buffer descriptor;
++};
++
++int ipts_resources_init(struct ipts_resources *res, struct device *dev, size_t ds, size_t fs);
++int ipts_resources_free(struct ipts_resources *res);
++
++#endif /* IPTS_RESOURCES_H */
+diff --git a/drivers/hid/ipts/spec-data.h b/drivers/hid/ipts/spec-data.h
+new file mode 100644
+index 0000000000000..e8dd98895a7ee
+--- /dev/null
++++ b/drivers/hid/ipts/spec-data.h
+@@ -0,0 +1,100 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
 +/*
-+ * Resets the data flow from the ME to the hosts and
-+ * clears the buffers that were set with SET_MEM_WINDOW.
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2020-2023 Dorian Stoll
 + *
-+ * The command must not contain any payload.
-+ * The response will not contain any payload.
++ * Linux driver for Intel Precise Touch & Stylus
 + */
-+#define IPTS_CMD_CLEAR_MEM_WINDOW 0x00000007
-+#define IPTS_RSP_CLEAR_MEM_WINDOW 0x80000007
 +
++#ifndef IPTS_SPEC_DATA_H
++#define IPTS_SPEC_DATA_H
++
++#include <linux/build_bug.h>
++#include <linux/types.h>
++
++/**
++ * enum ipts_feedback_cmd_type - Commands that can be executed on the sensor through feedback.
++ */
++enum ipts_feedback_cmd_type {
++	IPTS_FEEDBACK_CMD_TYPE_NONE = 0,
++	IPTS_FEEDBACK_CMD_TYPE_SOFT_RESET = 1,
++	IPTS_FEEDBACK_CMD_TYPE_GOTO_ARMED = 2,
++	IPTS_FEEDBACK_CMD_TYPE_GOTO_SENSING = 3,
++	IPTS_FEEDBACK_CMD_TYPE_GOTO_SLEEP = 4,
++	IPTS_FEEDBACK_CMD_TYPE_GOTO_DOZE = 5,
++	IPTS_FEEDBACK_CMD_TYPE_HARD_RESET = 6,
++};
++
++/**
++ * enum ipts_feedback_data_type - Defines what data a feedback buffer contains.
++ * @IPTS_FEEDBACK_DATA_TYPE_VENDOR:        The buffer contains vendor specific feedback.
++ * @IPTS_FEEDBACK_DATA_TYPE_SET_FEATURES:  The buffer contains a HID set features report.
++ * @IPTS_FEEDBACK_DATA_TYPE_GET_FEATURES:  The buffer contains a HID get features report.
++ * @IPTS_FEEDBACK_DATA_TYPE_OUTPUT_REPORT: The buffer contains a HID output report.
++ * @IPTS_FEEDBACK_DATA_TYPE_STORE_DATA:    The buffer contains calibration data for the sensor.
++ */
++enum ipts_feedback_data_type {
++	IPTS_FEEDBACK_DATA_TYPE_VENDOR = 0,
++	IPTS_FEEDBACK_DATA_TYPE_SET_FEATURES = 1,
++	IPTS_FEEDBACK_DATA_TYPE_GET_FEATURES = 2,
++	IPTS_FEEDBACK_DATA_TYPE_OUTPUT_REPORT = 3,
++	IPTS_FEEDBACK_DATA_TYPE_STORE_DATA = 4,
++};
++
++/**
++ * struct ipts_feedback_header - Header that is prefixed to the data in a feedback buffer.
++ * @cmd_type:   A command that should be executed on the sensor.
++ * @size:       The size of the payload to be written.
++ * @buffer:     The ID of the buffer that contains this feedback data.
++ * @protocol:   The protocol version of the EDS.
++ * @data_type:  The type of data that the buffer contains.
++ * @spi_offset: The offset at which to write the payload data to the sensor.
++ * @payload:    Payload for the feedback command, or 0 if no payload is sent.
++ */
++struct ipts_feedback_header {
++	enum ipts_feedback_cmd_type cmd_type;
++	u32 size;
++	u32 buffer;
++	u32 protocol;
++	enum ipts_feedback_data_type data_type;
++	u32 spi_offset;
++	u8 reserved[40];
++	u8 payload[];
++} __packed;
++
++static_assert(sizeof(struct ipts_feedback_header) == 64);
++
++/**
++ * enum ipts_data_type - Defines what type of data a buffer contains.
++ * @IPTS_DATA_TYPE_FRAME:        Raw data frame.
++ * @IPTS_DATA_TYPE_ERROR:        Error data.
++ * @IPTS_DATA_TYPE_VENDOR:       Vendor specific data.
++ * @IPTS_DATA_TYPE_HID:          A HID report.
++ * @IPTS_DATA_TYPE_GET_FEATURES: The response to a GET_FEATURES HID2ME command.
++ */
++enum ipts_data_type {
++	IPTS_DATA_TYPE_FRAME = 0x00,
++	IPTS_DATA_TYPE_ERROR = 0x01,
++	IPTS_DATA_TYPE_VENDOR = 0x02,
++	IPTS_DATA_TYPE_HID = 0x03,
++	IPTS_DATA_TYPE_GET_FEATURES = 0x04,
++	IPTS_DATA_TYPE_DESCRIPTOR = 0x05,
++};
++
++/**
++ * struct ipts_data_header - Header that is prefixed to the data in a data buffer.
++ * @type: What data the buffer contains.
++ * @size: How much data the buffer contains.
++ * @buffer: Which buffer the data is in.
++ */
++struct ipts_data_header {
++	enum ipts_data_type type;
++	u32 size;
++	u32 buffer;
++	u8 reserved[52];
++	u8 data[];
++} __packed;
++
++static_assert(sizeof(struct ipts_data_header) == 64);
++
++#endif /* IPTS_SPEC_DATA_H */
+diff --git a/drivers/hid/ipts/spec-device.h b/drivers/hid/ipts/spec-device.h
+new file mode 100644
+index 0000000000000..93f673d981f7f
+--- /dev/null
++++ b/drivers/hid/ipts/spec-device.h
+@@ -0,0 +1,285 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
 +/*
-+ * Instructs the ME to reset the touch sensor.
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2020-2023 Dorian Stoll
 + *
-+ * The command must contain struct ipts_reset_sensor_cmd as payload.
-+ * The response will not contain any payload.
++ * Linux driver for Intel Precise Touch & Stylus
++ */
++
++#ifndef IPTS_SPEC_DEVICE_H
++#define IPTS_SPEC_DEVICE_H
++
++#include <linux/build_bug.h>
++#include <linux/types.h>
++
++/*
++ * The amount of buffers that IPTS can use for data transfer.
++ */
++#define IPTS_BUFFERS 16
++
++/*
++ * The buffer ID that is used for HID2ME feedback
 + */
-+#define IPTS_CMD_RESET_SENSOR 0x0000000B
-+#define IPTS_RSP_RESET_SENSOR 0x8000000B
++#define IPTS_HID2ME_BUFFER IPTS_BUFFERS
 +
 +/**
-+ * enum ipts_status - Possible status codes returned by IPTS commands.
++ * enum ipts_command - Commands that can be sent to the IPTS hardware.
++ * @IPTS_CMD_GET_DEVICE_INFO:  Retrieves vendor information from the device.
++ * @IPTS_CMD_SET_MODE:         Changes the mode that the device will operate in.
++ * @IPTS_CMD_SET_MEM_WINDOW:   Configures memory buffers for passing data between device and driver.
++ * @IPTS_CMD_QUIESCE_IO:       Stops the data flow from the device to the driver.
++ * @IPTS_CMD_READY_FOR_DATA:   Informs the device that the driver is ready to receive data.
++ * @IPTS_CMD_FEEDBACK:         Informs the device that a buffer was processed and can be refilled.
++ * @IPTS_CMD_CLEAR_MEM_WINDOW: Stops the data flow and clears the buffer addresses on the device.
++ * @IPTS_CMD_RESET_SENSOR:     Resets the sensor to its default state.
++ * @IPTS_CMD_GET_DESCRIPTOR:   Retrieves the HID descriptor of the device.
++ */
++enum ipts_command_code {
++	IPTS_CMD_GET_DEVICE_INFO = 0x01,
++	IPTS_CMD_SET_MODE = 0x02,
++	IPTS_CMD_SET_MEM_WINDOW = 0x03,
++	IPTS_CMD_QUIESCE_IO = 0x04,
++	IPTS_CMD_READY_FOR_DATA = 0x05,
++	IPTS_CMD_FEEDBACK = 0x06,
++	IPTS_CMD_CLEAR_MEM_WINDOW = 0x07,
++	IPTS_CMD_RESET_SENSOR = 0x0B,
++	IPTS_CMD_GET_DESCRIPTOR = 0x0F,
++};
++
++/**
++ * enum ipts_status - Possible status codes returned by the IPTS device.
 + * @IPTS_STATUS_SUCCESS:                 Operation completed successfully.
-+ * @IPTS_STATUS_INVALID_PARAMS:          Command contained a payload with invalid parameters.
-+ * @IPTS_STATUS_ACCESS_DENIED:           ME could not validate buffer addresses supplied by host.
++ * @IPTS_STATUS_INVALID_PARAMS:          Command contained an invalid payload.
++ * @IPTS_STATUS_ACCESS_DENIED:           ME could not validate a buffer address.
 + * @IPTS_STATUS_CMD_SIZE_ERROR:          Command contains an invalid payload.
 + * @IPTS_STATUS_NOT_READY:               Buffer addresses have not been set.
 + * @IPTS_STATUS_REQUEST_OUTSTANDING:     There is an outstanding command of the same type.
-+ *                                       The host must wait for a response before sending another
-+ *                                       command of the same type.
-+ * @IPTS_STATUS_NO_SENSOR_FOUND:         No sensor could be found. Either no sensor is connected, it
-+ *                                       has not been initialized yet, or the system is improperly
-+ *                                       configured.
++ * @IPTS_STATUS_NO_SENSOR_FOUND:         No sensor could be found.
 + * @IPTS_STATUS_OUT_OF_MEMORY:           Not enough free memory for requested operation.
 + * @IPTS_STATUS_INTERNAL_ERROR:          An unexpected error occurred.
 + * @IPTS_STATUS_SENSOR_DISABLED:         The sensor has been disabled and must be reinitialized.
 + * @IPTS_STATUS_COMPAT_CHECK_FAIL:       Compatibility revision check between sensor and ME failed.
 + *                                       The host can ignore this error and attempt to continue.
-+ * @IPTS_STATUS_SENSOR_EXPECTED_RESET:   The sensor went through a reset initiated by ME or host.
++ * @IPTS_STATUS_SENSOR_EXPECTED_RESET:   The sensor went through a reset initiated by the driver.
 + * @IPTS_STATUS_SENSOR_UNEXPECTED_RESET: The sensor went through an unexpected reset.
 + * @IPTS_STATUS_RESET_FAILED:            Requested sensor reset failed to complete.
 + * @IPTS_STATUS_TIMEOUT:                 The operation timed out.
 + * @IPTS_STATUS_TEST_MODE_FAIL:          Test mode pattern did not match expected values.
-+ * @IPTS_STATUS_SENSOR_FAIL_FATAL:       The sensor reported a fatal error during reset sequence.
++ * @IPTS_STATUS_SENSOR_FAIL_FATAL:       The sensor reported an error during reset sequence.
 + *                                       Further progress is not possible.
-+ * @IPTS_STATUS_SENSOR_FAIL_NONFATAL:    The sensor reported a fatal error during reset sequence.
-+ *                                       The host can attempt to continue.
++ * @IPTS_STATUS_SENSOR_FAIL_NONFATAL:    The sensor reported an error during reset sequence.
++ *                                       The driver can attempt to continue.
 + * @IPTS_STATUS_INVALID_DEVICE_CAPS:     The device reported invalid capabilities.
 + * @IPTS_STATUS_QUIESCE_IO_IN_PROGRESS:  Command cannot be completed until Quiesce IO is done.
 + */
 +enum ipts_status {
-+	IPTS_STATUS_SUCCESS = 0,
-+	IPTS_STATUS_INVALID_PARAMS = 1,
-+	IPTS_STATUS_ACCESS_DENIED = 2,
-+	IPTS_STATUS_CMD_SIZE_ERROR = 3,
-+	IPTS_STATUS_NOT_READY = 4,
-+	IPTS_STATUS_REQUEST_OUTSTANDING = 5,
-+	IPTS_STATUS_NO_SENSOR_FOUND = 6,
-+	IPTS_STATUS_OUT_OF_MEMORY = 7,
-+	IPTS_STATUS_INTERNAL_ERROR = 8,
-+	IPTS_STATUS_SENSOR_DISABLED = 9,
-+	IPTS_STATUS_COMPAT_CHECK_FAIL = 10,
-+	IPTS_STATUS_SENSOR_EXPECTED_RESET = 11,
-+	IPTS_STATUS_SENSOR_UNEXPECTED_RESET = 12,
-+	IPTS_STATUS_RESET_FAILED = 13,
-+	IPTS_STATUS_TIMEOUT = 14,
-+	IPTS_STATUS_TEST_MODE_FAIL = 15,
-+	IPTS_STATUS_SENSOR_FAIL_FATAL = 16,
-+	IPTS_STATUS_SENSOR_FAIL_NONFATAL = 17,
-+	IPTS_STATUS_INVALID_DEVICE_CAPS = 18,
-+	IPTS_STATUS_QUIESCE_IO_IN_PROGRESS = 19,
++	IPTS_STATUS_SUCCESS = 0x00,
++	IPTS_STATUS_INVALID_PARAMS = 0x01,
++	IPTS_STATUS_ACCESS_DENIED = 0x02,
++	IPTS_STATUS_CMD_SIZE_ERROR = 0x03,
++	IPTS_STATUS_NOT_READY = 0x04,
++	IPTS_STATUS_REQUEST_OUTSTANDING = 0x05,
++	IPTS_STATUS_NO_SENSOR_FOUND = 0x06,
++	IPTS_STATUS_OUT_OF_MEMORY = 0x07,
++	IPTS_STATUS_INTERNAL_ERROR = 0x08,
++	IPTS_STATUS_SENSOR_DISABLED = 0x09,
++	IPTS_STATUS_COMPAT_CHECK_FAIL = 0x0A,
++	IPTS_STATUS_SENSOR_EXPECTED_RESET = 0x0B,
++	IPTS_STATUS_SENSOR_UNEXPECTED_RESET = 0x0C,
++	IPTS_STATUS_RESET_FAILED = 0x0D,
++	IPTS_STATUS_TIMEOUT = 0x0E,
++	IPTS_STATUS_TEST_MODE_FAIL = 0x0F,
++	IPTS_STATUS_SENSOR_FAIL_FATAL = 0x10,
++	IPTS_STATUS_SENSOR_FAIL_NONFATAL = 0x11,
++	IPTS_STATUS_INVALID_DEVICE_CAPS = 0x12,
++	IPTS_STATUS_QUIESCE_IO_IN_PROGRESS = 0x13,
 +};
 +
-+/*
-+ * The amount of buffers that is used for IPTS
++/**
++ * struct ipts_command - Message that is sent to the device for calling a command.
++ * @cmd:     The command that will be called.
++ * @payload: Payload containing parameters for the called command.
 + */
-+#define IPTS_BUFFERS 16
++struct ipts_command {
++	enum ipts_command_code cmd;
++	u8 payload[320];
++} __packed;
 +
-+/*
-+ * The special buffer ID that is used for direct host2me feedback.
-+ */
-+#define IPTS_HOST2ME_BUFFER IPTS_BUFFERS
++static_assert(sizeof(struct ipts_command) == 324);
 +
 +/**
-+ * enum ipts_mode - Operation mode for IPTS hardware
-+ * @IPTS_MODE_SINGLETOUCH: Fallback that supports only one finger and no stylus.
-+ *                         The data is received as a HID report with ID 64.
-+ * @IPTS_MODE_MULTITOUCH:  The "proper" operation mode for IPTS. It will return
-+ *                         stylus data as well as capacitive heatmap touch data.
-+ *                         This data needs to be processed in userspace.
++ * enum ipts_mode - Configures what data the device produces and how its sent.
++ * @IPTS_MODE_EVENT:    The device will send an event once a buffer was filled.
++ *                      Older devices will return singletouch data in this mode.
++ * @IPTS_MODE_DOORBELL: The device will notify the driver by incrementing the doorbell value.
++ *                      Older devices will return multitouch data in this mode.
 + */
 +enum ipts_mode {
-+	IPTS_MODE_SINGLETOUCH = 0,
-+	IPTS_MODE_MULTITOUCH = 1,
++	IPTS_MODE_EVENT = 0x00,
++	IPTS_MODE_DOORBELL = 0x01,
 +};
 +
 +/**
-+ * struct ipts_set_mode_cmd - Payload for the SET_MODE command.
-+ * @mode: The mode that IPTS should operate in.
++ * struct ipts_set_mode - Payload for the SET_MODE command.
++ * @mode: Changes the mode that IPTS will operate in.
 + */
-+struct ipts_set_mode_cmd {
++struct ipts_set_mode {
 +	enum ipts_mode mode;
 +	u8 reserved[12];
 +} __packed;
 +
++static_assert(sizeof(struct ipts_set_mode) == 16);
++
 +#define IPTS_WORKQUEUE_SIZE	 8192
 +#define IPTS_WORKQUEUE_ITEM_SIZE 16
 +
 +/**
-+ * struct ipts_set_mem_window_cmd - Payload for the SET_MEM_WINDOW command.
-+ * @data_buffer_addr_lower:     Lower 32 bits of the data buffer addresses.
-+ * @data_buffer_addr_upper:     Upper 32 bits of the data buffer addresses.
-+ * @workqueue_addr_lower:       Lower 32 bits of the workqueue buffer address.
-+ * @workqueue_addr_upper:       Upper 32 bits of the workqueue buffer address.
-+ * @doorbell_addr_lower:        Lower 32 bits of the doorbell buffer address.
-+ * @doorbell_addr_upper:        Upper 32 bits of the doorbell buffer address.
-+ * @feedback_buffer_addr_lower: Lower 32 bits of the feedback buffer addresses.
-+ * @feedback_buffer_addr_upper: Upper 32 bits of the feedback buffer addresses.
-+ * @host2me_addr_lower:         Lower 32 bits of the host2me buffer address.
-+ * @host2me_addr_upper:         Upper 32 bits of the host2me buffer address.
-+ * @workqueue_item_size:        Magic value. (IPTS_WORKQUEUE_ITEM_SIZE)
-+ * @workqueue_size:             Magic value. (IPTS_WORKQUEUE_SIZE)
-+ *
-+ * The data buffers are buffers that get filled with touch data by the ME.
-+ * The doorbell buffer is a u32 that gets incremented by the ME once a data
-+ * buffer has been filled with new data.
++ * struct ipts_mem_window - Payload for the SET_MEM_WINDOW command.
++ * @data_addr_lower:      Lower 32 bits of the data buffer addresses.
++ * @data_addr_upper:      Upper 32 bits of the data buffer addresses.
++ * @workqueue_addr_lower: Lower 32 bits of the workqueue buffer address.
++ * @workqueue_addr_upper: Upper 32 bits of the workqueue buffer address.
++ * @doorbell_addr_lower:  Lower 32 bits of the doorbell buffer address.
++ * @doorbell_addr_upper:  Upper 32 bits of the doorbell buffer address.
++ * @feedbackaddr_lower:   Lower 32 bits of the feedback buffer addresses.
++ * @feedbackaddr_upper:   Upper 32 bits of the feedback buffer addresses.
++ * @hid2me_addr_lower:    Lower 32 bits of the hid2me buffer address.
++ * @hid2me_addr_upper:    Upper 32 bits of the hid2me buffer address.
++ * @hid2me_size:          Size of the hid2me feedback buffer.
++ * @workqueue_item_size:  Magic value. Must be 16.
++ * @workqueue_size:       Magic value. Must be 8192.
 + *
-+ * The other buffers are required for using GuC submission with binary
-+ * firmware. Since support for GuC submission has been dropped from i915,
-+ * they are not used anymore, but they need to be allocated and passed,
-+ * otherwise the hardware will refuse to start.
++ * The workqueue related items in this struct are required for using
++ * GuC submission with binary processing firmware. Since this driver does
++ * not use GuC submission and instead exports raw data to userspace, these
++ * items are not actually used, but they need to be allocated and passed
++ * to the device, otherwise initialization will fail.
 + */
-+struct ipts_set_mem_window_cmd {
-+	u32 data_buffer_addr_lower[IPTS_BUFFERS];
-+	u32 data_buffer_addr_upper[IPTS_BUFFERS];
++struct ipts_mem_window {
++	u32 data_addr_lower[IPTS_BUFFERS];
++	u32 data_addr_upper[IPTS_BUFFERS];
 +	u32 workqueue_addr_lower;
 +	u32 workqueue_addr_upper;
 +	u32 doorbell_addr_lower;
 +	u32 doorbell_addr_upper;
-+	u32 feedback_buffer_addr_lower[IPTS_BUFFERS];
-+	u32 feedback_buffer_addr_upper[IPTS_BUFFERS];
-+	u32 host2me_addr_lower;
-+	u32 host2me_addr_upper;
-+	u32 host2me_size;
++	u32 feedback_addr_lower[IPTS_BUFFERS];
++	u32 feedback_addr_upper[IPTS_BUFFERS];
++	u32 hid2me_addr_lower;
++	u32 hid2me_addr_upper;
++	u32 hid2me_size;
 +	u8 reserved1;
 +	u8 workqueue_item_size;
 +	u16 workqueue_size;
 +	u8 reserved[32];
 +} __packed;
 +
++static_assert(sizeof(struct ipts_mem_window) == 320);
++
 +/**
-+ * struct ipts_feedback_cmd - Payload for the FEEDBACK command.
-+ * @buffer: The buffer that the ME should refill.
++ * struct ipts_quiesce_io - Payload for the QUIESCE_IO command.
 + */
-+struct ipts_feedback_cmd {
-+	u32 buffer;
++struct ipts_quiesce_io {
 +	u8 reserved[12];
 +} __packed;
 +
-+/**
-+ * enum ipts_feedback_cmd_type - Commands that can be executed on the sensor through feedback.
-+ */
-+enum ipts_feedback_cmd_type {
-+	IPTS_FEEDBACK_CMD_TYPE_NONE = 0,
-+	IPTS_FEEDBACK_CMD_TYPE_SOFT_RESET = 1,
-+	IPTS_FEEDBACK_CMD_TYPE_GOTO_ARMED = 2,
-+	IPTS_FEEDBACK_CMD_TYPE_GOTO_SENSING = 3,
-+	IPTS_FEEDBACK_CMD_TYPE_GOTO_SLEEP = 4,
-+	IPTS_FEEDBACK_CMD_TYPE_GOTO_DOZE = 5,
-+	IPTS_FEEDBACK_CMD_TYPE_HARD_RESET = 6,
-+};
++static_assert(sizeof(struct ipts_quiesce_io) == 12);
 +
 +/**
-+ * enum ipts_feedback_data_type - Describes the data that a feedback buffer contains.
-+ * @IPTS_FEEDBACK_DATA_TYPE_VENDOR:        The buffer contains vendor specific feedback.
-+ * @IPTS_FEEDBACK_DATA_TYPE_SET_FEATURES:  The buffer contains a HID set features command.
-+ * @IPTS_FEEDBACK_DATA_TYPE_GET_FEATURES:  The buffer contains a HID get features command.
-+ * @IPTS_FEEDBACK_DATA_TYPE_OUTPUT_REPORT: The buffer contains a HID output report.
-+ * @IPTS_FEEDBACK_DATA_TYPE_STORE_DATA:    The buffer contains calibration data for the sensor.
-+ */
-+enum ipts_feedback_data_type {
-+	IPTS_FEEDBACK_DATA_TYPE_VENDOR = 0,
-+	IPTS_FEEDBACK_DATA_TYPE_SET_FEATURES = 1,
-+	IPTS_FEEDBACK_DATA_TYPE_GET_FEATURES = 2,
-+	IPTS_FEEDBACK_DATA_TYPE_OUTPUT_REPORT = 3,
-+	IPTS_FEEDBACK_DATA_TYPE_STORE_DATA = 4,
-+};
-+
-+/**
-+ * struct ipts_feedback_buffer - The contents of an IPTS feedback buffer.
-+ * @cmd_type: A command that should be executed on the sensor.
-+ * @size: The size of the payload to be written.
-+ * @buffer: The ID of the buffer that contains this feedback data.
-+ * @protocol: The protocol version of the EDS.
-+ * @data_type: The type of payload that the buffer contains.
-+ * @spi_offset: The offset at which to write the payload data.
-+ * @payload: Payload for the feedback command, or 0 if no payload is sent.
++ * struct ipts_feedback - Payload for the FEEDBACK command.
++ * @buffer: The buffer that the device should refill.
 + */
-+struct ipts_feedback_buffer {
-+	enum ipts_feedback_cmd_type cmd_type;
-+	u32 size;
++struct ipts_feedback {
 +	u32 buffer;
-+	u32 protocol;
-+	enum ipts_feedback_data_type data_type;
-+	u32 spi_offset;
-+	u8 reserved[40];
-+	u8 payload[];
++	u8 reserved[12];
 +} __packed;
 +
++static_assert(sizeof(struct ipts_feedback) == 16);
++
 +/**
-+ * enum ipts_reset_type - Possible ways of resetting the touch sensor
++ * enum ipts_reset_type - Possible ways of resetting the device.
 + * @IPTS_RESET_TYPE_HARD: Perform hardware reset using GPIO pin.
-+ * @IPTS_RESET_TYPE_SOFT: Perform software reset using SPI interface.
++ * @IPTS_RESET_TYPE_SOFT: Perform software reset using SPI command.
 + */
 +enum ipts_reset_type {
-+	IPTS_RESET_TYPE_HARD = 0,
-+	IPTS_RESET_TYPE_SOFT = 1,
++	IPTS_RESET_TYPE_HARD = 0x00,
++	IPTS_RESET_TYPE_SOFT = 0x01,
 +};
 +
 +/**
-+ * struct ipts_reset_sensor_cmd - Payload for the RESET_SENSOR command.
-+ * @type: What type of reset should be performed.
++ * struct ipts_reset - Payload for the RESET_SENSOR command.
++ * @type: How the device should get reset.
 + */
-+struct ipts_reset_sensor_cmd {
++struct ipts_reset_sensor {
 +	enum ipts_reset_type type;
 +	u8 reserved[4];
 +} __packed;
 +
-+/**
-+ * struct ipts_command - A message sent from the host to the ME.
-+ * @code:    The message code describing the command. (see IPTS_CMD_*)
-+ * @payload: Payload for the command, or 0 if no payload is required.
-+ */
-+struct ipts_command {
-+	u32 code;
-+	u8 payload[320];
-+} __packed;
++static_assert(sizeof(struct ipts_reset_sensor) == 8);
 +
 +/**
-+ * struct ipts_device_info - Payload for the GET_DEVICE_INFO response.
-+ * @vendor_id:     Vendor ID of the touch sensor.
-+ * @device_id:     Device ID of the touch sensor.
-+ * @hw_rev:        Hardware revision of the touch sensor.
-+ * @fw_rev:        Firmware revision of the touch sensor.
-+ * @data_size:     Required size of one data buffer.
-+ * @feedback_size: Required size of one feedback buffer.
-+ * @mode:          Current operation mode of IPTS.
-+ * @max_contacts:  The amount of concurrent touches supported by the sensor.
++ * struct ipts_get_descriptor - Payload for the GET_DESCRIPTOR command.
++ * @addr_lower: The lower 32 bits of the descriptor buffer address.
++ * @addr_upper: The upper 32 bits of the descriptor buffer address.
++ * @magic:      A magic value. Must be 8.
 + */
-+struct ipts_get_device_info_rsp {
-+	u16 vendor_id;
-+	u16 device_id;
-+	u32 hw_rev;
-+	u32 fw_rev;
-+	u32 data_size;
-+	u32 feedback_size;
-+	enum ipts_mode mode;
-+	u8 max_contacts;
-+	u8 reserved[19];
++struct ipts_get_descriptor {
++	u32 addr_lower;
++	u32 addr_upper;
++	u32 magic;
++	u8 reserved[12];
 +} __packed;
 +
-+/**
-+ * struct ipts_feedback_rsp - Payload for the FEEDBACK response.
-+ * @buffer: The buffer that has received feedback.
++static_assert(sizeof(struct ipts_get_descriptor) == 24);
++
++/*
++ * The type of a response is indicated by a
++ * command code, with the most significant bit flipped to 1.
 + */
-+struct ipts_feedback_rsp {
-+	u32 buffer;
-+} __packed;
++#define IPTS_RSP_BIT BIT(31)
 +
 +/**
-+ * struct ipts_response - A message sent from the ME to the host.
-+ * @code:    The message code describing the response. (see IPTS_RSP_*)
-+ * @status:  The status code returned by the command.
-+ * @payload: Payload returned by the command.
++ * struct ipts_response - Data returned from the device in response to a command.
++ * @cmd:     The command that this response answers (IPTS_RSP_BIT will be 1).
++ * @status:  The return code of the command.
++ * @payload: The data that was produced by the command.
 + */
 +struct ipts_response {
-+	u32 code;
++	enum ipts_command_code cmd;
 +	enum ipts_status status;
 +	u8 payload[80];
 +} __packed;
 +
-+#endif /* _IPTS_PROTOCOL_H_ */
-diff --git a/drivers/misc/ipts/receiver.c b/drivers/misc/ipts/receiver.c
++static_assert(sizeof(struct ipts_response) == 88);
++
++/**
++ * struct ipts_device_info - Vendor information of the IPTS device.
++ * @vendor:        Vendor ID of this device.
++ * @product:       Product ID of this device.
++ * @hw_version:    Hardware revision of this device.
++ * @fw_version:    Firmware revision of this device.
++ * @data_size:     Requested size for a data buffer.
++ * @feedback_size: Requested size for a feedback buffer.
++ * @mode:          Mode that the device currently operates in.
++ * @max_contacts:  Maximum amount of concurrent touches the sensor can process.
++ */
++struct ipts_device_info {
++	u16 vendor;
++	u16 product;
++	u32 hw_version;
++	u32 fw_version;
++	u32 data_size;
++	u32 feedback_size;
++	enum ipts_mode mode;
++	u8 max_contacts;
++	u8 reserved1[3];
++	u8 sensor_min_eds;
++	u8 sensor_maj_eds;
++	u8 me_min_eds;
++	u8 me_maj_eds;
++	u8 intf_eds;
++	u8 reserved2[11];
++} __packed;
++
++static_assert(sizeof(struct ipts_device_info) == 44);
++
++#endif /* IPTS_SPEC_DEVICE_H */
+diff --git a/drivers/hid/ipts/spec-hid.h b/drivers/hid/ipts/spec-hid.h
 new file mode 100644
-index 000000000000..23dca13c2139
+index 0000000000000..ea70f29ff00cb
 --- /dev/null
-+++ b/drivers/misc/ipts/receiver.c
-@@ -0,0 +1,224 @@
-+// SPDX-License-Identifier: GPL-2.0-or-later
++++ b/drivers/hid/ipts/spec-hid.h
+@@ -0,0 +1,35 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
 +/*
 + * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
++ * Copyright (c) 2020-2023 Dorian Stoll
 + *
 + * Linux driver for Intel Precise Touch & Stylus
 + */
 +
-+#include <linux/mei_cl_bus.h>
-+#include <linux/moduleparam.h>
++#ifndef IPTS_SPEC_HID_H
++#define IPTS_SPEC_HID_H
++
++#include <linux/build_bug.h>
 +#include <linux/types.h>
 +
-+#include "context.h"
-+#include "control.h"
-+#include "protocol.h"
-+#include "resources.h"
++/*
++ * Made-up type for passing raw IPTS data in a HID report.
++ */
++#define IPTS_HID_FRAME_TYPE_RAW 0xEE
 +
++/**
++ * struct ipts_hid_frame - Header that is prefixed to raw IPTS data wrapped in a HID report.
++ * @size: Size of the data inside the report, including this header.
++ * @type: What type of data does this report contain.
++ */
++struct ipts_hid_header {
++	u32 size;
++	u8 reserved1;
++	u8 type;
++	u8 reserved2;
++	u8 data[];
++} __packed;
++
++static_assert(sizeof(struct ipts_hid_header) == 7);
++
++#endif /* IPTS_SPEC_HID_H */
+diff --git a/drivers/hid/ipts/thread.c b/drivers/hid/ipts/thread.c
+new file mode 100644
+index 0000000000000..8b46f775c1070
+--- /dev/null
++++ b/drivers/hid/ipts/thread.c
+@@ -0,0 +1,85 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
 +/*
-+ * Temporary parameter to guard gen7 multitouch mode.
-+ * Remove once gen7 has stable iptsd support.
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
 + */
-+static bool gen7mt;
-+module_param(gen7mt, bool, 0644);
 +
-+static int ipts_receiver_handle_get_device_info(struct ipts_context *ipts,
-+						struct ipts_response *rsp)
-+{
-+	struct ipts_set_mode_cmd cmd;
++#include <linux/completion.h>
++#include <linux/err.h>
++#include <linux/kthread.h>
++#include <linux/mutex.h>
 +
-+	memcpy(&ipts->device_info, rsp->payload,
-+	       sizeof(struct ipts_get_device_info_rsp));
++#include "thread.h"
 +
-+	memset(&cmd, 0, sizeof(struct ipts_set_mode_cmd));
-+	cmd.mode = IPTS_MODE_MULTITOUCH;
++bool ipts_thread_should_stop(struct ipts_thread *thread)
++{
++	if (!thread)
++		return false;
 +
-+	return ipts_control_send(ipts, IPTS_CMD_SET_MODE, &cmd,
-+				 sizeof(struct ipts_set_mode_cmd));
++	return READ_ONCE(thread->should_stop);
 +}
 +
-+static int ipts_receiver_handle_set_mode(struct ipts_context *ipts)
++static int ipts_thread_runner(void *data)
 +{
-+	int i, ret;
-+	struct ipts_set_mem_window_cmd cmd;
-+
-+	ret = ipts_resources_alloc(ipts);
-+	if (ret) {
-+		dev_err(ipts->dev, "Failed to allocate resources\n");
-+		return ret;
-+	}
++	int ret = 0;
++	struct ipts_thread *thread = data;
 +
-+	memset(&cmd, 0, sizeof(struct ipts_set_mem_window_cmd));
++	if (!thread)
++		return -EFAULT;
 +
-+	for (i = 0; i < IPTS_BUFFERS; i++) {
-+		cmd.data_buffer_addr_lower[i] =
-+			lower_32_bits(ipts->data[i].dma_address);
++	if (!thread->threadfn)
++		return -EFAULT;
 +
-+		cmd.data_buffer_addr_upper[i] =
-+			upper_32_bits(ipts->data[i].dma_address);
++	ret = thread->threadfn(thread);
++	complete_all(&thread->done);
 +
-+		cmd.feedback_buffer_addr_lower[i] =
-+			lower_32_bits(ipts->feedback[i].dma_address);
++	return ret;
++}
 +
-+		cmd.feedback_buffer_addr_upper[i] =
-+			upper_32_bits(ipts->feedback[i].dma_address);
-+	}
++int ipts_thread_start(struct ipts_thread *thread, int (*threadfn)(struct ipts_thread *thread),
++		      void *data, const char *name)
++{
++	if (!thread)
++		return -EFAULT;
 +
-+	cmd.workqueue_addr_lower = lower_32_bits(ipts->workqueue.dma_address);
-+	cmd.workqueue_addr_upper = upper_32_bits(ipts->workqueue.dma_address);
++	if (!threadfn)
++		return -EFAULT;
 +
-+	cmd.doorbell_addr_lower = lower_32_bits(ipts->doorbell.dma_address);
-+	cmd.doorbell_addr_upper = upper_32_bits(ipts->doorbell.dma_address);
++	init_completion(&thread->done);
 +
-+	cmd.host2me_addr_lower = lower_32_bits(ipts->host2me.dma_address);
-+	cmd.host2me_addr_upper = upper_32_bits(ipts->host2me.dma_address);
++	thread->data = data;
++	thread->should_stop = false;
++	thread->threadfn = threadfn;
 +
-+	cmd.workqueue_size = IPTS_WORKQUEUE_SIZE;
-+	cmd.workqueue_item_size = IPTS_WORKQUEUE_ITEM_SIZE;
-+
-+	return ipts_control_send(ipts, IPTS_CMD_SET_MEM_WINDOW, &cmd,
-+				 sizeof(struct ipts_set_mem_window_cmd));
++	thread->thread = kthread_run(ipts_thread_runner, thread, name);
++	return PTR_ERR_OR_ZERO(thread->thread);
 +}
 +
-+static int ipts_receiver_handle_set_mem_window(struct ipts_context *ipts)
++int ipts_thread_stop(struct ipts_thread *thread)
 +{
-+	int ret;
-+
-+	dev_info(ipts->dev, "Device %04hX:%04hX ready\n",
-+		 ipts->device_info.vendor_id, ipts->device_info.device_id);
-+	ipts->status = IPTS_HOST_STATUS_STARTED;
++	int ret = 0;
 +
-+	ret = ipts_control_send(ipts, IPTS_CMD_READY_FOR_DATA, NULL, 0);
-+	if (ret)
-+		return ret;
++	if (!thread)
++		return -EFAULT;
 +
-+	if (!gen7mt)
++	if (!thread->thread)
 +		return 0;
 +
-+	return ipts_control_set_feature(ipts, 0x5, 0x1);
-+}
-+
-+static int ipts_receiver_handle_feedback(struct ipts_context *ipts,
-+					 struct ipts_response *rsp)
-+{
-+	struct ipts_feedback_rsp feedback;
++	WRITE_ONCE(thread->should_stop, true);
 +
-+	if (ipts->status != IPTS_HOST_STATUS_STOPPING)
-+		return 0;
++	/*
++	 * Make sure that the write has gone through before waiting.
++	 */
++	wmb();
 +
-+	memcpy(&feedback, rsp->payload, sizeof(feedback));
++	wait_for_completion(&thread->done);
++	ret = kthread_stop(thread->thread);
 +
-+	if (feedback.buffer < IPTS_BUFFERS - 1)
-+		return ipts_control_send_feedback(ipts, feedback.buffer + 1);
++	thread->thread = NULL;
++	thread->data = NULL;
++	thread->threadfn = NULL;
 +
-+	return ipts_control_send(ipts, IPTS_CMD_CLEAR_MEM_WINDOW, NULL, 0);
++	return ret;
 +}
+diff --git a/drivers/hid/ipts/thread.h b/drivers/hid/ipts/thread.h
+new file mode 100644
+index 0000000000000..a314843599fc3
+--- /dev/null
++++ b/drivers/hid/ipts/thread.h
+@@ -0,0 +1,60 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * Copyright (c) 2016 Intel Corporation
++ * Copyright (c) 2023 Dorian Stoll
++ *
++ * Linux driver for Intel Precise Touch & Stylus
++ */
 +
-+static int ipts_receiver_handle_clear_mem_window(struct ipts_context *ipts)
-+{
-+	ipts->status = IPTS_HOST_STATUS_STOPPED;
++#ifndef IPTS_THREAD_H
++#define IPTS_THREAD_H
 +
-+	if (ipts->restart)
-+		return ipts_control_start(ipts);
++#include <linux/completion.h>
++#include <linux/mutex.h>
++#include <linux/sched.h>
 +
-+	return 0;
-+}
++/*
++ * This wrapper over kthread is necessary, because calling kthread_stop makes it impossible
++ * to issue MEI commands from that thread while it shuts itself down. By using a custom
++ * boolean variable and a completion object, we can call kthread_stop only when the thread
++ * already finished all of its work and has returned.
++ */
++struct ipts_thread {
++	struct task_struct *thread;
 +
-+static bool ipts_receiver_sensor_was_reset(u32 status)
-+{
-+	return status == IPTS_STATUS_SENSOR_EXPECTED_RESET ||
-+	       status == IPTS_STATUS_SENSOR_UNEXPECTED_RESET;
-+}
++	bool should_stop;
++	struct completion done;
 +
-+static bool ipts_receiver_handle_error(struct ipts_context *ipts,
-+				       struct ipts_response *rsp)
-+{
-+	bool error;
++	void *data;
++	int (*threadfn)(struct ipts_thread *thread);
++};
 +
-+	switch (rsp->status) {
-+	case IPTS_STATUS_SUCCESS:
-+	case IPTS_STATUS_COMPAT_CHECK_FAIL:
-+		error = false;
-+		break;
-+	case IPTS_STATUS_INVALID_PARAMS:
-+		error = rsp->code != IPTS_RSP_FEEDBACK;
-+		break;
-+	case IPTS_STATUS_SENSOR_DISABLED:
-+		error = ipts->status != IPTS_HOST_STATUS_STOPPING;
-+		break;
-+	default:
-+		error = true;
-+		break;
++/*
++ * ipts_thread_should_stop() - Returns true if the thread is asked to terminate.
++ * @thread: The current thread.
++ *
++ * Returns: true if the thread should stop, false if not.
++ */
++bool ipts_thread_should_stop(struct ipts_thread *thread);
++
++/*
++ * ipts_thread_start() - Starts an IPTS thread.
++ * @thread: The thread to initialize and start.
++ * @threadfn: The function to execute.
++ * @data: An argument that will be passed to threadfn.
++ * @name: The name of the new thread.
++ *
++ * Returns: 0 on success, <0 on error.
++ */
++int ipts_thread_start(struct ipts_thread *thread, int (*threadfn)(struct ipts_thread *thread),
++		      void *data, const char name[]);
++
++/*
++ * ipts_thread_stop() - Asks the thread to terminate and waits until it has finished.
++ * @thread: The thread that should stop.
++ *
++ * Returns: The return value of the thread function.
++ */
++int ipts_thread_stop(struct ipts_thread *thread);
++
++#endif /* IPTS_THREAD_H */
+-- 
+2.39.2
+
+From 0dbbe2f1542b0926f6524910ca180166ab9bb778 Mon Sep 17 00:00:00 2001
+From: Dorian Stoll <dorian.stoll@tmsp.io>
+Date: Sun, 11 Dec 2022 12:03:38 +0100
+Subject: [PATCH] iommu: intel: Disable source id verification for ITHC
+
+Signed-off-by: Dorian Stoll <dorian.stoll@tmsp.io>
+Patchset: ithc
+---
+ drivers/iommu/intel/irq_remapping.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/iommu/intel/irq_remapping.c b/drivers/iommu/intel/irq_remapping.c
+index 5962bb5027d06..86fa129d10d40 100644
+--- a/drivers/iommu/intel/irq_remapping.c
++++ b/drivers/iommu/intel/irq_remapping.c
+@@ -396,6 +396,22 @@ static int set_msi_sid(struct irte *irte, struct pci_dev *dev)
+ 	data.busmatch_count = 0;
+ 	pci_for_each_dma_alias(dev, set_msi_sid_cb, &data);
+ 
++	/*
++	 * The Intel Touch Host Controller is at 00:10.6, but for some reason
++	 * the MSI interrupts have request id 01:05.0.
++	 * Disable id verification to work around this.
++	 * FIXME Find proper fix or turn this into a quirk.
++	 */
++	if (dev->vendor == PCI_VENDOR_ID_INTEL && (dev->class >> 8) == PCI_CLASS_INPUT_PEN) {
++		switch(dev->device) {
++		case 0x98d0: case 0x98d1: // LKF
++		case 0xa0d0: case 0xa0d1: // TGL LP
++		case 0x43d0: case 0x43d1: // TGL H
++			set_irte_sid(irte, SVT_NO_VERIFY, SQ_ALL_16, 0);
++			return 0;
++		}
 +	}
 +
-+	if (!error)
-+		return false;
+ 	/*
+ 	 * DMA alias provides us with a PCI device and alias.  The only case
+ 	 * where the it will return an alias on a different bus than the
+-- 
+2.39.2
+
+From 5bde25a4abb63731d4a4d42a84725d0043ef0215 Mon Sep 17 00:00:00 2001
+From: Dorian Stoll <dorian.stoll@tmsp.io>
+Date: Sun, 11 Dec 2022 12:10:54 +0100
+Subject: [PATCH] hid: Add support for Intel Touch Host Controller
+
+Based on quo/ithc-linux@55803a2
+
+Signed-off-by: Dorian Stoll <dorian.stoll@tmsp.io>
+Patchset: ithc
+---
+ drivers/hid/Kconfig           |   2 +
+ drivers/hid/Makefile          |   1 +
+ drivers/hid/ithc/Kbuild       |   6 +
+ drivers/hid/ithc/Kconfig      |  12 +
+ drivers/hid/ithc/ithc-debug.c |  96 ++++++
+ drivers/hid/ithc/ithc-dma.c   | 258 ++++++++++++++++
+ drivers/hid/ithc/ithc-dma.h   |  67 +++++
+ drivers/hid/ithc/ithc-main.c  | 534 ++++++++++++++++++++++++++++++++++
+ drivers/hid/ithc/ithc-regs.c  |  64 ++++
+ drivers/hid/ithc/ithc-regs.h  | 186 ++++++++++++
+ drivers/hid/ithc/ithc.h       |  60 ++++
+ 11 files changed, 1286 insertions(+)
+ create mode 100644 drivers/hid/ithc/Kbuild
+ create mode 100644 drivers/hid/ithc/Kconfig
+ create mode 100644 drivers/hid/ithc/ithc-debug.c
+ create mode 100644 drivers/hid/ithc/ithc-dma.c
+ create mode 100644 drivers/hid/ithc/ithc-dma.h
+ create mode 100644 drivers/hid/ithc/ithc-main.c
+ create mode 100644 drivers/hid/ithc/ithc-regs.c
+ create mode 100644 drivers/hid/ithc/ithc-regs.h
+ create mode 100644 drivers/hid/ithc/ithc.h
+
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 1523ccdf73b51..b7030071ac0c0 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -1292,4 +1292,6 @@ source "drivers/hid/surface-hid/Kconfig"
+ 
+ source "drivers/hid/ipts/Kconfig"
+ 
++source "drivers/hid/ithc/Kconfig"
 +
-+	dev_err(ipts->dev, "Command 0x%08x failed: %d\n", rsp->code,
-+		rsp->status);
+ endmenu
+diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
+index e48300bcea9be..8ef7308b0f9d7 100644
+--- a/drivers/hid/Makefile
++++ b/drivers/hid/Makefile
+@@ -166,3 +166,4 @@ obj-$(CONFIG_AMD_SFH_HID)       += amd-sfh-hid/
+ obj-$(CONFIG_SURFACE_HID_CORE)  += surface-hid/
+ 
+ obj-$(CONFIG_HID_IPTS)          += ipts/
++obj-$(CONFIG_HID_ITHC)          += ithc/
+diff --git a/drivers/hid/ithc/Kbuild b/drivers/hid/ithc/Kbuild
+new file mode 100644
+index 0000000000000..aea83f2ac07b4
+--- /dev/null
++++ b/drivers/hid/ithc/Kbuild
+@@ -0,0 +1,6 @@
++obj-$(CONFIG_HID_ITHC) := ithc.o
 +
-+	if (ipts_receiver_sensor_was_reset(rsp->status)) {
-+		dev_err(ipts->dev, "Sensor was reset\n");
++ithc-objs := ithc-main.o ithc-regs.o ithc-dma.o ithc-debug.o
 +
-+		if (ipts_control_restart(ipts))
-+			dev_err(ipts->dev, "Failed to restart IPTS\n");
-+	}
++ccflags-y := -std=gnu11 -Wno-declaration-after-statement
 +
-+	return true;
-+}
+diff --git a/drivers/hid/ithc/Kconfig b/drivers/hid/ithc/Kconfig
+new file mode 100644
+index 0000000000000..ede7130236096
+--- /dev/null
++++ b/drivers/hid/ithc/Kconfig
+@@ -0,0 +1,12 @@
++config HID_ITHC
++	tristate "Intel Touch Host Controller"
++	depends on PCI
++	depends on HID
++	help
++	  Say Y here if your system has a touchscreen using Intels
++	  Touch Host Controller (ITHC / IPTS) technology.
 +
-+static void ipts_receiver_handle_response(struct ipts_context *ipts,
-+					  struct ipts_response *rsp)
-+{
-+	int ret;
++	  If unsure say N.
 +
-+	if (ipts_receiver_handle_error(ipts, rsp))
-+		return;
++	  To compile this driver as a module, choose M here: the
++	  module will be called ithc.
+diff --git a/drivers/hid/ithc/ithc-debug.c b/drivers/hid/ithc/ithc-debug.c
+new file mode 100644
+index 0000000000000..57bf125c45bd5
+--- /dev/null
++++ b/drivers/hid/ithc/ithc-debug.c
+@@ -0,0 +1,96 @@
++#include "ithc.h"
++
++void ithc_log_regs(struct ithc *ithc) {
++	if (!ithc->prev_regs) return;
++	u32 __iomem *cur = (__iomem void*)ithc->regs;
++	u32 *prev = (void*)ithc->prev_regs;
++	for (int i = 1024; i < sizeof *ithc->regs / 4; i++) {
++		u32 x = readl(cur + i);
++		if (x != prev[i]) {
++			pci_info(ithc->pci, "reg %04x: %08x -> %08x\n", i * 4, prev[i], x);
++			prev[i] = x;
++		}
++	}
++}
 +
-+	switch (rsp->code) {
-+	case IPTS_RSP_GET_DEVICE_INFO:
-+		ret = ipts_receiver_handle_get_device_info(ipts, rsp);
++static ssize_t ithc_debugfs_cmd_write(struct file *f, const char __user *buf, size_t len, loff_t *offset) {
++	struct ithc *ithc = file_inode(f)->i_private;
++	char cmd[256];
++	if (!ithc || !ithc->pci) return -ENODEV;
++	if (!len) return -EINVAL;
++	if (len >= sizeof cmd) return -EINVAL;
++	if (copy_from_user(cmd, buf, len)) return -EFAULT;
++	cmd[len] = 0;
++	if (cmd[len-1] == '\n') cmd[len-1] = 0;
++	pci_info(ithc->pci, "debug command: %s\n", cmd);
++	u32 n = 0;
++	const char *s = cmd + 1;
++	u32 a[32];
++	while (*s && *s != '\n') {
++		if (n >= ARRAY_SIZE(a)) return -EINVAL;
++		if (*s++ != ' ') return -EINVAL;
++		char *e;
++		a[n++] = simple_strtoul(s, &e, 0);
++		if (e == s) return -EINVAL;
++		s = e;
++	}
++	ithc_log_regs(ithc);
++	switch(cmd[0]) {
++	case 'x': // reset
++		ithc_reset(ithc);
 +		break;
-+	case IPTS_RSP_SET_MODE:
-+		ret = ipts_receiver_handle_set_mode(ipts);
++	case 'w': // write register: offset mask value
++		if (n != 3 || (a[0] & 3)) return -EINVAL;
++		pci_info(ithc->pci, "debug write 0x%04x = 0x%08x (mask 0x%08x)\n", a[0], a[2], a[1]);
++		bitsl(((__iomem u32 *)ithc->regs) + a[0] / 4, a[1], a[2]);
 +		break;
-+	case IPTS_RSP_SET_MEM_WINDOW:
-+		ret = ipts_receiver_handle_set_mem_window(ipts);
++	case 'r': // read register: offset
++		if (n != 1 || (a[0] & 3)) return -EINVAL;
++		pci_info(ithc->pci, "debug read 0x%04x = 0x%08x\n", a[0], readl(((__iomem u32 *)ithc->regs) + a[0] / 4));
 +		break;
-+	case IPTS_RSP_FEEDBACK:
-+		ret = ipts_receiver_handle_feedback(ipts, rsp);
++	case 's': // spi command: cmd offset len data...
++		// read config: s 4 0 64 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
++		// set touch cfg: s 6 12 4 XX
++		if (n < 3 || a[2] > (n - 3) * 4) return -EINVAL;
++		pci_info(ithc->pci, "debug spi command %u with %u bytes of data\n", a[0], a[2]);
++		if (!CHECK(ithc_spi_command, ithc, a[0], a[1], a[2], a + 3))
++			for (u32 i = 0; i < (a[2] + 3) / 4; i++) pci_info(ithc->pci, "resp %u = 0x%08x\n", i, a[3+i]);
 +		break;
-+	case IPTS_RSP_CLEAR_MEM_WINDOW:
-+		ret = ipts_receiver_handle_clear_mem_window(ipts);
++	case 'd': // dma command: cmd len data...
++		// get report descriptor: d 7 8 0 0
++		// enable multitouch: d 3 2 0x0105
++		if (n < 2 || a[1] > (n - 2) * 4) return -EINVAL;
++		pci_info(ithc->pci, "debug dma command %u with %u bytes of data\n", a[0], a[1]);
++		if (ithc_dma_tx(ithc, a[0], a[1], a + 2)) pci_err(ithc->pci, "dma tx failed\n");
 +		break;
 +	default:
-+		ret = 0;
-+		break;
++		return -EINVAL;
 +	}
-+
-+	if (!ret)
-+		return;
-+
-+	dev_err(ipts->dev, "Error while handling response 0x%08x: %d\n",
-+		rsp->code, ret);
-+
-+	if (ipts_control_stop(ipts))
-+		dev_err(ipts->dev, "Failed to stop IPTS\n");
++	ithc_log_regs(ithc);
++	return len;
 +}
 +
-+void ipts_receiver_callback(struct mei_cl_device *cldev)
-+{
-+	int ret;
-+	struct ipts_response rsp;
-+	struct ipts_context *ipts;
-+
-+	ipts = mei_cldev_get_drvdata(cldev);
-+
-+	ret = mei_cldev_recv(cldev, (u8 *)&rsp, sizeof(struct ipts_response));
-+	if (ret <= 0) {
-+		dev_err(ipts->dev, "Error while reading response: %d\n", ret);
-+		return;
-+	}
++static const struct file_operations ithc_debugfops_cmd = {
++	.owner = THIS_MODULE,
++	.write = ithc_debugfs_cmd_write,
++};
 +
-+	ipts_receiver_handle_response(ipts, &rsp);
++static void ithc_debugfs_devres_release(struct device *dev, void *res) {
++	struct dentry **dbgm = res;
++	if (*dbgm) debugfs_remove_recursive(*dbgm);
 +}
-diff --git a/drivers/misc/ipts/receiver.h b/drivers/misc/ipts/receiver.h
-new file mode 100644
-index 000000000000..7f075afa7ef8
---- /dev/null
-+++ b/drivers/misc/ipts/receiver.h
-@@ -0,0 +1,16 @@
-+/* SPDX-License-Identifier: GPL-2.0-or-later */
-+/*
-+ * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
-+ *
-+ * Linux driver for Intel Precise Touch & Stylus
-+ */
 +
-+#ifndef _IPTS_RECEIVER_H_
-+#define _IPTS_RECEIVER_H_
++int ithc_debug_init(struct ithc *ithc) {
++	struct dentry **dbgm = devres_alloc(ithc_debugfs_devres_release, sizeof *dbgm, GFP_KERNEL);
++	if (!dbgm) return -ENOMEM;
++	devres_add(&ithc->pci->dev, dbgm);
++	struct dentry *dbg = debugfs_create_dir(DEVNAME, NULL);
++	if (IS_ERR(dbg)) return PTR_ERR(dbg);
++	*dbgm = dbg;
 +
-+#include <linux/mei_cl_bus.h>
++	struct dentry *cmd = debugfs_create_file("cmd", 0220, dbg, ithc, &ithc_debugfops_cmd);
++	if (IS_ERR(cmd)) return PTR_ERR(cmd);
 +
-+void ipts_receiver_callback(struct mei_cl_device *cldev);
++	return 0;
++}
 +
-+#endif /* _IPTS_RECEIVER_H_ */
-diff --git a/drivers/misc/ipts/resources.c b/drivers/misc/ipts/resources.c
+diff --git a/drivers/hid/ithc/ithc-dma.c b/drivers/hid/ithc/ithc-dma.c
 new file mode 100644
-index 000000000000..8e3a2409e438
+index 0000000000000..7e89b3496918d
 --- /dev/null
-+++ b/drivers/misc/ipts/resources.c
-@@ -0,0 +1,128 @@
-+// SPDX-License-Identifier: GPL-2.0-or-later
-+/*
-+ * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
-+ *
-+ * Linux driver for Intel Precise Touch & Stylus
-+ */
-+
-+#include <linux/dma-mapping.h>
-+
-+#include "context.h"
++++ b/drivers/hid/ithc/ithc-dma.c
+@@ -0,0 +1,258 @@
++#include "ithc.h"
++
++static int ithc_dma_prd_alloc(struct ithc *ithc, struct ithc_dma_prd_buffer *p, unsigned num_buffers, unsigned num_pages, enum dma_data_direction dir) {
++	p->num_pages = num_pages;
++	p->dir = dir;
++	p->size = round_up(num_buffers * num_pages * sizeof(struct ithc_phys_region_desc), PAGE_SIZE);
++	p->addr = dmam_alloc_coherent(&ithc->pci->dev, p->size, &p->dma_addr, GFP_KERNEL);
++	if (!p->addr) return -ENOMEM;
++	if (p->dma_addr & (PAGE_SIZE - 1)) return -EFAULT;
++	return 0;
++}
 +
-+void ipts_resources_free(struct ipts_context *ipts)
-+{
++struct ithc_sg_table {
++	void *addr;
++	struct sg_table sgt;
++	enum dma_data_direction dir;
++};
++static void ithc_dma_sgtable_free(struct sg_table *sgt) {
++	struct scatterlist *sg;
 +	int i;
-+	struct ipts_buffer_info *buffers;
-+
-+	u32 data_buffer_size = ipts->device_info.data_size;
-+	u32 feedback_buffer_size = ipts->device_info.feedback_size;
++	for_each_sgtable_sg(sgt, sg, i) {
++		struct page *p = sg_page(sg);
++		if (p) __free_page(p);
++	}
++	sg_free_table(sgt);
++}
++static void ithc_dma_data_devres_release(struct device *dev, void *res) {
++	struct ithc_sg_table *sgt = res;
++	if (sgt->addr) vunmap(sgt->addr);
++	dma_unmap_sgtable(dev, &sgt->sgt, sgt->dir, 0);
++	ithc_dma_sgtable_free(&sgt->sgt);
++}
 +
-+	buffers = ipts->data;
-+	for (i = 0; i < IPTS_BUFFERS; i++) {
-+		if (!buffers[i].address)
-+			continue;
++static int ithc_dma_data_alloc(struct ithc* ithc, struct ithc_dma_prd_buffer *prds, struct ithc_dma_data_buffer *b) {
++	// We don't use dma_alloc_coherent for data buffers, because they don't have to be contiguous (we can use one PRD per page) or coherent (they are unidirectional).
++	// Instead we use an sg_table of individually allocated pages (5.13 has dma_alloc_noncontiguous for this, but we'd like to support 5.10 for now).
++	struct page *pages[16];
++	if (prds->num_pages == 0 || prds->num_pages > ARRAY_SIZE(pages)) return -EINVAL;
++	b->active_idx = -1;
++	struct ithc_sg_table *sgt = devres_alloc(ithc_dma_data_devres_release, sizeof *sgt, GFP_KERNEL);
++	if (!sgt) return -ENOMEM;
++	sgt->dir = prds->dir;
++	if (!sg_alloc_table(&sgt->sgt, prds->num_pages, GFP_KERNEL)) {
++		struct scatterlist *sg;
++		int i;
++		bool ok = true;
++		for_each_sgtable_sg(&sgt->sgt, sg, i) {
++			struct page *p = pages[i] = alloc_page(GFP_KERNEL | __GFP_ZERO); // don't need __GFP_DMA for PCI DMA
++			if (!p) { ok = false; break; }
++			sg_set_page(sg, p, PAGE_SIZE, 0);
++		}
++		if (ok && !dma_map_sgtable(&ithc->pci->dev, &sgt->sgt, prds->dir, 0)) {
++			devres_add(&ithc->pci->dev, sgt);
++			b->sgt = &sgt->sgt;
++			b->addr = sgt->addr = vmap(pages, prds->num_pages, 0, PAGE_KERNEL);
++			if (!b->addr) return -ENOMEM;
++			return 0;
++		}
++		ithc_dma_sgtable_free(&sgt->sgt);
++	}
++	devres_free(sgt);
++	return -ENOMEM;
++}
 +
-+		dma_free_coherent(ipts->dev, data_buffer_size,
-+				  buffers[i].address, buffers[i].dma_address);
++static int ithc_dma_data_buffer_put(struct ithc *ithc, struct ithc_dma_prd_buffer *prds, struct ithc_dma_data_buffer *b, unsigned idx) {
++	struct ithc_phys_region_desc *prd = prds->addr;
++	prd += idx * prds->num_pages;
++	if (b->active_idx >= 0) { pci_err(ithc->pci, "buffer already active\n"); return -EINVAL; }
++	b->active_idx = idx;
++	if (prds->dir == DMA_TO_DEVICE) {
++		if (b->data_size > PAGE_SIZE) return -EINVAL;
++		prd->addr = sg_dma_address(b->sgt->sgl) >> 10;
++		prd->size = b->data_size | PRD_FLAG_END;
++		flush_kernel_vmap_range(b->addr, b->data_size);
++	} else if (prds->dir == DMA_FROM_DEVICE) {
++		struct scatterlist *sg;
++		int i;
++		for_each_sgtable_dma_sg(b->sgt, sg, i) {
++			prd->addr = sg_dma_address(sg) >> 10;
++			prd->size = sg_dma_len(sg);
++			prd++;
++		}
++		prd[-1].size |= PRD_FLAG_END;
++	}
++	dma_wmb(); // for the prds
++	dma_sync_sgtable_for_device(&ithc->pci->dev, b->sgt, prds->dir);
++	return 0;
++}
 +
-+		buffers[i].address = NULL;
-+		buffers[i].dma_address = 0;
++static int ithc_dma_data_buffer_get(struct ithc *ithc, struct ithc_dma_prd_buffer *prds, struct ithc_dma_data_buffer *b, unsigned idx) {
++	struct ithc_phys_region_desc *prd = prds->addr;
++	prd += idx * prds->num_pages;
++	if (b->active_idx != idx) { pci_err(ithc->pci, "wrong buffer index\n"); return -EINVAL; }
++	b->active_idx = -1;
++	if (prds->dir == DMA_FROM_DEVICE) {
++		dma_rmb(); // for the prds
++		b->data_size = 0;
++		struct scatterlist *sg;
++		int i;
++		for_each_sgtable_dma_sg(b->sgt, sg, i) {
++			unsigned size = prd->size;
++			b->data_size += size & PRD_SIZE_MASK;
++			if (size & PRD_FLAG_END) break;
++			if ((size & PRD_SIZE_MASK) != sg_dma_len(sg)) { pci_err(ithc->pci, "truncated prd\n"); break; }
++			prd++;
++		}
++		invalidate_kernel_vmap_range(b->addr, b->data_size);
 +	}
++	dma_sync_sgtable_for_cpu(&ithc->pci->dev, b->sgt, prds->dir);
++	return 0;
++}
 +
-+	buffers = ipts->feedback;
-+	for (i = 0; i < IPTS_BUFFERS; i++) {
-+		if (!buffers[i].address)
-+			continue;
++int ithc_dma_rx_init(struct ithc *ithc, u8 channel, const char *devname) {
++	struct ithc_dma_rx *rx = &ithc->dma_rx[channel];
++	mutex_init(&rx->mutex);
++	u32 buf_size = DEVCFG_DMA_RX_SIZE(ithc->config.dma_buf_sizes);
++	unsigned num_pages = (buf_size + PAGE_SIZE - 1) / PAGE_SIZE;
++	pci_dbg(ithc->pci, "allocating rx buffers: num = %u, size = %u, pages = %u\n", NUM_RX_BUF, buf_size, num_pages);
++	CHECK_RET(ithc_dma_prd_alloc, ithc, &rx->prds, NUM_RX_BUF, num_pages, DMA_FROM_DEVICE);
++	for (unsigned i = 0; i < NUM_RX_BUF; i++)
++		CHECK_RET(ithc_dma_data_alloc, ithc, &rx->prds, &rx->bufs[i]);
++	writeb(DMA_RX_CONTROL2_RESET, &ithc->regs->dma_rx[channel].control2);
++	lo_hi_writeq(rx->prds.dma_addr, &ithc->regs->dma_rx[channel].addr);
++	writeb(NUM_RX_BUF - 1, &ithc->regs->dma_rx[channel].num_bufs);
++	writeb(num_pages - 1, &ithc->regs->dma_rx[channel].num_prds);
++	u8 head = readb(&ithc->regs->dma_rx[channel].head);
++	if (head) { pci_err(ithc->pci, "head is nonzero (%u)\n", head); return -EIO; }
++	for (unsigned i = 0; i < NUM_RX_BUF; i++)
++		CHECK_RET(ithc_dma_data_buffer_put, ithc, &rx->prds, &rx->bufs[i], i);
++	writeb(head ^ DMA_RX_WRAP_FLAG, &ithc->regs->dma_rx[channel].tail);
++	return 0;
++}
++void ithc_dma_rx_enable(struct ithc *ithc, u8 channel) {
++	bitsb_set(&ithc->regs->dma_rx[channel].control, DMA_RX_CONTROL_ENABLE | DMA_RX_CONTROL_IRQ_ERROR | DMA_RX_CONTROL_IRQ_DATA);
++	CHECK(waitl, ithc, &ithc->regs->dma_rx[1].status, DMA_RX_STATUS_ENABLED, DMA_RX_STATUS_ENABLED);
++}
 +
-+		dma_free_coherent(ipts->dev, feedback_buffer_size,
-+				  buffers[i].address, buffers[i].dma_address);
++int ithc_dma_tx_init(struct ithc *ithc) {
++	struct ithc_dma_tx *tx = &ithc->dma_tx;
++	mutex_init(&tx->mutex);
++	tx->max_size = DEVCFG_DMA_TX_SIZE(ithc->config.dma_buf_sizes);
++	unsigned num_pages = (tx->max_size + PAGE_SIZE - 1) / PAGE_SIZE;
++	pci_dbg(ithc->pci, "allocating tx buffers: size = %u, pages = %u\n", tx->max_size, num_pages);
++	CHECK_RET(ithc_dma_prd_alloc, ithc, &tx->prds, 1, num_pages, DMA_TO_DEVICE);
++	CHECK_RET(ithc_dma_data_alloc, ithc, &tx->prds, &tx->buf);
++	lo_hi_writeq(tx->prds.dma_addr, &ithc->regs->dma_tx.addr);
++	writeb(num_pages - 1, &ithc->regs->dma_tx.num_prds);
++	CHECK_RET(ithc_dma_data_buffer_put, ithc, &ithc->dma_tx.prds, &ithc->dma_tx.buf, 0);
++	return 0;
++}
 +
-+		buffers[i].address = NULL;
-+		buffers[i].dma_address = 0;
++static int ithc_dma_rx_process_buf(struct ithc *ithc, struct ithc_dma_data_buffer *data, u8 channel, u8 buf) {
++	if (buf >= NUM_RX_BUF) {
++		pci_err(ithc->pci, "invalid dma ringbuffer index\n");
++		return -EINVAL;
 +	}
-+
-+	if (ipts->doorbell.address) {
-+		dma_free_coherent(ipts->dev, sizeof(u32),
-+				  ipts->doorbell.address,
-+				  ipts->doorbell.dma_address);
-+
-+		ipts->doorbell.address = NULL;
-+		ipts->doorbell.dma_address = 0;
++	ithc_set_active(ithc);
++	u32 len = data->data_size;
++	struct ithc_dma_rx_header *hdr = data->addr;
++	u8 *hiddata = (void *)(hdr + 1);
++	if (len >= sizeof *hdr && hdr->code == DMA_RX_CODE_RESET) {
++		CHECK(ithc_reset, ithc);
++	} else if (len < sizeof *hdr || len != sizeof *hdr + hdr->data_size) {
++		if (hdr->code == DMA_RX_CODE_INPUT_REPORT) {
++			// When the CPU enters a low power state during DMA, we can get truncated messages.
++			// Typically this will be a single touch HID report that is only 1 byte, or a multitouch report that is 257 bytes.
++			// See also ithc_set_active().
++		} else {
++			pci_err(ithc->pci, "invalid dma rx data! channel %u, buffer %u, size %u, code %u, data size %u\n", channel, buf, len, hdr->code, hdr->data_size);
++			print_hex_dump_debug(DEVNAME " data: ", DUMP_PREFIX_OFFSET, 32, 1, hdr, min(len, 0x400u), 0);
++		}
++	} else if (hdr->code == DMA_RX_CODE_REPORT_DESCRIPTOR && hdr->data_size > 8) {
++		CHECK(hid_parse_report, ithc->hid, hiddata + 8, hdr->data_size - 8);
++		WRITE_ONCE(ithc->hid_parse_done, true);
++		wake_up(&ithc->wait_hid_parse);
++	} else if (hdr->code == DMA_RX_CODE_INPUT_REPORT) {
++		CHECK(hid_input_report, ithc->hid, HID_INPUT_REPORT, hiddata, hdr->data_size, 1);
++	} else if (hdr->code == DMA_RX_CODE_FEATURE_REPORT) {
++		bool done = false;
++		mutex_lock(&ithc->hid_get_feature_mutex);
++		if (ithc->hid_get_feature_buf) {
++			if (hdr->data_size < ithc->hid_get_feature_size) ithc->hid_get_feature_size = hdr->data_size;
++			memcpy(ithc->hid_get_feature_buf, hiddata, ithc->hid_get_feature_size);
++			ithc->hid_get_feature_buf = NULL;
++			done = true;
++		}
++		mutex_unlock(&ithc->hid_get_feature_mutex);
++		if (done) wake_up(&ithc->wait_hid_get_feature);
++		else CHECK(hid_input_report, ithc->hid, HID_FEATURE_REPORT, hiddata, hdr->data_size, 1);
++	} else {
++		pci_dbg(ithc->pci, "unhandled dma rx data! channel %u, buffer %u, size %u, code %u\n", channel, buf, len, hdr->code);
++		print_hex_dump_debug(DEVNAME " data: ", DUMP_PREFIX_OFFSET, 32, 1, hdr, min(len, 0x400u), 0);
 +	}
++	return 0;
++}
 +
-+	if (ipts->workqueue.address) {
-+		dma_free_coherent(ipts->dev, sizeof(u32),
-+				  ipts->workqueue.address,
-+				  ipts->workqueue.dma_address);
-+
-+		ipts->workqueue.address = NULL;
-+		ipts->workqueue.dma_address = 0;
++static int ithc_dma_rx_unlocked(struct ithc *ithc, u8 channel) {
++	struct ithc_dma_rx *rx = &ithc->dma_rx[channel];
++	unsigned n = rx->num_received;
++	u8 head_wrap = readb(&ithc->regs->dma_rx[channel].head);
++	while (1) {
++		u8 tail = n % NUM_RX_BUF;
++		u8 tail_wrap = tail | ((n / NUM_RX_BUF) & 1 ? 0 : DMA_RX_WRAP_FLAG);
++		writeb(tail_wrap, &ithc->regs->dma_rx[channel].tail);
++		// ringbuffer is full if tail_wrap == head_wrap
++		// ringbuffer is empty if tail_wrap == head_wrap ^ WRAP_FLAG
++		if (tail_wrap == (head_wrap ^ DMA_RX_WRAP_FLAG)) return 0;
++
++		// take the buffer that the device just filled
++		struct ithc_dma_data_buffer *b = &rx->bufs[n % NUM_RX_BUF];
++		CHECK_RET(ithc_dma_data_buffer_get, ithc, &rx->prds, b, tail);
++		rx->num_received = ++n;
++
++		// process data
++		CHECK(ithc_dma_rx_process_buf, ithc, b, channel, tail);
++
++		// give the buffer back to the device
++		CHECK_RET(ithc_dma_data_buffer_put, ithc, &rx->prds, b, tail);
 +	}
++}
++int ithc_dma_rx(struct ithc *ithc, u8 channel) {
++	struct ithc_dma_rx *rx = &ithc->dma_rx[channel];
++	mutex_lock(&rx->mutex);
++	int ret = ithc_dma_rx_unlocked(ithc, channel);
++	mutex_unlock(&rx->mutex);
++	return ret;
++}
 +
-+	if (ipts->host2me.address) {
-+		dma_free_coherent(ipts->dev, feedback_buffer_size,
-+				  ipts->host2me.address,
-+				  ipts->host2me.dma_address);
-+
-+		ipts->host2me.address = NULL;
-+		ipts->host2me.dma_address = 0;
-+	}
++static int ithc_dma_tx_unlocked(struct ithc *ithc, u32 cmdcode, u32 datasize, void *data) {
++	pci_dbg(ithc->pci, "dma tx command %u, size %u\n", cmdcode, datasize);
++	struct ithc_dma_tx_header *hdr;
++	u8 padding = datasize & 3 ? 4 - (datasize & 3) : 0;
++	unsigned fullsize = sizeof *hdr + datasize + padding;
++	if (fullsize > ithc->dma_tx.max_size || fullsize > PAGE_SIZE) return -EINVAL;
++	CHECK_RET(ithc_dma_data_buffer_get, ithc, &ithc->dma_tx.prds, &ithc->dma_tx.buf, 0);
++
++	ithc->dma_tx.buf.data_size = fullsize;
++	hdr = ithc->dma_tx.buf.addr;
++	hdr->code = cmdcode;
++	hdr->data_size = datasize;
++	u8 *dest = (void *)(hdr + 1);
++	memcpy(dest, data, datasize);
++	dest += datasize;
++	for (u8 p = 0; p < padding; p++) *dest++ = 0;
++	CHECK_RET(ithc_dma_data_buffer_put, ithc, &ithc->dma_tx.prds, &ithc->dma_tx.buf, 0);
++
++	bitsb_set(&ithc->regs->dma_tx.control, DMA_TX_CONTROL_SEND);
++	CHECK_RET(waitb, ithc, &ithc->regs->dma_tx.control, DMA_TX_CONTROL_SEND, 0);
++	writel(DMA_TX_STATUS_DONE, &ithc->regs->dma_tx.status);
++	return 0;
++}
++int ithc_dma_tx(struct ithc *ithc, u32 cmdcode, u32 datasize, void *data) {
++	mutex_lock(&ithc->dma_tx.mutex);
++	int ret = ithc_dma_tx_unlocked(ithc, cmdcode, datasize, data);
++	mutex_unlock(&ithc->dma_tx.mutex);
++	return ret;
 +}
 +
-+int ipts_resources_alloc(struct ipts_context *ipts)
-+{
-+	int i;
-+	struct ipts_buffer_info *buffers;
+diff --git a/drivers/hid/ithc/ithc-dma.h b/drivers/hid/ithc/ithc-dma.h
+new file mode 100644
+index 0000000000000..d9f2c19a13f3a
+--- /dev/null
++++ b/drivers/hid/ithc/ithc-dma.h
+@@ -0,0 +1,67 @@
++#define PRD_SIZE_MASK            0xffffff
++#define PRD_FLAG_END             0x1000000
++#define PRD_FLAG_SUCCESS         0x2000000
++#define PRD_FLAG_ERROR           0x4000000
++
++struct ithc_phys_region_desc {
++	u64 addr; // physical addr/1024
++	u32 size; // num bytes, PRD_FLAG_END marks last prd for data split over multiple prds
++	u32 unused;
++};
 +
-+	u32 data_buffer_size = ipts->device_info.data_size;
-+	u32 feedback_buffer_size = ipts->device_info.feedback_size;
++#define DMA_RX_CODE_INPUT_REPORT          3
++#define DMA_RX_CODE_FEATURE_REPORT        4
++#define DMA_RX_CODE_REPORT_DESCRIPTOR     5
++#define DMA_RX_CODE_RESET                 7
 +
-+	buffers = ipts->data;
-+	for (i = 0; i < IPTS_BUFFERS; i++) {
-+		buffers[i].address =
-+			dma_alloc_coherent(ipts->dev, data_buffer_size,
-+					   &buffers[i].dma_address, GFP_KERNEL);
++struct ithc_dma_rx_header {
++	u32 code;
++	u32 data_size;
++	u32 _unknown[14];
++};
 +
-+		if (!buffers[i].address)
-+			goto release_resources;
-+	}
++#define DMA_TX_CODE_SET_FEATURE           3
++#define DMA_TX_CODE_GET_FEATURE           4
++#define DMA_TX_CODE_OUTPUT_REPORT         5
++#define DMA_TX_CODE_GET_REPORT_DESCRIPTOR 7
 +
-+	buffers = ipts->feedback;
-+	for (i = 0; i < IPTS_BUFFERS; i++) {
-+		buffers[i].address =
-+			dma_alloc_coherent(ipts->dev, feedback_buffer_size,
-+					   &buffers[i].dma_address, GFP_KERNEL);
++struct ithc_dma_tx_header {
++	u32 code;
++	u32 data_size;
++};
 +
-+		if (!buffers[i].address)
-+			goto release_resources;
-+	}
++struct ithc_dma_prd_buffer {
++	void *addr;
++	dma_addr_t dma_addr;
++	u32 size;
++	u32 num_pages; // per data buffer
++	enum dma_data_direction dir;
++};
 +
-+	ipts->doorbell.address =
-+		dma_alloc_coherent(ipts->dev, sizeof(u32),
-+				   &ipts->doorbell.dma_address, GFP_KERNEL);
++struct ithc_dma_data_buffer {
++	void *addr;
++	struct sg_table *sgt;
++	int active_idx;
++	u32 data_size;
++};
 +
-+	if (!ipts->doorbell.address)
-+		goto release_resources;
++struct ithc_dma_tx {
++	struct mutex mutex;
++	u32 max_size;
++	struct ithc_dma_prd_buffer prds;
++	struct ithc_dma_data_buffer buf;
++};
 +
-+	ipts->workqueue.address =
-+		dma_alloc_coherent(ipts->dev, sizeof(u32),
-+				   &ipts->workqueue.dma_address, GFP_KERNEL);
++struct ithc_dma_rx {
++	struct mutex mutex;
++	u32 num_received;
++	struct ithc_dma_prd_buffer prds;
++	struct ithc_dma_data_buffer bufs[NUM_RX_BUF];
++};
 +
-+	if (!ipts->workqueue.address)
-+		goto release_resources;
++int ithc_dma_rx_init(struct ithc *ithc, u8 channel, const char *devname);
++void ithc_dma_rx_enable(struct ithc *ithc, u8 channel);
++int ithc_dma_tx_init(struct ithc *ithc);
++int ithc_dma_rx(struct ithc *ithc, u8 channel);
++int ithc_dma_tx(struct ithc *ithc, u32 cmdcode, u32 datasize, void *cmddata);
 +
-+	ipts->host2me.address =
-+		dma_alloc_coherent(ipts->dev, feedback_buffer_size,
-+				   &ipts->host2me.dma_address, GFP_KERNEL);
+diff --git a/drivers/hid/ithc/ithc-main.c b/drivers/hid/ithc/ithc-main.c
+new file mode 100644
+index 0000000000000..09512b9cb4d31
+--- /dev/null
++++ b/drivers/hid/ithc/ithc-main.c
+@@ -0,0 +1,534 @@
++#include "ithc.h"
++
++MODULE_DESCRIPTION("Intel Touch Host Controller driver");
++MODULE_LICENSE("Dual BSD/GPL");
++
++// Lakefield
++#define PCI_DEVICE_ID_INTEL_THC_LKF_PORT1    0x98d0
++#define PCI_DEVICE_ID_INTEL_THC_LKF_PORT2    0x98d1
++// Tiger Lake
++#define PCI_DEVICE_ID_INTEL_THC_TGL_LP_PORT1 0xa0d0
++#define PCI_DEVICE_ID_INTEL_THC_TGL_LP_PORT2 0xa0d1
++#define PCI_DEVICE_ID_INTEL_THC_TGL_H_PORT1  0x43d0
++#define PCI_DEVICE_ID_INTEL_THC_TGL_H_PORT2  0x43d1
++// Alder Lake
++#define PCI_DEVICE_ID_INTEL_THC_ADL_S_PORT1  0x7ad8
++#define PCI_DEVICE_ID_INTEL_THC_ADL_S_PORT2  0x7ad9
++#define PCI_DEVICE_ID_INTEL_THC_ADL_P_PORT1  0x51d0
++#define PCI_DEVICE_ID_INTEL_THC_ADL_P_PORT2  0x51d1
++#define PCI_DEVICE_ID_INTEL_THC_ADL_M_PORT1  0x54d0
++#define PCI_DEVICE_ID_INTEL_THC_ADL_M_PORT2  0x54d1
++// Raptor Lake
++#define PCI_DEVICE_ID_INTEL_THC_RPL_S_PORT1  0x7a58
++#define PCI_DEVICE_ID_INTEL_THC_RPL_S_PORT2  0x7a59
++// Meteor Lake
++#define PCI_DEVICE_ID_INTEL_THC_MTL_PORT1    0x7e48
++#define PCI_DEVICE_ID_INTEL_THC_MTL_PORT2    0x7e4a
++
++static const struct pci_device_id ithc_pci_tbl[] = {
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_LKF_PORT1) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_LKF_PORT2) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_TGL_LP_PORT1) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_TGL_LP_PORT2) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_TGL_H_PORT1) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_TGL_H_PORT2) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_ADL_S_PORT1) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_ADL_S_PORT2) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_ADL_P_PORT1) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_ADL_P_PORT2) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_ADL_M_PORT1) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_ADL_M_PORT2) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_RPL_S_PORT1) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_RPL_S_PORT2) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_MTL_PORT1) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_THC_MTL_PORT2) },
++	{}
++};
++MODULE_DEVICE_TABLE(pci, ithc_pci_tbl);
 +
-+	if (!ipts->workqueue.address)
-+		goto release_resources;
++// Module parameters
 +
-+	return 0;
++static bool ithc_use_polling = false;
++module_param_named(poll, ithc_use_polling, bool, 0);
++MODULE_PARM_DESC(poll, "Use polling instead of interrupts");
 +
-+release_resources:
++static bool ithc_use_rx0 = false;
++module_param_named(rx0, ithc_use_rx0, bool, 0);
++MODULE_PARM_DESC(rx0, "Use DMA RX channel 0");
 +
-+	ipts_resources_free(ipts);
-+	return -ENOMEM;
-+}
-diff --git a/drivers/misc/ipts/resources.h b/drivers/misc/ipts/resources.h
-new file mode 100644
-index 000000000000..fdac0eee9156
---- /dev/null
-+++ b/drivers/misc/ipts/resources.h
-@@ -0,0 +1,17 @@
-+/* SPDX-License-Identifier: GPL-2.0-or-later */
-+/*
-+ * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
-+ *
-+ * Linux driver for Intel Precise Touch & Stylus
-+ */
++static bool ithc_use_rx1 = true;
++module_param_named(rx1, ithc_use_rx1, bool, 0);
++MODULE_PARM_DESC(rx1, "Use DMA RX channel 1");
 +
-+#ifndef _IPTS_RESOURCES_H_
-+#define _IPTS_RESOURCES_H_
++static bool ithc_log_regs_enabled = false;
++module_param_named(logregs, ithc_log_regs_enabled, bool, 0);
++MODULE_PARM_DESC(logregs, "Log changes in register values (for debugging)");
 +
-+#include "context.h"
++// Sysfs attributes
 +
-+int ipts_resources_alloc(struct ipts_context *ipts);
-+void ipts_resources_free(struct ipts_context *ipts);
++static bool ithc_is_config_valid(struct ithc *ithc) {
++	return ithc->config.device_id == DEVCFG_DEVICE_ID_TIC;
++}
 +
-+#endif /* _IPTS_RESOURCES_H_ */
-diff --git a/drivers/misc/ipts/uapi.c b/drivers/misc/ipts/uapi.c
-new file mode 100644
-index 000000000000..598f0710ad64
---- /dev/null
-+++ b/drivers/misc/ipts/uapi.c
-@@ -0,0 +1,208 @@
-+// SPDX-License-Identifier: GPL-2.0-or-later
-+/*
-+ * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
-+ *
-+ * Linux driver for Intel Precise Touch & Stylus
-+ */
++static ssize_t vendor_show(struct device *dev, struct device_attribute *attr, char *buf) {
++	struct ithc *ithc = dev_get_drvdata(dev);
++	if (!ithc || !ithc_is_config_valid(ithc)) return -ENODEV;
++	return sprintf(buf, "0x%04x", ithc->config.vendor_id);
++}
++static DEVICE_ATTR_RO(vendor);
++static ssize_t product_show(struct device *dev, struct device_attribute *attr, char *buf) {
++	struct ithc *ithc = dev_get_drvdata(dev);
++	if (!ithc || !ithc_is_config_valid(ithc)) return -ENODEV;
++	return sprintf(buf, "0x%04x", ithc->config.product_id);
++}
++static DEVICE_ATTR_RO(product);
++static ssize_t revision_show(struct device *dev, struct device_attribute *attr, char *buf) {
++	struct ithc *ithc = dev_get_drvdata(dev);
++	if (!ithc || !ithc_is_config_valid(ithc)) return -ENODEV;
++	return sprintf(buf, "%u", ithc->config.revision);
++}
++static DEVICE_ATTR_RO(revision);
++static ssize_t fw_version_show(struct device *dev, struct device_attribute *attr, char *buf) {
++	struct ithc *ithc = dev_get_drvdata(dev);
++	if (!ithc || !ithc_is_config_valid(ithc)) return -ENODEV;
++	u32 v = ithc->config.fw_version;
++	return sprintf(buf, "%i.%i.%i.%i", v >> 24, v >> 16 & 0xff, v >> 8 & 0xff, v & 0xff);
++}
++static DEVICE_ATTR_RO(fw_version);
++
++static const struct attribute_group *ithc_attribute_groups[] = {
++	&(const struct attribute_group){
++		.name = DEVNAME,
++		.attrs = (struct attribute *[]){
++			&dev_attr_vendor.attr,
++			&dev_attr_product.attr,
++			&dev_attr_revision.attr,
++			&dev_attr_fw_version.attr,
++			NULL
++		},
++	},
++	NULL
++};
 +
-+#include <linux/cdev.h>
-+#include <linux/delay.h>
-+#include <linux/device.h>
-+#include <linux/fs.h>
-+#include <linux/types.h>
-+#include <linux/uaccess.h>
++// HID setup
 +
-+#include "context.h"
-+#include "control.h"
-+#include "protocol.h"
-+#include "uapi.h"
++static int ithc_hid_start(struct hid_device *hdev) { return 0; }
++static void ithc_hid_stop(struct hid_device *hdev) { }
++static int ithc_hid_open(struct hid_device *hdev) { return 0; }
++static void ithc_hid_close(struct hid_device *hdev) { }
 +
-+struct ipts_uapi uapi;
++static int ithc_hid_parse(struct hid_device *hdev) {
++	struct ithc *ithc = hdev->driver_data;
++	u64 val = 0;
++	WRITE_ONCE(ithc->hid_parse_done, false);
++	CHECK_RET(ithc_dma_tx, ithc, DMA_TX_CODE_GET_REPORT_DESCRIPTOR, sizeof val, &val);
++	if (!wait_event_timeout(ithc->wait_hid_parse, READ_ONCE(ithc->hid_parse_done), msecs_to_jiffies(1000))) return -ETIMEDOUT;
++	return 0;
++}
 +
-+static ssize_t ipts_uapi_read(struct file *file, char __user *buf, size_t count,
-+			      loff_t *offset)
-+{
-+	int buffer;
-+	int maxbytes;
-+	struct ipts_context *ipts = uapi.ipts;
++static int ithc_hid_raw_request(struct hid_device *hdev, unsigned char reportnum, __u8 *buf, size_t len, unsigned char rtype, int reqtype) {
++	struct ithc *ithc = hdev->driver_data;
++	if (!buf || !len) return -EINVAL;
++	u32 code;
++	if (rtype == HID_OUTPUT_REPORT && reqtype == HID_REQ_SET_REPORT) code = DMA_TX_CODE_OUTPUT_REPORT;
++	else if (rtype == HID_FEATURE_REPORT && reqtype == HID_REQ_SET_REPORT) code = DMA_TX_CODE_SET_FEATURE;
++	else if (rtype == HID_FEATURE_REPORT && reqtype == HID_REQ_GET_REPORT) code = DMA_TX_CODE_GET_FEATURE;
++	else {
++		pci_err(ithc->pci, "unhandled hid request %i %i for report id %i\n", rtype, reqtype, reportnum);
++		return -EINVAL;
++	}
++	buf[0] = reportnum;
++	if (reqtype == HID_REQ_GET_REPORT) {
++		mutex_lock(&ithc->hid_get_feature_mutex);
++		ithc->hid_get_feature_buf = buf;
++		ithc->hid_get_feature_size = len;
++		mutex_unlock(&ithc->hid_get_feature_mutex);
++		int r = CHECK(ithc_dma_tx, ithc, code, 1, buf);
++		if (!r) {
++			r = wait_event_interruptible_timeout(ithc->wait_hid_get_feature, !ithc->hid_get_feature_buf, msecs_to_jiffies(1000));
++			if (!r) r = -ETIMEDOUT;
++			else if (r < 0) r = -EINTR;
++			else r = 0;
++		}
++		mutex_lock(&ithc->hid_get_feature_mutex);
++		ithc->hid_get_feature_buf = NULL;
++		if (!r) r = ithc->hid_get_feature_size;
++		mutex_unlock(&ithc->hid_get_feature_mutex);
++		return r;
++	}
++	CHECK_RET(ithc_dma_tx, ithc, code, len, buf);
++	return 0;
++}
 +
-+	buffer = MINOR(file->f_path.dentry->d_inode->i_rdev);
++static struct hid_ll_driver ithc_ll_driver = {
++	.start = ithc_hid_start,
++	.stop = ithc_hid_stop,
++	.open = ithc_hid_open,
++	.close = ithc_hid_close,
++	.parse = ithc_hid_parse,
++	.raw_request = ithc_hid_raw_request,
++};
 +
-+	if (!ipts || ipts->status != IPTS_HOST_STATUS_STARTED)
-+		return -ENODEV;
++static void ithc_hid_devres_release(struct device *dev, void *res) {
++	struct hid_device **hidm = res;
++	if (*hidm) hid_destroy_device(*hidm);
++}
 +
-+	maxbytes = ipts->device_info.data_size - *offset;
-+	if (maxbytes <= 0 || count > maxbytes)
-+		return -EINVAL;
++static int ithc_hid_init(struct ithc *ithc) {
++	struct hid_device **hidm = devres_alloc(ithc_hid_devres_release, sizeof *hidm, GFP_KERNEL);
++	if (!hidm) return -ENOMEM;
++	devres_add(&ithc->pci->dev, hidm);
++	struct hid_device *hid = hid_allocate_device();
++	if (IS_ERR(hid)) return PTR_ERR(hid);
++	*hidm = hid;
++
++	strscpy(hid->name, DEVFULLNAME, sizeof(hid->name));
++	strscpy(hid->phys, ithc->phys, sizeof(hid->phys));
++	hid->ll_driver = &ithc_ll_driver;
++	hid->bus = BUS_PCI;
++	hid->vendor = ithc->config.vendor_id;
++	hid->product = ithc->config.product_id;
++	hid->version = 0x100;
++	hid->dev.parent = &ithc->pci->dev;
++	hid->driver_data = ithc;
++
++	ithc->hid = hid;
++	return 0;
++}
 +
-+	if (copy_to_user(buf, ipts->data[buffer].address + *offset, count))
-+		return -EFAULT;
++// Interrupts/polling
 +
-+	return count;
++static void ithc_activity_timer_callback(struct timer_list *t) {
++	struct ithc *ithc = container_of(t, struct ithc, activity_timer);
++	cpu_latency_qos_update_request(&ithc->activity_qos, PM_QOS_DEFAULT_VALUE);
 +}
 +
-+static long ipts_uapi_ioctl_get_device_ready(struct ipts_context *ipts,
-+					     unsigned long arg)
-+{
-+	void __user *buffer = (void __user *)arg;
-+	u8 ready = 0;
++void ithc_set_active(struct ithc *ithc) {
++	// When CPU usage is very low, the CPU can enter various low power states (C2-C10).
++	// This disrupts DMA, causing truncated DMA messages. ERROR_FLAG_DMA_UNKNOWN_12 will be set when this happens.
++	// The amount of truncated messages can become very high, resulting in user-visible effects (laggy/stuttering cursor).
++	// To avoid this, we use a CPU latency QoS request to prevent the CPU from entering low power states during touch interactions.
++	cpu_latency_qos_update_request(&ithc->activity_qos, 0);
++	mod_timer(&ithc->activity_timer, jiffies + msecs_to_jiffies(1000));
++}
 +
-+	if (ipts)
-+		ready = ipts->status == IPTS_HOST_STATUS_STARTED;
++static int ithc_set_device_enabled(struct ithc *ithc, bool enable) {
++	u32 x = ithc->config.touch_cfg = (ithc->config.touch_cfg & ~(u32)DEVCFG_TOUCH_MASK) | DEVCFG_TOUCH_UNKNOWN_2
++		| (enable ? DEVCFG_TOUCH_ENABLE | DEVCFG_TOUCH_UNKNOWN_3 | DEVCFG_TOUCH_UNKNOWN_4 : 0);
++	return ithc_spi_command(ithc, SPI_CMD_CODE_WRITE, offsetof(struct ithc_device_config, touch_cfg), sizeof x, &x);
++}
 +
-+	if (copy_to_user(buffer, &ready, sizeof(u8)))
-+		return -EFAULT;
++static void ithc_disable_interrupts(struct ithc *ithc) {
++	writel(0, &ithc->regs->error_control);
++	bitsb(&ithc->regs->spi_cmd.control, SPI_CMD_CONTROL_IRQ, 0);
++	bitsb(&ithc->regs->dma_rx[0].control, DMA_RX_CONTROL_IRQ_UNKNOWN_1 | DMA_RX_CONTROL_IRQ_ERROR | DMA_RX_CONTROL_IRQ_UNKNOWN_4 | DMA_RX_CONTROL_IRQ_DATA, 0);
++	bitsb(&ithc->regs->dma_rx[1].control, DMA_RX_CONTROL_IRQ_UNKNOWN_1 | DMA_RX_CONTROL_IRQ_ERROR | DMA_RX_CONTROL_IRQ_UNKNOWN_4 | DMA_RX_CONTROL_IRQ_DATA, 0);
++	bitsb(&ithc->regs->dma_tx.control, DMA_TX_CONTROL_IRQ, 0);
++}
 +
-+	return 0;
++static void ithc_clear_dma_rx_interrupts(struct ithc *ithc, unsigned channel) {
++	writel(DMA_RX_STATUS_ERROR | DMA_RX_STATUS_UNKNOWN_4 | DMA_RX_STATUS_HAVE_DATA, &ithc->regs->dma_rx[channel].status);
 +}
 +
-+static long ipts_uapi_ioctl_get_device_info(struct ipts_context *ipts,
-+					    unsigned long arg)
-+{
-+	struct ipts_device_info info;
-+	void __user *buffer = (void __user *)arg;
++static void ithc_clear_interrupts(struct ithc *ithc) {
++	writel(0xffffffff, &ithc->regs->error_flags);
++	writel(ERROR_STATUS_DMA | ERROR_STATUS_SPI, &ithc->regs->error_status);
++	writel(SPI_CMD_STATUS_DONE | SPI_CMD_STATUS_ERROR, &ithc->regs->spi_cmd.status);
++	ithc_clear_dma_rx_interrupts(ithc, 0);
++	ithc_clear_dma_rx_interrupts(ithc, 1);
++	writel(DMA_TX_STATUS_DONE | DMA_TX_STATUS_ERROR | DMA_TX_STATUS_UNKNOWN_2, &ithc->regs->dma_tx.status);
++}
 +
-+	if (!ipts || ipts->status != IPTS_HOST_STATUS_STARTED)
-+		return -ENODEV;
++static void ithc_process(struct ithc *ithc) {
++	ithc_log_regs(ithc);
 +
-+	info.vendor = ipts->device_info.vendor_id;
-+	info.product = ipts->device_info.device_id;
-+	info.version = ipts->device_info.fw_rev;
-+	info.buffer_size = ipts->device_info.data_size;
-+	info.max_contacts = ipts->device_info.max_contacts;
++	// read and clear error bits
++	u32 err = readl(&ithc->regs->error_flags);
++	if (err) {
++		if (err & ~ERROR_FLAG_DMA_UNKNOWN_12) pci_err(ithc->pci, "error flags: 0x%08x\n", err);
++		writel(err, &ithc->regs->error_flags);
++	}
 +
-+	if (copy_to_user(buffer, &info, sizeof(struct ipts_device_info)))
-+		return -EFAULT;
++	// process DMA rx
++	if (ithc_use_rx0) {
++		ithc_clear_dma_rx_interrupts(ithc, 0);
++		ithc_dma_rx(ithc, 0);
++	}
++	if (ithc_use_rx1) {
++		ithc_clear_dma_rx_interrupts(ithc, 1);
++		ithc_dma_rx(ithc, 1);
++	}
 +
++	ithc_log_regs(ithc);
++}
++
++static irqreturn_t ithc_interrupt_thread(int irq, void *arg) {
++	struct ithc *ithc = arg;
++	pci_dbg(ithc->pci, "IRQ! err=%08x/%08x/%08x, cmd=%02x/%08x, rx0=%02x/%08x, rx1=%02x/%08x, tx=%02x/%08x\n",
++		readl(&ithc->regs->error_control), readl(&ithc->regs->error_status), readl(&ithc->regs->error_flags),
++		readb(&ithc->regs->spi_cmd.control), readl(&ithc->regs->spi_cmd.status),
++		readb(&ithc->regs->dma_rx[0].control), readl(&ithc->regs->dma_rx[0].status),
++		readb(&ithc->regs->dma_rx[1].control), readl(&ithc->regs->dma_rx[1].status),
++		readb(&ithc->regs->dma_tx.control), readl(&ithc->regs->dma_tx.status));
++	ithc_process(ithc);
++	return IRQ_HANDLED;
++}
++
++static int ithc_poll_thread(void *arg) {
++	struct ithc *ithc = arg;
++	unsigned sleep = 100;
++	while (!kthread_should_stop()) {
++		u32 n = ithc->dma_rx[1].num_received;
++		ithc_process(ithc);
++		if (n != ithc->dma_rx[1].num_received) sleep = 20;
++		else sleep = min(200u, sleep + (sleep >> 4) + 1);
++		msleep_interruptible(sleep);
++	}
 +	return 0;
 +}
 +
-+static long ipts_uapi_ioctl_get_doorbell(struct ipts_context *ipts,
-+					 unsigned long arg)
-+{
-+	void __user *buffer = (void __user *)arg;
++// Device initialization and shutdown
++
++static void ithc_disable(struct ithc *ithc) {
++	bitsl_set(&ithc->regs->control_bits, CONTROL_QUIESCE);
++	CHECK(waitl, ithc, &ithc->regs->control_bits, CONTROL_IS_QUIESCED, CONTROL_IS_QUIESCED);
++	bitsl(&ithc->regs->control_bits, CONTROL_NRESET, 0);
++	bitsb(&ithc->regs->spi_cmd.control, SPI_CMD_CONTROL_SEND, 0);
++	bitsb(&ithc->regs->dma_tx.control, DMA_TX_CONTROL_SEND, 0);
++	bitsb(&ithc->regs->dma_rx[0].control, DMA_RX_CONTROL_ENABLE, 0);
++	bitsb(&ithc->regs->dma_rx[1].control, DMA_RX_CONTROL_ENABLE, 0);
++	ithc_disable_interrupts(ithc);
++	ithc_clear_interrupts(ithc);
++}
 +
-+	if (!ipts || ipts->status != IPTS_HOST_STATUS_STARTED)
-+		return -ENODEV;
++static int ithc_init_device(struct ithc *ithc) {
++	ithc_log_regs(ithc);
++	bool was_enabled = (readl(&ithc->regs->control_bits) & CONTROL_NRESET) != 0;
++	ithc_disable(ithc);
++	CHECK_RET(waitl, ithc, &ithc->regs->control_bits, CONTROL_READY, CONTROL_READY);
++	ithc_set_spi_config(ithc, 10, 0);
++	bitsl_set(&ithc->regs->dma_rx[0].unknown_init_bits, 0x80000000); // seems to help with reading config
++
++	if (was_enabled) if (msleep_interruptible(100)) return -EINTR;
++	bitsl(&ithc->regs->control_bits, CONTROL_QUIESCE, 0);
++	CHECK_RET(waitl, ithc, &ithc->regs->control_bits, CONTROL_IS_QUIESCED, 0);
++	for (int retries = 0; ; retries++) {
++		ithc_log_regs(ithc);
++		bitsl_set(&ithc->regs->control_bits, CONTROL_NRESET);
++		if (!waitl(ithc, &ithc->regs->state, 0xf, 2)) break;
++		if (retries > 5) {
++			pci_err(ithc->pci, "too many retries, failed to reset device\n");
++			return -ETIMEDOUT;
++		}
++		pci_err(ithc->pci, "invalid state, retrying reset\n");
++		bitsl(&ithc->regs->control_bits, CONTROL_NRESET, 0);
++		if (msleep_interruptible(1000)) return -EINTR;
++	}
++	ithc_log_regs(ithc);
++
++	CHECK(waitl, ithc, &ithc->regs->dma_rx[0].status, DMA_RX_STATUS_UNKNOWN_4, DMA_RX_STATUS_UNKNOWN_4);
++
++	// read config
++	for (int retries = 0; ; retries++) {
++		ithc_log_regs(ithc);
++		memset(&ithc->config, 0, sizeof ithc->config);
++		CHECK_RET(ithc_spi_command, ithc, SPI_CMD_CODE_READ, 0, sizeof ithc->config, &ithc->config);
++		u32 *p = (void *)&ithc->config;
++		pci_info(ithc->pci, "config: %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x\n",
++			p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7], p[8], p[9], p[10], p[11], p[12], p[13], p[14], p[15]);
++		if (ithc_is_config_valid(ithc)) break;
++		if (retries > 10) {
++			pci_err(ithc->pci, "failed to read config, unknown device ID 0x%08x\n", ithc->config.device_id);
++			return -EIO;
++		}
++		pci_err(ithc->pci, "failed to read config, retrying\n");
++		if (msleep_interruptible(100)) return -EINTR;
++	}
++	ithc_log_regs(ithc);
 +
-+	if (copy_to_user(buffer, ipts->doorbell.address, sizeof(u32)))
-+		return -EFAULT;
++	CHECK_RET(ithc_set_spi_config, ithc, DEVCFG_SPI_MAX_FREQ(ithc->config.spi_config), DEVCFG_SPI_MODE(ithc->config.spi_config));
++	CHECK_RET(ithc_set_device_enabled, ithc, true);
++	ithc_log_regs(ithc);
++	return 0;
++}
 +
++int ithc_reset(struct ithc *ithc) {
++	// FIXME This should probably do devres_release_group()+ithc_start(). But because this is called during DMA
++	// processing, that would have to be done asynchronously (schedule_work()?). And with extra locking?
++	pci_err(ithc->pci, "reset\n");
++	CHECK(ithc_init_device, ithc);
++	if (ithc_use_rx0) ithc_dma_rx_enable(ithc, 0);
++	if (ithc_use_rx1) ithc_dma_rx_enable(ithc, 1);
++	ithc_log_regs(ithc);
++	pci_dbg(ithc->pci, "reset completed\n");
 +	return 0;
 +}
 +
-+static long ipts_uapi_ioctl_send_feedback(struct ipts_context *ipts,
-+					  struct file *file)
-+{
-+	int ret;
-+	u32 buffer;
++static void ithc_stop(void *res) {
++	struct ithc *ithc = res;
++	pci_dbg(ithc->pci, "stopping\n");
++	ithc_log_regs(ithc);
++	if (ithc->poll_thread) CHECK(kthread_stop, ithc->poll_thread);
++	if (ithc->irq >= 0) disable_irq(ithc->irq);
++	CHECK(ithc_set_device_enabled, ithc, false);
++	ithc_disable(ithc);
++	del_timer_sync(&ithc->activity_timer);
++	cpu_latency_qos_remove_request(&ithc->activity_qos);
++	// clear dma config
++	for(unsigned i = 0; i < 2; i++) {
++		CHECK(waitl, ithc, &ithc->regs->dma_rx[i].status, DMA_RX_STATUS_ENABLED, 0);
++		lo_hi_writeq(0, &ithc->regs->dma_rx[i].addr);
++		writeb(0, &ithc->regs->dma_rx[i].num_bufs);
++		writeb(0, &ithc->regs->dma_rx[i].num_prds);
++	}
++	lo_hi_writeq(0, &ithc->regs->dma_tx.addr);
++	writeb(0, &ithc->regs->dma_tx.num_prds);
++	ithc_log_regs(ithc);
++	pci_dbg(ithc->pci, "stopped\n");
++}
 +
-+	if (!ipts || ipts->status != IPTS_HOST_STATUS_STARTED)
-+		return -ENODEV;
++static void ithc_clear_drvdata(void *res) {
++	struct pci_dev *pci = res;
++	pci_set_drvdata(pci, NULL);
++}
 +
-+	buffer = MINOR(file->f_path.dentry->d_inode->i_rdev);
++static int ithc_start(struct pci_dev *pci) {
++	pci_dbg(pci, "starting\n");
++	if (pci_get_drvdata(pci)) {
++		pci_err(pci, "device already initialized\n");
++		return -EINVAL;
++	}
++	if (!devres_open_group(&pci->dev, ithc_start, GFP_KERNEL)) return -ENOMEM;
++
++	struct ithc *ithc = devm_kzalloc(&pci->dev, sizeof *ithc, GFP_KERNEL);
++	if (!ithc) return -ENOMEM;
++	ithc->irq = -1;
++	ithc->pci = pci;
++	snprintf(ithc->phys, sizeof ithc->phys, "pci-%s/" DEVNAME, pci_name(pci));
++	init_waitqueue_head(&ithc->wait_hid_parse);
++	init_waitqueue_head(&ithc->wait_hid_get_feature);
++	mutex_init(&ithc->hid_get_feature_mutex);
++	pci_set_drvdata(pci, ithc);
++	CHECK_RET(devm_add_action_or_reset, &pci->dev, ithc_clear_drvdata, pci);
++	if (ithc_log_regs_enabled) ithc->prev_regs = devm_kzalloc(&pci->dev, sizeof *ithc->prev_regs, GFP_KERNEL);
++
++	CHECK_RET(pcim_enable_device, pci);
++	pci_set_master(pci);
++	CHECK_RET(pcim_iomap_regions, pci, BIT(0), DEVNAME " regs");
++	CHECK_RET(dma_set_mask_and_coherent, &pci->dev, DMA_BIT_MASK(64));
++	CHECK_RET(pci_set_power_state, pci, PCI_D0);
++	ithc->regs = pcim_iomap_table(pci)[0];
++
++	if (!ithc_use_polling) {
++		CHECK_RET(pci_alloc_irq_vectors, pci, 1, 1, PCI_IRQ_MSI | PCI_IRQ_MSIX);
++		ithc->irq = CHECK(pci_irq_vector, pci, 0);
++		if (ithc->irq < 0) return ithc->irq;
++	}
 +
-+	ret = ipts_control_send_feedback(ipts, buffer);
-+	if (ret)
-+		return -EFAULT;
++	CHECK_RET(ithc_init_device, ithc);
++	CHECK(devm_device_add_groups, &pci->dev, ithc_attribute_groups);
++	if (ithc_use_rx0) CHECK_RET(ithc_dma_rx_init, ithc, 0, ithc_use_rx1 ? DEVNAME "0" : DEVNAME);
++	if (ithc_use_rx1) CHECK_RET(ithc_dma_rx_init, ithc, 1, ithc_use_rx0 ? DEVNAME "1" : DEVNAME);
++	CHECK_RET(ithc_dma_tx_init, ithc);
 +
-+	return 0;
-+}
++	CHECK_RET(ithc_hid_init, ithc);
 +
-+static long ipts_uapi_ioctl_send_reset(struct ipts_context *ipts)
-+{
-+	int ret;
-+	struct ipts_reset_sensor_cmd cmd;
++	cpu_latency_qos_add_request(&ithc->activity_qos, PM_QOS_DEFAULT_VALUE);
++	timer_setup(&ithc->activity_timer, ithc_activity_timer_callback, 0);
 +
-+	if (!ipts || ipts->status != IPTS_HOST_STATUS_STARTED)
-+		return -ENODEV;
++	// add ithc_stop callback AFTER setting up DMA buffers, so that polling/irqs/DMA are disabled BEFORE the buffers are freed
++	CHECK_RET(devm_add_action_or_reset, &pci->dev, ithc_stop, ithc);
 +
-+	memset(&cmd, 0, sizeof(struct ipts_reset_sensor_cmd));
-+	cmd.type = IPTS_RESET_TYPE_SOFT;
++	if (ithc_use_polling) {
++		pci_info(pci, "using polling instead of irq\n");
++		// use a thread instead of simple timer because we want to be able to sleep
++		ithc->poll_thread = kthread_run(ithc_poll_thread, ithc, DEVNAME "poll");
++		if (IS_ERR(ithc->poll_thread)) {
++			int err = PTR_ERR(ithc->poll_thread);
++			ithc->poll_thread = NULL;
++			return err;
++		}
++	} else {
++		CHECK_RET(devm_request_threaded_irq, &pci->dev, ithc->irq, NULL, ithc_interrupt_thread, IRQF_TRIGGER_HIGH | IRQF_ONESHOT, DEVNAME, ithc);
++	}
 +
-+	ret = ipts_control_send(ipts, IPTS_CMD_RESET_SENSOR, &cmd,
-+				sizeof(struct ipts_reset_sensor_cmd));
++	if (ithc_use_rx0) ithc_dma_rx_enable(ithc, 0);
++	if (ithc_use_rx1) ithc_dma_rx_enable(ithc, 1);
 +
-+	if (ret)
-+		return -EFAULT;
++	// hid_add_device can only be called after irq/polling is started and DMA is enabled, because it calls ithc_hid_parse which reads the report descriptor via DMA
++	CHECK_RET(hid_add_device, ithc->hid);
 +
++	CHECK(ithc_debug_init, ithc);
++
++	pci_dbg(pci, "started\n");
 +	return 0;
 +}
 +
-+static long ipts_uapi_ioctl(struct file *file, unsigned int cmd,
-+			    unsigned long arg)
-+{
-+	struct ipts_context *ipts = uapi.ipts;
-+
-+	switch (cmd) {
-+	case IPTS_IOCTL_GET_DEVICE_READY:
-+		return ipts_uapi_ioctl_get_device_ready(ipts, arg);
-+	case IPTS_IOCTL_GET_DEVICE_INFO:
-+		return ipts_uapi_ioctl_get_device_info(ipts, arg);
-+	case IPTS_IOCTL_GET_DOORBELL:
-+		return ipts_uapi_ioctl_get_doorbell(ipts, arg);
-+	case IPTS_IOCTL_SEND_FEEDBACK:
-+		return ipts_uapi_ioctl_send_feedback(ipts, file);
-+	case IPTS_IOCTL_SEND_RESET:
-+		return ipts_uapi_ioctl_send_reset(ipts);
-+	default:
-+		return -ENOTTY;
-+	}
++static int ithc_probe(struct pci_dev *pci, const struct pci_device_id *id) {
++	pci_dbg(pci, "device probe\n");
++	return ithc_start(pci);
 +}
 +
-+static const struct file_operations ipts_uapi_fops = {
-+	.owner = THIS_MODULE,
-+	.read = ipts_uapi_read,
-+	.unlocked_ioctl = ipts_uapi_ioctl,
-+#ifdef CONFIG_COMPAT
-+	.compat_ioctl = ipts_uapi_ioctl,
-+#endif
-+};
++static void ithc_remove(struct pci_dev *pci) {
++	pci_dbg(pci, "device remove\n");
++	// all cleanup is handled by devres
++}
 +
-+void ipts_uapi_link(struct ipts_context *ipts)
-+{
-+	uapi.ipts = ipts;
++static int ithc_suspend(struct device *dev) {
++	struct pci_dev *pci = to_pci_dev(dev);
++	pci_dbg(pci, "pm suspend\n");
++	devres_release_group(dev, ithc_start);
++	return 0;
 +}
 +
-+void ipts_uapi_unlink(void)
-+{
-+	uapi.ipts = NULL;
++static int ithc_resume(struct device *dev) {
++	struct pci_dev *pci = to_pci_dev(dev);
++	pci_dbg(pci, "pm resume\n");
++	return ithc_start(pci);
 +}
 +
-+int ipts_uapi_init(void)
-+{
-+	int i, major;
++static int ithc_freeze(struct device *dev) {
++	struct pci_dev *pci = to_pci_dev(dev);
++	pci_dbg(pci, "pm freeze\n");
++	devres_release_group(dev, ithc_start);
++	return 0;
++}
 +
-+	alloc_chrdev_region(&uapi.dev, 0, IPTS_BUFFERS, "ipts");
-+	uapi.class = class_create(THIS_MODULE, "ipts");
++static int ithc_thaw(struct device *dev) {
++	struct pci_dev *pci = to_pci_dev(dev);
++	pci_dbg(pci, "pm thaw\n");
++	return ithc_start(pci);
++}
 +
-+	major = MAJOR(uapi.dev);
++static int ithc_restore(struct device *dev) {
++	struct pci_dev *pci = to_pci_dev(dev);
++	pci_dbg(pci, "pm restore\n");
++	return ithc_start(pci);
++}
 +
-+	cdev_init(&uapi.cdev, &ipts_uapi_fops);
-+	uapi.cdev.owner = THIS_MODULE;
-+	cdev_add(&uapi.cdev, MKDEV(major, 0), IPTS_BUFFERS);
++static struct pci_driver ithc_driver = {
++	.name = DEVNAME,
++	.id_table = ithc_pci_tbl,
++	.probe = ithc_probe,
++	.remove = ithc_remove,
++	.driver.pm = &(const struct dev_pm_ops) {
++		.suspend = ithc_suspend,
++		.resume = ithc_resume,
++		.freeze = ithc_freeze,
++		.thaw = ithc_thaw,
++		.restore = ithc_restore,
++	},
++	//.dev_groups = ithc_attribute_groups, // could use this (since 5.14), however the attributes won't have valid values until config has been read anyway
++};
 +
-+	for (i = 0; i < IPTS_BUFFERS; i++) {
-+		device_create(uapi.class, NULL, MKDEV(major, i), NULL,
-+			      "ipts/%d", i);
-+	}
++static int __init ithc_init(void) {
++	return pci_register_driver(&ithc_driver);
++}
 +
-+	return 0;
++static void __exit ithc_exit(void) {
++	pci_unregister_driver(&ithc_driver);
 +}
 +
-+void ipts_uapi_free(void)
-+{
-+	int i;
-+	int major;
++module_init(ithc_init);
++module_exit(ithc_exit);
 +
-+	major = MAJOR(uapi.dev);
+diff --git a/drivers/hid/ithc/ithc-regs.c b/drivers/hid/ithc/ithc-regs.c
+new file mode 100644
+index 0000000000000..85d567b05761f
+--- /dev/null
++++ b/drivers/hid/ithc/ithc-regs.c
+@@ -0,0 +1,64 @@
++#include "ithc.h"
 +
-+	for (i = 0; i < IPTS_BUFFERS; i++)
-+		device_destroy(uapi.class, MKDEV(major, i));
++#define reg_num(r) (0x1fff & (u16)(__force u64)(r))
 +
-+	cdev_del(&uapi.cdev);
++void bitsl(__iomem u32 *reg, u32 mask, u32 val) {
++	if (val & ~mask) pr_err("register 0x%x: invalid value 0x%x for bitmask 0x%x\n", reg_num(reg), val, mask);
++	writel((readl(reg) & ~mask) | (val & mask), reg);
++}
 +
-+	unregister_chrdev_region(MKDEV(major, 0), MINORMASK);
-+	class_destroy(uapi.class);
++void bitsb(__iomem u8 *reg, u8 mask, u8 val) {
++	if (val & ~mask) pr_err("register 0x%x: invalid value 0x%x for bitmask 0x%x\n", reg_num(reg), val, mask);
++	writeb((readb(reg) & ~mask) | (val & mask), reg);
 +}
-diff --git a/drivers/misc/ipts/uapi.h b/drivers/misc/ipts/uapi.h
-new file mode 100644
-index 000000000000..53fb86a88f97
---- /dev/null
-+++ b/drivers/misc/ipts/uapi.h
-@@ -0,0 +1,47 @@
-+/* SPDX-License-Identifier: GPL-2.0-or-later */
-+/*
-+ * Copyright (c) 2016 Intel Corporation
-+ * Copyright (c) 2020 Dorian Stoll
-+ *
-+ * Linux driver for Intel Precise Touch & Stylus
-+ */
 +
-+#ifndef _IPTS_UAPI_H_
-+#define _IPTS_UAPI_H_
++int waitl(struct ithc *ithc, __iomem u32 *reg, u32 mask, u32 val) {
++	pci_dbg(ithc->pci, "waiting for reg 0x%04x mask 0x%08x val 0x%08x\n", reg_num(reg), mask, val);
++	u32 x;
++	if (readl_poll_timeout(reg, x, (x & mask) == val, 200, 1000*1000)) {
++		pci_err(ithc->pci, "timed out waiting for reg 0x%04x mask 0x%08x val 0x%08x\n", reg_num(reg), mask, val);
++		return -ETIMEDOUT;
++	}
++	pci_dbg(ithc->pci, "done waiting\n");
++	return 0;
++}
 +
-+#include <linux/types.h>
++int waitb(struct ithc *ithc, __iomem u8 *reg, u8 mask, u8 val) {
++	pci_dbg(ithc->pci, "waiting for reg 0x%04x mask 0x%02x val 0x%02x\n", reg_num(reg), mask, val);
++	u8 x;
++	if (readb_poll_timeout(reg, x, (x & mask) == val, 200, 1000*1000)) {
++		pci_err(ithc->pci, "timed out waiting for reg 0x%04x mask 0x%02x val 0x%02x\n", reg_num(reg), mask, val);
++		return -ETIMEDOUT;
++	}
++	pci_dbg(ithc->pci, "done waiting\n");
++	return 0;
++}
 +
-+#include "context.h"
++int ithc_set_spi_config(struct ithc *ithc, u8 speed, u8 mode) {
++	pci_dbg(ithc->pci, "setting SPI speed to %i, mode %i\n", speed, mode);
++	if (mode == 3) mode = 2;
++	bitsl(&ithc->regs->spi_config,
++		SPI_CONFIG_MODE(0xff) | SPI_CONFIG_SPEED(0xff) | SPI_CONFIG_UNKNOWN_18(0xff) | SPI_CONFIG_SPEED2(0xff),
++		SPI_CONFIG_MODE(mode) | SPI_CONFIG_SPEED(speed) | SPI_CONFIG_UNKNOWN_18(0) | SPI_CONFIG_SPEED2(speed));
++	return 0;
++}
 +
-+struct ipts_uapi {
-+	dev_t dev;
-+	struct class *class;
-+	struct cdev cdev;
++int ithc_spi_command(struct ithc *ithc, u8 command, u32 offset, u32 size, void *data) {
++	pci_dbg(ithc->pci, "SPI command %u, size %u, offset %u\n", command, size, offset);
++	if (size > sizeof ithc->regs->spi_cmd.data) return -EINVAL;
++	CHECK_RET(waitl, ithc, &ithc->regs->spi_cmd.status, SPI_CMD_STATUS_BUSY, 0);
++	writel(SPI_CMD_STATUS_DONE | SPI_CMD_STATUS_ERROR, &ithc->regs->spi_cmd.status);
++	writeb(command, &ithc->regs->spi_cmd.code);
++	writew(size, &ithc->regs->spi_cmd.size);
++	writel(offset, &ithc->regs->spi_cmd.offset);
++	u32 *p = data, n = (size + 3) / 4;
++	for (u32 i = 0; i < n; i++) writel(p[i], &ithc->regs->spi_cmd.data[i]);
++	bitsb_set(&ithc->regs->spi_cmd.control, SPI_CMD_CONTROL_SEND);
++	CHECK_RET(waitl, ithc, &ithc->regs->spi_cmd.status, SPI_CMD_STATUS_BUSY, 0);
++	if ((readl(&ithc->regs->spi_cmd.status) & (SPI_CMD_STATUS_DONE | SPI_CMD_STATUS_ERROR)) != SPI_CMD_STATUS_DONE) return -EIO;
++	if (readw(&ithc->regs->spi_cmd.size) != size) return -EMSGSIZE;
++	for (u32 i = 0; i < n; i++) p[i] = readl(&ithc->regs->spi_cmd.data[i]);
++	writel(SPI_CMD_STATUS_DONE | SPI_CMD_STATUS_ERROR, &ithc->regs->spi_cmd.status);
++	return 0;
++}
 +
-+	struct ipts_context *ipts;
+diff --git a/drivers/hid/ithc/ithc-regs.h b/drivers/hid/ithc/ithc-regs.h
+new file mode 100644
+index 0000000000000..1a96092ed7eed
+--- /dev/null
++++ b/drivers/hid/ithc/ithc-regs.h
+@@ -0,0 +1,186 @@
++#define CONTROL_QUIESCE                     BIT(1)
++#define CONTROL_IS_QUIESCED                 BIT(2)
++#define CONTROL_NRESET                      BIT(3)
++#define CONTROL_READY                       BIT(29)
++
++#define SPI_CONFIG_MODE(x)                  (((x) & 3) << 2)
++#define SPI_CONFIG_SPEED(x)                 (((x) & 7) << 4)
++#define SPI_CONFIG_UNKNOWN_18(x)            (((x) & 3) << 18)
++#define SPI_CONFIG_SPEED2(x)                (((x) & 0xf) << 20) // high bit = high speed mode?
++
++#define ERROR_CONTROL_UNKNOWN_0             BIT(0)
++#define ERROR_CONTROL_DISABLE_DMA           BIT(1) // clears DMA_RX_CONTROL_ENABLE when a DMA error occurs
++#define ERROR_CONTROL_UNKNOWN_2             BIT(2)
++#define ERROR_CONTROL_UNKNOWN_3             BIT(3)
++#define ERROR_CONTROL_IRQ_DMA_UNKNOWN_9     BIT(9)
++#define ERROR_CONTROL_IRQ_DMA_UNKNOWN_10    BIT(10)
++#define ERROR_CONTROL_IRQ_DMA_UNKNOWN_12    BIT(12)
++#define ERROR_CONTROL_IRQ_DMA_UNKNOWN_13    BIT(13)
++#define ERROR_CONTROL_UNKNOWN_16(x)         (((x) & 0xff) << 16) // spi error code irq?
++#define ERROR_CONTROL_SET_DMA_STATUS        BIT(29) // sets DMA_RX_STATUS_ERROR when a DMA error occurs
++
++#define ERROR_STATUS_DMA                    BIT(28)
++#define ERROR_STATUS_SPI                    BIT(30)
++
++#define ERROR_FLAG_DMA_UNKNOWN_9            BIT(9)
++#define ERROR_FLAG_DMA_UNKNOWN_10           BIT(10)
++#define ERROR_FLAG_DMA_UNKNOWN_12           BIT(12) // set when we receive a truncated DMA message
++#define ERROR_FLAG_DMA_UNKNOWN_13           BIT(13)
++#define ERROR_FLAG_SPI_BUS_TURNAROUND       BIT(16)
++#define ERROR_FLAG_SPI_RESPONSE_TIMEOUT     BIT(17)
++#define ERROR_FLAG_SPI_INTRA_PACKET_TIMEOUT BIT(18)
++#define ERROR_FLAG_SPI_INVALID_RESPONSE     BIT(19)
++#define ERROR_FLAG_SPI_HS_RX_TIMEOUT        BIT(20)
++#define ERROR_FLAG_SPI_TOUCH_IC_INIT        BIT(21)
++
++#define SPI_CMD_CONTROL_SEND                BIT(0) // cleared by device when sending is complete
++#define SPI_CMD_CONTROL_IRQ                 BIT(1)
++
++#define SPI_CMD_CODE_READ                   4
++#define SPI_CMD_CODE_WRITE                  6
++
++#define SPI_CMD_STATUS_DONE                 BIT(0)
++#define SPI_CMD_STATUS_ERROR                BIT(1)
++#define SPI_CMD_STATUS_BUSY                 BIT(3)
++
++#define DMA_TX_CONTROL_SEND                 BIT(0) // cleared by device when sending is complete
++#define DMA_TX_CONTROL_IRQ                  BIT(3)
++
++#define DMA_TX_STATUS_DONE                  BIT(0)
++#define DMA_TX_STATUS_ERROR                 BIT(1)
++#define DMA_TX_STATUS_UNKNOWN_2             BIT(2)
++#define DMA_TX_STATUS_UNKNOWN_3             BIT(3) // busy?
++
++#define DMA_RX_CONTROL_ENABLE               BIT(0)
++#define DMA_RX_CONTROL_IRQ_UNKNOWN_1        BIT(1) // rx1 only?
++#define DMA_RX_CONTROL_IRQ_ERROR            BIT(3) // rx1 only?
++#define DMA_RX_CONTROL_IRQ_UNKNOWN_4        BIT(4) // rx0 only?
++#define DMA_RX_CONTROL_IRQ_DATA             BIT(5)
++
++#define DMA_RX_CONTROL2_UNKNOWN_5           BIT(5) // rx0 only?
++#define DMA_RX_CONTROL2_RESET               BIT(7) // resets ringbuffer indices
++
++#define DMA_RX_WRAP_FLAG                    BIT(7)
++
++#define DMA_RX_STATUS_ERROR                 BIT(3)
++#define DMA_RX_STATUS_UNKNOWN_4             BIT(4) // set in rx0 after using CONTROL_NRESET when it becomes possible to read config (can take >100ms)
++#define DMA_RX_STATUS_HAVE_DATA             BIT(5)
++#define DMA_RX_STATUS_ENABLED               BIT(8)
++
++#define COUNTER_RESET                       BIT(31)
++
++struct ithc_registers {
++	/* 0000 */ u32 _unknown_0000[1024];
++	/* 1000 */ u32 _unknown_1000;
++	/* 1004 */ u32 _unknown_1004;
++	/* 1008 */ u32 control_bits;
++	/* 100c */ u32 _unknown_100c;
++	/* 1010 */ u32 spi_config;
++	/* 1014 */ u32 _unknown_1014[3];
++	/* 1020 */ u32 error_control;
++	/* 1024 */ u32 error_status; // write to clear
++	/* 1028 */ u32 error_flags; // write to clear
++	/* 102c */ u32 _unknown_102c[5];
++	struct {
++		/* 1040 */ u8 control;
++		/* 1041 */ u8 code;
++		/* 1042 */ u16 size;
++		/* 1044 */ u32 status; // write to clear
++		/* 1048 */ u32 offset;
++		/* 104c */ u32 data[16];
++		/* 108c */ u32 _unknown_108c;
++	} spi_cmd;
++	struct {
++		/* 1090 */ u64 addr; // cannot be written with writeq(), must use lo_hi_writeq()
++		/* 1098 */ u8 control;
++		/* 1099 */ u8 _unknown_1099;
++		/* 109a */ u8 _unknown_109a;
++		/* 109b */ u8 num_prds;
++		/* 109c */ u32 status; // write to clear
++	} dma_tx;
++	/* 10a0 */ u32 _unknown_10a0[7];
++	/* 10bc */ u32 state; // is 0xe0000402 (dev config val 0) after CONTROL_NRESET, 0xe0000461 after first touch, 0xe0000401 after DMA_RX_CODE_RESET
++	/* 10c0 */ u32 _unknown_10c0[8];
++	/* 10e0 */ u32 _unknown_10e0_counters[3];
++	/* 10ec */ u32 _unknown_10ec[5];
++	struct {
++		/* 1100/1200 */ u64 addr; // cannot be written with writeq(), must use lo_hi_writeq()
++		/* 1108/1208 */ u8 num_bufs;
++		/* 1109/1209 */ u8 num_prds;
++		/* 110a/120a */ u16 _unknown_110a;
++		/* 110c/120c */ u8 control;
++		/* 110d/120d */ u8 head;
++		/* 110e/120e */ u8 tail;
++		/* 110f/120f */ u8 control2;
++		/* 1110/1210 */ u32 status; // write to clear
++		/* 1114/1214 */ u32 _unknown_1114;
++		/* 1118/1218 */ u64 _unknown_1118_guc_addr;
++		/* 1120/1220 */ u32 _unknown_1120_guc;
++		/* 1124/1224 */ u32 _unknown_1124_guc;
++		/* 1128/1228 */ u32 unknown_init_bits; // bit 2 = guc related, bit 3 = rx1 related, bit 4 = guc related
++		/* 112c/122c */ u32 _unknown_112c;
++		/* 1130/1230 */ u64 _unknown_1130_guc_addr;
++		/* 1138/1238 */ u32 _unknown_1138_guc;
++		/* 113c/123c */ u32 _unknown_113c;
++		/* 1140/1240 */ u32 _unknown_1140_guc;
++		/* 1144/1244 */ u32 _unknown_1144[23];
++		/* 11a0/12a0 */ u32 _unknown_11a0_counters[6];
++		/* 11b8/12b8 */ u32 _unknown_11b8[18];
++	} dma_rx[2];
 +};
-+
-+struct ipts_device_info {
-+	__u16 vendor;
-+	__u16 product;
-+	__u32 version;
-+	__u32 buffer_size;
-+	__u8 max_contacts;
-+
-+	/* For future expansion */
-+	__u8 reserved[19];
++static_assert(sizeof(struct ithc_registers) == 0x1300);
++
++#define DEVCFG_DMA_RX_SIZE(x)          ((((x) & 0x3fff) + 1) << 6)
++#define DEVCFG_DMA_TX_SIZE(x)          (((((x) >> 14) & 0x3ff) + 1) << 6)
++
++#define DEVCFG_TOUCH_MASK              0x3f
++#define DEVCFG_TOUCH_ENABLE            BIT(0)
++#define DEVCFG_TOUCH_UNKNOWN_1         BIT(1)
++#define DEVCFG_TOUCH_UNKNOWN_2         BIT(2)
++#define DEVCFG_TOUCH_UNKNOWN_3         BIT(3)
++#define DEVCFG_TOUCH_UNKNOWN_4         BIT(4)
++#define DEVCFG_TOUCH_UNKNOWN_5         BIT(5)
++#define DEVCFG_TOUCH_UNKNOWN_6         BIT(6)
++
++#define DEVCFG_DEVICE_ID_TIC           0x43495424 // "$TIC"
++
++#define DEVCFG_SPI_MAX_FREQ(x)         (((x) >> 1) & 0xf) // high bit = use high speed mode?
++#define DEVCFG_SPI_MODE(x)             (((x) >> 6) & 3)
++#define DEVCFG_SPI_UNKNOWN_8(x)        (((x) >> 8) & 0x3f)
++#define DEVCFG_SPI_NEEDS_HEARTBEAT     BIT(20)
++#define DEVCFG_SPI_HEARTBEAT_INTERVAL  (((x) >> 21) & 7)
++#define DEVCFG_SPI_UNKNOWN_25          BIT(25)
++#define DEVCFG_SPI_UNKNOWN_26          BIT(26)
++#define DEVCFG_SPI_UNKNOWN_27          BIT(27)
++#define DEVCFG_SPI_DELAY               (((x) >> 28) & 7)
++#define DEVCFG_SPI_USE_EXT_READ_CFG    BIT(31)
++
++struct ithc_device_config {
++	u32 _unknown_00;      // 00 = 0xe0000402 (0xe0000401 after DMA_RX_CODE_RESET)
++	u32 _unknown_04;      // 04 = 0x00000000
++	u32 dma_buf_sizes;    // 08 = 0x000a00ff
++	u32 touch_cfg;        // 0c = 0x0000001c
++	u32 _unknown_10;      // 10 = 0x0000001c
++	u32 device_id;        // 14 = 0x43495424 = "$TIC"
++	u32 spi_config;       // 18 = 0xfda00a2e
++	u16 vendor_id;        // 1c = 0x045e = Microsoft Corp.
++	u16 product_id;       // 1e = 0x0c1a
++	u32 revision;         // 20 = 0x00000001
++	u32 fw_version;       // 24 = 0x05008a8b = 5.0.138.139
++	u32 _unknown_28;      // 28 = 0x00000000
++	u32 fw_mode;          // 2c = 0x00000000
++	u32 _unknown_30;      // 30 = 0x00000000
++	u32 _unknown_34;      // 34 = 0x0404035e (u8,u8,u8,u8 = version?)
++	u32 _unknown_38;      // 38 = 0x000001c0 (0x000001c1 after DMA_RX_CODE_RESET)
++	u32 _unknown_3c;      // 3c = 0x00000002
 +};
 +
-+#define IPTS_IOCTL_GET_DEVICE_READY _IOR(0x86, 0x01, __u8)
-+#define IPTS_IOCTL_GET_DEVICE_INFO  _IOR(0x86, 0x02, struct ipts_device_info)
-+#define IPTS_IOCTL_GET_DOORBELL	    _IOR(0x86, 0x03, __u32)
-+#define IPTS_IOCTL_SEND_FEEDBACK    _IO(0x86, 0x04)
-+#define IPTS_IOCTL_SEND_RESET	    _IO(0x86, 0x05)
-+
-+void ipts_uapi_link(struct ipts_context *ipts);
-+void ipts_uapi_unlink(void);
-+
-+int ipts_uapi_init(void);
-+void ipts_uapi_free(void);
-+
-+#endif /* _IPTS_UAPI_H_ */
--- 
-2.39.0
-
-From e3eebbc271fccaa8579b04b340f4b4b01d54ec61 Mon Sep 17 00:00:00 2001
-From: Liban Hannan <liban.p@gmail.com>
-Date: Tue, 12 Apr 2022 23:31:12 +0100
-Subject: [PATCH] iommu: ipts: use IOMMU passthrough mode for IPTS
-
-Adds a quirk so that IOMMU uses passthrough mode for the IPTS device.
-Otherwise, when IOMMU is enabled, IPTS produces DMAR errors like:
-
-DMAR: [DMA Read NO_PASID] Request device [00:16.4] fault addr
-0x104ea3000 [fault reason 0x06] PTE Read access is not set
-
-This is very similar to the bug described at:
-https://bugs.launchpad.net/bugs/1958004
-
-Fixed with the following patch which this patch basically copies:
-https://launchpadlibrarian.net/586396847/43255ca.diff
-Patchset: ipts
----
- drivers/iommu/intel/iommu.c | 24 ++++++++++++++++++++++++
- 1 file changed, 24 insertions(+)
-
-diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
-index 644ca49e8cf8..408c321b929a 100644
---- a/drivers/iommu/intel/iommu.c
-+++ b/drivers/iommu/intel/iommu.c
-@@ -37,6 +37,8 @@
- #define IS_GFX_DEVICE(pdev) ((pdev->class >> 16) == PCI_BASE_CLASS_DISPLAY)
- #define IS_USB_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_SERIAL_USB)
- #define IS_ISA_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA)
-+#define IS_IPTS(pdev) ((pdev)->vendor == PCI_VENDOR_ID_INTEL &&	\
-+			    ((pdev)->device == 0x9d3e))
- #define IS_AZALIA(pdev) ((pdev)->vendor == 0x8086 && (pdev)->device == 0x3a3e)
- 
- #define IOAPIC_RANGE_START	(0xfee00000)
-@@ -286,12 +288,14 @@ int intel_iommu_enabled = 0;
- EXPORT_SYMBOL_GPL(intel_iommu_enabled);
- 
- static int dmar_map_gfx = 1;
-+static int dmar_map_ipts = 1;
- static int intel_iommu_superpage = 1;
- static int iommu_identity_mapping;
- static int iommu_skip_te_disable;
- 
- #define IDENTMAP_GFX		2
- #define IDENTMAP_AZALIA		4
-+#define IDENTMAP_IPTS		16
- 
- const struct iommu_ops intel_iommu_ops;
- 
-@@ -2630,6 +2634,9 @@ static int device_def_domain_type(struct device *dev)
- 
- 		if ((iommu_identity_mapping & IDENTMAP_GFX) && IS_GFX_DEVICE(pdev))
- 			return IOMMU_DOMAIN_IDENTITY;
++void bitsl(__iomem u32 *reg, u32 mask, u32 val);
++void bitsb(__iomem u8 *reg, u8 mask, u8 val);
++#define bitsl_set(reg, x) bitsl(reg, x, x)
++#define bitsb_set(reg, x) bitsb(reg, x, x)
++int waitl(struct ithc *ithc, __iomem u32 *reg, u32 mask, u32 val);
++int waitb(struct ithc *ithc, __iomem u8 *reg, u8 mask, u8 val);
++int ithc_set_spi_config(struct ithc *ithc, u8 speed, u8 mode);
++int ithc_spi_command(struct ithc *ithc, u8 command, u32 offset, u32 size, void *data);
 +
-+		if ((iommu_identity_mapping & IDENTMAP_IPTS) && IS_IPTS(pdev))
-+			return IOMMU_DOMAIN_IDENTITY;
- 	}
- 
- 	return 0;
-@@ -3019,6 +3026,9 @@ static int __init init_dmars(void)
- 	if (!dmar_map_gfx)
- 		iommu_identity_mapping |= IDENTMAP_GFX;
- 
-+	if (!dmar_map_ipts)
-+		iommu_identity_mapping |= IDENTMAP_IPTS;
+diff --git a/drivers/hid/ithc/ithc.h b/drivers/hid/ithc/ithc.h
+new file mode 100644
+index 0000000000000..6a9b0d480bc15
+--- /dev/null
++++ b/drivers/hid/ithc/ithc.h
+@@ -0,0 +1,60 @@
++#include <linux/module.h>
++#include <linux/input.h>
++#include <linux/hid.h>
++#include <linux/dma-mapping.h>
++#include <linux/highmem.h>
++#include <linux/pci.h>
++#include <linux/io-64-nonatomic-lo-hi.h>
++#include <linux/iopoll.h>
++#include <linux/delay.h>
++#include <linux/kthread.h>
++#include <linux/miscdevice.h>
++#include <linux/debugfs.h>
++#include <linux/poll.h>
++#include <linux/timer.h>
++#include <linux/pm_qos.h>
 +
- 	check_tylersburg_isoch();
- 
- 	ret = si_domain_init(hw_pass_through);
-@@ -4774,6 +4784,17 @@ static void quirk_iommu_igfx(struct pci_dev *dev)
- 	dmar_map_gfx = 0;
- }
- 
-+static void quirk_iommu_ipts(struct pci_dev *dev)
-+{
-+	if (!IS_IPTS(dev))
-+		return;
++#define DEVNAME "ithc"
++#define DEVFULLNAME "Intel Touch Host Controller"
 +
-+	if (risky_device(dev))
-+		return;
++#undef pr_fmt
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#define CHECK(fn, ...) ({ int r = fn(__VA_ARGS__); if (r < 0) pci_err(ithc->pci, "%s: %s failed with %i\n", __func__, #fn, r); r; })
++#define CHECK_RET(...) do { int r = CHECK(__VA_ARGS__); if (r < 0) return r; } while(0)
++
++#define NUM_RX_BUF 16
++
++struct ithc;
++
++#include "ithc-regs.h"
++#include "ithc-dma.h"
++
++struct ithc {
++	char phys[32];
++	struct pci_dev *pci;
++	int irq;
++	struct task_struct *poll_thread;
++	struct pm_qos_request activity_qos;
++	struct timer_list activity_timer;
++
++	struct hid_device *hid;
++	bool hid_parse_done;
++	wait_queue_head_t wait_hid_parse;
++	wait_queue_head_t wait_hid_get_feature;
++	struct mutex hid_get_feature_mutex;
++	void *hid_get_feature_buf;
++	size_t hid_get_feature_size;
++
++	struct ithc_registers __iomem *regs;
++	struct ithc_registers *prev_regs; // for debugging
++	struct ithc_device_config config;
++	struct ithc_dma_rx dma_rx[2];
++	struct ithc_dma_tx dma_tx;
++};
 +
-+	pci_info(dev, "Passthrough IOMMU for IPTS\n");
-+	dmar_map_ipts = 0;
-+}
- /* G4x/GM45 integrated gfx dmar support is totally busted. */
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_igfx);
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e00, quirk_iommu_igfx);
-@@ -4809,6 +4830,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1632, quirk_iommu_igfx);
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x163A, quirk_iommu_igfx);
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x163D, quirk_iommu_igfx);
- 
-+/* disable IPTS dmar support */
-+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9D3E, quirk_iommu_ipts);
++int ithc_reset(struct ithc *ithc);
++void ithc_set_active(struct ithc *ithc);
++int ithc_debug_init(struct ithc *ithc);
++void ithc_log_regs(struct ithc *ithc);
 +
- static void quirk_iommu_rwbf(struct pci_dev *dev)
- {
- 	if (risky_device(dev))
 -- 
-2.39.0
+2.39.2
 
-From 9e44cdad03a46c1f08f3be86173c118c6db561c6 Mon Sep 17 00:00:00 2001
+From 95a60c5bc443f1658c987e837722d0dfdbe1e9a4 Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
-Date: Sat, 5 Nov 2022 21:23:53 +0100
+Date: Fri, 2 Dec 2022 23:33:20 +0100
 Subject: [PATCH] platform/surface: aggregator: Improve documentation and
  handling of message target and source IDs
 
@@ -2235,22 +5053,26 @@ indicating the peer from which the message originated and the peer for
 which it is intended.
 
 Change the naming of those fields accordingly and improve the protocol
-documenation. Additionally, introduce an enum containing all currently
+documentation. Additionally, introduce an enum containing all currently
 known peers, i.e. targets and sources.
 
 Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/20221202223327.690880-3-luzmaximilian@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
 Patchset: surface-sam
 ---
  .../driver-api/surface_aggregator/client.rst  |  4 +-
  .../driver-api/surface_aggregator/ssh.rst     | 36 +++++++++--------
  .../platform/surface/aggregator/controller.c  | 12 +++---
  .../platform/surface/aggregator/ssh_msgb.h    |  4 +-
+ .../surface/aggregator/ssh_request_layer.c    | 11 ++---
  include/linux/surface_aggregator/controller.h |  4 +-
  include/linux/surface_aggregator/serial_hub.h | 40 +++++++++++++------
- 6 files changed, 58 insertions(+), 42 deletions(-)
+ 7 files changed, 64 insertions(+), 47 deletions(-)
 
 diff --git a/Documentation/driver-api/surface_aggregator/client.rst b/Documentation/driver-api/surface_aggregator/client.rst
-index 27f95abdbe99..9d7411223a84 100644
+index 27f95abdbe997..9d7411223a848 100644
 --- a/Documentation/driver-api/surface_aggregator/client.rst
 +++ b/Documentation/driver-api/surface_aggregator/client.rst
 @@ -191,7 +191,7 @@ data received from it is converted from little-endian to host endianness.
@@ -2272,7 +5094,7 @@ index 27f95abdbe99..9d7411223a84 100644
             .instance_id     = 0x00,
     });
 diff --git a/Documentation/driver-api/surface_aggregator/ssh.rst b/Documentation/driver-api/surface_aggregator/ssh.rst
-index bf007d6c9873..18fd0f0aee84 100644
+index bf007d6c98732..18fd0f0aee84b 100644
 --- a/Documentation/driver-api/surface_aggregator/ssh.rst
 +++ b/Documentation/driver-api/surface_aggregator/ssh.rst
 @@ -13,6 +13,7 @@
@@ -2336,7 +5158,7 @@ index bf007d6c9873..18fd0f0aee84 100644
  
  Limitations and Observations
 diff --git a/drivers/platform/surface/aggregator/controller.c b/drivers/platform/surface/aggregator/controller.c
-index 43e765199137..54bfb1f3d2dc 100644
+index c6537a1b3a2ec..2c99f51ccd4ec 100644
 --- a/drivers/platform/surface/aggregator/controller.c
 +++ b/drivers/platform/surface/aggregator/controller.c
 @@ -994,7 +994,7 @@ static void ssam_handle_event(struct ssh_rtl *rtl,
@@ -2348,7 +5170,7 @@ index 43e765199137..54bfb1f3d2dc 100644
  	item->event.command_id = cmd->cid;
  	item->event.instance_id = cmd->iid;
  	memcpy(&item->event.data[0], data->ptr, data->len);
-@@ -1777,35 +1777,35 @@ EXPORT_SYMBOL_GPL(ssam_request_sync_with_buffer);
+@@ -1779,35 +1779,35 @@ EXPORT_SYMBOL_GPL(ssam_request_sync_with_buffer);
  
  SSAM_DEFINE_SYNC_REQUEST_R(ssam_ssh_get_firmware_version, __le32, {
  	.target_category = SSAM_SSH_TC_SAM,
@@ -2390,7 +5212,7 @@ index 43e765199137..54bfb1f3d2dc 100644
  	.instance_id     = 0x00,
  });
 diff --git a/drivers/platform/surface/aggregator/ssh_msgb.h b/drivers/platform/surface/aggregator/ssh_msgb.h
-index f3ecad92eefd..438873e06098 100644
+index f3ecad92eefd8..438873e060986 100644
 --- a/drivers/platform/surface/aggregator/ssh_msgb.h
 +++ b/drivers/platform/surface/aggregator/ssh_msgb.h
 @@ -189,8 +189,8 @@ static inline void msgb_push_cmd(struct msgbuf *msgb, u8 seq, u16 rqid,
@@ -2404,8 +5226,32 @@ index f3ecad92eefd..438873e06098 100644
  	__msgb_push_u8(msgb, rqst->instance_id);	/* Instance ID. */
  	__msgb_push_u16(msgb, rqid);			/* Request ID. */
  	__msgb_push_u8(msgb, rqst->command_id);		/* Command ID. */
+diff --git a/drivers/platform/surface/aggregator/ssh_request_layer.c b/drivers/platform/surface/aggregator/ssh_request_layer.c
+index 69132976d297e..90634dcacabf2 100644
+--- a/drivers/platform/surface/aggregator/ssh_request_layer.c
++++ b/drivers/platform/surface/aggregator/ssh_request_layer.c
+@@ -920,13 +920,14 @@ static void ssh_rtl_rx_command(struct ssh_ptl *p, const struct ssam_span *data)
+ 	 * Check if the message was intended for us. If not, drop it.
+ 	 *
+ 	 * Note: We will need to change this to handle debug messages. On newer
+-	 * generation devices, these seem to be sent to tid_out=0x03. We as
+-	 * host can still receive them as they can be forwarded via an override
+-	 * option on SAM, but doing so does not change tid_out=0x00.
++	 * generation devices, these seem to be sent to SSAM_SSH_TID_DEBUG. We
++	 * as host can still receive them as they can be forwarded via an
++	 * override option on SAM, but doing so does not change the target ID
++	 * to SSAM_SSH_TID_HOST.
+ 	 */
+-	if (command->tid_out != 0x00) {
++	if (command->tid != SSAM_SSH_TID_HOST) {
+ 		rtl_warn(rtl, "rtl: dropping message not intended for us (tid = %#04x)\n",
+-			 command->tid_out);
++			 command->tid);
+ 		return;
+ 	}
+ 
 diff --git a/include/linux/surface_aggregator/controller.h b/include/linux/surface_aggregator/controller.h
-index d11a1c6e3186..8932bc0bae18 100644
+index d11a1c6e3186a..8932bc0bae187 100644
 --- a/include/linux/surface_aggregator/controller.h
 +++ b/include/linux/surface_aggregator/controller.h
 @@ -912,10 +912,10 @@ enum ssam_event_mask {
@@ -2422,7 +5268,7 @@ index d11a1c6e3186..8932bc0bae18 100644
  #define SSAM_EVENT_REGISTRY_REG(tid)\
  	SSAM_EVENT_REGISTRY(SSAM_SSH_TC_REG, tid, 0x01, 0x02)
 diff --git a/include/linux/surface_aggregator/serial_hub.h b/include/linux/surface_aggregator/serial_hub.h
-index 45501b6e54e8..5c4ae1a26183 100644
+index 45501b6e54e8a..5c4ae1a261831 100644
 --- a/include/linux/surface_aggregator/serial_hub.h
 +++ b/include/linux/surface_aggregator/serial_hub.h
 @@ -83,23 +83,21 @@ enum ssh_payload_type {
@@ -2484,80 +5330,11 @@ index 45501b6e54e8..5c4ae1a26183 100644
   * Known SSH/EC target categories.
   *
 -- 
-2.39.0
-
-From 29ac02c869e3070532fa9f6a947dbde5125afe2d Mon Sep 17 00:00:00 2001
-From: Maximilian Luz <luzmaximilian@gmail.com>
-Date: Sat, 5 Nov 2022 21:30:58 +0100
-Subject: [PATCH] platform/surface: aggregator: Ignore command messages not
- intended for us
-
-It is possible that we (the host/kernel driver) receive command messages
-that are not intended for us. Ignore those for now.
-
-The whole story is a bit more complicated: It is possible to enable
-debug output on SAM, which is sent via SSH command messages. By default
-this output is sent to a debug connector, with its own target ID
-(TID=0x03). It is possible to override the target of the debug output
-and set it to the host/kernel driver. This, however, does not change the
-original target ID of the message. Meaning, we receive messages with
-TID=0x03 (debug) but expect to only receive messages with TID=0x00
-(host).
-
-The problem is that the different target ID also comes with a different
-scope of request IDs. In particular, these do not follow the standard
-event rules (i.e. do not fall into a set of small reserved values).
-Therefore, current message handling interprets them as responses to
-pending requests and tries to match them up via the request ID. However,
-these debug output messages are not in fact responses, and therefore
-this will at best fail to find the request and at worst pass on the
-wrong data as response for a request.
-
-Therefore ignore any command messages not intended for us (host) for
-now. We can implement support for the debug messages once we have a
-better understanding of them.
-
-Note that this may also provide a bit more stability and avoid some
-driver confusion in case any other targets want to talk to us in the
-future, since we don't yet know what to do with those as well. A warning
-for the dropped messages should suffice for now and also give us a
-chance of discovering new targets if they come along without any
-potential for bugs/instabilities.
-
-Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
-Patchset: surface-sam
----
- .../surface/aggregator/ssh_request_layer.c        | 15 +++++++++++++++
- 1 file changed, 15 insertions(+)
-
-diff --git a/drivers/platform/surface/aggregator/ssh_request_layer.c b/drivers/platform/surface/aggregator/ssh_request_layer.c
-index f5565570f16c..90634dcacabf 100644
---- a/drivers/platform/surface/aggregator/ssh_request_layer.c
-+++ b/drivers/platform/surface/aggregator/ssh_request_layer.c
-@@ -920,13 +920,13 @@
- 	 * Check if the message was intended for us. If not, drop it.
- 	 *
- 	 * Note: We will need to change this to handle debug messages. On newer
--	 * generation devices, these seem to be sent to tid_out=0x03. We as
-+	 * generation devices, these seem to be sent to SSAM_SSH_TID_DEBUG. We as
- 	 * host can still receive them as they can be forwarded via an override
--	 * option on SAM, but doing so does not change tid_out=0x00.
-+	 * option on SAM, but doing so does not change the target ID to SSAM_SSH_TID_HOST.
- 	 */
--	if (command->tid_out != 0x00) {
-+	if (command->tid != 0x00) {
- 		rtl_warn(rtl, "rtl: dropping message not intended for us (tid = %#04x)\n",
--			 command->tid_out);
-+			 command->tid);
- 		return;
- 	}
- 
--- 
-2.39.0
+2.39.2
 
-From 7b80425cbcee6aeac0cf312367c1f98df72f2093 Mon Sep 17 00:00:00 2001
+From 5542a89eaf6142f28befee2602ebe89fb6afccf4 Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
-Date: Sat, 5 Nov 2022 21:42:19 +0100
+Date: Fri, 2 Dec 2022 23:33:21 +0100
 Subject: [PATCH] platform/surface: aggregator: Add target and source IDs to
  command trace events
 
@@ -2571,13 +5348,16 @@ that interface). So it makes sense to also explicitly name the peers
 involved when tracing.
 
 Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/20221202223327.690880-4-luzmaximilian@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
 Patchset: surface-sam
 ---
  drivers/platform/surface/aggregator/trace.h | 73 +++++++++++++++++++--
  1 file changed, 67 insertions(+), 6 deletions(-)
 
 diff --git a/drivers/platform/surface/aggregator/trace.h b/drivers/platform/surface/aggregator/trace.h
-index 2a2c17771d01..55cc61bba1da 100644
+index 2a2c17771d014..55cc61bba1da6 100644
 --- a/drivers/platform/surface/aggregator/trace.h
 +++ b/drivers/platform/surface/aggregator/trace.h
 @@ -96,6 +96,7 @@ TRACE_DEFINE_ENUM(SSAM_SSH_TC_POS);
@@ -2747,11 +5527,11 @@ index 2a2c17771d01..55cc61bba1da 100644
  		ssam_show_generic_u8_field(__entry->cid),
  		ssam_show_generic_u8_field(__entry->iid),
 -- 
-2.39.0
+2.39.2
 
-From 28f119067bd5982c043f3822b01a864e60d6ec54 Mon Sep 17 00:00:00 2001
+From 45414ba7fa9d6ce1889626710e24f71193c4e4d5 Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
-Date: Sat, 5 Nov 2022 21:32:16 +0100
+Date: Fri, 2 Dec 2022 23:33:22 +0100
 Subject: [PATCH] platform/surface: aggregator_hub: Use target-ID enum instead
  of hard-coding values
 
@@ -2759,13 +5539,16 @@ Instead of hard-coding the target ID, use the respective enum
 ssam_ssh_tid value.
 
 Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/20221202223327.690880-5-luzmaximilian@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
 Patchset: surface-sam
 ---
  drivers/platform/surface/surface_aggregator_hub.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/drivers/platform/surface/surface_aggregator_hub.c b/drivers/platform/surface/surface_aggregator_hub.c
-index 43061514be38..62f27cdb6ca8 100644
+index 43061514be382..62f27cdb6ca8f 100644
 --- a/drivers/platform/surface/surface_aggregator_hub.c
 +++ b/drivers/platform/surface/surface_aggregator_hub.c
 @@ -214,7 +214,7 @@ static void ssam_hub_remove(struct ssam_device *sdev)
@@ -2787,11 +5570,11 @@ index 43061514be38..62f27cdb6ca8 100644
  	.instance_id     = 0x00,
  });
 -- 
-2.39.0
+2.39.2
 
-From e9cc6b4179e0e913d5203273742b0ad40f9da048 Mon Sep 17 00:00:00 2001
+From e436e81159bc3941a3d744143b400a859afbef11 Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
-Date: Sat, 5 Nov 2022 21:33:26 +0100
+Date: Fri, 2 Dec 2022 23:33:23 +0100
 Subject: [PATCH] platform/surface: aggregator_tabletsw: Use target-ID enum
  instead of hard-coding values
 
@@ -2799,13 +5582,16 @@ Instead of hard-coding the target ID, use the respective enum
 ssam_ssh_tid value.
 
 Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/20221202223327.690880-6-luzmaximilian@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
 Patchset: surface-sam
 ---
  drivers/platform/surface/surface_aggregator_tabletsw.c | 6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/drivers/platform/surface/surface_aggregator_tabletsw.c b/drivers/platform/surface/surface_aggregator_tabletsw.c
-index 27d95a6a7851..bd8cd453c393 100644
+index 27d95a6a78513..bd8cd453c393a 100644
 --- a/drivers/platform/surface/surface_aggregator_tabletsw.c
 +++ b/drivers/platform/surface/surface_aggregator_tabletsw.c
 @@ -247,7 +247,7 @@ static bool ssam_kip_cover_state_is_tablet_mode(struct ssam_tablet_sw *sw, u32 s
@@ -2836,11 +5622,11 @@ index 27d95a6a7851..bd8cd453c393 100644
  	.instance_id     = 0x00,
  });
 -- 
-2.39.0
+2.39.2
 
-From 118efac5894275e2910b1e6a7764da49ef78a017 Mon Sep 17 00:00:00 2001
+From d1b11ceedce2dd2ed1b4e3601d2ccaa873d9b4ba Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
-Date: Sat, 5 Nov 2022 21:34:06 +0100
+Date: Fri, 2 Dec 2022 23:33:24 +0100
 Subject: [PATCH] platform/surface: dtx: Use target-ID enum instead of
  hard-coding values
 
@@ -2848,13 +5634,16 @@ Instead of hard-coding the target ID, use the respective enum
 ssam_ssh_tid value.
 
 Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/20221202223327.690880-7-luzmaximilian@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
 Patchset: surface-sam
 ---
  drivers/platform/surface/surface_dtx.c | 18 +++++++++---------
  1 file changed, 9 insertions(+), 9 deletions(-)
 
 diff --git a/drivers/platform/surface/surface_dtx.c b/drivers/platform/surface/surface_dtx.c
-index ed36944467f9..0de76a784a35 100644
+index ed36944467f9f..0de76a784a35f 100644
 --- a/drivers/platform/surface/surface_dtx.c
 +++ b/drivers/platform/surface/surface_dtx.c
 @@ -71,63 +71,63 @@ static_assert(sizeof(struct ssam_bas_base_info) == 2);
@@ -2931,11 +5720,11 @@ index ed36944467f9..0de76a784a35 100644
  	.instance_id     = 0x00,
  });
 -- 
-2.39.0
+2.39.2
 
-From 1bf091f4db2f290dc82252ae0479f92e37dc87b0 Mon Sep 17 00:00:00 2001
+From 392ce2f40092dfc98134a81d30185e3679489d27 Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
-Date: Sat, 5 Nov 2022 21:40:06 +0100
+Date: Fri, 2 Dec 2022 23:33:25 +0100
 Subject: [PATCH] HID: surface-hid: Use target-ID enum instead of hard-coding
  values
 
@@ -2943,13 +5732,16 @@ Instead of hard-coding the target ID, use the respective enum
 ssam_ssh_tid value.
 
 Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/20221202223327.690880-8-luzmaximilian@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
 Patchset: surface-sam
 ---
  drivers/hid/surface-hid/surface_kbd.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/drivers/hid/surface-hid/surface_kbd.c b/drivers/hid/surface-hid/surface_kbd.c
-index 0635341bc517..42933bf3e925 100644
+index 0635341bc5174..42933bf3e925f 100644
 --- a/drivers/hid/surface-hid/surface_kbd.c
 +++ b/drivers/hid/surface-hid/surface_kbd.c
 @@ -250,7 +250,7 @@ static int surface_kbd_probe(struct platform_device *pdev)
@@ -2962,11 +5754,11 @@ index 0635341bc517..42933bf3e925 100644
  	shid->uid.function = 0;
  
 -- 
-2.39.0
+2.39.2
 
-From 9530d700f41edbddd880d2bec9e3b6547de811f3 Mon Sep 17 00:00:00 2001
+From 5d06854e48e40547414d309f9b298ca8d5390fe6 Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
-Date: Sat, 5 Nov 2022 21:45:28 +0100
+Date: Fri, 2 Dec 2022 23:33:26 +0100
 Subject: [PATCH] platform/surface: aggregator: Enforce use of target-ID enum
  in device ID macros
 
@@ -2981,6 +5773,10 @@ know the names for the target IDs, use the same trick for them as well.
 Also rename the SSAM_ANY_x macros to SSAM_SSH_x_ANY to better fit in.
 
 Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Acked-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Link: https://lore.kernel.org/r/20221202223327.690880-9-luzmaximilian@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
 Patchset: surface-sam
 ---
  drivers/hid/surface-hid/surface_hid.c         |  2 +-
@@ -2994,7 +5790,7 @@ Patchset: surface-sam
  8 files changed, 35 insertions(+), 35 deletions(-)
 
 diff --git a/drivers/hid/surface-hid/surface_hid.c b/drivers/hid/surface-hid/surface_hid.c
-index d4aa8c81903a..aa80d83a83d1 100644
+index d4aa8c81903ae..aa80d83a83d1b 100644
 --- a/drivers/hid/surface-hid/surface_hid.c
 +++ b/drivers/hid/surface-hid/surface_hid.c
 @@ -230,7 +230,7 @@ static void surface_hid_remove(struct ssam_device *sdev)
@@ -3007,7 +5803,7 @@ index d4aa8c81903a..aa80d83a83d1 100644
  };
  MODULE_DEVICE_TABLE(ssam, surface_hid_match);
 diff --git a/drivers/platform/surface/surface_aggregator_hub.c b/drivers/platform/surface/surface_aggregator_hub.c
-index 62f27cdb6ca8..6abd1efe2088 100644
+index 62f27cdb6ca8f..6abd1efe20883 100644
 --- a/drivers/platform/surface/surface_aggregator_hub.c
 +++ b/drivers/platform/surface/surface_aggregator_hub.c
 @@ -348,8 +348,8 @@ static const struct ssam_hub_desc kip_hub = {
@@ -3022,7 +5818,7 @@ index 62f27cdb6ca8..6abd1efe2088 100644
  };
  MODULE_DEVICE_TABLE(ssam, ssam_hub_match);
 diff --git a/drivers/platform/surface/surface_aggregator_tabletsw.c b/drivers/platform/surface/surface_aggregator_tabletsw.c
-index bd8cd453c393..6147aa887939 100644
+index bd8cd453c393a..6147aa8879391 100644
 --- a/drivers/platform/surface/surface_aggregator_tabletsw.c
 +++ b/drivers/platform/surface/surface_aggregator_tabletsw.c
 @@ -510,8 +510,8 @@ static const struct ssam_tablet_sw_desc ssam_pos_sw_desc = {
@@ -3037,7 +5833,7 @@ index bd8cd453c393..6147aa887939 100644
  };
  MODULE_DEVICE_TABLE(ssam, ssam_tablet_sw_match);
 diff --git a/drivers/platform/surface/surface_dtx.c b/drivers/platform/surface/surface_dtx.c
-index 0de76a784a35..30cbde278c59 100644
+index 0de76a784a35f..30cbde278c599 100644
 --- a/drivers/platform/surface/surface_dtx.c
 +++ b/drivers/platform/surface/surface_dtx.c
 @@ -1214,7 +1214,7 @@ static void surface_dtx_ssam_remove(struct ssam_device *sdev)
@@ -3050,7 +5846,7 @@ index 0de76a784a35..30cbde278c59 100644
  };
  MODULE_DEVICE_TABLE(ssam, surface_dtx_ssam_match);
 diff --git a/drivers/platform/surface/surface_platform_profile.c b/drivers/platform/surface/surface_platform_profile.c
-index fbf2e11fd6ce..f433a13c3689 100644
+index fbf2e11fd6ce7..f433a13c3689a 100644
 --- a/drivers/platform/surface/surface_platform_profile.c
 +++ b/drivers/platform/surface/surface_platform_profile.c
 @@ -169,7 +169,7 @@ static void surface_platform_profile_remove(struct ssam_device *sdev)
@@ -3063,7 +5859,7 @@ index fbf2e11fd6ce..f433a13c3689 100644
  };
  MODULE_DEVICE_TABLE(ssam, ssam_platform_profile_match);
 diff --git a/drivers/power/supply/surface_battery.c b/drivers/power/supply/surface_battery.c
-index 540707882bb0..19d2f8834e56 100644
+index 540707882bb0a..19d2f8834e56d 100644
 --- a/drivers/power/supply/surface_battery.c
 +++ b/drivers/power/supply/surface_battery.c
 @@ -852,8 +852,8 @@ static const struct spwr_psy_properties spwr_psy_props_bat2_sb3 = {
@@ -3078,7 +5874,7 @@ index 540707882bb0..19d2f8834e56 100644
  };
  MODULE_DEVICE_TABLE(ssam, surface_battery_match);
 diff --git a/drivers/power/supply/surface_charger.c b/drivers/power/supply/surface_charger.c
-index 59182d55742d..cabdd8da12d0 100644
+index 59182d55742d0..cabdd8da12d08 100644
 --- a/drivers/power/supply/surface_charger.c
 +++ b/drivers/power/supply/surface_charger.c
 @@ -260,7 +260,7 @@ static const struct spwr_psy_properties spwr_psy_props_adp1 = {
@@ -3091,7 +5887,7 @@ index 59182d55742d..cabdd8da12d0 100644
  };
  MODULE_DEVICE_TABLE(ssam, surface_ac_match);
 diff --git a/include/linux/surface_aggregator/device.h b/include/linux/surface_aggregator/device.h
-index 46c45d1b6368..4da20b7a0ee5 100644
+index 46c45d1b63682..4da20b7a0ee5e 100644
 --- a/include/linux/surface_aggregator/device.h
 +++ b/include/linux/surface_aggregator/device.h
 @@ -68,9 +68,9 @@ struct ssam_device_uid {
@@ -3194,11 +5990,11 @@ index 46c45d1b6368..4da20b7a0ee5 100644
  /*
   * enum ssam_device_flags - Flags for SSAM client devices.
 -- 
-2.39.0
+2.39.2
 
-From f905337cf4c31e3cc429b94ab9586b370b882c23 Mon Sep 17 00:00:00 2001
+From c2d159b625d24c5df3438a7e1080bc13cb68c713 Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
-Date: Sat, 5 Nov 2022 21:46:37 +0100
+Date: Fri, 2 Dec 2022 23:33:27 +0100
 Subject: [PATCH] platform/surface: aggregator_registry: Fix target-ID of
  base-hub
 
@@ -3207,7 +6003,15 @@ peripherals). However, even though it manages such devices with the KIP
 target ID, the base hub itself is actually accessed via the SAM target
 ID. So set it accordingly.
 
+Note that the target ID of the hub can be chosen arbitrarily and does
+not directly correspond to any physical or virtual component of the EC.
+This change is only a code improvement intended for consistency and
+clarity, it does not fix an actual bug.
+
 Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/20221202223327.690880-10-luzmaximilian@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
 Patchset: surface-sam
 ---
  drivers/platform/surface/surface_aggregator_hub.c      | 2 +-
@@ -3215,7 +6019,7 @@ Patchset: surface-sam
  2 files changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/drivers/platform/surface/surface_aggregator_hub.c b/drivers/platform/surface/surface_aggregator_hub.c
-index 6abd1efe2088..8b8b80228c14 100644
+index 6abd1efe20883..8b8b80228c147 100644
 --- a/drivers/platform/surface/surface_aggregator_hub.c
 +++ b/drivers/platform/surface/surface_aggregator_hub.c
 @@ -349,7 +349,7 @@ static const struct ssam_hub_desc kip_hub = {
@@ -3228,7 +6032,7 @@ index 6abd1efe2088..8b8b80228c14 100644
  };
  MODULE_DEVICE_TABLE(ssam, ssam_hub_match);
 diff --git a/drivers/platform/surface/surface_aggregator_registry.c b/drivers/platform/surface/surface_aggregator_registry.c
-index 023f126121d7..296f72d52e6a 100644
+index 023f126121d7d..296f72d52e6a6 100644
 --- a/drivers/platform/surface/surface_aggregator_registry.c
 +++ b/drivers/platform/surface/surface_aggregator_registry.c
 @@ -46,7 +46,7 @@ static const struct software_node ssam_node_hub_kip = {
@@ -3241,9 +6045,1068 @@ index 023f126121d7..296f72d52e6a 100644
  };
  
 -- 
-2.39.0
+2.39.2
+
+From d37d589914fbc1c54ae9e28fb6261e16346b474e Mon Sep 17 00:00:00 2001
+From: Maximilian Luz <luzmaximilian@gmail.com>
+Date: Tue, 20 Dec 2022 18:56:08 +0100
+Subject: [PATCH] platform/surface: aggregator: Rename top-level request
+ functions to avoid ambiguities
+
+We currently have a struct ssam_request_sync and a function
+ssam_request_sync(). While this is valid C, there are some downsides to
+it.
+
+One of these is that current Sphinx versions (>= 3.0) cannot
+disambiguate between the two (see disucssion and pull request linked
+below). It instead emits a "WARNING: Duplicate C declaration" and links
+for the struct and function in the resulting documentation link to the
+same entry (i.e. both to either function or struct documentation)
+instead of their respective own entries.
+
+While we could just ignore that and wait for a fix, there's also a point
+to be made that the current naming can be somewhat confusing when
+searching (e.g. via grep) or trying to understand the levels of
+abstraction at play:
+
+We currently have struct ssam_request_sync and associated functions
+ssam_request_sync_[alloc|free|init|wait|...]() operating on this struct.
+However, function ssam_request_sync() is one abstraction level above
+this. Similarly, ssam_request_sync_with_buffer() is not a function
+operating on struct ssam_request_sync, but rather a sibling to
+ssam_request_sync(), both using the struct under the hood.
+
+Therefore, rename the top level request functions:
+
+  ssam_request_sync() -> ssam_request_do_sync()
+  ssam_request_sync_with_buffer() -> ssam_request_do_sync_with_buffer()
+  ssam_request_sync_onstack() -> ssam_request_do_sync_onstack()
+
+Link: https://lore.kernel.org/all/085e0ada65c11da9303d07e70c510dc45f21315b.1656756450.git.mchehab@kernel.org/
+Link: https://github.com/sphinx-doc/sphinx/pull/8313
+Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/20221220175608.1436273-2-luzmaximilian@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Patchset: surface-sam
+---
+ .../driver-api/surface_aggregator/client.rst  |  8 +--
+ drivers/hid/surface-hid/surface_hid.c         |  6 +-
+ drivers/hid/surface-hid/surface_kbd.c         |  6 +-
+ drivers/platform/surface/aggregator/bus.c     |  6 +-
+ .../platform/surface/aggregator/controller.c  | 32 +++++------
+ .../platform/surface/surface_acpi_notify.c    |  2 +-
+ .../surface/surface_aggregator_cdev.c         |  6 +-
+ .../surface/surface_aggregator_tabletsw.c     |  2 +-
+ include/linux/surface_aggregator/controller.h | 56 +++++++++----------
+ include/linux/surface_aggregator/device.h     |  8 +--
+ 10 files changed, 66 insertions(+), 66 deletions(-)
+
+diff --git a/Documentation/driver-api/surface_aggregator/client.rst b/Documentation/driver-api/surface_aggregator/client.rst
+index 9d7411223a848..e100ab0a24cc4 100644
+--- a/Documentation/driver-api/surface_aggregator/client.rst
++++ b/Documentation/driver-api/surface_aggregator/client.rst
+@@ -19,7 +19,7 @@
+ .. |ssam_notifier_unregister| replace:: :c:func:`ssam_notifier_unregister`
+ .. |ssam_device_notifier_register| replace:: :c:func:`ssam_device_notifier_register`
+ .. |ssam_device_notifier_unregister| replace:: :c:func:`ssam_device_notifier_unregister`
+-.. |ssam_request_sync| replace:: :c:func:`ssam_request_sync`
++.. |ssam_request_do_sync| replace:: :c:func:`ssam_request_do_sync`
+ .. |ssam_event_mask| replace:: :c:type:`enum ssam_event_mask <ssam_event_mask>`
+ 
+ 
+@@ -209,12 +209,12 @@ data received from it is converted from little-endian to host endianness.
+             * with the SSAM_REQUEST_HAS_RESPONSE flag set in the specification
+             * above.
+             */
+-           status = ssam_request_sync(ctrl, &rqst, &resp);
++           status = ssam_request_do_sync(ctrl, &rqst, &resp);
+ 
+            /*
+             * Alternatively use
+             *
+-            *   ssam_request_sync_onstack(ctrl, &rqst, &resp, sizeof(arg_le));
++            *   ssam_request_do_sync_onstack(ctrl, &rqst, &resp, sizeof(arg_le));
+             *
+             * to perform the request, allocating the message buffer directly
+             * on the stack as opposed to allocation via kzalloc().
+@@ -230,7 +230,7 @@ data received from it is converted from little-endian to host endianness.
+            return status;
+    }
+ 
+-Note that |ssam_request_sync| in its essence is a wrapper over lower-level
++Note that |ssam_request_do_sync| in its essence is a wrapper over lower-level
+ request primitives, which may also be used to perform requests. Refer to its
+ implementation and documentation for more details.
+ 
+diff --git a/drivers/hid/surface-hid/surface_hid.c b/drivers/hid/surface-hid/surface_hid.c
+index aa80d83a83d1b..61e5814b0ad7d 100644
+--- a/drivers/hid/surface-hid/surface_hid.c
++++ b/drivers/hid/surface-hid/surface_hid.c
+@@ -80,7 +80,7 @@ static int ssam_hid_get_descriptor(struct surface_hid_device *shid, u8 entry, u8
+ 
+ 		rsp.length = 0;
+ 
+-		status = ssam_retry(ssam_request_sync_onstack, shid->ctrl, &rqst, &rsp,
++		status = ssam_retry(ssam_request_do_sync_onstack, shid->ctrl, &rqst, &rsp,
+ 				    sizeof(*slice));
+ 		if (status)
+ 			return status;
+@@ -131,7 +131,7 @@ static int ssam_hid_set_raw_report(struct surface_hid_device *shid, u8 rprt_id,
+ 
+ 	buf[0] = rprt_id;
+ 
+-	return ssam_retry(ssam_request_sync, shid->ctrl, &rqst, NULL);
++	return ssam_retry(ssam_request_do_sync, shid->ctrl, &rqst, NULL);
+ }
+ 
+ static int ssam_hid_get_raw_report(struct surface_hid_device *shid, u8 rprt_id, u8 *buf, size_t len)
+@@ -151,7 +151,7 @@ static int ssam_hid_get_raw_report(struct surface_hid_device *shid, u8 rprt_id,
+ 	rsp.length = 0;
+ 	rsp.pointer = buf;
+ 
+-	return ssam_retry(ssam_request_sync_onstack, shid->ctrl, &rqst, &rsp, sizeof(rprt_id));
++	return ssam_retry(ssam_request_do_sync_onstack, shid->ctrl, &rqst, &rsp, sizeof(rprt_id));
+ }
+ 
+ static u32 ssam_hid_event_fn(struct ssam_event_notifier *nf, const struct ssam_event *event)
+diff --git a/drivers/hid/surface-hid/surface_kbd.c b/drivers/hid/surface-hid/surface_kbd.c
+index 42933bf3e925f..4fbce201db6a1 100644
+--- a/drivers/hid/surface-hid/surface_kbd.c
++++ b/drivers/hid/surface-hid/surface_kbd.c
+@@ -49,7 +49,7 @@ static int ssam_kbd_get_descriptor(struct surface_hid_device *shid, u8 entry, u8
+ 	rsp.length = 0;
+ 	rsp.pointer = buf;
+ 
+-	status = ssam_retry(ssam_request_sync_onstack, shid->ctrl, &rqst, &rsp, sizeof(entry));
++	status = ssam_retry(ssam_request_do_sync_onstack, shid->ctrl, &rqst, &rsp, sizeof(entry));
+ 	if (status)
+ 		return status;
+ 
+@@ -75,7 +75,7 @@ static int ssam_kbd_set_caps_led(struct surface_hid_device *shid, bool value)
+ 	rqst.length = sizeof(value_u8);
+ 	rqst.payload = &value_u8;
+ 
+-	return ssam_retry(ssam_request_sync_onstack, shid->ctrl, &rqst, NULL, sizeof(value_u8));
++	return ssam_retry(ssam_request_do_sync_onstack, shid->ctrl, &rqst, NULL, sizeof(value_u8));
+ }
+ 
+ static int ssam_kbd_get_feature_report(struct surface_hid_device *shid, u8 *buf, size_t len)
+@@ -97,7 +97,7 @@ static int ssam_kbd_get_feature_report(struct surface_hid_device *shid, u8 *buf,
+ 	rsp.length = 0;
+ 	rsp.pointer = buf;
+ 
+-	status = ssam_retry(ssam_request_sync_onstack, shid->ctrl, &rqst, &rsp, sizeof(payload));
++	status = ssam_retry(ssam_request_do_sync_onstack, shid->ctrl, &rqst, &rsp, sizeof(payload));
+ 	if (status)
+ 		return status;
+ 
+diff --git a/drivers/platform/surface/aggregator/bus.c b/drivers/platform/surface/aggregator/bus.c
+index de539938896e2..7004eb4a63a28 100644
+--- a/drivers/platform/surface/aggregator/bus.c
++++ b/drivers/platform/surface/aggregator/bus.c
+@@ -136,9 +136,9 @@ int ssam_device_add(struct ssam_device *sdev)
+ 	 * is always valid and can be used for requests as long as the client
+ 	 * device we add here is registered as child under it. This essentially
+ 	 * guarantees that the client driver can always expect the preconditions
+-	 * for functions like ssam_request_sync (controller has to be started
+-	 * and is not suspended) to hold and thus does not have to check for
+-	 * them.
++	 * for functions like ssam_request_do_sync() (controller has to be
++	 * started and is not suspended) to hold and thus does not have to check
++	 * for them.
+ 	 *
+ 	 * Note that for this to work, the controller has to be a parent device.
+ 	 * If it is not a direct parent, care has to be taken that the device is
+diff --git a/drivers/platform/surface/aggregator/controller.c b/drivers/platform/surface/aggregator/controller.c
+index 2c99f51ccd4ec..535581c0471c5 100644
+--- a/drivers/platform/surface/aggregator/controller.c
++++ b/drivers/platform/surface/aggregator/controller.c
+@@ -1674,7 +1674,7 @@ int ssam_request_sync_submit(struct ssam_controller *ctrl,
+ EXPORT_SYMBOL_GPL(ssam_request_sync_submit);
+ 
+ /**
+- * ssam_request_sync() - Execute a synchronous request.
++ * ssam_request_do_sync() - Execute a synchronous request.
+  * @ctrl: The controller via which the request will be submitted.
+  * @spec: The request specification and payload.
+  * @rsp:  The response buffer.
+@@ -1686,9 +1686,9 @@ EXPORT_SYMBOL_GPL(ssam_request_sync_submit);
+  *
+  * Return: Returns the status of the request or any failure during setup.
+  */
+-int ssam_request_sync(struct ssam_controller *ctrl,
+-		      const struct ssam_request *spec,
+-		      struct ssam_response *rsp)
++int ssam_request_do_sync(struct ssam_controller *ctrl,
++			 const struct ssam_request *spec,
++			 struct ssam_response *rsp)
+ {
+ 	struct ssam_request_sync *rqst;
+ 	struct ssam_span buf;
+@@ -1722,10 +1722,10 @@ int ssam_request_sync(struct ssam_controller *ctrl,
+ 	ssam_request_sync_free(rqst);
+ 	return status;
+ }
+-EXPORT_SYMBOL_GPL(ssam_request_sync);
++EXPORT_SYMBOL_GPL(ssam_request_do_sync);
+ 
+ /**
+- * ssam_request_sync_with_buffer() - Execute a synchronous request with the
++ * ssam_request_do_sync_with_buffer() - Execute a synchronous request with the
+  * provided buffer as back-end for the message buffer.
+  * @ctrl: The controller via which the request will be submitted.
+  * @spec: The request specification and payload.
+@@ -1738,17 +1738,17 @@ EXPORT_SYMBOL_GPL(ssam_request_sync);
+  * SSH_COMMAND_MESSAGE_LENGTH() macro can be used to compute the required
+  * message buffer size.
+  *
+- * This function does essentially the same as ssam_request_sync(), but instead
+- * of dynamically allocating the request and message data buffer, it uses the
+- * provided message data buffer and stores the (small) request struct on the
+- * heap.
++ * This function does essentially the same as ssam_request_do_sync(), but
++ * instead of dynamically allocating the request and message data buffer, it
++ * uses the provided message data buffer and stores the (small) request struct
++ * on the heap.
+  *
+  * Return: Returns the status of the request or any failure during setup.
+  */
+-int ssam_request_sync_with_buffer(struct ssam_controller *ctrl,
+-				  const struct ssam_request *spec,
+-				  struct ssam_response *rsp,
+-				  struct ssam_span *buf)
++int ssam_request_do_sync_with_buffer(struct ssam_controller *ctrl,
++				     const struct ssam_request *spec,
++				     struct ssam_response *rsp,
++				     struct ssam_span *buf)
+ {
+ 	struct ssam_request_sync rqst;
+ 	ssize_t len;
+@@ -1772,7 +1772,7 @@ int ssam_request_sync_with_buffer(struct ssam_controller *ctrl,
+ 
+ 	return status;
+ }
+-EXPORT_SYMBOL_GPL(ssam_request_sync_with_buffer);
++EXPORT_SYMBOL_GPL(ssam_request_do_sync_with_buffer);
+ 
+ 
+ /* -- Internal SAM requests. ------------------------------------------------ */
+@@ -1864,7 +1864,7 @@ static int __ssam_ssh_event_request(struct ssam_controller *ctrl,
+ 	result.length = 0;
+ 	result.pointer = &buf;
+ 
+-	status = ssam_retry(ssam_request_sync_onstack, ctrl, &rqst, &result,
++	status = ssam_retry(ssam_request_do_sync_onstack, ctrl, &rqst, &result,
+ 			    sizeof(params));
+ 
+ 	return status < 0 ? status : buf;
+diff --git a/drivers/platform/surface/surface_acpi_notify.c b/drivers/platform/surface/surface_acpi_notify.c
+index 50500e562963d..897cdd9c3aae8 100644
+--- a/drivers/platform/surface/surface_acpi_notify.c
++++ b/drivers/platform/surface/surface_acpi_notify.c
+@@ -590,7 +590,7 @@ static acpi_status san_rqst(struct san_data *d, struct gsb_buffer *buffer)
+ 		return san_rqst_fixup_suspended(d, &rqst, buffer);
+ 	}
+ 
+-	status = __ssam_retry(ssam_request_sync_onstack, SAN_REQUEST_NUM_TRIES,
++	status = __ssam_retry(ssam_request_do_sync_onstack, SAN_REQUEST_NUM_TRIES,
+ 			      d->ctrl, &rqst, &rsp, SAN_GSB_MAX_RQSX_PAYLOAD);
+ 
+ 	if (!status) {
+diff --git a/drivers/platform/surface/surface_aggregator_cdev.c b/drivers/platform/surface/surface_aggregator_cdev.c
+index 492c82e691827..07f0ed658369b 100644
+--- a/drivers/platform/surface/surface_aggregator_cdev.c
++++ b/drivers/platform/surface/surface_aggregator_cdev.c
+@@ -302,8 +302,8 @@ static long ssam_cdev_request(struct ssam_cdev_client *client, struct ssam_cdev_
+ 		 * theoretical maximum (SSH_COMMAND_MAX_PAYLOAD_SIZE) of the
+ 		 * underlying protocol (note that nothing remotely this size
+ 		 * should ever be allocated in any normal case). This size is
+-		 * validated later in ssam_request_sync(), for allocation the
+-		 * bound imposed by u16 should be enough.
++		 * validated later in ssam_request_do_sync(), for allocation
++		 * the bound imposed by u16 should be enough.
+ 		 */
+ 		spec.payload = kzalloc(spec.length, GFP_KERNEL);
+ 		if (!spec.payload) {
+@@ -342,7 +342,7 @@ static long ssam_cdev_request(struct ssam_cdev_client *client, struct ssam_cdev_
+ 	}
+ 
+ 	/* Perform request. */
+-	status = ssam_request_sync(client->cdev->ctrl, &spec, &rsp);
++	status = ssam_request_do_sync(client->cdev->ctrl, &spec, &rsp);
+ 	if (status)
+ 		goto out;
+ 
+diff --git a/drivers/platform/surface/surface_aggregator_tabletsw.c b/drivers/platform/surface/surface_aggregator_tabletsw.c
+index 6147aa8879391..9fed800c7cc09 100644
+--- a/drivers/platform/surface/surface_aggregator_tabletsw.c
++++ b/drivers/platform/surface/surface_aggregator_tabletsw.c
+@@ -382,7 +382,7 @@ static int ssam_pos_get_sources_list(struct ssam_tablet_sw *sw, struct ssam_sour
+ 	rsp.length = 0;
+ 	rsp.pointer = (u8 *)sources;
+ 
+-	status = ssam_retry(ssam_request_sync_onstack, sw->sdev->ctrl, &rqst, &rsp, 0);
++	status = ssam_retry(ssam_request_do_sync_onstack, sw->sdev->ctrl, &rqst, &rsp, 0);
+ 	if (status)
+ 		return status;
+ 
+diff --git a/include/linux/surface_aggregator/controller.h b/include/linux/surface_aggregator/controller.h
+index 8932bc0bae187..cb7980805920a 100644
+--- a/include/linux/surface_aggregator/controller.h
++++ b/include/linux/surface_aggregator/controller.h
+@@ -207,17 +207,17 @@ static inline int ssam_request_sync_wait(struct ssam_request_sync *rqst)
+ 	return rqst->status;
+ }
+ 
+-int ssam_request_sync(struct ssam_controller *ctrl,
+-		      const struct ssam_request *spec,
+-		      struct ssam_response *rsp);
++int ssam_request_do_sync(struct ssam_controller *ctrl,
++			 const struct ssam_request *spec,
++			 struct ssam_response *rsp);
+ 
+-int ssam_request_sync_with_buffer(struct ssam_controller *ctrl,
+-				  const struct ssam_request *spec,
+-				  struct ssam_response *rsp,
+-				  struct ssam_span *buf);
++int ssam_request_do_sync_with_buffer(struct ssam_controller *ctrl,
++				     const struct ssam_request *spec,
++				     struct ssam_response *rsp,
++				     struct ssam_span *buf);
+ 
+ /**
+- * ssam_request_sync_onstack - Execute a synchronous request on the stack.
++ * ssam_request_do_sync_onstack - Execute a synchronous request on the stack.
+  * @ctrl: The controller via which the request is submitted.
+  * @rqst: The request specification.
+  * @rsp:  The response buffer.
+@@ -227,7 +227,7 @@ int ssam_request_sync_with_buffer(struct ssam_controller *ctrl,
+  * fully initializes it via the provided request specification, submits it,
+  * and finally waits for its completion before returning its status. This
+  * helper macro essentially allocates the request message buffer on the stack
+- * and then calls ssam_request_sync_with_buffer().
++ * and then calls ssam_request_do_sync_with_buffer().
+  *
+  * Note: The @payload_len parameter specifies the maximum payload length, used
+  * for buffer allocation. The actual payload length may be smaller.
+@@ -235,12 +235,12 @@ int ssam_request_sync_with_buffer(struct ssam_controller *ctrl,
+  * Return: Returns the status of the request or any failure during setup, i.e.
+  * zero on success and a negative value on failure.
+  */
+-#define ssam_request_sync_onstack(ctrl, rqst, rsp, payload_len)			\
++#define ssam_request_do_sync_onstack(ctrl, rqst, rsp, payload_len)		\
+ 	({									\
+ 		u8 __data[SSH_COMMAND_MESSAGE_LENGTH(payload_len)];		\
+ 		struct ssam_span __buf = { &__data[0], ARRAY_SIZE(__data) };	\
+ 										\
+-		ssam_request_sync_with_buffer(ctrl, rqst, rsp, &__buf);		\
++		ssam_request_do_sync_with_buffer(ctrl, rqst, rsp, &__buf);	\
+ 	})
+ 
+ /**
+@@ -349,7 +349,7 @@ struct ssam_request_spec_md {
+  * zero on success and negative on failure. The ``ctrl`` parameter is the
+  * controller via which the request is being sent.
+  *
+- * Refer to ssam_request_sync_onstack() for more details on the behavior of
++ * Refer to ssam_request_do_sync_onstack() for more details on the behavior of
+  * the generated function.
+  */
+ #define SSAM_DEFINE_SYNC_REQUEST_N(name, spec...)				\
+@@ -366,7 +366,7 @@ struct ssam_request_spec_md {
+ 		rqst.length = 0;						\
+ 		rqst.payload = NULL;						\
+ 										\
+-		return ssam_request_sync_onstack(ctrl, &rqst, NULL, 0);		\
++		return ssam_request_do_sync_onstack(ctrl, &rqst, NULL, 0);	\
+ 	}
+ 
+ /**
+@@ -389,7 +389,7 @@ struct ssam_request_spec_md {
+  * parameter is the controller via which the request is sent. The request
+  * argument is specified via the ``arg`` pointer.
+  *
+- * Refer to ssam_request_sync_onstack() for more details on the behavior of
++ * Refer to ssam_request_do_sync_onstack() for more details on the behavior of
+  * the generated function.
+  */
+ #define SSAM_DEFINE_SYNC_REQUEST_W(name, atype, spec...)			\
+@@ -406,8 +406,8 @@ struct ssam_request_spec_md {
+ 		rqst.length = sizeof(atype);					\
+ 		rqst.payload = (u8 *)arg;					\
+ 										\
+-		return ssam_request_sync_onstack(ctrl, &rqst, NULL,		\
+-						 sizeof(atype));		\
++		return ssam_request_do_sync_onstack(ctrl, &rqst, NULL,		\
++						    sizeof(atype));		\
+ 	}
+ 
+ /**
+@@ -430,7 +430,7 @@ struct ssam_request_spec_md {
+  * the controller via which the request is sent. The request's return value is
+  * written to the memory pointed to by the ``ret`` parameter.
+  *
+- * Refer to ssam_request_sync_onstack() for more details on the behavior of
++ * Refer to ssam_request_do_sync_onstack() for more details on the behavior of
+  * the generated function.
+  */
+ #define SSAM_DEFINE_SYNC_REQUEST_R(name, rtype, spec...)			\
+@@ -453,7 +453,7 @@ struct ssam_request_spec_md {
+ 		rsp.length = 0;							\
+ 		rsp.pointer = (u8 *)ret;					\
+ 										\
+-		status = ssam_request_sync_onstack(ctrl, &rqst, &rsp, 0);	\
++		status = ssam_request_do_sync_onstack(ctrl, &rqst, &rsp, 0);	\
+ 		if (status)							\
+ 			return status;						\
+ 										\
+@@ -491,7 +491,7 @@ struct ssam_request_spec_md {
+  * request argument is specified via the ``arg`` pointer. The request's return
+  * value is written to the memory pointed to by the ``ret`` parameter.
+  *
+- * Refer to ssam_request_sync_onstack() for more details on the behavior of
++ * Refer to ssam_request_do_sync_onstack() for more details on the behavior of
+  * the generated function.
+  */
+ #define SSAM_DEFINE_SYNC_REQUEST_WR(name, atype, rtype, spec...)		\
+@@ -514,7 +514,7 @@ struct ssam_request_spec_md {
+ 		rsp.length = 0;							\
+ 		rsp.pointer = (u8 *)ret;					\
+ 										\
+-		status = ssam_request_sync_onstack(ctrl, &rqst, &rsp, sizeof(atype)); \
++		status = ssam_request_do_sync_onstack(ctrl, &rqst, &rsp, sizeof(atype)); \
+ 		if (status)							\
+ 			return status;						\
+ 										\
+@@ -550,7 +550,7 @@ struct ssam_request_spec_md {
+  * parameter is the controller via which the request is sent, ``tid`` the
+  * target ID for the request, and ``iid`` the instance ID.
+  *
+- * Refer to ssam_request_sync_onstack() for more details on the behavior of
++ * Refer to ssam_request_do_sync_onstack() for more details on the behavior of
+  * the generated function.
+  */
+ #define SSAM_DEFINE_SYNC_REQUEST_MD_N(name, spec...)				\
+@@ -567,7 +567,7 @@ struct ssam_request_spec_md {
+ 		rqst.length = 0;						\
+ 		rqst.payload = NULL;						\
+ 										\
+-		return ssam_request_sync_onstack(ctrl, &rqst, NULL, 0);		\
++		return ssam_request_do_sync_onstack(ctrl, &rqst, NULL, 0);	\
+ 	}
+ 
+ /**
+@@ -592,7 +592,7 @@ struct ssam_request_spec_md {
+  * ``tid`` the target ID for the request, and ``iid`` the instance ID. The
+  * request argument is specified via the ``arg`` pointer.
+  *
+- * Refer to ssam_request_sync_onstack() for more details on the behavior of
++ * Refer to ssam_request_do_sync_onstack() for more details on the behavior of
+  * the generated function.
+  */
+ #define SSAM_DEFINE_SYNC_REQUEST_MD_W(name, atype, spec...)			\
+@@ -609,7 +609,7 @@ struct ssam_request_spec_md {
+ 		rqst.length = sizeof(atype);					\
+ 		rqst.payload = (u8 *)arg;					\
+ 										\
+-		return ssam_request_sync_onstack(ctrl, &rqst, NULL,		\
++		return ssam_request_do_sync_onstack(ctrl, &rqst, NULL,		\
+ 						 sizeof(atype));		\
+ 	}
+ 
+@@ -635,7 +635,7 @@ struct ssam_request_spec_md {
+  * the target ID for the request, and ``iid`` the instance ID. The request's
+  * return value is written to the memory pointed to by the ``ret`` parameter.
+  *
+- * Refer to ssam_request_sync_onstack() for more details on the behavior of
++ * Refer to ssam_request_do_sync_onstack() for more details on the behavior of
+  * the generated function.
+  */
+ #define SSAM_DEFINE_SYNC_REQUEST_MD_R(name, rtype, spec...)			\
+@@ -658,7 +658,7 @@ struct ssam_request_spec_md {
+ 		rsp.length = 0;							\
+ 		rsp.pointer = (u8 *)ret;					\
+ 										\
+-		status = ssam_request_sync_onstack(ctrl, &rqst, &rsp, 0);	\
++		status = ssam_request_do_sync_onstack(ctrl, &rqst, &rsp, 0);	\
+ 		if (status)							\
+ 			return status;						\
+ 										\
+@@ -698,7 +698,7 @@ struct ssam_request_spec_md {
+  * The request argument is specified via the ``arg`` pointer. The request's
+  * return value is written to the memory pointed to by the ``ret`` parameter.
+  *
+- * Refer to ssam_request_sync_onstack() for more details on the behavior of
++ * Refer to ssam_request_do_sync_onstack() for more details on the behavior of
+  * the generated function.
+  */
+ #define SSAM_DEFINE_SYNC_REQUEST_MD_WR(name, atype, rtype, spec...)		\
+@@ -722,7 +722,7 @@ struct ssam_request_spec_md {
+ 		rsp.length = 0;							\
+ 		rsp.pointer = (u8 *)ret;					\
+ 										\
+-		status = ssam_request_sync_onstack(ctrl, &rqst, &rsp, sizeof(atype)); \
++		status = ssam_request_do_sync_onstack(ctrl, &rqst, &rsp, sizeof(atype)); \
+ 		if (status)							\
+ 			return status;						\
+ 										\
+diff --git a/include/linux/surface_aggregator/device.h b/include/linux/surface_aggregator/device.h
+index 4da20b7a0ee5e..1545e5567b152 100644
+--- a/include/linux/surface_aggregator/device.h
++++ b/include/linux/surface_aggregator/device.h
+@@ -456,7 +456,7 @@ static inline int ssam_device_register_clients(struct ssam_device *sdev)
+  * device of the request and by association the controller via which the
+  * request is sent.
+  *
+- * Refer to ssam_request_sync_onstack() for more details on the behavior of
++ * Refer to ssam_request_do_sync_onstack() for more details on the behavior of
+  * the generated function.
+  */
+ #define SSAM_DEFINE_SYNC_REQUEST_CL_N(name, spec...)			\
+@@ -490,7 +490,7 @@ static inline int ssam_device_register_clients(struct ssam_device *sdev)
+  * which the request is sent. The request's argument is specified via the
+  * ``arg`` pointer.
+  *
+- * Refer to ssam_request_sync_onstack() for more details on the behavior of
++ * Refer to ssam_request_do_sync_onstack() for more details on the behavior of
+  * the generated function.
+  */
+ #define SSAM_DEFINE_SYNC_REQUEST_CL_W(name, atype, spec...)		\
+@@ -524,7 +524,7 @@ static inline int ssam_device_register_clients(struct ssam_device *sdev)
+  * the request is sent. The request's return value is written to the memory
+  * pointed to by the ``ret`` parameter.
+  *
+- * Refer to ssam_request_sync_onstack() for more details on the behavior of
++ * Refer to ssam_request_do_sync_onstack() for more details on the behavior of
+  * the generated function.
+  */
+ #define SSAM_DEFINE_SYNC_REQUEST_CL_R(name, rtype, spec...)		\
+@@ -560,7 +560,7 @@ static inline int ssam_device_register_clients(struct ssam_device *sdev)
+  * specified via the ``arg`` pointer. The request's return value is written to
+  * the memory pointed to by the ``ret`` parameter.
+  *
+- * Refer to ssam_request_sync_onstack() for more details on the behavior of
++ * Refer to ssam_request_do_sync_onstack() for more details on the behavior of
+  * the generated function.
+  */
+ #define SSAM_DEFINE_SYNC_REQUEST_CL_WR(name, atype, rtype, spec...)		\
+-- 
+2.39.2
+
+From 92a5456ed57b0ab00122d10085387a5b515ec238 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Wed, 18 Jan 2023 11:38:23 +0200
+Subject: [PATCH] platform/surface: Switch to use acpi_evaluate_dsm_typed()
+
+The acpi_evaluate_dsm_typed() provides a way to check the type of the
+object evaluated by _DSM call. Use it instead of open coded variant.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/20230118093823.39679-1-andriy.shevchenko@linux.intel.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Patchset: surface-sam
+---
+ drivers/platform/surface/surface_hotplug.c | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/platform/surface/surface_hotplug.c b/drivers/platform/surface/surface_hotplug.c
+index f004a24952013..7b6d887dccdbf 100644
+--- a/drivers/platform/surface/surface_hotplug.c
++++ b/drivers/platform/surface/surface_hotplug.c
+@@ -101,18 +101,12 @@ static void shps_dsm_notify_irq(struct platform_device *pdev, enum shps_irq_type
+ 	param.type = ACPI_TYPE_INTEGER;
+ 	param.integer.value = value;
+ 
+-	result = acpi_evaluate_dsm(handle, &shps_dsm_guid, SHPS_DSM_REVISION,
+-				   shps_dsm_fn_for_irq(type), &param);
+-
++	result = acpi_evaluate_dsm_typed(handle, &shps_dsm_guid, SHPS_DSM_REVISION,
++					 shps_dsm_fn_for_irq(type), &param, ACPI_TYPE_BUFFER);
+ 	if (!result) {
+ 		dev_err(&pdev->dev, "IRQ notification via DSM failed (irq=%d, gpio=%d)\n",
+ 			type, value);
+ 
+-	} else if (result->type != ACPI_TYPE_BUFFER) {
+-		dev_err(&pdev->dev,
+-			"IRQ notification via DSM failed: unexpected result type (irq=%d, gpio=%d)\n",
+-			type, value);
+-
+ 	} else if (result->buffer.length != 1 || result->buffer.pointer[0] != 0) {
+ 		dev_err(&pdev->dev,
+ 			"IRQ notification via DSM failed: unexpected result value (irq=%d, gpio=%d)\n",
+@@ -121,8 +115,7 @@ static void shps_dsm_notify_irq(struct platform_device *pdev, enum shps_irq_type
+ 
+ 	mutex_unlock(&sdev->lock[type]);
+ 
+-	if (result)
+-		ACPI_FREE(result);
++	ACPI_FREE(result);
+ }
+ 
+ static irqreturn_t shps_handle_irq(int irq, void *data)
+-- 
+2.39.2
+
+From 1bf772afae5fed7cd220aa56888e69d4ef0ea31c Mon Sep 17 00:00:00 2001
+From: Maximilian Luz <luzmaximilian@gmail.com>
+Date: Sat, 4 Mar 2023 20:09:36 +0100
+Subject: [PATCH] platform/surface: aggregator_tabletsw: Properly handle
+ different posture source IDs
+
+The device posture subsystem (POS) can provide different posture
+sources. Different sources can provide different posture states and
+sources can be identified by their ID.
+
+For example, screen posture of the Surface Laptop Studio (SLS), which is
+currently the only supported source, uses a source ID of 0x03. The
+Surface Pro 9 uses the same subsystem for its Type-Cover, however,
+provides different states for that under the ID 0x00.
+
+To eventually support the Surface Pro 9 and potential future devices, we
+need to properly disambiguate between source IDs. Therefore, add the
+source ID to the state we carry and determine the tablet-mode state (as
+well as state names) based on that.
+
+Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Patchset: surface-sam
+---
+ .../surface/surface_aggregator_tabletsw.c     | 123 ++++++++++++------
+ 1 file changed, 84 insertions(+), 39 deletions(-)
+
+diff --git a/drivers/platform/surface/surface_aggregator_tabletsw.c b/drivers/platform/surface/surface_aggregator_tabletsw.c
+index 9fed800c7cc09..e8682f52558f3 100644
+--- a/drivers/platform/surface/surface_aggregator_tabletsw.c
++++ b/drivers/platform/surface/surface_aggregator_tabletsw.c
+@@ -20,16 +20,23 @@
+ 
+ struct ssam_tablet_sw;
+ 
++struct ssam_tablet_sw_state {
++	u32 source;
++	u32 state;
++};
++
+ struct ssam_tablet_sw_ops {
+-	int (*get_state)(struct ssam_tablet_sw *sw, u32 *state);
+-	const char *(*state_name)(struct ssam_tablet_sw *sw, u32 state);
+-	bool (*state_is_tablet_mode)(struct ssam_tablet_sw *sw, u32 state);
++	int (*get_state)(struct ssam_tablet_sw *sw, struct ssam_tablet_sw_state *state);
++	const char *(*state_name)(struct ssam_tablet_sw *sw,
++				  const struct ssam_tablet_sw_state *state);
++	bool (*state_is_tablet_mode)(struct ssam_tablet_sw *sw,
++				     const struct ssam_tablet_sw_state *state);
+ };
+ 
+ struct ssam_tablet_sw {
+ 	struct ssam_device *sdev;
+ 
+-	u32 state;
++	struct ssam_tablet_sw_state state;
+ 	struct work_struct update_work;
+ 	struct input_dev *mode_switch;
+ 
+@@ -45,9 +52,11 @@ struct ssam_tablet_sw_desc {
+ 
+ 	struct {
+ 		u32 (*notify)(struct ssam_event_notifier *nf, const struct ssam_event *event);
+-		int (*get_state)(struct ssam_tablet_sw *sw, u32 *state);
+-		const char *(*state_name)(struct ssam_tablet_sw *sw, u32 state);
+-		bool (*state_is_tablet_mode)(struct ssam_tablet_sw *sw, u32 state);
++		int (*get_state)(struct ssam_tablet_sw *sw, struct ssam_tablet_sw_state *state);
++		const char *(*state_name)(struct ssam_tablet_sw *sw,
++					  const struct ssam_tablet_sw_state *state);
++		bool (*state_is_tablet_mode)(struct ssam_tablet_sw *sw,
++					     const struct ssam_tablet_sw_state *state);
+ 	} ops;
+ 
+ 	struct {
+@@ -61,7 +70,7 @@ struct ssam_tablet_sw_desc {
+ static ssize_t state_show(struct device *dev, struct device_attribute *attr, char *buf)
+ {
+ 	struct ssam_tablet_sw *sw = dev_get_drvdata(dev);
+-	const char *state = sw->ops.state_name(sw, sw->state);
++	const char *state = sw->ops.state_name(sw, &sw->state);
+ 
+ 	return sysfs_emit(buf, "%s\n", state);
+ }
+@@ -79,19 +88,19 @@ static const struct attribute_group ssam_tablet_sw_group = {
+ static void ssam_tablet_sw_update_workfn(struct work_struct *work)
+ {
+ 	struct ssam_tablet_sw *sw = container_of(work, struct ssam_tablet_sw, update_work);
++	struct ssam_tablet_sw_state state;
+ 	int tablet, status;
+-	u32 state;
+ 
+ 	status = sw->ops.get_state(sw, &state);
+ 	if (status)
+ 		return;
+ 
+-	if (sw->state == state)
++	if (sw->state.source == state.source && sw->state.state == state.state)
+ 		return;
+ 	sw->state = state;
+ 
+ 	/* Send SW_TABLET_MODE event. */
+-	tablet = sw->ops.state_is_tablet_mode(sw, state);
++	tablet = sw->ops.state_is_tablet_mode(sw, &state);
+ 	input_report_switch(sw->mode_switch, SW_TABLET_MODE, tablet);
+ 	input_sync(sw->mode_switch);
+ }
+@@ -146,7 +155,7 @@ static int ssam_tablet_sw_probe(struct ssam_device *sdev)
+ 	sw->mode_switch->id.bustype = BUS_HOST;
+ 	sw->mode_switch->dev.parent = &sdev->dev;
+ 
+-	tablet = sw->ops.state_is_tablet_mode(sw, sw->state);
++	tablet = sw->ops.state_is_tablet_mode(sw, &sw->state);
+ 	input_set_capability(sw->mode_switch, EV_SW, SW_TABLET_MODE);
+ 	input_report_switch(sw->mode_switch, SW_TABLET_MODE, tablet);
+ 
+@@ -203,9 +212,10 @@ enum ssam_kip_cover_state {
+ 	SSAM_KIP_COVER_STATE_FOLDED_BACK   = 0x05,
+ };
+ 
+-static const char *ssam_kip_cover_state_name(struct ssam_tablet_sw *sw, u32 state)
++static const char *ssam_kip_cover_state_name(struct ssam_tablet_sw *sw,
++					     const struct ssam_tablet_sw_state *state)
+ {
+-	switch (state) {
++	switch (state->state) {
+ 	case SSAM_KIP_COVER_STATE_DISCONNECTED:
+ 		return "disconnected";
+ 
+@@ -222,14 +232,15 @@ static const char *ssam_kip_cover_state_name(struct ssam_tablet_sw *sw, u32 stat
+ 		return "folded-back";
+ 
+ 	default:
+-		dev_warn(&sw->sdev->dev, "unknown KIP cover state: %u\n", state);
++		dev_warn(&sw->sdev->dev, "unknown KIP cover state: %u\n", state->state);
+ 		return "<unknown>";
+ 	}
+ }
+ 
+-static bool ssam_kip_cover_state_is_tablet_mode(struct ssam_tablet_sw *sw, u32 state)
++static bool ssam_kip_cover_state_is_tablet_mode(struct ssam_tablet_sw *sw,
++						const struct ssam_tablet_sw_state *state)
+ {
+-	switch (state) {
++	switch (state->state) {
+ 	case SSAM_KIP_COVER_STATE_DISCONNECTED:
+ 	case SSAM_KIP_COVER_STATE_FOLDED_CANVAS:
+ 	case SSAM_KIP_COVER_STATE_FOLDED_BACK:
+@@ -240,7 +251,7 @@ static bool ssam_kip_cover_state_is_tablet_mode(struct ssam_tablet_sw *sw, u32 s
+ 		return false;
+ 
+ 	default:
+-		dev_warn(&sw->sdev->dev, "unknown KIP cover state: %d\n", sw->state);
++		dev_warn(&sw->sdev->dev, "unknown KIP cover state: %d\n", state->state);
+ 		return true;
+ 	}
+ }
+@@ -252,7 +263,7 @@ SSAM_DEFINE_SYNC_REQUEST_R(__ssam_kip_get_cover_state, u8, {
+ 	.instance_id     = 0x00,
+ });
+ 
+-static int ssam_kip_get_cover_state(struct ssam_tablet_sw *sw, u32 *state)
++static int ssam_kip_get_cover_state(struct ssam_tablet_sw *sw, struct ssam_tablet_sw_state *state)
+ {
+ 	int status;
+ 	u8 raw;
+@@ -263,7 +274,8 @@ static int ssam_kip_get_cover_state(struct ssam_tablet_sw *sw, u32 *state)
+ 		return status;
+ 	}
+ 
+-	*state = raw;
++	state->source = 0;	/* Unused for KIP switch. */
++	state->state = raw;
+ 	return 0;
+ }
+ 
+@@ -312,11 +324,15 @@ MODULE_PARM_DESC(tablet_mode_in_slate_state, "Enable tablet mode in slate device
+ #define SSAM_EVENT_POS_CID_POSTURE_CHANGED	0x03
+ #define SSAM_POS_MAX_SOURCES			4
+ 
+-enum ssam_pos_state {
+-	SSAM_POS_POSTURE_LID_CLOSED = 0x00,
+-	SSAM_POS_POSTURE_LAPTOP     = 0x01,
+-	SSAM_POS_POSTURE_SLATE      = 0x02,
+-	SSAM_POS_POSTURE_TABLET     = 0x03,
++enum ssam_pos_source_id {
++	SSAM_POS_SOURCE_SLS   = 0x03,
++};
++
++enum ssam_pos_state_sls {
++	SSAM_POS_SLS_LID_CLOSED = 0x00,
++	SSAM_POS_SLS_LAPTOP     = 0x01,
++	SSAM_POS_SLS_SLATE      = 0x02,
++	SSAM_POS_SLS_TABLET     = 0x03,
+ };
+ 
+ struct ssam_sources_list {
+@@ -324,42 +340,68 @@ struct ssam_sources_list {
+ 	__le32 id[SSAM_POS_MAX_SOURCES];
+ } __packed;
+ 
+-static const char *ssam_pos_state_name(struct ssam_tablet_sw *sw, u32 state)
++static const char *ssam_pos_state_name_sls(struct ssam_tablet_sw *sw, u32 state)
+ {
+ 	switch (state) {
+-	case SSAM_POS_POSTURE_LID_CLOSED:
++	case SSAM_POS_SLS_LID_CLOSED:
+ 		return "closed";
+ 
+-	case SSAM_POS_POSTURE_LAPTOP:
++	case SSAM_POS_SLS_LAPTOP:
+ 		return "laptop";
+ 
+-	case SSAM_POS_POSTURE_SLATE:
++	case SSAM_POS_SLS_SLATE:
+ 		return "slate";
+ 
+-	case SSAM_POS_POSTURE_TABLET:
++	case SSAM_POS_SLS_TABLET:
+ 		return "tablet";
+ 
+ 	default:
+-		dev_warn(&sw->sdev->dev, "unknown device posture: %u\n", state);
++		dev_warn(&sw->sdev->dev, "unknown device posture for SLS: %u\n", state);
+ 		return "<unknown>";
+ 	}
+ }
+ 
+-static bool ssam_pos_state_is_tablet_mode(struct ssam_tablet_sw *sw, u32 state)
++static const char *ssam_pos_state_name(struct ssam_tablet_sw *sw,
++				       const struct ssam_tablet_sw_state *state)
++{
++	switch (state->source) {
++	case SSAM_POS_SOURCE_SLS:
++		return ssam_pos_state_name_sls(sw, state->state);
++
++	default:
++		dev_warn(&sw->sdev->dev, "unknown device posture source: %u\n", state->source);
++		return "<unknown>";
++	}
++}
++
++static bool ssam_pos_state_is_tablet_mode_sls(struct ssam_tablet_sw *sw, u32 state)
+ {
+ 	switch (state) {
+-	case SSAM_POS_POSTURE_LAPTOP:
+-	case SSAM_POS_POSTURE_LID_CLOSED:
++	case SSAM_POS_SLS_LAPTOP:
++	case SSAM_POS_SLS_LID_CLOSED:
+ 		return false;
+ 
+-	case SSAM_POS_POSTURE_SLATE:
++	case SSAM_POS_SLS_SLATE:
+ 		return tablet_mode_in_slate_state;
+ 
+-	case SSAM_POS_POSTURE_TABLET:
++	case SSAM_POS_SLS_TABLET:
+ 		return true;
+ 
+ 	default:
+-		dev_warn(&sw->sdev->dev, "unknown device posture: %u\n", state);
++		dev_warn(&sw->sdev->dev, "unknown device posture for SLS: %u\n", state);
++		return true;
++	}
++}
++
++static bool ssam_pos_state_is_tablet_mode(struct ssam_tablet_sw *sw,
++					  const struct ssam_tablet_sw_state *state)
++{
++	switch (state->source) {
++	case SSAM_POS_SOURCE_SLS:
++		return ssam_pos_state_is_tablet_mode_sls(sw, state->state);
++
++	default:
++		dev_warn(&sw->sdev->dev, "unknown device posture source: %u\n", state->source);
+ 		return true;
+ 	}
+ }
+@@ -450,9 +492,10 @@ static int ssam_pos_get_posture_for_source(struct ssam_tablet_sw *sw, u32 source
+ 	return 0;
+ }
+ 
+-static int ssam_pos_get_posture(struct ssam_tablet_sw *sw, u32 *state)
++static int ssam_pos_get_posture(struct ssam_tablet_sw *sw, struct ssam_tablet_sw_state *state)
+ {
+ 	u32 source_id;
++	u32 source_state;
+ 	int status;
+ 
+ 	status = ssam_pos_get_source(sw, &source_id);
+@@ -461,13 +504,15 @@ static int ssam_pos_get_posture(struct ssam_tablet_sw *sw, u32 *state)
+ 		return status;
+ 	}
+ 
+-	status = ssam_pos_get_posture_for_source(sw, source_id, state);
++	status = ssam_pos_get_posture_for_source(sw, source_id, &source_state);
+ 	if (status) {
+ 		dev_err(&sw->sdev->dev, "failed to get posture value for source %u: %d\n",
+ 			source_id, status);
+ 		return status;
+ 	}
+ 
++	state->source = source_id;
++	state->state = source_state;
+ 	return 0;
+ }
+ 
+-- 
+2.39.2
+
+From 64197727498531561cb89c910e119e70533d13fd Mon Sep 17 00:00:00 2001
+From: Maximilian Luz <luzmaximilian@gmail.com>
+Date: Sun, 19 Feb 2023 23:33:43 +0100
+Subject: [PATCH] platform/surface: aggregator_tabletsw: Add support for
+ Type-Cover posture source
+
+Implement support for the Type-Cover posture source (ID 0x00), found on
+the Surface Pro 9.
+
+Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Patchset: surface-sam
+---
+ .../surface/surface_aggregator_tabletsw.c     | 57 +++++++++++++++++++
+ 1 file changed, 57 insertions(+)
+
+diff --git a/drivers/platform/surface/surface_aggregator_tabletsw.c b/drivers/platform/surface/surface_aggregator_tabletsw.c
+index e8682f52558f3..8f52b62d1c195 100644
+--- a/drivers/platform/surface/surface_aggregator_tabletsw.c
++++ b/drivers/platform/surface/surface_aggregator_tabletsw.c
+@@ -325,9 +325,18 @@ MODULE_PARM_DESC(tablet_mode_in_slate_state, "Enable tablet mode in slate device
+ #define SSAM_POS_MAX_SOURCES			4
+ 
+ enum ssam_pos_source_id {
++	SSAM_POS_SOURCE_COVER = 0x00,
+ 	SSAM_POS_SOURCE_SLS   = 0x03,
+ };
+ 
++enum ssam_pos_state_cover {
++	SSAM_POS_COVER_DISCONNECTED  = 0x01,
++	SSAM_POS_COVER_CLOSED        = 0x02,
++	SSAM_POS_COVER_LAPTOP        = 0x03,
++	SSAM_POS_COVER_FOLDED_CANVAS = 0x04,
++	SSAM_POS_COVER_FOLDED_BACK   = 0x05,
++};
++
+ enum ssam_pos_state_sls {
+ 	SSAM_POS_SLS_LID_CLOSED = 0x00,
+ 	SSAM_POS_SLS_LAPTOP     = 0x01,
+@@ -340,6 +349,30 @@ struct ssam_sources_list {
+ 	__le32 id[SSAM_POS_MAX_SOURCES];
+ } __packed;
+ 
++static const char *ssam_pos_state_name_cover(struct ssam_tablet_sw *sw, u32 state)
++{
++	switch (state) {
++	case SSAM_POS_COVER_DISCONNECTED:
++		return "disconnected";
++
++	case SSAM_POS_COVER_CLOSED:
++		return "closed";
++
++	case SSAM_POS_COVER_LAPTOP:
++		return "laptop";
++
++	case SSAM_POS_COVER_FOLDED_CANVAS:
++		return "folded-canvas";
++
++	case SSAM_POS_COVER_FOLDED_BACK:
++		return "folded-back";
++
++	default:
++		dev_warn(&sw->sdev->dev, "unknown device posture for type-cover: %u\n", state);
++		return "<unknown>";
++	}
++}
++
+ static const char *ssam_pos_state_name_sls(struct ssam_tablet_sw *sw, u32 state)
+ {
+ 	switch (state) {
+@@ -365,6 +398,9 @@ static const char *ssam_pos_state_name(struct ssam_tablet_sw *sw,
+ 				       const struct ssam_tablet_sw_state *state)
+ {
+ 	switch (state->source) {
++	case SSAM_POS_SOURCE_COVER:
++		return ssam_pos_state_name_cover(sw, state->state);
++
+ 	case SSAM_POS_SOURCE_SLS:
+ 		return ssam_pos_state_name_sls(sw, state->state);
+ 
+@@ -374,6 +410,24 @@ static const char *ssam_pos_state_name(struct ssam_tablet_sw *sw,
+ 	}
+ }
+ 
++static bool ssam_pos_state_is_tablet_mode_cover(struct ssam_tablet_sw *sw, u32 state)
++{
++	switch (state) {
++	case SSAM_POS_COVER_DISCONNECTED:
++	case SSAM_POS_COVER_FOLDED_CANVAS:
++	case SSAM_POS_COVER_FOLDED_BACK:
++		return true;
++
++	case SSAM_POS_COVER_CLOSED:
++	case SSAM_POS_COVER_LAPTOP:
++		return false;
++
++	default:
++		dev_warn(&sw->sdev->dev, "unknown device posture for type-cover: %u\n", state);
++		return true;
++	}
++}
++
+ static bool ssam_pos_state_is_tablet_mode_sls(struct ssam_tablet_sw *sw, u32 state)
+ {
+ 	switch (state) {
+@@ -397,6 +451,9 @@ static bool ssam_pos_state_is_tablet_mode(struct ssam_tablet_sw *sw,
+ 					  const struct ssam_tablet_sw_state *state)
+ {
+ 	switch (state->source) {
++	case SSAM_POS_SOURCE_COVER:
++		return ssam_pos_state_is_tablet_mode_cover(sw, state->state);
++
+ 	case SSAM_POS_SOURCE_SLS:
+ 		return ssam_pos_state_is_tablet_mode_sls(sw, state->state);
+ 
+-- 
+2.39.2
 
-From e17056688f8040ace8f60ee7a5ebc4e196ae6b0d Mon Sep 17 00:00:00 2001
+From 8357939c324e363bfad4813d881b34ead8e4c243 Mon Sep 17 00:00:00 2001
+From: Maximilian Luz <luzmaximilian@gmail.com>
+Date: Sun, 19 Feb 2023 23:41:18 +0100
+Subject: [PATCH] platform/surface: aggregator_registry: Add support for
+ tablet-mode switch on Surface Pro 9
+
+Add support for the POS-subsystem tablet-mode switch used on the Surface
+Pro 9.
+
+Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Patchset: surface-sam
+---
+ drivers/platform/surface/surface_aggregator_registry.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/surface/surface_aggregator_registry.c b/drivers/platform/surface/surface_aggregator_registry.c
+index 296f72d52e6a6..0fe5be5396525 100644
+--- a/drivers/platform/surface/surface_aggregator_registry.c
++++ b/drivers/platform/surface/surface_aggregator_registry.c
+@@ -305,7 +305,7 @@ static const struct software_node *ssam_node_group_sp9[] = {
+ 	&ssam_node_bat_ac,
+ 	&ssam_node_bat_main,
+ 	&ssam_node_tmp_pprof,
+-	/* TODO: Tablet mode switch (via POS subsystem) */
++	&ssam_node_pos_tablet_switch,
+ 	&ssam_node_hid_kip_keyboard,
+ 	&ssam_node_hid_kip_penstash,
+ 	&ssam_node_hid_kip_touchpad,
+-- 
+2.39.2
+
+From 6a5e1c3f0a2a55dd2cb55db7b8b8b0c1369443b6 Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
 Date: Sat, 25 Jul 2020 17:19:53 +0200
 Subject: [PATCH] i2c: acpi: Implement RawBytes read access
@@ -3300,7 +7163,7 @@ Patchset: surface-sam-over-hid
  1 file changed, 35 insertions(+)
 
 diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
-index 4dd777cc0c89..b2338618163a 100644
+index 4dd777cc0c89f..b2338618163ad 100644
 --- a/drivers/i2c/i2c-core-acpi.c
 +++ b/drivers/i2c/i2c-core-acpi.c
 @@ -639,6 +639,28 @@ static int acpi_gsb_i2c_write_bytes(struct i2c_client *client,
@@ -3353,9 +7216,9 @@ index 4dd777cc0c89..b2338618163a 100644
  		dev_warn(&adapter->dev, "protocol 0x%02x not supported for client 0x%02x\n",
  			 accessor_type, client->addr);
 -- 
-2.39.0
+2.39.2
 
-From 725ce85d616e7b985208e32426c41a95a33c4005 Mon Sep 17 00:00:00 2001
+From 2a6f08f97a8f645dabd0538a09d3692c88474066 Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
 Date: Sat, 13 Feb 2021 16:41:18 +0100
 Subject: [PATCH] platform/surface: Add driver for Surface Book 1 dGPU switch
@@ -3378,7 +7241,7 @@ Patchset: surface-sam-over-hid
  create mode 100644 drivers/platform/surface/surfacebook1_dgpu_switch.c
 
 diff --git a/drivers/platform/surface/Kconfig b/drivers/platform/surface/Kconfig
-index b629e82af97c..68656e8f309e 100644
+index b629e82af97c0..68656e8f309ed 100644
 --- a/drivers/platform/surface/Kconfig
 +++ b/drivers/platform/surface/Kconfig
 @@ -149,6 +149,13 @@ config SURFACE_AGGREGATOR_TABLET_SWITCH
@@ -3396,7 +7259,7 @@ index b629e82af97c..68656e8f309e 100644
  	tristate "Surface DTX (Detachment System) Driver"
  	depends on SURFACE_AGGREGATOR
 diff --git a/drivers/platform/surface/Makefile b/drivers/platform/surface/Makefile
-index 53344330939b..7efcd0cdb532 100644
+index 53344330939bf..7efcd0cdb5329 100644
 --- a/drivers/platform/surface/Makefile
 +++ b/drivers/platform/surface/Makefile
 @@ -12,6 +12,7 @@ obj-$(CONFIG_SURFACE_AGGREGATOR_CDEV)	+= surface_aggregator_cdev.o
@@ -3409,7 +7272,7 @@ index 53344330939b..7efcd0cdb532 100644
  obj-$(CONFIG_SURFACE_HOTPLUG)		+= surface_hotplug.o
 diff --git a/drivers/platform/surface/surfacebook1_dgpu_switch.c b/drivers/platform/surface/surfacebook1_dgpu_switch.c
 new file mode 100644
-index 000000000000..8b816ed8f35c
+index 0000000000000..8b816ed8f35c6
 --- /dev/null
 +++ b/drivers/platform/surface/surfacebook1_dgpu_switch.c
 @@ -0,0 +1,162 @@
@@ -3576,9 +7439,9 @@ index 000000000000..8b816ed8f35c
 +MODULE_DESCRIPTION("Discrete GPU Power-Switch for Surface Book 1");
 +MODULE_LICENSE("GPL");
 -- 
-2.39.0
+2.39.2
 
-From 0f45b177ca4e7d9b62c0f7572e273104fe93f274 Mon Sep 17 00:00:00 2001
+From c158663450515d39c6ed38d8d2654761b1aad0a7 Mon Sep 17 00:00:00 2001
 From: Sachi King <nakato@nakato.io>
 Date: Tue, 5 Oct 2021 00:05:09 +1100
 Subject: [PATCH] Input: soc_button_array - support AMD variant Surface devices
@@ -3600,7 +7463,7 @@ Patchset: surface-button
  1 file changed, 8 insertions(+), 25 deletions(-)
 
 diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c
-index 09489380afda..0f02411a60f1 100644
+index 09489380afda7..0f02411a60f1c 100644
 --- a/drivers/input/misc/soc_button_array.c
 +++ b/drivers/input/misc/soc_button_array.c
 @@ -507,8 +507,8 @@ static const struct soc_device_data soc_device_MSHW0028 = {
@@ -3653,9 +7516,9 @@ index 09489380afda..0f02411a60f1 100644
  
  /*
 -- 
-2.39.0
+2.39.2
 
-From bff73a6735c9eba68a048fa321c371714d5817f6 Mon Sep 17 00:00:00 2001
+From b11c73499f55ce84a9a06220d365ef5c9a23f80b Mon Sep 17 00:00:00 2001
 From: Sachi King <nakato@nakato.io>
 Date: Tue, 5 Oct 2021 00:22:57 +1100
 Subject: [PATCH] platform/surface: surfacepro3_button: don't load on amd
@@ -3676,7 +7539,7 @@ Patchset: surface-button
  1 file changed, 6 insertions(+), 24 deletions(-)
 
 diff --git a/drivers/platform/surface/surfacepro3_button.c b/drivers/platform/surface/surfacepro3_button.c
-index 242fb690dcaf..30eea54dbb47 100644
+index 242fb690dcaf7..30eea54dbb477 100644
 --- a/drivers/platform/surface/surfacepro3_button.c
 +++ b/drivers/platform/surface/surfacepro3_button.c
 @@ -149,7 +149,8 @@ static int surface_button_resume(struct device *dev)
@@ -3725,9 +7588,50 @@ index 242fb690dcaf..30eea54dbb47 100644
  
  
 -- 
-2.39.0
+2.39.2
+
+From 6a4abbc116311e4882a0a4643737bed04b36a907 Mon Sep 17 00:00:00 2001
+From: Maximilian Luz <luzmaximilian@gmail.com>
+Date: Sat, 18 Feb 2023 01:02:49 +0100
+Subject: [PATCH] USB: quirks: Add USB_QUIRK_DELAY_INIT for Surface Go 3
+ Type-Cover
+
+The touchpad on the Type-Cover of the Surface Go 3 is sometimes not
+being initialized properly. Apply USB_QUIRK_DELAY_INIT to fix this
+issue.
+
+More specifically, the device in question is a fairly standard modern
+touchpad with pointer and touchpad input modes. During setup, the device
+needs to be switched from pointer- to touchpad-mode (which is done in
+hid-multitouch) to fully utilize it as intended. Unfortunately, however,
+this seems to occasionally fail silently, leaving the device in
+pointer-mode. Applying USB_QUIRK_DELAY_INIT seems to fix this.
+
+Link: https://github.com/linux-surface/linux-surface/issues/1059
+Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Patchset: surface-typecover
+---
+ drivers/usb/core/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 934b3d997702e..2c6604c6e8e12 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -220,6 +220,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* Microsoft Surface Dock Ethernet (RTL8153 GigE) */
+ 	{ USB_DEVICE(0x045e, 0x07c6), .driver_info = USB_QUIRK_NO_LPM },
+ 
++	/* Microsoft Surface Go 3 Type-Cover */
++	{ USB_DEVICE(0x045e, 0x09b5), .driver_info = USB_QUIRK_DELAY_INIT },
++
+ 	/* Cherry Stream G230 2.0 (G85-231) and 3.0 (G85-232) */
+ 	{ USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+-- 
+2.39.2
 
-From dc3a1664b024f9f8051f65ee84edf5391460dbc4 Mon Sep 17 00:00:00 2001
+From 7b335ce8bcb89dab6a3dc2dbd00a68828c991130 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jonas=20Dre=C3=9Fler?= <verdre@v0yd.nl>
 Date: Thu, 5 Nov 2020 13:09:45 +0100
 Subject: [PATCH] hid/multitouch: Turn off Type Cover keyboard backlight when
@@ -3763,7 +7667,7 @@ Patchset: surface-typecover
  1 file changed, 98 insertions(+), 2 deletions(-)
 
 diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
-index 372cbdd223e0..fe849df6a948 100644
+index e31be0cb8b850..63fd042aba6ba 100644
 --- a/drivers/hid/hid-multitouch.c
 +++ b/drivers/hid/hid-multitouch.c
 @@ -34,7 +34,10 @@
@@ -3785,11 +7689,11 @@ index 372cbdd223e0..fe849df6a948 100644
  
  /* quirks to control the device */
  #define MT_QUIRK_NOT_SEEN_MEANS_UP	BIT(0)
-@@ -71,12 +75,15 @@ MODULE_LICENSE("GPL");
- #define MT_QUIRK_SEPARATE_APP_REPORT	BIT(19)
+@@ -72,12 +76,15 @@ MODULE_LICENSE("GPL");
  #define MT_QUIRK_FORCE_MULTI_INPUT	BIT(20)
  #define MT_QUIRK_DISABLE_WAKEUP		BIT(21)
-+#define MT_QUIRK_HAS_TYPE_COVER_BACKLIGHT	BIT(22)
+ #define MT_QUIRK_ORIENTATION_INVERT	BIT(22)
++#define MT_QUIRK_HAS_TYPE_COVER_BACKLIGHT	BIT(23)
  
  #define MT_INPUTMODE_TOUCHSCREEN	0x02
  #define MT_INPUTMODE_TOUCHPAD		0x03
@@ -3801,7 +7705,7 @@ index 372cbdd223e0..fe849df6a948 100644
  enum latency_mode {
  	HID_LATENCY_NORMAL = 0,
  	HID_LATENCY_HIGH = 1,
-@@ -168,6 +175,8 @@ struct mt_device {
+@@ -169,6 +176,8 @@ struct mt_device {
  
  	struct list_head applications;
  	struct list_head reports;
@@ -3810,7 +7714,7 @@ index 372cbdd223e0..fe849df6a948 100644
  };
  
  static void mt_post_parse_default_settings(struct mt_device *td,
-@@ -212,6 +221,7 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app);
+@@ -213,6 +222,7 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app);
  #define MT_CLS_GOOGLE				0x0111
  #define MT_CLS_RAZER_BLADE_STEALTH		0x0112
  #define MT_CLS_SMART_TECH			0x0113
@@ -3818,7 +7722,7 @@ index 372cbdd223e0..fe849df6a948 100644
  
  #define MT_DEFAULT_MAXCONTACT	10
  #define MT_MAX_MAXCONTACT	250
-@@ -396,6 +406,16 @@ static const struct mt_class mt_classes[] = {
+@@ -397,6 +407,16 @@ static const struct mt_class mt_classes[] = {
  			MT_QUIRK_CONTACT_CNT_ACCURATE |
  			MT_QUIRK_SEPARATE_APP_REPORT,
  	},
@@ -3835,7 +7739,7 @@ index 372cbdd223e0..fe849df6a948 100644
  	{ }
  };
  
-@@ -1706,6 +1726,69 @@ static void mt_expired_timeout(struct timer_list *t)
+@@ -1728,6 +1748,69 @@ static void mt_expired_timeout(struct timer_list *t)
  	clear_bit_unlock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);
  }
  
@@ -3905,7 +7809,7 @@ index 372cbdd223e0..fe849df6a948 100644
  static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
  {
  	int ret, i;
-@@ -1729,6 +1812,9 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
+@@ -1751,6 +1834,9 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
  	td->inputmode_value = MT_INPUTMODE_TOUCHSCREEN;
  	hid_set_drvdata(hdev, td);
  
@@ -3915,7 +7819,7 @@ index 372cbdd223e0..fe849df6a948 100644
  	INIT_LIST_HEAD(&td->applications);
  	INIT_LIST_HEAD(&td->reports);
  
-@@ -1758,15 +1844,19 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
+@@ -1789,15 +1875,19 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
  	timer_setup(&td->release_timer, mt_expired_timeout, 0);
  
  	ret = hid_parse(hdev);
@@ -3937,7 +7841,7 @@ index 372cbdd223e0..fe849df6a948 100644
  
  	ret = sysfs_create_group(&hdev->dev.kobj, &mt_attribute_group);
  	if (ret)
-@@ -1818,6 +1908,7 @@ static void mt_remove(struct hid_device *hdev)
+@@ -1849,6 +1939,7 @@ static void mt_remove(struct hid_device *hdev)
  {
  	struct mt_device *td = hid_get_drvdata(hdev);
  
@@ -3945,7 +7849,7 @@ index 372cbdd223e0..fe849df6a948 100644
  	del_timer_sync(&td->release_timer);
  
  	sysfs_remove_group(&hdev->dev.kobj, &mt_attribute_group);
-@@ -2195,6 +2286,11 @@ static const struct hid_device_id mt_devices[] = {
+@@ -2226,6 +2317,11 @@ static const struct hid_device_id mt_devices[] = {
  		MT_USB_DEVICE(USB_VENDOR_ID_XIROKU,
  			USB_DEVICE_ID_XIROKU_CSR2) },
  
@@ -3958,9 +7862,9 @@ index 372cbdd223e0..fe849df6a948 100644
  	{ .driver_data = MT_CLS_GOOGLE,
  		HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, USB_VENDOR_ID_GOOGLE,
 -- 
-2.39.0
+2.39.2
 
-From 88620b36eb8e96c20001aaeda03ad290cbabf43e Mon Sep 17 00:00:00 2001
+From 1ef242e34b7ed5aeda8072d566365a5484592ebf Mon Sep 17 00:00:00 2001
 From: PJungkamp <p.jungkamp@gmail.com>
 Date: Fri, 25 Feb 2022 12:04:25 +0100
 Subject: [PATCH] hid/multitouch: Add support for surface pro type cover tablet
@@ -3989,18 +7893,18 @@ Patchset: surface-typecover
  1 file changed, 122 insertions(+), 26 deletions(-)
 
 diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
-index fe849df6a948..3a7a43eb9fbe 100644
+index 63fd042aba6ba..508a250ff4bf1 100644
 --- a/drivers/hid/hid-multitouch.c
 +++ b/drivers/hid/hid-multitouch.c
-@@ -76,6 +76,7 @@ MODULE_LICENSE("GPL");
- #define MT_QUIRK_FORCE_MULTI_INPUT	BIT(20)
+@@ -77,6 +77,7 @@ MODULE_LICENSE("GPL");
  #define MT_QUIRK_DISABLE_WAKEUP		BIT(21)
- #define MT_QUIRK_HAS_TYPE_COVER_BACKLIGHT	BIT(22)
-+#define MT_QUIRK_HAS_TYPE_COVER_TABLET_MODE_SWITCH	BIT(23)
+ #define MT_QUIRK_ORIENTATION_INVERT	BIT(22)
+ #define MT_QUIRK_HAS_TYPE_COVER_BACKLIGHT	BIT(23)
++#define MT_QUIRK_HAS_TYPE_COVER_TABLET_MODE_SWITCH	BIT(24)
  
  #define MT_INPUTMODE_TOUCHSCREEN	0x02
  #define MT_INPUTMODE_TOUCHPAD		0x03
-@@ -83,6 +84,8 @@ MODULE_LICENSE("GPL");
+@@ -84,6 +85,8 @@ MODULE_LICENSE("GPL");
  #define MT_BUTTONTYPE_CLICKPAD		0
  
  #define MS_TYPE_COVER_FEATURE_REPORT_USAGE	0xff050086
@@ -4009,7 +7913,7 @@ index fe849df6a948..3a7a43eb9fbe 100644
  
  enum latency_mode {
  	HID_LATENCY_NORMAL = 0,
-@@ -408,6 +411,7 @@ static const struct mt_class mt_classes[] = {
+@@ -409,6 +412,7 @@ static const struct mt_class mt_classes[] = {
  	},
  	{ .name = MT_CLS_WIN_8_MS_SURFACE_TYPE_COVER,
  		.quirks = MT_QUIRK_HAS_TYPE_COVER_BACKLIGHT |
@@ -4017,7 +7921,7 @@ index fe849df6a948..3a7a43eb9fbe 100644
  			MT_QUIRK_ALWAYS_VALID |
  			MT_QUIRK_IGNORE_DUPLICATES |
  			MT_QUIRK_HOVERING |
-@@ -1368,6 +1372,9 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+@@ -1390,6 +1394,9 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
  	    field->application != HID_CP_CONSUMER_CONTROL &&
  	    field->application != HID_GD_WIRELESS_RADIO_CTLS &&
  	    field->application != HID_GD_SYSTEM_MULTIAXIS &&
@@ -4027,7 +7931,7 @@ index fe849df6a948..3a7a43eb9fbe 100644
  	    !(field->application == HID_VD_ASUS_CUSTOM_MEDIA_KEYS &&
  	      application->quirks & MT_QUIRK_ASUS_CUSTOM_UP))
  		return -1;
-@@ -1395,6 +1402,21 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+@@ -1417,6 +1424,21 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
  		return 1;
  	}
  
@@ -4049,7 +7953,7 @@ index fe849df6a948..3a7a43eb9fbe 100644
  	if (rdata->is_mt_collection)
  		return mt_touch_input_mapping(hdev, hi, field, usage, bit, max,
  					      application);
-@@ -1416,6 +1438,7 @@ static int mt_input_mapped(struct hid_device *hdev, struct hid_input *hi,
+@@ -1438,6 +1460,7 @@ static int mt_input_mapped(struct hid_device *hdev, struct hid_input *hi,
  {
  	struct mt_device *td = hid_get_drvdata(hdev);
  	struct mt_report_data *rdata;
@@ -4057,7 +7961,7 @@ index fe849df6a948..3a7a43eb9fbe 100644
  
  	rdata = mt_find_report_data(td, field->report);
  	if (rdata && rdata->is_mt_collection) {
-@@ -1423,6 +1446,19 @@ static int mt_input_mapped(struct hid_device *hdev, struct hid_input *hi,
+@@ -1445,6 +1468,19 @@ static int mt_input_mapped(struct hid_device *hdev, struct hid_input *hi,
  		return -1;
  	}
  
@@ -4077,7 +7981,7 @@ index fe849df6a948..3a7a43eb9fbe 100644
  	/* let hid-core decide for the others */
  	return 0;
  }
-@@ -1432,11 +1468,21 @@ static int mt_event(struct hid_device *hid, struct hid_field *field,
+@@ -1454,11 +1490,21 @@ static int mt_event(struct hid_device *hid, struct hid_field *field,
  {
  	struct mt_device *td = hid_get_drvdata(hid);
  	struct mt_report_data *rdata;
@@ -4099,7 +8003,7 @@ index fe849df6a948..3a7a43eb9fbe 100644
  	return 0;
  }
  
-@@ -1589,6 +1635,42 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app)
+@@ -1611,6 +1657,42 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app)
  		app->quirks &= ~MT_QUIRK_CONTACT_CNT_ACCURATE;
  }
  
@@ -4142,7 +8046,7 @@ index fe849df6a948..3a7a43eb9fbe 100644
  static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
  {
  	struct mt_device *td = hid_get_drvdata(hdev);
-@@ -1638,6 +1720,13 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
+@@ -1660,6 +1742,13 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
  		/* force BTN_STYLUS to allow tablet matching in udev */
  		__set_bit(BTN_STYLUS, hi->input->keybit);
  		break;
@@ -4156,7 +8060,7 @@ index fe849df6a948..3a7a43eb9fbe 100644
  	default:
  		suffix = "UNKNOWN";
  		break;
-@@ -1726,30 +1815,6 @@ static void mt_expired_timeout(struct timer_list *t)
+@@ -1748,30 +1837,6 @@ static void mt_expired_timeout(struct timer_list *t)
  	clear_bit_unlock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);
  }
  
@@ -4187,7 +8091,7 @@ index fe849df6a948..3a7a43eb9fbe 100644
  static void update_keyboard_backlight(struct hid_device *hdev, bool enabled)
  {
  	struct usb_device *udev = hid_to_usb_dev(hdev);
-@@ -1758,8 +1823,9 @@ static void update_keyboard_backlight(struct hid_device *hdev, bool enabled)
+@@ -1780,8 +1845,9 @@ static void update_keyboard_backlight(struct hid_device *hdev, bool enabled)
  	/* Wake up the device in case it's already suspended */
  	pm_runtime_get_sync(&udev->dev);
  
@@ -4199,7 +8103,7 @@ index fe849df6a948..3a7a43eb9fbe 100644
  		hid_err(hdev, "couldn't find backlight field\n");
  		goto out;
  	}
-@@ -1885,13 +1951,24 @@ static int mt_suspend(struct hid_device *hdev, pm_message_t state)
+@@ -1916,13 +1982,24 @@ static int mt_suspend(struct hid_device *hdev, pm_message_t state)
  
  static int mt_reset_resume(struct hid_device *hdev)
  {
@@ -4224,7 +8128,7 @@ index fe849df6a948..3a7a43eb9fbe 100644
  	/* Some Elan legacy devices require SET_IDLE to be set on resume.
  	 * It should be safe to send it to other devices too.
  	 * Tested on 3M, Stantum, Cypress, Zytronic, eGalax, and Elan panels. */
-@@ -1900,6 +1977,10 @@ static int mt_resume(struct hid_device *hdev)
+@@ -1931,6 +2008,10 @@ static int mt_resume(struct hid_device *hdev)
  
  	mt_set_modes(hdev, HID_LATENCY_NORMAL, true, true);
  
@@ -4235,7 +8139,7 @@ index fe849df6a948..3a7a43eb9fbe 100644
  	return 0;
  }
  #endif
-@@ -1907,6 +1988,21 @@ static int mt_resume(struct hid_device *hdev)
+@@ -1938,6 +2019,21 @@ static int mt_resume(struct hid_device *hdev)
  static void mt_remove(struct hid_device *hdev)
  {
  	struct mt_device *td = hid_get_drvdata(hdev);
@@ -4258,9 +8162,157 @@ index fe849df6a948..3a7a43eb9fbe 100644
  	unregister_pm_notifier(&td->pm_notifier);
  	del_timer_sync(&td->release_timer);
 -- 
-2.39.0
+2.39.2
+
+From a1d8dbed4b776b6b979deeb0f8c3010bd19369fe Mon Sep 17 00:00:00 2001
+From: Maximilian Luz <luzmaximilian@gmail.com>
+Date: Sun, 19 Feb 2023 22:12:24 +0100
+Subject: [PATCH] PCI: Add quirk to prevent calling shutdown mehtod
+
+Work around buggy EFI firmware: On some Microsoft Surface devices
+(Surface Pro 9 and Surface Laptop 5) the EFI ResetSystem call with
+EFI_RESET_SHUTDOWN doesn't function properly. Instead of shutting the
+system down, it returns and the system stays on.
+
+It turns out that this only happens after PCI shutdown callbacks ran for
+specific devices. Excluding those devices from the shutdown process
+makes the ResetSystem call work as expected.
+
+TODO: Maybe we can find a better way or the root cause of this?
+
+Not-Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Patchset: surface-shutdown
+---
+ drivers/pci/pci-driver.c |  3 +++
+ drivers/pci/quirks.c     | 36 ++++++++++++++++++++++++++++++++++++
+ include/linux/pci.h      |  1 +
+ 3 files changed, 40 insertions(+)
+
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index f47a3b10bf504..9ea4352aac56c 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -507,6 +507,9 @@ static void pci_device_shutdown(struct device *dev)
+ 	struct pci_dev *pci_dev = to_pci_dev(dev);
+ 	struct pci_driver *drv = pci_dev->driver;
+ 
++	if (pci_dev->no_shutdown)
++		return;
++
+ 	pm_runtime_resume(dev);
+ 
+ 	if (drv && drv->shutdown)
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 494fa46f57671..106fb2ff855b2 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -6015,3 +6015,39 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2d, dpc_log_size);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2f, dpc_log_size);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a31, dpc_log_size);
+ #endif
++
++static const struct dmi_system_id no_shutdown_dmi_table[] = {
++	/*
++	 * Systems on which some devices should not be touched during shutdown.
++	 */
++	{
++		.ident = "Microsoft Surface Pro 9",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Surface Pro 9"),
++		},
++	},
++	{
++		.ident = "Microsoft Surface Laptop 5",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Surface Laptop 5"),
++		},
++	},
++	{}
++};
++
++static void quirk_no_shutdown(struct pci_dev *dev)
++{
++	if (!dmi_check_system(no_shutdown_dmi_table))
++		return;
++
++	dev->no_shutdown = 1;
++	pci_info(dev, "disabling shutdown ops for [%04x:%04x]\n",
++		 dev->vendor, dev->device);
++}
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x461e, quirk_no_shutdown);  // Thunderbolt 4 USB Controller
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x461f, quirk_no_shutdown);  // Thunderbolt 4 PCI Express Root Port
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x462f, quirk_no_shutdown);  // Thunderbolt 4 PCI Express Root Port
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x466d, quirk_no_shutdown);  // Thunderbolt 4 NHI
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x46a8, quirk_no_shutdown);  // GPU
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index cb538bc579710..409925d303ed7 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -462,6 +462,7 @@ struct pci_dev {
+ 	unsigned int	no_vf_scan:1;		/* Don't scan for VFs after IOV enablement */
+ 	unsigned int	no_command_memory:1;	/* No PCI_COMMAND_MEMORY */
+ 	unsigned int	rom_bar_overlap:1;	/* ROM BAR disable broken */
++	unsigned int	no_shutdown:1;		/* Do not touch device on shutdown */
+ 	pci_dev_flags_t dev_flags;
+ 	atomic_t	enable_cnt;	/* pci_enable_device has been called */
+ 
+-- 
+2.39.2
+
+From 23fb72a959d8cb8842ea87ee7705427e3c1d6ab9 Mon Sep 17 00:00:00 2001
+From: Maximilian Luz <luzmaximilian@gmail.com>
+Date: Sun, 12 Mar 2023 01:41:57 +0100
+Subject: [PATCH] platform/surface: gpe: Add support for Surface Pro 9
+
+Add the lid GPE used by the Surface Pro 9.
+
+Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Patchset: surface-gpe
+---
+ drivers/platform/surface/surface_gpe.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/platform/surface/surface_gpe.c b/drivers/platform/surface/surface_gpe.c
+index c219b840d491a..69c4352e8406b 100644
+--- a/drivers/platform/surface/surface_gpe.c
++++ b/drivers/platform/surface/surface_gpe.c
+@@ -41,6 +41,11 @@ static const struct property_entry lid_device_props_l4F[] = {
+ 	{},
+ };
+ 
++static const struct property_entry lid_device_props_l52[] = {
++	PROPERTY_ENTRY_U32("gpe", 0x52),
++	{},
++};
++
+ static const struct property_entry lid_device_props_l57[] = {
+ 	PROPERTY_ENTRY_U32("gpe", 0x57),
+ 	{},
+@@ -107,6 +112,18 @@ static const struct dmi_system_id dmi_lid_device_table[] = {
+ 		},
+ 		.driver_data = (void *)lid_device_props_l4B,
+ 	},
++	{
++		/*
++		 * We match for SKU here due to product name clash with the ARM
++		 * version.
++		 */
++		.ident = "Surface Pro 9",
++		.matches = {
++			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "Surface_Pro_9_2038"),
++		},
++		.driver_data = (void *)lid_device_props_l52,
++	},
+ 	{
+ 		.ident = "Surface Book 1",
+ 		.matches = {
+-- 
+2.39.2
 
-From d7034b752abab1bc8bbeae6bec214434a59e9a43 Mon Sep 17 00:00:00 2001
+From 033ef8c5b7ad4308e3ac076e35256488491046e3 Mon Sep 17 00:00:00 2001
 From: Hans de Goede <hdegoede@redhat.com>
 Date: Sun, 10 Oct 2021 20:56:57 +0200
 Subject: [PATCH] ACPI: delay enumeration of devices with a _DEP pointing to an
@@ -4320,10 +8372,10 @@ Patchset: cameras
  1 file changed, 3 insertions(+)
 
 diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
-index b47e93a24a9a..22c921886cbe 100644
+index dbfa58e799e28..ccbd3f8b523e8 100644
 --- a/drivers/acpi/scan.c
 +++ b/drivers/acpi/scan.c
-@@ -2103,6 +2103,9 @@ static acpi_status acpi_bus_check_add_2(acpi_handle handle, u32 lvl_not_used,
+@@ -2106,6 +2106,9 @@ static acpi_status acpi_bus_check_add_2(acpi_handle handle, u32 lvl_not_used,
  
  static void acpi_default_enumeration(struct acpi_device *device)
  {
@@ -4334,9 +8386,9 @@ index b47e93a24a9a..22c921886cbe 100644
  	 * Do not enumerate devices with enumeration_by_parent flag set as
  	 * they will be enumerated by their respective parents.
 -- 
-2.39.0
+2.39.2
 
-From b7ae48c658abca801fb92cc6c734a3e3726ede8a Mon Sep 17 00:00:00 2001
+From 0b559e61d232d1fd2dfd6ebcf3a1626a1f434531 Mon Sep 17 00:00:00 2001
 From: zouxiaoh <xiaohong.zou@intel.com>
 Date: Fri, 25 Jun 2021 08:52:59 +0800
 Subject: [PATCH] iommu: intel-ipu: use IOMMU passthrough mode for Intel IPUs
@@ -4362,7 +8414,7 @@ Patchset: cameras
  1 file changed, 30 insertions(+)
 
 diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
-index 408c321b929a..6e58effbe12b 100644
+index 3965979c7bd41..509cfb9f66954 100644
 --- a/drivers/iommu/intel/iommu.c
 +++ b/drivers/iommu/intel/iommu.c
 @@ -37,6 +37,12 @@
@@ -4413,7 +8465,7 @@ index 408c321b929a..6e58effbe12b 100644
  	if (!dmar_map_ipts)
  		iommu_identity_mapping |= IDENTMAP_IPTS;
  
-@@ -4784,6 +4798,18 @@ static void quirk_iommu_igfx(struct pci_dev *dev)
+@@ -4798,6 +4812,18 @@ static void quirk_iommu_igfx(struct pci_dev *dev)
  	dmar_map_gfx = 0;
  }
  
@@ -4432,7 +8484,7 @@ index 408c321b929a..6e58effbe12b 100644
  static void quirk_iommu_ipts(struct pci_dev *dev)
  {
  	if (!IS_IPTS(dev))
-@@ -4795,6 +4821,7 @@ static void quirk_iommu_ipts(struct pci_dev *dev)
+@@ -4809,6 +4835,7 @@ static void quirk_iommu_ipts(struct pci_dev *dev)
  	pci_info(dev, "Passthrough IOMMU for IPTS\n");
  	dmar_map_ipts = 0;
  }
@@ -4440,7 +8492,7 @@ index 408c321b929a..6e58effbe12b 100644
  /* G4x/GM45 integrated gfx dmar support is totally busted. */
  DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_igfx);
  DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e00, quirk_iommu_igfx);
-@@ -4830,6 +4857,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1632, quirk_iommu_igfx);
+@@ -4844,6 +4871,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1632, quirk_iommu_igfx);
  DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x163A, quirk_iommu_igfx);
  DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x163D, quirk_iommu_igfx);
  
@@ -4451,9 +8503,9 @@ index 408c321b929a..6e58effbe12b 100644
  DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9D3E, quirk_iommu_ipts);
  
 -- 
-2.39.0
+2.39.2
 
-From b8246f77d572fe16b5cd53acf2473cb6eddcaddc Mon Sep 17 00:00:00 2001
+From 26b6001d2f0738dc69212b714b4cfe5ad5c769da Mon Sep 17 00:00:00 2001
 From: Daniel Scally <djrscally@gmail.com>
 Date: Sun, 10 Oct 2021 20:57:02 +0200
 Subject: [PATCH] platform/x86: int3472: Enable I2c daisy chain
@@ -4470,7 +8522,7 @@ Patchset: cameras
  1 file changed, 7 insertions(+)
 
 diff --git a/drivers/platform/x86/intel/int3472/tps68470.c b/drivers/platform/x86/intel/int3472/tps68470.c
-index 5b8d1a9620a5..6a0ff035cf20 100644
+index 5b8d1a9620a5d..6a0ff035cf209 100644
 --- a/drivers/platform/x86/intel/int3472/tps68470.c
 +++ b/drivers/platform/x86/intel/int3472/tps68470.c
 @@ -46,6 +46,13 @@ static int tps68470_chip_init(struct device *dev, struct regmap *regmap)
@@ -4488,9 +8540,9 @@ index 5b8d1a9620a5..6a0ff035cf20 100644
  
  	return 0;
 -- 
-2.39.0
+2.39.2
 
-From 75d54e3be5ceb01b46d74e3e9d3af3f88d7a2669 Mon Sep 17 00:00:00 2001
+From b71265fab43356eada571af1390deb3ac5fc238a Mon Sep 17 00:00:00 2001
 From: Daniel Scally <djrscally@gmail.com>
 Date: Thu, 28 Oct 2021 21:55:16 +0100
 Subject: [PATCH] media: i2c: Add driver for DW9719 VCM
@@ -4509,7 +8561,7 @@ Patchset: cameras
  create mode 100644 drivers/media/i2c/dw9719.c
 
 diff --git a/MAINTAINERS b/MAINTAINERS
-index 886d3f69ee64..659fc8af4a12 100644
+index 350d7e3ba94f9..ce7d8d9c83cb1 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
 @@ -6286,6 +6286,13 @@ T:	git git://linuxtv.org/media_tree.git
@@ -4527,7 +8579,7 @@ index 886d3f69ee64..659fc8af4a12 100644
  M:	Dongchun Zhu <dongchun.zhu@mediatek.com>
  L:	linux-media@vger.kernel.org
 diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
-index 7806d4b81716..98d081efeef7 100644
+index 7806d4b81716e..98d081efeef7f 100644
 --- a/drivers/media/i2c/Kconfig
 +++ b/drivers/media/i2c/Kconfig
 @@ -821,6 +821,17 @@ config VIDEO_DW9714
@@ -4549,7 +8601,7 @@ index 7806d4b81716..98d081efeef7 100644
  	tristate "DW9768 lens voice coil support"
  	depends on I2C && VIDEO_DEV
 diff --git a/drivers/media/i2c/Makefile b/drivers/media/i2c/Makefile
-index 0a2933103dd9..b82a07c76388 100644
+index 0a2933103dd92..b82a07c763880 100644
 --- a/drivers/media/i2c/Makefile
 +++ b/drivers/media/i2c/Makefile
 @@ -30,6 +30,7 @@ obj-$(CONFIG_VIDEO_CS5345) += cs5345.o
@@ -4562,7 +8614,7 @@ index 0a2933103dd9..b82a07c76388 100644
  obj-$(CONFIG_VIDEO_ET8EK8) += et8ek8/
 diff --git a/drivers/media/i2c/dw9719.c b/drivers/media/i2c/dw9719.c
 new file mode 100644
-index 000000000000..180b04d2a6b3
+index 0000000000000..180b04d2a6b3a
 --- /dev/null
 +++ b/drivers/media/i2c/dw9719.c
 @@ -0,0 +1,425 @@
@@ -4992,9 +9044,9 @@ index 000000000000..180b04d2a6b3
 +MODULE_DESCRIPTION("DW9719 VCM Driver");
 +MODULE_LICENSE("GPL");
 -- 
-2.39.0
+2.39.2
 
-From 0611d5aa6bb68362b37dc6dc310050ed2d16bd64 Mon Sep 17 00:00:00 2001
+From 0ee02b001c6e806cca3e7eeef5bf0608e7580436 Mon Sep 17 00:00:00 2001
 From: Daniel Scally <djrscally@gmail.com>
 Date: Wed, 4 May 2022 23:21:45 +0100
 Subject: [PATCH] media: ipu3-cio2: Move functionality from .complete() to
@@ -5013,7 +9065,7 @@ Patchset: cameras
  1 file changed, 23 insertions(+), 42 deletions(-)
 
 diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c
-index 390bd5ea3472..76339fb842bf 100644
+index 3b76a9d0383a8..38f9f4da1922e 100644
 --- a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c
 +++ b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c
 @@ -1383,7 +1383,10 @@ static int cio2_notifier_bound(struct v4l2_async_notifier *notifier,
@@ -5107,9 +9159,9 @@ index 390bd5ea3472..76339fb842bf 100644
  
  static int cio2_parse_firmware(struct cio2_device *cio2)
 -- 
-2.39.0
+2.39.2
 
-From 65a24c651f437949aaa6cd640bf8318d747a92ce Mon Sep 17 00:00:00 2001
+From a7a074d5023e76983ca0325eb8dedca224a858b8 Mon Sep 17 00:00:00 2001
 From: Daniel Scally <djrscally@gmail.com>
 Date: Thu, 2 Jun 2022 22:15:56 +0100
 Subject: [PATCH] media: ipu3-cio2: Re-add .complete() to ipu3-cio2
@@ -5127,7 +9179,7 @@ Patchset: cameras
  1 file changed, 9 insertions(+)
 
 diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c
-index 76339fb842bf..eb7aa269ec2b 100644
+index 38f9f4da1922e..82681df7d794f 100644
 --- a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c
 +++ b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c
 @@ -1430,9 +1430,18 @@ static void cio2_notifier_unbind(struct v4l2_async_notifier *notifier,
@@ -5150,9 +9202,9 @@ index 76339fb842bf..eb7aa269ec2b 100644
  
  static int cio2_parse_firmware(struct cio2_device *cio2)
 -- 
-2.39.0
+2.39.2
 
-From c07d00b78e9792663f36a8f57444fc9b4e66a0d8 Mon Sep 17 00:00:00 2001
+From c4a0681b762a438e7ab1df93fe1ba0bb5f14d799 Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
 Date: Fri, 15 Jul 2022 23:48:00 +0200
 Subject: [PATCH] drivers/media/i2c: Fix DW9719 dependencies
@@ -5166,7 +9218,7 @@ Patchset: cameras
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
-index 98d081efeef7..c67966cafe10 100644
+index 98d081efeef7f..c67966cafe109 100644
 --- a/drivers/media/i2c/Kconfig
 +++ b/drivers/media/i2c/Kconfig
 @@ -823,7 +823,7 @@ config VIDEO_DW9714
@@ -5179,9 +9231,100 @@ index 98d081efeef7..c67966cafe10 100644
  	select VIDEO_V4L2_SUBDEV_API
  	select V4L2_ASYNC
 -- 
-2.39.0
+2.39.2
+
+From d3903b5c3021fb0874d2313cd23097931b08b801 Mon Sep 17 00:00:00 2001
+From: Daniel Scally <dan.scally@ideasonboard.com>
+Date: Fri, 24 Feb 2023 14:03:41 +0000
+Subject: [PATCH] platform/x86: int3472: Add GPIOs to Surface Go 3 Board data
+
+Add the INT347E GPIO lookup table to the board data for the Surface
+Go 3. This is necessary to allow the ov7251 IR camera to probe
+properly on that platform.
+
+Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com>
+Patchset: cameras
+---
+ drivers/platform/x86/intel/int3472/tps68470_board_data.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/intel/int3472/tps68470_board_data.c b/drivers/platform/x86/intel/int3472/tps68470_board_data.c
+index 309eab9c05588..322237e056f32 100644
+--- a/drivers/platform/x86/intel/int3472/tps68470_board_data.c
++++ b/drivers/platform/x86/intel/int3472/tps68470_board_data.c
+@@ -159,9 +159,10 @@ static const struct int3472_tps68470_board_data surface_go_tps68470_board_data =
+ static const struct int3472_tps68470_board_data surface_go3_tps68470_board_data = {
+ 	.dev_name = "i2c-INT3472:01",
+ 	.tps68470_regulator_pdata = &surface_go_tps68470_pdata,
+-	.n_gpiod_lookups = 1,
++	.n_gpiod_lookups = 2,
+ 	.tps68470_gpio_lookup_tables = {
+-		&surface_go_int347a_gpios
++		&surface_go_int347a_gpios,
++		&surface_go_int347e_gpios,
+ 	},
+ };
+ 
+-- 
+2.39.2
+
+From 0fc904dd6658824c7624a27618cf280c7afeeeb4 Mon Sep 17 00:00:00 2001
+From: Daniel Scally <dan.scally@ideasonboard.com>
+Date: Thu, 2 Mar 2023 12:59:39 +0000
+Subject: [PATCH] platform/x86: int3472: Remap reset GPIO for INT347E
+
+ACPI _HID INT347E represents the OmniVision 7251 camera sensor. The
+driver for this sensor expects a single pin named "enable", but on
+some Microsoft Surface platforms the sensor is assigned a single
+GPIO who's type flag is INT3472_GPIO_TYPE_RESET.
+
+Remap the GPIO pin's function from "reset" to "enable". This is done
+outside of the existing remap table since it is a more widespread
+discrepancy than that method is designed for. Additionally swap the
+polarity of the pin to match the driver's expectation.
 
-From 4e0cf6e05dd0de32045adcc2087f4ed7c9a184e7 Mon Sep 17 00:00:00 2001
+Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com>
+Patchset: cameras
+---
+ drivers/platform/x86/intel/int3472/discrete.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/platform/x86/intel/int3472/discrete.c b/drivers/platform/x86/intel/int3472/discrete.c
+index c42c3faa2c32d..6f4b8e24eb56c 100644
+--- a/drivers/platform/x86/intel/int3472/discrete.c
++++ b/drivers/platform/x86/intel/int3472/discrete.c
+@@ -108,6 +108,9 @@ static int skl_int3472_map_gpio_to_sensor(struct int3472_discrete_device *int347
+ {
+ 	const struct int3472_sensor_config *sensor_config;
+ 	char *path = agpio->resource_source.string_ptr;
++	const struct acpi_device_id ov7251_ids[] = {
++		{ "INT347E" },
++	};
+ 	struct gpiod_lookup *table_entry;
+ 	struct acpi_device *adev;
+ 	acpi_handle handle;
+@@ -130,6 +133,17 @@ static int skl_int3472_map_gpio_to_sensor(struct int3472_discrete_device *int347
+ 		}
+ 	}
+ 
++	/*
++	 * In addition to the function remap table we need to bulk remap the
++	 * "reset" GPIO for the OmniVision 7251 sensor, as the driver for that
++	 * expects its only GPIO pin to be called "enable" (and to have the
++	 * opposite polarity).
++	 */
++	if (!strcmp(func, "reset") && !acpi_match_device_ids(int3472->sensor, ov7251_ids)) {
++		func = "enable";
++		polarity = GPIO_ACTIVE_HIGH;
++	}
++
+ 	/* Functions mapped to NULL should not be mapped to the sensor */
+ 	if (!func)
+ 		return 0;
+-- 
+2.39.2
+
+From 7739b393ccba091cac6d21776f65aa2490d45a91 Mon Sep 17 00:00:00 2001
 From: Sachi King <nakato@nakato.io>
 Date: Sat, 29 May 2021 17:47:38 +1000
 Subject: [PATCH] ACPI: Add quirk for Surface Laptop 4 AMD missing irq 7
@@ -5204,7 +9347,7 @@ Patchset: amd-gpio
  1 file changed, 17 insertions(+)
 
 diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
-index 907cc98b1938..0116d27b29ea 100644
+index 518bda50068cb..7706380d825a3 100644
 --- a/arch/x86/kernel/acpi/boot.c
 +++ b/arch/x86/kernel/acpi/boot.c
 @@ -22,6 +22,7 @@
@@ -5215,7 +9358,7 @@ index 907cc98b1938..0116d27b29ea 100644
  
  #include <asm/e820/api.h>
  #include <asm/irqdomain.h>
-@@ -1234,6 +1235,17 @@ static void __init mp_config_acpi_legacy_irqs(void)
+@@ -1247,6 +1248,17 @@ static void __init mp_config_acpi_legacy_irqs(void)
  	}
  }
  
@@ -5233,7 +9376,7 @@ index 907cc98b1938..0116d27b29ea 100644
  /*
   * Parse IOAPIC related entries in MADT
   * returns 0 on success, < 0 on error
-@@ -1289,6 +1301,11 @@ static int __init acpi_parse_madt_ioapic_entries(void)
+@@ -1302,6 +1314,11 @@ static int __init acpi_parse_madt_ioapic_entries(void)
  		acpi_sci_ioapic_setup(acpi_gbl_FADT.sci_interrupt, 0, 0,
  				      acpi_gbl_FADT.sci_interrupt);
  
@@ -5246,9 +9389,9 @@ index 907cc98b1938..0116d27b29ea 100644
  	mp_config_acpi_legacy_irqs();
  
 -- 
-2.39.0
+2.39.2
 
-From 94f476cef8457ab5cba6109ee104608eba7e8072 Mon Sep 17 00:00:00 2001
+From 09ed2994012b6aafb79e8e48080f8ad9f3a4b17e Mon Sep 17 00:00:00 2001
 From: Maximilian Luz <luzmaximilian@gmail.com>
 Date: Thu, 3 Jun 2021 14:04:26 +0200
 Subject: [PATCH] ACPI: Add AMD 13" Surface Laptop 4 model to irq 7 override
@@ -5263,10 +9406,10 @@ Patchset: amd-gpio
  1 file changed, 8 insertions(+), 1 deletion(-)
 
 diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
-index 0116d27b29ea..af102c6f8e5b 100644
+index 7706380d825a3..e26c38ddc601d 100644
 --- a/arch/x86/kernel/acpi/boot.c
 +++ b/arch/x86/kernel/acpi/boot.c
-@@ -1237,12 +1237,19 @@ static void __init mp_config_acpi_legacy_irqs(void)
+@@ -1250,12 +1250,19 @@ static void __init mp_config_acpi_legacy_irqs(void)
  
  static const struct dmi_system_id surface_quirk[] __initconst = {
  	{
@@ -5288,9 +9431,9 @@ index 0116d27b29ea..af102c6f8e5b 100644
  };
  
 -- 
-2.39.0
+2.39.2
 
-From ad11ec823a7792d636492a9f99dfaf7bd7842f0d Mon Sep 17 00:00:00 2001
+From 8ddc376b24ac53d198df35cbbc0034e3a7e9bcf1 Mon Sep 17 00:00:00 2001
 From: "Bart Groeneveld | GPX Solutions B.V" <bart@gpxbv.nl>
 Date: Mon, 5 Dec 2022 16:08:46 +0100
 Subject: [PATCH] acpi: allow usage of acpi_tad on HW-reduced platforms
@@ -5313,7 +9456,7 @@ Patchset: rtc
  1 file changed, 24 insertions(+), 11 deletions(-)
 
 diff --git a/drivers/acpi/acpi_tad.c b/drivers/acpi/acpi_tad.c
-index e9b8e8305e23..944276934e7e 100644
+index e9b8e8305e23e..944276934e7ec 100644
 --- a/drivers/acpi/acpi_tad.c
 +++ b/drivers/acpi/acpi_tad.c
 @@ -432,6 +432,14 @@ static ssize_t caps_show(struct device *dev, struct device_attribute *attr,
@@ -5397,5 +9540,3311 @@ index e9b8e8305e23..944276934e7e 100644
  		ret = sysfs_create_group(&dev->kobj, &acpi_tad_dc_attr_group);
  		if (ret)
 -- 
-2.39.0
+2.39.2
+
+From 8cb6f5bf4f355b0169e3f60c559a5e2203c1a988 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Tue, 18 Oct 2022 04:22:40 -0700
+Subject: [PATCH] thermal: intel: hfi: Improve the type of
+ hfi_features::nr_table_pages
+
+A Coverity static code scan raised a potential overflow_before_widen
+warning when hfi_features::nr_table_pages is used as an argument to
+memcpy in intel_hfi_process_event().
+
+Even though the overflow can never happen (the maximum number of pages of
+the HFI table is 0x10 and 0x10 << PAGE_SHIFT = 0x10000), using size_t as
+the data type of hfi_features::nr_table_pages makes Coverity happy and
+matches the data type of the argument 'size' of memcpy().
+
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Patchset: intel-thread-director
+---
+ drivers/thermal/intel/intel_hfi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/intel/intel_hfi.c b/drivers/thermal/intel/intel_hfi.c
+index a0640f762dc5d..239afe02e5182 100644
+--- a/drivers/thermal/intel/intel_hfi.c
++++ b/drivers/thermal/intel/intel_hfi.c
+@@ -137,7 +137,7 @@ struct hfi_instance {
+  * Parameters and supported features that are common to all HFI instances
+  */
+ struct hfi_features {
+-	unsigned int	nr_table_pages;
++	size_t		nr_table_pages;
+ 	unsigned int	cpu_stride;
+ 	unsigned int	hdr_size;
+ };
+-- 
+2.39.2
+
+From 8f590ad883a1330a99f0bbd18d76c4631d7fddbb Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 20:58:29 -0800
+Subject: [PATCH] sched/fair: Generalize asym_packing logic for SMT cores
+
+When doing asym_packing load balancing between cores, all we care is that
+the destination core is fully idle (including SMT siblings, if any) and
+that the busiest candidate scheduling group has exactly one busy CPU. It is
+irrelevant whether the candidate busiest core is non-SMT, SMT2, SMT4, SMT8,
+etc.
+
+Do not handle the candidate busiest non-SMT vs SMT cases separately. Simply
+do the two checks described above. Let find_busiest_group() handle bigger
+imbalances in the number of idle CPUs.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-kernel@vger.kernel.org
+Reviewed-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Tested-by: Zhang Rui <rui.zhang@intel.com>
+Patchset: intel-thread-director
+---
+ kernel/sched/fair.c | 41 ++++++++++++++---------------------------
+ 1 file changed, 14 insertions(+), 27 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 2c3d0d49c80ea..8b5fc8e86addb 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -9042,13 +9042,11 @@ group_type group_classify(unsigned int imbalance_pct,
+  * the SMT siblings of @sg are busy. If only one CPU in @sg is busy, pull tasks
+  * only if @dst_cpu has higher priority.
+  *
+- * If both @dst_cpu and @sg have SMT siblings, and @sg has exactly one more
+- * busy CPU than @sds::local, let @dst_cpu pull tasks if it has higher priority.
+- * Bigger imbalances in the number of busy CPUs will be dealt with in
+- * update_sd_pick_busiest().
+- *
+- * If @sg does not have SMT siblings, only pull tasks if all of the SMT siblings
+- * of @dst_cpu are idle and @sg has lower priority.
++ * If @dst_cpu has SMT siblings, check if there are no running tasks in
++ * @sds::local. In such case, decide based on the priority of @sg. Do it only
++ * if @sg has exactly one busy CPU (i.e., one more than @sds::local). Bigger
++ * imbalances in the number of busy CPUs will be dealt with in
++ * find_busiest_group().
+  *
+  * Return: true if @dst_cpu can pull tasks, false otherwise.
+  */
+@@ -9057,12 +9055,10 @@ static bool asym_smt_can_pull_tasks(int dst_cpu, struct sd_lb_stats *sds,
+ 				    struct sched_group *sg)
+ {
+ #ifdef CONFIG_SCHED_SMT
+-	bool local_is_smt, sg_is_smt;
++	bool local_is_smt;
+ 	int sg_busy_cpus;
+ 
+ 	local_is_smt = sds->local->flags & SD_SHARE_CPUCAPACITY;
+-	sg_is_smt = sg->flags & SD_SHARE_CPUCAPACITY;
+-
+ 	sg_busy_cpus = sgs->group_weight - sgs->idle_cpus;
+ 
+ 	if (!local_is_smt) {
+@@ -9083,25 +9079,16 @@ static bool asym_smt_can_pull_tasks(int dst_cpu, struct sd_lb_stats *sds,
+ 		return sched_asym_prefer(dst_cpu, sg->asym_prefer_cpu);
+ 	}
+ 
+-	/* @dst_cpu has SMT siblings. */
+-
+-	if (sg_is_smt) {
+-		int local_busy_cpus = sds->local->group_weight -
+-				      sds->local_stat.idle_cpus;
+-		int busy_cpus_delta = sg_busy_cpus - local_busy_cpus;
+-
+-		if (busy_cpus_delta == 1)
+-			return sched_asym_prefer(dst_cpu, sg->asym_prefer_cpu);
+-
+-		return false;
+-	}
+-
+ 	/*
+-	 * @sg does not have SMT siblings. Ensure that @sds::local does not end
+-	 * up with more than one busy SMT sibling and only pull tasks if there
+-	 * are not busy CPUs (i.e., no CPU has running tasks).
++	 * @dst_cpu has SMT siblings. Do asym_packing load balancing only if
++	 * all its siblings are idle (moving tasks between physical cores in
++	 * which some SMT siblings are busy results in the same throughput).
++	 *
++	 * If the difference in the number of busy CPUs is two or more, let
++	 * find_busiest_group() take care of it. We only care if @sg has
++	 * exactly one busy CPU. This covers SMT and non-SMT sched groups.
+ 	 */
+-	if (!sds->local_stat.sum_nr_running)
++	if (sg_busy_cpus == 1 && !sds->local_stat.sum_nr_running)
+ 		return sched_asym_prefer(dst_cpu, sg->asym_prefer_cpu);
+ 
+ 	return false;
+-- 
+2.39.2
+
+From 5a3b5eb5f79e51634f5fd173c0949c5293c93566 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 20:58:30 -0800
+Subject: [PATCH] sched/fair: Move is_core_idle() out of CONFIG_NUMA
+
+asym_packing needs this function to determine whether an SMT core is a
+suitable destination for load balancing.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Tested-by: Zhang Rui <rui.zhang@intel.com>
+Patchset: intel-thread-director
+---
+ kernel/sched/fair.c | 34 +++++++++++++++++-----------------
+ 1 file changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 8b5fc8e86addb..98c64f1db20e0 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -1049,6 +1049,23 @@ update_stats_curr_start(struct cfs_rq *cfs_rq, struct sched_entity *se)
+  * Scheduling class queueing methods:
+  */
+ 
++static inline bool is_core_idle(int cpu)
++{
++#ifdef CONFIG_SCHED_SMT
++	int sibling;
++
++	for_each_cpu(sibling, cpu_smt_mask(cpu)) {
++		if (cpu == sibling)
++			continue;
++
++		if (!idle_cpu(sibling))
++			return false;
++	}
++#endif
++
++	return true;
++}
++
+ #ifdef CONFIG_NUMA
+ #define NUMA_IMBALANCE_MIN 2
+ 
+@@ -1688,23 +1705,6 @@ struct numa_stats {
+ 	int idle_cpu;
+ };
+ 
+-static inline bool is_core_idle(int cpu)
+-{
+-#ifdef CONFIG_SCHED_SMT
+-	int sibling;
+-
+-	for_each_cpu(sibling, cpu_smt_mask(cpu)) {
+-		if (cpu == sibling)
+-			continue;
+-
+-		if (!idle_cpu(sibling))
+-			return false;
+-	}
+-#endif
+-
+-	return true;
+-}
+-
+ struct task_numa_env {
+ 	struct task_struct *p;
+ 
+-- 
+2.39.2
+
+From d4ba60a8be784dc7ed866fb52ff94519eb9d1586 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 20:58:31 -0800
+Subject: [PATCH] sched/fair: Only do asym_packing load balancing from fully
+ idle SMT cores
+
+When balancing load between cores, all the SMT siblings of the destination
+CPU, if any, must be idle. Otherwise, pulling new tasks degrades the
+throughput of the busy SMT siblings. The overall throughput of the system
+remains the same.
+
+When balancing load within an SMT core this consideration is not relevant
+relevant. Follow the priorities that hardware indicates.
+
+Using is_core_idle() renders checking !sds->local_stat.sum_nr_running
+redundant. Remove it.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-kernel@vger.kernel.org
+Suggested-by: Valentin Schneider <vschneid@redhat.com>
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Tested-by: Zhang Rui <rui.zhang@intel.com>
+Patchset: intel-thread-director
+---
+ kernel/sched/fair.c | 34 +++++++++++++++++++++++++---------
+ 1 file changed, 25 insertions(+), 9 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 98c64f1db20e0..f74777fc78d7d 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -9038,12 +9038,14 @@ group_type group_classify(unsigned int imbalance_pct,
+  * Check the state of the SMT siblings of both @sds::local and @sg and decide
+  * if @dst_cpu can pull tasks.
+  *
++ * This function must be called only if all the SMT siblings of @dst_cpu are
++ * idle, if any.
++ *
+  * If @dst_cpu does not have SMT siblings, it can pull tasks if two or more of
+  * the SMT siblings of @sg are busy. If only one CPU in @sg is busy, pull tasks
+  * only if @dst_cpu has higher priority.
+  *
+- * If @dst_cpu has SMT siblings, check if there are no running tasks in
+- * @sds::local. In such case, decide based on the priority of @sg. Do it only
++ * If @dst_cpu has SMT siblings, decide based on the priority of @sg. Do it only
+  * if @sg has exactly one busy CPU (i.e., one more than @sds::local). Bigger
+  * imbalances in the number of busy CPUs will be dealt with in
+  * find_busiest_group().
+@@ -9080,15 +9082,13 @@ static bool asym_smt_can_pull_tasks(int dst_cpu, struct sd_lb_stats *sds,
+ 	}
+ 
+ 	/*
+-	 * @dst_cpu has SMT siblings. Do asym_packing load balancing only if
+-	 * all its siblings are idle (moving tasks between physical cores in
+-	 * which some SMT siblings are busy results in the same throughput).
++	 * @dst_cpu has SMT siblings and are also idle.
+ 	 *
+ 	 * If the difference in the number of busy CPUs is two or more, let
+ 	 * find_busiest_group() take care of it. We only care if @sg has
+ 	 * exactly one busy CPU. This covers SMT and non-SMT sched groups.
+ 	 */
+-	if (sg_busy_cpus == 1 && !sds->local_stat.sum_nr_running)
++	if (sg_busy_cpus == 1)
+ 		return sched_asym_prefer(dst_cpu, sg->asym_prefer_cpu);
+ 
+ 	return false;
+@@ -9102,7 +9102,14 @@ static inline bool
+ sched_asym(struct lb_env *env, struct sd_lb_stats *sds,  struct sg_lb_stats *sgs,
+ 	   struct sched_group *group)
+ {
+-	/* Only do SMT checks if either local or candidate have SMT siblings */
++	/*
++	 * If the destination CPU has SMT siblings, env->idle != CPU_NOT_IDLE
++	 * is not sufficient. We need to make sure the whole core is idle.
++	 */
++	if (sds->local->flags & SD_SHARE_CPUCAPACITY && !is_core_idle(env->dst_cpu))
++		return false;
++
++	/* Only do SMT checks if either local or candidate have SMT siblings. */
+ 	if ((sds->local->flags & SD_SHARE_CPUCAPACITY) ||
+ 	    (group->flags & SD_SHARE_CPUCAPACITY))
+ 		return asym_smt_can_pull_tasks(env->dst_cpu, sds, sgs, group);
+@@ -11049,8 +11056,17 @@ static void nohz_balancer_kick(struct rq *rq)
+ 		 */
+ 		for_each_cpu_and(i, sched_domain_span(sd), nohz.idle_cpus_mask) {
+ 			if (sched_asym_prefer(i, cpu)) {
+-				flags = NOHZ_STATS_KICK | NOHZ_BALANCE_KICK;
+-				goto unlock;
++				/*
++				 * Always do ASYM_PACKING balance in the SMT
++				 * domain. In upper domains, the core must be
++				 * fully idle.
++				 */
++				if (sd->flags & SD_SHARE_CPUCAPACITY ||
++				    (!(sd->flags & SD_SHARE_CPUCAPACITY) &&
++				     is_core_idle(i))) {
++					flags = NOHZ_STATS_KICK | NOHZ_BALANCE_KICK;
++					goto unlock;
++				}
+ 			}
+ 		}
+ 	}
+-- 
+2.39.2
+
+From 20641917bc6bad6f81bafe1bac213c1c3e70ed09 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 20:58:32 -0800
+Subject: [PATCH] sched/fair: Let low-priority cores help high-priority busy
+ SMT cores
+
+Using asym_packing priorities within an SMT core is straightforward. Just
+follow the priorities that hardware indicates.
+
+When balancing load from an SMT core, also consider the idle of its
+siblings. Priorities do not reflect that an SMT core divides its throughput
+among all its busy siblings. They only makes sense when exactly one sibling
+is busy.
+
+Indicate that active balance is needed if the destination CPU has lower
+priority than the source CPU but the latter has busy SMT siblings.
+
+Make find_busiest_queue() not skip higher-priority SMT cores with more than
+busy sibling.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-kernel@vger.kernel.org
+Suggested-by: Valentin Schneider <vschneid@redhat.com>
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Tested-by: Zhang Rui <rui.zhang@intel.com>
+Patchset: intel-thread-director
+---
+ kernel/sched/fair.c | 31 ++++++++++++++++++++++++++-----
+ 1 file changed, 26 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index f74777fc78d7d..24183e3eb3d47 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -10224,11 +10224,20 @@ static struct rq *find_busiest_queue(struct lb_env *env,
+ 		    nr_running == 1)
+ 			continue;
+ 
+-		/* Make sure we only pull tasks from a CPU of lower priority */
++		/*
++		 * Make sure we only pull tasks from a CPU of lower priority
++		 * when balancing between SMT siblings.
++		 *
++		 * If balancing between cores, let lower priority CPUs help
++		 * SMT cores with more than one busy sibling.
++		 */
+ 		if ((env->sd->flags & SD_ASYM_PACKING) &&
+ 		    sched_asym_prefer(i, env->dst_cpu) &&
+-		    nr_running == 1)
+-			continue;
++		    nr_running == 1) {
++			if (env->sd->flags & SD_SHARE_CPUCAPACITY ||
++			    (!(env->sd->flags & SD_SHARE_CPUCAPACITY) && is_core_idle(i)))
++				continue;
++		}
+ 
+ 		switch (env->migration_type) {
+ 		case migrate_load:
+@@ -10318,8 +10327,20 @@ asym_active_balance(struct lb_env *env)
+ 	 * lower priority CPUs in order to pack all tasks in the
+ 	 * highest priority CPUs.
+ 	 */
+-	return env->idle != CPU_NOT_IDLE && (env->sd->flags & SD_ASYM_PACKING) &&
+-	       sched_asym_prefer(env->dst_cpu, env->src_cpu);
++	if (env->idle != CPU_NOT_IDLE && (env->sd->flags & SD_ASYM_PACKING)) {
++		/* Always obey priorities between SMT siblings. */
++		if (env->sd->flags & SD_SHARE_CPUCAPACITY)
++			return sched_asym_prefer(env->dst_cpu, env->src_cpu);
++
++		/*
++		 * A lower priority CPU can help an SMT core with more than one
++		 * busy sibling.
++		 */
++		return sched_asym_prefer(env->dst_cpu, env->src_cpu) ||
++		       !is_core_idle(env->src_cpu);
++	}
++
++	return false;
+ }
+ 
+ static inline bool
+-- 
+2.39.2
+
+From c1e77e8eea55b2d16b80c6dde3bcb3cf7e232aa5 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 20:58:33 -0800
+Subject: [PATCH] sched/fair: Keep a fully_busy SMT sched group as busiest
+
+When comparing two fully_busy scheduling groups, keep the current busiest
+group if it represents an SMT core. Tasks in such scheduling group share
+CPU resources and need more help than tasks in a non-SMT fully_busy group.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Tested-by: Zhang Rui <rui.zhang@intel.com>
+Patchset: intel-thread-director
+---
+ kernel/sched/fair.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 24183e3eb3d47..30b0e8476d1c6 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -9302,10 +9302,22 @@ static bool update_sd_pick_busiest(struct lb_env *env,
+ 		 * contention when accessing shared HW resources.
+ 		 *
+ 		 * XXX for now avg_load is not computed and always 0 so we
+-		 * select the 1st one.
++		 * select the 1st one, except if @sg is composed of SMT
++		 * siblings.
+ 		 */
+-		if (sgs->avg_load <= busiest->avg_load)
++
++		if (sgs->avg_load < busiest->avg_load)
+ 			return false;
++
++		if (sgs->avg_load == busiest->avg_load) {
++			/*
++			 * SMT sched groups need more help than non-SMT groups.
++			 * If @sg happens to also be SMT, either choice is good.
++			 */
++			if (sds->busiest->flags & SD_SHARE_CPUCAPACITY)
++				return false;
++		}
++
+ 		break;
+ 
+ 	case group_has_spare:
+-- 
+2.39.2
+
+From a6d2b260d711873add514001a4eca293ff40c860 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 20:58:34 -0800
+Subject: [PATCH] sched/fair: Use the prefer_sibling flag of the current sched
+ domain
+
+SD_PREFER_SIBLING is set from the SMT scheduling domain up to the first
+non-NUMA domain (the exception is systems with SD_ASYM_CPUCAPACITY).
+
+Above the SMT sched domain, all domains have a child. The SD_PREFER_
+SIBLING is honored always regardless of the scheduling domain at which the
+load balance takes place.
+
+There are cases, however, in which the busiest CPU's sched domain has
+child but the destination CPU's does not. Consider, for instance a non-SMT
+core (or an SMT core with only one online sibling) doing load balance with
+an SMT core at the MC level. SD_PREFER_SIBLING will not be honored. We are
+left with a fully busy SMT core and an idle non-SMT core.
+
+Avoid inconsistent behavior. Use the prefer_sibling behavior at the current
+scheduling domain, not its child.
+
+The NUMA sched domain does not have the SD_PREFER_SIBLING flag. Thus, we
+will not spread load among NUMA sched groups, as desired.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-kernel@vger.kernel.org
+Suggested-by: Valentin Schneider <vschneid@redhat.com>
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Tested-by: Zhang Rui <rui.zhang@intel.com>
+Patchset: intel-thread-director
+---
+ kernel/sched/fair.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 30b0e8476d1c6..9e98cfcf1e48b 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -9792,7 +9792,6 @@ static void update_idle_cpu_scan(struct lb_env *env,
+ 
+ static inline void update_sd_lb_stats(struct lb_env *env, struct sd_lb_stats *sds)
+ {
+-	struct sched_domain *child = env->sd->child;
+ 	struct sched_group *sg = env->sd->groups;
+ 	struct sg_lb_stats *local = &sds->local_stat;
+ 	struct sg_lb_stats tmp_sgs;
+@@ -9833,9 +9832,11 @@ static inline void update_sd_lb_stats(struct lb_env *env, struct sd_lb_stats *sd
+ 		sg = sg->next;
+ 	} while (sg != env->sd->groups);
+ 
+-	/* Tag domain that child domain prefers tasks go to siblings first */
+-	sds->prefer_sibling = child && child->flags & SD_PREFER_SIBLING;
+-
++	/*
++	 * Tag domain that @env::sd prefers to spread excess tasks among
++	 * sibling sched groups.
++	 */
++	sds->prefer_sibling = env->sd->flags & SD_PREFER_SIBLING;
+ 
+ 	if (env->sd->flags & SD_NUMA)
+ 		env->fbq_type = fbq_classify_group(&sds->busiest_stat);
+@@ -10134,7 +10135,6 @@ static struct sched_group *find_busiest_group(struct lb_env *env)
+ 			goto out_balanced;
+ 	}
+ 
+-	/* Try to move all excess tasks to child's sibling domain */
+ 	if (sds.prefer_sibling && local->group_type == group_has_spare &&
+ 	    busiest->sum_nr_running > local->sum_nr_running + 1)
+ 		goto force_balance;
+-- 
+2.39.2
+
+From 08ff98c145516a1013cc5cc4f1d9b0d36388ec90 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 20:58:35 -0800
+Subject: [PATCH] sched/fair: Do not even the number of busy CPUs via
+ asym_packing
+
+Now that find_busiest_group() triggers load balancing between a fully_
+busy SMT2 core and an idle non-SMT core, it is no longer needed to force
+balancing via asym_packing. Use asym_packing only as intended: when there
+is high-priority CPU that is idle.
+
+After this change, the same logic apply to SMT and non-SMT local groups.
+Simplify asym_smt_can_pull_tasks() accordingly.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Tested-by: Zhang Rui <rui.zhang@intel.com>
+Patchset: intel-thread-director
+---
+ kernel/sched/fair.c | 37 +++++--------------------------------
+ 1 file changed, 5 insertions(+), 32 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 9e98cfcf1e48b..635e8b41a87c9 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -9035,20 +9035,15 @@ group_type group_classify(unsigned int imbalance_pct,
+  * @sgs:	Load-balancing statistics of the candidate busiest group
+  * @sg:		The candidate busiest group
+  *
+- * Check the state of the SMT siblings of both @sds::local and @sg and decide
+- * if @dst_cpu can pull tasks.
++ * Check the state of the SMT siblings of @sg and decide if @dst_cpu can pull
++ * tasks.
+  *
+  * This function must be called only if all the SMT siblings of @dst_cpu are
+  * idle, if any.
+  *
+- * If @dst_cpu does not have SMT siblings, it can pull tasks if two or more of
+- * the SMT siblings of @sg are busy. If only one CPU in @sg is busy, pull tasks
+- * only if @dst_cpu has higher priority.
+- *
+- * If @dst_cpu has SMT siblings, decide based on the priority of @sg. Do it only
+- * if @sg has exactly one busy CPU (i.e., one more than @sds::local). Bigger
+- * imbalances in the number of busy CPUs will be dealt with in
+- * find_busiest_group().
++ * @dst_cpu can pull tasks if @sg has exactly one busy CPU (i.e., one more than
++ * @sds::local) and has lower group priority than @sds::local. Bigger imbalances
++ * in the number of busy CPUs will be dealt with in find_busiest_group().
+  *
+  * Return: true if @dst_cpu can pull tasks, false otherwise.
+  */
+@@ -9057,33 +9052,11 @@ static bool asym_smt_can_pull_tasks(int dst_cpu, struct sd_lb_stats *sds,
+ 				    struct sched_group *sg)
+ {
+ #ifdef CONFIG_SCHED_SMT
+-	bool local_is_smt;
+ 	int sg_busy_cpus;
+ 
+-	local_is_smt = sds->local->flags & SD_SHARE_CPUCAPACITY;
+ 	sg_busy_cpus = sgs->group_weight - sgs->idle_cpus;
+ 
+-	if (!local_is_smt) {
+-		/*
+-		 * If we are here, @dst_cpu is idle and does not have SMT
+-		 * siblings. Pull tasks if candidate group has two or more
+-		 * busy CPUs.
+-		 */
+-		if (sg_busy_cpus >= 2) /* implies sg_is_smt */
+-			return true;
+-
+-		/*
+-		 * @dst_cpu does not have SMT siblings. @sg may have SMT
+-		 * siblings and only one is busy. In such case, @dst_cpu
+-		 * can help if it has higher priority and is idle (i.e.,
+-		 * it has no running tasks).
+-		 */
+-		return sched_asym_prefer(dst_cpu, sg->asym_prefer_cpu);
+-	}
+-
+ 	/*
+-	 * @dst_cpu has SMT siblings and are also idle.
+-	 *
+ 	 * If the difference in the number of busy CPUs is two or more, let
+ 	 * find_busiest_group() take care of it. We only care if @sg has
+ 	 * exactly one busy CPU. This covers SMT and non-SMT sched groups.
+-- 
+2.39.2
+
+From f70e8d703a3703327fea540de41d6b4df922a85d Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 20:58:36 -0800
+Subject: [PATCH] sched/topology: Remove SHARED_CHILD from ASYM_PACKING
+
+Only x86 and Power7 use ASYM_PACKING. They use it differently.
+
+Power7 has cores of equal priority, but the SMT siblings of a core have
+different priorities. Parent scheduling domains do not need (nor have) the
+ASYM_PACKING flag. SHARED_CHILD is not needed. Using SHARED_PARENT would
+cause the topology debug code to complain.
+
+X86 has cores of different priority, but all the SMT siblings of the core
+have equal priority. It needs ASYM_PACKING at the MC level, but not at the
+SMT level (it also needs it at upper levels if they have scheduling groups
+of different priority). Removing ASYM_PACKING from the SMT domain causes
+the topology debug code to complain.
+
+Remove SHARED_CHILD for now. We still need a topology check that satisfies
+both architectures.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-kernel@vger.kernel.org
+Suggested-by: Valentin Schneider <vschneid@redhat.com>
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Tested-by: Zhang Rui <rui.zhang@intel.com>
+Patchset: intel-thread-director
+---
+ include/linux/sched/sd_flags.h | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/include/linux/sched/sd_flags.h b/include/linux/sched/sd_flags.h
+index 57bde66d95f7a..800238854ba54 100644
+--- a/include/linux/sched/sd_flags.h
++++ b/include/linux/sched/sd_flags.h
+@@ -132,12 +132,9 @@ SD_FLAG(SD_SERIALIZE, SDF_SHARED_PARENT | SDF_NEEDS_GROUPS)
+ /*
+  * Place busy tasks earlier in the domain
+  *
+- * SHARED_CHILD: Usually set on the SMT level. Technically could be set further
+- *               up, but currently assumed to be set from the base domain
+- *               upwards (see update_top_cache_domain()).
+  * NEEDS_GROUPS: Load balancing flag.
+  */
+-SD_FLAG(SD_ASYM_PACKING, SDF_SHARED_CHILD | SDF_NEEDS_GROUPS)
++SD_FLAG(SD_ASYM_PACKING,  SDF_NEEDS_GROUPS)
+ 
+ /*
+  * Prefer to place tasks in a sibling domain
+-- 
+2.39.2
+
+From fa1585eecfadd43f866f50951bbe106c09e1f79f Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 20:58:37 -0800
+Subject: [PATCH] x86/sched: Remove SD_ASYM_PACKING from the SMT domain flags
+
+There is no difference between any of the SMT siblings of a physical core.
+Do not do asym_packing load balancing at this level.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Tested-by: Zhang Rui <rui.zhang@intel.com>
+Patchset: intel-thread-director
+---
+ arch/x86/kernel/smpboot.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 3f3ea0287f694..c3de98224cb4f 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -545,7 +545,7 @@ static int x86_core_flags(void)
+ #ifdef CONFIG_SCHED_SMT
+ static int x86_smt_flags(void)
+ {
+-	return cpu_smt_flags() | x86_sched_itmt_flags();
++	return cpu_smt_flags();
+ }
+ #endif
+ #ifdef CONFIG_SCHED_CLUSTER
+-- 
+2.39.2
+
+From 5f0150f15f343e543bc257bca1db30f3481ed474 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 20:58:38 -0800
+Subject: [PATCH] x86/sched/itmt: Give all SMT siblings of a core the same
+ priority
+
+X86 does not have the SD_ASYM_PACKING flag in the SMT domain. The scheduler
+knows how to handle SMT and non-SMT cores of different priority. There is
+no reason for SMT siblings of a core to have different priorities.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-kernel@vger.kernel.org
+Reviewed-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Tested-by: Zhang Rui <rui.zhang@intel.com>
+Patchset: intel-thread-director
+---
+ arch/x86/kernel/itmt.c | 23 +++++------------------
+ 1 file changed, 5 insertions(+), 18 deletions(-)
+
+diff --git a/arch/x86/kernel/itmt.c b/arch/x86/kernel/itmt.c
+index 9ff480e94511b..6510883c5e817 100644
+--- a/arch/x86/kernel/itmt.c
++++ b/arch/x86/kernel/itmt.c
+@@ -174,32 +174,19 @@ int arch_asym_cpu_priority(int cpu)
+ 
+ /**
+  * sched_set_itmt_core_prio() - Set CPU priority based on ITMT
+- * @prio:	Priority of cpu core
+- * @core_cpu:	The cpu number associated with the core
++ * @prio:	Priority of @cpu
++ * @cpu:	The CPU number
+  *
+  * The pstate driver will find out the max boost frequency
+  * and call this function to set a priority proportional
+- * to the max boost frequency. CPU with higher boost
++ * to the max boost frequency. CPUs with higher boost
+  * frequency will receive higher priority.
+  *
+  * No need to rebuild sched domain after updating
+  * the CPU priorities. The sched domains have no
+  * dependency on CPU priorities.
+  */
+-void sched_set_itmt_core_prio(int prio, int core_cpu)
++void sched_set_itmt_core_prio(int prio, int cpu)
+ {
+-	int cpu, i = 1;
+-
+-	for_each_cpu(cpu, topology_sibling_cpumask(core_cpu)) {
+-		int smt_prio;
+-
+-		/*
+-		 * Ensure that the siblings are moved to the end
+-		 * of the priority chain and only used when
+-		 * all other high priority cpus are out of capacity.
+-		 */
+-		smt_prio = prio * smp_num_siblings / (i * i);
+-		per_cpu(sched_core_priority, cpu) = smt_prio;
+-		i++;
+-	}
++	per_cpu(sched_core_priority, cpu) = prio;
+ }
+-- 
+2.39.2
+
+From 59c32bf713f2d1c52fedb38ceeef07375736dbbc Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:10:42 -0800
+Subject: [PATCH] sched/task_struct: Introduce IPC classes of tasks
+
+On hybrid processors, the architecture differences between the types of
+CPUs lead to different instructions-per-cycle (IPC) on each type of CPU.
+IPCs may differ further by the type of instructions. Instructions can be
+grouped into classes of similar IPCs.
+
+Hence, tasks can be classified into groups based on the type of
+instructions they execute.
+
+Add a new member task_struct::ipcc to associate a particular task to
+an IPC class that depends on the instructions it executes.
+
+The scheduler may use the IPC class of a task and data about the
+performance among CPUs of a given IPC class to improve throughput. It
+may, for instance, place certain classes of tasks on CPUs of higher
+performance.
+
+The methods to determine the classification of a task and its relative
+IPC score are specific to each CPU architecture.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ include/linux/sched.h | 10 ++++++++++
+ init/Kconfig          | 12 ++++++++++++
+ 2 files changed, 22 insertions(+)
+
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index ffb6eb55cd135..ca0c32bf796fb 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -127,6 +127,8 @@ struct task_group;
+ 					 __TASK_TRACED | EXIT_DEAD | EXIT_ZOMBIE | \
+ 					 TASK_PARKED)
+ 
++#define IPC_CLASS_UNCLASSIFIED		0
++
+ #define task_is_running(task)		(READ_ONCE((task)->__state) == TASK_RUNNING)
+ 
+ #define task_is_traced(task)		((READ_ONCE(task->jobctl) & JOBCTL_TRACED) != 0)
+@@ -1528,6 +1530,14 @@ struct task_struct {
+ 	union rv_task_monitor		rv[RV_PER_TASK_MONITORS];
+ #endif
+ 
++#ifdef CONFIG_IPC_CLASSES
++	/*
++	 * A hardware-defined classification of task that reflects but is
++	 * not identical to the number of instructions per cycle.
++	 */
++	unsigned short			ipcc;
++#endif
++
+ 	/*
+ 	 * New fields for task_struct should be added above here, so that
+ 	 * they are included in the randomized portion of task_struct.
+diff --git a/init/Kconfig b/init/Kconfig
+index 0c214af99085d..0ddda55fde6a6 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -865,6 +865,18 @@ config UCLAMP_BUCKETS_COUNT
+ 
+ 	  If in doubt, use the default value.
+ 
++config IPC_CLASSES
++	bool "IPC classes of tasks"
++	depends on SMP
++	help
++	  If selected, each task is assigned a classification value that
++	  reflects the type of instructions that the task executes. This
++	  classification reflects but is not equal to the number of
++	  instructions retired per cycle.
++
++	  The scheduler uses the classification value to improve the placement
++	  of tasks.
++
+ endmenu
+ 
+ #
+-- 
+2.39.2
+
+From c4738d1d773b0e4066f30875c6393adb77d55837 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:10:43 -0800
+Subject: [PATCH] sched: Add interfaces for IPC classes
+
+Add the interfaces that architectures shall implement to convey the data
+to support IPC classes.
+
+arch_update_ipcc() updates the IPC classification of the current task as
+given by hardware.
+
+arch_get_ipcc_score() provides a performance score for a given IPC class
+when placed on a specific CPU. Higher scores indicate higher performance.
+
+When a driver or equivalent enablement code has configured the necessary
+hardware to support IPC classes, it should call sched_enable_ipc_classes()
+to notify the scheduler that it can start using IPC classes data.
+
+The number of classes and the score of each class of task are determined
+by hardware.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ include/linux/sched/topology.h |  6 ++++
+ kernel/sched/sched.h           | 66 ++++++++++++++++++++++++++++++++++
+ kernel/sched/topology.c        |  9 +++++
+ 3 files changed, 81 insertions(+)
+
+diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h
+index 816df6cc444e1..5b084d3c9ad12 100644
+--- a/include/linux/sched/topology.h
++++ b/include/linux/sched/topology.h
+@@ -280,4 +280,10 @@ static inline int task_node(const struct task_struct *p)
+ 	return cpu_to_node(task_cpu(p));
+ }
+ 
++#ifdef CONFIG_IPC_CLASSES
++extern void sched_enable_ipc_classes(void);
++#else
++static inline void sched_enable_ipc_classes(void) { }
++#endif
++
+ #endif /* _LINUX_SCHED_TOPOLOGY_H */
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index d6d488e8eb554..a3b2b66e077d9 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -2511,6 +2511,72 @@ void arch_scale_freq_tick(void)
+ }
+ #endif
+ 
++#ifdef CONFIG_IPC_CLASSES
++DECLARE_STATIC_KEY_FALSE(sched_ipcc);
++
++static inline bool sched_ipcc_enabled(void)
++{
++	return static_branch_unlikely(&sched_ipcc);
++}
++
++#ifndef arch_update_ipcc
++/**
++ * arch_update_ipcc() - Update the IPC class of the current task
++ * @curr:		The current task
++ *
++ * Request that the IPC classification of @curr is updated.
++ *
++ * Returns: none
++ */
++static __always_inline
++void arch_update_ipcc(struct task_struct *curr)
++{
++}
++#endif
++
++#ifndef arch_get_ipcc_score
++
++#define SCHED_IPCC_SCORE_SCALE (1L << SCHED_FIXEDPOINT_SHIFT)
++/**
++ * arch_get_ipcc_score() - Get the IPC score of a class of task
++ * @ipcc:	The IPC class
++ * @cpu:	A CPU number
++ *
++ * The IPC performance scores reflects (but it is not identical to) the number
++ * of instructions retired per cycle for a given IPC class. It is a linear and
++ * abstract metric. Higher scores reflect better performance.
++ *
++ * The IPC score can be normalized with respect to the class, i, with the
++ * highest IPC score on the CPU, c, with highest performance:
++ *
++ *            IPC(i, c)
++ *  ------------------------------------ * SCHED_IPCC_SCORE_SCALE
++ *     max(IPC(i, c) : (i, c))
++ *
++ * Scheduling schemes that want to use the IPC score along with other
++ * normalized metrics for scheduling (e.g., CPU capacity) may need to normalize
++ * it.
++ *
++ * Other scheduling schemes (e.g., asym_packing) do not need normalization.
++ *
++ * Returns the performance score of an IPC class, @ipcc, when running on @cpu.
++ * Error when either @ipcc or @cpu are invalid.
++ */
++static __always_inline
++unsigned long arch_get_ipcc_score(unsigned short ipcc, int cpu)
++{
++	return SCHED_IPCC_SCORE_SCALE;
++}
++#endif
++#else /* CONFIG_IPC_CLASSES */
++
++#define arch_get_ipcc_score(ipcc, cpu) (-EINVAL)
++#define arch_update_ipcc(curr)
++
++static inline bool sched_ipcc_enabled(void) { return false; }
++
++#endif /* CONFIG_IPC_CLASSES */
++
+ #ifndef arch_scale_freq_capacity
+ /**
+  * arch_scale_freq_capacity - get the frequency scale factor of a given CPU.
+diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
+index 8739c2a5a54ea..60e03d15f58ca 100644
+--- a/kernel/sched/topology.c
++++ b/kernel/sched/topology.c
+@@ -670,6 +670,15 @@ DEFINE_PER_CPU(struct sched_domain __rcu *, sd_asym_packing);
+ DEFINE_PER_CPU(struct sched_domain __rcu *, sd_asym_cpucapacity);
+ DEFINE_STATIC_KEY_FALSE(sched_asym_cpucapacity);
+ 
++#ifdef CONFIG_IPC_CLASSES
++DEFINE_STATIC_KEY_FALSE(sched_ipcc);
++
++void sched_enable_ipc_classes(void)
++{
++	static_branch_enable_cpuslocked(&sched_ipcc);
++}
++#endif
++
+ static void update_top_cache_domain(int cpu)
+ {
+ 	struct sched_domain_shared *sds = NULL;
+-- 
+2.39.2
+
+From 021e8196d4ef87aa80fae8024b8055a6bca5b9c4 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:10:44 -0800
+Subject: [PATCH] sched/core: Initialize the IPC class of a new task
+
+New tasks shall start life as unclassified. They will be classified by
+hardware when they run.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ kernel/sched/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index f730b6fe94a7f..7b63bf90430bb 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -4377,6 +4377,9 @@ static void __sched_fork(unsigned long clone_flags, struct task_struct *p)
+ 	p->se.prev_sum_exec_runtime	= 0;
+ 	p->se.nr_migrations		= 0;
+ 	p->se.vruntime			= 0;
++#ifdef CONFIG_IPC_CLASSES
++	p->ipcc				= IPC_CLASS_UNCLASSIFIED;
++#endif
+ 	INIT_LIST_HEAD(&p->se.group_node);
+ 
+ #ifdef CONFIG_FAIR_GROUP_SCHED
+-- 
+2.39.2
+
+From ef293bd0404885577a038daf0c011a57eeece3de Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:10:45 -0800
+Subject: [PATCH] sched/core: Add user_tick as argument to scheduler_tick()
+
+Differentiate between user and kernel ticks so that the scheduler updates
+the IPC class of the current task during the former.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ include/linux/sched.h | 2 +-
+ kernel/sched/core.c   | 2 +-
+ kernel/time/timer.c   | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index ca0c32bf796fb..e58dc7503864c 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -293,7 +293,7 @@ enum {
+ 	TASK_COMM_LEN = 16,
+ };
+ 
+-extern void scheduler_tick(void);
++extern void scheduler_tick(bool user_tick);
+ 
+ #define	MAX_SCHEDULE_TIMEOUT		LONG_MAX
+ 
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 7b63bf90430bb..0a8558421eba2 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5492,7 +5492,7 @@ static inline u64 cpu_resched_latency(struct rq *rq) { return 0; }
+  * This function gets called by the timer code, with HZ frequency.
+  * We call it with interrupts disabled.
+  */
+-void scheduler_tick(void)
++void scheduler_tick(bool user_tick)
+ {
+ 	int cpu = smp_processor_id();
+ 	struct rq *rq = cpu_rq(cpu);
+diff --git a/kernel/time/timer.c b/kernel/time/timer.c
+index 717fcb9fb14aa..b444b6f5f585b 100644
+--- a/kernel/time/timer.c
++++ b/kernel/time/timer.c
+@@ -1841,7 +1841,7 @@ void update_process_times(int user_tick)
+ 	if (in_irq())
+ 		irq_work_tick();
+ #endif
+-	scheduler_tick();
++	scheduler_tick(user_tick);
+ 	if (IS_ENABLED(CONFIG_POSIX_TIMERS))
+ 		run_posix_cpu_timers();
+ }
+-- 
+2.39.2
+
+From 45a0511c0378f765cc26fb1faaddc3080ab2e179 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:10:46 -0800
+Subject: [PATCH] sched/core: Update the IPC class of the current task
+
+When supported, hardware monitors the instruction stream to classify the
+current task. Hence, at userspace tick, we are ready to read the most
+recent classification result for the current task.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ kernel/sched/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 0a8558421eba2..4782b1359eb89 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5504,6 +5504,9 @@ void scheduler_tick(bool user_tick)
+ 	if (housekeeping_cpu(cpu, HK_TYPE_TICK))
+ 		arch_scale_freq_tick();
+ 
++	if (sched_ipcc_enabled() && user_tick)
++		arch_update_ipcc(curr);
++
+ 	sched_clock_tick();
+ 
+ 	rq_lock(rq, &rf);
+-- 
+2.39.2
+
+From b88b78dd46cf545386f984768597179451f2bdf0 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:10:47 -0800
+Subject: [PATCH] sched/fair: Collect load-balancing stats for IPC classes
+
+When selecting a busiest scheduling group, the IPC class of the current
+task can be used to select between two scheduling groups of types asym_
+packing or fully_busy that are otherwise identical.
+
+Compute the IPC class performance score for a scheduling group. It
+is the sum of the scores of the current tasks of all the runqueues.
+
+Also, keep track of the class of the task with the lowest IPC class score
+in the scheduling group.
+
+These two metrics will be used during idle load balancing to compute the
+current and the prospective IPC class score of a scheduling group.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ kernel/sched/fair.c | 61 +++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 61 insertions(+)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 635e8b41a87c9..86f779d9d2a90 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -8751,6 +8751,11 @@ struct sg_lb_stats {
+ 	unsigned int nr_numa_running;
+ 	unsigned int nr_preferred_running;
+ #endif
++#ifdef CONFIG_IPC_CLASSES
++	unsigned long min_score; /* Min(score(rq->curr->ipcc)) */
++	unsigned short min_ipcc; /* Class of the task with the minimum IPCC score in the rq */
++	unsigned long sum_score; /* Sum(score(rq->curr->ipcc)) */
++#endif
+ };
+ 
+ /*
+@@ -9028,6 +9033,59 @@ group_type group_classify(unsigned int imbalance_pct,
+ 	return group_has_spare;
+ }
+ 
++#ifdef CONFIG_IPC_CLASSES
++static void init_rq_ipcc_stats(struct sg_lb_stats *sgs)
++{
++	/* All IPCC stats have been set to zero in update_sg_lb_stats(). */
++	sgs->min_score = ULONG_MAX;
++}
++
++/* Called only if cpu_of(@rq) is not idle and has tasks running. */
++static void update_sg_lb_ipcc_stats(int dst_cpu, struct sg_lb_stats *sgs,
++				    struct rq *rq)
++{
++	struct task_struct *curr;
++	unsigned short ipcc;
++	unsigned long score;
++
++	if (!sched_ipcc_enabled())
++		return;
++
++	curr = rcu_dereference(rq->curr);
++	if (!curr || (curr->flags & PF_EXITING) || is_idle_task(curr) ||
++	    task_is_realtime(curr) ||
++	    !cpumask_test_cpu(dst_cpu, curr->cpus_ptr))
++		return;
++
++	ipcc = curr->ipcc;
++	score = arch_get_ipcc_score(ipcc, cpu_of(rq));
++
++	/*
++	 * Ignore tasks with invalid scores. When finding the busiest group, we
++	 * prefer those with higher sum_score. This group will not be selected.
++	 */
++	if (IS_ERR_VALUE(score))
++		return;
++
++	sgs->sum_score += score;
++
++	if (score < sgs->min_score) {
++		sgs->min_score = score;
++		sgs->min_ipcc = ipcc;
++	}
++}
++
++#else /* CONFIG_IPC_CLASSES */
++static void update_sg_lb_ipcc_stats(int dst_cpu, struct sg_lb_stats *sgs,
++				    struct rq *rq)
++{
++}
++
++static void init_rq_ipcc_stats(struct sg_lb_stats *sgs)
++{
++}
++#endif /* CONFIG_IPC_CLASSES */
++
+ /**
+  * asym_smt_can_pull_tasks - Check whether the load balancing CPU can pull tasks
+  * @dst_cpu:	Destination CPU of the load balancing
+@@ -9120,6 +9178,7 @@ static inline void update_sg_lb_stats(struct lb_env *env,
+ 	int i, nr_running, local_group;
+ 
+ 	memset(sgs, 0, sizeof(*sgs));
++	init_rq_ipcc_stats(sgs);
+ 
+ 	local_group = group == sds->local;
+ 
+@@ -9169,6 +9228,8 @@ static inline void update_sg_lb_stats(struct lb_env *env,
+ 			if (sgs->group_misfit_task_load < load)
+ 				sgs->group_misfit_task_load = load;
+ 		}
++
++		update_sg_lb_ipcc_stats(env->dst_cpu, sgs, rq);
+ 	}
+ 
+ 	sgs->group_capacity = group->sgc->capacity;
+-- 
+2.39.2
+
+From ba3c46567c032ee843d8ab5f576ddc78df1a56bf Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:10:48 -0800
+Subject: [PATCH] sched/fair: Compute IPC class scores for load balancing
+
+Compute the joint total (both current and prospective) IPC class score of
+a scheduling group and the local scheduling group.
+
+These IPCC statistics are used during idle load balancing. The candidate
+scheduling group will have one fewer busy CPU after load balancing. This
+observation is important for cores with SMT support.
+
+The IPCC score of scheduling groups composed of SMT siblings needs to
+consider that the siblings share CPU resources. When computing the total
+IPCC score of the scheduling group, divide score of each sibling by the
+number of busy siblings.
+
+Collect IPCC statistics for asym_packing and fully_busy scheduling groups.
+When picking a busiest group, they are used to break ties between otherwise
+identical groups.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ kernel/sched/fair.c | 68 +++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 68 insertions(+)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 86f779d9d2a90..3b84fb72891bc 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -8755,6 +8755,8 @@ struct sg_lb_stats {
+ 	unsigned long min_score; /* Min(score(rq->curr->ipcc)) */
+ 	unsigned short min_ipcc; /* Class of the task with the minimum IPCC score in the rq */
+ 	unsigned long sum_score; /* Sum(score(rq->curr->ipcc)) */
++	long ipcc_score_after; /* Prospective IPCC score after load balancing */
++	unsigned long ipcc_score_before; /* IPCC score before load balancing */
+ #endif
+ };
+ 
+@@ -9075,6 +9077,62 @@ static void update_sg_lb_ipcc_stats(int dst_cpu, struct sg_lb_stats *sgs,
+ 	}
+ }
+ 
++static void update_sg_lb_stats_scores(struct sg_lb_stats *sgs,
++				      struct sched_group *sg,
++				      struct lb_env *env)
++{
++	unsigned long score_on_dst_cpu, before;
++	int busy_cpus;
++	long after;
++
++	if (!sched_ipcc_enabled())
++		return;
++
++	/*
++	 * IPCC scores are only useful during idle load balancing. For now,
++	 * only asym_packing uses IPCC scores.
++	 */
++	if (!(env->sd->flags & SD_ASYM_PACKING) ||
++	    env->idle == CPU_NOT_IDLE)
++		return;
++
++	/*
++	 * IPCC scores are used to break ties only between these types of
++	 * groups.
++	 */
++	if (sgs->group_type != group_fully_busy &&
++	    sgs->group_type != group_asym_packing)
++		return;
++
++	busy_cpus = sgs->group_weight - sgs->idle_cpus;
++
++	/* No busy CPUs in the group. No tasks to move. */
++	if (!busy_cpus)
++		return;
++
++	score_on_dst_cpu = arch_get_ipcc_score(sgs->min_ipcc, env->dst_cpu);
++
++	/*
++	 * Do not use IPC scores. sgs::ipcc_score_{after, before} will be zero
++	 * and not used.
++	 */
++	if (IS_ERR_VALUE(score_on_dst_cpu))
++		return;
++
++	before = sgs->sum_score;
++	after = before - sgs->min_score;
++
++	/* SMT siblings share throughput. */
++	if (busy_cpus > 1 && sg->flags & SD_SHARE_CPUCAPACITY) {
++		before /= busy_cpus;
++		/* One sibling will become idle after load balance. */
++		after /= busy_cpus - 1;
++	}
++
++	sgs->ipcc_score_after = after + score_on_dst_cpu;
++	sgs->ipcc_score_before = before;
++}
++
+ #else /* CONFIG_IPC_CLASSES */
+ static void update_sg_lb_ipcc_stats(int dst_cpu, struct sg_lb_stats *sgs,
+ 				    struct rq *rq)
+@@ -9084,6 +9142,13 @@ static void update_sg_lb_ipcc_stats(int dst_cpu, struct sg_lb_stats *sgs,
+ static void init_rq_ipcc_stats(struct sg_lb_stats *sgs)
+ {
+ }
++
++static void update_sg_lb_stats_scores(struct sg_lb_stats *sgs,
++				      struct sched_group *sg,
++				      struct lb_env *env)
++{
++}
++
+ #endif /* CONFIG_IPC_CLASSES */
+ 
+ /**
+@@ -9245,6 +9310,9 @@ static inline void update_sg_lb_stats(struct lb_env *env,
+ 
+ 	sgs->group_type = group_classify(env->sd->imbalance_pct, group, sgs);
+ 
++	if (!local_group)
++		update_sg_lb_stats_scores(sgs, group, env);
++
+ 	/* Computing avg_load makes sense only when group is overloaded */
+ 	if (sgs->group_type == group_overloaded)
+ 		sgs->avg_load = (sgs->group_load * SCHED_CAPACITY_SCALE) /
+-- 
+2.39.2
+
+From 98664eb2ae97aaf9b290077ef9e6629a7c1d7d79 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:10:49 -0800
+Subject: [PATCH] sched/fair: Use IPCC stats to break ties between asym_packing
+ sched groups
+
+As it iterates, update_sd_pick_busiest() keeps on selecting as busiest
+sched groups of identical priority. Since both groups have the same
+priority, either group is a good choice. The IPCC statistics provide a
+measure of the throughput before and after load balance. Use them to
+pick a busiest scheduling group from otherwise identical asym_packing
+scheduling groups.
+
+Pick as busiest the scheduling group that yields a higher IPCC score
+after load balancing.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ kernel/sched/fair.c | 72 +++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 72 insertions(+)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 3b84fb72891bc..89a13ae0185e6 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -9133,6 +9133,60 @@ static void update_sg_lb_stats_scores(struct sg_lb_stats *sgs,
+ 	sgs->ipcc_score_before = before;
+ }
+ 
++/**
++ * sched_asym_ipcc_prefer - Select a sched group based on its IPCC score
++ * @a:	Load balancing statistics of a sched group
++ * @b:	Load balancing statistics of a second sched group
++ *
++ * Returns: true if @a has a higher IPCC score than @b after load balance.
++ * False otherwise.
++ */
++static bool sched_asym_ipcc_prefer(struct sg_lb_stats *a,
++				   struct sg_lb_stats *b)
++{
++	if (!sched_ipcc_enabled())
++		return false;
++
++	/* @a increases overall throughput after load balance. */
++	if (a->ipcc_score_after > b->ipcc_score_after)
++		return true;
++
++	/*
++	 * If @a and @b yield the same overall throughput, pick @a if
++	 * its current throughput is lower than that of @b.
++	 */
++	if (a->ipcc_score_after == b->ipcc_score_after)
++		return a->ipcc_score_before < b->ipcc_score_before;
++
++	return false;
++}
++
++/**
++ * sched_asym_ipcc_pick - Select a sched group based on its IPCC score
++ * @a:		A scheduling group
++ * @b:		A second scheduling group
++ * @a_stats:	Load balancing statistics of @a
++ * @b_stats:	Load balancing statistics of @b
++ *
++ * Returns: true if @a has the same priority and @a has tasks with IPC classes
++ * that yield higher overall throughput after load balance. False otherwise.
++ */
++static bool sched_asym_ipcc_pick(struct sched_group *a,
++				 struct sched_group *b,
++				 struct sg_lb_stats *a_stats,
++				 struct sg_lb_stats *b_stats)
++{
++	/*
++	 * Only use the class-specific preference selection if both sched
++	 * groups have the same priority.
++	 */
++	if (arch_asym_cpu_priority(a->asym_prefer_cpu) !=
++	    arch_asym_cpu_priority(b->asym_prefer_cpu))
++		return false;
++
++	return sched_asym_ipcc_prefer(a_stats, b_stats);
++}
++
+ #else /* CONFIG_IPC_CLASSES */
+ static void update_sg_lb_ipcc_stats(int dst_cpu, struct sg_lb_stats *sgs,
+ 				    struct rq *rq)
+@@ -9149,6 +9203,14 @@ static void update_sg_lb_stats_scores(struct sg_lb_stats *sgs,
+ {
+ }
+ 
++static bool sched_asym_ipcc_pick(struct sched_group *a,
++				 struct sched_group *b,
++				 struct sg_lb_stats *a_stats,
++				 struct sg_lb_stats *b_stats)
++{
++	return false;
++}
++
+ #endif /* CONFIG_IPC_CLASSES */
+ 
+ /**
+@@ -9384,6 +9446,16 @@ static bool update_sd_pick_busiest(struct lb_env *env,
+ 		/* Prefer to move from lowest priority CPU's work */
+ 		if (sched_asym_prefer(sg->asym_prefer_cpu, sds->busiest->asym_prefer_cpu))
+ 			return false;
++
++		/*
++		 * Unlike other callers of sched_asym_prefer(), here both @sg
++		 * and @sds::busiest have tasks running. When they have equal
++		 * priority, their IPC class scores can be used to select a
++		 * better busiest.
++		 */
++		if (sched_asym_ipcc_pick(sds->busiest, sg, &sds->busiest_stat, sgs))
++			return false;
++
+ 		break;
+ 
+ 	case group_misfit_task:
+-- 
+2.39.2
+
+From a4b0646c23237cc67703ed40bdde243d78bb7910 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:10:50 -0800
+Subject: [PATCH] sched/fair: Use IPCC stats to break ties between fully_busy
+ SMT groups
+
+IPCC statistics are used during idle load balancing. After balancing one
+of the siblings of an SMT core will become idle. The rest of the busy
+siblings will enjoy increased throughput. The IPCC statistics provide
+a measure of the increased throughput. Use them to pick a busiest group
+from otherwise identical fully_busy scheduling groups (of which the
+avg_load is equal - and zero).
+
+Using IPCC scores to break ties with non-SMT fully_busy sched groups
+is not necessary. SMT sched groups always need more help.
+
+Add a stub sched_asym_ipcc_prefer() for !CONFIG_IPC_CLASSES.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ kernel/sched/fair.c | 23 ++++++++++++++++++++---
+ 1 file changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 89a13ae0185e6..4f75e9964e8ca 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -9203,6 +9203,12 @@ static void update_sg_lb_stats_scores(struct sg_lb_stats *sgs,
+ {
+ }
+ 
++static bool sched_asym_ipcc_prefer(struct sg_lb_stats *a,
++				   struct sg_lb_stats *b)
++{
++	return false;
++}
++
+ static bool sched_asym_ipcc_pick(struct sched_group *a,
+ 				 struct sched_group *b,
+ 				 struct sg_lb_stats *a_stats,
+@@ -9486,10 +9492,21 @@ static bool update_sd_pick_busiest(struct lb_env *env,
+ 		if (sgs->avg_load == busiest->avg_load) {
+ 			/*
+ 			 * SMT sched groups need more help than non-SMT groups.
+-			 * If @sg happens to also be SMT, either choice is good.
+ 			 */
+-			if (sds->busiest->flags & SD_SHARE_CPUCAPACITY)
+-				return false;
++			if (sds->busiest->flags & SD_SHARE_CPUCAPACITY) {
++				if (!(sg->flags & SD_SHARE_CPUCAPACITY))
++					return false;
++
++				/*
++				 * Between two SMT groups, use IPCC scores to pick the
++				 * one that would improve throughput the most (only
++				 * asym_packing uses IPCC scores for now).
++				 */
++				if (sched_ipcc_enabled() &&
++				    env->sd->flags & SD_ASYM_PACKING &&
++				    sched_asym_ipcc_prefer(busiest, sgs))
++					return false;
++			}
+ 		}
+ 
+ 		break;
+-- 
+2.39.2
+
+From cc96548bd32f891b0cdf162cdde5f8ca2ba98404 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:10:51 -0800
+Subject: [PATCH] sched/fair: Use IPCC scores to select a busiest runqueue
+
+For two runqueues of equal priority and equal number of running of tasks,
+select the one whose current task would have the highest IPC class score
+if placed on the destination CPU.
+
+For now, use IPCC scores only for scheduling domains with the
+SD_ASYM_PACKING flag.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ kernel/sched/fair.c | 64 +++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 64 insertions(+)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 4f75e9964e8ca..fc42b58f1ba42 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -9187,6 +9187,37 @@ static bool sched_asym_ipcc_pick(struct sched_group *a,
+ 	return sched_asym_ipcc_prefer(a_stats, b_stats);
+ }
+ 
++/**
++ * ipcc_score_delta - Get the IPCC score delta wrt the load balance's dst_cpu
++ * @p:		A task
++ * @env:	Load balancing environment
++ *
++ * Returns: The IPCC score delta that @p would get if placed in the destination
++ * CPU of @env. LONG_MIN to indicate that the delta should not be used.
++ */
++static long ipcc_score_delta(struct task_struct *p, struct lb_env *env)
++{
++	unsigned long score_src, score_dst;
++	unsigned short ipcc = p->ipcc;
++
++	if (!sched_ipcc_enabled())
++		return LONG_MIN;
++
++	/* Only asym_packing uses IPCC scores at the moment. */
++	if (!(env->sd->flags & SD_ASYM_PACKING))
++		return LONG_MIN;
++
++	score_dst = arch_get_ipcc_score(ipcc, env->dst_cpu);
++	if (IS_ERR_VALUE(score_dst))
++		return LONG_MIN;
++
++	score_src = arch_get_ipcc_score(ipcc, task_cpu(p));
++	if (IS_ERR_VALUE(score_src))
++		return LONG_MIN;
++
++	return score_dst - score_src;
++}
++
+ #else /* CONFIG_IPC_CLASSES */
+ static void update_sg_lb_ipcc_stats(int dst_cpu, struct sg_lb_stats *sgs,
+ 				    struct rq *rq)
+@@ -9217,6 +9248,11 @@ static bool sched_asym_ipcc_pick(struct sched_group *a,
+ 	return false;
+ }
+ 
++static long ipcc_score_delta(struct task_struct *p, struct lb_env *env)
++{
++	return LONG_MIN;
++}
++
+ #endif /* CONFIG_IPC_CLASSES */
+ 
+ /**
+@@ -10377,6 +10413,7 @@ static struct rq *find_busiest_queue(struct lb_env *env,
+ {
+ 	struct rq *busiest = NULL, *rq;
+ 	unsigned long busiest_util = 0, busiest_load = 0, busiest_capacity = 1;
++	long busiest_ipcc_delta = LONG_MIN;
+ 	unsigned int busiest_nr = 0;
+ 	int i;
+ 
+@@ -10493,8 +10530,35 @@ static struct rq *find_busiest_queue(struct lb_env *env,
+ 
+ 		case migrate_task:
+ 			if (busiest_nr < nr_running) {
++				struct task_struct *curr;
++
+ 				busiest_nr = nr_running;
+ 				busiest = rq;
++
++				/*
++				 * Remember the IPCC score delta of busiest::curr.
++				 * We may need it to break a tie with other queues
++				 * with equal nr_running.
++				 */
++				curr = rcu_dereference(busiest->curr);
++				busiest_ipcc_delta = ipcc_score_delta(curr, env);
++			/*
++			 * If rq and busiest have the same number of running
++			 * tasks and IPC classes are supported, pick rq if doing
++			 * so would give rq::curr a bigger IPC boost on dst_cpu.
++			 */
++			} else if (busiest_nr == nr_running) {
++				struct task_struct *curr;
++				long delta;
++
++				curr = rcu_dereference(rq->curr);
++				delta = ipcc_score_delta(curr, env);
++
++				if (busiest_ipcc_delta < delta) {
++					busiest_ipcc_delta = delta;
++					busiest_nr = nr_running;
++					busiest = rq;
++				}
+ 			}
+ 			break;
+ 
+-- 
+2.39.2
+
+From 8435406d47c8fb7c349f7615ebb1cd0a812afc90 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:10:52 -0800
+Subject: [PATCH] thermal: intel: hfi: Introduce Intel Thread Director classes
+
+On Intel hybrid parts, each type of CPU has specific performance and
+energy efficiency capabilities. The Intel Thread Director technology
+extends the Hardware Feedback Interface (HFI) to provide performance and
+energy efficiency data for advanced classes of instructions.
+
+Add support to parse per-class capabilities.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ drivers/thermal/intel/intel_hfi.c | 30 ++++++++++++++++++++++++------
+ 1 file changed, 24 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/thermal/intel/intel_hfi.c b/drivers/thermal/intel/intel_hfi.c
+index 239afe02e5182..ae7eec197f680 100644
+--- a/drivers/thermal/intel/intel_hfi.c
++++ b/drivers/thermal/intel/intel_hfi.c
+@@ -79,7 +79,7 @@ union cpuid6_edx {
+  * @ee_cap:		Energy efficiency capability
+  *
+  * Capabilities of a logical processor in the HFI table. These capabilities are
+- * unitless.
++ * unitless and specific to each HFI class.
+  */
+ struct hfi_cpu_data {
+ 	u8	perf_cap;
+@@ -91,7 +91,8 @@ struct hfi_cpu_data {
+  * @perf_updated:	Hardware updated performance capabilities
+  * @ee_updated:		Hardware updated energy efficiency capabilities
+  *
+- * Properties of the data in an HFI table.
++ * Properties of the data in an HFI table. There exists one header per each
++ * HFI class.
+  */
+ struct hfi_hdr {
+ 	u8	perf_updated;
+@@ -129,16 +130,21 @@ struct hfi_instance {
+ 
+ /**
+  * struct hfi_features - Supported HFI features
++ * @nr_classes:		Number of classes supported
+  * @nr_table_pages:	Size of the HFI table in 4KB pages
+  * @cpu_stride:		Stride size to locate the capability data of a logical
+  *			processor within the table (i.e., row stride)
++ * @class_stride:	Stride size to locate a class within the capability
++ *			data of a logical processor or the HFI table header
+  * @hdr_size:		Size of the table header
+  *
+  * Parameters and supported features that are common to all HFI instances
+  */
+ struct hfi_features {
++	unsigned int	nr_classes;
+ 	size_t		nr_table_pages;
+ 	unsigned int	cpu_stride;
++	unsigned int	class_stride;
+ 	unsigned int	hdr_size;
+ };
+ 
+@@ -325,8 +331,8 @@ static void init_hfi_cpu_index(struct hfi_cpu_info *info)
+ }
+ 
+ /*
+- * The format of the HFI table depends on the number of capabilities that the
+- * hardware supports. Keep a data structure to navigate the table.
++ * The format of the HFI table depends on the number of capabilities and classes
++ * that the hardware supports. Keep a data structure to navigate the table.
+  */
+ static void init_hfi_instance(struct hfi_instance *hfi_instance)
+ {
+@@ -507,18 +513,30 @@ static __init int hfi_parse_features(void)
+ 	/* The number of 4KB pages required by the table */
+ 	hfi_features.nr_table_pages = edx.split.table_pages + 1;
+ 
++	/*
++	 * Capability fields of an HFI class are grouped together. Classes are
++	 * contiguous in memory.  Hence, use the number of supported features to
++	 * locate a specific class.
++	 */
++	hfi_features.class_stride = nr_capabilities;
++
++	/* For now, use only one class of the HFI table */
++	hfi_features.nr_classes = 1;
++
+ 	/*
+ 	 * The header contains change indications for each supported feature.
+ 	 * The size of the table header is rounded up to be a multiple of 8
+ 	 * bytes.
+ 	 */
+-	hfi_features.hdr_size = DIV_ROUND_UP(nr_capabilities, 8) * 8;
++	hfi_features.hdr_size = DIV_ROUND_UP(nr_capabilities *
++					     hfi_features.nr_classes, 8) * 8;
+ 
+ 	/*
+ 	 * Data of each logical processor is also rounded up to be a multiple
+ 	 * of 8 bytes.
+ 	 */
+-	hfi_features.cpu_stride = DIV_ROUND_UP(nr_capabilities, 8) * 8;
++	hfi_features.cpu_stride = DIV_ROUND_UP(nr_capabilities *
++					       hfi_features.nr_classes, 8) * 8;
+ 
+ 	return 0;
+ }
+-- 
+2.39.2
+
+From 78b14aa7d839c69d3073e92c54445a085b22df4f Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:10:53 -0800
+Subject: [PATCH] x86/cpufeatures: Add the Intel Thread Director feature
+ definitions
+
+Intel Thread Director (ITD) provides hardware resources to classify
+the current task. The classification reflects the type of instructions that
+a task currently executes.
+
+ITD extends the Hardware Feedback Interface table to provide performance
+and energy efficiency capabilities for each of the supported classes of
+tasks.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ arch/x86/include/asm/cpufeatures.h       | 1 +
+ arch/x86/include/asm/disabled-features.h | 8 +++++++-
+ arch/x86/kernel/cpu/cpuid-deps.c         | 1 +
+ 3 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
+index 92729c38853d1..02f10cd5c7536 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -342,6 +342,7 @@
+ #define X86_FEATURE_HWP_EPP		(14*32+10) /* HWP Energy Perf. Preference */
+ #define X86_FEATURE_HWP_PKG_REQ		(14*32+11) /* HWP Package Level Request */
+ #define X86_FEATURE_HFI			(14*32+19) /* Hardware Feedback Interface */
++#define X86_FEATURE_ITD			(14*32+23) /* Intel Thread Director */
+ 
+ /* AMD SVM Feature Identification, CPUID level 0x8000000a (EDX), word 15 */
+ #define X86_FEATURE_NPT			(15*32+ 0) /* Nested Page Table support */
+diff --git a/arch/x86/include/asm/disabled-features.h b/arch/x86/include/asm/disabled-features.h
+index 33d2cd04d2544..7a668f6d0502d 100644
+--- a/arch/x86/include/asm/disabled-features.h
++++ b/arch/x86/include/asm/disabled-features.h
+@@ -87,6 +87,12 @@
+ # define DISABLE_TDX_GUEST	(1 << (X86_FEATURE_TDX_GUEST & 31))
+ #endif
+ 
++#ifdef CONFIG_IPC_CLASSES
++# define DISABLE_ITD	0
++#else
++# define DISABLE_ITD	(1 << (X86_FEATURE_ITD & 31))
++#endif
++
+ /*
+  * Make sure to add features to the correct mask
+  */
+@@ -104,7 +110,7 @@
+ #define DISABLED_MASK11	(DISABLE_RETPOLINE|DISABLE_RETHUNK|DISABLE_UNRET)
+ #define DISABLED_MASK12	0
+ #define DISABLED_MASK13	0
+-#define DISABLED_MASK14	0
++#define DISABLED_MASK14	(DISABLE_ITD)
+ #define DISABLED_MASK15	0
+ #define DISABLED_MASK16	(DISABLE_PKU|DISABLE_OSPKE|DISABLE_LA57|DISABLE_UMIP| \
+ 			 DISABLE_ENQCMD)
+diff --git a/arch/x86/kernel/cpu/cpuid-deps.c b/arch/x86/kernel/cpu/cpuid-deps.c
+index c881bcafba7d7..f6f8a3cd4f2ce 100644
+--- a/arch/x86/kernel/cpu/cpuid-deps.c
++++ b/arch/x86/kernel/cpu/cpuid-deps.c
+@@ -78,6 +78,7 @@ static const struct cpuid_dep cpuid_deps[] = {
+ 	{ X86_FEATURE_XFD,			X86_FEATURE_XSAVES    },
+ 	{ X86_FEATURE_XFD,			X86_FEATURE_XGETBV1   },
+ 	{ X86_FEATURE_AMX_TILE,			X86_FEATURE_XFD       },
++	{ X86_FEATURE_ITD,			X86_FEATURE_HFI       },
+ 	{}
+ };
+ 
+-- 
+2.39.2
+
+From b4ce6b73c21395712049b4eeb71e55bf617be6f2 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:10:54 -0800
+Subject: [PATCH] thermal: intel: hfi: Store per-CPU IPCC scores
+
+The scheduler reads the IPCC scores when balancing load. These reads can
+be quite frequent. Hardware can also update the HFI table frequently.
+Concurrent access may cause a lot of lock contention. It gets worse as the
+number of CPUs increases.
+
+Instead, create separate per-CPU IPCC scores that the scheduler can read
+without the HFI table lock.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Suggested-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ drivers/thermal/intel/intel_hfi.c | 46 +++++++++++++++++++++++++++++++
+ 1 file changed, 46 insertions(+)
+
+diff --git a/drivers/thermal/intel/intel_hfi.c b/drivers/thermal/intel/intel_hfi.c
+index ae7eec197f680..e84dcfbef0dd9 100644
+--- a/drivers/thermal/intel/intel_hfi.c
++++ b/drivers/thermal/intel/intel_hfi.c
+@@ -29,6 +29,7 @@
+ #include <linux/kernel.h>
+ #include <linux/math.h>
+ #include <linux/mutex.h>
++#include <linux/percpu.h>
+ #include <linux/percpu-defs.h>
+ #include <linux/printk.h>
+ #include <linux/processor.h>
+@@ -172,6 +173,43 @@ static struct workqueue_struct *hfi_updates_wq;
+ #define HFI_UPDATE_INTERVAL		HZ
+ #define HFI_MAX_THERM_NOTIFY_COUNT	16
+ 
++#ifdef CONFIG_IPC_CLASSES
++static int __percpu *hfi_ipcc_scores;
++
++static int alloc_hfi_ipcc_scores(void)
++{
++	if (!cpu_feature_enabled(X86_FEATURE_ITD))
++		return 0;
++
++	hfi_ipcc_scores = __alloc_percpu(sizeof(*hfi_ipcc_scores) *
++					 hfi_features.nr_classes,
++					 sizeof(*hfi_ipcc_scores));
++
++	return !hfi_ipcc_scores;
++}
++
++static void set_hfi_ipcc_score(void *caps, int cpu)
++{
++	int i, *hfi_class;
++
++	if (!cpu_feature_enabled(X86_FEATURE_ITD))
++		return;
++
++	hfi_class = per_cpu_ptr(hfi_ipcc_scores, cpu);
++
++	for (i = 0;  i < hfi_features.nr_classes; i++) {
++		struct hfi_cpu_data *class_caps;
++
++		class_caps = caps + i * hfi_features.class_stride;
++		WRITE_ONCE(hfi_class[i], class_caps->perf_cap);
++	}
++}
++
++#else
++static int alloc_hfi_ipcc_scores(void) { return 0; }
++static void set_hfi_ipcc_score(void *caps, int cpu) { }
++#endif /* CONFIG_IPC_CLASSES */
++
+ static void get_hfi_caps(struct hfi_instance *hfi_instance,
+ 			 struct thermal_genl_cpu_caps *cpu_caps)
+ {
+@@ -194,6 +232,8 @@ static void get_hfi_caps(struct hfi_instance *hfi_instance,
+ 		cpu_caps[i].efficiency = caps->ee_cap << 2;
+ 
+ 		++i;
++
++		set_hfi_ipcc_score(caps, cpu);
+ 	}
+ 	raw_spin_unlock_irq(&hfi_instance->table_lock);
+ }
+@@ -572,8 +612,14 @@ void __init intel_hfi_init(void)
+ 	if (!hfi_updates_wq)
+ 		goto err_nomem;
+ 
++	if (alloc_hfi_ipcc_scores())
++		goto err_ipcc;
++
+ 	return;
+ 
++err_ipcc:
++	destroy_workqueue(hfi_updates_wq);
++
+ err_nomem:
+ 	for (j = 0; j < i; ++j) {
+ 		hfi_instance = &hfi_instances[j];
+-- 
+2.39.2
+
+From 8826c8ac9227c660003590b333f80a0d144cba2e Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:10:55 -0800
+Subject: [PATCH] thermal: intel: hfi: Update the IPC class of the current task
+
+Use Intel Thread Director classification to update the IPC class of a
+task. Implement the arch_update_ipcc() interface of the scheduler.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ arch/x86/include/asm/topology.h   |  6 ++++++
+ drivers/thermal/intel/intel_hfi.c | 32 +++++++++++++++++++++++++++++++
+ 2 files changed, 38 insertions(+)
+
+diff --git a/arch/x86/include/asm/topology.h b/arch/x86/include/asm/topology.h
+index 458c891a82736..ffcdac3f398f0 100644
+--- a/arch/x86/include/asm/topology.h
++++ b/arch/x86/include/asm/topology.h
+@@ -227,4 +227,10 @@ void init_freq_invariance_cppc(void);
+ #define arch_init_invariance_cppc init_freq_invariance_cppc
+ #endif
+ 
++#if defined(CONFIG_IPC_CLASSES) && defined(CONFIG_INTEL_HFI_THERMAL)
++void intel_hfi_update_ipcc(struct task_struct *curr);
++
++#define arch_update_ipcc intel_hfi_update_ipcc
++#endif /* defined(CONFIG_IPC_CLASSES) && defined(CONFIG_INTEL_HFI_THERMAL) */
++
+ #endif /* _ASM_X86_TOPOLOGY_H */
+diff --git a/drivers/thermal/intel/intel_hfi.c b/drivers/thermal/intel/intel_hfi.c
+index e84dcfbef0dd9..f2de597b3118a 100644
+--- a/drivers/thermal/intel/intel_hfi.c
++++ b/drivers/thermal/intel/intel_hfi.c
+@@ -74,6 +74,17 @@ union cpuid6_edx {
+ 	u32 full;
+ };
+ 
++#ifdef CONFIG_IPC_CLASSES
++union hfi_thread_feedback_char_msr {
++	struct {
++		u64	classid : 8;
++		u64	__reserved : 55;
++		u64	valid : 1;
++	} split;
++	u64 full;
++};
++#endif
++
+ /**
+  * struct hfi_cpu_data - HFI capabilities per CPU
+  * @perf_cap:		Performance capability
+@@ -176,6 +187,27 @@ static struct workqueue_struct *hfi_updates_wq;
+ #ifdef CONFIG_IPC_CLASSES
+ static int __percpu *hfi_ipcc_scores;
+ 
++void intel_hfi_update_ipcc(struct task_struct *curr)
++{
++	union hfi_thread_feedback_char_msr msr;
++
++	/* We should not be here if ITD is not supported. */
++	if (!cpu_feature_enabled(X86_FEATURE_ITD)) {
++		pr_warn_once("task classification requested but not supported!");
++		return;
++	}
++
++	rdmsrl(MSR_IA32_HW_FEEDBACK_CHAR, msr.full);
++	if (!msr.split.valid)
++		return;
++
++	/*
++	 * 0 is a valid classification for Intel Thread Director. A scheduler
++	 * IPCC class of 0 means that the task is unclassified. Adjust.
++	 */
++	curr->ipcc = msr.split.classid + 1;
++}
++
+ static int alloc_hfi_ipcc_scores(void)
+ {
+ 	if (!cpu_feature_enabled(X86_FEATURE_ITD))
+-- 
+2.39.2
+
+From e6c5f3a62bb1fc563887cca4df785b49f77ef0af Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:10:56 -0800
+Subject: [PATCH] thermal: intel: hfi: Report the IPC class score of a CPU
+
+Implement the arch_get_ipcc_score() interface of the scheduler. Use the
+performance capabilities of the extended Hardware Feedback Interface table
+as the IPC score.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ arch/x86/include/asm/topology.h   |  2 ++
+ drivers/thermal/intel/intel_hfi.c | 27 +++++++++++++++++++++++++++
+ 2 files changed, 29 insertions(+)
+
+diff --git a/arch/x86/include/asm/topology.h b/arch/x86/include/asm/topology.h
+index ffcdac3f398f0..c4fcd9c3c634f 100644
+--- a/arch/x86/include/asm/topology.h
++++ b/arch/x86/include/asm/topology.h
+@@ -229,8 +229,10 @@ void init_freq_invariance_cppc(void);
+ 
+ #if defined(CONFIG_IPC_CLASSES) && defined(CONFIG_INTEL_HFI_THERMAL)
+ void intel_hfi_update_ipcc(struct task_struct *curr);
++unsigned long intel_hfi_get_ipcc_score(unsigned short ipcc, int cpu);
+ 
+ #define arch_update_ipcc intel_hfi_update_ipcc
++#define arch_get_ipcc_score intel_hfi_get_ipcc_score
+ #endif /* defined(CONFIG_IPC_CLASSES) && defined(CONFIG_INTEL_HFI_THERMAL) */
+ 
+ #endif /* _ASM_X86_TOPOLOGY_H */
+diff --git a/drivers/thermal/intel/intel_hfi.c b/drivers/thermal/intel/intel_hfi.c
+index f2de597b3118a..e8ad2be47e82f 100644
+--- a/drivers/thermal/intel/intel_hfi.c
++++ b/drivers/thermal/intel/intel_hfi.c
+@@ -208,6 +208,33 @@ void intel_hfi_update_ipcc(struct task_struct *curr)
+ 	curr->ipcc = msr.split.classid + 1;
+ }
+ 
++unsigned long intel_hfi_get_ipcc_score(unsigned short ipcc, int cpu)
++{
++	unsigned short hfi_class;
++	int *scores;
++
++	if (cpu < 0 || cpu >= nr_cpu_ids)
++		return -EINVAL;
++
++	if (ipcc == IPC_CLASS_UNCLASSIFIED)
++		return -EINVAL;
++
++	/*
++	 * Scheduler IPC classes start at 1. HFI classes start at 0.
++	 * See note intel_hfi_update_ipcc().
++	 */
++	hfi_class = ipcc - 1;
++
++	if (hfi_class >= hfi_features.nr_classes)
++		return -EINVAL;
++
++	scores = per_cpu_ptr(hfi_ipcc_scores, cpu);
++	if (!scores)
++		return -ENODEV;
++
++	return READ_ONCE(scores[hfi_class]);
++}
++
+ static int alloc_hfi_ipcc_scores(void)
+ {
+ 	if (!cpu_feature_enabled(X86_FEATURE_ITD))
+-- 
+2.39.2
+
+From 502fea0f97180e7e5a9fb1a88d31659d30813348 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:10:57 -0800
+Subject: [PATCH] thermal: intel: hfi: Define a default class for unclassified
+ tasks
+
+A task may be unclassified if it has been recently created, spend most of
+its lifetime sleeping, or hardware has not provided a classification.
+
+Most tasks will be eventually classified as scheduler's IPC class 1
+(HFI class 0). This class corresponds to the capabilities in the legacy,
+classless, HFI table.
+
+IPC class 1 is a reasonable choice until hardware provides an actual
+classification. Meanwhile, the scheduler will place classes of tasks with
+higher IPC scores on higher-performance CPUs.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ drivers/thermal/intel/intel_hfi.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/intel/intel_hfi.c b/drivers/thermal/intel/intel_hfi.c
+index e8ad2be47e82f..0f6935705e559 100644
+--- a/drivers/thermal/intel/intel_hfi.c
++++ b/drivers/thermal/intel/intel_hfi.c
+@@ -187,6 +187,19 @@ static struct workqueue_struct *hfi_updates_wq;
+ #ifdef CONFIG_IPC_CLASSES
+ static int __percpu *hfi_ipcc_scores;
+ 
++/*
++ * A task may be unclassified if it has been recently created, spend most of
++ * its lifetime sleeping, or hardware has not provided a classification.
++ *
++ * Most tasks will be classified as scheduler's IPC class 1 (HFI class 0)
++ * eventually. Meanwhile, the scheduler will place classes of tasks with higher
++ * IPC scores on higher-performance CPUs.
++ *
++ * IPC class 1 is a reasonable choice. It matches the performance capability
++ * of the legacy, classless, HFI table.
++ */
++#define HFI_UNCLASSIFIED_DEFAULT 1
++
+ void intel_hfi_update_ipcc(struct task_struct *curr)
+ {
+ 	union hfi_thread_feedback_char_msr msr;
+@@ -217,7 +230,7 @@ unsigned long intel_hfi_get_ipcc_score(unsigned short ipcc, int cpu)
+ 		return -EINVAL;
+ 
+ 	if (ipcc == IPC_CLASS_UNCLASSIFIED)
+-		return -EINVAL;
++		ipcc = HFI_UNCLASSIFIED_DEFAULT;
+ 
+ 	/*
+ 	 * Scheduler IPC classes start at 1. HFI classes start at 0.
+-- 
+2.39.2
+
+From 5c8a8a9dc0da32f5cb1321e5cd86e68c7221af74 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:10:58 -0800
+Subject: [PATCH] thermal: intel: hfi: Enable the Intel Thread Director
+
+Enable Intel Thread Director from the CPU hotplug callback: globally from
+CPU0 and then enable the thread-classification hardware in each logical
+processor individually.
+
+Also, initialize the number of classes supported.
+
+Let the scheduler know that it can start using IPC classes.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ arch/x86/include/asm/msr-index.h  |  2 ++
+ drivers/thermal/intel/intel_hfi.c | 40 +++++++++++++++++++++++++++++--
+ 2 files changed, 40 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index 117e4e977b55d..b4a5de303b88a 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -1089,6 +1089,8 @@
+ /* Hardware Feedback Interface */
+ #define MSR_IA32_HW_FEEDBACK_PTR        0x17d0
+ #define MSR_IA32_HW_FEEDBACK_CONFIG     0x17d1
++#define MSR_IA32_HW_FEEDBACK_THREAD_CONFIG 0x17d4
++#define MSR_IA32_HW_FEEDBACK_CHAR	0x17d2
+ 
+ /* x2APIC locked status */
+ #define MSR_IA32_XAPIC_DISABLE_STATUS	0xBD
+diff --git a/drivers/thermal/intel/intel_hfi.c b/drivers/thermal/intel/intel_hfi.c
+index 0f6935705e559..21a0d246ca501 100644
+--- a/drivers/thermal/intel/intel_hfi.c
++++ b/drivers/thermal/intel/intel_hfi.c
+@@ -50,6 +50,8 @@
+ /* Hardware Feedback Interface MSR configuration bits */
+ #define HW_FEEDBACK_PTR_VALID_BIT		BIT(0)
+ #define HW_FEEDBACK_CONFIG_HFI_ENABLE_BIT	BIT(0)
++#define HW_FEEDBACK_CONFIG_ITD_ENABLE_BIT	BIT(1)
++#define HW_FEEDBACK_THREAD_CONFIG_ENABLE_BIT	BIT(0)
+ 
+ /* CPUID detection and enumeration definitions for HFI */
+ 
+@@ -74,6 +76,15 @@ union cpuid6_edx {
+ 	u32 full;
+ };
+ 
++union cpuid6_ecx {
++	struct {
++		u32	dont_care0:8;
++		u32	nr_classes:8;
++		u32	dont_care1:16;
++	} split;
++	u32 full;
++};
++
+ #ifdef CONFIG_IPC_CLASSES
+ union hfi_thread_feedback_char_msr {
+ 	struct {
+@@ -498,6 +509,11 @@ void intel_hfi_online(unsigned int cpu)
+ 
+ 	init_hfi_cpu_index(info);
+ 
++	if (cpu_feature_enabled(X86_FEATURE_ITD)) {
++		msr_val = HW_FEEDBACK_THREAD_CONFIG_ENABLE_BIT;
++		wrmsrl(MSR_IA32_HW_FEEDBACK_THREAD_CONFIG, msr_val);
++	}
++
+ 	/*
+ 	 * Now check if the HFI instance of the package/die of @cpu has been
+ 	 * initialized (by checking its header). In such case, all we have to
+@@ -553,8 +569,22 @@ void intel_hfi_online(unsigned int cpu)
+ 	 */
+ 	rdmsrl(MSR_IA32_HW_FEEDBACK_CONFIG, msr_val);
+ 	msr_val |= HW_FEEDBACK_CONFIG_HFI_ENABLE_BIT;
++
++	if (cpu_feature_enabled(X86_FEATURE_ITD))
++		msr_val |= HW_FEEDBACK_CONFIG_ITD_ENABLE_BIT;
++
+ 	wrmsrl(MSR_IA32_HW_FEEDBACK_CONFIG, msr_val);
+ 
++	/*
++	 * We have all we need to support IPC classes. Task classification is
++	 * now working.
++	 *
++	 * All class scores are zero until after the first HFI update. That is
++	 * OK. The scheduler queries these scores at every load balance.
++	 */
++	if (cpu_feature_enabled(X86_FEATURE_ITD))
++		sched_enable_ipc_classes();
++
+ unlock:
+ 	mutex_unlock(&hfi_instance_lock);
+ 	return;
+@@ -632,8 +662,14 @@ static __init int hfi_parse_features(void)
+ 	 */
+ 	hfi_features.class_stride = nr_capabilities;
+ 
+-	/* For now, use only one class of the HFI table */
+-	hfi_features.nr_classes = 1;
++	if (cpu_feature_enabled(X86_FEATURE_ITD)) {
++		union cpuid6_ecx ecx;
++
++		ecx.full = cpuid_ecx(CPUID_HFI_LEAF);
++		hfi_features.nr_classes = ecx.split.nr_classes;
++	} else {
++		hfi_features.nr_classes = 1;
++	}
+ 
+ 	/*
+ 	 * The header contains change indications for each supported feature.
+-- 
+2.39.2
+
+From 721e6a04633384f5f0a837ee1347e99ba9f2357d Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:10:59 -0800
+Subject: [PATCH] sched/task_struct: Add helpers for IPC classification
+
+The unprocessed classification that hardware provides for a task may not
+be usable by the scheduler: the classification may change too frequently or
+architectures may want to consider extra factors. For instance, some
+processors with Intel Thread Director need to consider the state of the SMT
+siblings of a core.
+
+Provide per-task helper variables that architectures can use to post-
+process the classification that hardware provides.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ include/linux/sched.h | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index e58dc7503864c..63c2f88f0168a 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1535,7 +1535,17 @@ struct task_struct {
+ 	 * A hardware-defined classification of task that reflects but is
+ 	 * not identical to the number of instructions per cycle.
+ 	 */
+-	unsigned short			ipcc;
++	unsigned int			ipcc : 9;
++	/*
++	 * A candidate classification that arch-specific implementations
++	 * qualify for correctness.
++	 */
++	unsigned int			ipcc_tmp : 9;
++	/*
++	 * Counter to filter out transient candidate classifications
++	 * of a task.
++	 */
++	unsigned int			ipcc_cntr : 14;
+ #endif
+ 
+ 	/*
+-- 
+2.39.2
+
+From afb386225a0c507949d96ea5122003edce813bb0 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:11:00 -0800
+Subject: [PATCH] sched/core: Initialize helpers of task classification
+
+Just as tasks start life unclassified, initialize the classification
+auxiliar variables.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ kernel/sched/core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 4782b1359eb89..d9a026845d51c 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -4379,6 +4379,8 @@ static void __sched_fork(unsigned long clone_flags, struct task_struct *p)
+ 	p->se.vruntime			= 0;
+ #ifdef CONFIG_IPC_CLASSES
+ 	p->ipcc				= IPC_CLASS_UNCLASSIFIED;
++	p->ipcc_tmp			= IPC_CLASS_UNCLASSIFIED;
++	p->ipcc_cntr			= 0;
+ #endif
+ 	INIT_LIST_HEAD(&p->se.group_node);
+ 
+-- 
+2.39.2
+
+From 20d6343c567733d5a2704e1f4bb437acd115683e Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:11:01 -0800
+Subject: [PATCH] sched/fair: Introduce sched_smt_siblings_idle()
+
+X86 needs to know the idle state of the SMT siblings of a CPU to improve
+the accuracy of IPCC classification. X86 implements support for IPC classes
+in the thermal HFI driver.
+
+Rename is_core_idle() as sched_smt_siblings_idle() and make it available
+outside the scheduler code.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ include/linux/sched.h |  2 ++
+ kernel/sched/fair.c   | 21 +++++++++++++++------
+ 2 files changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 63c2f88f0168a..b049584f4c1a5 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -2446,4 +2446,6 @@ static inline void sched_core_fork(struct task_struct *p) { }
+ 
+ extern void sched_set_stop_task(int cpu, struct task_struct *stop);
+ 
++extern bool sched_smt_siblings_idle(int cpu);
++
+ #endif
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index fc42b58f1ba42..ff1fd953258bd 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -1049,7 +1049,14 @@ update_stats_curr_start(struct cfs_rq *cfs_rq, struct sched_entity *se)
+  * Scheduling class queueing methods:
+  */
+ 
+-static inline bool is_core_idle(int cpu)
++/**
++ * sched_smt_siblings_idle - Check whether SMT siblings of a CPU are idle
++ * @cpu:	The CPU to check
++ *
++ * Returns true if all the SMT siblings of @cpu are idle or @cpu does not have
++ * SMT siblings. The idle state of @cpu is not considered.
++ */
++bool sched_smt_siblings_idle(int cpu)
+ {
+ #ifdef CONFIG_SCHED_SMT
+ 	int sibling;
+@@ -1755,7 +1762,7 @@ static inline int numa_idle_core(int idle_core, int cpu)
+ 	 * Prefer cores instead of packing HT siblings
+ 	 * and triggering future load balancing.
+ 	 */
+-	if (is_core_idle(cpu))
++	if (sched_smt_siblings_idle(cpu))
+ 		idle_core = cpu;
+ 
+ 	return idle_core;
+@@ -9306,7 +9313,8 @@ sched_asym(struct lb_env *env, struct sd_lb_stats *sds,  struct sg_lb_stats *sgs
+ 	 * If the destination CPU has SMT siblings, env->idle != CPU_NOT_IDLE
+ 	 * is not sufficient. We need to make sure the whole core is idle.
+ 	 */
+-	if (sds->local->flags & SD_SHARE_CPUCAPACITY && !is_core_idle(env->dst_cpu))
++	if (sds->local->flags & SD_SHARE_CPUCAPACITY &&
++	    !sched_smt_siblings_idle(env->dst_cpu))
+ 		return false;
+ 
+ 	/* Only do SMT checks if either local or candidate have SMT siblings. */
+@@ -10475,7 +10483,8 @@ static struct rq *find_busiest_queue(struct lb_env *env,
+ 		    sched_asym_prefer(i, env->dst_cpu) &&
+ 		    nr_running == 1) {
+ 			if (env->sd->flags & SD_SHARE_CPUCAPACITY ||
+-			    (!(env->sd->flags & SD_SHARE_CPUCAPACITY) && is_core_idle(i)))
++			    (!(env->sd->flags & SD_SHARE_CPUCAPACITY) &&
++			     sched_smt_siblings_idle(i)))
+ 				continue;
+ 		}
+ 
+@@ -10604,7 +10613,7 @@ asym_active_balance(struct lb_env *env)
+ 		 * busy sibling.
+ 		 */
+ 		return sched_asym_prefer(env->dst_cpu, env->src_cpu) ||
+-		       !is_core_idle(env->src_cpu);
++		       !sched_smt_siblings_idle(env->src_cpu);
+ 	}
+ 
+ 	return false;
+@@ -11351,7 +11360,7 @@ static void nohz_balancer_kick(struct rq *rq)
+ 				 */
+ 				if (sd->flags & SD_SHARE_CPUCAPACITY ||
+ 				    (!(sd->flags & SD_SHARE_CPUCAPACITY) &&
+-				     is_core_idle(i))) {
++				     sched_smt_siblings_idle(i))) {
+ 					flags = NOHZ_STATS_KICK | NOHZ_BALANCE_KICK;
+ 					goto unlock;
+ 				}
+-- 
+2.39.2
+
+From 0a346e6136d9ca6c52ef6061e5d24b231629cd67 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:11:02 -0800
+Subject: [PATCH] thermal: intel: hfi: Implement model-specific checks for task
+ classification
+
+In Alder Lake and Raptor Lake, the result of thread classification is more
+accurate when only one SMT sibling is busy. Classification results for
+class 2 and 3 are always reliable.
+
+To avoid unnecessary migrations, only update the class of a task if it has
+been the same during 4 consecutive user ticks.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ drivers/thermal/intel/intel_hfi.c | 60 ++++++++++++++++++++++++++++++-
+ 1 file changed, 59 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/intel/intel_hfi.c b/drivers/thermal/intel/intel_hfi.c
+index 21a0d246ca501..751b84b6b8fda 100644
+--- a/drivers/thermal/intel/intel_hfi.c
++++ b/drivers/thermal/intel/intel_hfi.c
+@@ -40,6 +40,7 @@
+ #include <linux/workqueue.h>
+ 
+ #include <asm/msr.h>
++#include <asm/intel-family.h>
+ 
+ #include "../thermal_core.h"
+ #include "intel_hfi.h"
+@@ -211,9 +212,64 @@ static int __percpu *hfi_ipcc_scores;
+  */
+ #define HFI_UNCLASSIFIED_DEFAULT 1
+ 
++#define CLASS_DEBOUNCER_SKIPS 4
++
++/**
++ * debounce_and_update_class() - Process and update a task's classification
++ *
++ * @p:		The task of which the classification will be updated
++ * @new_ipcc:	The new IPC classification
++ *
++ * Update the classification of @p with the new value that hardware provides.
++ * Only update the classification of @p if it has been the same during
++ * CLASS_DEBOUNCER_SKIPS consecutive ticks.
++ */
++static void debounce_and_update_class(struct task_struct *p, u8 new_ipcc)
++{
++	u16 debounce_skip;
++
++	/* The class of @p changed. Only restart the debounce counter. */
++	if (p->ipcc_tmp != new_ipcc) {
++		p->ipcc_cntr = 1;
++		goto out;
++	}
++
++	/*
++	 * The class of @p did not change. Update it if it has been the same
++	 * for CLASS_DEBOUNCER_SKIPS user ticks.
++	 */
++	debounce_skip = p->ipcc_cntr + 1;
++	if (debounce_skip < CLASS_DEBOUNCER_SKIPS)
++		p->ipcc_cntr++;
++	else
++		p->ipcc = new_ipcc;
++
++out:
++	p->ipcc_tmp = new_ipcc;
++}
++
++static bool classification_is_accurate(u8 hfi_class, bool smt_siblings_idle)
++{
++	switch (boot_cpu_data.x86_model) {
++	case INTEL_FAM6_ALDERLAKE:
++	case INTEL_FAM6_ALDERLAKE_L:
++	case INTEL_FAM6_RAPTORLAKE:
++	case INTEL_FAM6_RAPTORLAKE_P:
++	case INTEL_FAM6_RAPTORLAKE_S:
++		if (hfi_class == 3 || hfi_class == 2 || smt_siblings_idle)
++			return true;
++
++		return false;
++
++	default:
++		return true;
++	}
++}
++
+ void intel_hfi_update_ipcc(struct task_struct *curr)
+ {
+ 	union hfi_thread_feedback_char_msr msr;
++	bool idle;
+ 
+ 	/* We should not be here if ITD is not supported. */
+ 	if (!cpu_feature_enabled(X86_FEATURE_ITD)) {
+@@ -229,7 +285,9 @@ void intel_hfi_update_ipcc(struct task_struct *curr)
+ 	 * 0 is a valid classification for Intel Thread Director. A scheduler
+ 	 * IPCC class of 0 means that the task is unclassified. Adjust.
+ 	 */
+-	curr->ipcc = msr.split.classid + 1;
++	idle = sched_smt_siblings_idle(task_cpu(curr));
++	if (classification_is_accurate(msr.split.classid, idle))
++		debounce_and_update_class(curr, msr.split.classid + 1);
+ }
+ 
+ unsigned long intel_hfi_get_ipcc_score(unsigned short ipcc, int cpu)
+-- 
+2.39.2
+
+From 0ae9abd0c6e2109c538599229c213539fb1386ca Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:11:03 -0800
+Subject: [PATCH] x86/cpufeatures: Add feature bit for HRESET
+
+The HRESET instruction prevents the classification of the current task
+from influencing the classification of the next task when running serially
+on the same logical processor.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ arch/x86/include/asm/cpufeatures.h | 1 +
+ arch/x86/include/asm/msr-index.h   | 4 +++-
+ arch/x86/kernel/cpu/scattered.c    | 1 +
+ 3 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
+index 02f10cd5c7536..2fc261302f5cc 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -307,6 +307,7 @@
+ 
+ 
+ #define X86_FEATURE_MSR_TSX_CTRL	(11*32+20) /* "" MSR IA32_TSX_CTRL (Intel) implemented */
++#define X86_FEATURE_HRESET		(11*32+23) /* Hardware history reset instruction */
+ 
+ /* Intel-defined CPU features, CPUID level 0x00000007:1 (EAX), word 12 */
+ #define X86_FEATURE_AVX_VNNI		(12*32+ 4) /* AVX VNNI instructions */
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index b4a5de303b88a..4ef01ce8eadb5 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -1092,6 +1092,9 @@
+ #define MSR_IA32_HW_FEEDBACK_THREAD_CONFIG 0x17d4
+ #define MSR_IA32_HW_FEEDBACK_CHAR	0x17d2
+ 
++/* Hardware History Reset  */
++#define MSR_IA32_HW_HRESET_ENABLE	0x17da
++
+ /* x2APIC locked status */
+ #define MSR_IA32_XAPIC_DISABLE_STATUS	0xBD
+ #define LEGACY_XAPIC_DISABLED		BIT(0) /*
+@@ -1099,5 +1102,4 @@
+ 						* disabling x2APIC will cause
+ 						* a #GP
+ 						*/
+-
+ #endif /* _ASM_X86_MSR_INDEX_H */
+diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c
+index fc01f81f6e2a3..b8ad312d36949 100644
+--- a/arch/x86/kernel/cpu/scattered.c
++++ b/arch/x86/kernel/cpu/scattered.c
+@@ -28,6 +28,7 @@ static const struct cpuid_bit cpuid_bits[] = {
+ 	{ X86_FEATURE_EPB,		CPUID_ECX,  3, 0x00000006, 0 },
+ 	{ X86_FEATURE_INTEL_PPIN,	CPUID_EBX,  0, 0x00000007, 1 },
+ 	{ X86_FEATURE_RRSBA_CTRL,	CPUID_EDX,  2, 0x00000007, 2 },
++	{ X86_FEATURE_HRESET,		CPUID_EAX, 22, 0x00000007, 1 },
+ 	{ X86_FEATURE_CQM_LLC,		CPUID_EDX,  1, 0x0000000f, 0 },
+ 	{ X86_FEATURE_CQM_OCCUP_LLC,	CPUID_EDX,  0, 0x0000000f, 1 },
+ 	{ X86_FEATURE_CQM_MBM_TOTAL,	CPUID_EDX,  1, 0x0000000f, 1 },
+-- 
+2.39.2
+
+From dcf0f4ab904b1ef3090f2de141f55ff42bf9b0f2 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:11:04 -0800
+Subject: [PATCH] x86/hreset: Configure history reset
+
+Configure the MSR that controls the behavior of HRESET on each logical
+processor.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ arch/x86/kernel/cpu/common.c | 23 ++++++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index c34bdba57993a..98b48cf80ec21 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -411,6 +411,26 @@ static __always_inline void setup_umip(struct cpuinfo_x86 *c)
+ 	cr4_clear_bits(X86_CR4_UMIP);
+ }
+ 
++static u32 hardware_history_features __ro_after_init;
++
++static __always_inline void setup_hreset(struct cpuinfo_x86 *c)
++{
++	if (!cpu_feature_enabled(X86_FEATURE_HRESET))
++		return;
++
++	/*
++	 * Use on all CPUs the hardware history features that the boot
++	 * CPU supports.
++	 */
++	if (c == &boot_cpu_data)
++		hardware_history_features = cpuid_ebx(0x20);
++
++	if (!hardware_history_features)
++		return;
++
++	wrmsrl(MSR_IA32_HW_HRESET_ENABLE, hardware_history_features);
++}
++
+ /* These bits should not change their value after CPU init is finished. */
+ static const unsigned long cr4_pinned_mask =
+ 	X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_UMIP |
+@@ -1828,10 +1848,11 @@ static void identify_cpu(struct cpuinfo_x86 *c)
+ 	/* Disable the PN if appropriate */
+ 	squash_the_stupid_serial_number(c);
+ 
+-	/* Set up SMEP/SMAP/UMIP */
++	/* Set up SMEP/SMAP/UMIP/HRESET */
+ 	setup_smep(c);
+ 	setup_smap(c);
+ 	setup_umip(c);
++	setup_hreset(c);
+ 
+ 	/* Enable FSGSBASE instructions if available. */
+ 	if (cpu_has(c, X86_FEATURE_FSGSBASE)) {
+-- 
+2.39.2
+
+From d562f8856447bb5019dad771dab745821b383939 Mon Sep 17 00:00:00 2001
+From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Date: Mon, 6 Feb 2023 21:11:05 -0800
+Subject: [PATCH] x86/process: Reset hardware history in context switch
+
+Reset the classification history of the current task when switching to the
+next task. Hardware will start the classification of the next task from
+scratch.
+
+Cc: Ben Segall <bsegall@google.com>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Ionela Voinescu <ionela.voinescu@arm.com>
+Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Lukasz Luba <lukasz.luba@arm.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Tim C. Chen <tim.c.chen@intel.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: x86@kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Patchset: intel-thread-director
+---
+ arch/x86/include/asm/hreset.h | 30 ++++++++++++++++++++++++++++++
+ arch/x86/kernel/cpu/common.c  |  7 +++++++
+ arch/x86/kernel/process_32.c  |  3 +++
+ arch/x86/kernel/process_64.c  |  3 +++
+ 4 files changed, 43 insertions(+)
+ create mode 100644 arch/x86/include/asm/hreset.h
+
+diff --git a/arch/x86/include/asm/hreset.h b/arch/x86/include/asm/hreset.h
+new file mode 100644
+index 0000000000000..d68ca2fb8642b
+--- /dev/null
++++ b/arch/x86/include/asm/hreset.h
+@@ -0,0 +1,30 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ASM_X86_HRESET_H
++
++/**
++ * HRESET - History reset. Available since binutils v2.36.
++ *
++ * Request the processor to reset the history of task classification on the
++ * current logical processor. The history components to be
++ * reset are specified in %eax. Only bits specified in CPUID(0x20).EBX
++ * and enabled in the IA32_HRESET_ENABLE MSR can be selected.
++ *
++ * The assembly code looks like:
++ *
++ *	hreset %eax
++ *
++ * The corresponding machine code looks like:
++ *
++ *	F3 0F 3A F0 ModRM Imm
++ *
++ * The value of ModRM is 0xc0 to specify %eax register addressing.
++ * The ignored immediate operand is set to 0.
++ *
++ * The instruction is documented in the Intel SDM.
++ */
++
++#define __ASM_HRESET  ".byte 0xf3, 0xf, 0x3a, 0xf0, 0xc0, 0x0"
++
++void reset_hardware_history(void);
++
++#endif /* _ASM_X86_HRESET_H */
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 98b48cf80ec21..67bf6fbae082a 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -52,6 +52,7 @@
+ #include <asm/cpu.h>
+ #include <asm/mce.h>
+ #include <asm/msr.h>
++#include <asm/hreset.h>
+ #include <asm/memtype.h>
+ #include <asm/microcode.h>
+ #include <asm/microcode_intel.h>
+@@ -413,6 +414,12 @@ static __always_inline void setup_umip(struct cpuinfo_x86 *c)
+ 
+ static u32 hardware_history_features __ro_after_init;
+ 
++void reset_hardware_history(void)
++{
++	asm_inline volatile (ALTERNATIVE("", __ASM_HRESET, X86_FEATURE_HRESET)
++			     : : "a" (hardware_history_features) : "memory");
++}
++
+ static __always_inline void setup_hreset(struct cpuinfo_x86 *c)
+ {
+ 	if (!cpu_feature_enabled(X86_FEATURE_HRESET))
+diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
+index ceab14b6118f7..888cdb7624dcd 100644
+--- a/arch/x86/kernel/process_32.c
++++ b/arch/x86/kernel/process_32.c
+@@ -52,6 +52,7 @@
+ #include <asm/switch_to.h>
+ #include <asm/vm86.h>
+ #include <asm/resctrl.h>
++#include <asm/hreset.h>
+ #include <asm/proto.h>
+ 
+ #include "process.h"
+@@ -214,6 +215,8 @@
+ 	/* Load the Intel cache allocation PQR MSR. */
+ 	resctrl_sched_in();
+ 
++	reset_hardware_history();
++
+ 	return prev_p;
+ }
+ 
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index 7f94dbbc397b7..d0d3c33237475 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -53,6 +53,7 @@
+ #include <asm/xen/hypervisor.h>
+ #include <asm/vdso.h>
+ #include <asm/resctrl.h>
++#include <asm/hreset.h>
+ #include <asm/unistd.h>
+ #include <asm/fsgsbase.h>
+ #ifdef CONFIG_IA32_EMULATION
+@@ -658,6 +659,8 @@
+ 	/* Load the Intel cache allocation PQR MSR. */
+ 	resctrl_sched_in();
+ 
++	reset_hardware_history();
++
+ 	return prev_p;
+ }
+ 
+-- 
+2.39.2