linux-surface/patches/5.3/0009-ipts.patch

From 8289a12d110b5e2a8749ed94bcfb4330964b4761 Mon Sep 17 00:00:00 2001
From: Maximilian Luz <luzmaximilian@gmail.com>
Date: Wed, 18 Sep 2019 13:04:18 +0200
Subject: [PATCH 9/9] ipts

---
 drivers/gpu/drm/i915_legacy/Makefile          |    3 +
 drivers/gpu/drm/i915_legacy/i915_debugfs.c    |   63 +-
 drivers/gpu/drm/i915_legacy/i915_drv.c        |    7 +
 drivers/gpu/drm/i915_legacy/i915_drv.h        |    3 +
 .../gpu/drm/i915_legacy/i915_gem_context.c    |   12 +
 drivers/gpu/drm/i915_legacy/i915_irq.c        |    7 +-
 drivers/gpu/drm/i915_legacy/i915_params.c     |    5 +-
 drivers/gpu/drm/i915_legacy/i915_params.h     |    5 +-
 drivers/gpu/drm/i915_legacy/intel_guc.h       |    1 +
 .../drm/i915_legacy/intel_guc_submission.c    |   89 +-
 .../drm/i915_legacy/intel_guc_submission.h    |    4 +
 drivers/gpu/drm/i915_legacy/intel_ipts.c      |  651 +++
 drivers/gpu/drm/i915_legacy/intel_ipts.h      |   34 +
 drivers/gpu/drm/i915_legacy/intel_lrc.c       |   15 +-
 drivers/gpu/drm/i915_legacy/intel_lrc.h       |    6 +
 drivers/gpu/drm/i915_legacy/intel_panel.c     |    7 +
 drivers/misc/Kconfig                          |    1 +
 drivers/misc/Makefile                         |    1 +
 drivers/misc/ipts/Kconfig                     |   11 +
 drivers/misc/ipts/Makefile                    |   17 +
 drivers/misc/ipts/companion/Kconfig           |    9 +
 drivers/misc/ipts/companion/Makefile          |    1 +
 drivers/misc/ipts/companion/ipts-surface.c    |  100 +
 drivers/misc/ipts/ipts-binary-spec.h          |  118 +
 drivers/misc/ipts/ipts-dbgfs.c                |  291 ++
 drivers/misc/ipts/ipts-fw.c                   |  113 +
 drivers/misc/ipts/ipts-fw.h                   |   12 +
 drivers/misc/ipts/ipts-gfx.c                  |  185 +
 drivers/misc/ipts/ipts-gfx.h                  |   24 +
 drivers/misc/ipts/ipts-hid.c                  |  497 ++
 drivers/misc/ipts/ipts-hid.h                  |   34 +
 drivers/misc/ipts/ipts-kernel.c               | 1042 +++++
 drivers/misc/ipts/ipts-kernel.h               |   23 +
 drivers/misc/ipts/ipts-mei-msgs.h             |  585 +++
 drivers/misc/ipts/ipts-mei.c                  |  250 +
 drivers/misc/ipts/ipts-msg-handler.c          |  426 ++
 drivers/misc/ipts/ipts-msg-handler.h          |   32 +
 drivers/misc/ipts/ipts-params.c               |   21 +
 drivers/misc/ipts/ipts-params.h               |   14 +
 drivers/misc/ipts/ipts-resource.c             |  277 ++
 drivers/misc/ipts/ipts-resource.h             |   30 +
 drivers/misc/ipts/ipts-sensor-regs.h          |  700 +++
 drivers/misc/ipts/ipts-state.h                |   29 +
 drivers/misc/ipts/ipts.h                      |  200 +
 drivers/misc/mei/hw-me-regs.h                 |    1 +
 drivers/misc/mei/pci-me.c                     |    1 +
 drivers/platform/x86/Kconfig                  |   98 +-
 drivers/platform/x86/Makefile                 |    2 +-
 drivers/platform/x86/surface_acpi.c           | 4010 -----------------
 drivers/platform/x86/surface_sam/Kconfig      |  104 +
 drivers/platform/x86/surface_sam/Makefile     |    5 +
 .../x86/surface_sam/surface_sam_dtx.c         |  620 +++
 .../x86/surface_sam/surface_sam_san.c         |  708 +++
 .../x86/surface_sam/surface_sam_sid.c         |  483 ++
 .../x86/surface_sam/surface_sam_ssh.c         | 1691 +++++++
 .../x86/surface_sam/surface_sam_ssh.h         |   91 +
 .../x86/surface_sam/surface_sam_vhf.c         |  286 ++
 include/linux/intel_ipts_fw.h                 |   14 +
 include/linux/intel_ipts_if.h                 |   76 +
 59 files changed, 10016 insertions(+), 4129 deletions(-)
 create mode 100644 drivers/gpu/drm/i915_legacy/intel_ipts.c
 create mode 100644 drivers/gpu/drm/i915_legacy/intel_ipts.h
 create mode 100644 drivers/misc/ipts/Kconfig
 create mode 100644 drivers/misc/ipts/Makefile
 create mode 100644 drivers/misc/ipts/companion/Kconfig
 create mode 100644 drivers/misc/ipts/companion/Makefile
 create mode 100644 drivers/misc/ipts/companion/ipts-surface.c
 create mode 100644 drivers/misc/ipts/ipts-binary-spec.h
 create mode 100644 drivers/misc/ipts/ipts-dbgfs.c
 create mode 100644 drivers/misc/ipts/ipts-fw.c
 create mode 100644 drivers/misc/ipts/ipts-fw.h
 create mode 100644 drivers/misc/ipts/ipts-gfx.c
 create mode 100644 drivers/misc/ipts/ipts-gfx.h
 create mode 100644 drivers/misc/ipts/ipts-hid.c
 create mode 100644 drivers/misc/ipts/ipts-hid.h
 create mode 100644 drivers/misc/ipts/ipts-kernel.c
 create mode 100644 drivers/misc/ipts/ipts-kernel.h
 create mode 100644 drivers/misc/ipts/ipts-mei-msgs.h
 create mode 100644 drivers/misc/ipts/ipts-mei.c
 create mode 100644 drivers/misc/ipts/ipts-msg-handler.c
 create mode 100644 drivers/misc/ipts/ipts-msg-handler.h
 create mode 100644 drivers/misc/ipts/ipts-params.c
 create mode 100644 drivers/misc/ipts/ipts-params.h
 create mode 100644 drivers/misc/ipts/ipts-resource.c
 create mode 100644 drivers/misc/ipts/ipts-resource.h
 create mode 100644 drivers/misc/ipts/ipts-sensor-regs.h
 create mode 100644 drivers/misc/ipts/ipts-state.h
 create mode 100644 drivers/misc/ipts/ipts.h
 delete mode 100644 drivers/platform/x86/surface_acpi.c
 create mode 100644 drivers/platform/x86/surface_sam/Kconfig
 create mode 100644 drivers/platform/x86/surface_sam/Makefile
 create mode 100644 drivers/platform/x86/surface_sam/surface_sam_dtx.c
 create mode 100644 drivers/platform/x86/surface_sam/surface_sam_san.c
 create mode 100644 drivers/platform/x86/surface_sam/surface_sam_sid.c
 create mode 100644 drivers/platform/x86/surface_sam/surface_sam_ssh.c
 create mode 100644 drivers/platform/x86/surface_sam/surface_sam_ssh.h
 create mode 100644 drivers/platform/x86/surface_sam/surface_sam_vhf.c
 create mode 100644 include/linux/intel_ipts_fw.h
 create mode 100644 include/linux/intel_ipts_if.h

diff --git a/drivers/gpu/drm/i915_legacy/Makefile b/drivers/gpu/drm/i915_legacy/Makefile
index fbcb0904f4a8..1a273956b41c 100644
--- a/drivers/gpu/drm/i915_legacy/Makefile
+++ b/drivers/gpu/drm/i915_legacy/Makefile
@@ -170,6 +170,9 @@ i915-y += dvo_ch7017.o \
 	  vlv_dsi_pll.o \
 	  intel_vdsc.o
 
+# intel precise touch & stylus
+i915-y  += intel_ipts.o
+
 # Post-mortem debug and GPU hang state capture
 i915-$(CONFIG_DRM_I915_CAPTURE_ERROR) += i915_gpu_error.o
 i915-$(CONFIG_DRM_I915_SELFTEST) += \
diff --git a/drivers/gpu/drm/i915_legacy/i915_debugfs.c b/drivers/gpu/drm/i915_legacy/i915_debugfs.c
index 5823ffb17821..2ffad9712041 100644
--- a/drivers/gpu/drm/i915_legacy/i915_debugfs.c
+++ b/drivers/gpu/drm/i915_legacy/i915_debugfs.c
@@ -41,6 +41,7 @@
 #include "intel_hdmi.h"
 #include "intel_pm.h"
 #include "intel_psr.h"
+#include "intel_ipts.h"
 
 static inline struct drm_i915_private *node_to_i915(struct drm_info_node *node)
 {
@@ -4567,6 +4568,64 @@ static const struct file_operations i915_fifo_underrun_reset_ops = {
 	.llseek = default_llseek,
 };
 
+static ssize_t
+i915_intel_ipts_cleanup_write(struct file *filp,
+			       const char __user *ubuf,
+			       size_t cnt, loff_t *ppos)
+{
+	struct drm_i915_private *dev_priv = filp->private_data;
+	struct drm_device *dev = &dev_priv->drm;
+	int ret;
+	bool flag;
+
+	ret = kstrtobool_from_user(ubuf, cnt, &flag);
+	if (ret)
+		return ret;
+
+	if (!flag)
+		return cnt;
+
+	intel_ipts_cleanup(dev);
+
+	return cnt;
+}
+
+static const struct file_operations i915_intel_ipts_cleanup_ops = {
+	.owner = THIS_MODULE,
+	.open = simple_open,
+	.write = i915_intel_ipts_cleanup_write,
+	.llseek = default_llseek,
+};
+
+static ssize_t
+i915_intel_ipts_init_write(struct file *filp,
+			       const char __user *ubuf,
+			       size_t cnt, loff_t *ppos)
+{
+	struct drm_i915_private *dev_priv = filp->private_data;
+	struct drm_device *dev = &dev_priv->drm;
+	int ret;
+	bool flag;
+
+	ret = kstrtobool_from_user(ubuf, cnt, &flag);
+	if (ret)
+		return ret;
+
+	if (!flag)
+		return cnt;
+
+	intel_ipts_init(dev);
+
+	return cnt;
+}
+
+static const struct file_operations i915_intel_ipts_init_ops = {
+	.owner = THIS_MODULE,
+	.open = simple_open,
+	.write = i915_intel_ipts_init_write,
+	.llseek = default_llseek,
+};
+
 static const struct drm_info_list i915_debugfs_list[] = {
 	{"i915_capabilities", i915_capabilities, 0},
 	{"i915_gem_objects", i915_gem_object_info, 0},
@@ -4642,7 +4701,9 @@ static const struct i915_debugfs_files {
 	{"i915_hpd_short_storm_ctl", &i915_hpd_short_storm_ctl_fops},
 	{"i915_ipc_status", &i915_ipc_status_fops},
 	{"i915_drrs_ctl", &i915_drrs_ctl_fops},
-	{"i915_edp_psr_debug", &i915_edp_psr_debug_fops}
+	{"i915_edp_psr_debug", &i915_edp_psr_debug_fops},
+	{"i915_intel_ipts_cleanup", &i915_intel_ipts_cleanup_ops},
+	{"i915_intel_ipts_init", &i915_intel_ipts_init_ops},
 };
 
 int i915_debugfs_register(struct drm_i915_private *dev_priv)
diff --git a/drivers/gpu/drm/i915_legacy/i915_drv.c b/drivers/gpu/drm/i915_legacy/i915_drv.c
index d485d49c473b..adb7af18dc2b 100644
--- a/drivers/gpu/drm/i915_legacy/i915_drv.c
+++ b/drivers/gpu/drm/i915_legacy/i915_drv.c
@@ -63,6 +63,7 @@
 #include "intel_sprite.h"
 #include "intel_uc.h"
 #include "intel_workarounds.h"
+#include "intel_ipts.h"
 
 static struct drm_driver driver;
 
@@ -723,6 +724,9 @@ static int i915_load_modeset_init(struct drm_device *dev)
 
 	intel_init_ipc(dev_priv);
 
+	if (INTEL_GEN(dev_priv) >= 9 && i915_modparams.enable_guc && i915_modparams.enable_ipts)
+		intel_ipts_init(dev);
+
 	return 0;
 
 cleanup_gem:
@@ -1918,6 +1922,9 @@ void i915_driver_unload(struct drm_device *dev)
 
 	disable_rpm_wakeref_asserts(dev_priv);
 
+	if (INTEL_GEN(dev_priv) >= 9 && i915_modparams.enable_guc && i915_modparams.enable_ipts)
+		intel_ipts_cleanup(dev);
+
 	i915_driver_unregister(dev_priv);
 
 	/*
diff --git a/drivers/gpu/drm/i915_legacy/i915_drv.h b/drivers/gpu/drm/i915_legacy/i915_drv.h
index 066fd2a12851..2a872d8725b5 100644
--- a/drivers/gpu/drm/i915_legacy/i915_drv.h
+++ b/drivers/gpu/drm/i915_legacy/i915_drv.h
@@ -3184,6 +3184,9 @@ void i915_gem_object_do_bit_17_swizzle(struct drm_i915_gem_object *obj,
 void i915_gem_object_save_bit_17_swizzle(struct drm_i915_gem_object *obj,
 					 struct sg_table *pages);
 
+struct i915_gem_context *
+i915_gem_context_create_ipts(struct drm_device *dev);
+
 static inline struct i915_gem_context *
 __i915_gem_context_lookup_rcu(struct drm_i915_file_private *file_priv, u32 id)
 {
diff --git a/drivers/gpu/drm/i915_legacy/i915_gem_context.c b/drivers/gpu/drm/i915_legacy/i915_gem_context.c
index fb5e2784d3c7..41f569c649bd 100644
--- a/drivers/gpu/drm/i915_legacy/i915_gem_context.c
+++ b/drivers/gpu/drm/i915_legacy/i915_gem_context.c
@@ -562,6 +562,18 @@ static bool needs_preempt_context(struct drm_i915_private *i915)
 	return HAS_EXECLISTS(i915);
 }
 
+struct i915_gem_context *i915_gem_context_create_ipts(struct drm_device *dev)
+{
+	struct drm_i915_private *dev_priv = to_i915(dev);
+	struct i915_gem_context *ctx;
+
+	BUG_ON(!mutex_is_locked(&dev->struct_mutex));
+
+	ctx = i915_gem_create_context(dev_priv, 0);
+
+	return ctx;
+}
+
 int i915_gem_contexts_init(struct drm_i915_private *dev_priv)
 {
 	struct i915_gem_context *ctx;
diff --git a/drivers/gpu/drm/i915_legacy/i915_irq.c b/drivers/gpu/drm/i915_legacy/i915_irq.c
index b92cfd69134b..78fcd4b78480 100644
--- a/drivers/gpu/drm/i915_legacy/i915_irq.c
+++ b/drivers/gpu/drm/i915_legacy/i915_irq.c
@@ -41,6 +41,7 @@
 #include "i915_trace.h"
 #include "intel_drv.h"
 #include "intel_psr.h"
+#include "intel_ipts.h"
 
 /**
  * DOC: interrupt handling
@@ -1520,6 +1521,9 @@ gen8_cs_irq_handler(struct intel_engine_cs *engine, u32 iir)
 		tasklet |= intel_engine_needs_breadcrumb_tasklet(engine);
 	}
 
+	if (iir & GT_RENDER_PIPECTL_NOTIFY_INTERRUPT && i915_modparams.enable_ipts)
+		intel_ipts_notify_complete();
+
 	if (tasklet)
 		tasklet_hi_schedule(&engine->execlists.tasklet);
 }
@@ -4055,7 +4059,8 @@ static void gen8_gt_irq_postinstall(struct drm_i915_private *dev_priv)
 
 	/* These are interrupts we'll toggle with the ring mask register */
 	u32 gt_interrupts[] = {
-		(GT_RENDER_USER_INTERRUPT << GEN8_RCS_IRQ_SHIFT |
+		(GT_RENDER_PIPECTL_NOTIFY_INTERRUPT << GEN8_RCS_IRQ_SHIFT |
+		 GT_RENDER_USER_INTERRUPT << GEN8_RCS_IRQ_SHIFT |
 		 GT_CONTEXT_SWITCH_INTERRUPT << GEN8_RCS_IRQ_SHIFT |
 		 GT_RENDER_USER_INTERRUPT << GEN8_BCS_IRQ_SHIFT |
 		 GT_CONTEXT_SWITCH_INTERRUPT << GEN8_BCS_IRQ_SHIFT),
diff --git a/drivers/gpu/drm/i915_legacy/i915_params.c b/drivers/gpu/drm/i915_legacy/i915_params.c
index b5be0abbba35..831f2bcae687 100644
--- a/drivers/gpu/drm/i915_legacy/i915_params.c
+++ b/drivers/gpu/drm/i915_legacy/i915_params.c
@@ -143,7 +143,10 @@ i915_param_named_unsafe(edp_vswing, int, 0400,
 i915_param_named_unsafe(enable_guc, int, 0400,
 	"Enable GuC load for GuC submission and/or HuC load. "
 	"Required functionality can be selected using bitmask values. "
-	"(-1=auto, 0=disable [default], 1=GuC submission, 2=HuC load)");
+	"(-1=auto [default], 0=disable, 1=GuC submission, 2=HuC load)");
+
+i915_param_named_unsafe(enable_ipts, int, 0400,
+	"Enable IPTS Touchscreen and Pen support (default: 1)");
 
 i915_param_named(guc_log_level, int, 0400,
 	"GuC firmware logging level. Requires GuC to be loaded. "
diff --git a/drivers/gpu/drm/i915_legacy/i915_params.h b/drivers/gpu/drm/i915_legacy/i915_params.h
index 3f14e9881a0d..e314a2414041 100644
--- a/drivers/gpu/drm/i915_legacy/i915_params.h
+++ b/drivers/gpu/drm/i915_legacy/i915_params.h
@@ -54,7 +54,7 @@ struct drm_printer;
 	param(int, disable_power_well, -1) \
 	param(int, enable_ips, 1) \
 	param(int, invert_brightness, 0) \
-	param(int, enable_guc, 0) \
+	param(int, enable_guc, -1) \
 	param(int, guc_log_level, -1) \
 	param(char *, guc_firmware_path, NULL) \
 	param(char *, huc_firmware_path, NULL) \
@@ -76,7 +76,8 @@ struct drm_printer;
 	param(bool, nuclear_pageflip, false) \
 	param(bool, enable_dp_mst, true) \
 	param(bool, enable_dpcd_backlight, false) \
-	param(bool, enable_gvt, false)
+	param(bool, enable_gvt, false) \
+	param(int, enable_ipts, 1)
 
 #define MEMBER(T, member, ...) T member;
 struct i915_params {
diff --git a/drivers/gpu/drm/i915_legacy/intel_guc.h b/drivers/gpu/drm/i915_legacy/intel_guc.h
index 2c59ff8d9f39..d7f91693972f 100644
--- a/drivers/gpu/drm/i915_legacy/intel_guc.h
+++ b/drivers/gpu/drm/i915_legacy/intel_guc.h
@@ -67,6 +67,7 @@ struct intel_guc {
 
 	struct intel_guc_client *execbuf_client;
 	struct intel_guc_client *preempt_client;
+	struct intel_guc_client *ipts_client;
 
 	struct guc_preempt_work preempt_work[I915_NUM_ENGINES];
 	struct workqueue_struct *preempt_wq;
diff --git a/drivers/gpu/drm/i915_legacy/intel_guc_submission.c b/drivers/gpu/drm/i915_legacy/intel_guc_submission.c
index 46cd0e70aecb..e84c805f7340 100644
--- a/drivers/gpu/drm/i915_legacy/intel_guc_submission.c
+++ b/drivers/gpu/drm/i915_legacy/intel_guc_submission.c
@@ -93,12 +93,17 @@ static inline struct i915_priolist *to_priolist(struct rb_node *rb)
 
 static inline bool is_high_priority(struct intel_guc_client *client)
 {
-	return (client->priority == GUC_CLIENT_PRIORITY_KMD_HIGH ||
-		client->priority == GUC_CLIENT_PRIORITY_HIGH);
+	return (client->priority == GUC_CLIENT_PRIORITY_HIGH);
+}
+
+static inline bool is_high_priority_kmd(struct intel_guc_client *client)
+{
+	return (client->priority == GUC_CLIENT_PRIORITY_KMD_HIGH);
 }
 
 static int reserve_doorbell(struct intel_guc_client *client)
 {
+	struct drm_i915_private *dev_priv = guc_to_i915(client->guc);
 	unsigned long offset;
 	unsigned long end;
 	u16 id;
@@ -111,10 +116,14 @@ static int reserve_doorbell(struct intel_guc_client *client)
 	 * priority contexts, the second half for high-priority ones.
 	 */
 	offset = 0;
-	end = GUC_NUM_DOORBELLS / 2;
-	if (is_high_priority(client)) {
-		offset = end;
-		end += offset;
+	if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv)) {
+		end = GUC_NUM_DOORBELLS;
+	} else {
+		end = GUC_NUM_DOORBELLS/2;
+		if (is_high_priority(client)) {
+			offset = end;
+			end += offset;
+		}
 	}
 
 	id = find_next_zero_bit(client->guc->doorbell_bitmap, end, offset);
@@ -372,9 +381,15 @@ static void guc_stage_desc_init(struct intel_guc_client *client)
 	desc = __get_stage_desc(client);
 	memset(desc, 0, sizeof(*desc));
 
-	desc->attribute = GUC_STAGE_DESC_ATTR_ACTIVE |
-			  GUC_STAGE_DESC_ATTR_KERNEL;
-	if (is_high_priority(client))
+	desc->attribute = GUC_STAGE_DESC_ATTR_ACTIVE;
+	if ((client->priority == GUC_CLIENT_PRIORITY_KMD_NORMAL) ||
+			(client->priority == GUC_CLIENT_PRIORITY_KMD_HIGH)) {
+		desc->attribute  |= GUC_STAGE_DESC_ATTR_KERNEL;
+	} else {
+		desc->attribute  |= GUC_STAGE_DESC_ATTR_PCH;
+	}
+
+	if (is_high_priority_kmd(client))
 		desc->attribute |= GUC_STAGE_DESC_ATTR_PREEMPT;
 	desc->stage_id = client->stage_id;
 	desc->priority = client->priority;
@@ -1302,7 +1317,8 @@ static void guc_interrupts_capture(struct drm_i915_private *dev_priv)
 		I915_WRITE(RING_MODE_GEN7(engine), irqs);
 
 	/* route USER_INTERRUPT to Host, all others are sent to GuC. */
-	irqs = GT_RENDER_USER_INTERRUPT << GEN8_RCS_IRQ_SHIFT |
+	irqs = (GT_RENDER_USER_INTERRUPT | GT_RENDER_PIPECTL_NOTIFY_INTERRUPT)
+							<< GEN8_RCS_IRQ_SHIFT |
 	       GT_RENDER_USER_INTERRUPT << GEN8_BCS_IRQ_SHIFT;
 	/* These three registers have the same bit definitions */
 	I915_WRITE(GUC_BCS_RCS_IER, ~irqs);
@@ -1449,6 +1465,59 @@ void intel_guc_submission_disable(struct intel_guc *guc)
 	guc_clients_disable(guc);
 }
 
+int i915_guc_ipts_submission_enable(struct drm_i915_private *dev_priv,
+				    struct i915_gem_context *ctx)
+{
+	struct intel_guc *guc = &dev_priv->guc;
+	struct intel_guc_client *client;
+	int err;
+	int ret;
+
+	/* client for execbuf submission */
+	client = guc_client_alloc(dev_priv,
+				  INTEL_INFO(dev_priv)->engine_mask,
+				  IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv) ? GUC_CLIENT_PRIORITY_HIGH : GUC_CLIENT_PRIORITY_NORMAL,
+				  ctx);
+	if (IS_ERR(client)) {
+		DRM_ERROR("Failed to create normal GuC client!\n");
+		return -ENOMEM;
+	}
+
+	guc->ipts_client = client;
+
+	err = intel_guc_sample_forcewake(guc);
+	if (err)
+		return err;
+
+	ret = __guc_client_enable(guc->ipts_client);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+void i915_guc_ipts_submission_disable(struct drm_i915_private *dev_priv)
+{
+	struct intel_guc *guc = &dev_priv->guc;
+
+	if (!guc->ipts_client)
+		return;
+
+	__guc_client_disable(guc->ipts_client);
+	guc_client_free(guc->ipts_client);
+	guc->ipts_client = NULL;
+}
+
+void i915_guc_ipts_reacquire_doorbell(struct drm_i915_private *dev_priv)
+{
+	struct intel_guc *guc = &dev_priv->guc;
+
+	int err = __guc_allocate_doorbell(guc, guc->ipts_client->stage_id);
+
+	if (err)
+		DRM_ERROR("Not able to reacquire IPTS doorbell\n");
+}
+
 #if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)
 #include "selftests/intel_guc.c"
 #endif
diff --git a/drivers/gpu/drm/i915_legacy/intel_guc_submission.h b/drivers/gpu/drm/i915_legacy/intel_guc_submission.h
index aa5e6749c925..c9e5c14e7f67 100644
--- a/drivers/gpu/drm/i915_legacy/intel_guc_submission.h
+++ b/drivers/gpu/drm/i915_legacy/intel_guc_submission.h
@@ -84,5 +84,9 @@ void intel_guc_submission_disable(struct intel_guc *guc);
 void intel_guc_submission_fini(struct intel_guc *guc);
 int intel_guc_preempt_work_create(struct intel_guc *guc);
 void intel_guc_preempt_work_destroy(struct intel_guc *guc);
+int i915_guc_ipts_submission_enable(struct drm_i915_private *dev_priv,
+				    struct i915_gem_context *ctx);
+void i915_guc_ipts_submission_disable(struct drm_i915_private *dev_priv);
+void i915_guc_ipts_reacquire_doorbell(struct drm_i915_private *dev_priv);
 
 #endif
diff --git a/drivers/gpu/drm/i915_legacy/intel_ipts.c b/drivers/gpu/drm/i915_legacy/intel_ipts.c
new file mode 100644
index 000000000000..3d3c353986f7
--- /dev/null
+++ b/drivers/gpu/drm/i915_legacy/intel_ipts.c
@@ -0,0 +1,651 @@
+/*
+ * Copyright  2016 Intel Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/module.h>
+#include <linux/intel_ipts_if.h>
+#include <drm/drmP.h>
+
+#include "intel_guc_submission.h"
+#include "i915_drv.h"
+
+#define SUPPORTED_IPTS_INTERFACE_VERSION	1
+
+#define REACQUIRE_DB_THRESHOLD				10
+#define DB_LOST_CHECK_STEP1_INTERVAL		2500	/* ms */
+#define DB_LOST_CHECK_STEP2_INTERVAL		1000	/* ms */
+
+/* intel IPTS ctx for ipts support */
+typedef struct intel_ipts {
+	struct drm_device *dev;
+	struct i915_gem_context *ipts_context;
+	intel_ipts_callback_t ipts_clbks;
+
+	/* buffers' list */
+	struct {
+		spinlock_t       lock;
+		struct list_head list;
+	} buffers;
+
+	void *data;
+
+	struct delayed_work reacquire_db_work;
+	intel_ipts_wq_info_t wq_info;
+	u32	old_tail;
+	u32	old_head;
+	bool	need_reacquire_db;
+
+	bool	connected;
+	bool	initialized;
+} intel_ipts_t;
+
+intel_ipts_t intel_ipts;
+
+typedef struct intel_ipts_object {
+	struct list_head list;
+	struct drm_i915_gem_object *gem_obj;
+	void	*cpu_addr;
+} intel_ipts_object_t;
+
+static intel_ipts_object_t *ipts_object_create(size_t size, u32 flags)
+{
+	struct drm_i915_private *dev_priv = to_i915(intel_ipts.dev);
+	intel_ipts_object_t *obj = NULL;
+	struct drm_i915_gem_object *gem_obj = NULL;
+	int ret = 0;
+
+	obj = kzalloc(sizeof(*obj), GFP_KERNEL);
+	if (!obj)
+		return NULL;
+
+	size = roundup(size, PAGE_SIZE);
+	if (size == 0) {
+		ret = -EINVAL;
+		goto err_out;
+	}
+
+	/* Allocate the new object */
+	gem_obj = i915_gem_object_create(dev_priv, size);
+	if (gem_obj == NULL) {
+		ret = -ENOMEM;
+		goto err_out;
+	}
+
+	if (flags & IPTS_BUF_FLAG_CONTIGUOUS) {
+		ret = i915_gem_object_attach_phys(gem_obj, PAGE_SIZE);
+		if (ret) {
+			pr_info(">> ipts no contiguous : %d\n", ret);
+			goto err_out;
+		}
+	}
+
+	obj->gem_obj = gem_obj;
+
+	spin_lock(&intel_ipts.buffers.lock);
+	list_add_tail(&obj->list, &intel_ipts.buffers.list);
+	spin_unlock(&intel_ipts.buffers.lock);
+
+	return obj;
+
+err_out:
+	if (gem_obj)
+		i915_gem_free_object(&gem_obj->base);
+
+	if (obj)
+		kfree(obj);
+
+	return NULL;
+}
+
+static void ipts_object_free(intel_ipts_object_t* obj)
+{
+	spin_lock(&intel_ipts.buffers.lock);
+	list_del(&obj->list);
+	spin_unlock(&intel_ipts.buffers.lock);
+
+	i915_gem_free_object(&obj->gem_obj->base);
+	kfree(obj);
+}
+
+static int ipts_object_pin(intel_ipts_object_t* obj,
+					struct i915_gem_context *ipts_ctx)
+{
+	struct i915_address_space *vm = NULL;
+	struct i915_vma *vma = NULL;
+	struct drm_i915_private *dev_priv = to_i915(intel_ipts.dev);
+	int ret = 0;
+
+	if (ipts_ctx->ppgtt) {
+		vm = &ipts_ctx->ppgtt->vm;
+	} else {
+		vm = &dev_priv->ggtt.vm;
+	}
+
+	vma = i915_vma_instance(obj->gem_obj, vm, NULL);
+	if (IS_ERR(vma)) {
+		DRM_ERROR("cannot find or create vma\n");
+		return -1;
+	}
+
+	ret = i915_vma_pin(vma, 0, PAGE_SIZE, PIN_USER);
+
+	return ret;
+}
+
+static void ipts_object_unpin(intel_ipts_object_t *obj)
+{
+	/* TBD: Add support */
+}
+
+static void* ipts_object_map(intel_ipts_object_t *obj)
+{
+
+	return i915_gem_object_pin_map(obj->gem_obj, I915_MAP_WB);
+}
+
+static void ipts_object_unmap(intel_ipts_object_t* obj)
+{
+	i915_gem_object_unpin_map(obj->gem_obj);
+	obj->cpu_addr = NULL;
+}
+
+static int create_ipts_context(void)
+{
+	struct i915_gem_context *ipts_ctx = NULL;
+	struct drm_i915_private *dev_priv = to_i915(intel_ipts.dev);
+	struct intel_context *ce = NULL;
+	int ret = 0;
+
+	/* Initialize the context right away.*/
+	ret = i915_mutex_lock_interruptible(intel_ipts.dev);
+	if (ret) {
+		DRM_ERROR("i915_mutex_lock_interruptible failed \n");
+		return ret;
+	}
+
+	ipts_ctx = i915_gem_context_create_ipts(intel_ipts.dev);
+	if (IS_ERR(ipts_ctx)) {
+		DRM_ERROR("Failed to create IPTS context (error %ld)\n",
+			  PTR_ERR(ipts_ctx));
+		ret = PTR_ERR(ipts_ctx);
+		goto err_unlock;
+	}
+
+	ce = intel_context_pin(ipts_ctx, dev_priv->engine[RCS0]);
+	if (IS_ERR(ce)) {
+		DRM_ERROR("Failed to create intel context (error %ld)\n",
+			  PTR_ERR(ce));
+		ret = PTR_ERR(ce);
+		goto err_unlock;
+	}
+
+	ret = execlists_context_deferred_alloc(ce, ce->engine);
+	if (ret) {
+		DRM_DEBUG("lr context allocation failed : %d\n", ret);
+		goto err_ctx;
+	}
+
+	ret = execlists_context_pin(ce);
+	if (ret) {
+		DRM_DEBUG("lr context pinning failed : %d\n", ret);
+		goto err_ctx;
+	}
+
+	/* Release the mutex */
+	mutex_unlock(&intel_ipts.dev->struct_mutex);
+
+	spin_lock_init(&intel_ipts.buffers.lock);
+	INIT_LIST_HEAD(&intel_ipts.buffers.list);
+
+	intel_ipts.ipts_context = ipts_ctx;
+
+	return 0;
+
+err_ctx:
+	if (ipts_ctx)
+		i915_gem_context_put(ipts_ctx);
+
+err_unlock:
+	mutex_unlock(&intel_ipts.dev->struct_mutex);
+
+	return ret;
+}
+
+static void destroy_ipts_context(void)
+{
+	struct i915_gem_context *ipts_ctx = NULL;
+	struct drm_i915_private *dev_priv = to_i915(intel_ipts.dev);
+	struct intel_context *ce = NULL;
+	int ret = 0;
+
+	ipts_ctx = intel_ipts.ipts_context;
+
+	ce = intel_context_lookup(ipts_ctx, dev_priv->engine[RCS0]);
+
+	/* Initialize the context right away.*/
+	ret = i915_mutex_lock_interruptible(intel_ipts.dev);
+	if (ret) {
+		DRM_ERROR("i915_mutex_lock_interruptible failed \n");
+		return;
+	}
+
+	execlists_context_unpin(ce);
+	intel_context_unpin(ce);
+	i915_gem_context_put(ipts_ctx);
+
+	mutex_unlock(&intel_ipts.dev->struct_mutex);
+}
+
+int intel_ipts_notify_complete(void)
+{
+	if (intel_ipts.ipts_clbks.workload_complete)
+		intel_ipts.ipts_clbks.workload_complete(intel_ipts.data);
+
+	return 0;
+}
+
+int intel_ipts_notify_backlight_status(bool backlight_on)
+{
+	if (intel_ipts.ipts_clbks.notify_gfx_status) {
+		if (backlight_on) {
+			intel_ipts.ipts_clbks.notify_gfx_status(
+						IPTS_NOTIFY_STA_BACKLIGHT_ON,
+						intel_ipts.data);
+			schedule_delayed_work(&intel_ipts.reacquire_db_work,
+				msecs_to_jiffies(DB_LOST_CHECK_STEP1_INTERVAL));
+		} else {
+			intel_ipts.ipts_clbks.notify_gfx_status(
+						IPTS_NOTIFY_STA_BACKLIGHT_OFF,
+						intel_ipts.data);
+			cancel_delayed_work(&intel_ipts.reacquire_db_work);
+		}
+	}
+
+	return 0;
+}
+
+static void intel_ipts_reacquire_db(intel_ipts_t *intel_ipts_p)
+{
+	int ret = 0;
+
+	ret = i915_mutex_lock_interruptible(intel_ipts_p->dev);
+	if (ret) {
+		DRM_ERROR("i915_mutex_lock_interruptible failed \n");
+		return;
+	}
+
+	/* Reacquire the doorbell */
+	i915_guc_ipts_reacquire_doorbell(intel_ipts_p->dev->dev_private);
+
+	mutex_unlock(&intel_ipts_p->dev->struct_mutex);
+
+	return;
+}
+
+static int intel_ipts_get_wq_info(uint64_t gfx_handle,
+						intel_ipts_wq_info_t *wq_info)
+{
+	if (gfx_handle != (uint64_t)&intel_ipts) {
+		DRM_ERROR("invalid gfx handle\n");
+		return -EINVAL;
+	}
+
+	*wq_info = intel_ipts.wq_info;
+
+	intel_ipts_reacquire_db(&intel_ipts);
+	schedule_delayed_work(&intel_ipts.reacquire_db_work,
+				msecs_to_jiffies(DB_LOST_CHECK_STEP1_INTERVAL));
+
+	return 0;
+}
+
+static int set_wq_info(void)
+{
+	struct drm_i915_private *dev_priv = to_i915(intel_ipts.dev);
+	struct intel_guc *guc = &dev_priv->guc;
+	struct intel_guc_client *client;
+	struct guc_process_desc *desc;
+	void *base = NULL;
+	intel_ipts_wq_info_t *wq_info;
+	u64 phy_base = 0;
+
+	wq_info = &intel_ipts.wq_info;
+
+	client = guc->ipts_client;
+	if (!client) {
+		DRM_ERROR("IPTS GuC client is NOT available\n");
+		return -EINVAL;
+	}
+
+	base = client->vaddr;
+	desc = (struct guc_process_desc *)((u64)base + client->proc_desc_offset);
+
+	desc->wq_base_addr = (u64)base + GUC_DB_SIZE;
+	desc->db_base_addr = (u64)base + client->doorbell_offset;
+
+	/* IPTS expects physical addresses to pass it to ME */
+	phy_base = sg_dma_address(client->vma->pages->sgl);
+
+	wq_info->db_addr = desc->db_base_addr;
+        wq_info->db_phy_addr = phy_base + client->doorbell_offset;
+        wq_info->db_cookie_offset = offsetof(struct guc_doorbell_info, cookie);
+        wq_info->wq_addr = desc->wq_base_addr;
+        wq_info->wq_phy_addr = phy_base + GUC_DB_SIZE;
+        wq_info->wq_head_addr = (u64)&desc->head;
+        wq_info->wq_head_phy_addr = phy_base + client->proc_desc_offset +
+					offsetof(struct guc_process_desc, head);
+        wq_info->wq_tail_addr = (u64)&desc->tail;
+        wq_info->wq_tail_phy_addr = phy_base + client->proc_desc_offset +
+					offsetof(struct guc_process_desc, tail);
+        wq_info->wq_size = desc->wq_size_bytes;
+
+	return 0;
+}
+
+static int intel_ipts_init_wq(void)
+{
+	int ret = 0;
+
+	ret = i915_mutex_lock_interruptible(intel_ipts.dev);
+	if (ret) {
+		DRM_ERROR("i915_mutex_lock_interruptible failed\n");
+		return ret;
+	}
+
+	/* disable IPTS submission */
+	i915_guc_ipts_submission_disable(intel_ipts.dev->dev_private);
+
+	/* enable IPTS submission */
+	ret = i915_guc_ipts_submission_enable(intel_ipts.dev->dev_private,
+							intel_ipts.ipts_context);
+	if (ret) {
+		DRM_ERROR("i915_guc_ipts_submission_enable failed : %d\n", ret);
+		goto out;
+        }
+
+	ret = set_wq_info();
+	if (ret) {
+		DRM_ERROR("set_wq_info failed\n");
+		goto out;
+	}
+
+out:
+	mutex_unlock(&intel_ipts.dev->struct_mutex);
+
+	return ret;
+}
+
+static void intel_ipts_release_wq(void)
+{
+	int ret = 0;
+
+	ret = i915_mutex_lock_interruptible(intel_ipts.dev);
+	if (ret) {
+		DRM_ERROR("i915_mutex_lock_interruptible failed\n");
+		return;
+	}
+
+	/* disable IPTS submission */
+	i915_guc_ipts_submission_disable(intel_ipts.dev->dev_private);
+
+	mutex_unlock(&intel_ipts.dev->struct_mutex);
+}
+
+static int intel_ipts_map_buffer(u64 gfx_handle, intel_ipts_mapbuffer_t *mapbuf)
+{
+	intel_ipts_object_t* obj;
+	struct i915_gem_context *ipts_ctx = NULL;
+	struct drm_i915_private *dev_priv = to_i915(intel_ipts.dev);
+	struct i915_address_space *vm = NULL;
+	struct i915_vma *vma = NULL;
+	int ret = 0;
+
+	if (gfx_handle != (uint64_t)&intel_ipts) {
+		DRM_ERROR("invalid gfx handle\n");
+		return -EINVAL;
+	}
+
+	/* Acquire mutex first */
+	ret = i915_mutex_lock_interruptible(intel_ipts.dev);
+	if (ret) {
+		DRM_ERROR("i915_mutex_lock_interruptible failed \n");
+		return -EINVAL;
+	}
+
+	obj = ipts_object_create(mapbuf->size, mapbuf->flags);
+	if (!obj)
+		return -ENOMEM;
+
+	ipts_ctx = intel_ipts.ipts_context;
+	ret = ipts_object_pin(obj, ipts_ctx);
+	if (ret) {
+		DRM_ERROR("Not able to pin iTouch obj\n");
+		ipts_object_free(obj);
+		mutex_unlock(&intel_ipts.dev->struct_mutex);
+		return -ENOMEM;
+	}
+
+	if (mapbuf->flags & IPTS_BUF_FLAG_CONTIGUOUS) {
+		obj->cpu_addr = obj->gem_obj->phys_handle->vaddr;
+	} else {
+		obj->cpu_addr = ipts_object_map(obj);
+	}
+
+	if (ipts_ctx->ppgtt) {
+		vm = &ipts_ctx->ppgtt->vm;
+	} else {
+		vm = &dev_priv->ggtt.vm;
+	}
+
+	vma = i915_vma_instance(obj->gem_obj, vm, NULL);
+	if (IS_ERR(vma)) {
+		DRM_ERROR("cannot find or create vma\n");
+		return -EINVAL;
+	}
+
+	mapbuf->gfx_addr = (void*)vma->node.start;
+	mapbuf->cpu_addr = (void*)obj->cpu_addr;
+	mapbuf->buf_handle = (u64)obj;
+	if (mapbuf->flags & IPTS_BUF_FLAG_CONTIGUOUS) {
+		mapbuf->phy_addr = (u64)obj->gem_obj->phys_handle->busaddr;
+	}
+
+	/* Release the mutex */
+	mutex_unlock(&intel_ipts.dev->struct_mutex);
+
+	return 0;
+}
+
+static int intel_ipts_unmap_buffer(uint64_t gfx_handle, uint64_t buf_handle)
+{
+	intel_ipts_object_t* obj = (intel_ipts_object_t*)buf_handle;
+
+	if (gfx_handle != (uint64_t)&intel_ipts) {
+		DRM_ERROR("invalid gfx handle\n");
+		return -EINVAL;
+	}
+
+	if (!obj->gem_obj->phys_handle)
+		ipts_object_unmap(obj);
+	ipts_object_unpin(obj);
+	ipts_object_free(obj);
+
+	return 0;
+}
+
+int intel_ipts_connect(intel_ipts_connect_t *ipts_connect)
+{
+	u32 flags = DL_FLAG_PM_RUNTIME | DL_FLAG_AUTOREMOVE_CONSUMER;
+	struct drm_i915_private *dev_priv = to_i915(intel_ipts.dev);
+
+	if (!intel_ipts.initialized)
+		return -EIO;
+
+	if (!ipts_connect)
+		return -EINVAL;
+
+	if (ipts_connect->if_version > SUPPORTED_IPTS_INTERFACE_VERSION)
+		return -EINVAL;
+
+	/* set up device-link for PM */
+	if (!device_link_add(ipts_connect->client, intel_ipts.dev->dev, flags))
+		return -EFAULT;
+
+	/* return gpu operations for ipts */
+	ipts_connect->ipts_ops.get_wq_info = intel_ipts_get_wq_info;
+	ipts_connect->ipts_ops.map_buffer = intel_ipts_map_buffer;
+	ipts_connect->ipts_ops.unmap_buffer = intel_ipts_unmap_buffer;
+	ipts_connect->gfx_version = INTEL_INFO(dev_priv)->gen;
+	ipts_connect->gfx_handle = (uint64_t)&intel_ipts;
+
+	/* save callback and data */
+	intel_ipts.data = ipts_connect->data;
+	intel_ipts.ipts_clbks = ipts_connect->ipts_cb;
+
+	intel_ipts.connected = true;
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(intel_ipts_connect);
+
+void intel_ipts_disconnect(uint64_t gfx_handle)
+{
+	if (!intel_ipts.initialized)
+		return;
+
+	if (gfx_handle != (uint64_t)&intel_ipts ||
+					intel_ipts.connected == false) {
+		DRM_ERROR("invalid gfx handle\n");
+		return;
+	}
+
+	intel_ipts.data = 0;
+	memset(&intel_ipts.ipts_clbks, 0, sizeof(intel_ipts_callback_t));
+
+	intel_ipts.connected = false;
+}
+EXPORT_SYMBOL_GPL(intel_ipts_disconnect);
+
+static void reacquire_db_work_func(struct work_struct *work)
+{
+	struct delayed_work *d_work = container_of(work, struct delayed_work,
+							work);
+	intel_ipts_t *intel_ipts_p = container_of(d_work, intel_ipts_t,
+							reacquire_db_work);
+	u32 head;
+	u32 tail;
+	u32 size;
+	u32 load;
+
+	head = *(u32*)intel_ipts_p->wq_info.wq_head_addr;
+	tail = *(u32*)intel_ipts_p->wq_info.wq_tail_addr;
+	size = intel_ipts_p->wq_info.wq_size;
+
+	if (head >= tail)
+		load = head - tail;
+	else
+		load = head + size - tail;
+
+	if (load < REACQUIRE_DB_THRESHOLD) {
+		intel_ipts_p->need_reacquire_db = false;
+		goto reschedule_work;
+	}
+
+	if (intel_ipts_p->need_reacquire_db) {
+		if (intel_ipts_p->old_head == head && intel_ipts_p->old_tail == tail)
+			intel_ipts_reacquire_db(intel_ipts_p);
+		intel_ipts_p->need_reacquire_db = false;
+	} else {
+		intel_ipts_p->old_head = head;
+		intel_ipts_p->old_tail = tail;
+		intel_ipts_p->need_reacquire_db = true;
+
+		/* recheck */
+		schedule_delayed_work(&intel_ipts_p->reacquire_db_work,
+				msecs_to_jiffies(DB_LOST_CHECK_STEP2_INTERVAL));
+		return;
+	}
+
+reschedule_work:
+	schedule_delayed_work(&intel_ipts_p->reacquire_db_work,
+				msecs_to_jiffies(DB_LOST_CHECK_STEP1_INTERVAL));
+}
+
+/**
+ * intel_ipts_init - Initialize ipts support
+ * @dev: drm device
+ *
+ * Setup the required structures for ipts.
+ */
+int intel_ipts_init(struct drm_device *dev)
+{
+	int ret = 0;
+
+	pr_info("ipts: initializing ipts\n");
+
+	intel_ipts.dev = dev;
+	INIT_DELAYED_WORK(&intel_ipts.reacquire_db_work, reacquire_db_work_func);
+
+	ret = create_ipts_context();
+	if (ret)
+		return -ENOMEM;
+
+	ret = intel_ipts_init_wq();
+	if (ret)
+		return ret;
+
+	intel_ipts.initialized = true;
+	pr_info("ipts: Intel iTouch framework initialized\n");
+
+	return ret;
+}
+
+void intel_ipts_cleanup(struct drm_device *dev)
+{
+	intel_ipts_object_t *obj, *n;
+
+	if (intel_ipts.dev == dev) {
+		list_for_each_entry_safe(obj, n, &intel_ipts.buffers.list, list) {
+			struct i915_vma *vma, *vn;
+
+			list_for_each_entry_safe(vma, vn,
+						 &obj->list, obj_link) {
+				vma->flags &= ~I915_VMA_PIN_MASK;
+				i915_vma_destroy(vma);
+			}
+
+			list_del(&obj->list);
+
+			if (!obj->gem_obj->phys_handle)
+				ipts_object_unmap(obj);
+			ipts_object_unpin(obj);
+			i915_gem_free_object(&obj->gem_obj->base);
+			kfree(obj);
+		}
+
+		intel_ipts_release_wq();
+		destroy_ipts_context();
+		cancel_delayed_work(&intel_ipts.reacquire_db_work);
+	}
+}
diff --git a/drivers/gpu/drm/i915_legacy/intel_ipts.h b/drivers/gpu/drm/i915_legacy/intel_ipts.h
new file mode 100644
index 000000000000..a6965d102417
--- /dev/null
+++ b/drivers/gpu/drm/i915_legacy/intel_ipts.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright © 2016 Intel Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ *
+ */
+#ifndef _INTEL_IPTS_H_
+#define _INTEL_IPTS_H_
+
+struct drm_device;
+
+int intel_ipts_init(struct drm_device *dev);
+void intel_ipts_cleanup(struct drm_device *dev);
+int intel_ipts_notify_backlight_status(bool backlight_on);
+int intel_ipts_notify_complete(void);
+
+#endif //_INTEL_IPTS_H_
diff --git a/drivers/gpu/drm/i915_legacy/intel_lrc.c b/drivers/gpu/drm/i915_legacy/intel_lrc.c
index 11e5a86610bf..4adf38cad6da 100644
--- a/drivers/gpu/drm/i915_legacy/intel_lrc.c
+++ b/drivers/gpu/drm/i915_legacy/intel_lrc.c
@@ -166,8 +166,8 @@
 
 #define ACTIVE_PRIORITY (I915_PRIORITY_NOSEMAPHORE)
 
-static int execlists_context_deferred_alloc(struct intel_context *ce,
-					    struct intel_engine_cs *engine);
+int execlists_context_deferred_alloc(struct intel_context *ce,
+				     struct intel_engine_cs *engine);
 static void execlists_init_reg_state(u32 *reg_state,
 				     struct intel_context *ce,
 				     struct intel_engine_cs *engine,
@@ -1183,7 +1183,7 @@ static void __context_unpin(struct i915_vma *vma)
 	__i915_vma_unpin(vma);
 }
 
-static void execlists_context_unpin(struct intel_context *ce)
+void execlists_context_unpin(struct intel_context *ce)
 {
 	struct intel_engine_cs *engine;
 
@@ -1285,7 +1285,7 @@ __execlists_context_pin(struct intel_context *ce,
 	return ret;
 }
 
-static int execlists_context_pin(struct intel_context *ce)
+int execlists_context_pin(struct intel_context *ce)
 {
 	return __execlists_context_pin(ce, ce->engine);
 }
@@ -2520,6 +2520,9 @@ int logical_render_ring_init(struct intel_engine_cs *engine)
 	engine->emit_flush = gen8_emit_flush_render;
 	engine->emit_fini_breadcrumb = gen8_emit_fini_breadcrumb_rcs;
 
+	engine->irq_keep_mask |= GT_RENDER_PIPECTL_NOTIFY_INTERRUPT
+				<< GEN8_RCS_IRQ_SHIFT;
+
 	ret = logical_ring_init(engine);
 	if (ret)
 		return ret;
@@ -2881,8 +2884,8 @@ static struct i915_timeline *get_timeline(struct i915_gem_context *ctx)
 		return i915_timeline_create(ctx->i915, NULL);
 }
 
-static int execlists_context_deferred_alloc(struct intel_context *ce,
-					    struct intel_engine_cs *engine)
+int execlists_context_deferred_alloc(struct intel_context *ce,
+				     struct intel_engine_cs *engine)
 {
 	struct drm_i915_gem_object *ctx_obj;
 	struct i915_vma *vma;
diff --git a/drivers/gpu/drm/i915_legacy/intel_lrc.h b/drivers/gpu/drm/i915_legacy/intel_lrc.h
index 84aa230ea27b..0e8008eb0f3a 100644
--- a/drivers/gpu/drm/i915_legacy/intel_lrc.h
+++ b/drivers/gpu/drm/i915_legacy/intel_lrc.h
@@ -115,6 +115,12 @@ void intel_execlists_show_requests(struct intel_engine_cs *engine,
 							const char *prefix),
 				   unsigned int max);
 
+int execlists_context_pin(struct intel_context *ce);
+void execlists_context_unpin(struct intel_context *ce);
+int execlists_context_deferred_alloc(struct intel_context *ce,
+				     struct intel_engine_cs *engine);
+
+
 u32 gen8_make_rpcs(struct drm_i915_private *i915, struct intel_sseu *ctx_sseu);
 
 #endif /* _INTEL_LRC_H_ */
diff --git a/drivers/gpu/drm/i915_legacy/intel_panel.c b/drivers/gpu/drm/i915_legacy/intel_panel.c
index 4ab4ce6569e7..2d3c523ba5c7 100644
--- a/drivers/gpu/drm/i915_legacy/intel_panel.c
+++ b/drivers/gpu/drm/i915_legacy/intel_panel.c
@@ -37,6 +37,7 @@
 #include "intel_connector.h"
 #include "intel_drv.h"
 #include "intel_panel.h"
+#include "intel_ipts.h"
 
 #define CRC_PMIC_PWM_PERIOD_NS	21333
 
@@ -730,6 +731,9 @@ static void lpt_disable_backlight(const struct drm_connector_state *old_conn_sta
 	struct drm_i915_private *dev_priv = to_i915(connector->base.dev);
 	u32 tmp;
 
+	if (INTEL_GEN(dev_priv) >= 9 && i915_modparams.enable_guc && i915_modparams.enable_ipts)
+		intel_ipts_notify_backlight_status(false);
+
 	intel_panel_actually_set_backlight(old_conn_state, 0);
 
 	/*
@@ -917,6 +921,9 @@ static void lpt_enable_backlight(const struct intel_crtc_state *crtc_state,
 
 	/* This won't stick until the above enable. */
 	intel_panel_actually_set_backlight(conn_state, panel->backlight.level);
+
+	if (INTEL_GEN(dev_priv) >= 9 && i915_modparams.enable_guc && i915_modparams.enable_ipts)
+		intel_ipts_notify_backlight_status(true);
 }
 
 static void pch_enable_backlight(const struct intel_crtc_state *crtc_state,
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 16900357afc2..b44910a839e8 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -495,6 +495,7 @@ source "drivers/misc/ti-st/Kconfig"
 source "drivers/misc/lis3lv02d/Kconfig"
 source "drivers/misc/altera-stapl/Kconfig"
 source "drivers/misc/mei/Kconfig"
+source "drivers/misc/ipts/Kconfig"
 source "drivers/misc/vmw_vmci/Kconfig"
 source "drivers/misc/mic/Kconfig"
 source "drivers/misc/genwqe/Kconfig"
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index abd8ae249746..40c8683b4ce6 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -44,6 +44,7 @@ obj-y				+= ti-st/
 obj-y				+= lis3lv02d/
 obj-$(CONFIG_ALTERA_STAPL)	+=altera-stapl/
 obj-$(CONFIG_INTEL_MEI)		+= mei/
+obj-$(CONFIG_INTEL_IPTS)	+= ipts/
 obj-$(CONFIG_VMWARE_VMCI)	+= vmw_vmci/
 obj-$(CONFIG_LATTICE_ECP3_CONFIG)	+= lattice-ecp3-config.o
 obj-$(CONFIG_SRAM)		+= sram.o
diff --git a/drivers/misc/ipts/Kconfig b/drivers/misc/ipts/Kconfig
new file mode 100644
index 000000000000..992a51061b38
--- /dev/null
+++ b/drivers/misc/ipts/Kconfig
@@ -0,0 +1,11 @@
+config INTEL_IPTS
+	tristate "Intel Precise Touch & Stylus"
+	select INTEL_MEI
+	depends on X86 && PCI && HID && DRM_I915
+	help
+	  Intel Precise Touch & Stylus support
+	  Supported SoCs:
+	  Intel Skylake
+	  Intel Kabylake
+
+source "drivers/misc/ipts/companion/Kconfig"
diff --git a/drivers/misc/ipts/Makefile b/drivers/misc/ipts/Makefile
new file mode 100644
index 000000000000..78bb61933387
--- /dev/null
+++ b/drivers/misc/ipts/Makefile
@@ -0,0 +1,17 @@
+#
+# Makefile - Intel Precise Touch & Stylus device driver
+# Copyright (c) 2016, Intel Corporation.
+#
+
+obj-$(CONFIG_INTEL_IPTS)+= intel-ipts.o
+intel-ipts-objs += ipts-fw.o
+intel-ipts-objs += ipts-mei.o
+intel-ipts-objs += ipts-hid.o
+intel-ipts-objs += ipts-msg-handler.o
+intel-ipts-objs += ipts-kernel.o
+intel-ipts-objs += ipts-params.o
+intel-ipts-objs += ipts-resource.o
+intel-ipts-objs += ipts-gfx.o
+intel-ipts-$(CONFIG_DEBUG_FS) += ipts-dbgfs.o
+
+obj-y += companion/
diff --git a/drivers/misc/ipts/companion/Kconfig b/drivers/misc/ipts/companion/Kconfig
new file mode 100644
index 000000000000..877a04494779
--- /dev/null
+++ b/drivers/misc/ipts/companion/Kconfig
@@ -0,0 +1,9 @@
+config INTEL_IPTS_SURFACE
+	tristate "IPTS companion driver for Microsoft Surface"
+	depends on INTEL_IPTS
+	depends on ACPI
+	help
+	  IPTS companion driver for Microsoft Surface. This driver is responsible
+	  for loading firmware using surface-specific hardware IDs.
+
+	  If you have a Microsoft Surface using IPTS, select y or m here.
diff --git a/drivers/misc/ipts/companion/Makefile b/drivers/misc/ipts/companion/Makefile
new file mode 100644
index 000000000000..fb4d58935f01
--- /dev/null
+++ b/drivers/misc/ipts/companion/Makefile
@@ -0,0 +1 @@
+obj-$(CONFIG_INTEL_IPTS_SURFACE)+= ipts-surface.o
diff --git a/drivers/misc/ipts/companion/ipts-surface.c b/drivers/misc/ipts/companion/ipts-surface.c
new file mode 100644
index 000000000000..6f5aabb14e5a
--- /dev/null
+++ b/drivers/misc/ipts/companion/ipts-surface.c
@@ -0,0 +1,100 @@
+#include <linux/acpi.h>
+#include <linux/firmware.h>
+#include <linux/intel_ipts_fw.h>
+#include <linux/intel_ipts_if.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#define IPTS_SURFACE_FW_PATH_FMT "intel/ipts/%s/%s"
+
+#define __IPTS_SURFACE_FIRMWARE(X, Y)				\
+	MODULE_FIRMWARE("intel/ipts/" X "/" Y)
+
+#define IPTS_SURFACE_FIRMWARE(X)				\
+	__IPTS_SURFACE_FIRMWARE(X, "config.bin");		\
+	__IPTS_SURFACE_FIRMWARE(X, "intel_desc.bin");		\
+	__IPTS_SURFACE_FIRMWARE(X, "intel_fw_config.bin");	\
+	__IPTS_SURFACE_FIRMWARE(X, "vendor_desc.bin");		\
+	__IPTS_SURFACE_FIRMWARE(X, "vendor_kernel.bin")
+
+IPTS_SURFACE_FIRMWARE("MSHW0076");
+IPTS_SURFACE_FIRMWARE("MSHW0078");
+IPTS_SURFACE_FIRMWARE("MSHW0079");
+IPTS_SURFACE_FIRMWARE("MSHW0101");
+IPTS_SURFACE_FIRMWARE("MSHW0102");
+IPTS_SURFACE_FIRMWARE("MSHW0103");
+IPTS_SURFACE_FIRMWARE("MSHW0137");
+
+int ipts_surface_request_firmware(const struct firmware **fw, const char *name,
+	struct device *device, void *data)
+{
+	char fw_path[MAX_IOCL_FILE_PATH_LEN];
+
+	if (data == NULL) {
+		return -ENOENT;
+	}
+
+	snprintf(fw_path, MAX_IOCL_FILE_PATH_LEN, IPTS_SURFACE_FW_PATH_FMT,
+		(const char *)data, name);
+	return request_firmware(fw, fw_path, device);
+}
+
+static int ipts_surface_probe(struct platform_device *pdev)
+{
+	int ret;
+	struct acpi_device *adev = ACPI_COMPANION(&pdev->dev);
+
+	if (!adev) {
+		dev_err(&pdev->dev, "Unable to find ACPI info for device\n");
+		return -ENODEV;
+	}
+
+	ret = intel_ipts_add_fw_handler(&ipts_surface_request_firmware,
+		(void *)acpi_device_hid(adev));
+	if (ret) {
+		dev_info(&pdev->dev, "Adding IPTS firmware handler failed, "
+			"error: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+static int ipts_surface_remove(struct platform_device *pdev)
+{
+	int ret;
+
+	ret = intel_ipts_rm_fw_handler(&ipts_surface_request_firmware);
+	if (ret) {
+		dev_info(&pdev->dev, "Removing IPTS firmware handler failed, "
+			"error: %d\n", ret);
+	}
+
+	return 0;
+}
+
+static const struct acpi_device_id ipts_surface_acpi_match[] = {
+	{ "MSHW0076", 0 },	/* Surface Book 1 / Surface Studio */
+	{ "MSHW0078", 0 },	/* Surface Pro 4 */
+	{ "MSHW0079", 0 },	/* Surface Laptop 1 / 2 */
+	{ "MSHW0101", 0 },	/* Surface Book 2 15" */
+	{ "MSHW0102", 0 },	/* Surface Pro 2017 / 6 */
+	{ "MSHW0103", 0 },	/* unknown, but firmware exists */
+	{ "MSHW0137", 0 },	/* Surface Book 2 */
+	{ },
+};
+MODULE_DEVICE_TABLE(acpi, ipts_surface_acpi_match);
+
+static struct platform_driver ipts_surface_driver = {
+	.probe = ipts_surface_probe,
+	.remove = ipts_surface_remove,
+	.driver = {
+		.name = "ipts_surface",
+		.acpi_match_table = ACPI_PTR(ipts_surface_acpi_match),
+	},
+};
+module_platform_driver(ipts_surface_driver);
+
+MODULE_AUTHOR("Dorian Stoll <dorian.stoll@tmsp.io>");
+MODULE_DESCRIPTION("IPTS companion driver for Microsoft Surface");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/misc/ipts/ipts-binary-spec.h b/drivers/misc/ipts/ipts-binary-spec.h
new file mode 100644
index 000000000000..87d4bc4133c4
--- /dev/null
+++ b/drivers/misc/ipts/ipts-binary-spec.h
@@ -0,0 +1,118 @@
+/*
+ *
+ * Intel Precise Touch & Stylus binary spec
+ * Copyright (c) 2016 Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ */
+
+#ifndef _IPTS_BINARY_SPEC_H
+#define _IPTS_BINARY_SPEC_H
+
+#define IPTS_BIN_HEADER_VERSION 2
+
+#pragma pack(1)
+
+/* we support 16 output buffers(1:feedback, 15:HID) */
+#define  MAX_NUM_OUTPUT_BUFFERS 16
+
+typedef enum {
+	IPTS_BIN_KERNEL,
+	IPTS_BIN_RO_DATA,
+	IPTS_BIN_RW_DATA,
+	IPTS_BIN_SENSOR_FRAME,
+	IPTS_BIN_OUTPUT,
+	IPTS_BIN_DYNAMIC_STATE_HEAP,
+	IPTS_BIN_PATCH_LOCATION_LIST,
+	IPTS_BIN_ALLOCATION_LIST,
+	IPTS_BIN_COMMAND_BUFFER_PACKET,
+	IPTS_BIN_TAG,
+} ipts_bin_res_type_t;
+
+typedef struct ipts_bin_header {
+	char str[4];
+	unsigned int version;
+
+#if IPTS_BIN_HEADER_VERSION > 1
+	unsigned int gfxcore;
+	unsigned int revid;
+#endif
+} ipts_bin_header_t;
+
+typedef struct ipts_bin_alloc {
+	unsigned int handle;
+	unsigned int reserved;
+} ipts_bin_alloc_t;
+
+typedef struct ipts_bin_alloc_list {
+	unsigned int num;
+	ipts_bin_alloc_t alloc[];
+} ipts_bin_alloc_list_t;
+
+typedef struct ipts_bin_cmdbuf {
+	unsigned int size;
+	char data[];
+} ipts_bin_cmdbuf_t;
+
+typedef struct ipts_bin_res {
+	unsigned int handle;
+	ipts_bin_res_type_t type;
+	unsigned int initialize;
+	unsigned int aligned_size;
+	unsigned int size;
+	char data[];
+} ipts_bin_res_t;
+
+typedef enum {
+	IPTS_INPUT,
+	IPTS_OUTPUT,
+	IPTS_CONFIGURATION,
+	IPTS_CALIBRATION,
+	IPTS_FEATURE,
+} ipts_bin_io_buffer_type_t;
+
+typedef struct ipts_bin_io_header {
+	char str[10];
+	unsigned short type;
+} ipts_bin_io_header_t;
+
+typedef struct ipts_bin_res_list {
+	unsigned int num;
+	ipts_bin_res_t res[];
+} ipts_bin_res_list_t;
+
+typedef struct ipts_bin_patch {
+	unsigned int index;
+	unsigned int reserved1[2];
+	unsigned int alloc_offset;
+	unsigned int patch_offset;
+	unsigned int reserved2;
+} ipts_bin_patch_t;
+
+typedef struct ipts_bin_patch_list {
+	unsigned int num;
+	ipts_bin_patch_t patch[];
+} ipts_bin_patch_list_t;
+
+typedef struct ipts_bin_guc_wq_info {
+	unsigned int batch_offset;
+	unsigned int size;
+	char data[];
+} ipts_bin_guc_wq_info_t;
+
+typedef struct ipts_bin_bufid_patch {
+	unsigned int imm_offset;
+	unsigned int mem_offset;
+} ipts_bin_bufid_patch_t;
+
+#pragma pack()
+
+#endif /* _IPTS_BINARY_SPEC_H */
diff --git a/drivers/misc/ipts/ipts-dbgfs.c b/drivers/misc/ipts/ipts-dbgfs.c
new file mode 100644
index 000000000000..ffa42a33399d
--- /dev/null
+++ b/drivers/misc/ipts/ipts-dbgfs.c
@@ -0,0 +1,291 @@
+/*
+ * Intel Precise Touch & Stylus device driver
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ */
+#include <linux/debugfs.h>
+#include <linux/ctype.h>
+#include <linux/uaccess.h>
+
+#include "ipts.h"
+#include "ipts-sensor-regs.h"
+#include "ipts-msg-handler.h"
+#include "ipts-state.h"
+#include "../mei/mei_dev.h"
+
+const char ipts_status_fmt[] = "ipts state : %01d\n";
+const char ipts_debug_fmt[] = ">> tdt : fw status : %s\n"
+							  ">> == DB s:%x, c:%x ==\n"
+							  ">> == WQ h:%u, t:%u ==\n";
+
+static ssize_t ipts_dbgfs_status_read(struct file *fp, char __user *ubuf,
+						size_t cnt, loff_t *ppos)
+{
+	ipts_info_t *ipts = fp->private_data;
+	char status[256];
+	int len = 0;
+
+	if (cnt < sizeof(ipts_status_fmt) - 3)
+		return -EINVAL;
+
+	len = scnprintf(status, 256, ipts_status_fmt, ipts->state);
+	if (len < 0)
+		return -EIO;
+
+	return simple_read_from_buffer(ubuf, cnt, ppos, status, len);
+}
+
+static const struct file_operations ipts_status_dbgfs_fops = {
+        .open = simple_open,
+        .read = ipts_dbgfs_status_read,
+        .llseek = generic_file_llseek,
+};
+
+static ssize_t ipts_dbgfs_quiesce_io_cmd_write(struct file *fp, const char __user *ubuf,
+						size_t cnt, loff_t *ppos)
+{
+	ipts_info_t *ipts = fp->private_data;
+	bool result;
+	int rc;
+
+	rc = kstrtobool_from_user(ubuf, cnt, &result);
+	if (rc)
+		return rc;
+
+	if (!result)
+		return -EINVAL;
+
+	ipts_send_sensor_quiesce_io_cmd(ipts);
+
+	return cnt;
+}
+
+static const struct file_operations ipts_quiesce_io_cmd_dbgfs_fops = {
+        .open = simple_open,
+        .write = ipts_dbgfs_quiesce_io_cmd_write,
+        .llseek = generic_file_llseek,
+};
+
+static ssize_t ipts_dbgfs_clear_mem_window_cmd_write(struct file *fp, const char __user *ubuf,
+						size_t cnt, loff_t *ppos)
+{
+	ipts_info_t *ipts = fp->private_data;
+	bool result;
+	int rc;
+
+	rc = kstrtobool_from_user(ubuf, cnt, &result);
+	if (rc)
+		return rc;
+
+	if (!result)
+		return -EINVAL;
+
+	ipts_send_sensor_clear_mem_window_cmd(ipts);
+
+	return cnt;
+}
+
+static const struct file_operations ipts_clear_mem_window_cmd_dbgfs_fops = {
+        .open = simple_open,
+        .write = ipts_dbgfs_clear_mem_window_cmd_write,
+        .llseek = generic_file_llseek,
+};
+
+static ssize_t ipts_dbgfs_debug_read(struct file *fp, char __user *ubuf,
+						size_t cnt, loff_t *ppos)
+{
+	ipts_info_t *ipts = fp->private_data;
+	char dbg_info[1024];
+	int len = 0;
+
+	char fw_sts_str[MEI_FW_STATUS_STR_SZ];
+	u32 *db, *head, *tail;
+	intel_ipts_wq_info_t* wq_info;
+
+	wq_info = &ipts->resource.wq_info;
+
+	mei_fw_status_str(ipts->cldev->bus, fw_sts_str, MEI_FW_STATUS_STR_SZ);
+	// pr_info(">> tdt : fw status : %s\n", fw_sts_str);
+
+	db = (u32*)wq_info->db_addr;
+	head = (u32*)wq_info->wq_head_addr;
+	tail = (u32*)wq_info->wq_tail_addr;
+	// pr_info(">> == DB s:%x, c:%x ==\n", *db, *(db+1));
+	// pr_info(">> == WQ h:%u, t:%u ==\n", *head, *tail);
+
+	if (cnt < sizeof(ipts_debug_fmt) - 3)
+		return -EINVAL;
+
+	len = scnprintf(dbg_info, 1024, ipts_debug_fmt,
+							fw_sts_str,
+							*db, *(db+1),
+							*head, *tail);
+	if (len < 0)
+		return -EIO;
+
+	return simple_read_from_buffer(ubuf, cnt, ppos, dbg_info, len);
+}
+
+static const struct file_operations ipts_debug_dbgfs_fops = {
+        .open = simple_open,
+        .read = ipts_dbgfs_debug_read,
+        .llseek = generic_file_llseek,
+};
+
+static ssize_t ipts_dbgfs_ipts_restart_write(struct file *fp, const char __user *ubuf,
+						size_t cnt, loff_t *ppos)
+{
+	ipts_info_t *ipts = fp->private_data;
+	bool result;
+	int rc;
+
+	rc = kstrtobool_from_user(ubuf, cnt, &result);
+	if (rc)
+		return rc;
+
+	if (!result)
+		return -EINVAL;
+
+	ipts_restart(ipts);
+
+	return cnt;
+}
+
+static const struct file_operations ipts_ipts_restart_dbgfs_fops = {
+        .open = simple_open,
+        .write = ipts_dbgfs_ipts_restart_write,
+        .llseek = generic_file_llseek,
+};
+
+static ssize_t ipts_dbgfs_ipts_stop_write(struct file *fp, const char __user *ubuf,
+						size_t cnt, loff_t *ppos)
+{
+	ipts_info_t *ipts = fp->private_data;
+	bool result;
+	int rc;
+
+	rc = kstrtobool_from_user(ubuf, cnt, &result);
+	if (rc)
+		return rc;
+
+	if (!result)
+		return -EINVAL;
+
+	ipts_stop(ipts);
+
+	return cnt;
+}
+
+static const struct file_operations ipts_ipts_stop_dbgfs_fops = {
+        .open = simple_open,
+        .write = ipts_dbgfs_ipts_stop_write,
+        .llseek = generic_file_llseek,
+};
+
+static ssize_t ipts_dbgfs_ipts_start_write(struct file *fp, const char __user *ubuf,
+						size_t cnt, loff_t *ppos)
+{
+	ipts_info_t *ipts = fp->private_data;
+	bool result;
+	int rc;
+
+	rc = kstrtobool_from_user(ubuf, cnt, &result);
+	if (rc)
+		return rc;
+
+	if (!result)
+		return -EINVAL;
+
+	ipts_start(ipts);
+
+	return cnt;
+}
+
+static const struct file_operations ipts_ipts_start_dbgfs_fops = {
+        .open = simple_open,
+        .write = ipts_dbgfs_ipts_start_write,
+        .llseek = generic_file_llseek,
+};
+
+void ipts_dbgfs_deregister(ipts_info_t* ipts)
+{
+	if (!ipts->dbgfs_dir)
+		return;
+
+	debugfs_remove_recursive(ipts->dbgfs_dir);
+	ipts->dbgfs_dir = NULL;
+}
+
+int ipts_dbgfs_register(ipts_info_t* ipts, const char *name)
+{
+	struct dentry *dir, *f;
+
+	dir = debugfs_create_dir(name, NULL);
+	if (!dir)
+		return -ENOMEM;
+
+        f = debugfs_create_file("status", S_IRUSR, dir,
+                                ipts, &ipts_status_dbgfs_fops);
+        if (!f) {
+                ipts_err(ipts, "debugfs status creation failed\n");
+                goto err;
+        }
+
+        f = debugfs_create_file("quiesce_io_cmd", S_IWUSR, dir,
+                                ipts, &ipts_quiesce_io_cmd_dbgfs_fops);
+        if (!f) {
+                ipts_err(ipts, "debugfs quiesce_io_cmd creation failed\n");
+                goto err;
+        }
+
+        f = debugfs_create_file("clear_mem_window_cmd", S_IWUSR, dir,
+                                ipts, &ipts_clear_mem_window_cmd_dbgfs_fops);
+        if (!f) {
+                ipts_err(ipts, "debugfs clear_mem_window_cmd creation failed\n");
+                goto err;
+        }
+
+        f = debugfs_create_file("debug", S_IRUSR, dir,
+                                ipts, &ipts_debug_dbgfs_fops);
+        if (!f) {
+                ipts_err(ipts, "debugfs debug creation failed\n");
+                goto err;
+        }
+
+        f = debugfs_create_file("ipts_restart", S_IWUSR, dir,
+                                ipts, &ipts_ipts_restart_dbgfs_fops);
+        if (!f) {
+                ipts_err(ipts, "debugfs ipts_restart creation failed\n");
+                goto err;
+        }
+
+        f = debugfs_create_file("ipts_stop", S_IWUSR, dir,
+                                ipts, &ipts_ipts_stop_dbgfs_fops);
+        if (!f) {
+                ipts_err(ipts, "debugfs ipts_stop creation failed\n");
+                goto err;
+        }
+
+        f = debugfs_create_file("ipts_start", S_IWUSR, dir,
+                                ipts, &ipts_ipts_start_dbgfs_fops);
+        if (!f) {
+                ipts_err(ipts, "debugfs ipts_start creation failed\n");
+                goto err;
+        }
+
+	ipts->dbgfs_dir = dir;
+
+	return 0;
+err:
+	ipts_dbgfs_deregister(ipts);
+	return -ENODEV;
+}
diff --git a/drivers/misc/ipts/ipts-fw.c b/drivers/misc/ipts/ipts-fw.c
new file mode 100644
index 000000000000..82e6e44c9908
--- /dev/null
+++ b/drivers/misc/ipts/ipts-fw.c
@@ -0,0 +1,113 @@
+#include <linux/firmware.h>
+#include <linux/intel_ipts_fw.h>
+#include <linux/intel_ipts_if.h>
+#include <linux/mutex.h>
+
+#include "ipts.h"
+#include "ipts-fw.h"
+#include "ipts-params.h"
+
+#define IPTS_GENERIC_FW_PATH_FMT "intel/ipts/%s"
+
+/*
+ * This function pointer allows a companion driver to register a custom logic
+ * for loading firmware files. This can be used to detect devices that can
+ * be used for IPTS versioning, but that are not connected over the MEI bus,
+ * and cannot be detected by the ME driver.
+ */
+IPTS_FW_HANDLER(ipts_fw_handler);
+DEFINE_MUTEX(ipts_fw_handler_lock);
+void *ipts_fw_handler_data = NULL;
+
+bool ipts_fw_handler_available(void)
+{
+	bool ret;
+	mutex_lock(&ipts_fw_handler_lock);
+
+	ret = ipts_fw_handler != NULL;
+
+	mutex_unlock(&ipts_fw_handler_lock);
+	return ret;
+}
+
+int intel_ipts_add_fw_handler(IPTS_FW_HANDLER(handler), void *data)
+{
+	int ret = 0;
+	mutex_lock(&ipts_fw_handler_lock);
+
+	if (ipts_fw_handler != NULL) {
+		ret = -EBUSY;
+		goto ipts_add_fw_handler_return;
+	}
+
+	ipts_fw_handler = handler;
+	ipts_fw_handler_data = data;
+
+ipts_add_fw_handler_return:
+
+	mutex_unlock(&ipts_fw_handler_lock);
+	return ret;
+}
+EXPORT_SYMBOL(intel_ipts_add_fw_handler);
+
+int intel_ipts_rm_fw_handler(IPTS_FW_HANDLER(handler))
+{
+	int ret = 0;
+	mutex_lock(&ipts_fw_handler_lock);
+
+	if (ipts_fw_handler == NULL) {
+		ret = 0;
+		goto ipts_rm_fw_handler_return;
+	}
+
+	if (*handler != *ipts_fw_handler) {
+		ret = -EPERM;
+		goto ipts_rm_fw_handler_return;
+	}
+
+	ipts_fw_handler = NULL;
+	ipts_fw_handler_data = NULL;
+
+ipts_rm_fw_handler_return:
+
+	mutex_unlock(&ipts_fw_handler_lock);
+	return ret;
+}
+EXPORT_SYMBOL(intel_ipts_rm_fw_handler);
+
+int ipts_request_firmware(const struct firmware **fw, const char *name,
+	struct device *device)
+{
+	int ret = 0;
+	char fw_path[MAX_IOCL_FILE_PATH_LEN];
+	mutex_lock(&ipts_fw_handler_lock);
+
+	// Check if a firmware handler was registered. If not, skip
+	// forward and try to load the firmware from the legacy path
+	if (ipts_fw_handler == NULL || ipts_modparams.ignore_companion) {
+		goto ipts_request_firmware_fallback;
+	}
+
+	ret = (*ipts_fw_handler)(fw, name, device, ipts_fw_handler_data);
+	if (!ret) {
+		goto ipts_request_firmware_return;
+	}
+
+ipts_request_firmware_fallback:
+
+	// If fallback loading for firmware was disabled, abort.
+	// Return -ENOENT as no firmware file was found.
+	if (ipts_modparams.ignore_fw_fallback) {
+		ret = -ENOENT;
+		goto ipts_request_firmware_return;
+	}
+
+	// No firmware was found by the companion driver, try the generic path now.
+	snprintf(fw_path, MAX_IOCL_FILE_PATH_LEN, IPTS_GENERIC_FW_PATH_FMT, name);
+	ret = request_firmware(fw, fw_path, device);
+
+ipts_request_firmware_return:
+
+	mutex_unlock(&ipts_fw_handler_lock);
+	return ret;
+}
diff --git a/drivers/misc/ipts/ipts-fw.h b/drivers/misc/ipts/ipts-fw.h
new file mode 100644
index 000000000000..4c1c9a0dd77f
--- /dev/null
+++ b/drivers/misc/ipts/ipts-fw.h
@@ -0,0 +1,12 @@
+#ifndef _IPTS_FW_H_
+#define _IPTS_FW_H_
+
+#include <linux/firmware.h>
+
+#include "ipts.h"
+
+int ipts_request_firmware(const struct firmware **fw, const char *name,
+	struct device *device);
+bool ipts_fw_handler_available(void);
+
+#endif // _IPTS_FW_H_
diff --git a/drivers/misc/ipts/ipts-gfx.c b/drivers/misc/ipts/ipts-gfx.c
new file mode 100644
index 000000000000..4989a22227d2
--- /dev/null
+++ b/drivers/misc/ipts/ipts-gfx.c
@@ -0,0 +1,185 @@
+/*
+ *
+ * Intel Integrated Touch Gfx Interface Layer
+ * Copyright (c) 2016 Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ */
+#include <linux/kthread.h>
+#include <linux/delay.h>
+#include <linux/intel_ipts_if.h>
+
+#include "ipts.h"
+#include "ipts-msg-handler.h"
+#include "ipts-state.h"
+
+static void gfx_processing_complete(void *data)
+{
+	ipts_info_t *ipts = data;
+
+	if (ipts_get_state(ipts) == IPTS_STA_RAW_DATA_STARTED) {
+		schedule_work(&ipts->raw_data_work);
+		return;
+	}
+
+	ipts_dbg(ipts, "not ready to handle gfx event\n");
+}
+
+static void notify_gfx_status(u32 status, void *data)
+{
+	ipts_info_t *ipts = data;
+
+	ipts->gfx_status = status;
+	schedule_work(&ipts->gfx_status_work);
+}
+
+static int connect_gfx(ipts_info_t *ipts)
+{
+	int ret = 0;
+	intel_ipts_connect_t ipts_connect;
+
+	ipts_connect.client = ipts->cldev->dev.parent;
+	ipts_connect.if_version = IPTS_INTERFACE_V1;
+	ipts_connect.ipts_cb.workload_complete = gfx_processing_complete;
+	ipts_connect.ipts_cb.notify_gfx_status = notify_gfx_status;
+	ipts_connect.data = (void*)ipts;
+
+	ret = intel_ipts_connect(&ipts_connect);
+	if (ret)
+		return ret;
+
+	/* TODO: gfx version check */
+	ipts->gfx_info.gfx_handle = ipts_connect.gfx_handle;
+	ipts->gfx_info.ipts_ops = ipts_connect.ipts_ops;
+
+	return ret;
+}
+
+static void disconnect_gfx(ipts_info_t *ipts)
+{
+	intel_ipts_disconnect(ipts->gfx_info.gfx_handle);
+}
+
+#ifdef RUN_DBG_THREAD
+#include "../mei/mei_dev.h"
+
+static struct task_struct *dbg_thread;
+
+static void ipts_print_dbg_info(ipts_info_t* ipts)
+{
+        char fw_sts_str[MEI_FW_STATUS_STR_SZ];
+	u32 *db, *head, *tail;
+	intel_ipts_wq_info_t* wq_info;
+
+	wq_info = &ipts->resource.wq_info;
+
+	mei_fw_status_str(ipts->cldev->bus, fw_sts_str, MEI_FW_STATUS_STR_SZ);
+	pr_info(">> tdt : fw status : %s\n", fw_sts_str);
+
+	db = (u32*)wq_info->db_addr;
+	head = (u32*)wq_info->wq_head_addr;
+	tail = (u32*)wq_info->wq_tail_addr;
+	pr_info(">> == DB s:%x, c:%x ==\n", *db, *(db+1));
+	pr_info(">> == WQ h:%u, t:%u ==\n", *head, *tail);
+}
+
+static int ipts_dbg_thread(void *data)
+{
+	ipts_info_t *ipts = (ipts_info_t *)data;
+
+	pr_info(">> start debug thread\n");
+
+	while (!kthread_should_stop()) {
+		if (ipts_get_state(ipts) != IPTS_STA_RAW_DATA_STARTED) {
+			pr_info("state is not IPTS_STA_RAW_DATA_STARTED : %d\n",
+							ipts_get_state(ipts));
+			msleep(5000);
+			continue;
+		}
+
+		ipts_print_dbg_info(ipts);
+
+		msleep(3000);
+	}
+
+	return 0;
+}
+#endif
+
+int ipts_open_gpu(ipts_info_t *ipts)
+{
+	int ret = 0;
+
+	ret = connect_gfx(ipts);
+	if (ret) {
+		ipts_dbg(ipts, "cannot connect GPU\n");
+		return ret;
+	}
+
+	ret = ipts->gfx_info.ipts_ops.get_wq_info(ipts->gfx_info.gfx_handle,
+							&ipts->resource.wq_info);
+	if (ret) {
+		ipts_dbg(ipts, "error in get_wq_info\n");
+		return ret;
+	}
+
+#ifdef	RUN_DBG_THREAD
+	dbg_thread = kthread_run(ipts_dbg_thread, (void *)ipts, "ipts_debug");
+#endif
+
+	return 0;
+}
+
+void ipts_close_gpu(ipts_info_t *ipts)
+{
+	disconnect_gfx(ipts);
+
+#ifdef	RUN_DBG_THREAD
+	kthread_stop(dbg_thread);
+#endif
+}
+
+intel_ipts_mapbuffer_t *ipts_map_buffer(ipts_info_t *ipts, u32 size, u32 flags)
+{
+	intel_ipts_mapbuffer_t *buf;
+	u64 handle;
+	int ret;
+
+	buf = devm_kzalloc(&ipts->cldev->dev, sizeof(*buf), GFP_KERNEL);
+	if (!buf)
+		return NULL;
+
+	buf->size = size;
+	buf->flags = flags;
+
+	handle = ipts->gfx_info.gfx_handle;
+	ret = ipts->gfx_info.ipts_ops.map_buffer(handle, buf);
+	if (ret) {
+		devm_kfree(&ipts->cldev->dev, buf);
+		return NULL;
+	}
+
+	return buf;
+}
+
+void ipts_unmap_buffer(ipts_info_t *ipts, intel_ipts_mapbuffer_t *buf)
+{
+	u64 handle;
+	int ret;
+
+	if (!buf)
+		return;
+
+	handle = ipts->gfx_info.gfx_handle;
+	ret = ipts->gfx_info.ipts_ops.unmap_buffer(handle, buf->buf_handle);
+
+	devm_kfree(&ipts->cldev->dev, buf);
+}
diff --git a/drivers/misc/ipts/ipts-gfx.h b/drivers/misc/ipts/ipts-gfx.h
new file mode 100644
index 000000000000..03a5f3551ddf
--- /dev/null
+++ b/drivers/misc/ipts/ipts-gfx.h
@@ -0,0 +1,24 @@
+/*
+ * Intel Precise Touch & Stylus gpu wrapper
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+
+#ifndef _IPTS_GFX_H_
+#define _IPTS_GFX_H_
+
+int ipts_open_gpu(ipts_info_t *ipts);
+void ipts_close_gpu(ipts_info_t *ipts);
+intel_ipts_mapbuffer_t *ipts_map_buffer(ipts_info_t *ipts, u32 size, u32 flags);
+void ipts_unmap_buffer(ipts_info_t *ipts, intel_ipts_mapbuffer_t *buf);
+
+#endif // _IPTS_GFX_H_
diff --git a/drivers/misc/ipts/ipts-hid.c b/drivers/misc/ipts/ipts-hid.c
new file mode 100644
index 000000000000..32cf5927f949
--- /dev/null
+++ b/drivers/misc/ipts/ipts-hid.c
@@ -0,0 +1,497 @@
+/*
+ * Intel Precise Touch & Stylus HID driver
+ *
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#include <linux/module.h>
+#include <linux/firmware.h>
+#include <linux/hid.h>
+#include <linux/vmalloc.h>
+#include <linux/dmi.h>
+
+#include "ipts.h"
+#include "ipts-fw.h"
+#include "ipts-params.h"
+#include "ipts-resource.h"
+#include "ipts-sensor-regs.h"
+#include "ipts-msg-handler.h"
+
+#define BUS_MEI				0x44
+
+#define	HID_DESC_INTEL	"intel_desc.bin"
+#define	HID_DESC_VENDOR	"vendor_desc.bin"
+
+typedef enum output_buffer_payload_type {
+	OUTPUT_BUFFER_PAYLOAD_ERROR = 0,
+	OUTPUT_BUFFER_PAYLOAD_HID_INPUT_REPORT,
+	OUTPUT_BUFFER_PAYLOAD_HID_FEATURE_REPORT,
+	OUTPUT_BUFFER_PAYLOAD_KERNEL_LOAD,
+	OUTPUT_BUFFER_PAYLOAD_FEEDBACK_BUFFER
+} output_buffer_payload_type_t;
+
+typedef struct kernel_output_buffer_header {
+	u16 length;
+	u8 payload_type;
+	u8 reserved1;
+	touch_hid_private_data_t hid_private_data;
+	u8 reserved2[28];
+	u8 data[0];
+} kernel_output_buffer_header_t;
+
+typedef struct kernel_output_payload_error {
+	u16 severity;
+	u16 source;
+	u8 code[4];
+	char string[128];
+} kernel_output_payload_error_t;
+
+static const struct dmi_system_id no_feedback_dmi_table[] = {
+	{
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Book"),
+		},
+	},
+	{
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Pro 4"),
+		},
+	},
+	{ }
+};
+
+static int ipts_hid_get_hid_descriptor(ipts_info_t *ipts, u8 **desc, int *size)
+{
+	u8 *buf;
+	int hid_size = 0, ret = 0;
+	const struct firmware *intel_desc = NULL;
+	const struct firmware *vendor_desc = NULL;
+	const char *intel_desc_path = HID_DESC_INTEL;
+	const char *vendor_desc_path = HID_DESC_VENDOR;
+
+	ret = ipts_request_firmware(&intel_desc, intel_desc_path, &ipts->cldev->dev);
+	if (ret) {
+		goto no_hid;
+	}
+	hid_size = intel_desc->size;
+
+	ret = ipts_request_firmware(&vendor_desc, vendor_desc_path, &ipts->cldev->dev);
+	if (ret) {
+		ipts_dbg(ipts, "error in reading HID Vendor Descriptor\n");
+	} else {
+		hid_size += vendor_desc->size;
+	}
+
+	ipts_dbg(ipts, "hid size = %d\n", hid_size);
+	buf = vmalloc(hid_size);
+	if (buf == NULL) {
+		ret = -ENOMEM;
+		goto no_mem;
+	}
+
+	memcpy(buf, intel_desc->data, intel_desc->size);
+	if (vendor_desc) {
+		memcpy(&buf[intel_desc->size], vendor_desc->data,
+							vendor_desc->size);
+		release_firmware(vendor_desc);
+	}
+
+	release_firmware(intel_desc);
+
+	*desc = buf;
+	*size = hid_size;
+
+	return 0;
+no_mem :
+	if (vendor_desc)
+		release_firmware(vendor_desc);
+	release_firmware(intel_desc);
+
+no_hid :
+	return ret;
+}
+
+static int ipts_hid_parse(struct hid_device *hid)
+{
+	ipts_info_t *ipts = hid->driver_data;
+	int ret = 0, size;
+	u8 *buf;
+
+	ipts_dbg(ipts, "ipts_hid_parse() start\n");
+	ret = ipts_hid_get_hid_descriptor(ipts, &buf, &size);
+	if (ret != 0) {
+		ipts_dbg(ipts, "ipts_hid_ipts_get_hid_descriptor ret %d\n", ret);
+		return -EIO;
+	}
+
+	ret = hid_parse_report(hid, buf, size);
+	vfree(buf);
+	if (ret) {
+		ipts_err(ipts, "hid_parse_report error : %d\n", ret);
+		goto out;
+	}
+
+	ipts->hid_desc_ready = true;
+out:
+	return ret;
+}
+
+static int ipts_hid_start(struct hid_device *hid)
+{
+	return 0;
+}
+
+static void ipts_hid_stop(struct hid_device *hid)
+{
+	return;
+}
+
+static int ipts_hid_open(struct hid_device *hid)
+{
+	return 0;
+}
+
+static void ipts_hid_close(struct hid_device *hid)
+{
+	ipts_info_t *ipts = hid->driver_data;
+
+	ipts->hid_desc_ready = false;
+
+	return;
+}
+
+static int ipts_hid_send_hid2me_feedback(ipts_info_t *ipts, u32 fb_data_type,
+							__u8 *buf, size_t count)
+{
+	ipts_buffer_info_t *fb_buf;
+	touch_feedback_hdr_t *feedback;
+	u8 *payload;
+	int header_size;
+	ipts_state_t state;
+
+	header_size = sizeof(touch_feedback_hdr_t);
+
+	if (count > ipts->resource.hid2me_buffer_size - header_size)
+		return -EINVAL;
+
+	state = ipts_get_state(ipts);
+	if (state != IPTS_STA_RAW_DATA_STARTED && state != IPTS_STA_HID_STARTED)
+		return 0;
+
+	fb_buf = ipts_get_hid2me_buffer(ipts);
+	feedback = (touch_feedback_hdr_t *)fb_buf->addr;
+	payload = fb_buf->addr + header_size;
+	memset(feedback, 0, header_size);
+
+	feedback->feedback_data_type = fb_data_type;
+	feedback->feedback_cmd_type = TOUCH_FEEDBACK_CMD_TYPE_NONE;
+	feedback->payload_size_bytes = count;
+	feedback->buffer_id = TOUCH_HID_2_ME_BUFFER_ID;
+	feedback->protocol_ver = 0;
+	feedback->reserved[0] = 0xAC;
+
+	/* copy payload */
+	memcpy(payload, buf, count);
+
+	ipts_send_feedback(ipts, TOUCH_HID_2_ME_BUFFER_ID, 0);
+
+	return 0;
+}
+
+static int ipts_hid_raw_request(struct hid_device *hid,
+				unsigned char report_number, __u8 *buf,
+				size_t count, unsigned char report_type,
+				int reqtype)
+{
+	ipts_info_t *ipts = hid->driver_data;
+	u32 fb_data_type;
+
+	ipts_dbg(ipts, "hid raw request => report %d, request %d\n",
+						 (int)report_type, reqtype);
+
+	if (report_type != HID_FEATURE_REPORT)
+		return 0;
+
+	switch (reqtype) {
+		case HID_REQ_GET_REPORT:
+			fb_data_type = TOUCH_FEEDBACK_DATA_TYPE_GET_FEATURES;
+			break;
+		case HID_REQ_SET_REPORT:
+			fb_data_type = TOUCH_FEEDBACK_DATA_TYPE_SET_FEATURES;
+			break;
+		default:
+			ipts_err(ipts, "raw request not supprted: %d\n", reqtype);
+			return -EIO;
+	}
+
+	return ipts_hid_send_hid2me_feedback(ipts, fb_data_type, buf, count);
+}
+
+static int ipts_hid_output_report(struct hid_device *hid,
+					__u8 *buf, size_t count)
+{
+	ipts_info_t *ipts = hid->driver_data;
+	u32 fb_data_type;
+
+	ipts_dbg(ipts, "hid output report\n");
+
+	fb_data_type = TOUCH_FEEDBACK_DATA_TYPE_OUTPUT_REPORT;
+
+	return ipts_hid_send_hid2me_feedback(ipts, fb_data_type, buf, count);
+}
+
+static struct hid_ll_driver ipts_hid_ll_driver = {
+	.parse = ipts_hid_parse,
+	.start = ipts_hid_start,
+	.stop = ipts_hid_stop,
+	.open = ipts_hid_open,
+	.close = ipts_hid_close,
+	.raw_request = ipts_hid_raw_request,
+	.output_report = ipts_hid_output_report,
+};
+
+int ipts_hid_init(ipts_info_t *ipts)
+{
+	int ret = 0;
+	struct hid_device *hid;
+
+	hid = hid_allocate_device();
+	if (IS_ERR(hid)) {
+		ret = PTR_ERR(hid);
+		goto err_dev;
+	}
+
+	hid->driver_data = ipts;
+	hid->ll_driver = &ipts_hid_ll_driver;
+	hid->dev.parent = &ipts->cldev->dev;
+	hid->bus = BUS_MEI;
+	hid->version = ipts->device_info.fw_rev;
+	hid->vendor = ipts->device_info.vendor_id;
+	hid->product = ipts->device_info.device_id;
+
+	snprintf(hid->phys, sizeof(hid->phys), "heci3");
+	snprintf(hid->name, sizeof(hid->name),
+		 "%s %04hX:%04hX", "ipts", hid->vendor, hid->product);
+
+	ret = hid_add_device(hid);
+	if (ret) {
+		if (ret != -ENODEV)
+			ipts_err(ipts, "can't add hid device: %d\n", ret);
+		goto err_mem_free;
+	}
+
+	ipts->hid = hid;
+
+	return 0;
+
+err_mem_free:
+	hid_destroy_device(hid);
+err_dev:
+	return ret;
+}
+
+void ipts_hid_release(ipts_info_t *ipts)
+{
+	if (!ipts->hid)
+			return;
+	hid_destroy_device(ipts->hid);
+}
+
+int ipts_handle_hid_data(ipts_info_t *ipts,
+			touch_sensor_hid_ready_for_data_rsp_data_t *hid_rsp)
+{
+	touch_raw_data_hdr_t *raw_header;
+	ipts_buffer_info_t *buffer_info;
+	touch_feedback_hdr_t *feedback;
+	u8 *raw_data;
+	int touch_data_buffer_index;
+	int transaction_id;
+	int ret = 0;
+
+	touch_data_buffer_index = (int)hid_rsp->touch_data_buffer_index;
+	buffer_info = ipts_get_touch_data_buffer_hid(ipts);
+	raw_header = (touch_raw_data_hdr_t *)buffer_info->addr;
+	transaction_id = raw_header->hid_private_data.transaction_id;
+
+	raw_data = (u8*)raw_header + sizeof(touch_raw_data_hdr_t);
+	if (raw_header->data_type == TOUCH_RAW_DATA_TYPE_HID_REPORT) {
+		memcpy(ipts->hid_input_report, raw_data,
+				raw_header->raw_data_size_bytes);
+
+		ret = hid_input_report(ipts->hid, HID_INPUT_REPORT,
+					(u8*)ipts->hid_input_report,
+					raw_header->raw_data_size_bytes, 1);
+		if (ret) {
+			ipts_err(ipts, "error in hid_input_report : %d\n", ret);
+		}
+	} else if (raw_header->data_type == TOUCH_RAW_DATA_TYPE_GET_FEATURES) {
+		/* TODO: implement together with "get feature ioctl" */
+	} else if (raw_header->data_type == TOUCH_RAW_DATA_TYPE_ERROR) {
+		touch_error_t *touch_err = (touch_error_t *)raw_data;
+
+		ipts_err(ipts, "error type : %d, me fw error : %x, err reg : %x\n",
+				touch_err->touch_error_type,
+				touch_err->touch_me_fw_error.value,
+				touch_err->touch_error_register.reg_value);
+	}
+
+	/* send feedback data for HID mode */
+        buffer_info = ipts_get_feedback_buffer(ipts, touch_data_buffer_index);
+	feedback = (touch_feedback_hdr_t *)buffer_info->addr;
+	memset(feedback, 0, sizeof(touch_feedback_hdr_t));
+	feedback->feedback_cmd_type = TOUCH_FEEDBACK_CMD_TYPE_NONE;
+	feedback->payload_size_bytes = 0;
+	feedback->buffer_id = touch_data_buffer_index;
+	feedback->protocol_ver = 0;
+	feedback->reserved[0] = 0xAC;
+
+	ret = ipts_send_feedback(ipts, touch_data_buffer_index, transaction_id);
+
+	return ret;
+}
+
+static int handle_outputs(ipts_info_t *ipts, int parallel_idx)
+{
+	kernel_output_buffer_header_t *out_buf_hdr;
+	ipts_buffer_info_t *output_buf, *fb_buf = NULL;
+	u8 *input_report, *payload;
+	u32 transaction_id;
+	int i, payload_size, ret = 0, header_size;
+
+	header_size = sizeof(kernel_output_buffer_header_t);
+	output_buf = ipts_get_output_buffers_by_parallel_id(ipts, parallel_idx);
+	for (i = 0; i < ipts->resource.num_of_outputs; i++) {
+		out_buf_hdr = (kernel_output_buffer_header_t*)output_buf[i].addr;
+		if (out_buf_hdr->length < header_size)
+			continue;
+
+		payload_size = out_buf_hdr->length - header_size;
+		payload = out_buf_hdr->data;
+
+		switch(out_buf_hdr->payload_type) {
+			case OUTPUT_BUFFER_PAYLOAD_HID_INPUT_REPORT:
+				input_report = ipts->hid_input_report;
+				memcpy(input_report, payload, payload_size);
+				hid_input_report(ipts->hid, HID_INPUT_REPORT,
+						input_report, payload_size, 1);
+				break;
+			case OUTPUT_BUFFER_PAYLOAD_HID_FEATURE_REPORT:
+				ipts_dbg(ipts, "output hid feature report\n");
+				break;
+			case OUTPUT_BUFFER_PAYLOAD_KERNEL_LOAD:
+				ipts_dbg(ipts, "output kernel load\n");
+				break;
+			case OUTPUT_BUFFER_PAYLOAD_FEEDBACK_BUFFER:
+			{
+				/* send feedback data for raw data mode */
+                                fb_buf = ipts_get_feedback_buffer(ipts,
+								parallel_idx);
+				transaction_id = out_buf_hdr->
+						hid_private_data.transaction_id;
+				memcpy(fb_buf->addr, payload, payload_size);
+				break;
+			}
+			case OUTPUT_BUFFER_PAYLOAD_ERROR:
+			{
+				kernel_output_payload_error_t *err_payload;
+
+				if (payload_size == 0)
+					break;
+
+				err_payload =
+					(kernel_output_payload_error_t*)payload;
+
+				ipts_err(ipts, "error : severity : %d,"
+						" source : %d,"
+						" code : %d:%d:%d:%d\n"
+						"string %s\n",
+						err_payload->severity,
+						err_payload->source,
+						err_payload->code[0],
+						err_payload->code[1],
+						err_payload->code[2],
+						err_payload->code[3],
+						err_payload->string);
+
+				break;
+			}
+			default:
+				ipts_err(ipts, "invalid output buffer payload\n");
+				break;
+		}
+	}
+
+	/*
+	 * XXX: Calling the "ipts_send_feedback" function repeatedly seems to be
+	 * what is causing touch to crash (found by sebanc, see the link below for
+	 * the comment) on some models, especially on Surface Pro 4 and
+	 * Surface Book 1.
+	 * The most desirable fix could be done by raising IPTS GuC priority. Until
+	 * we find a better solution, use this workaround.
+	 *
+	 * Link to the comment where sebanc found this workaround:
+	 * https://github.com/jakeday/linux-surface/issues/374#issuecomment-508234110
+	 * (Touch and pen issue persists · Issue #374 · jakeday/linux-surface)
+	 *
+	 * Link to the usage from kitakar5525 who made this change:
+	 * https://github.com/jakeday/linux-surface/issues/374#issuecomment-517289171
+	 * (Touch and pen issue persists · Issue #374 · jakeday/linux-surface)
+	 */
+	if (fb_buf) {
+		/* A negative value means "decide by dmi table" */
+		if (ipts_modparams.no_feedback < 0)
+			ipts_modparams.no_feedback =
+				dmi_check_system(no_feedback_dmi_table) ? true : false;
+
+		if (ipts_modparams.no_feedback)
+			return 0;
+
+		ret = ipts_send_feedback(ipts, parallel_idx, transaction_id);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+static int handle_output_buffers(ipts_info_t *ipts, int cur_idx, int end_idx)
+{
+	int max_num_of_buffers = ipts_get_num_of_parallel_buffers(ipts);
+
+	do {
+		cur_idx++; /* cur_idx has last completed so starts with +1 */
+		cur_idx %= max_num_of_buffers;
+		handle_outputs(ipts, cur_idx);
+	} while (cur_idx != end_idx);
+
+	return 0;
+}
+
+int ipts_handle_processed_data(ipts_info_t *ipts)
+{
+	int ret = 0;
+	int current_buffer_idx;
+	int last_buffer_idx;
+
+	current_buffer_idx = *ipts->last_submitted_id;
+	last_buffer_idx = ipts->last_buffer_completed;
+
+	if (current_buffer_idx == last_buffer_idx)
+		return 0;
+
+	ipts->last_buffer_completed = current_buffer_idx;
+	handle_output_buffers(ipts, last_buffer_idx, current_buffer_idx);
+
+	return ret;
+}
diff --git a/drivers/misc/ipts/ipts-hid.h b/drivers/misc/ipts/ipts-hid.h
new file mode 100644
index 000000000000..f1b22c912df7
--- /dev/null
+++ b/drivers/misc/ipts/ipts-hid.h
@@ -0,0 +1,34 @@
+/*
+ * Intel Precise Touch & Stylus HID definition
+ *
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#ifndef _IPTS_HID_H_
+#define	_IPTS_HID_H_
+
+#define	BUS_MEI				0x44
+
+#if 0 /* TODO : we have special report ID. will implement them */
+#define WRITE_CHANNEL_REPORT_ID		0xa
+#define READ_CHANNEL_REPORT_ID		0xb
+#define CONFIG_CHANNEL_REPORT_ID	0xd
+#define VENDOR_INFO_REPORT_ID		0xF
+#define SINGLE_TOUCH_REPORT_ID		0x40
+#endif
+
+int ipts_hid_init(ipts_info_t *ipts);
+void ipts_hid_release(ipts_info_t *ipts);
+int ipts_handle_hid_data(ipts_info_t *ipts,
+			touch_sensor_hid_ready_for_data_rsp_data_t *hid_rsp);
+
+#endif /* _IPTS_HID_H_ */
diff --git a/drivers/misc/ipts/ipts-kernel.c b/drivers/misc/ipts/ipts-kernel.c
new file mode 100644
index 000000000000..5933b190cdaf
--- /dev/null
+++ b/drivers/misc/ipts/ipts-kernel.c
@@ -0,0 +1,1042 @@
+#include <linux/module.h>
+#include <linux/firmware.h>
+#include <linux/vmalloc.h>
+#include <linux/intel_ipts_fw.h>
+#include <linux/intel_ipts_if.h>
+
+#include "ipts.h"
+#include "ipts-fw.h"
+#include "ipts-resource.h"
+#include "ipts-binary-spec.h"
+#include "ipts-state.h"
+#include "ipts-msg-handler.h"
+#include "ipts-gfx.h"
+
+#pragma pack(1)
+typedef struct bin_data_file_info {
+    u32 io_buffer_type;
+    u32 flags;
+    char file_name[MAX_IOCL_FILE_NAME_LEN];
+} bin_data_file_info_t;
+
+typedef struct bin_fw_info {
+	char fw_name[MAX_IOCL_FILE_NAME_LEN];
+
+	/* list of parameters to load a kernel */
+	s32 vendor_output;	/* output index. -1 for no use */
+	u32 num_of_data_files;
+	bin_data_file_info_t data_file[];
+} bin_fw_info_t;
+
+typedef struct bin_fw_list {
+	u32 num_of_fws;
+	bin_fw_info_t fw_info[];
+} bin_fw_list_t;
+#pragma pack()
+
+/* OpenCL kernel */
+typedef struct bin_workload {
+	int cmdbuf_index;
+	int iobuf_input;
+	int iobuf_output[MAX_NUM_OUTPUT_BUFFERS];
+} bin_workload_t;
+
+typedef struct bin_buffer {
+	unsigned int handle;
+	intel_ipts_mapbuffer_t *buf;
+	bool no_unmap;	/* only releasing vendor kernel unmaps output buffers */
+} bin_buffer_t;
+
+typedef struct bin_alloc_info {
+	bin_buffer_t *buffs;
+	int num_of_allocations;
+	int num_of_outputs;
+
+	int num_of_buffers;
+} bin_alloc_info_t;
+
+typedef struct bin_guc_wq_item {
+	unsigned int batch_offset;
+	unsigned int size;
+	char data[];
+} bin_guc_wq_item_t;
+
+typedef struct bin_kernel_info {
+	bin_workload_t *wl;
+	bin_alloc_info_t *alloc_info;
+	bin_guc_wq_item_t *guc_wq_item;
+	ipts_bin_bufid_patch_t bufid_patch;
+
+	bool is_vendor; /* 1: vendor, 0: postprocessing */
+} bin_kernel_info_t;
+
+typedef struct bin_kernel_list {
+	intel_ipts_mapbuffer_t *bufid_buf;
+	int num_of_kernels;
+	bin_kernel_info_t kernels[];
+} bin_kernel_list_t;
+
+typedef struct bin_parse_info {
+	u8 *data;
+	int size;
+	int parsed;
+
+	bin_fw_info_t *fw_info;
+
+	/* only used by postprocessing */
+	bin_kernel_info_t *vendor_kernel;
+	u32 interested_vendor_output; /* interested vendor output index */
+} bin_parse_info_t;
+
+#define BDW_SURFACE_BASE_ADDRESS		0x6101000e
+#define SURFACE_STATE_OFFSET_WORD		4
+#define SBA_OFFSET_BYTES			16384
+#define LASTSUBMITID_DEFAULT_VALUE		-1
+
+#define IPTS_FW_CONFIG_FILE			"ipts_fw_config.bin"
+
+#define IPTS_INPUT_ON				((u32)1 << IPTS_INPUT)
+#define IPTS_OUTPUT_ON				((u32)1 << IPTS_OUTPUT)
+#define IPTS_CONFIGURATION_ON			((u32)1 << IPTS_CONFIGURATION)
+#define IPTS_CALIBRATION_ON			((u32)1 << IPTS_CALIBRATION)
+#define IPTS_FEATURE_ON				((u32)1 << IPTS_FEATURE)
+
+#define	DATA_FILE_FLAG_SHARE			0x00000001
+#define	DATA_FILE_FLAG_ALLOC_CONTIGUOUS		0x00000002
+
+static int bin_read_fw(ipts_info_t *ipts, const char *fw_name,
+						u8* data, int size)
+{
+	const struct firmware *fw = NULL;
+	int ret = 0;
+
+	ret = ipts_request_firmware(&fw, fw_name, &ipts->cldev->dev);
+	if (ret) {
+		ipts_err(ipts, "cannot read fw %s\n", fw_name);
+		return ret;
+	}
+
+	if (fw->size > size) {
+		ipts_dbg(ipts, "too small buffer to contain fw data\n");
+		ret = -EINVAL;
+		goto rel_return;
+	}
+
+	memcpy(data, fw->data, fw->size);
+
+rel_return:
+	release_firmware(fw);
+
+	return ret;
+}
+
+
+static bin_data_file_info_t* bin_get_data_file_info(bin_fw_info_t* fw_info,
+							u32 io_buffer_type)
+{
+	int i;
+
+	for (i = 0; i < fw_info->num_of_data_files; i++) {
+		if (fw_info->data_file[i].io_buffer_type == io_buffer_type)
+			break;
+	}
+
+	if (i == fw_info->num_of_data_files)
+		return NULL;
+
+	return &fw_info->data_file[i];
+}
+
+static inline bool is_shared_data(const bin_data_file_info_t *data_file)
+{
+	if (data_file)
+		return (!!(data_file->flags & DATA_FILE_FLAG_SHARE));
+
+	return false;
+}
+
+static inline bool is_alloc_cont_data(const bin_data_file_info_t *data_file)
+{
+	if (data_file)
+		return (!!(data_file->flags & DATA_FILE_FLAG_ALLOC_CONTIGUOUS));
+
+	return false;
+}
+
+static inline bool is_parsing_vendor_kernel(const bin_parse_info_t *parse_info)
+{
+	/* vendor_kernel == null while loading itself(vendor kernel) */
+	return parse_info->vendor_kernel == NULL;
+}
+
+static int bin_read_allocation_list(ipts_info_t *ipts,
+					bin_parse_info_t *parse_info,
+					bin_alloc_info_t *alloc_info)
+{
+	ipts_bin_alloc_list_t *alloc_list;
+	int alloc_idx, parallel_idx, num_of_parallels, buf_idx, num_of_buffers;
+	int parsed, size;
+
+	parsed = parse_info->parsed;
+	size = parse_info->size;
+
+	alloc_list = (ipts_bin_alloc_list_t *)&parse_info->data[parsed];
+
+	/* validation check */
+	if (sizeof(alloc_list->num) > size - parsed)
+		return -EINVAL;
+
+	/* read the number of aloocations */
+	parsed += sizeof(alloc_list->num);
+
+	/* validation check */
+	if (sizeof(alloc_list->alloc[0]) * alloc_list->num > size - parsed)
+		return -EINVAL;
+
+	num_of_parallels = ipts_get_num_of_parallel_buffers(ipts);
+	num_of_buffers = num_of_parallels * alloc_list->num + num_of_parallels;
+
+	alloc_info->buffs = vmalloc(sizeof(bin_buffer_t) * num_of_buffers);
+	if (alloc_info->buffs == NULL)
+		return -ENOMEM;
+
+	memset(alloc_info->buffs, 0, sizeof(bin_buffer_t) * num_of_buffers);
+	for (alloc_idx = 0; alloc_idx < alloc_list->num; alloc_idx++) {
+		for (parallel_idx = 0; parallel_idx < num_of_parallels;
+								parallel_idx++) {
+			buf_idx = alloc_idx + (parallel_idx * alloc_list->num);
+			alloc_info->buffs[buf_idx].handle =
+					alloc_list->alloc[alloc_idx].handle;
+
+		}
+
+		parsed += sizeof(alloc_list->alloc[0]);
+	}
+
+	parse_info->parsed = parsed;
+	alloc_info->num_of_allocations = alloc_list->num;
+	alloc_info->num_of_buffers = num_of_buffers;
+
+	ipts_dbg(ipts, "number of allocations = %d, buffers = %d\n",
+						alloc_info->num_of_allocations,
+						alloc_info->num_of_buffers);
+
+	return 0;
+}
+
+static void patch_SBA(u32 *buf_addr, u64 gpu_addr, int size)
+{
+	u64 *stateBase;
+	u64 SBA;
+	u32 inst;
+	int i;
+
+	SBA = gpu_addr + SBA_OFFSET_BYTES;
+
+	for (i = 0; i < size/4; i++) {
+		inst = buf_addr[i];
+		if (inst == BDW_SURFACE_BASE_ADDRESS) {
+			stateBase = (u64*)&buf_addr[i + SURFACE_STATE_OFFSET_WORD];
+			*stateBase |= SBA;
+			*stateBase |= 0x01; // enable
+			break;
+		}
+	}
+}
+
+static int bin_read_cmd_buffer(ipts_info_t *ipts,
+					bin_parse_info_t *parse_info,
+					bin_alloc_info_t *alloc_info,
+					bin_workload_t *wl)
+{
+	ipts_bin_cmdbuf_t *cmd;
+	intel_ipts_mapbuffer_t *buf;
+	int cmdbuf_idx, size, parsed, parallel_idx, num_of_parallels;
+
+	size = parse_info->size;
+	parsed = parse_info->parsed;
+
+	cmd = (ipts_bin_cmdbuf_t *)&parse_info->data[parsed];
+
+	if (sizeof(cmd->size) > size - parsed)
+		return -EINVAL;
+
+	parsed += sizeof(cmd->size);
+	if (cmd->size > size - parsed)
+		return -EINVAL;
+
+	ipts_dbg(ipts, "cmd buf size = %d\n", cmd->size);
+
+	num_of_parallels = ipts_get_num_of_parallel_buffers(ipts);
+	/* command buffers are located after the other allocations */
+	cmdbuf_idx = num_of_parallels * alloc_info->num_of_allocations;
+	for (parallel_idx = 0; parallel_idx < num_of_parallels; parallel_idx++) {
+		buf = ipts_map_buffer(ipts, cmd->size, 0);
+		if (buf == NULL)
+			return -ENOMEM;
+
+		ipts_dbg(ipts, "cmd_idx[%d] = %d, g:0x%p, c:0x%p\n", parallel_idx,
+					cmdbuf_idx, buf->gfx_addr, buf->cpu_addr);
+
+		memcpy((void *)buf->cpu_addr, &(cmd->data[0]), cmd->size);
+		patch_SBA(buf->cpu_addr, (u64)buf->gfx_addr, cmd->size);
+		alloc_info->buffs[cmdbuf_idx].buf = buf;
+		wl[parallel_idx].cmdbuf_index = cmdbuf_idx;
+
+		cmdbuf_idx++;
+	}
+
+	parsed += cmd->size;
+	parse_info->parsed = parsed;
+
+	return 0;
+}
+
+static int bin_find_alloc(ipts_info_t *ipts,
+					bin_alloc_info_t *alloc_info,
+					u32 handle)
+{
+	int i;
+
+	for (i = 0; i < alloc_info->num_of_allocations; i++) {
+		if (alloc_info->buffs[i].handle == handle)
+			return i;
+	}
+
+	return -1;
+}
+
+static intel_ipts_mapbuffer_t* bin_get_vendor_kernel_output(
+						bin_parse_info_t *parse_info,
+						int parallel_idx)
+{
+	bin_kernel_info_t *vendor = parse_info->vendor_kernel;
+	bin_alloc_info_t *alloc_info;
+	int buf_idx, vendor_output_idx;
+
+	alloc_info = vendor->alloc_info;
+	vendor_output_idx = parse_info->interested_vendor_output;
+
+	if (vendor_output_idx >= alloc_info->num_of_outputs)
+		return NULL;
+
+	buf_idx = vendor->wl[parallel_idx].iobuf_output[vendor_output_idx];
+	return alloc_info->buffs[buf_idx].buf;
+}
+
+static int bin_read_res_list(ipts_info_t *ipts,
+					bin_parse_info_t *parse_info,
+					bin_alloc_info_t *alloc_info,
+					bin_workload_t *wl)
+{
+	ipts_bin_res_list_t *res_list;
+	ipts_bin_res_t *res;
+	intel_ipts_mapbuffer_t *buf;
+	bin_data_file_info_t *data_file;
+	u8 *bin_data;
+	int i, size, parsed, parallel_idx, num_of_parallels, output_idx = -1;
+	int buf_idx, num_of_alloc;
+	u32 buf_size, flags, io_buf_type;
+	bool initialize;
+
+	parsed = parse_info->parsed;
+	size = parse_info->size;
+	bin_data = parse_info->data;
+
+	res_list = (ipts_bin_res_list_t *)&parse_info->data[parsed];
+	if (sizeof(res_list->num) > (size - parsed))
+		return -EINVAL;
+	parsed += sizeof(res_list->num);
+	num_of_parallels = ipts_get_num_of_parallel_buffers(ipts);
+
+	ipts_dbg(ipts, "number of resources %u\n", res_list->num);
+	for (i = 0; i < res_list->num; i++) {
+		initialize = false;
+		io_buf_type = 0;
+		flags = 0;
+
+		/* initial data */
+		data_file = NULL;
+
+		res = (ipts_bin_res_t *)(&(bin_data[parsed]));
+		if (sizeof(res[0]) > (size - parsed)) {
+			return -EINVAL;
+		}
+
+		ipts_dbg(ipts, "Resource(%d):handle 0x%08x type %u init %u"
+				" size %u alsigned %u\n",
+				i, res->handle, res->type, res->initialize,
+				res->size, res->aligned_size);
+                parsed += sizeof(res[0]);
+
+		if (res->initialize) {
+			if (res->size > (size - parsed)) {
+				return -EINVAL;
+			}
+			parsed += res->size;
+		}
+
+		initialize = res->initialize;
+		if (initialize && res->size > sizeof(ipts_bin_io_header_t)) {
+			ipts_bin_io_header_t *io_hdr;
+			io_hdr = (ipts_bin_io_header_t *)(&res->data[0]);
+			if (strncmp(io_hdr->str, "INTELTOUCH", 10) == 0) {
+				data_file = bin_get_data_file_info(
+							parse_info->fw_info,
+							(u32)io_hdr->type);
+				switch (io_hdr->type) {
+				case IPTS_INPUT:
+					ipts_dbg(ipts, "input detected\n");
+					io_buf_type = IPTS_INPUT_ON;
+					flags = IPTS_BUF_FLAG_CONTIGUOUS;
+					break;
+				case IPTS_OUTPUT:
+					ipts_dbg(ipts, "output detected\n");
+					io_buf_type = IPTS_OUTPUT_ON;
+					output_idx++;
+					break;
+				default:
+					if ((u32)io_hdr->type > 31) {
+						ipts_err(ipts,
+							"invalid io buffer : %u\n",
+							(u32)io_hdr->type);
+						continue;
+					}
+
+					if (is_alloc_cont_data(data_file))
+						flags = IPTS_BUF_FLAG_CONTIGUOUS;
+
+					io_buf_type = ((u32)1 << (u32)io_hdr->type);
+					ipts_dbg(ipts, "special io buffer %u\n",
+								io_hdr->type);
+					break;
+				}
+
+				initialize = false;
+			}
+		}
+
+		num_of_alloc = alloc_info->num_of_allocations;
+		buf_idx = bin_find_alloc(ipts, alloc_info, res->handle);
+		if (buf_idx == -1) {
+			ipts_dbg(ipts, "cannot find alloc info\n");
+			return -EINVAL;
+		}
+		for (parallel_idx = 0; parallel_idx < num_of_parallels;
+					parallel_idx++, buf_idx += num_of_alloc) {
+			if (!res->aligned_size)
+				continue;
+
+			if (!(parallel_idx == 0 ||
+				    (io_buf_type && !is_shared_data(data_file))))
+				continue;
+
+			buf_size = res->aligned_size;
+			if (io_buf_type & IPTS_INPUT_ON) {
+				buf_size = max_t(u32,
+						ipts->device_info.frame_size,
+						buf_size);
+				wl[parallel_idx].iobuf_input = buf_idx;
+			} else if (io_buf_type & IPTS_OUTPUT_ON) {
+				wl[parallel_idx].iobuf_output[output_idx] = buf_idx;
+
+				if (!is_parsing_vendor_kernel(parse_info) &&
+								output_idx > 0) {
+					ipts_err(ipts,
+						"postproc with more than one inout"
+						" is not supported : %d\n", output_idx);
+					return -EINVAL;
+				}
+			}
+
+			if (!is_parsing_vendor_kernel(parse_info) &&
+						io_buf_type & IPTS_OUTPUT_ON) {
+				buf = bin_get_vendor_kernel_output(
+								parse_info,
+								parallel_idx);
+				alloc_info->buffs[buf_idx].no_unmap = true;
+			} else
+				buf = ipts_map_buffer(ipts, buf_size, flags);
+
+			if (buf == NULL) {
+				ipts_dbg(ipts, "ipts_map_buffer failed\n");
+				return -ENOMEM;
+			}
+
+			if (initialize) {
+				memcpy((void *)buf->cpu_addr, &(res->data[0]),
+								res->size);
+			} else {
+				if (data_file && strlen(data_file->file_name)) {
+					bin_read_fw(ipts, data_file->file_name,
+                                                        buf->cpu_addr, buf_size);
+				} else if (is_parsing_vendor_kernel(parse_info) ||
+						!(io_buf_type & IPTS_OUTPUT_ON)) {
+					memset((void *)buf->cpu_addr, 0, res->size);
+				}
+			}
+
+			alloc_info->buffs[buf_idx].buf = buf;
+		}
+	}
+
+        alloc_info->num_of_outputs = output_idx + 1;
+	parse_info->parsed = parsed;
+
+	return 0;
+}
+
+static int bin_read_patch_list(ipts_info_t *ipts,
+					bin_parse_info_t *parse_info,
+					bin_alloc_info_t *alloc_info,
+					bin_workload_t *wl)
+{
+	ipts_bin_patch_list_t *patch_list;
+	ipts_bin_patch_t *patch;
+	intel_ipts_mapbuffer_t *cmd = NULL;
+	u8 *batch;
+	int parsed, size, i, parallel_idx, num_of_parallels, cmd_idx, buf_idx;
+	unsigned int gtt_offset;
+
+	parsed = parse_info->parsed;
+	size = parse_info->size;
+	patch_list = (ipts_bin_patch_list_t *)&parse_info->data[parsed];
+
+	if (sizeof(patch_list->num) > (size - parsed)) {
+		return -EFAULT;
+	}
+	parsed += sizeof(patch_list->num);
+
+	num_of_parallels = ipts_get_num_of_parallel_buffers(ipts);
+	patch = (ipts_bin_patch_t *)(&patch_list->patch[0]);
+	for (i = 0; i < patch_list->num; i++) {
+		if (sizeof(patch_list->patch[0]) > (size - parsed)) {
+			return -EFAULT;
+		}
+
+		for (parallel_idx = 0; parallel_idx < num_of_parallels;
+								parallel_idx++) {
+			cmd_idx = wl[parallel_idx].cmdbuf_index;
+			buf_idx = patch[i].index + parallel_idx *
+						alloc_info->num_of_allocations;
+
+			if (alloc_info->buffs[buf_idx].buf == NULL) {
+				/* buffer shared */
+				buf_idx = patch[i].index;
+			}
+
+			cmd = alloc_info->buffs[cmd_idx].buf;
+			batch = (char *)(u64)cmd->cpu_addr;
+
+			gtt_offset = 0;
+			if(alloc_info->buffs[buf_idx].buf != NULL) {
+				gtt_offset = (u32)(u64)
+					alloc_info->buffs[buf_idx].buf->gfx_addr;
+			}
+			gtt_offset += patch[i].alloc_offset;
+
+			batch += patch[i].patch_offset;
+			*(u32*)batch = gtt_offset;
+		}
+
+		parsed += sizeof(patch_list->patch[0]);
+	}
+
+	parse_info->parsed = parsed;
+
+	return 0;
+}
+
+static int bin_read_guc_wq_item(ipts_info_t *ipts,
+					bin_parse_info_t *parse_info,
+					bin_guc_wq_item_t **guc_wq_item)
+{
+	ipts_bin_guc_wq_info_t *bin_guc_wq;
+	bin_guc_wq_item_t *item;
+	u8 *wi_data;
+	int size, parsed, hdr_size, wi_size;
+	int i, batch_offset;
+
+	parsed = parse_info->parsed;
+	size = parse_info->size;
+	bin_guc_wq = (ipts_bin_guc_wq_info_t *)&parse_info->data[parsed];
+
+	wi_size = bin_guc_wq->size;
+	wi_data = bin_guc_wq->data;
+	batch_offset = bin_guc_wq->batch_offset;
+	ipts_dbg(ipts, "wi size = %d, bt offset = %d\n", wi_size, batch_offset);
+	for (i = 0; i < wi_size / sizeof(u32); i++) {
+		ipts_dbg(ipts, "wi[%d] = 0x%08x\n", i, *((u32*)wi_data + i));
+	}
+	hdr_size = sizeof(bin_guc_wq->size) + sizeof(bin_guc_wq->batch_offset);
+
+	if (hdr_size > (size - parsed)) {
+		return -EINVAL;
+	}
+	parsed += hdr_size;
+
+	item = vmalloc(sizeof(bin_guc_wq_item_t) + wi_size);
+	if (item == NULL)
+		return -ENOMEM;
+
+	item->size = wi_size;
+	item->batch_offset = batch_offset;
+	memcpy(item->data, wi_data, wi_size);
+
+	*guc_wq_item = item;
+
+	parsed += wi_size;
+	parse_info->parsed = parsed;
+
+	return 0;
+}
+
+static int bin_setup_guc_workqueue(ipts_info_t *ipts,
+					bin_kernel_list_t *kernel_list)
+{
+	bin_alloc_info_t *alloc_info;
+	bin_workload_t *wl;
+	bin_kernel_info_t *kernel;
+	u8 *wq_start, *wq_addr, *wi_data;
+	bin_buffer_t *bin_buf;
+	int wq_size, wi_size, parallel_idx, cmd_idx, k_idx, iter_size;
+	int i, num_of_parallels, batch_offset, k_num, total_workload;
+
+	wq_addr = (u8*)ipts->resource.wq_info.wq_addr;
+	wq_size = ipts->resource.wq_info.wq_size;
+	num_of_parallels = ipts_get_num_of_parallel_buffers(ipts);
+	total_workload = ipts_get_wq_item_size(ipts);
+	k_num = kernel_list->num_of_kernels;
+
+	iter_size = total_workload * num_of_parallels;
+	if (wq_size % iter_size) {
+		ipts_err(ipts, "wq item cannot fit into wq\n");
+		return -EINVAL;
+	}
+
+	wq_start = wq_addr;
+	for (parallel_idx = 0; parallel_idx < num_of_parallels;
+							parallel_idx++) {
+		kernel = &kernel_list->kernels[0];
+		for (k_idx = 0; k_idx < k_num; k_idx++, kernel++) {
+			wl = kernel->wl;
+			alloc_info = kernel->alloc_info;
+
+			batch_offset = kernel->guc_wq_item->batch_offset;
+			wi_size = kernel->guc_wq_item->size;
+			wi_data = &kernel->guc_wq_item->data[0];
+
+			cmd_idx = wl[parallel_idx].cmdbuf_index;
+			bin_buf = &alloc_info->buffs[cmd_idx];
+
+			/* Patch the WQ Data with proper batch buffer offset */
+			*(u32*)(wi_data + batch_offset) =
+				(u32)(unsigned long)(bin_buf->buf->gfx_addr);
+
+			memcpy(wq_addr, wi_data, wi_size);
+
+			wq_addr += wi_size;
+		}
+	}
+
+	for (i = 0; i < (wq_size / iter_size) - 1; i++) {
+		memcpy(wq_addr, wq_start, iter_size);
+		wq_addr += iter_size;
+	}
+
+	return 0;
+}
+
+static int bin_read_bufid_patch(ipts_info_t *ipts,
+					bin_parse_info_t *parse_info,
+					ipts_bin_bufid_patch_t *bufid_patch)
+{
+	ipts_bin_bufid_patch_t *patch;
+	int size, parsed;
+
+	parsed = parse_info->parsed;
+	size = parse_info->size;
+	patch = (ipts_bin_bufid_patch_t *)&parse_info->data[parsed];
+
+	if (sizeof(ipts_bin_bufid_patch_t) > (size - parsed)) {
+		ipts_dbg(ipts, "invalid bufid info\n");
+		return -EINVAL;
+	}
+	parsed += sizeof(ipts_bin_bufid_patch_t);
+
+	memcpy(bufid_patch, patch, sizeof(ipts_bin_bufid_patch_t));
+
+	parse_info->parsed = parsed;
+
+	return 0;
+}
+
+static int bin_setup_bufid_buffer(ipts_info_t *ipts, bin_kernel_list_t *kernel_list)
+{
+	intel_ipts_mapbuffer_t *buf, *cmd_buf;
+	bin_kernel_info_t *last_kernel;
+	bin_alloc_info_t *alloc_info;
+	bin_workload_t *wl;
+	u8 *batch;
+	int parallel_idx, num_of_parallels, cmd_idx;
+	u32 mem_offset, imm_offset;
+
+	buf = ipts_map_buffer(ipts, PAGE_SIZE, 0);
+	if (!buf) {
+		return -ENOMEM;
+	}
+
+	last_kernel = &kernel_list->kernels[kernel_list->num_of_kernels - 1];
+
+	mem_offset = last_kernel->bufid_patch.mem_offset;
+	imm_offset = last_kernel->bufid_patch.imm_offset;
+	wl = last_kernel->wl;
+	alloc_info = last_kernel->alloc_info;
+
+	/* Initialize the buffer with default value */
+        *((u32*)buf->cpu_addr) = LASTSUBMITID_DEFAULT_VALUE;
+	ipts->current_buffer_index = LASTSUBMITID_DEFAULT_VALUE;
+	ipts->last_buffer_completed = LASTSUBMITID_DEFAULT_VALUE;
+	ipts->last_submitted_id = (int*)buf->cpu_addr;
+
+	num_of_parallels = ipts_get_num_of_parallel_buffers(ipts);
+	for (parallel_idx = 0; parallel_idx < num_of_parallels; parallel_idx++) {
+		cmd_idx = wl[parallel_idx].cmdbuf_index;
+		cmd_buf = alloc_info->buffs[cmd_idx].buf;
+		batch = (u8*)(u64)cmd_buf->cpu_addr;
+
+		*((u32*)(batch + mem_offset)) = (u32)(u64)(buf->gfx_addr);
+                *((u32*)(batch + imm_offset)) = parallel_idx;
+	}
+
+	kernel_list->bufid_buf = buf;
+
+	return 0;
+}
+
+static void unmap_buffers(ipts_info_t *ipts, bin_alloc_info_t *alloc_info)
+{
+	bin_buffer_t *buffs;
+	int i, num_of_buffers;
+
+	num_of_buffers = alloc_info->num_of_buffers;
+	buffs = &alloc_info->buffs[0];
+
+	for (i = 0; i < num_of_buffers; i++) {
+		if (buffs[i].no_unmap != true && buffs[i].buf != NULL)
+			ipts_unmap_buffer(ipts, buffs[i].buf);
+	}
+}
+
+static int load_kernel(ipts_info_t *ipts, bin_parse_info_t *parse_info,
+						bin_kernel_info_t *kernel)
+{
+	ipts_bin_header_t *hdr;
+	bin_workload_t *wl;
+	bin_alloc_info_t *alloc_info;
+	bin_guc_wq_item_t *guc_wq_item = NULL;
+	ipts_bin_bufid_patch_t bufid_patch;
+	int num_of_parallels, ret;
+
+	num_of_parallels = ipts_get_num_of_parallel_buffers(ipts);
+
+        /* check header version and magic numbers */
+	hdr = (ipts_bin_header_t *)parse_info->data;
+	if (hdr->version != IPTS_BIN_HEADER_VERSION ||
+					strncmp(hdr->str, "IOCL", 4) != 0) {
+		ipts_err(ipts, "binary header is not correct version = %d, "
+				"string = %c%c%c%c\n", hdr->version,
+				hdr->str[0], hdr->str[1],
+				hdr->str[2], hdr->str[3] );
+		return -EINVAL;
+	}
+
+	parse_info->parsed = sizeof(ipts_bin_header_t);
+	wl = vmalloc(sizeof(bin_workload_t) * num_of_parallels);
+	if (wl == NULL)
+		return -ENOMEM;
+	memset(wl, 0, sizeof(bin_workload_t) * num_of_parallels);
+
+	alloc_info = vmalloc(sizeof(bin_alloc_info_t));
+	if (alloc_info == NULL) {
+		vfree(wl);
+		return -ENOMEM;
+	}
+	memset(alloc_info, 0, sizeof(bin_alloc_info_t));
+
+        ipts_dbg(ipts, "kernel setup(size : %d)\n", parse_info->size);
+
+	ret = bin_read_allocation_list(ipts, parse_info, alloc_info);
+	if (ret) {
+		ipts_dbg(ipts, "error read_allocation_list\n");
+		goto setup_error;
+	}
+
+	ret = bin_read_cmd_buffer(ipts, parse_info, alloc_info, wl);
+	if (ret) {
+		ipts_dbg(ipts, "error read_cmd_buffer\n");
+		goto setup_error;
+	}
+
+	ret = bin_read_res_list(ipts, parse_info, alloc_info, wl);
+	if (ret) {
+		ipts_dbg(ipts, "error read_res_list\n");
+		goto setup_error;
+	}
+
+	ret = bin_read_patch_list(ipts, parse_info, alloc_info, wl);
+	if (ret) {
+		ipts_dbg(ipts, "error read_patch_list\n");
+		goto setup_error;
+	}
+
+	ret = bin_read_guc_wq_item(ipts, parse_info, &guc_wq_item);
+	if (ret) {
+		ipts_dbg(ipts, "error read_guc_workqueue\n");
+		goto setup_error;
+	}
+
+	memset(&bufid_patch, 0, sizeof(bufid_patch));
+	ret = bin_read_bufid_patch(ipts, parse_info, &bufid_patch);
+	if (ret) {
+		ipts_dbg(ipts, "error read_bufid_patch\n");
+		goto setup_error;
+	}
+
+	kernel->wl = wl;
+	kernel->alloc_info = alloc_info;
+	kernel->is_vendor = is_parsing_vendor_kernel(parse_info);
+	kernel->guc_wq_item = guc_wq_item;
+	memcpy(&kernel->bufid_patch, &bufid_patch, sizeof(bufid_patch));
+
+	return 0;
+
+setup_error:
+	vfree(guc_wq_item);
+
+	unmap_buffers(ipts, alloc_info);
+
+	vfree(alloc_info->buffs);
+	vfree(alloc_info);
+	vfree(wl);
+
+	return ret;
+}
+
+void bin_setup_input_output(ipts_info_t *ipts, bin_kernel_list_t *kernel_list)
+{
+	bin_kernel_info_t *vendor_kernel;
+	bin_workload_t *wl;
+	intel_ipts_mapbuffer_t *buf;
+	bin_alloc_info_t *alloc_info;
+	int parallel_idx, num_of_parallels, i, buf_idx;
+
+	vendor_kernel = &kernel_list->kernels[0];
+
+	wl = vendor_kernel->wl;
+	alloc_info = vendor_kernel->alloc_info;
+	ipts->resource.num_of_outputs = alloc_info->num_of_outputs;
+	num_of_parallels = ipts_get_num_of_parallel_buffers(ipts);
+
+	for (parallel_idx = 0; parallel_idx < num_of_parallels; parallel_idx++) {
+		buf_idx = wl[parallel_idx].iobuf_input;
+		buf = alloc_info->buffs[buf_idx].buf;
+
+		ipts_dbg(ipts, "in_buf[%d](%d) c:%p, p:%p, g:%p\n",
+					parallel_idx, buf_idx, (void*)buf->cpu_addr,
+					(void*)buf->phy_addr, (void*)buf->gfx_addr);
+
+		ipts_set_input_buffer(ipts, parallel_idx, buf->cpu_addr,
+								buf->phy_addr);
+
+		for (i = 0; i < alloc_info->num_of_outputs; i++) {
+			buf_idx = wl[parallel_idx].iobuf_output[i];
+			buf = alloc_info->buffs[buf_idx].buf;
+
+			ipts_dbg(ipts, "out_buf[%d][%d] c:%p, p:%p, g:%p\n",
+					parallel_idx, i, (void*)buf->cpu_addr,
+					(void*)buf->phy_addr, (void*)buf->gfx_addr);
+
+			ipts_set_output_buffer(ipts, parallel_idx, i,
+					buf->cpu_addr, buf->phy_addr);
+		}
+	}
+}
+
+static void unload_kernel(ipts_info_t *ipts, bin_kernel_info_t *kernel)
+{
+	bin_alloc_info_t *alloc_info = kernel->alloc_info;
+	bin_guc_wq_item_t *guc_wq_item = kernel->guc_wq_item;
+
+	if (guc_wq_item) {
+		vfree(guc_wq_item);
+	}
+
+	if (alloc_info) {
+		unmap_buffers(ipts, alloc_info);
+
+		vfree(alloc_info->buffs);
+		vfree(alloc_info);
+	}
+}
+
+static int setup_kernel(ipts_info_t *ipts, bin_fw_list_t *fw_list)
+{
+	bin_kernel_list_t *kernel_list = NULL;
+	bin_kernel_info_t *kernel = NULL;
+	const struct firmware *fw = NULL;
+	bin_workload_t *wl;
+	bin_fw_info_t *fw_info;
+	char *fw_name, *fw_data;
+	bin_parse_info_t parse_info;
+	int ret = 0, kernel_idx = 0, num_of_kernels = 0;
+	int vendor_output_idx, total_workload = 0;
+
+	num_of_kernels = fw_list->num_of_fws;
+	kernel_list = vmalloc(sizeof(*kernel) * num_of_kernels + sizeof(*kernel_list));
+	if (kernel_list == NULL)
+		return -ENOMEM;
+
+	memset(kernel_list, 0, sizeof(*kernel) * num_of_kernels + sizeof(*kernel_list));
+	kernel_list->num_of_kernels = num_of_kernels;
+	kernel = &kernel_list->kernels[0];
+
+	fw_data = (char *)&fw_list->fw_info[0];
+	for (kernel_idx = 0; kernel_idx < num_of_kernels; kernel_idx++) {
+		fw_info = (bin_fw_info_t *)fw_data;
+		fw_name = &fw_info->fw_name[0];
+		vendor_output_idx = fw_info->vendor_output;
+		ret = ipts_request_firmware(&fw, fw_name, &ipts->cldev->dev);
+		if (ret) {
+			ipts_err(ipts, "cannot read fw %s\n", fw_name);
+			goto error_exit;
+		}
+
+		parse_info.data = (u8*)fw->data;
+		parse_info.size = fw->size;
+		parse_info.parsed = 0;
+		parse_info.fw_info = fw_info;
+		parse_info.vendor_kernel = (kernel_idx == 0) ? NULL : &kernel[0];
+		parse_info.interested_vendor_output = vendor_output_idx;
+
+		ret = load_kernel(ipts, &parse_info, &kernel[kernel_idx]);
+		if (ret) {
+			ipts_err(ipts, "do_setup_kernel error : %d\n", ret);
+			release_firmware(fw);
+			goto error_exit;
+		}
+
+		release_firmware(fw);
+
+		total_workload += kernel[kernel_idx].guc_wq_item->size;
+
+		/* advance to the next kernel */
+		fw_data += sizeof(bin_fw_info_t);
+		fw_data += sizeof(bin_data_file_info_t) * fw_info->num_of_data_files;
+	}
+
+	ipts_set_wq_item_size(ipts, total_workload);
+
+	ret = bin_setup_guc_workqueue(ipts, kernel_list);
+	if (ret) {
+		ipts_dbg(ipts, "error setup_guc_workqueue\n");
+		goto error_exit;
+	}
+
+	ret = bin_setup_bufid_buffer(ipts, kernel_list);
+	if (ret) {
+		ipts_dbg(ipts, "error setup_lastbubmit_buffer\n");
+		goto error_exit;
+	}
+
+	bin_setup_input_output(ipts, kernel_list);
+
+	/* workload is not needed during run-time so free them */
+	for (kernel_idx = 0; kernel_idx < num_of_kernels; kernel_idx++) {
+		wl = kernel[kernel_idx].wl;
+		vfree(wl);
+	}
+
+	ipts->kernel_handle = (u64)kernel_list;
+
+	return 0;
+
+error_exit:
+
+	for (kernel_idx = 0; kernel_idx < num_of_kernels; kernel_idx++) {
+		wl = kernel[kernel_idx].wl;
+		vfree(wl);
+		unload_kernel(ipts, &kernel[kernel_idx]);
+	}
+
+	vfree(kernel_list);
+
+	return ret;
+}
+
+
+static void release_kernel(ipts_info_t *ipts)
+{
+	bin_kernel_list_t *kernel_list;
+	bin_kernel_info_t *kernel;
+	int k_idx, k_num;
+
+	kernel_list = (bin_kernel_list_t *)ipts->kernel_handle;
+	k_num = kernel_list->num_of_kernels;
+	kernel = &kernel_list->kernels[0];
+
+	for (k_idx = 0; k_idx < k_num; k_idx++) {
+		unload_kernel(ipts, kernel);
+		kernel++;
+	}
+
+	ipts_unmap_buffer(ipts, kernel_list->bufid_buf);
+
+	vfree(kernel_list);
+	ipts->kernel_handle = 0;
+}
+
+int ipts_init_kernels(ipts_info_t *ipts)
+{
+	const struct firmware *config_fw = NULL;
+	const char *config_fw_path = IPTS_FW_CONFIG_FILE;
+	bin_fw_list_t *fw_list;
+	int ret;
+
+	ret = ipts_open_gpu(ipts);
+	if (ret) {
+		ipts_err(ipts, "open gpu error : %d\n", ret);
+		return ret;
+	}
+
+	ret = ipts_request_firmware(&config_fw, config_fw_path,	&ipts->cldev->dev);
+	if (ret) {
+		ipts_err(ipts, "request firmware error : %d\n", ret);
+		goto close_gpu;
+	}
+
+	fw_list = (bin_fw_list_t *)config_fw->data;
+	ret = setup_kernel(ipts, fw_list);
+	if (ret) {
+		ipts_err(ipts, "setup kernel error : %d\n", ret);
+		goto close_firmware;
+	}
+
+	release_firmware(config_fw);
+
+	return ret;
+
+close_firmware:
+	release_firmware(config_fw);
+
+close_gpu:
+	ipts_close_gpu(ipts);
+
+	return ret;
+}
+
+void ipts_release_kernels(ipts_info_t *ipts)
+{
+	release_kernel(ipts);
+	ipts_close_gpu(ipts);
+}
diff --git a/drivers/misc/ipts/ipts-kernel.h b/drivers/misc/ipts/ipts-kernel.h
new file mode 100644
index 000000000000..0e7f1393b807
--- /dev/null
+++ b/drivers/misc/ipts/ipts-kernel.h
@@ -0,0 +1,23 @@
+/*
+ *
+ * Intel Precise Touch & Stylus Linux driver
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ */
+
+#ifndef _ITPS_GFX_H
+#define _ITPS_GFX_H
+
+int ipts_init_kernels(ipts_info_t *ipts);
+void ipts_release_kernels(ipts_info_t *ipts);
+
+#endif
diff --git a/drivers/misc/ipts/ipts-mei-msgs.h b/drivers/misc/ipts/ipts-mei-msgs.h
new file mode 100644
index 000000000000..8ca146800a47
--- /dev/null
+++ b/drivers/misc/ipts/ipts-mei-msgs.h
@@ -0,0 +1,585 @@
+/*
+ * Precise Touch HECI Message
+ *
+ * Copyright (c) 2013-2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#ifndef _IPTS_MEI_MSGS_H_
+#define _IPTS_MEI_MSGS_H_
+
+#include "ipts-sensor-regs.h"
+
+#pragma pack(1)
+
+
+// Initial protocol version
+#define TOUCH_HECI_CLIENT_PROTOCOL_VERSION      10
+
+// GUID that identifies the Touch HECI client.
+#define TOUCH_HECI_CLIENT_GUID  \
+            {0x3e8d0870, 0x271a, 0x4208, {0x8e, 0xb5, 0x9a, 0xcb, 0x94, 0x02, 0xae, 0x04}}
+
+
+// define C_ASSERT macro to check structure size and fail compile for unexpected mismatch
+#ifndef C_ASSERT
+#define C_ASSERT(e) typedef char __C_ASSERT__[(e)?1:-1]
+#endif
+
+
+// General Type Defines for compatibility with HID driver and BIOS
+#ifndef BIT0
+#define BIT0 1
+#endif
+#ifndef BIT1
+#define BIT1 2
+#endif
+#ifndef BIT2
+#define BIT2 4
+#endif
+
+
+#define TOUCH_SENSOR_GET_DEVICE_INFO_CMD        0x00000001
+#define TOUCH_SENSOR_GET_DEVICE_INFO_RSP        0x80000001
+
+
+#define TOUCH_SENSOR_SET_MODE_CMD               0x00000002
+#define TOUCH_SENSOR_SET_MODE_RSP               0x80000002
+
+
+#define TOUCH_SENSOR_SET_MEM_WINDOW_CMD         0x00000003
+#define TOUCH_SENSOR_SET_MEM_WINDOW_RSP         0x80000003
+
+
+#define TOUCH_SENSOR_QUIESCE_IO_CMD             0x00000004
+#define TOUCH_SENSOR_QUIESCE_IO_RSP             0x80000004
+
+
+#define TOUCH_SENSOR_HID_READY_FOR_DATA_CMD     0x00000005
+#define TOUCH_SENSOR_HID_READY_FOR_DATA_RSP     0x80000005
+
+
+#define TOUCH_SENSOR_FEEDBACK_READY_CMD         0x00000006
+#define TOUCH_SENSOR_FEEDBACK_READY_RSP         0x80000006
+
+
+#define TOUCH_SENSOR_CLEAR_MEM_WINDOW_CMD       0x00000007
+#define TOUCH_SENSOR_CLEAR_MEM_WINDOW_RSP       0x80000007
+
+
+#define TOUCH_SENSOR_NOTIFY_DEV_READY_CMD       0x00000008
+#define TOUCH_SENSOR_NOTIFY_DEV_READY_RSP       0x80000008
+
+
+#define TOUCH_SENSOR_SET_POLICIES_CMD           0x00000009
+#define TOUCH_SENSOR_SET_POLICIES_RSP           0x80000009
+
+
+#define TOUCH_SENSOR_GET_POLICIES_CMD           0x0000000A
+#define TOUCH_SENSOR_GET_POLICIES_RSP           0x8000000A
+
+
+#define TOUCH_SENSOR_RESET_CMD                  0x0000000B
+#define TOUCH_SENSOR_RESET_RSP                  0x8000000B
+
+
+#define TOUCH_SENSOR_READ_ALL_REGS_CMD          0x0000000C
+#define TOUCH_SENSOR_READ_ALL_REGS_RSP          0x8000000C
+
+
+#define TOUCH_SENSOR_CMD_ERROR_RSP              0x8FFFFFFF  // M2H: ME sends this message to indicate previous command was unrecognized/unsupported
+
+
+
+//*******************************************************************
+//
+// Touch Sensor Status Codes
+//
+//*******************************************************************
+typedef enum touch_status
+{
+    TOUCH_STATUS_SUCCESS = 0,               //  0 Requested operation was successful
+    TOUCH_STATUS_INVALID_PARAMS,            //  1 Invalid parameter(s) sent
+    TOUCH_STATUS_ACCESS_DENIED,             //  2 Unable to validate address range
+    TOUCH_STATUS_CMD_SIZE_ERROR,            //  3 HECI message incorrect size for specified command
+    TOUCH_STATUS_NOT_READY,                 //  4 Memory window not set or device is not armed for operation
+    TOUCH_STATUS_REQUEST_OUTSTANDING,       //  5 There is already an outstanding message of the same type, must wait for response before sending another request of that type
+    TOUCH_STATUS_NO_SENSOR_FOUND,           //  6 Sensor could not be found. Either no sensor is connected, the sensor has not yet initialized, or the system is improperly configured.
+    TOUCH_STATUS_OUT_OF_MEMORY,             //  7 Not enough memory/storage for requested operation
+    TOUCH_STATUS_INTERNAL_ERROR,            //  8 Unexpected error occurred
+    TOUCH_STATUS_SENSOR_DISABLED,           //  9 Used in TOUCH_SENSOR_HID_READY_FOR_DATA_RSP to indicate sensor has been disabled or reset and must be reinitialized.
+    TOUCH_STATUS_COMPAT_CHECK_FAIL,         // 10 Used to indicate compatibility revision check between sensor and ME failed, or protocol ver between ME/HID/Kernels failed.
+    TOUCH_STATUS_SENSOR_EXPECTED_RESET,     // 11 Indicates sensor went through a reset initiated by ME
+    TOUCH_STATUS_SENSOR_UNEXPECTED_RESET,   // 12 Indicates sensor went through an unexpected reset
+    TOUCH_STATUS_RESET_FAILED,              // 13 Requested sensor reset failed to complete
+    TOUCH_STATUS_TIMEOUT,                   // 14 Operation timed out
+    TOUCH_STATUS_TEST_MODE_FAIL,            // 15 Test mode pattern did not match expected values
+    TOUCH_STATUS_SENSOR_FAIL_FATAL,         // 16 Indicates sensor reported fatal error during reset sequence. Further progress is not possible.
+    TOUCH_STATUS_SENSOR_FAIL_NONFATAL,      // 17 Indicates sensor reported non-fatal error during reset sequence. HID/BIOS logs error and attempts to continue.
+    TOUCH_STATUS_INVALID_DEVICE_CAPS,       // 18 Indicates sensor reported invalid capabilities, such as not supporting required minimum frequency or I/O mode.
+    TOUCH_STATUS_QUIESCE_IO_IN_PROGRESS,    // 19 Indicates that command cannot be complete until ongoing Quiesce I/O flow has completed.
+    TOUCH_STATUS_MAX                        // 20 Invalid value, never returned
+} touch_status_t;
+C_ASSERT(sizeof(touch_status_t) == 4);
+
+
+
+//*******************************************************************
+//
+// Defines for message structures used for Host to ME communication
+//
+//*******************************************************************
+
+
+typedef enum touch_sensor_mode
+{
+    TOUCH_SENSOR_MODE_HID = 0,          // Set mode to HID mode
+    TOUCH_SENSOR_MODE_RAW_DATA,         // Set mode to Raw Data mode
+    TOUCH_SENSOR_MODE_SENSOR_DEBUG = 4, // Used like TOUCH_SENSOR_MODE_HID but data coming from sensor is not necessarily a HID packet.
+    TOUCH_SENSOR_MODE_MAX               // Invalid value
+} touch_sensor_mode_t;
+C_ASSERT(sizeof(touch_sensor_mode_t) == 4);
+
+typedef struct touch_sensor_set_mode_cmd_data
+{
+    touch_sensor_mode_t	sensor_mode;     // Indicate desired sensor mode
+    u32					Reserved[3];    // For future expansion
+} touch_sensor_set_mode_cmd_data_t;
+C_ASSERT(sizeof(touch_sensor_set_mode_cmd_data_t) == 16);
+
+
+#define TOUCH_SENSOR_MAX_DATA_BUFFERS   16
+#define TOUCH_HID_2_ME_BUFFER_ID        TOUCH_SENSOR_MAX_DATA_BUFFERS
+#define TOUCH_HID_2_ME_BUFFER_SIZE_MAX  1024
+#define TOUCH_INVALID_BUFFER_ID         0xFF
+
+typedef struct touch_sensor_set_mem_window_cmd_data
+{
+    u32  touch_data_buffer_addr_lower[TOUCH_SENSOR_MAX_DATA_BUFFERS];    // Lower 32 bits of Touch Data Buffer physical address. Size of each buffer should be TOUCH_SENSOR_GET_DEVICE_INFO_RSP_DATA.FrameSize
+    u32  touch_data_buffer_addr_upper[TOUCH_SENSOR_MAX_DATA_BUFFERS];    // Upper 32 bits of Touch Data Buffer physical address. Size of each buffer should be TOUCH_SENSOR_GET_DEVICE_INFO_RSP_DATA.FrameSize
+    u32  tail_offset_addr_lower;                                        // Lower 32 bits of Tail Offset physical address
+    u32  tail_offset_addr_upper;                                        // Upper 32 bits of Tail Offset physical address, always 32 bit, increment by WorkQueueItemSize
+    u32  doorbell_cookie_addr_lower;                                    // Lower 32 bits of Doorbell register physical address
+    u32  doorbell_cookie_addr_upper;                                    // Upper 32 bits of Doorbell register physical address, always 32 bit, increment as integer, rollover to 1
+    u32  feedback_buffer_addr_lower[TOUCH_SENSOR_MAX_DATA_BUFFERS];     // Lower 32 bits of Feedback Buffer physical address. Size of each buffer should be TOUCH_SENSOR_GET_DEVICE_INFO_RSP_DATA.FeedbackSize
+    u32  feedback_buffer_addr_upper[TOUCH_SENSOR_MAX_DATA_BUFFERS];     // Upper 32 bits of Feedback Buffer physical address. Size of each buffer should be TOUCH_SENSOR_GET_DEVICE_INFO_RSP_DATA.FeedbackSize
+    u32  hid2me_buffer_addr_lower;                                      // Lower 32 bits of dedicated HID to ME communication buffer. Size is Hid2MeBufferSize.
+    u32  hid2me_buffer_addr_upper;                                      // Upper 32 bits of dedicated HID to ME communication buffer. Size is Hid2MeBufferSize.
+    u32  hid2me_buffer_size;                                           // Size in bytes of Hid2MeBuffer, can be no bigger than TOUCH_HID_2_ME_BUFFER_SIZE_MAX
+    u8   reserved1;                                                  // For future expansion
+    u8   work_queue_item_size;                                          // Size in bytes of the GuC Work Queue Item pointed to by TailOffset
+    u16  work_queue_size;                                              // Size in bytes of the entire GuC Work Queue
+    u32  reserved[8];                                                // For future expansion
+} touch_sensor_set_mem_window_cmd_data_t;
+C_ASSERT(sizeof(touch_sensor_set_mem_window_cmd_data_t) == 320);
+
+
+#define TOUCH_SENSOR_QUIESCE_FLAG_GUC_RESET BIT0   // indicates GuC got reset and ME must re-read GuC data such as TailOffset and Doorbell Cookie values
+
+typedef struct touch_sensor_quiesce_io_cmd_data
+{
+    u32  quiesce_flags;   // Optionally set TOUCH_SENSOR_QUIESCE_FLAG_GUC_RESET
+    u32  reserved[2];
+} touch_sensor_quiesce_io_cmd_data_t;
+C_ASSERT(sizeof(touch_sensor_quiesce_io_cmd_data_t) == 12);
+
+
+typedef struct touch_sensor_feedback_ready_cmd_data
+{
+    u8   feedback_index;  // Index value from 0 to TOUCH_HID_2_ME_BUFFER_ID used to indicate which Feedback Buffer to use. Using special value TOUCH_HID_2_ME_BUFFER_ID
+                            // is an indication to ME to get feedback data from the Hid2Me buffer instead of one of the standard Feedback buffers.
+    u8   reserved1[3];   // For future expansion
+    u32  transaction_id;  // Transaction ID that was originally passed to host in TOUCH_HID_PRIVATE_DATA. Used to track round trip of a given transaction for performance measurements.
+    u32  reserved2[2];   // For future expansion
+} touch_sensor_feedback_ready_cmd_data_t;
+C_ASSERT(sizeof(touch_sensor_feedback_ready_cmd_data_t) == 16);
+
+
+#define TOUCH_DEFAULT_DOZE_TIMER_SECONDS    30
+
+typedef enum touch_freq_override
+{
+    TOUCH_FREQ_OVERRIDE_NONE,   // Do not apply any override
+    TOUCH_FREQ_OVERRIDE_10MHZ,  // Force frequency to 10MHz (not currently supported)
+    TOUCH_FREQ_OVERRIDE_17MHZ,  // Force frequency to 17MHz
+    TOUCH_FREQ_OVERRIDE_30MHZ,  // Force frequency to 30MHz
+    TOUCH_FREQ_OVERRIDE_50MHZ,  // Force frequency to 50MHz (not currently supported)
+    TOUCH_FREQ_OVERRIDE_MAX     // Invalid value
+} touch_freq_override_t;
+C_ASSERT(sizeof(touch_freq_override_t) == 4);
+
+typedef enum touch_spi_io_mode_override
+{
+    TOUCH_SPI_IO_MODE_OVERRIDE_NONE,    // Do not apply any override
+    TOUCH_SPI_IO_MODE_OVERRIDE_SINGLE,  // Force Single I/O
+    TOUCH_SPI_IO_MODE_OVERRIDE_DUAL,    // Force Dual I/O
+    TOUCH_SPI_IO_MODE_OVERRIDE_QUAD,    // Force Quad I/O
+    TOUCH_SPI_IO_MODE_OVERRIDE_MAX      // Invalid value
+} touch_spi_io_mode_override_t;
+C_ASSERT(sizeof(touch_spi_io_mode_override_t) == 4);
+
+// Debug Policy bits used by TOUCH_POLICY_DATA.DebugOverride
+#define TOUCH_DBG_POLICY_OVERRIDE_STARTUP_TIMER_DIS BIT0    // Disable sensor startup timer
+#define TOUCH_DBG_POLICY_OVERRIDE_SYNC_BYTE_DIS     BIT1    // Disable Sync Byte check
+#define TOUCH_DBG_POLICY_OVERRIDE_ERR_RESET_DIS     BIT2    // Disable error resets
+
+typedef struct touch_policy_data
+{
+    u32                      reserved0;          // For future expansion.
+    u32                      doze_timer     :16;  // Value in seconds, after which ME will put the sensor into Doze power state if no activity occurs. Set
+                                                    // to 0 to disable Doze mode (not recommended). Value will be set to TOUCH_DEFAULT_DOZE_TIMER_SECONDS by
+                                                    // default.
+    touch_freq_override_t         freq_override  :3;   // Override frequency requested by sensor
+    touch_spi_io_mode_override_t  spi_io_override :3;   // Override IO mode requested by sensor
+    u32                      reserved1     :10;  // For future expansion
+    u32                      reserved2;          // For future expansion
+    u32                      debug_override;      // Normally all bits will be zero. Bits will be defined as needed for enabling special debug features
+} touch_policy_data_t;
+C_ASSERT(sizeof(touch_policy_data_t) == 16);
+
+typedef struct touch_sensor_set_policies_cmd_data
+{
+    touch_policy_data_t           policy_data;         // Contains the desired policy to be set
+} touch_sensor_set_policies_cmd_data_t;
+C_ASSERT(sizeof(touch_sensor_set_policies_cmd_data_t) == 16);
+
+
+typedef enum touch_sensor_reset_type
+{
+    TOUCH_SENSOR_RESET_TYPE_HARD,   // Hardware Reset using dedicated GPIO pin
+    TOUCH_SENSOR_RESET_TYPE_SOFT,   // Software Reset using command written over SPI interface
+    TOUCH_SENSOR_RESET_TYPE_MAX     // Invalid value
+} touch_sensor_reset_type_t;
+C_ASSERT(sizeof(touch_sensor_reset_type_t) == 4);
+
+typedef struct touch_sensor_reset_cmd_data
+{
+    touch_sensor_reset_type_t reset_type;  // Indicate desired reset type
+    u32                  reserved;   // For future expansion
+} touch_sensor_reset_cmd_data_t;
+C_ASSERT(sizeof(touch_sensor_reset_cmd_data_t) == 8);
+
+
+//
+// Host to ME message
+//
+typedef struct touch_sensor_msg_h2m
+{
+    u32  command_code;
+    union
+    {
+        touch_sensor_set_mode_cmd_data_t        set_mode_cmd_data;
+        touch_sensor_set_mem_window_cmd_data_t  set_window_cmd_data;
+        touch_sensor_quiesce_io_cmd_data_t      quiesce_io_cmd_data;
+        touch_sensor_feedback_ready_cmd_data_t  feedback_ready_cmd_data;
+        touch_sensor_set_policies_cmd_data_t    set_policies_cmd_data;
+        touch_sensor_reset_cmd_data_t           reset_cmd_data;
+    } h2m_data;
+} touch_sensor_msg_h2m_t;
+C_ASSERT(sizeof(touch_sensor_msg_h2m_t) == 324);
+
+
+//*******************************************************************
+//
+// Defines for message structures used for ME to Host communication
+//
+//*******************************************************************
+
+// I/O mode values used by TOUCH_SENSOR_GET_DEVICE_INFO_RSP_DATA.
+typedef enum touch_spi_io_mode
+{
+    TOUCH_SPI_IO_MODE_SINGLE = 0,   // Sensor set for Single I/O SPI
+    TOUCH_SPI_IO_MODE_DUAL,         // Sensor set for Dual I/O SPI
+    TOUCH_SPI_IO_MODE_QUAD,         // Sensor set for Quad I/O SPI
+    TOUCH_SPI_IO_MODE_MAX           // Invalid value
+} touch_spi_io_mode_t;
+C_ASSERT(sizeof(touch_spi_io_mode_t) == 4);
+
+//
+// TOUCH_SENSOR_GET_DEVICE_INFO_RSP code is sent in response to TOUCH_SENSOR_GET_DEVICE_INFO_CMD. This code will be followed
+// by TOUCH_SENSOR_GET_DEVICE_INFO_RSP_DATA.
+//
+// Possible Status values:
+//      TOUCH_STATUS_SUCCESS:               Command was processed successfully and sensor details are reported.
+//      TOUCH_STATUS_CMD_SIZE_ERROR:        Command sent did not match expected size. Other fields will not contain valid data.
+//      TOUCH_STATUS_NO_SENSOR_FOUND:       Sensor has not yet been detected. Other fields will not contain valid data.
+//      TOUCH_STATUS_INVALID_DEVICE_CAPS:   Indicates sensor does not support minimum required Frequency or I/O Mode. ME firmware will choose best possible option for the errant
+//                                          field. Caller should attempt to continue.
+//      TOUCH_STATUS_COMPAT_CHECK_FAIL:     Indicates TouchIC/ME compatibility mismatch. Caller should attempt to continue.
+//
+typedef struct touch_sensor_get_device_info_rsp_data
+{
+    u16				vendor_id;               // Touch Sensor vendor ID
+    u16              device_id;               // Touch Sensor device ID
+    u32              hw_rev;                  // Touch Sensor Hardware Revision
+    u32              fw_rev;                  // Touch Sensor Firmware Revision
+    u32              frame_size;              // Max size of one frame returned by Touch IC in bytes. This data will be TOUCH_RAW_DATA_HDR followed
+                                                // by a payload. The payload can be raw data or a HID structure depending on mode.
+    u32              feedback_size;           // Max size of one Feedback structure in bytes
+    touch_sensor_mode_t	sensor_mode;             // Current operating mode of the sensor
+    u32              max_touch_points  :8;     // Maximum number of simultaneous touch points that can be reported by sensor
+    touch_freq_t          spi_frequency    :8;     // SPI bus Frequency supported by sensor and ME firmware
+    touch_spi_io_mode_t   spi_io_mode       :8;     // SPI bus I/O Mode supported by sensor and ME firmware
+    u32              reserved0       :8;     // For future expansion
+    u8               sensor_minor_eds_rev;      // Minor version number of EDS spec supported by sensor (from Compat Rev ID Reg)
+    u8               sensor_major_eds_rev;      // Major version number of EDS spec supported by sensor (from Compat Rev ID Reg)
+    u8               me_minor_eds_rev;          // Minor version number of EDS spec supported by ME
+    u8               me_major_eds_rev;          // Major version number of EDS spec supported by ME
+    u8               sensor_eds_intf_rev;       // EDS Interface Revision Number supported by sensor (from Compat Rev ID Reg)
+    u8               me_eds_intf_rev;           // EDS Interface Revision Number supported by ME
+    u8               kernel_compat_ver;        // EU Kernel Compatibility Version  (from Compat Rev ID Reg)
+    u8               reserved1;              // For future expansion
+    u32              reserved2[2];           // For future expansion
+} touch_sensor_get_device_info_rsp_data_t;
+C_ASSERT(sizeof(touch_sensor_get_device_info_rsp_data_t) == 44);
+
+
+//
+// TOUCH_SENSOR_SET_MODE_RSP code is sent in response to TOUCH_SENSOR_SET_MODE_CMD. This code will be followed
+// by TOUCH_SENSOR_SET_MODE_RSP_DATA.
+//
+// Possible Status values:
+//      TOUCH_STATUS_SUCCESS:           Command was processed successfully and mode was set.
+//      TOUCH_STATUS_CMD_SIZE_ERROR:    Command sent did not match expected size. Other fields will not contain valid data.
+//      TOUCH_STATUS_INVALID_PARAMS:    Input parameters are out of range.
+//
+typedef struct touch_sensor_set_mode_rsp_data
+{
+    u32          reserved[3];    // For future expansion
+} touch_sensor_set_mode_rsp_data_t;
+C_ASSERT(sizeof(touch_sensor_set_mode_rsp_data_t) == 12);
+
+
+//
+// TOUCH_SENSOR_SET_MEM_WINDOW_RSP code is sent in response to TOUCH_SENSOR_SET_MEM_WINDOW_CMD. This code will be followed
+// by TOUCH_SENSOR_SET_MEM_WINDOW_RSP_DATA.
+//
+// Possible Status values:
+//      TOUCH_STATUS_SUCCESS:           Command was processed successfully and memory window was set.
+//      TOUCH_STATUS_CMD_SIZE_ERROR:    Command sent did not match expected size. Other fields will not contain valid data.
+//      TOUCH_STATUS_INVALID_PARAMS:    Input parameters are out of range.
+//      TOUCH_STATUS_ACCESS_DENIED:     Unable to map host address ranges for DMA.
+//      TOUCH_STATUS_OUT_OF_MEMORY:     Unable to allocate enough space for needed buffers.
+//
+typedef struct touch_sensor_set_mem_window_rsp_data
+{
+    u32          reserved[3];    // For future expansion
+} touch_sensor_set_mem_window_rsp_data_t;
+C_ASSERT(sizeof(touch_sensor_set_mem_window_rsp_data_t) == 12);
+
+
+//
+// TOUCH_SENSOR_QUIESCE_IO_RSP code is sent in response to TOUCH_SENSOR_QUIESCE_IO_CMD. This code will be followed
+// by TOUCH_SENSOR_QUIESCE_IO_RSP_DATA.
+//
+// Possible Status values:
+//      TOUCH_STATUS_SUCCESS:                   Command was processed successfully and touch flow has stopped.
+//      TOUCH_STATUS_CMD_SIZE_ERROR:            Command sent did not match expected size. Other fields will not contain valid data.
+//      TOUCH_STATUS_QUIESCE_IO_IN_PROGRESS:    Indicates that Quiesce I/O is already in progress and this command cannot be accepted at this time.
+//      TOUCH_STATIS_TIMEOUT:                   Indicates ME timed out waiting for Quiesce I/O flow to complete.
+//
+typedef struct touch_sensor_quiesce_io_rsp_data
+{
+    u32          reserved[3];    // For future expansion
+} touch_sensor_quiesce_io_rsp_data_t;
+C_ASSERT(sizeof(touch_sensor_quiesce_io_rsp_data_t) == 12);
+
+
+// Reset Reason values used in TOUCH_SENSOR_HID_READY_FOR_DATA_RSP_DATA
+typedef enum touch_reset_reason
+{
+    TOUCH_RESET_REASON_UNKNOWN = 0,         // Reason for sensor reset is not known
+    TOUCH_RESET_REASON_FEEDBACK_REQUEST,    // Reset was requested as part of TOUCH_SENSOR_FEEDBACK_READY_CMD
+    TOUCH_RESET_REASON_HECI_REQUEST,        // Reset was requested via TOUCH_SENSOR_RESET_CMD
+    TOUCH_RESET_REASON_MAX
+} touch_reset_reason_t;
+C_ASSERT(sizeof(touch_reset_reason_t) == 4);
+
+//
+// TOUCH_SENSOR_HID_READY_FOR_DATA_RSP code is sent in response to TOUCH_SENSOR_HID_READY_FOR_DATA_CMD. This code will be followed
+// by TOUCH_SENSOR_HID_READY_FOR_DATA_RSP_DATA.
+//
+// Possible Status values:
+//      TOUCH_STATUS_SUCCESS:                   Command was processed successfully and HID data was sent by DMA. This will only be sent in HID mode.
+//      TOUCH_STATUS_CMD_SIZE_ERROR:            Command sent did not match expected size. Other fields will not contain valid data.
+//      TOUCH_STATUS_REQUEST_OUTSTANDING:       Previous request is still outstanding, ME FW cannot handle another request for the same command.
+//      TOUCH_STATUS_NOT_READY:                 Indicates memory window has not yet been set by BIOS/HID.
+//      TOUCH_STATUS_SENSOR_DISABLED:           Indicates that ME to HID communication has been stopped either by TOUCH_SENSOR_QUIESCE_IO_CMD or TOUCH_SENSOR_CLEAR_MEM_WINDOW_CMD.
+//      TOUCH_STATUS_SENSOR_UNEXPECTED_RESET:   Sensor signaled a Reset Interrupt. ME did not expect this and has no info about why this occurred.
+//      TOUCH_STATUS_SENSOR_EXPECTED_RESET:     Sensor signaled a Reset Interrupt. ME either directly requested this reset, or it was expected as part of a defined flow in the EDS.
+//      TOUCH_STATUS_QUIESCE_IO_IN_PROGRESS:    Indicates that Quiesce I/O is already in progress and this command cannot be accepted at this time.
+//      TOUCH_STATUS_TIMEOUT:                   Sensor did not generate a reset interrupt in the time allotted. Could indicate sensor is not connected or malfunctioning.
+//
+typedef struct touch_sensor_hid_ready_for_data_rsp_data
+{
+    u32          data_size;               // Size of the data the ME DMA'd into a RawDataBuffer. Valid only when Status == TOUCH_STATUS_SUCCESS
+    u8           touch_data_buffer_index;   // Index to indicate which RawDataBuffer was used. Valid only when Status == TOUCH_STATUS_SUCCESS
+    u8           reset_reason;            // If Status is TOUCH_STATUS_SENSOR_EXPECTED_RESET, ME will provide the cause. See TOUCH_RESET_REASON.
+    u8           reserved1[2];           // For future expansion
+    u32          reserved2[5];           // For future expansion
+} touch_sensor_hid_ready_for_data_rsp_data_t;
+C_ASSERT(sizeof(touch_sensor_hid_ready_for_data_rsp_data_t) == 28);
+
+
+//
+// TOUCH_SENSOR_FEEDBACK_READY_RSP code is sent in response to TOUCH_SENSOR_FEEDBACK_READY_CMD. This code will be followed
+// by TOUCH_SENSOR_FEEDBACK_READY_RSP_DATA.
+//
+// Possible Status values:
+//      TOUCH_STATUS_SUCCESS:           Command was processed successfully and any feedback or commands were sent to sensor.
+//      TOUCH_STATUS_CMD_SIZE_ERROR:    Command sent did not match expected size. Other fields will not contain valid data.
+//      TOUCH_STATUS_INVALID_PARAMS:    Input parameters are out of range.
+//      TOUCH_STATUS_COMPAT_CHECK_FAIL  Indicates ProtocolVer does not match ME supported version. (non-fatal error)
+//      TOUCH_STATUS_INTERNAL_ERROR:    Unexpected error occurred. This should not normally be seen.
+//      TOUCH_STATUS_OUT_OF_MEMORY:     Insufficient space to store Calibration Data
+//
+typedef struct touch_sensor_feedback_ready_rsp_data
+{
+    u8           feedback_index;  // Index value from 0 to TOUCH_SENSOR_MAX_DATA_BUFFERS used to indicate which Feedback Buffer to use
+    u8           reserved1[3];   // For future expansion
+    u32          reserved2[6];   // For future expansion
+} touch_sensor_feedback_ready_rsp_data_t;
+C_ASSERT(sizeof(touch_sensor_feedback_ready_rsp_data_t) == 28);
+
+
+//
+// TOUCH_SENSOR_CLEAR_MEM_WINDOW_RSP code is sent in response to TOUCH_SENSOR_CLEAR_MEM_WINDOW_CMD. This code will be followed
+// by TOUCH_SENSOR_CLEAR_MEM_WINDOW_RSP_DATA.
+//
+// Possible Status values:
+//      TOUCH_STATUS_SUCCESS:                   Command was processed successfully and memory window was set.
+//      TOUCH_STATUS_CMD_SIZE_ERROR:            Command sent did not match expected size. Other fields will not contain valid data.
+//      TOUCH_STATUS_INVALID_PARAMS:            Input parameters are out of range.
+//      TOUCH_STATUS_QUIESCE_IO_IN_PROGRESS:    Indicates that Quiesce I/O is already in progress and this command cannot be accepted at this time.
+//
+typedef struct touch_sensor_clear_mem_window_rsp_data
+{
+    u32          reserved[3];    // For future expansion
+} touch_sensor_clear_mem_window_rsp_data_t;
+C_ASSERT(sizeof(touch_sensor_clear_mem_window_rsp_data_t) == 12);
+
+
+//
+// TOUCH_SENSOR_NOTIFY_DEV_READY_RSP code is sent in response to TOUCH_SENSOR_NOTIFY_DEV_READY_CMD. This code will be followed
+// by TOUCH_SENSOR_NOTIFY_DEV_READY_RSP_DATA.
+//
+// Possible Status values:
+//      TOUCH_STATUS_SUCCESS:               Command was processed successfully and sensor has been detected by ME FW.
+//      TOUCH_STATUS_CMD_SIZE_ERROR:        Command sent did not match expected size.
+//      TOUCH_STATUS_REQUEST_OUTSTANDING:   Previous request is still outstanding, ME FW cannot handle another request for the same command.
+//      TOUCH_STATUS_TIMEOUT:               Sensor did not generate a reset interrupt in the time allotted. Could indicate sensor is not connected or malfunctioning.
+//      TOUCH_STATUS_SENSOR_FAIL_FATAL:     Sensor indicated a fatal error, further operation is not possible. Error details can be found in ErrReg.
+//      TOUCH_STATUS_SENSOR_FAIL_NONFATAL:  Sensor indicated a non-fatal error. Error should be logged by caller and init flow can continue. Error details can be found in ErrReg.
+//
+typedef struct touch_sensor_notify_dev_ready_rsp_data
+{
+    touch_err_reg_t   err_reg;         // Value of sensor Error Register, field is only valid for Status == TOUCH_STATUS_SENSOR_FAIL_FATAL or TOUCH_STATUS_SENSOR_FAIL_NONFATAL
+    u32          reserved[2];    // For future expansion
+} touch_sensor_notify_dev_ready_rsp_data_t;
+C_ASSERT(sizeof(touch_sensor_notify_dev_ready_rsp_data_t) == 12);
+
+
+//
+// TOUCH_SENSOR_SET_POLICIES_RSP code is sent in response to TOUCH_SENSOR_SET_POLICIES_CMD. This code will be followed
+// by TOUCH_SENSOR_SET_POLICIES_RSP_DATA.
+//
+// Possible Status values:
+//      TOUCH_STATUS_SUCCESS:           Command was processed successfully and new policies were set.
+//      TOUCH_STATUS_CMD_SIZE_ERROR:    Command sent did not match expected size. Other fields will not contain valid data.
+//      TOUCH_STATUS_INVALID_PARAMS:    Input parameters are out of range.
+//
+typedef struct touch_sensor_set_policies_rsp_data
+{
+    u32          reserved[3];    // For future expansion
+} touch_sensor_set_policies_rsp_data_t;
+C_ASSERT(sizeof(touch_sensor_set_policies_rsp_data_t) == 12);
+
+
+//
+// TOUCH_SENSOR_GET_POLICIES_RSP code is sent in response to TOUCH_SENSOR_GET_POLICIES_CMD. This code will be followed
+// by TOUCH_SENSOR_GET_POLICIES_RSP_DATA.
+//
+// Possible Status values:
+//      TOUCH_STATUS_SUCCESS:           Command was processed successfully and new policies were set.
+//      TOUCH_STATUS_CMD_SIZE_ERROR:    Command sent did not match expected size. Other fields will not contain valid data.
+//
+typedef struct touch_sensor_get_policies_rsp_data
+{
+    touch_policy_data_t   policy_data;         // Contains the current policy
+} touch_sensor_get_policies_rsp_data_t;
+C_ASSERT(sizeof(touch_sensor_get_policies_rsp_data_t) == 16);
+
+
+//
+// TOUCH_SENSOR_RESET_RSP code is sent in response to TOUCH_SENSOR_RESET_CMD. This code will be followed
+// by TOUCH_SENSOR_RESET_RSP_DATA.
+//
+// Possible Status values:
+//      TOUCH_STATUS_SUCCESS:                   Command was processed successfully and sensor reset was completed.
+//      TOUCH_STATUS_CMD_SIZE_ERROR:            Command sent did not match expected size. Other fields will not contain valid data.
+//      TOUCH_STATUS_INVALID_PARAMS:            Input parameters are out of range.
+//      TOUCH_STATUS_TIMEOUT:                   Sensor did not generate a reset interrupt in the time allotted. Could indicate sensor is not connected or malfunctioning.
+//      TOUCH_STATUS_RESET_FAILED:              Sensor generated an invalid or unexpected interrupt.
+//      TOUCH_STATUS_QUIESCE_IO_IN_PROGRESS:    Indicates that Quiesce I/O is already in progress and this command cannot be accepted at this time.
+//
+typedef struct touch_sensor_reset_rsp_data
+{
+    u32          reserved[3];    // For future expansion
+} touch_sensor_reset_rsp_data_t;
+C_ASSERT(sizeof(touch_sensor_reset_rsp_data_t) == 12);
+
+
+//
+// TOUCH_SENSOR_READ_ALL_REGS_RSP code is sent in response to TOUCH_SENSOR_READ_ALL_REGS_CMD. This code will be followed
+// by TOUCH_SENSOR_READ_ALL_REGS_RSP_DATA.
+//
+// Possible Status values:
+//      TOUCH_STATUS_SUCCESS:           Command was processed successfully and new policies were set.
+//      TOUCH_STATUS_CMD_SIZE_ERROR:    Command sent did not match expected size. Other fields will not contain valid data.
+//
+typedef struct touch_sensor_read_all_regs_rsp_data
+{
+    touch_reg_block_t sensor_regs; // Returns first 64 bytes of register space used for normal touch operation. Does not include test mode register.
+    u32          reserved[4];
+} touch_sensor_read_all_regs_rsp_data_t;
+C_ASSERT(sizeof(touch_sensor_read_all_regs_rsp_data_t) == 80);
+
+//
+// ME to Host Message
+//
+typedef struct touch_sensor_msg_m2h
+{
+    u32  command_code;
+    touch_status_t	status;
+    union
+    {
+        touch_sensor_get_device_info_rsp_data_t     device_info_rsp_data;
+        touch_sensor_set_mode_rsp_data_t            set_mode_rsp_data;
+        touch_sensor_set_mem_window_rsp_data_t      set_mem_window_rsp_data;
+        touch_sensor_quiesce_io_rsp_data_t          quiesce_io_rsp_data;
+        touch_sensor_hid_ready_for_data_rsp_data_t  hid_ready_for_data_rsp_data;
+        touch_sensor_feedback_ready_rsp_data_t      feedback_ready_rsp_data;
+        touch_sensor_clear_mem_window_rsp_data_t    clear_mem_window_rsp_data;
+        touch_sensor_notify_dev_ready_rsp_data_t    notify_dev_ready_rsp_data;
+        touch_sensor_set_policies_rsp_data_t        set_policies_rsp_data;
+        touch_sensor_get_policies_rsp_data_t        get_policies_rsp_data;
+        touch_sensor_reset_rsp_data_t               reset_rsp_data;
+	touch_sensor_read_all_regs_rsp_data_t       read_all_regs_rsp_data;
+    } m2h_data;
+} touch_sensor_msg_m2h_t;
+C_ASSERT(sizeof(touch_sensor_msg_m2h_t) == 88);
+
+
+#define TOUCH_MSG_SIZE_MAX_BYTES    (MAX(sizeof(touch_sensor_msg_m2h_t), sizeof(touch_sensor_msg_h2m_t)))
+
+#pragma pack()
+
+#endif // _IPTS_MEI_MSGS_H_
diff --git a/drivers/misc/ipts/ipts-mei.c b/drivers/misc/ipts/ipts-mei.c
new file mode 100644
index 000000000000..7773b878318e
--- /dev/null
+++ b/drivers/misc/ipts/ipts-mei.c
@@ -0,0 +1,250 @@
+/*
+ * MEI client driver for Intel Precise Touch and Stylus
+ *
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#include <linux/mei_cl_bus.h>
+#include <linux/module.h>
+#include <linux/mod_devicetable.h>
+#include <linux/hid.h>
+#include <linux/dma-mapping.h>
+#include <linux/kthread.h>
+#include <linux/intel_ipts_if.h>
+
+#include "ipts.h"
+#include "ipts-fw.h"
+#include "ipts-hid.h"
+#include "ipts-params.h"
+#include "ipts-msg-handler.h"
+#include "ipts-mei-msgs.h"
+#include "ipts-binary-spec.h"
+#include "ipts-state.h"
+
+#define IPTS_DRIVER_NAME	"ipts"
+#define IPTS_MEI_UUID		UUID_LE(0x3e8d0870, 0x271a, 0x4208, \
+				0x8e, 0xb5, 0x9a, 0xcb, 0x94, 0x02, 0xae, 0x04)
+
+static struct mei_cl_device_id ipts_mei_cl_tbl[] = {
+	{ "", IPTS_MEI_UUID, MEI_CL_VERSION_ANY},
+	{}
+};
+
+static ssize_t device_info_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	ipts_info_t *ipts;
+
+	ipts = dev_get_drvdata(dev);
+	return sprintf(buf, "vendor id = 0x%04hX\n"
+				"device id = 0x%04hX\n"
+				"HW rev = 0x%08X\n"
+				"firmware rev = 0x%08X\n",
+			ipts->device_info.vendor_id, ipts->device_info.device_id,
+			ipts->device_info.hw_rev, ipts->device_info.fw_rev);
+}
+static DEVICE_ATTR_RO(device_info);
+
+static struct attribute *ipts_attrs[] = {
+	&dev_attr_device_info.attr,
+	NULL
+};
+
+static const struct attribute_group ipts_grp = {
+	.attrs = ipts_attrs,
+};
+
+MODULE_DEVICE_TABLE(mei, ipts_mei_cl_tbl);
+
+static void raw_data_work_func(struct work_struct *work)
+{
+	ipts_info_t *ipts = container_of(work, ipts_info_t, raw_data_work);
+
+	ipts_handle_processed_data(ipts);
+}
+
+static void gfx_status_work_func(struct work_struct *work)
+{
+	ipts_info_t *ipts = container_of(work, ipts_info_t, gfx_status_work);
+	ipts_state_t state;
+	int status = ipts->gfx_status;
+
+	ipts_dbg(ipts, "notify gfx status : %d\n", status);
+
+	state = ipts_get_state(ipts);
+
+	if (state == IPTS_STA_RAW_DATA_STARTED || state == IPTS_STA_HID_STARTED) {
+		if (status == IPTS_NOTIFY_STA_BACKLIGHT_ON &&
+					ipts->display_status == false) {
+			ipts_send_sensor_clear_mem_window_cmd(ipts);
+			ipts->display_status = true;
+		} else if (status == IPTS_NOTIFY_STA_BACKLIGHT_OFF &&
+					ipts->display_status == true) {
+			ipts_send_sensor_quiesce_io_cmd(ipts);
+			ipts->display_status = false;
+		}
+	}
+}
+
+/* event loop */
+static int ipts_mei_cl_event_thread(void *data)
+{
+	ipts_info_t *ipts = (ipts_info_t *)data;
+	struct mei_cl_device *cldev = ipts->cldev;
+	ssize_t msg_len;
+	touch_sensor_msg_m2h_t m2h_msg;
+
+	while (!kthread_should_stop()) {
+		msg_len = mei_cldev_recv(cldev, (u8*)&m2h_msg, sizeof(m2h_msg));
+		if (msg_len <= 0) {
+			ipts_err(ipts, "error in reading m2h msg\n");
+			continue;
+		}
+
+		if (ipts_handle_resp(ipts, &m2h_msg, msg_len) != 0) {
+			ipts_err(ipts, "error in handling resp msg\n");
+		}
+	}
+
+	ipts_dbg(ipts, "!! end event loop !!\n");
+
+	return 0;
+}
+
+static void init_work_func(struct work_struct *work)
+{
+	ipts_info_t *ipts = container_of(work, ipts_info_t, init_work);
+
+	ipts->sensor_mode = TOUCH_SENSOR_MODE_RAW_DATA;
+	ipts->display_status = true;
+
+	ipts_start(ipts);
+}
+
+static int ipts_mei_cl_probe(struct mei_cl_device *cldev,
+			const struct mei_cl_device_id *id)
+{
+	int ret = 0;
+	ipts_info_t *ipts = NULL;
+
+	// Check if a companion driver for firmware loading was registered
+	// If not, defer probing until it was properly registere
+	if (!ipts_fw_handler_available() && !ipts_modparams.ignore_companion) {
+		return -EPROBE_DEFER;
+	}
+
+	pr_info("probing Intel Precise Touch & Stylus\n");
+
+	// setup the DMA BIT mask, the system will choose the best possible
+	if (dma_coerce_mask_and_coherent(&cldev->dev, DMA_BIT_MASK(64)) == 0) {
+		pr_info("IPTS using DMA_BIT_MASK(64)\n");
+	} else if (dma_coerce_mask_and_coherent(&cldev->dev,
+						DMA_BIT_MASK(32)) == 0) {
+		pr_info("IPTS using  DMA_BIT_MASK(32)\n");
+	} else {
+		pr_err("IPTS: No suitable DMA available\n");
+		return -EFAULT;
+	}
+
+	ret = mei_cldev_enable(cldev);
+	if (ret < 0) {
+		pr_err("cannot enable IPTS\n");
+		return ret;
+	}
+
+	ipts = devm_kzalloc(&cldev->dev, sizeof(ipts_info_t), GFP_KERNEL);
+	if (ipts == NULL) {
+		ret = -ENOMEM;
+		goto disable_mei;
+	}
+	ipts->cldev = cldev;
+	mei_cldev_set_drvdata(cldev, ipts);
+
+	ipts->event_loop = kthread_run(ipts_mei_cl_event_thread, (void*)ipts,
+							"ipts_event_thread");
+
+	if(ipts_dbgfs_register(ipts, "ipts"))
+		pr_debug("cannot register debugfs for IPTS\n");
+
+	INIT_WORK(&ipts->init_work, init_work_func);
+	INIT_WORK(&ipts->raw_data_work, raw_data_work_func);
+	INIT_WORK(&ipts->gfx_status_work, gfx_status_work_func);
+
+	ret = sysfs_create_group(&cldev->dev.kobj, &ipts_grp);
+	if (ret != 0) {
+		pr_debug("cannot create sysfs for IPTS\n");
+	}
+
+	schedule_work(&ipts->init_work);
+
+	return 0;
+
+disable_mei :
+	mei_cldev_disable(cldev);
+
+	return ret;
+}
+
+static int ipts_mei_cl_remove(struct mei_cl_device *cldev)
+{
+	ipts_info_t *ipts = mei_cldev_get_drvdata(cldev);
+
+	ipts_stop(ipts);
+
+	sysfs_remove_group(&cldev->dev.kobj, &ipts_grp);
+	ipts_hid_release(ipts);
+	ipts_dbgfs_deregister(ipts);
+	mei_cldev_disable(cldev);
+
+	kthread_stop(ipts->event_loop);
+
+	pr_info("IPTS removed\n");
+
+	return 0;
+}
+
+static struct mei_cl_driver ipts_mei_cl_driver = {
+	.id_table = ipts_mei_cl_tbl,
+	.name = IPTS_DRIVER_NAME,
+	.probe = ipts_mei_cl_probe,
+	.remove = ipts_mei_cl_remove,
+};
+
+static int ipts_mei_cl_init(void)
+{
+	int ret;
+
+	pr_info("IPTS %s() is called\n", __func__);
+
+	ret = mei_cldev_driver_register(&ipts_mei_cl_driver);
+	if (ret) {
+		pr_err("unable to register IPTS mei client driver\n");
+		return ret;
+	}
+
+	return 0;
+}
+
+static void __exit ipts_mei_cl_exit(void)
+{
+	pr_info("IPTS %s() is called\n", __func__);
+
+	mei_cldev_driver_unregister(&ipts_mei_cl_driver);
+}
+
+module_init(ipts_mei_cl_init);
+module_exit(ipts_mei_cl_exit);
+
+MODULE_DESCRIPTION
+	("Intel(R) Management Engine Interface Client Driver for "\
+	"Intel Precision Touch and Sylus");
+MODULE_LICENSE("GPL");
diff --git a/drivers/misc/ipts/ipts-msg-handler.c b/drivers/misc/ipts/ipts-msg-handler.c
new file mode 100644
index 000000000000..6ca74dd7037b
--- /dev/null
+++ b/drivers/misc/ipts/ipts-msg-handler.c
@@ -0,0 +1,426 @@
+#include <linux/mei_cl_bus.h>
+
+#include "ipts.h"
+#include "ipts-hid.h"
+#include "ipts-resource.h"
+#include "ipts-mei-msgs.h"
+
+int ipts_handle_cmd(ipts_info_t *ipts, u32 cmd, void *data, int data_size)
+{
+	int ret = 0;
+	touch_sensor_msg_h2m_t h2m_msg;
+	int len = 0;
+
+	memset(&h2m_msg, 0, sizeof(h2m_msg));
+
+	h2m_msg.command_code = cmd;
+	len = sizeof(h2m_msg.command_code) + data_size;
+	if (data != NULL && data_size != 0)
+		memcpy(&h2m_msg.h2m_data, data, data_size); /* copy payload */
+
+	ret = mei_cldev_send(ipts->cldev, (u8*)&h2m_msg, len);
+	if (ret < 0) {
+		ipts_err(ipts, "mei_cldev_send() error 0x%X:%d\n",
+							cmd, ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+int ipts_send_feedback(ipts_info_t *ipts, int buffer_idx, u32 transaction_id)
+{
+	int ret;
+	int cmd_len;
+	touch_sensor_feedback_ready_cmd_data_t fb_ready_cmd;
+
+	cmd_len = sizeof(touch_sensor_feedback_ready_cmd_data_t);
+	memset(&fb_ready_cmd, 0, cmd_len);
+
+	fb_ready_cmd.feedback_index = buffer_idx;
+	fb_ready_cmd.transaction_id = transaction_id;
+
+	ret = ipts_handle_cmd(ipts, TOUCH_SENSOR_FEEDBACK_READY_CMD,
+				&fb_ready_cmd, cmd_len);
+
+	return ret;
+}
+
+int ipts_send_sensor_quiesce_io_cmd(ipts_info_t *ipts)
+{
+	int ret;
+	int cmd_len;
+	touch_sensor_quiesce_io_cmd_data_t quiesce_io_cmd;
+
+	cmd_len = sizeof(touch_sensor_quiesce_io_cmd_data_t);
+	memset(&quiesce_io_cmd, 0, cmd_len);
+
+	ret = ipts_handle_cmd(ipts, TOUCH_SENSOR_QUIESCE_IO_CMD,
+				&quiesce_io_cmd, cmd_len);
+
+	return ret;
+}
+
+int ipts_send_sensor_hid_ready_for_data_cmd(ipts_info_t *ipts)
+{
+	return ipts_handle_cmd(ipts, TOUCH_SENSOR_HID_READY_FOR_DATA_CMD, NULL, 0);
+}
+
+int ipts_send_sensor_clear_mem_window_cmd(ipts_info_t *ipts)
+{
+	return ipts_handle_cmd(ipts, TOUCH_SENSOR_CLEAR_MEM_WINDOW_CMD, NULL, 0);
+}
+
+static int check_validity(touch_sensor_msg_m2h_t *m2h_msg, u32 msg_len)
+{
+	int ret = 0;
+	int valid_msg_len = sizeof(m2h_msg->command_code);
+	u32 cmd_code = m2h_msg->command_code;
+
+	switch (cmd_code) {
+		case TOUCH_SENSOR_SET_MODE_RSP:
+			valid_msg_len +=
+				sizeof(touch_sensor_set_mode_rsp_data_t);
+			break;
+		case TOUCH_SENSOR_SET_MEM_WINDOW_RSP:
+			valid_msg_len +=
+				sizeof(touch_sensor_set_mem_window_rsp_data_t);
+			break;
+		case TOUCH_SENSOR_QUIESCE_IO_RSP:
+			valid_msg_len +=
+				sizeof(touch_sensor_quiesce_io_rsp_data_t);
+			break;
+		case TOUCH_SENSOR_HID_READY_FOR_DATA_RSP:
+			valid_msg_len +=
+				sizeof(touch_sensor_hid_ready_for_data_rsp_data_t);
+			break;
+		case TOUCH_SENSOR_FEEDBACK_READY_RSP:
+			valid_msg_len +=
+				sizeof(touch_sensor_feedback_ready_rsp_data_t);
+			break;
+		case TOUCH_SENSOR_CLEAR_MEM_WINDOW_RSP:
+			valid_msg_len +=
+				sizeof(touch_sensor_clear_mem_window_rsp_data_t);
+			break;
+		case TOUCH_SENSOR_NOTIFY_DEV_READY_RSP:
+			valid_msg_len +=
+				sizeof(touch_sensor_notify_dev_ready_rsp_data_t);
+			break;
+		case TOUCH_SENSOR_SET_POLICIES_RSP:
+			valid_msg_len +=
+				sizeof(touch_sensor_set_policies_rsp_data_t);
+			break;
+		case TOUCH_SENSOR_GET_POLICIES_RSP:
+			valid_msg_len +=
+				sizeof(touch_sensor_get_policies_rsp_data_t);
+			break;
+		case TOUCH_SENSOR_RESET_RSP:
+			valid_msg_len +=
+				sizeof(touch_sensor_reset_rsp_data_t);
+			break;
+	}
+
+	if (valid_msg_len != msg_len) {
+		return -EINVAL;
+	}
+
+	return ret;
+}
+
+int ipts_start(ipts_info_t *ipts)
+{
+	int ret = 0;
+	/* TODO : check if we need to do SET_POLICIES_CMD
+	we need to do this when protocol version doesn't match with reported one
+	how we keep vendor specific data is the first thing to solve */
+
+	ipts_set_state(ipts, IPTS_STA_INIT);
+	ipts->num_of_parallel_data_buffers = TOUCH_SENSOR_MAX_DATA_BUFFERS;
+
+	ipts->sensor_mode = TOUCH_SENSOR_MODE_RAW_DATA; /* start with RAW_DATA */
+
+	ret = ipts_handle_cmd(ipts, TOUCH_SENSOR_NOTIFY_DEV_READY_CMD, NULL, 0);
+
+	return ret;
+}
+
+void ipts_stop(ipts_info_t *ipts)
+{
+	ipts_state_t old_state;
+
+	old_state = ipts_get_state(ipts);
+	ipts_set_state(ipts, IPTS_STA_STOPPING);
+
+	ipts_send_sensor_quiesce_io_cmd(ipts);
+	ipts_send_sensor_clear_mem_window_cmd(ipts);
+
+	if (old_state < IPTS_STA_RESOURCE_READY)
+		return;
+
+	if (old_state == IPTS_STA_RAW_DATA_STARTED ||
+					old_state == IPTS_STA_HID_STARTED) {
+		ipts_free_default_resource(ipts);
+		ipts_free_raw_data_resource(ipts);
+
+		return;
+	}
+}
+
+int ipts_restart(ipts_info_t *ipts)
+{
+	int ret = 0;
+
+	ipts_dbg(ipts, "ipts restart\n");
+
+	ipts_stop(ipts);
+
+	ipts->retry++;
+	if (ipts->retry == IPTS_MAX_RETRY &&
+			ipts->sensor_mode == TOUCH_SENSOR_MODE_RAW_DATA) {
+		/* try with HID mode */
+		ipts->sensor_mode = TOUCH_SENSOR_MODE_HID;
+	} else if (ipts->retry > IPTS_MAX_RETRY) {
+		return -EPERM;
+	}
+
+	ipts_send_sensor_quiesce_io_cmd(ipts);
+	ipts->restart = true;
+
+	return ret;
+}
+
+#define rsp_failed(ipts, cmd, status) ipts_err(ipts, \
+				"0x%08x failed status = %d\n", cmd, status);
+
+int ipts_handle_resp(ipts_info_t *ipts, touch_sensor_msg_m2h_t *m2h_msg,
+								u32 msg_len)
+{
+	int ret = 0;
+	int rsp_status = 0;
+	int cmd_status = 0;
+	int cmd_len = 0;
+	u32 cmd;
+
+	if (!check_validity(m2h_msg, msg_len)) {
+		ipts_err(ipts, "wrong rsp\n");
+		return -EINVAL;
+	}
+
+	rsp_status = m2h_msg->status;
+	cmd = m2h_msg->command_code;
+
+	switch (cmd) {
+		case TOUCH_SENSOR_NOTIFY_DEV_READY_RSP:
+			if (rsp_status != 0 &&
+			  rsp_status != TOUCH_STATUS_SENSOR_FAIL_NONFATAL) {
+				rsp_failed(ipts, cmd, rsp_status);
+				break;
+			}
+
+			cmd_status = ipts_handle_cmd(ipts,
+					TOUCH_SENSOR_GET_DEVICE_INFO_CMD,
+					NULL, 0);
+			break;
+		case TOUCH_SENSOR_GET_DEVICE_INFO_RSP:
+			if (rsp_status != 0 &&
+			  rsp_status != TOUCH_STATUS_COMPAT_CHECK_FAIL) {
+				rsp_failed(ipts, cmd, rsp_status);
+				break;
+			}
+
+			memcpy(&ipts->device_info,
+				&m2h_msg->m2h_data.device_info_rsp_data,
+				sizeof(touch_sensor_get_device_info_rsp_data_t));
+
+			/*
+			    TODO : support raw_request during HID init.
+			    Although HID init happens here, technically most of
+			    reports (for both direction) can be issued only
+			    after SET_MEM_WINDOWS_CMD since they may require
+			    ME or touch IC. If ipts vendor requires raw_request
+			    during HID init, we need to consider to move HID init.
+			*/
+			if (ipts->hid_desc_ready == false) {
+				ret = ipts_hid_init(ipts);
+				if (ret)
+					break;
+			}
+
+			cmd_status = ipts_send_sensor_clear_mem_window_cmd(ipts);
+
+			break;
+		case TOUCH_SENSOR_CLEAR_MEM_WINDOW_RSP:
+		{
+			touch_sensor_set_mode_cmd_data_t sensor_mode_cmd;
+
+			if (rsp_status != 0 &&
+					rsp_status != TOUCH_STATUS_TIMEOUT) {
+				rsp_failed(ipts, cmd, rsp_status);
+				break;
+			}
+
+			if (ipts_get_state(ipts) == IPTS_STA_STOPPING)
+				break;
+
+			/* allocate default resource : common & hid only */
+			if (!ipts_is_default_resource_ready(ipts)) {
+				ret = ipts_allocate_default_resource(ipts);
+				if (ret)
+					break;
+			}
+
+			if (ipts->sensor_mode == TOUCH_SENSOR_MODE_RAW_DATA &&
+					!ipts_is_raw_data_resource_ready(ipts)) {
+				ret = ipts_allocate_raw_data_resource(ipts);
+				if (ret) {
+					ipts_free_default_resource(ipts);
+					break;
+				}
+			}
+
+			ipts_set_state(ipts, IPTS_STA_RESOURCE_READY);
+
+			cmd_len = sizeof(touch_sensor_set_mode_cmd_data_t);
+			memset(&sensor_mode_cmd, 0, cmd_len);
+			sensor_mode_cmd.sensor_mode = ipts->sensor_mode;
+			cmd_status = ipts_handle_cmd(ipts,
+				TOUCH_SENSOR_SET_MODE_CMD,
+				&sensor_mode_cmd, cmd_len);
+			break;
+		}
+		case TOUCH_SENSOR_SET_MODE_RSP:
+		{
+			touch_sensor_set_mem_window_cmd_data_t smw_cmd;
+
+			if (rsp_status != 0) {
+				rsp_failed(ipts, cmd, rsp_status);
+				break;
+			}
+
+			cmd_len = sizeof(touch_sensor_set_mem_window_cmd_data_t);
+			memset(&smw_cmd, 0, cmd_len);
+			ipts_get_set_mem_window_cmd_data(ipts, &smw_cmd);
+			cmd_status = ipts_handle_cmd(ipts,
+				TOUCH_SENSOR_SET_MEM_WINDOW_CMD,
+				&smw_cmd, cmd_len);
+			break;
+		}
+		case TOUCH_SENSOR_SET_MEM_WINDOW_RSP:
+			if (rsp_status != 0) {
+				rsp_failed(ipts, cmd, rsp_status);
+				break;
+			}
+
+			cmd_status = ipts_send_sensor_hid_ready_for_data_cmd(ipts);
+			if (cmd_status)
+				break;
+
+			if (ipts->sensor_mode == TOUCH_SENSOR_MODE_HID) {
+				ipts_set_state(ipts, IPTS_STA_HID_STARTED);
+			} else if (ipts->sensor_mode == TOUCH_SENSOR_MODE_RAW_DATA) {
+				ipts_set_state(ipts, IPTS_STA_RAW_DATA_STARTED);
+			}
+
+			ipts_err(ipts, "touch enabled %d\n", ipts_get_state(ipts));
+
+			break;
+		case TOUCH_SENSOR_HID_READY_FOR_DATA_RSP:
+		{
+			touch_sensor_hid_ready_for_data_rsp_data_t *hid_data;
+			ipts_state_t state;
+
+			if (rsp_status != 0 &&
+				  rsp_status != TOUCH_STATUS_SENSOR_DISABLED) {
+				rsp_failed(ipts, cmd, rsp_status);
+				break;
+			}
+
+			state = ipts_get_state(ipts);
+			if (ipts->sensor_mode == TOUCH_SENSOR_MODE_HID &&
+						state == IPTS_STA_HID_STARTED) {
+
+				hid_data = &m2h_msg->m2h_data.hid_ready_for_data_rsp_data;
+
+				/* HID mode only uses buffer 0 */
+				if (hid_data->touch_data_buffer_index != 0)
+					break;
+
+				/* handle hid data */
+				ipts_handle_hid_data(ipts, hid_data);
+			}
+
+			break;
+		}
+		case TOUCH_SENSOR_FEEDBACK_READY_RSP:
+			if (rsp_status != 0 &&
+			  rsp_status != TOUCH_STATUS_COMPAT_CHECK_FAIL) {
+				rsp_failed(ipts, cmd, rsp_status);
+				break;
+			}
+
+			if (m2h_msg->m2h_data.feedback_ready_rsp_data.
+					feedback_index == TOUCH_HID_2_ME_BUFFER_ID)
+				break;
+
+			if (ipts->sensor_mode == TOUCH_SENSOR_MODE_HID) {
+				cmd_status = ipts_handle_cmd(ipts,
+					TOUCH_SENSOR_HID_READY_FOR_DATA_CMD,
+					NULL, 0);
+			}
+
+			/* reset retry since we are getting touch data */
+			ipts->retry = 0;
+
+			break;
+		case TOUCH_SENSOR_QUIESCE_IO_RSP:
+		{
+			ipts_state_t state;
+
+			if (rsp_status != 0) {
+				rsp_failed(ipts, cmd, rsp_status);
+				break;
+			}
+
+			state = ipts_get_state(ipts);
+			if (state == IPTS_STA_STOPPING && ipts->restart) {
+				ipts_dbg(ipts, "restart\n");
+			        ipts_start(ipts);
+				ipts->restart = 0;
+				break;
+			}
+
+			/* support sysfs debug node for switch sensor mode */
+			if (ipts->switch_sensor_mode) {
+				ipts_set_state(ipts, IPTS_STA_INIT);
+				ipts->sensor_mode = ipts->new_sensor_mode;
+				ipts->switch_sensor_mode = false;
+
+				ipts_send_sensor_clear_mem_window_cmd(ipts);
+			}
+
+			break;
+		}
+	}
+
+	/* handle error in rsp_status */
+	if (rsp_status != 0) {
+		switch (rsp_status) {
+			case TOUCH_STATUS_SENSOR_EXPECTED_RESET:
+			case TOUCH_STATUS_SENSOR_UNEXPECTED_RESET:
+				ipts_dbg(ipts, "sensor reset %d\n", rsp_status);
+				ipts_restart(ipts);
+				break;
+			default:
+				ipts_dbg(ipts, "cmd : 0x%08x, status %d\n",
+								cmd,
+								rsp_status);
+				break;
+		}
+	}
+
+	if (cmd_status) {
+		ipts_restart(ipts);
+	}
+
+	return ret;
+}
diff --git a/drivers/misc/ipts/ipts-msg-handler.h b/drivers/misc/ipts/ipts-msg-handler.h
new file mode 100644
index 000000000000..4ee8301dbb81
--- /dev/null
+++ b/drivers/misc/ipts/ipts-msg-handler.h
@@ -0,0 +1,32 @@
+/*
+ *
+ * Intel Precise Touch & Stylus ME message handler
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ */
+
+#ifndef _IPTS_MSG_HANDLER_H
+#define _IPTS_MSG_HANDLER_H
+
+int ipts_handle_cmd(ipts_info_t *ipts, u32 cmd, void *data, int data_size);
+int ipts_start(ipts_info_t *ipts);
+void ipts_stop(ipts_info_t *ipts);
+int ipts_handle_resp(ipts_info_t *ipts, touch_sensor_msg_m2h_t *m2h_msg,
+                     u32 msg_len);
+int ipts_handle_processed_data(ipts_info_t *ipts);
+int ipts_send_feedback(ipts_info_t *ipts, int buffer_idx, u32 transaction_id);
+int ipts_send_sensor_quiesce_io_cmd(ipts_info_t *ipts);
+int ipts_send_sensor_hid_ready_for_data_cmd(ipts_info_t *ipts);
+int ipts_send_sensor_clear_mem_window_cmd(ipts_info_t *ipts);
+int ipts_restart(ipts_info_t *ipts);
+
+#endif /* _IPTS_MSG_HANDLER_H */
diff --git a/drivers/misc/ipts/ipts-params.c b/drivers/misc/ipts/ipts-params.c
new file mode 100644
index 000000000000..b4faa1afc046
--- /dev/null
+++ b/drivers/misc/ipts/ipts-params.c
@@ -0,0 +1,21 @@
+#include <linux/moduleparam.h>
+
+#include "ipts-params.h"
+
+struct ipts_params ipts_modparams = {
+	.ignore_fw_fallback = false,
+	.ignore_companion = false,
+	.no_feedback = -1,
+};
+
+module_param_named(ignore_fw_fallback, ipts_modparams.ignore_fw_fallback, bool, 0400);
+MODULE_PARM_DESC(ignore_fw_fallback, "Don't use the IPTS firmware fallback path");
+
+module_param_named(ignore_companion, ipts_modparams.ignore_companion, bool, 0400);
+MODULE_PARM_DESC(ignore_companion, "Don't use a companion driver to load firmware");
+
+module_param_named(no_feedback, ipts_modparams.no_feedback, int, 0644);
+MODULE_PARM_DESC(no_feedback, "Disable sending feedback in order to work around the issue that IPTS "
+	"stops working after some amount of use. "
+	"-1=auto (true if your model is SB1/SP4, false if another model), "
+	"0=false, 1=true, (default: -1)");
diff --git a/drivers/misc/ipts/ipts-params.h b/drivers/misc/ipts/ipts-params.h
new file mode 100644
index 000000000000..6fd62fb46d26
--- /dev/null
+++ b/drivers/misc/ipts/ipts-params.h
@@ -0,0 +1,14 @@
+#ifndef _IPTS_PARAMS_H_
+#define _IPTS_PARAMS_H_
+
+#include <linux/types.h>
+
+struct ipts_params {
+	bool ignore_fw_fallback;
+	bool ignore_companion;
+	int no_feedback;
+};
+
+extern struct ipts_params ipts_modparams;
+
+#endif // _IPTS_PARAMS_H_
diff --git a/drivers/misc/ipts/ipts-resource.c b/drivers/misc/ipts/ipts-resource.c
new file mode 100644
index 000000000000..47607ef7c461
--- /dev/null
+++ b/drivers/misc/ipts/ipts-resource.c
@@ -0,0 +1,277 @@
+#include <linux/dma-mapping.h>
+
+#include "ipts.h"
+#include "ipts-mei-msgs.h"
+#include "ipts-kernel.h"
+
+static void free_common_resource(ipts_info_t *ipts)
+{
+	char *addr;
+	ipts_buffer_info_t *feedback_buffer;
+	dma_addr_t dma_addr;
+	u32 buffer_size;
+	int i, num_of_parallels;
+
+	if (ipts->resource.me2hid_buffer) {
+		devm_kfree(&ipts->cldev->dev, ipts->resource.me2hid_buffer);
+		ipts->resource.me2hid_buffer = 0;
+	}
+
+	addr = ipts->resource.hid2me_buffer.addr;
+	dma_addr = ipts->resource.hid2me_buffer.dma_addr;
+	buffer_size = ipts->resource.hid2me_buffer_size;
+
+	if (ipts->resource.hid2me_buffer.addr) {
+		dmam_free_coherent(&ipts->cldev->dev, buffer_size, addr, dma_addr);
+		ipts->resource.hid2me_buffer.addr = 0;
+		ipts->resource.hid2me_buffer.dma_addr = 0;
+		ipts->resource.hid2me_buffer_size = 0;
+	}
+
+	feedback_buffer = ipts->resource.feedback_buffer;
+	num_of_parallels = ipts_get_num_of_parallel_buffers(ipts);
+	for (i = 0; i < num_of_parallels; i++) {
+		if (feedback_buffer[i].addr) {
+			dmam_free_coherent(&ipts->cldev->dev,
+				ipts->device_info.feedback_size,
+				feedback_buffer[i].addr,
+				feedback_buffer[i].dma_addr);
+			feedback_buffer[i].addr = 0;
+			feedback_buffer[i].dma_addr = 0;
+		}
+	}
+}
+
+static int allocate_common_resource(ipts_info_t *ipts)
+{
+	char *addr, *me2hid_addr;
+	ipts_buffer_info_t *feedback_buffer;
+	dma_addr_t dma_addr;
+	int i, ret = 0, num_of_parallels;
+	u32 buffer_size;
+
+	buffer_size = ipts->device_info.feedback_size;
+
+	addr = dmam_alloc_coherent(&ipts->cldev->dev,
+			buffer_size,
+			&dma_addr,
+			GFP_ATOMIC|__GFP_ZERO);
+	if (addr == NULL)
+		return -ENOMEM;
+
+	me2hid_addr = devm_kzalloc(&ipts->cldev->dev, buffer_size, GFP_KERNEL);
+	if (me2hid_addr == NULL) {
+		ret = -ENOMEM;
+		goto release_resource;
+	}
+
+	ipts->resource.hid2me_buffer.addr = addr;
+	ipts->resource.hid2me_buffer.dma_addr = dma_addr;
+	ipts->resource.hid2me_buffer_size = buffer_size;
+	ipts->resource.me2hid_buffer = me2hid_addr;
+
+	feedback_buffer = ipts->resource.feedback_buffer;
+	num_of_parallels = ipts_get_num_of_parallel_buffers(ipts);
+	for (i = 0; i < num_of_parallels; i++) {
+		feedback_buffer[i].addr = dmam_alloc_coherent(&ipts->cldev->dev,
+				ipts->device_info.feedback_size,
+				&feedback_buffer[i].dma_addr,
+				GFP_ATOMIC|__GFP_ZERO);
+
+		if (feedback_buffer[i].addr == NULL) {
+			ret = -ENOMEM;
+			goto release_resource;
+		}
+	}
+
+	return 0;
+
+release_resource:
+	free_common_resource(ipts);
+
+	return ret;
+}
+
+void ipts_free_raw_data_resource(ipts_info_t *ipts)
+{
+	if (ipts_is_raw_data_resource_ready(ipts)) {
+		ipts->resource.raw_data_resource_ready = false;
+
+		ipts_release_kernels(ipts);
+	}
+}
+
+static int allocate_hid_resource(ipts_info_t *ipts)
+{
+	ipts_buffer_info_t *buffer_hid;
+
+	/* hid mode uses only one touch data buffer */
+	buffer_hid = &ipts->resource.touch_data_buffer_hid;
+	buffer_hid->addr = dmam_alloc_coherent(&ipts->cldev->dev,
+				ipts->device_info.frame_size,
+				&buffer_hid->dma_addr,
+				GFP_ATOMIC|__GFP_ZERO);
+	if (buffer_hid->addr == NULL) {
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
+static void free_hid_resource(ipts_info_t *ipts)
+{
+	ipts_buffer_info_t *buffer_hid;
+
+	buffer_hid = &ipts->resource.touch_data_buffer_hid;
+	if (buffer_hid->addr) {
+		dmam_free_coherent(&ipts->cldev->dev,
+				ipts->device_info.frame_size,
+				buffer_hid->addr,
+				buffer_hid->dma_addr);
+		buffer_hid->addr = 0;
+		buffer_hid->dma_addr = 0;
+	}
+}
+
+int ipts_allocate_default_resource(ipts_info_t *ipts)
+{
+	int ret;
+
+	ret = allocate_common_resource(ipts);
+	if (ret) {
+		ipts_dbg(ipts, "cannot allocate common resource\n");
+		return ret;
+	}
+
+	ret = allocate_hid_resource(ipts);
+	if (ret) {
+		ipts_dbg(ipts, "cannot allocate hid resource\n");
+		free_common_resource(ipts);
+		return ret;
+	}
+
+	ipts->resource.default_resource_ready = true;
+
+	return 0;
+}
+
+void ipts_free_default_resource(ipts_info_t *ipts)
+{
+	if (ipts_is_default_resource_ready(ipts)) {
+		ipts->resource.default_resource_ready = false;
+
+		free_hid_resource(ipts);
+		free_common_resource(ipts);
+	}
+}
+
+int ipts_allocate_raw_data_resource(ipts_info_t *ipts)
+{
+	int ret = 0;
+
+	ret = ipts_init_kernels(ipts);
+	if (ret) {
+		return ret;
+	}
+
+	ipts->resource.raw_data_resource_ready = true;
+
+	return 0;
+}
+
+static void get_hid_only_smw_cmd_data(ipts_info_t *ipts,
+				touch_sensor_set_mem_window_cmd_data_t *data,
+				ipts_resource_t *resrc)
+{
+	ipts_buffer_info_t *touch_buf;
+	ipts_buffer_info_t *feedback_buf;
+
+	touch_buf = &resrc->touch_data_buffer_hid;
+	feedback_buf = &resrc->feedback_buffer[0];
+
+	data->touch_data_buffer_addr_lower[0] =
+				lower_32_bits(touch_buf->dma_addr);
+	data->touch_data_buffer_addr_upper[0] =
+				upper_32_bits(touch_buf->dma_addr);
+	data->feedback_buffer_addr_lower[0] =
+				lower_32_bits(feedback_buf->dma_addr);
+	data->feedback_buffer_addr_upper[0] =
+				upper_32_bits(feedback_buf->dma_addr);
+}
+
+static void get_raw_data_only_smw_cmd_data(ipts_info_t *ipts,
+				touch_sensor_set_mem_window_cmd_data_t *data,
+				ipts_resource_t *resrc)
+{
+	u64 wq_tail_phy_addr;
+	u64 cookie_phy_addr;
+	ipts_buffer_info_t *touch_buf;
+	ipts_buffer_info_t *feedback_buf;
+	int i, num_of_parallels;
+
+	touch_buf = resrc->touch_data_buffer_raw;
+	feedback_buf = resrc->feedback_buffer;
+
+	num_of_parallels = ipts_get_num_of_parallel_buffers(ipts);
+	for (i = 0; i < num_of_parallels; i++) {
+		data->touch_data_buffer_addr_lower[i] =
+					lower_32_bits(touch_buf[i].dma_addr);
+		data->touch_data_buffer_addr_upper[i] =
+					upper_32_bits(touch_buf[i].dma_addr);
+		data->feedback_buffer_addr_lower[i] =
+					lower_32_bits(feedback_buf[i].dma_addr);
+		data->feedback_buffer_addr_upper[i] =
+					upper_32_bits(feedback_buf[i].dma_addr);
+	}
+
+	wq_tail_phy_addr = resrc->wq_info.wq_tail_phy_addr;
+	data->tail_offset_addr_lower = lower_32_bits(wq_tail_phy_addr);
+	data->tail_offset_addr_upper = upper_32_bits(wq_tail_phy_addr);
+
+	cookie_phy_addr = resrc->wq_info.db_phy_addr +
+						resrc->wq_info.db_cookie_offset;
+	data->doorbell_cookie_addr_lower = lower_32_bits(cookie_phy_addr);
+	data->doorbell_cookie_addr_upper = upper_32_bits(cookie_phy_addr);
+	data->work_queue_size = resrc->wq_info.wq_size;
+
+	data->work_queue_item_size = resrc->wq_item_size;
+}
+
+void ipts_get_set_mem_window_cmd_data(ipts_info_t *ipts,
+				touch_sensor_set_mem_window_cmd_data_t *data)
+{
+	ipts_resource_t *resrc = &ipts->resource;
+
+	if (ipts->sensor_mode == TOUCH_SENSOR_MODE_RAW_DATA)
+		get_raw_data_only_smw_cmd_data(ipts, data, resrc);
+	else if (ipts->sensor_mode == TOUCH_SENSOR_MODE_HID)
+		get_hid_only_smw_cmd_data(ipts, data, resrc);
+
+	/* hid2me is common for "raw data" and "hid" */
+	data->hid2me_buffer_addr_lower =
+				lower_32_bits(resrc->hid2me_buffer.dma_addr);
+	data->hid2me_buffer_addr_upper =
+				upper_32_bits(resrc->hid2me_buffer.dma_addr);
+	data->hid2me_buffer_size = resrc->hid2me_buffer_size;
+}
+
+void ipts_set_input_buffer(ipts_info_t *ipts, int parallel_idx,
+						u8* cpu_addr, u64 dma_addr)
+{
+	ipts_buffer_info_t *touch_buf;
+
+	touch_buf = ipts->resource.touch_data_buffer_raw;
+	touch_buf[parallel_idx].dma_addr = dma_addr;
+	touch_buf[parallel_idx].addr = cpu_addr;
+}
+
+void ipts_set_output_buffer(ipts_info_t *ipts, int parallel_idx, int output_idx,
+						u8* cpu_addr, u64 dma_addr)
+{
+	ipts_buffer_info_t *output_buf;
+
+	output_buf = &ipts->resource.raw_data_mode_output_buffer[parallel_idx][output_idx];
+
+	output_buf->dma_addr = dma_addr;
+	output_buf->addr = cpu_addr;
+}
diff --git a/drivers/misc/ipts/ipts-resource.h b/drivers/misc/ipts/ipts-resource.h
new file mode 100644
index 000000000000..7d66ac72b475
--- /dev/null
+++ b/drivers/misc/ipts/ipts-resource.h
@@ -0,0 +1,30 @@
+/*
+ * Intel Precise Touch & Stylus state codes
+ *
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#ifndef _IPTS_RESOURCE_H_
+#define _IPTS_RESOURCE_H_
+
+int ipts_allocate_default_resource(ipts_info_t *ipts);
+void ipts_free_default_resource(ipts_info_t *ipts);
+int ipts_allocate_raw_data_resource(ipts_info_t *ipts);
+void ipts_free_raw_data_resource(ipts_info_t *ipts);
+void ipts_get_set_mem_window_cmd_data(ipts_info_t *ipts,
+				touch_sensor_set_mem_window_cmd_data_t *data);
+void ipts_set_input_buffer(ipts_info_t *ipts, int parallel_idx,
+						u8* cpu_addr, u64 dma_addr);
+void ipts_set_output_buffer(ipts_info_t *ipts, int parallel_idx, int output_idx,
+						u8* cpu_addr, u64 dma_addr);
+
+#endif // _IPTS_RESOURCE_H_
diff --git a/drivers/misc/ipts/ipts-sensor-regs.h b/drivers/misc/ipts/ipts-sensor-regs.h
new file mode 100644
index 000000000000..96812b0eb980
--- /dev/null
+++ b/drivers/misc/ipts/ipts-sensor-regs.h
@@ -0,0 +1,700 @@
+/*
+ * Touch Sensor Register definition
+ *
+ * Copyright (c) 2013-2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+
+#ifndef _TOUCH_SENSOR_REGS_H
+#define _TOUCH_SENSOR_REGS_H
+
+#pragma pack(1)
+
+// define C_ASSERT macro to check structure size and fail compile for unexpected mismatch
+#ifndef C_ASSERT
+#define C_ASSERT(e) typedef char __C_ASSERT__[(e)?1:-1]
+#endif
+
+//
+// Compatibility versions for this header file
+//
+#define TOUCH_EDS_REV_MINOR     0
+#define TOUCH_EDS_REV_MAJOR     1
+#define TOUCH_EDS_INTF_REV      1
+#define TOUCH_PROTOCOL_VER      0
+
+
+//
+// Offset 00h: TOUCH_STS: Status Register
+// This register is read by the SPI Controller immediately following an interrupt.
+//
+#define TOUCH_STS_REG_OFFSET                0x00
+
+typedef enum touch_sts_reg_int_type
+{
+    TOUCH_STS_REG_INT_TYPE_DATA_AVAIL = 0,  // Touch Data Available
+    TOUCH_STS_REG_INT_TYPE_RESET_OCCURRED,  // Reset Occurred
+    TOUCH_STS_REG_INT_TYPE_ERROR_OCCURRED,  // Error Occurred
+    TOUCH_STS_REG_INT_TYPE_VENDOR_DATA,     // Vendor specific data, treated same as raw frame
+    TOUCH_STS_REG_INT_TYPE_GET_FEATURES,    // Get Features response data available
+    TOUCH_STS_REG_INT_TYPE_MAX
+} touch_sts_reg_int_type_t;
+C_ASSERT(sizeof(touch_sts_reg_int_type_t) == 4);
+
+typedef enum touch_sts_reg_pwr_state
+{
+    TOUCH_STS_REG_PWR_STATE_SLEEP = 0,  // Sleep
+    TOUCH_STS_REG_PWR_STATE_DOZE,       // Doze
+    TOUCH_STS_REG_PWR_STATE_ARMED,      // Armed
+    TOUCH_STS_REG_PWR_STATE_SENSING,    // Sensing
+    TOUCH_STS_REG_PWR_STATE_MAX
+} touch_sts_reg_pwr_state_t;
+C_ASSERT(sizeof(touch_sts_reg_pwr_state_t) == 4);
+
+typedef enum touch_sts_reg_init_state
+{
+    TOUCH_STS_REG_INIT_STATE_READY_FOR_OP = 0,  // Ready for normal operation
+    TOUCH_STS_REG_INIT_STATE_FW_NEEDED,         // Touch IC needs its Firmware loaded
+    TOUCH_STS_REG_INIT_STATE_DATA_NEEDED,       // Touch IC needs its Data loaded
+    TOUCH_STS_REG_INIT_STATE_INIT_ERROR,        // Error info in TOUCH_ERR_REG
+    TOUCH_STS_REG_INIT_STATE_MAX
+} touch_sts_reg_init_state_t;
+C_ASSERT(sizeof(touch_sts_reg_init_state_t) == 4);
+
+#define TOUCH_SYNC_BYTE_VALUE   0x5A
+
+typedef union touch_sts_reg
+{
+    u32  reg_value;
+
+    struct
+    {
+        // When set, this indicates the hardware has data that needs to be read.
+        u32  int_status           :1;
+        // see TOUCH_STS_REG_INT_TYPE
+        u32  int_type             :4;
+        // see TOUCH_STS_REG_PWR_STATE
+        u32  pwr_state            :2;
+        // see TOUCH_STS_REG_INIT_STATE
+        u32  init_state           :2;
+        // Busy bit indicates that sensor cannot accept writes at this time
+        u32  busy                :1;
+        // Reserved
+        u32  reserved            :14;
+        // Synchronization bit, should always be TOUCH_SYNC_BYTE_VALUE
+        u32  sync_byte            :8;
+    } fields;
+} touch_sts_reg_t;
+C_ASSERT(sizeof(touch_sts_reg_t) == 4);
+
+
+//
+// Offset 04h: TOUCH_FRAME_CHAR: Frame Characteristics Register
+// This registers describes the characteristics of each data frame read by the SPI Controller in
+// response to a touch interrupt.
+//
+#define TOUCH_FRAME_CHAR_REG_OFFSET         0x04
+
+typedef union touch_frame_char_reg
+{
+    u32  reg_value;
+
+    struct
+    {
+        // Micro-Frame Size (MFS):  Indicates the size of a touch micro-frame in byte increments.
+        // When a micro-frame is to be read for processing (in data mode), this is the total number of
+        // bytes that must be read per interrupt, split into multiple read commands no longer than RPS.
+        // Maximum micro-frame size is 256KB.
+        u32  microframe_size      :18;
+        // Micro-Frames per Frame (MFPF): Indicates the number of micro-frames per frame. If a
+        // sensor's frame does not contain micro-frames this value will be 1. Valid values are 1-31.
+        u32  microframes_per_frame :5;
+        // Micro-Frame Index (MFI): Indicates the index of the micro-frame within a frame. This allows
+        // the SPI Controller to maintain synchronization with the sensor and determine when the final
+        // micro-frame has arrived. Valid values are 1-31.
+        u32  microframe_index     :5;
+        // HID/Raw Data: This bit describes whether the data from the sensor is Raw data or a HID
+        // report. When set, the data is a HID report.
+        u32  hid_report           :1;
+        // Reserved
+        u32  reserved            :3;
+    } fields;
+} touch_frame_char_reg_t;
+C_ASSERT(sizeof(touch_frame_char_reg_t) == 4);
+
+
+//
+// Offset 08h: Touch Error Register
+//
+#define TOUCH_ERR_REG_OFFSET                0x08
+
+// bit definition is vendor specific
+typedef union touch_err_reg
+{
+    u32  reg_value;
+
+    struct
+    {
+        u32  invalid_fw           :1;
+        u32  invalid_data        :1;
+        u32  self_test_failed       :1;
+        u32  reserved            :12;
+        u32  fatal_error          :1;
+        u32  vendor_errors        :16;
+    } fields;
+} touch_err_reg_t;
+C_ASSERT(sizeof(touch_err_reg_t) == 4);
+
+
+//
+// Offset 0Ch: RESERVED
+// This register is reserved for future use.
+//
+
+
+//
+// Offset 10h: Touch Identification Register
+//
+#define TOUCH_ID_REG_OFFSET                 0x10
+
+#define TOUCH_ID_REG_VALUE                  0x43495424
+
+// expected value is "$TIC" or 0x43495424
+typedef u32  touch_id_reg_t;
+C_ASSERT(sizeof(touch_id_reg_t) == 4);
+
+
+//
+// Offset 14h: TOUCH_DATA_SZ: Touch Data Size Register
+// This register describes the maximum size of frames and feedback data
+//
+#define TOUCH_DATA_SZ_REG_OFFSET            0x14
+
+#define TOUCH_MAX_FRAME_SIZE_INCREMENT      64
+#define TOUCH_MAX_FEEDBACK_SIZE_INCREMENT   64
+
+#define TOUCH_SENSOR_MAX_FRAME_SIZE         (32 * 1024)     // Max allowed frame size 32KB
+#define TOUCH_SENSOR_MAX_FEEDBACK_SIZE      (16 * 1024)     // Max allowed feedback size 16KB
+
+typedef union touch_data_sz_reg
+{
+    u32  reg_value;
+
+    struct
+    {
+        // This value describes the maximum frame size in 64byte increments.
+        u32  max_frame_size        :12;
+        // This value describes the maximum feedback size in 64byte increments.
+        u32  max_feedback_size     :8;
+        // Reserved
+        u32  reserved            :12;
+    } fields;
+} touch_data_sz_reg_t;
+C_ASSERT(sizeof(touch_data_sz_reg_t) == 4);
+
+
+//
+// Offset 18h: TOUCH_CAPABILITIES: Touch Capabilities Register
+// This register informs the host as to the capabilities of the touch IC.
+//
+#define TOUCH_CAPS_REG_OFFSET               0x18
+
+typedef enum touch_caps_reg_read_delay_time
+{
+    TOUCH_CAPS_REG_READ_DELAY_TIME_0,
+    TOUCH_CAPS_REG_READ_DELAY_TIME_10uS,
+    TOUCH_CAPS_REG_READ_DELAY_TIME_50uS,
+    TOUCH_CAPS_REG_READ_DELAY_TIME_100uS,
+    TOUCH_CAPS_REG_READ_DELAY_TIME_150uS,
+    TOUCH_CAPS_REG_READ_DELAY_TIME_250uS,
+    TOUCH_CAPS_REG_READ_DELAY_TIME_500uS,
+    TOUCH_CAPS_REG_READ_DELAY_TIME_1mS,
+} touch_caps_reg_read_delay_time_t;
+C_ASSERT(sizeof(touch_caps_reg_read_delay_time_t) == 4);
+
+#define TOUCH_BULK_DATA_MAX_WRITE_INCREMENT 64
+
+typedef union touch_caps_reg
+{
+    u32  reg_value;
+
+    struct
+    {
+        // Reserved for future frequency
+        u32  reserved0           :1;
+        // 17 MHz (14 MHz on Atom) Supported: 0b - Not supported, 1b - Supported
+        u32  supported_17Mhz      :1;
+        // 30 MHz (25MHz on Atom) Supported: 0b - Not supported, 1b - Supported
+        u32  supported_30Mhz      :1;
+        // 50 MHz Supported: 0b - Not supported, 1b - Supported
+        u32  supported_50Mhz      :1;
+        // Reserved
+        u32  reserved1           :4;
+        // Single I/O Supported: 0b - Not supported, 1b - Supported
+        u32  supported_single_io   :1;
+        // Dual I/O Supported: 0b - Not supported, 1b - Supported
+        u32  supported_dual_io     :1;
+        // Quad I/O Supported: 0b - Not supported, 1b - Supported
+        u32  supported_quad_io     :1;
+        // Bulk Data Area Max Write Size: The amount of data the SPI Controller can write to the bulk
+        // data area before it has to poll the busy bit. This field is in multiples of 64 bytes. The
+        // SPI Controller will write the amount of data specified in this field, then check and wait
+        // for the Status.Busy bit to be zero before writing the next data chunk. This field is 6 bits
+        // long, allowing for 4KB of contiguous writes w/o a poll of the busy bit. If this field is
+        // 0x00 the Touch IC has no limit in the amount of data the SPI Controller can write to the
+        // bulk data area.
+        u32  bulk_data_max_write    :6;
+        // Read Delay Timer Value: This field describes the delay the SPI Controller will initiate when
+        // a read interrupt follows a write data command. Uses values from TOUCH_CAPS_REG_READ_DELAY_TIME
+        u32  read_delay_timer_value :3;
+        // Reserved
+        u32  reserved2           :4;
+        // Maximum Touch Points: A byte value based on the HID descriptor definition.
+        u32  max_touch_points      :8;
+    } fields;
+} touch_caps_reg_t;
+C_ASSERT(sizeof(touch_caps_reg_t) == 4);
+
+
+//
+// Offset 1Ch: TOUCH_CFG: Touch Configuration Register
+// This register allows the SPI Controller to configure the touch sensor as needed during touch
+// operations.
+//
+#define TOUCH_CFG_REG_OFFSET                0x1C
+
+typedef enum touch_cfg_reg_bulk_xfer_size
+{
+    TOUCH_CFG_REG_BULK_XFER_SIZE_4B  = 0,   // Bulk Data Transfer Size is 4 bytes
+    TOUCH_CFG_REG_BULK_XFER_SIZE_8B,        // Bulk Data Transfer Size is 8 bytes
+    TOUCH_CFG_REG_BULK_XFER_SIZE_16B,       // Bulk Data Transfer Size is 16 bytes
+    TOUCH_CFG_REG_BULK_XFER_SIZE_32B,       // Bulk Data Transfer Size is 32 bytes
+    TOUCH_CFG_REG_BULK_XFER_SIZE_64B,       // Bulk Data Transfer Size is 64 bytes
+    TOUCH_CFG_REG_BULK_XFER_SIZE_MAX
+} touch_cfg_reg_bulk_xfer_size_t;
+C_ASSERT(sizeof(touch_cfg_reg_bulk_xfer_size_t) == 4);
+
+// Frequency values used by TOUCH_CFG_REG and TOUCH_SENSOR_GET_DEVICE_INFO_RSP_DATA.
+typedef enum touch_freq
+{
+    TOUCH_FREQ_RSVD = 0,    // Reserved value
+    TOUCH_FREQ_17MHZ,       // Sensor set for 17MHz operation (14MHz on Atom)
+    TOUCH_FREQ_30MHZ,       // Sensor set for 30MHz operation (25MHz on Atom)
+    TOUCH_FREQ_MAX          // Invalid value
+} touch_freq_t;
+C_ASSERT(sizeof(touch_freq_t) == 4);
+
+typedef union touch_cfg_reg
+{
+    u32  reg_value;
+
+    struct
+    {
+        // Touch Enable (TE):  This bit is used as a HW semaphore for the Touch IC to guarantee to the
+        // SPI Controller to that (when 0) no sensing operations will occur and only the Reset
+        // interrupt will be generated. When TE is cleared by the SPI Controller:
+        //  - TICs must flush all output buffers
+        //  - TICs must De-assert any pending interrupt
+        //  - ME must throw away any partial frame and pending interrupt must be cleared/not serviced.
+        // The SPI Controller will only modify the configuration of the TIC when TE is cleared. TE is
+        // defaulted to 0h on a power-on reset.
+        u32  touch_enable         :1;
+        // Data/HID Packet Mode (DHPM): Raw Data Mode: 0h, HID Packet Mode: 1h
+        u32  dhpm                :1;
+        // Bulk Data Transfer Size: This field represents the amount of data written to the Bulk Data
+        // Area (SPI Offset 0x1000-0x2FFF) in a single SPI write protocol
+        u32  bulk_xfer_size        :4;
+        // Frequency Select: Frequency for the TouchIC to run at. Use values from TOUCH_FREQ
+        u32  freq_select          :3;
+        // Reserved
+        u32  reserved            :23;
+    } fields;
+} touch_cfg_reg_t;
+C_ASSERT(sizeof(touch_cfg_reg_t) == 4);
+
+
+//
+// Offset 20h: TOUCH_CMD: Touch Command Register
+// This register is used for sending commands to the Touch IC.
+//
+#define TOUCH_CMD_REG_OFFSET                0x20
+
+typedef enum touch_cmd_reg_code
+{
+    TOUCH_CMD_REG_CODE_NOP = 0,             // No Operation
+    TOUCH_CMD_REG_CODE_SOFT_RESET,          // Soft Reset
+    TOUCH_CMD_REG_CODE_PREP_4_READ,         // Prepare All Registers for Read
+    TOUCH_CMD_REG_CODE_GEN_TEST_PACKETS,    // Generate Test Packets according to value in TOUCH_TEST_CTRL_REG
+    TOUCH_CMD_REG_CODE_MAX
+} touch_cmd_reg_code_t;
+C_ASSERT(sizeof(touch_cmd_reg_code_t) == 4);
+
+typedef union touch_cmd_reg
+{
+    u32  reg_value;
+
+    struct
+    {
+        // Command Code: See TOUCH_CMD_REG_CODE
+        u32  command_code :8;
+        // Reserved
+        u32  reserved    :24;
+    } fields;
+} touch_cmd_reg_t;
+C_ASSERT(sizeof(touch_cmd_reg_t) == 4);
+
+
+//
+// Offset 24h: Power Management Control
+// This register is used for active power management. The Touch IC is allowed to mover from Doze or
+// Armed to Sensing after a touch has occurred. All other transitions will be made at the request
+// of the SPI Controller.
+//
+#define TOUCH_PWR_MGMT_CTRL_REG_OFFSET      0x24
+
+typedef enum touch_pwr_mgmt_ctrl_reg_cmd
+{
+    TOUCH_PWR_MGMT_CTRL_REG_CMD_NOP = 0,    // No change to power state
+    TOUCH_PWR_MGMT_CTRL_REG_CMD_SLEEP,      // Sleep   - set when the system goes into connected standby
+    TOUCH_PWR_MGMT_CTRL_REG_CMD_DOZE,       // Doze    - set after 300 seconds of inactivity
+    TOUCH_PWR_MGMT_CTRL_REG_CMD_ARMED,      // Armed   - Set by FW when a "finger off" message is received from the EUs
+    TOUCH_PWR_MGMT_CTRL_REG_CMD_SENSING,    // Sensing - not typically set by FW
+    TOUCH_PWR_MGMT_CTRL_REG_CMD_MAX         // Values will result in no change to the power state of the Touch IC
+} touch_pwr_mgmt_ctrl_reg_cmd_t;
+C_ASSERT(sizeof(touch_pwr_mgmt_ctrl_reg_cmd_t) == 4);
+
+typedef union touch_pwr_mgmt_ctrl_reg
+{
+    u32  reg_value;
+
+    struct
+    {
+        // Power State Command: See TOUCH_PWR_MGMT_CTRL_REG_CMD
+        u32  pwr_state_cmd         :3;
+        // Reserved
+        u32  reserved            :29;
+    } fields;
+} touch_pwr_mgmt_ctrl_reg_t;
+C_ASSERT(sizeof(touch_pwr_mgmt_ctrl_reg_t) == 4);
+
+
+//
+// Offset 28h: Vendor HW Information Register
+// This register is used to relay Intel-assigned vendor ID information to the SPI Controller, which
+// may be forwarded to SW running on the host CPU.
+//
+#define TOUCH_VEN_HW_INFO_REG_OFFSET        0x28
+
+typedef union touch_ven_hw_info_reg
+{
+    u32  reg_value;
+
+    struct
+    {
+        // Touch Sensor Vendor ID
+        u32  vendor_id            :16;
+        // Touch Sensor Device ID
+        u32  device_id            :16;
+    } fields;
+} touch_ven_hw_info_reg_t;
+C_ASSERT(sizeof(touch_ven_hw_info_reg_t) == 4);
+
+
+//
+// Offset 2Ch: HW Revision ID Register
+// This register is used to relay vendor HW revision information to the SPI Controller which may be
+// forwarded to SW running on the host CPU.
+//
+#define TOUCH_HW_REV_REG_OFFSET             0x2C
+
+typedef u32  touch_hw_rev_reg_t;   // bit definition is vendor specific
+C_ASSERT(sizeof(touch_hw_rev_reg_t) == 4);
+
+
+//
+// Offset 30h: FW Revision ID Register
+// This register is used to relay vendor FW revision information to the SPI Controller which may be
+// forwarded to SW running on the host CPU.
+//
+#define TOUCH_FW_REV_REG_OFFSET             0x30
+
+typedef u32  touch_fw_rev_reg_t;    // bit definition is vendor specific
+C_ASSERT(sizeof(touch_fw_rev_reg_t) == 4);
+
+
+//
+// Offset 34h: Compatibility Revision ID Register
+// This register is used to relay vendor compatibility information to the SPI Controller which may
+// be forwarded to SW running on the host CPU. Compatibility Information is a numeric value given
+// by Intel to the Touch IC vendor based on the major and minor revision of the EDS supported. From
+// a nomenclature point of view in an x.y revision number of the EDS, the major version is the value
+// of x and the minor version is the value of y. For example, a Touch IC supporting an EDS version
+// of 0.61 would contain a major version of 0 and a minor version of 61 in the register.
+//
+#define TOUCH_COMPAT_REV_REG_OFFSET             0x34
+
+typedef union touch_compat_rev_reg
+{
+    u32  reg_value;
+
+    struct
+    {
+        // EDS Minor Revision
+        u8   minor;
+        // EDS Major Revision
+        u8   major;
+        // Interface Revision Number (from EDS)
+        u8   intf_rev;
+        // EU Kernel Compatibility Version - vendor specific value
+        u8   kernel_compat_ver;
+    } fields;
+} touch_compat_rev_reg_t;
+C_ASSERT(sizeof(touch_compat_rev_reg_t) == 4);
+
+
+//
+// Touch Register Block is the full set of registers from offset 0x00h to 0x3F
+// This is the entire set of registers needed for normal touch operation. It does not include test
+// registers such as TOUCH_TEST_CTRL_REG
+//
+#define TOUCH_REG_BLOCK_OFFSET              TOUCH_STS_REG_OFFSET
+
+typedef struct touch_reg_block
+{
+    touch_sts_reg_t         sts_reg;         // 0x00
+    touch_frame_char_reg_t  frame_char_reg;   // 0x04
+    touch_err_reg_t         error_reg;       // 0x08
+    u32                  reserved0;      // 0x0C
+    touch_id_reg_t          id_reg;          // 0x10
+    touch_data_sz_reg_t     data_size_reg;    // 0x14
+    touch_caps_reg_t        caps_reg;        // 0x18
+    touch_cfg_reg_t         cfg_reg;         // 0x1C
+    touch_cmd_reg_t         cmd_reg;         // 0x20
+    touch_pwr_mgmt_ctrl_reg_t  pwm_mgme_ctrl_reg; // 0x24
+    touch_ven_hw_info_reg_t ven_hw_info_reg;   // 0x28
+    touch_hw_rev_reg_t      hw_rev_reg;       // 0x2C
+    touch_fw_rev_reg_t      fw_rev_reg;       // 0x30
+    touch_compat_rev_reg_t  compat_rev_reg;   // 0x34
+    u32                  reserved1;      // 0x38
+    u32                  reserved2;      // 0x3C
+} touch_reg_block_t;
+C_ASSERT(sizeof(touch_reg_block_t) == 64);
+
+
+//
+// Offset 40h: Test Control Register
+// This register
+//
+#define TOUCH_TEST_CTRL_REG_OFFSET              0x40
+
+typedef union touch_test_ctrl_reg
+{
+    u32  reg_value;
+
+    struct
+    {
+        // Size of Test Frame in Raw Data Mode: This field specifies the test frame size in raw data
+        // mode in multiple of 64 bytes. For example, if this field value is 16, the test frame size
+        // will be 16x64 = 1K.
+        u32  raw_test_frame_size    :16;
+        // Number of Raw Data Frames or HID Report Packets Generation. This field represents the number
+        // of test frames or HID reports to be generated when test mode is enabled. When multiple
+        // packets/frames are generated, they need be generated at 100 Hz frequency, i.e. 10ms per
+        // packet/frame.
+        u32  num_test_frames       :16;
+    } fields;
+} touch_test_ctrl_reg_t;
+C_ASSERT(sizeof(touch_test_ctrl_reg_t) == 4);
+
+
+//
+// Offsets 0x000 to 0xFFF are reserved for Intel-defined Registers
+//
+#define TOUCH_REGISTER_LIMIT                0xFFF
+
+
+//
+// Data Window: Address 0x1000-0x1FFFF
+// The data window is reserved for writing and reading large quantities of data to and from the
+// sensor.
+//
+#define TOUCH_DATA_WINDOW_OFFSET            0x1000
+#define TOUCH_DATA_WINDOW_LIMIT             0x1FFFF
+
+#define TOUCH_SENSOR_MAX_OFFSET             TOUCH_DATA_WINDOW_LIMIT
+
+
+//
+// The following data structures represent the headers defined in the Data Structures chapter of the
+// Intel Integrated Touch EDS
+//
+
+// Enumeration used in TOUCH_RAW_DATA_HDR
+typedef enum touch_raw_data_types
+{
+    TOUCH_RAW_DATA_TYPE_FRAME = 0,
+    TOUCH_RAW_DATA_TYPE_ERROR,          // RawData will be the TOUCH_ERROR struct below
+    TOUCH_RAW_DATA_TYPE_VENDOR_DATA,    // Set when InterruptType is Vendor Data
+    TOUCH_RAW_DATA_TYPE_HID_REPORT,
+    TOUCH_RAW_DATA_TYPE_GET_FEATURES,
+    TOUCH_RAW_DATA_TYPE_MAX
+} touch_raw_data_types_t;
+C_ASSERT(sizeof(touch_raw_data_types_t) == 4);
+
+// Private data structure. Kernels must copy to HID driver buffer
+typedef struct touch_hid_private_data
+{
+    u32  transaction_id;
+    u8   reserved[28];
+} touch_hid_private_data_t;
+C_ASSERT(sizeof(touch_hid_private_data_t) == 32);
+
+// This is the data structure sent from the PCH FW to the EU kernel
+typedef struct touch_raw_data_hdr
+{
+    u32                  data_type;           // use values from TOUCH_RAW_DATA_TYPES
+    u32                  raw_data_size_bytes;   // The size in bytes of the raw data read from the
+                                                // sensor, does not include TOUCH_RAW_DATA_HDR. Will
+                                                // be the sum of all uFrames, or size of TOUCH_ERROR
+                                                // for if DataType is TOUCH_RAW_DATA_TYPE_ERROR
+    u32                  buffer_id;           // An ID to qualify with the feedback data to track
+                                                // buffer usage
+    u32                  protocol_ver;        // Must match protocol version of the EDS
+    u8                   kernel_compat_id;     // Copied from the Compatibility Revision ID Reg
+    u8                   reserved[15];       // Padding to extend header to full 64 bytes and
+                                                // allow for growth
+    touch_hid_private_data_t  hid_private_data;     // Private data structure. Kernels must copy to HID
+                                                // driver buffer
+} touch_raw_data_hdr_t;
+C_ASSERT(sizeof(touch_raw_data_hdr_t) == 64);
+
+typedef struct touch_raw_data
+{
+    touch_raw_data_hdr_t  header;
+    u8               raw_data[1]; // used to access the raw data as an array and keep the
+                                    // compilers happy. Actual size of this array is
+                                    // Header.RawDataSizeBytes
+} touch_raw_data_t;
+
+
+// The following section describes the data passed in TOUCH_RAW_DATA.RawData when DataType equals
+// TOUCH_RAW_DATA_TYPE_ERROR
+// Note: This data structure is also applied to HID mode
+typedef enum touch_err_types
+{
+    TOUCH_RAW_DATA_ERROR = 0,
+    TOUCH_RAW_ERROR_MAX
+} touch_err_types_t;
+C_ASSERT(sizeof(touch_err_types_t) == 4);
+
+typedef union touch_me_fw_error
+{
+    u32  value;
+
+    struct
+    {
+        u32 invalid_frame_characteristics : 1;
+        u32 microframe_index_invalid      : 1;
+        u32 reserved                    : 30;
+    } fields;
+} touch_me_fw_error_t;
+C_ASSERT(sizeof(touch_me_fw_error_t) == 4);
+
+typedef struct touch_error
+{
+    u8			touch_error_type; // This must be a value from TOUCH_ERROR_TYPES
+    u8			reserved[3];
+    touch_me_fw_error_t	touch_me_fw_error;
+    touch_err_reg_t	touch_error_register; // Contains the value copied from the Touch Error Reg
+} touch_error_t;
+C_ASSERT(sizeof(touch_error_t) == 12);
+
+// Enumeration used in TOUCH_FEEDBACK_BUFFER
+typedef enum touch_feedback_cmd_types
+{
+    TOUCH_FEEDBACK_CMD_TYPE_NONE = 0,
+    TOUCH_FEEDBACK_CMD_TYPE_SOFT_RESET,
+    TOUCH_FEEDBACK_CMD_TYPE_GOTO_ARMED,
+    TOUCH_FEEDBACK_CMD_TYPE_GOTO_SENSING,
+    TOUCH_FEEDBACK_CMD_TYPE_GOTO_SLEEP,
+    TOUCH_FEEDBACK_CMD_TYPE_GOTO_DOZE,
+    TOUCH_FEEDBACK_CMD_TYPE_HARD_RESET,
+    TOUCH_FEEDBACK_CMD_TYPE_MAX
+} touch_feedback_cmd_types_t;
+C_ASSERT(sizeof(touch_feedback_cmd_types_t) == 4);
+
+// Enumeration used in TOUCH_FEEDBACK_HDR
+typedef enum touch_feedback_data_types
+{
+    TOUCH_FEEDBACK_DATA_TYPE_FEEDBACK = 0,  // This is vendor specific feedback to be written to the sensor
+    TOUCH_FEEDBACK_DATA_TYPE_SET_FEATURES,  // This is a set features command to be written to the sensor
+    TOUCH_FEEDBACK_DATA_TYPE_GET_FEATURES,  // This is a get features command to be written to the sensor
+    TOUCH_FEEDBACK_DATA_TYPE_OUTPUT_REPORT, // This is a HID output report to be written to the sensor
+    TOUCH_FEEDBACK_DATA_TYPE_STORE_DATA,    // This is calibration data to be written to system flash
+    TOUCH_FEEDBACK_DATA_TYPE_MAX
+} touch_feedback_data_types_t;
+C_ASSERT(sizeof(touch_feedback_data_types_t) == 4);
+
+// This is the data structure sent from the EU kernels back to the ME FW.
+// In addition to "feedback" data, the FW can execute a "command" described by the command type parameter.
+// Any payload data will always be sent to the TIC first, then any command will be issued.
+typedef struct touch_feedback_hdr
+{
+    u32  feedback_cmd_type;    // use values from TOUCH_FEEDBACK_CMD_TYPES
+    u32  payload_size_bytes;   // The amount of data to be written to the sensor, not including the header
+    u32  buffer_id;           // The ID of the raw data buffer that generated this feedback data
+    u32  protocol_ver;        // Must match protocol version of the EDS
+    u32  feedback_data_type;   // use values from TOUCH_FEEDBACK_DATA_TYPES. This is not relevant if PayloadSizeBytes is 0
+    u32  spi_offest;          // The offset from TOUCH_DATA_WINDOW_OFFSET at which to write the Payload data. Maximum offset is 0x1EFFF.
+    u8   reserved[40];       // Padding to extend header to full 64 bytes and allow for growth
+} touch_feedback_hdr_t;
+C_ASSERT(sizeof(touch_feedback_hdr_t) == 64);
+
+typedef struct touch_feedback_buffer
+{
+    touch_feedback_hdr_t  Header;
+    u8               feedback_data[1];    // used to access the feedback data as an array and keep the compilers happy. Actual size of this array is Header.PayloadSizeBytes
+} touch_feedback_buffer_t;
+
+
+//
+// This data structure describes the header prepended to all data
+// written to the touch IC at the bulk data write (TOUCH_DATA_WINDOW_OFFSET + TOUCH_FEEDBACK_HDR.SpiOffest) address.
+typedef enum touch_write_data_type
+{
+    TOUCH_WRITE_DATA_TYPE_FW_LOAD = 0,
+    TOUCH_WRITE_DATA_TYPE_DATA_LOAD,
+    TOUCH_WRITE_DATA_TYPE_FEEDBACK,
+    TOUCH_WRITE_DATA_TYPE_SET_FEATURES,
+    TOUCH_WRITE_DATA_TYPE_GET_FEATURES,
+    TOUCH_WRITE_DATA_TYPE_OUTPUT_REPORT,
+    TOUCH_WRITE_DATA_TYPE_NO_DATA_USE_DEFAULTS,
+    TOUCH_WRITE_DATA_TYPE_MAX
+} touch_write_data_type_t;
+C_ASSERT(sizeof(touch_write_data_type_t) == 4);
+
+typedef struct touch_write_hdr
+{
+    u32  write_data_type;   // Use values from TOUCH_WRITE_DATA_TYPE
+    u32  write_data_len;    // This field designates the amount of data to follow
+} touch_write_hdr_t;
+C_ASSERT(sizeof(touch_write_hdr_t) == 8);
+
+typedef struct touch_write_data
+{
+    touch_write_hdr_t header;
+    u8           write_data[1];   // used to access the write data as an array and keep the compilers happy. Actual size of this array is Header.WriteDataLen
+} touch_write_data_t;
+
+#pragma pack()
+
+#endif // _TOUCH_SENSOR_REGS_H
diff --git a/drivers/misc/ipts/ipts-state.h b/drivers/misc/ipts/ipts-state.h
new file mode 100644
index 000000000000..39a2eaf5f004
--- /dev/null
+++ b/drivers/misc/ipts/ipts-state.h
@@ -0,0 +1,29 @@
+/*
+ * Intel Precise Touch & Stylus state codes
+ *
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#ifndef _IPTS_STATE_H_
+#define _IPTS_STATE_H_
+
+/* ipts driver states */
+typedef enum ipts_state {
+	IPTS_STA_NONE,
+	IPTS_STA_INIT,
+	IPTS_STA_RESOURCE_READY,
+	IPTS_STA_HID_STARTED,
+	IPTS_STA_RAW_DATA_STARTED,
+	IPTS_STA_STOPPING
+} ipts_state_t;
+
+#endif // _IPTS_STATE_H_
diff --git a/drivers/misc/ipts/ipts.h b/drivers/misc/ipts/ipts.h
new file mode 100644
index 000000000000..9c34b55ff036
--- /dev/null
+++ b/drivers/misc/ipts/ipts.h
@@ -0,0 +1,200 @@
+/*
+ *
+ * Intel Management Engine Interface (Intel MEI) Client Driver for IPTS
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ */
+
+#ifndef _IPTS_H_
+#define _IPTS_H_
+
+#include <linux/types.h>
+#include <linux/mei_cl_bus.h>
+#include <linux/hid.h>
+#include <linux/intel_ipts_if.h>
+
+#include "ipts-mei-msgs.h"
+#include "ipts-state.h"
+#include "ipts-binary-spec.h"
+
+#define ENABLE_IPTS_DEBUG		/* enable IPTS debug */
+
+#ifdef ENABLE_IPTS_DEBUG
+
+#define ipts_info(ipts, format, arg...) do {\
+	dev_info(&ipts->cldev->dev, format, ##arg);\
+} while (0)
+
+#define ipts_dbg(ipts, format, arg...) do {\
+	dev_info(&ipts->cldev->dev, format, ##arg);\
+} while (0)
+
+//#define RUN_DBG_THREAD
+
+#else
+
+#define ipts_info(ipts, format, arg...) do {} while(0);
+#define ipts_dbg(ipts, format, arg...) do {} while(0);
+
+#endif
+
+#define ipts_err(ipts, format, arg...) do {\
+	dev_err(&ipts->cldev->dev, format, ##arg);\
+} while (0)
+
+#define HID_PARALLEL_DATA_BUFFERS	TOUCH_SENSOR_MAX_DATA_BUFFERS
+
+#define IPTS_MAX_RETRY			3
+
+typedef struct ipts_buffer_info {
+	char *addr;
+	dma_addr_t dma_addr;
+} ipts_buffer_info_t;
+
+typedef struct ipts_gfx_info {
+	u64     gfx_handle;
+	intel_ipts_ops_t ipts_ops;
+} ipts_gfx_info_t;
+
+typedef struct ipts_resource {
+	/* ME & Gfx resource */
+	ipts_buffer_info_t touch_data_buffer_raw[HID_PARALLEL_DATA_BUFFERS];
+	ipts_buffer_info_t touch_data_buffer_hid;
+
+	ipts_buffer_info_t feedback_buffer[HID_PARALLEL_DATA_BUFFERS];
+
+	ipts_buffer_info_t hid2me_buffer;
+	u32 hid2me_buffer_size;
+
+	u8 wq_item_size;
+	intel_ipts_wq_info_t wq_info;
+
+	/* ME2HID buffer */
+	char *me2hid_buffer;
+
+	/* Gfx specific resource */
+	ipts_buffer_info_t raw_data_mode_output_buffer
+	    [HID_PARALLEL_DATA_BUFFERS][MAX_NUM_OUTPUT_BUFFERS];
+
+	int num_of_outputs;
+
+	bool default_resource_ready;
+	bool raw_data_resource_ready;
+} ipts_resource_t;
+
+typedef struct ipts_info {
+	struct mei_cl_device *cldev;
+	struct hid_device *hid;
+
+	struct work_struct init_work;
+	struct work_struct raw_data_work;
+	struct work_struct gfx_status_work;
+
+	struct task_struct *event_loop;
+
+#if IS_ENABLED(CONFIG_DEBUG_FS)
+        struct dentry *dbgfs_dir;
+#endif
+
+	ipts_state_t	state;
+
+	touch_sensor_mode_t	sensor_mode;
+	touch_sensor_get_device_info_rsp_data_t device_info;
+	ipts_resource_t	resource;
+	u8		hid_input_report[HID_MAX_BUFFER_SIZE];
+	int		num_of_parallel_data_buffers;
+	bool		hid_desc_ready;
+
+	int current_buffer_index;
+	int last_buffer_completed;
+	int *last_submitted_id;
+
+	ipts_gfx_info_t gfx_info;
+	u64		kernel_handle;
+	int             gfx_status;
+	bool		display_status;
+
+	bool		switch_sensor_mode;
+	touch_sensor_mode_t	new_sensor_mode;
+
+	int		retry;
+	bool		restart;
+} ipts_info_t;
+
+#if IS_ENABLED(CONFIG_DEBUG_FS)
+int ipts_dbgfs_register(ipts_info_t *ipts, const char *name);
+void ipts_dbgfs_deregister(ipts_info_t *ipts);
+#else
+static int ipts_dbgfs_register(ipts_info_t *ipts, const char *name);
+static void ipts_dbgfs_deregister(ipts_info_t *ipts);
+#endif /* CONFIG_DEBUG_FS */
+
+/* inline functions */
+static inline void ipts_set_state(ipts_info_t *ipts, ipts_state_t state)
+{
+	ipts->state = state;
+}
+
+static inline ipts_state_t ipts_get_state(const ipts_info_t *ipts)
+{
+	return ipts->state;
+}
+
+static inline bool ipts_is_default_resource_ready(const ipts_info_t *ipts)
+{
+	return ipts->resource.default_resource_ready;
+}
+
+static inline bool ipts_is_raw_data_resource_ready(const ipts_info_t *ipts)
+{
+	return ipts->resource.raw_data_resource_ready;
+}
+
+static inline ipts_buffer_info_t* ipts_get_feedback_buffer(ipts_info_t *ipts,
+								int buffer_idx)
+{
+	return &ipts->resource.feedback_buffer[buffer_idx];
+}
+
+static inline ipts_buffer_info_t* ipts_get_touch_data_buffer_hid(ipts_info_t *ipts)
+{
+	return &ipts->resource.touch_data_buffer_hid;
+}
+
+static inline ipts_buffer_info_t* ipts_get_output_buffers_by_parallel_id(
+							ipts_info_t *ipts,
+                                                        int parallel_idx)
+{
+	return &ipts->resource.raw_data_mode_output_buffer[parallel_idx][0];
+}
+
+static inline ipts_buffer_info_t* ipts_get_hid2me_buffer(ipts_info_t *ipts)
+{
+	return &ipts->resource.hid2me_buffer;
+}
+
+static inline void ipts_set_wq_item_size(ipts_info_t *ipts, u8 size)
+{
+	ipts->resource.wq_item_size = size;
+}
+
+static inline u8 ipts_get_wq_item_size(const ipts_info_t *ipts)
+{
+	return ipts->resource.wq_item_size;
+}
+
+static inline int ipts_get_num_of_parallel_buffers(const ipts_info_t *ipts)
+{
+	return ipts->num_of_parallel_data_buffers;
+}
+
+#endif // _IPTS_H_
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index c09f8bb49495..a3740901988e 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -59,6 +59,7 @@
 
 #define MEI_DEV_ID_SPT        0x9D3A  /* Sunrise Point */
 #define MEI_DEV_ID_SPT_2      0x9D3B  /* Sunrise Point 2 */
+#define MEI_DEV_ID_SPT_4      0x9D3E  /* Sunrise Point 4 */
 #define MEI_DEV_ID_SPT_H      0xA13A  /* Sunrise Point H */
 #define MEI_DEV_ID_SPT_H_2    0xA13B  /* Sunrise Point H 2 */
 
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 3a2eadcd0378..28973f96f956 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -77,6 +77,7 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
 
 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT, MEI_ME_PCH8_CFG)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, MEI_ME_PCH8_CFG)},
+	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_4, MEI_ME_PCH8_CFG)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, MEI_ME_PCH8_SPS_CFG)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, MEI_ME_PCH8_SPS_CFG)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH12_CFG)},
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index c381d14dea20..c3d68aeec587 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -629,103 +629,6 @@ config THINKPAD_ACPI_HOTKEY_POLL
 	  If you are not sure, say Y here.  The driver enables polling only if
 	  it is strictly necessary to do so.
 
-config SURFACE_ACPI
-	depends on ACPI
-	tristate "Microsoft Surface ACPI/Platform Drivers"
-	---help---
-	  ACPI and platform drivers for Microsoft Surface devices.
-
-config SURFACE_ACPI_SSH
-	bool "Surface Serial Hub Driver"
-	depends on SURFACE_ACPI
-	depends on X86_INTEL_LPSS
-	depends on SERIAL_8250_DW
-	depends on SERIAL_8250_DMA
-	depends on SERIAL_DEV_CTRL_TTYPORT
-	select CRC_CCITT
-	default y
-	---help---
-	  Surface Serial Hub driver for 5th generation (or later) Microsoft
-	  Surface devices.
-
-	  This is the base driver for the embedded serial controller found on
-	  5th generation (and later) Microsoft Surface devices (e.g. Book 2,
-	  Laptop, Laptop 2, Pro 2017, Pro 6, ...). This driver itself only
-	  provides access to the embedded controller and subsequent drivers are
-	  required for the respective functionalities.
-
-	  If you have a 5th generation (or later) Microsoft Surface device, say
-	  Y or M here.
-
-config SURFACE_ACPI_SSH_DEBUG_DEVICE
-	bool "Surface Serial Hub Debug Device"
-	depends on SURFACE_ACPI_SSH
-	default n
-	---help---
-	  Debug device for direct communication with the embedded controller
-	  found on 5th generation (and later) Microsoft Surface devices (e.g.
-	  Book 2, Laptop, Laptop 2, Pro 2017, Pro 6, ...) via sysfs.
-
-	  If you are not sure, say N here.
-
-config SURFACE_ACPI_SAN
-	bool "Surface ACPI Notify Driver"
-	depends on SURFACE_ACPI_SSH
-	default y
-	---help---
-	  Surface ACPI Notify driver for 5th generation (or later) Microsoft
-	  Surface devices.
-
-	  This driver enables basic ACPI events and requests, such as battery
-	  status requests/events, thermal events, lid status, and possibly more,
-	  which would otherwise not work on these devices.
-
-	  If you are not sure, say Y here.
-
-config SURFACE_ACPI_VHF
-	bool "Surface Virtual HID Framework Driver"
-	depends on SURFACE_ACPI_SSH
-	depends on HID
-	default y
-	---help---
-	  Surface Virtual HID Framework driver for 5th generation (or later)
-	  Microsoft Surface devices.
-
-	  This driver provides support for the Microsoft Virtual HID framework,
-	  which is required for the Surface Laptop (1 and newer) keyboard.
-
-	  If you are not sure, say Y here.
-
-config SURFACE_ACPI_DTX
-	bool "Surface Detachment System (DTX) Driver"
-	depends on SURFACE_ACPI_SSH
-	depends on INPUT
-	default y
-	---help---
-	  Surface Detachment System (DTX) driver for the Microsoft Surface Book
-	  2. This driver provides support for proper detachment handling in
-	  user-space, status-events relating to the base and support for
-	  the safe-guard keeping the base attached when the discrete GPU
-	  contained in it is running via the special /dev/surface-dtx device.
-
-	  Also provides a standard input device to provide SW_TABLET_MODE events
-	  upon device mode change.
-
-	  If you are not sure, say Y here.
-
-config SURFACE_ACPI_SID
-	bool "Surface Platform Integration Driver"
-	depends on SURFACE_ACPI_SSH
-	default y
-	---help---
-	  Surface Platform Integration Driver for the Microsoft Surface Devices.
-	  Currently only supports the Surface Book 2. This driver provides suport
-	  for setting performance-modes via the perf_mode sysfs attribute.
-	  Performance-modes directly influence the fan-profile of the device,
-	  allowing to choose between higher performance or quieter operation.
-
-	  If you are not sure, say Y here.
-
 config SENSORS_HDAPS
 	tristate "Thinkpad Hard Drive Active Protection System (hdaps)"
 	depends on INPUT
@@ -1448,6 +1351,7 @@ config PCENGINES_APU2
 	  will be called pcengines-apuv2.
 
 source "drivers/platform/x86/intel_speed_select_if/Kconfig"
+source "drivers/platform/x86/surface_sam/Kconfig"
 
 endif # X86_PLATFORM_DEVICES
 
diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
index 5c88172c0649..705525ff99a7 100644
--- a/drivers/platform/x86/Makefile
+++ b/drivers/platform/x86/Makefile
@@ -39,7 +39,6 @@ obj-$(CONFIG_TC1100_WMI)	+= tc1100-wmi.o
 obj-$(CONFIG_SONY_LAPTOP)	+= sony-laptop.o
 obj-$(CONFIG_IDEAPAD_LAPTOP)	+= ideapad-laptop.o
 obj-$(CONFIG_THINKPAD_ACPI)	+= thinkpad_acpi.o
-obj-$(CONFIG_SURFACE_ACPI)	+= surface_acpi.o
 obj-$(CONFIG_SENSORS_HDAPS)	+= hdaps.o
 obj-$(CONFIG_FUJITSU_LAPTOP)	+= fujitsu-laptop.o
 obj-$(CONFIG_FUJITSU_TABLET)	+= fujitsu-tablet.o
@@ -103,3 +102,4 @@ obj-$(CONFIG_I2C_MULTI_INSTANTIATE)	+= i2c-multi-instantiate.o
 obj-$(CONFIG_INTEL_ATOMISP2_PM)	+= intel_atomisp2_pm.o
 obj-$(CONFIG_PCENGINES_APU2)	+= pcengines-apuv2.o
 obj-$(CONFIG_INTEL_SPEED_SELECT_INTERFACE) += intel_speed_select_if/
+obj-$(CONFIG_SURFACE_SAM)	+= surface_sam/
diff --git a/drivers/platform/x86/surface_acpi.c b/drivers/platform/x86/surface_acpi.c
deleted file mode 100644
index 633fd8929037..000000000000
--- a/drivers/platform/x86/surface_acpi.c
+++ /dev/null
@@ -1,4010 +0,0 @@
-#include <asm/unaligned.h>
-#include <linux/acpi.h>
-#include <linux/completion.h>
-#include <linux/crc-ccitt.h>
-#include <linux/delay.h>
-#include <linux/device.h>
-#include <linux/dmaengine.h>
-#include <linux/dmi.h>
-#include <linux/fs.h>
-#include <linux/hid.h>
-#include <linux/input.h>
-#include <linux/ioctl.h>
-#include <linux/jiffies.h>
-#include <linux/kernel.h>
-#include <linux/kfifo.h>
-#include <linux/miscdevice.h>
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/mutex.h>
-#include <linux/platform_device.h>
-#include <linux/pm.h>
-#include <linux/poll.h>
-#include <linux/rculist.h>
-#include <linux/refcount.h>
-#include <linux/serdev.h>
-#include <linux/spinlock.h>
-#include <linux/sysfs.h>
-#include <linux/types.h>
-#include <linux/workqueue.h>
-
-
-#define USB_VENDOR_ID_MICROSOFT				0x045e
-#define USB_DEVICE_ID_MS_VHF				0xf001
-#define USB_DEVICE_ID_MS_SURFACE_BASE_2_INTEGRATION	0x0922
-
-#define SG5_PARAM_PERM		(S_IRUGO | S_IWUSR)
-
-
-/*************************************************************************
- * Surface Serial Hub driver (cross-driver interface)
- */
-
-#ifdef CONFIG_SURFACE_ACPI_SSH
-
-/*
- * Maximum request payload size in bytes.
- * Value based on ACPI (255 bytes minus header/status bytes).
- */
-#define SURFACEGEN5_MAX_RQST_PAYLOAD	(255 - 10)
-
-/*
- * Maximum response payload size in bytes.
- * Value based on ACPI (255 bytes minus header/status bytes).
- */
-#define SURFACEGEN5_MAX_RQST_RESPONSE	(255 - 4)
-
-#define SURFACEGEN5_RQID_EVENT_BITS	5
-
-#define SURFACEGEN5_EVENT_IMMEDIATE	((unsigned long) -1)
-
-
-struct surfacegen5_buf {
-	u8 cap;
-	u8 len;
-	u8 *data;
-};
-
-struct surfacegen5_rqst {
-	u8 tc;
-	u8 iid;
-	u8 cid;
-	u8 snc;
-	u8 cdl;
-	u8 *pld;
-};
-
-struct surfacegen5_event {
-	u16 rqid;
-	u8  tc;
-	u8  iid;
-	u8  cid;
-	u8  len;
-	u8 *pld;
-};
-
-
-typedef int (*surfacegen5_ec_event_handler_fn)(struct surfacegen5_event *event, void *data);
-typedef unsigned long (*surfacegen5_ec_event_handler_delay)(struct surfacegen5_event *event, void *data);
-
-int surfacegen5_ec_consumer_register(struct device *consumer);
-
-int surfacegen5_ec_rqst(const struct surfacegen5_rqst *rqst, struct surfacegen5_buf *result);
-
-int surfacegen5_ec_enable_event_source(u8 tc, u8 unknown, u16 rqid);
-int surfacegen5_ec_disable_event_source(u8 tc, u8 unknown, u16 rqid);
-int surfacegen5_ec_remove_event_handler(u16 rqid);
-int surfacegen5_ec_set_event_handler(u16 rqid, surfacegen5_ec_event_handler_fn fn, void *data);
-int surfacegen5_ec_set_delayed_event_handler(u16 rqid,
-		surfacegen5_ec_event_handler_fn fn,
-		surfacegen5_ec_event_handler_delay delay, void *data);
-
-#endif /* CONFIG_SURFACE_ACPI_SSH */
-
-
-/*************************************************************************
- * Surface Serial Hub Debug Device (cross-driver interface)
- */
-
-#ifdef CONFIG_SURFACE_ACPI_SSH
-
-int surfacegen5_ssh_sysfs_register(struct device *dev);
-void surfacegen5_ssh_sysfs_unregister(struct device *dev);
-
-#endif /* CONFIG_SURFACE_ACPI_SSH */
-
-
-/*************************************************************************
- * Surface Serial Hub driver (private implementation)
- */
-
-#ifdef CONFIG_SURFACE_ACPI_SSH
-
-#define SG5_RQST_TAG_FULL		"surfacegen5_ec_rqst: "
-#define SG5_RQST_TAG			"rqst: "
-#define SG5_EVENT_TAG			"event: "
-#define SG5_RECV_TAG			"recv: "
-
-#define SG5_SUPPORTED_FLOW_CONTROL_MASK		(~((u8) ACPI_UART_FLOW_CONTROL_HW))
-
-#define SG5_BYTELEN_SYNC		2
-#define SG5_BYTELEN_TERM		2
-#define SG5_BYTELEN_CRC			2
-#define SG5_BYTELEN_CTRL		4	// command-header, ACK, or RETRY
-#define SG5_BYTELEN_CMDFRAME		8	// without payload
-
-#define SG5_MAX_WRITE (                 \
-	  SG5_BYTELEN_SYNC              \
-	+ SG5_BYTELEN_CTRL              \
-	+ SG5_BYTELEN_CRC               \
-	+ SG5_BYTELEN_CMDFRAME          \
-	+ SURFACEGEN5_MAX_RQST_PAYLOAD  \
-	+ SG5_BYTELEN_CRC               \
-)
-
-#define SG5_MSG_LEN_CTRL (              \
-	  SG5_BYTELEN_SYNC              \
-	+ SG5_BYTELEN_CTRL              \
-	+ SG5_BYTELEN_CRC               \
-	+ SG5_BYTELEN_TERM              \
-)
-
-#define SG5_MSG_LEN_CMD_BASE (          \
-	  SG5_BYTELEN_SYNC              \
-	+ SG5_BYTELEN_CTRL              \
-	+ SG5_BYTELEN_CRC               \
-	+ SG5_BYTELEN_CRC               \
-)	// without payload and command-frame
-
-#define SG5_WRITE_TIMEOUT		msecs_to_jiffies(1000)
-#define SG5_READ_TIMEOUT		msecs_to_jiffies(1000)
-#define SG5_NUM_RETRY			3
-
-#define SG5_WRITE_BUF_LEN		SG5_MAX_WRITE
-#define SG5_READ_BUF_LEN		512		// must be power of 2
-#define SG5_EVAL_BUF_LEN		SG5_MAX_WRITE	// also works for reading
-
-#define SG5_FRAME_TYPE_CMD		0x80
-#define SG5_FRAME_TYPE_ACK		0x40
-#define SG5_FRAME_TYPE_RETRY		0x04
-
-#define SG5_FRAME_OFFS_CTRL		SG5_BYTELEN_SYNC
-#define SG5_FRAME_OFFS_CTRL_CRC		(SG5_FRAME_OFFS_CTRL + SG5_BYTELEN_CTRL)
-#define SG5_FRAME_OFFS_TERM		(SG5_FRAME_OFFS_CTRL_CRC + SG5_BYTELEN_CRC)
-#define SG5_FRAME_OFFS_CMD		SG5_FRAME_OFFS_TERM	// either TERM or CMD
-#define SG5_FRAME_OFFS_CMD_PLD		(SG5_FRAME_OFFS_CMD + SG5_BYTELEN_CMDFRAME)
-
-/*
- * A note on Request IDs (RQIDs):
- * 	0x0000 is not a valid RQID
- * 	0x0001 is valid, but reserved for Surface Laptop keyboard events
- */
-#define SG5_NUM_EVENT_TYPES		((1 << SURFACEGEN5_RQID_EVENT_BITS) - 1)
-
-/*
- * Sync:			aa 55
- * Terminate:			ff ff
- *
- * Request Message:		sync cmd-hdr crc(cmd-hdr) cmd-rqst-frame crc(cmd-rqst-frame)
- * Ack Message:			sync ack crc(ack) terminate
- * Retry Message:		sync retry crc(retry) terminate
- * Response Message:		sync cmd-hdr crc(cmd-hdr) cmd-resp-frame crc(cmd-resp-frame)
- *
- * Command Header:		80 LEN 00 SEQ
- * Ack:                 	40 00 00 SEQ
- * Retry:			04 00 00 00
- * Command Request Frame:	80 RTC 01 00 RIID RQID RCID PLD
- * Command Response Frame:	80 RTC 00 01 RIID RQID RCID PLD
- */
-
-struct surfacegen5_frame_ctrl {
-	u8 type;
-	u8 len;			// without crc
-	u8 pad;
-	u8 seq;
-} __packed;
-
-struct surfacegen5_frame_cmd {
-	u8 type;
-	u8 tc;
-	u8 unknown1;
-	u8 unknown2;
-	u8 iid;
-	u8 rqid_lo;		// id for request/response matching (low byte)
-	u8 rqid_hi;		// id for request/response matching (high byte)
-	u8 cid;
-} __packed;
-
-
-enum surfacegen5_ec_state {
-	SG5_EC_UNINITIALIZED,
-	SG5_EC_INITIALIZED,
-	SG5_EC_SUSPENDED,
-};
-
-struct surfacegen5_ec_counters {
-	u8  seq;		// control sequence id
-	u16 rqid;		// id for request/response matching
-};
-
-struct surfacegen5_ec_writer {
-	u8 *data;
-	u8 *ptr;
-} __packed;
-
-enum surfacegen5_ec_receiver_state {
-	SG5_RCV_DISCARD,
-	SG5_RCV_CONTROL,
-	SG5_RCV_COMMAND,
-};
-
-struct surfacegen5_ec_receiver {
-	spinlock_t        lock;
-	enum surfacegen5_ec_receiver_state state;
-	struct completion signal;
-	struct kfifo      fifo;
-	struct {
-		bool pld;
-		u8   seq;
-		u16  rqid;
-	} expect;
-	struct {
-		u16 cap;
-		u16 len;
-		u8 *ptr;
-	} eval_buf;
-};
-
-struct surfacegen5_ec_event_handler {
-	surfacegen5_ec_event_handler_fn handler;
-	surfacegen5_ec_event_handler_delay delay;
-	void *data;
-};
-
-struct surfacegen5_ec_events {
-	spinlock_t lock;
-	struct workqueue_struct *queue_ack;
-	struct workqueue_struct *queue_evt;
-	struct surfacegen5_ec_event_handler handler[SG5_NUM_EVENT_TYPES];
-};
-
-struct surfacegen5_ec {
-	struct mutex                   lock;
-	enum surfacegen5_ec_state      state;
-	struct serdev_device          *serdev;
-	struct surfacegen5_ec_counters counter;
-	struct surfacegen5_ec_writer   writer;
-	struct surfacegen5_ec_receiver receiver;
-	struct surfacegen5_ec_events   events;
-};
-
-struct surfacegen5_fifo_packet {
-	u8 type;	// packet type (ACK/RETRY/CMD)
-	u8 seq;
-	u8 len;
-};
-
-struct surfacegen5_event_work {
-	refcount_t               refcount;
-	struct surfacegen5_ec   *ec;
-	struct work_struct       work_ack;
-	struct delayed_work      work_evt;
-	struct surfacegen5_event event;
-	u8                       seq;
-};
-
-
-static struct surfacegen5_ec surfacegen5_ec = {
-	.lock   = __MUTEX_INITIALIZER(surfacegen5_ec.lock),
-	.state  = SG5_EC_UNINITIALIZED,
-	.serdev = NULL,
-	.counter = {
-		.seq  = 0,
-		.rqid = 0,
-	},
-	.writer = {
-		.data = NULL,
-		.ptr  = NULL,
-	},
-	.receiver = {
-		.lock = __SPIN_LOCK_UNLOCKED(),
-		.state = SG5_RCV_DISCARD,
-		.expect = {},
-	},
-	.events = {
-		.lock = __SPIN_LOCK_UNLOCKED(),
-		.handler = {},
-	}
-};
-
-
-static int surfacegen5_ec_rqst_unlocked(struct surfacegen5_ec *ec,
-                                 const struct surfacegen5_rqst *rqst,
-				 struct surfacegen5_buf *result);
-
-
-inline static struct surfacegen5_ec *surfacegen5_ec_acquire(void)
-{
-	struct surfacegen5_ec *ec = &surfacegen5_ec;
-
-	mutex_lock(&ec->lock);
-	return ec;
-}
-
-inline static void surfacegen5_ec_release(struct surfacegen5_ec *ec)
-{
-	mutex_unlock(&ec->lock);
-}
-
-inline static struct surfacegen5_ec *surfacegen5_ec_acquire_init(void)
-{
-	struct surfacegen5_ec *ec = surfacegen5_ec_acquire();
-
-	if (ec->state == SG5_EC_UNINITIALIZED) {
-		surfacegen5_ec_release(ec);
-		return NULL;
-	}
-
-	return ec;
-}
-
-int surfacegen5_ec_consumer_register(struct device *consumer)
-{
-	u32 flags = DL_FLAG_PM_RUNTIME | DL_FLAG_AUTOREMOVE_CONSUMER;
-	struct surfacegen5_ec *ec;
-	struct device_link *link;
-
-	ec = surfacegen5_ec_acquire_init();
-	if (!ec) {
-		return -ENXIO;
-	}
-
-	link = device_link_add(consumer, &ec->serdev->dev, flags);
-	if (!link) {
-		return -EFAULT;
-	}
-
-	surfacegen5_ec_release(ec);
-	return 0;
-}
-
-
-inline static u16 surfacegen5_rqid_to_rqst(u16 rqid) {
-	return rqid << SURFACEGEN5_RQID_EVENT_BITS;
-}
-
-inline static bool surfacegen5_rqid_is_event(u16 rqid) {
-	const u16 mask = (1 << SURFACEGEN5_RQID_EVENT_BITS) - 1;
-	return rqid != 0 && (rqid | mask) == mask;
-}
-
-int surfacegen5_ec_enable_event_source(u8 tc, u8 unknown, u16 rqid)
-{
-	struct surfacegen5_ec *ec;
-
-	u8 pld[4] = { tc, unknown, rqid & 0xff, rqid >> 8 };
-	u8 buf[1] = { 0x00 };
-
-	struct surfacegen5_rqst rqst = {
-		.tc  = 0x01,
-		.iid = 0x00,
-		.cid = 0x0b,
-		.snc = 0x01,
-		.cdl = 0x04,
-		.pld = pld,
-	};
-
-	struct surfacegen5_buf result = {
-		result.cap = ARRAY_SIZE(buf),
-		result.len = 0,
-		result.data = buf,
-	};
-
-	int status;
-
-	// only allow RQIDs that lie within event spectrum
-	if (!surfacegen5_rqid_is_event(rqid)) {
-		return -EINVAL;
-	}
-
-	ec = surfacegen5_ec_acquire_init();
-	if (!ec) {
-		printk(KERN_WARNING SG5_RQST_TAG_FULL "embedded controller is uninitialized\n");
-		return -ENXIO;
-	}
-
-	if (ec->state == SG5_EC_SUSPENDED) {
-		dev_warn(&ec->serdev->dev, SG5_RQST_TAG "embedded controller is suspended\n");
-
-		surfacegen5_ec_release(ec);
-		return -EPERM;
-	}
-
-	status = surfacegen5_ec_rqst_unlocked(ec, &rqst, &result);
-
-	if (buf[0] != 0x00) {
-		dev_warn(&ec->serdev->dev,
-		         "unexpected result while enabling event source: 0x%02x\n",
-			 buf[0]);
-	}
-
-	surfacegen5_ec_release(ec);
-	return status;
-
-}
-
-int surfacegen5_ec_disable_event_source(u8 tc, u8 unknown, u16 rqid)
-{
-	struct surfacegen5_ec *ec;
-
-	u8 pld[4] = { tc, unknown, rqid & 0xff, rqid >> 8 };
-	u8 buf[1] = { 0x00 };
-
-	struct surfacegen5_rqst rqst = {
-		.tc  = 0x01,
-		.iid = 0x00,
-		.cid = 0x0c,
-		.snc = 0x01,
-		.cdl = 0x04,
-		.pld = pld,
-	};
-
-	struct surfacegen5_buf result = {
-		result.cap = ARRAY_SIZE(buf),
-		result.len = 0,
-		result.data = buf,
-	};
-
-	int status;
-
-	// only allow RQIDs that lie within event spectrum
-	if (!surfacegen5_rqid_is_event(rqid)) {
-		return -EINVAL;
-	}
-
-	ec = surfacegen5_ec_acquire_init();
-	if (!ec) {
-		printk(KERN_WARNING SG5_RQST_TAG_FULL "embedded controller is uninitialized\n");
-		return -ENXIO;
-	}
-
-	if (ec->state == SG5_EC_SUSPENDED) {
-		dev_warn(&ec->serdev->dev, SG5_RQST_TAG "embedded controller is suspended\n");
-
-		surfacegen5_ec_release(ec);
-		return -EPERM;
-	}
-
-	status = surfacegen5_ec_rqst_unlocked(ec, &rqst, &result);
-
-	if (buf[0] != 0x00) {
-		dev_warn(&ec->serdev->dev,
-		         "unexpected result while disabling event source: 0x%02x\n",
-			 buf[0]);
-	}
-
-	surfacegen5_ec_release(ec);
-	return status;
-}
-
-int surfacegen5_ec_set_delayed_event_handler(
-		u16 rqid, surfacegen5_ec_event_handler_fn fn,
-		surfacegen5_ec_event_handler_delay delay,
-		void *data)
-{
-	struct surfacegen5_ec *ec;
-	unsigned long flags;
-
-	if (!surfacegen5_rqid_is_event(rqid)) {
-		return -EINVAL;
-	}
-
-	ec = surfacegen5_ec_acquire_init();
-	if (!ec) {
-		return -ENXIO;
-	}
-
-	spin_lock_irqsave(&ec->events.lock, flags);
-
-	// 0 is not a valid event RQID
-	ec->events.handler[rqid - 1].handler = fn;
-	ec->events.handler[rqid - 1].delay = delay;
-	ec->events.handler[rqid - 1].data = data;
-
-	spin_unlock_irqrestore(&ec->events.lock, flags);
-	surfacegen5_ec_release(ec);
-
-	return 0;
-}
-
-int surfacegen5_ec_set_event_handler(
-		u16 rqid, surfacegen5_ec_event_handler_fn fn, void *data)
-{
-	return surfacegen5_ec_set_delayed_event_handler(rqid, fn, NULL, data);
-}
-
-int surfacegen5_ec_remove_event_handler(u16 rqid)
-{
-	struct surfacegen5_ec *ec;
-	unsigned long flags;
-
-	if (!surfacegen5_rqid_is_event(rqid)) {
-		return -EINVAL;
-	}
-
-	ec = surfacegen5_ec_acquire_init();
-	if (!ec) {
-		return -ENXIO;
-	}
-
-	spin_lock_irqsave(&ec->events.lock, flags);
-
-	// 0 is not a valid event RQID
-	ec->events.handler[rqid - 1].handler = NULL;
-	ec->events.handler[rqid - 1].delay = NULL;
-	ec->events.handler[rqid - 1].data = NULL;
-
-	spin_unlock_irqrestore(&ec->events.lock, flags);
-	surfacegen5_ec_release(ec);
-
-	/*
-	 * Make sure that the handler is not in use any more after we've
-	 * removed it.
-	 */
-	flush_workqueue(ec->events.queue_evt);
-
-	return 0;
-}
-
-
-inline static u16 surfacegen5_ssh_crc(const u8 *buf, size_t size)
-{
-	return crc_ccitt_false(0xffff, buf, size);
-}
-
-inline static void surfacegen5_ssh_write_u16(struct surfacegen5_ec_writer *writer, u16 in)
-{
-	put_unaligned_le16(in, writer->ptr);
-	writer->ptr += 2;
-}
-
-inline static void surfacegen5_ssh_write_crc(struct surfacegen5_ec_writer *writer,
-                                             const u8 *buf, size_t size)
-{
-	surfacegen5_ssh_write_u16(writer, surfacegen5_ssh_crc(buf, size));
-}
-
-inline static void surfacegen5_ssh_write_syn(struct surfacegen5_ec_writer *writer)
-{
-	u8 *w = writer->ptr;
-
-	*w++ = 0xaa;
-	*w++ = 0x55;
-
-	writer->ptr = w;
-}
-
-inline static void surfacegen5_ssh_write_ter(struct surfacegen5_ec_writer *writer)
-{
-	u8 *w = writer->ptr;
-
-	*w++ = 0xff;
-	*w++ = 0xff;
-
-	writer->ptr = w;
-}
-
-inline static void surfacegen5_ssh_write_buf(struct surfacegen5_ec_writer *writer,
-                                             u8 *in, size_t len)
-{
-	writer->ptr = memcpy(writer->ptr, in, len) + len;
-}
-
-inline static void surfacegen5_ssh_write_hdr(struct surfacegen5_ec_writer *writer,
-                                             const struct surfacegen5_rqst *rqst,
-                                             struct surfacegen5_ec *ec)
-{
-	struct surfacegen5_frame_ctrl *hdr = (struct surfacegen5_frame_ctrl *)writer->ptr;
-	u8 *begin = writer->ptr;
-
-	hdr->type = SG5_FRAME_TYPE_CMD;
-	hdr->len  = SG5_BYTELEN_CMDFRAME + rqst->cdl;	// without CRC
-	hdr->pad  = 0x00;
-	hdr->seq  = ec->counter.seq;
-
-	writer->ptr += sizeof(*hdr);
-
-	surfacegen5_ssh_write_crc(writer, begin, writer->ptr - begin);
-}
-
-inline static void surfacegen5_ssh_write_cmd(struct surfacegen5_ec_writer *writer,
-                                             const struct surfacegen5_rqst *rqst,
-                                             struct surfacegen5_ec *ec)
-{
-	struct surfacegen5_frame_cmd *cmd = (struct surfacegen5_frame_cmd *)writer->ptr;
-	u8 *begin = writer->ptr;
-
-	u16 rqid = surfacegen5_rqid_to_rqst(ec->counter.rqid);
-	u8 rqid_lo = rqid & 0xFF;
-	u8 rqid_hi = rqid >> 8;
-
-	cmd->type     = SG5_FRAME_TYPE_CMD;
-	cmd->tc       = rqst->tc;
-	cmd->unknown1 = 0x01;
-	cmd->unknown2 = 0x00;
-	cmd->iid      = rqst->iid;
-	cmd->rqid_lo  = rqid_lo;
-	cmd->rqid_hi  = rqid_hi;
-	cmd->cid      = rqst->cid;
-
-	writer->ptr += sizeof(*cmd);
-
-	surfacegen5_ssh_write_buf(writer, rqst->pld, rqst->cdl);
-	surfacegen5_ssh_write_crc(writer, begin, writer->ptr - begin);
-}
-
-inline static void surfacegen5_ssh_write_ack(struct surfacegen5_ec_writer *writer, u8 seq)
-{
-	struct surfacegen5_frame_ctrl *ack = (struct surfacegen5_frame_ctrl *)writer->ptr;
-	u8 *begin = writer->ptr;
-
-	ack->type = SG5_FRAME_TYPE_ACK;
-	ack->len  = 0x00;
-	ack->pad  = 0x00;
-	ack->seq  = seq;
-
-	writer->ptr += sizeof(*ack);
-
-	surfacegen5_ssh_write_crc(writer, begin, writer->ptr - begin);
-}
-
-inline static void surfacegen5_ssh_writer_reset(struct surfacegen5_ec_writer *writer)
-{
-	writer->ptr = writer->data;
-}
-
-inline static int surfacegen5_ssh_writer_flush(struct surfacegen5_ec *ec)
-{
-	struct surfacegen5_ec_writer *writer = &ec->writer;
-	struct serdev_device *serdev = ec->serdev;
-	int status;
-
-	size_t len = writer->ptr - writer->data;
-
-	dev_dbg(&ec->serdev->dev, "sending message\n");
-	print_hex_dump_debug("send: ", DUMP_PREFIX_OFFSET, 16, 1,
-	                     writer->data, writer->ptr - writer->data, false);
-
-	status = serdev_device_write(serdev, writer->data, len, SG5_WRITE_TIMEOUT);
-	return status >= 0 ? 0 : status;
-}
-
-inline static void surfacegen5_ssh_write_msg_cmd(struct surfacegen5_ec *ec,
-                                                 const struct surfacegen5_rqst *rqst)
-{
-	surfacegen5_ssh_writer_reset(&ec->writer);
-	surfacegen5_ssh_write_syn(&ec->writer);
-	surfacegen5_ssh_write_hdr(&ec->writer, rqst, ec);
-	surfacegen5_ssh_write_cmd(&ec->writer, rqst, ec);
-}
-
-inline static void surfacegen5_ssh_write_msg_ack(struct surfacegen5_ec *ec, u8 seq)
-{
-	surfacegen5_ssh_writer_reset(&ec->writer);
-	surfacegen5_ssh_write_syn(&ec->writer);
-	surfacegen5_ssh_write_ack(&ec->writer, seq);
-	surfacegen5_ssh_write_ter(&ec->writer);
-}
-
-inline static void surfacegen5_ssh_receiver_restart(struct surfacegen5_ec *ec,
-                                                    const struct surfacegen5_rqst *rqst)
-{
-	unsigned long flags;
-
-	spin_lock_irqsave(&ec->receiver.lock, flags);
-	reinit_completion(&ec->receiver.signal);
-	ec->receiver.state = SG5_RCV_CONTROL;
-	ec->receiver.expect.pld = rqst->snc;
-	ec->receiver.expect.seq = ec->counter.seq;
-	ec->receiver.expect.rqid = surfacegen5_rqid_to_rqst(ec->counter.rqid);
-	ec->receiver.eval_buf.len = 0;
-	spin_unlock_irqrestore(&ec->receiver.lock, flags);
-}
-
-inline static void surfacegen5_ssh_receiver_discard(struct surfacegen5_ec *ec)
-{
-	unsigned long flags;
-
-	spin_lock_irqsave(&ec->receiver.lock, flags);
-	ec->receiver.state = SG5_RCV_DISCARD;
-	ec->receiver.eval_buf.len = 0;
-	kfifo_reset(&ec->receiver.fifo);
-	spin_unlock_irqrestore(&ec->receiver.lock, flags);
-}
-
-static int surfacegen5_ec_rqst_unlocked(struct surfacegen5_ec *ec,
-                                 const struct surfacegen5_rqst *rqst,
-				 struct surfacegen5_buf *result)
-{
-	struct device *dev = &ec->serdev->dev;
-	struct surfacegen5_fifo_packet packet = {};
-	int status;
-	int try;
-	unsigned int rem;
-
-	if (rqst->cdl > SURFACEGEN5_MAX_RQST_PAYLOAD) {
-		dev_err(dev, SG5_RQST_TAG "request payload too large\n");
-		return -EINVAL;
-	}
-
-	// write command in buffer, we may need it multiple times
-	surfacegen5_ssh_write_msg_cmd(ec, rqst);
-	surfacegen5_ssh_receiver_restart(ec, rqst);
-
-	// send command, try to get an ack response
-	for (try = 0; try < SG5_NUM_RETRY; try++) {
-		status = surfacegen5_ssh_writer_flush(ec);
-		if (status) {
-			goto ec_rqst_out;
-		}
-
-		rem = wait_for_completion_timeout(&ec->receiver.signal, SG5_READ_TIMEOUT);
-		if (rem) {
-			// completion assures valid packet, thus ignore returned length
-			(void) !kfifo_out(&ec->receiver.fifo, &packet, sizeof(packet));
-
-			if (packet.type == SG5_FRAME_TYPE_ACK) {
-				break;
-			}
-		}
-	}
-
-	// check if we ran out of tries?
-	if (try >= SG5_NUM_RETRY) {
-		dev_err(dev, SG5_RQST_TAG "communication failed %d times, giving up\n", try);
-		status = -EIO;
-		goto ec_rqst_out;
-	}
-
-	ec->counter.seq  += 1;
-	ec->counter.rqid += 1;
-
-	// get command response/payload
-	if (rqst->snc && result) {
-		rem = wait_for_completion_timeout(&ec->receiver.signal, SG5_READ_TIMEOUT);
-		if (rem) {
-			// completion assures valid packet, thus ignore returned length
-			(void) !kfifo_out(&ec->receiver.fifo, &packet, sizeof(packet));
-
-			if (result->cap < packet.len) {
-				status = -EINVAL;
-				goto ec_rqst_out;
-			}
-
-			// completion assures valid packet, thus ignore returned length
-			(void) !kfifo_out(&ec->receiver.fifo, result->data, packet.len);
-			result->len = packet.len;
-		} else {
-			dev_err(dev, SG5_RQST_TAG "communication timed out\n");
-			status = -EIO;
-			goto ec_rqst_out;
-		}
-
-		// send ACK
-		surfacegen5_ssh_write_msg_ack(ec, packet.seq);
-		status = surfacegen5_ssh_writer_flush(ec);
-		if (status) {
-			goto ec_rqst_out;
-		}
-	}
-
-ec_rqst_out:
-	surfacegen5_ssh_receiver_discard(ec);
-	return status;
-}
-
-int surfacegen5_ec_rqst(const struct surfacegen5_rqst *rqst, struct surfacegen5_buf *result)
-{
-	struct surfacegen5_ec *ec;
-	int status;
-
-	ec = surfacegen5_ec_acquire_init();
-	if (!ec) {
-		printk(KERN_WARNING SG5_RQST_TAG_FULL "embedded controller is uninitialized\n");
-		return -ENXIO;
-	}
-
-	if (ec->state == SG5_EC_SUSPENDED) {
-		dev_warn(&ec->serdev->dev, SG5_RQST_TAG "embedded controller is suspended\n");
-
-		surfacegen5_ec_release(ec);
-		return -EPERM;
-	}
-
-	status = surfacegen5_ec_rqst_unlocked(ec, rqst, result);
-
-	surfacegen5_ec_release(ec);
-	return status;
-}
-
-
-static int surfacegen5_ssh_ec_resume(struct surfacegen5_ec *ec)
-{
-	u8 buf[1] = { 0x00 };
-
-	struct surfacegen5_rqst rqst = {
-		.tc  = 0x01,
-		.iid = 0x00,
-		.cid = 0x16,
-		.snc = 0x01,
-		.cdl = 0x00,
-		.pld = NULL,
-	};
-
-	struct surfacegen5_buf result = {
-		result.cap = ARRAY_SIZE(buf),
-		result.len = 0,
-		result.data = buf,
-	};
-
-	int status = surfacegen5_ec_rqst_unlocked(ec, &rqst, &result);
-	if (status) {
-		return status;
-	}
-
-	if (buf[0] != 0x00) {
-		dev_warn(&ec->serdev->dev,
-		         "unexpected result while trying to resume EC: 0x%02x\n",
-			 buf[0]);
-	}
-
-	return 0;
-}
-
-static int surfacegen5_ssh_ec_suspend(struct surfacegen5_ec *ec)
-{
-	u8 buf[1] = { 0x00 };
-
-	struct surfacegen5_rqst rqst = {
-		.tc  = 0x01,
-		.iid = 0x00,
-		.cid = 0x15,
-		.snc = 0x01,
-		.cdl = 0x00,
-		.pld = NULL,
-	};
-
-	struct surfacegen5_buf result = {
-		result.cap = ARRAY_SIZE(buf),
-		result.len = 0,
-		result.data = buf,
-	};
-
-	int status = surfacegen5_ec_rqst_unlocked(ec, &rqst, &result);
-	if (status) {
-		return status;
-	}
-
-	if (buf[0] != 0x00) {
-		dev_warn(&ec->serdev->dev,
-		         "unexpected result while trying to suspend EC: 0x%02x\n",
-			 buf[0]);
-	}
-
-	return 0;
-}
-
-
-inline static bool surfacegen5_ssh_is_valid_syn(const u8 *ptr)
-{
-	return ptr[0] == 0xaa && ptr[1] == 0x55;
-}
-
-inline static bool surfacegen5_ssh_is_valid_ter(const u8 *ptr)
-{
-	return ptr[0] == 0xff && ptr[1] == 0xff;
-}
-
-inline static bool surfacegen5_ssh_is_valid_crc(const u8 *begin, const u8 *end)
-{
-	u16 crc = surfacegen5_ssh_crc(begin, end - begin);
-	return (end[0] == (crc & 0xff)) && (end[1] == (crc >> 8));
-}
-
-
-static int surfacegen5_ssh_send_ack(struct surfacegen5_ec *ec, u8 seq)
-{
-	int status;
-	u8 buf[SG5_MSG_LEN_CTRL];
-	u16 crc;
-
-	buf[0] = 0xaa;
-	buf[1] = 0x55;
-	buf[2] = 0x40;
-	buf[3] = 0x00;
-	buf[4] = 0x00;
-	buf[5] = seq;
-
-	crc = surfacegen5_ssh_crc(buf + SG5_FRAME_OFFS_CTRL, SG5_BYTELEN_CTRL);
-	buf[6] = crc & 0xff;
-	buf[7] = crc >> 8;
-
-	buf[8] = 0xff;
-	buf[9] = 0xff;
-
-	dev_dbg(&ec->serdev->dev, "sending message\n");
-	print_hex_dump_debug("send: ", DUMP_PREFIX_OFFSET, 16, 1,
-	                     buf, SG5_MSG_LEN_CTRL, false);
-
-	status = serdev_device_write(ec->serdev, buf, SG5_MSG_LEN_CTRL, SG5_WRITE_TIMEOUT);
-	return status >= 0 ? 0 : status;
-}
-
-static void surfacegen5_event_work_ack_handler(struct work_struct *_work)
-{
-	struct surfacegen5_event_work *work;
-	struct surfacegen5_event *event;
-	struct surfacegen5_ec *ec;
-	struct device *dev;
-	int status;
-
-	work = container_of(_work, struct surfacegen5_event_work, work_ack);
-	event = &work->event;
-	ec = work->ec;
-	dev = &ec->serdev->dev;
-
-	// make sure we load a fresh ec state
-	smp_mb();
-
-	if (ec->state == SG5_EC_INITIALIZED) {
-		status = surfacegen5_ssh_send_ack(ec, work->seq);
-		if (status) {
-			dev_err(dev, SG5_EVENT_TAG "failed to send ACK: %d\n", status);
-		}
-	}
-
-	if (refcount_dec_and_test(&work->refcount)) {
-		kfree(work);
-	}
-}
-
-static void surfacegen5_event_work_evt_handler(struct work_struct *_work)
-{
-	struct delayed_work *dwork = (struct delayed_work *)_work;
-	struct surfacegen5_event_work *work;
-	struct surfacegen5_event *event;
-	struct surfacegen5_ec *ec;
-	struct device *dev;
-	unsigned long flags;
-
-	surfacegen5_ec_event_handler_fn handler;
-	void *handler_data;
-
-	int status = 0;
-
-	work = container_of(dwork, struct surfacegen5_event_work, work_evt);
-	event = &work->event;
-	ec = work->ec;
-	dev = &ec->serdev->dev;
-
-	spin_lock_irqsave(&ec->events.lock, flags);
-	handler       = ec->events.handler[event->rqid - 1].handler;
-	handler_data  = ec->events.handler[event->rqid - 1].data;
-	spin_unlock_irqrestore(&ec->events.lock, flags);
-
-	/*
-	 * During handler removal or driver release, we ensure every event gets
-	 * handled before return of that function. Thus a handler obtained here is
-	 * guaranteed to be valid at least until this function returns.
-	 */
-
-	if (handler) {
-		status = handler(event, handler_data);
-	} else {
-		dev_warn(dev, SG5_EVENT_TAG "unhandled event (rqid: %04x)\n", event->rqid);
-	}
-
-	if (status) {
-		dev_err(dev, SG5_EVENT_TAG "error handling event: %d\n", status);
-	}
-
-	if (refcount_dec_and_test(&work->refcount)) {
-		kfree(work);
-	}
-}
-
-static void surfacegen5_ssh_handle_event(struct surfacegen5_ec *ec, const u8 *buf)
-{
-	struct device *dev = &ec->serdev->dev;
-	const struct surfacegen5_frame_ctrl *ctrl;
-	const struct surfacegen5_frame_cmd *cmd;
-	struct surfacegen5_event_work *work;
-	unsigned long flags;
-	u16 pld_len;
-
-	surfacegen5_ec_event_handler_delay delay_fn;
-	void *handler_data;
-	unsigned long delay = 0;
-
-	ctrl = (const struct surfacegen5_frame_ctrl *)(buf + SG5_FRAME_OFFS_CTRL);
-	cmd  = (const struct surfacegen5_frame_cmd  *)(buf + SG5_FRAME_OFFS_CMD);
-
-	pld_len = ctrl->len - SG5_BYTELEN_CMDFRAME;
-
-	work = kzalloc(sizeof(struct surfacegen5_event_work) + pld_len, GFP_ATOMIC);
-	if (!work) {
-		dev_warn(dev, SG5_EVENT_TAG "failed to allocate memory, dropping event\n");
-		return;
-	}
-
-	refcount_set(&work->refcount, 2);
-	work->ec         = ec;
-	work->seq        = ctrl->seq;
-	work->event.rqid = (cmd->rqid_hi << 8) | cmd->rqid_lo;
-	work->event.tc   = cmd->tc;
-	work->event.iid  = cmd->iid;
-	work->event.cid  = cmd->cid;
-	work->event.len  = pld_len;
-	work->event.pld  = ((u8*) work) + sizeof(struct surfacegen5_event_work);
-
-	memcpy(work->event.pld, buf + SG5_FRAME_OFFS_CMD_PLD, pld_len);
-
-	INIT_WORK(&work->work_ack, surfacegen5_event_work_ack_handler);
-	queue_work(ec->events.queue_ack, &work->work_ack);
-
-	spin_lock_irqsave(&ec->events.lock, flags);
-	handler_data = ec->events.handler[work->event.rqid - 1].data;
-	delay_fn     = ec->events.handler[work->event.rqid - 1].delay;
-	if (delay_fn) {
-		delay = delay_fn(&work->event, handler_data);
-	}
-	spin_unlock_irqrestore(&ec->events.lock, flags);
-
-	// immediate execution for high priority events (e.g. keyboard)
-	if (delay == SURFACEGEN5_EVENT_IMMEDIATE) {
-		surfacegen5_event_work_evt_handler(&work->work_evt.work);
-	} else {
-		INIT_DELAYED_WORK(&work->work_evt, surfacegen5_event_work_evt_handler);
-		queue_delayed_work(ec->events.queue_evt, &work->work_evt, delay);
-	}
-}
-
-static int surfacegen5_ssh_receive_msg_ctrl(struct surfacegen5_ec *ec,
-                                            const u8 *buf, size_t size)
-{
-	struct device *dev = &ec->serdev->dev;
-	struct surfacegen5_ec_receiver *rcv = &ec->receiver;
-	const struct surfacegen5_frame_ctrl *ctrl;
-	struct surfacegen5_fifo_packet packet;
-
-	const u8 *ctrl_begin = buf + SG5_FRAME_OFFS_CTRL;
-	const u8 *ctrl_end   = buf + SG5_FRAME_OFFS_CTRL_CRC;
-
-	ctrl = (const struct surfacegen5_frame_ctrl *)(ctrl_begin);
-
-	// actual length check
-	if (size < SG5_MSG_LEN_CTRL) {
-		return 0;			// need more bytes
-	}
-
-	// validate TERM
-	if (!surfacegen5_ssh_is_valid_ter(buf + SG5_FRAME_OFFS_TERM)) {
-		dev_err(dev, SG5_RECV_TAG "invalid end of message\n");
-		return size;			// discard everything
-	}
-
-	// validate CRC
-	if (!surfacegen5_ssh_is_valid_crc(ctrl_begin, ctrl_end)) {
-		dev_err(dev, SG5_RECV_TAG "invalid checksum (ctrl)\n");
-		return SG5_MSG_LEN_CTRL;	// only discard message
-	}
-
-	// check if we expect the message
-	if (rcv->state != SG5_RCV_CONTROL) {
-		dev_err(dev, SG5_RECV_TAG "discarding message: ctrl not expected\n");
-		return SG5_MSG_LEN_CTRL;	// discard message
-	}
-
-	// check if it is for our request
-	if (ctrl->type == SG5_FRAME_TYPE_ACK && ctrl->seq != rcv->expect.seq) {
-		dev_err(dev, SG5_RECV_TAG "discarding message: ack does not match\n");
-		return SG5_MSG_LEN_CTRL;	// discard message
-	}
-
-	// we now have a valid & expected ACK/RETRY message
-	dev_dbg(dev, SG5_RECV_TAG "valid control message received (type: 0x%02x)\n", ctrl->type);
-
-	packet.type = ctrl->type;
-	packet.seq  = ctrl->seq;
-	packet.len  = 0;
-
-	if (kfifo_avail(&rcv->fifo) >= sizeof(packet)) {
-		kfifo_in(&rcv->fifo, (u8 *) &packet, sizeof(packet));
-
-	} else {
-		dev_warn(dev, SG5_RECV_TAG
-			 "dropping frame: not enough space in fifo (type = %d)\n",
-			 SG5_FRAME_TYPE_CMD);
-
-		return SG5_MSG_LEN_CTRL;	// discard message
-	}
-
-	// update decoder state
-	if (ctrl->type == SG5_FRAME_TYPE_ACK) {
-		rcv->state = rcv->expect.pld
-			? SG5_RCV_COMMAND
-			: SG5_RCV_DISCARD;
-	}
-
-	complete(&rcv->signal);
-	return SG5_MSG_LEN_CTRL;		// handled message
-}
-
-static int surfacegen5_ssh_receive_msg_cmd(struct surfacegen5_ec *ec,
-                                           const u8 *buf, size_t size)
-{
-	struct device *dev = &ec->serdev->dev;
-	struct surfacegen5_ec_receiver *rcv = &ec->receiver;
-	const struct surfacegen5_frame_ctrl *ctrl;
-	const struct surfacegen5_frame_cmd *cmd;
-	struct surfacegen5_fifo_packet packet;
-
-	const u8 *ctrl_begin     = buf + SG5_FRAME_OFFS_CTRL;
-	const u8 *ctrl_end       = buf + SG5_FRAME_OFFS_CTRL_CRC;
-	const u8 *cmd_begin      = buf + SG5_FRAME_OFFS_CMD;
-	const u8 *cmd_begin_pld  = buf + SG5_FRAME_OFFS_CMD_PLD;
-	const u8 *cmd_end;
-
-	size_t msg_len;
-
-	ctrl = (const struct surfacegen5_frame_ctrl *)(ctrl_begin);
-	cmd  = (const struct surfacegen5_frame_cmd  *)(cmd_begin);
-
-	// we need at least a full control frame
-	if (size < (SG5_BYTELEN_SYNC + SG5_BYTELEN_CTRL + SG5_BYTELEN_CRC)) {
-		return 0;		// need more bytes
-	}
-
-	// validate control-frame CRC
-	if (!surfacegen5_ssh_is_valid_crc(ctrl_begin, ctrl_end)) {
-		dev_err(dev, SG5_RECV_TAG "invalid checksum (cmd-ctrl)\n");
-		/*
-		 * We can't be sure here if length is valid, thus
-		 * discard everything.
-		 */
-		return size;
-	}
-
-	// actual length check (ctrl->len contains command-frame but not crc)
-	msg_len = SG5_MSG_LEN_CMD_BASE + ctrl->len;
-	if (size < msg_len) {
-		return 0;			// need more bytes
-	}
-
-	cmd_end = cmd_begin + ctrl->len;
-
-	// validate command-frame type
-	if (cmd->type != SG5_FRAME_TYPE_CMD) {
-		dev_err(dev, SG5_RECV_TAG "expected command frame type but got 0x%02x\n", cmd->type);
-		return size;			// discard everything
-	}
-
-	// validate command-frame CRC
-	if (!surfacegen5_ssh_is_valid_crc(cmd_begin, cmd_end)) {
-		dev_err(dev, SG5_RECV_TAG "invalid checksum (cmd-pld)\n");
-
-		/*
-		 * The message length is provided in the control frame. As we
-		 * already validated that, we can be sure here that it's
-		 * correct, so we only need to discard the message.
-		 */
-		return msg_len;
-	}
-
-	// check if we received an event notification
-	if (surfacegen5_rqid_is_event((cmd->rqid_hi << 8) | cmd->rqid_lo)) {
-		surfacegen5_ssh_handle_event(ec, buf);
-		return msg_len;			// handled message
-	}
-
-	// check if we expect the message
-	if (rcv->state != SG5_RCV_COMMAND) {
-		dev_dbg(dev, SG5_RECV_TAG "discarding message: command not expected\n");
-		return msg_len;			// discard message
-	}
-
-	// check if response is for our request
-	if (rcv->expect.rqid != (cmd->rqid_lo | (cmd->rqid_hi << 8))) {
-		dev_dbg(dev, SG5_RECV_TAG "discarding message: command not a match\n");
-		return msg_len;			// discard message
-	}
-
-	// we now have a valid & expected command message
-	dev_dbg(dev, SG5_RECV_TAG "valid command message received\n");
-
-	packet.type = ctrl->type;
-	packet.seq = ctrl->seq;
-	packet.len = cmd_end - cmd_begin_pld;
-
-	if (kfifo_avail(&rcv->fifo) >= sizeof(packet) + packet.len) {
-		kfifo_in(&rcv->fifo, &packet, sizeof(packet));
-		kfifo_in(&rcv->fifo, cmd_begin_pld, packet.len);
-
-	} else {
-		dev_warn(dev, SG5_RECV_TAG
-			 "dropping frame: not enough space in fifo (type = %d)\n",
-			 SG5_FRAME_TYPE_CMD);
-
-		return SG5_MSG_LEN_CTRL;	// discard message
-	}
-
-	rcv->state = SG5_RCV_DISCARD;
-
-	complete(&rcv->signal);
-	return msg_len;				// handled message
-}
-
-static int surfacegen5_ssh_eval_buf(struct surfacegen5_ec *ec,
-                                    const u8 *buf, size_t size)
-{
-	struct device *dev = &ec->serdev->dev;
-	struct surfacegen5_frame_ctrl *ctrl;
-
-	// we need at least a control frame to check what to do
-	if (size < (SG5_BYTELEN_SYNC + SG5_BYTELEN_CTRL)) {
-		return 0;		// need more bytes
-	}
-
-	// make sure we're actually at the start of a new message
-	if (!surfacegen5_ssh_is_valid_syn(buf)) {
-		dev_err(dev, SG5_RECV_TAG "invalid start of message\n");
-		return size;		// discard everything
-	}
-
-	// handle individual message types seperately
-	ctrl = (struct surfacegen5_frame_ctrl *)(buf + SG5_FRAME_OFFS_CTRL);
-
-	switch (ctrl->type) {
-	case SG5_FRAME_TYPE_ACK:
-	case SG5_FRAME_TYPE_RETRY:
-		return surfacegen5_ssh_receive_msg_ctrl(ec, buf, size);
-
-	case SG5_FRAME_TYPE_CMD:
-		return surfacegen5_ssh_receive_msg_cmd(ec, buf, size);
-
-	default:
-		dev_err(dev, SG5_RECV_TAG "unknown frame type 0x%02x\n", ctrl->type);
-		return size;		// discard everything
-	}
-}
-
-static int surfacegen5_ssh_receive_buf(struct serdev_device *serdev,
-                                       const unsigned char *buf, size_t size)
-{
-	struct surfacegen5_ec *ec = serdev_device_get_drvdata(serdev);
-	struct surfacegen5_ec_receiver *rcv = &ec->receiver;
-	unsigned long flags;
-	int offs = 0;
-	int used, n;
-
-	dev_dbg(&serdev->dev, SG5_RECV_TAG "received buffer (size: %zu)\n", size);
-	print_hex_dump_debug(SG5_RECV_TAG, DUMP_PREFIX_OFFSET, 16, 1, buf, size, false);
-
-	/*
-	 * The battery _BIX message gets a bit long, thus we have to add some
-	 * additional buffering here.
-	 */
-
-	spin_lock_irqsave(&rcv->lock, flags);
-
-	// copy to eval-buffer
-	used = min(size, (size_t)(rcv->eval_buf.cap - rcv->eval_buf.len));
-	memcpy(rcv->eval_buf.ptr + rcv->eval_buf.len, buf, used);
-	rcv->eval_buf.len += used;
-
-	// evaluate buffer until we need more bytes or eval-buf is empty
-	while (offs < rcv->eval_buf.len) {
-		n = rcv->eval_buf.len - offs;
-		n = surfacegen5_ssh_eval_buf(ec, rcv->eval_buf.ptr + offs, n);
-		if (n <= 0) break;	// need more bytes
-
-		offs += n;
-	}
-
-	// throw away the evaluated parts
-	rcv->eval_buf.len -= offs;
-	memmove(rcv->eval_buf.ptr, rcv->eval_buf.ptr + offs, rcv->eval_buf.len);
-
-	spin_unlock_irqrestore(&rcv->lock, flags);
-
-	return used;
-}
-
-
-static acpi_status
-surfacegen5_ssh_setup_from_resource(struct acpi_resource *resource, void *context)
-{
-	struct serdev_device *serdev = context;
-	struct acpi_resource_common_serialbus *serial;
-	struct acpi_resource_uart_serialbus *uart;
-	int status = 0;
-
-	if (resource->type != ACPI_RESOURCE_TYPE_SERIAL_BUS) {
-		return AE_OK;
-	}
-
-	serial = &resource->data.common_serial_bus;
-	if (serial->type != ACPI_RESOURCE_SERIAL_TYPE_UART) {
-		return AE_OK;
-	}
-
-	uart = &resource->data.uart_serial_bus;
-
-	// set up serdev device
-	serdev_device_set_baudrate(serdev, uart->default_baud_rate);
-
-	// serdev currently only supports RTSCTS flow control
-	if (uart->flow_control & SG5_SUPPORTED_FLOW_CONTROL_MASK) {
-		dev_warn(&serdev->dev, "unsupported flow control (value: 0x%02x)\n", uart->flow_control);
-	}
-
-	// set RTSCTS flow control
-	serdev_device_set_flow_control(serdev, uart->flow_control & ACPI_UART_FLOW_CONTROL_HW);
-
-	// serdev currently only supports EVEN/ODD parity
-	switch (uart->parity) {
-	case ACPI_UART_PARITY_NONE:
-		status = serdev_device_set_parity(serdev, SERDEV_PARITY_NONE);
-		break;
-	case ACPI_UART_PARITY_EVEN:
-		status = serdev_device_set_parity(serdev, SERDEV_PARITY_EVEN);
-		break;
-	case ACPI_UART_PARITY_ODD:
-		status = serdev_device_set_parity(serdev, SERDEV_PARITY_ODD);
-		break;
-	default:
-		dev_warn(&serdev->dev, "unsupported parity (value: 0x%02x)\n", uart->parity);
-		break;
-	}
-
-	if (status) {
-		dev_err(&serdev->dev, "failed to set parity (value: 0x%02x)\n", uart->parity);
-		return status;
-	}
-
-	return AE_CTRL_TERMINATE;       // we've found the resource and are done
-}
-
-
-static bool surfacegen5_idma_filter(struct dma_chan *chan, void *param)
-{
-	// see dw8250_idma_filter
-	return param == chan->device->dev;
-}
-
-static int surfacegen5_ssh_check_dma(struct serdev_device *serdev)
-{
-	struct device *dev = serdev->ctrl->dev.parent;
-	struct dma_chan *rx, *tx;
-	dma_cap_mask_t mask;
-	int status = 0;
-
-	/*
-	 * The EC UART requires DMA for proper communication. If we don't use DMA,
-	 * we'll drop bytes when the system has high load, e.g. during boot. This
-	 * causes some ugly behaviour, i.e. battery information (_BIX) messages
-	 * failing frequently. We're making sure the required DMA channels are
-	 * available here so serial8250_do_startup is able to grab them later
-	 * instead of silently falling back to a non-DMA approach.
-	 */
-
-	dma_cap_zero(mask);
-	dma_cap_set(DMA_SLAVE, mask);
-
-	rx = dma_request_slave_channel_compat(mask, surfacegen5_idma_filter, dev->parent, dev, "rx");
-	if (IS_ERR_OR_NULL(rx)) {
-		status = rx ? PTR_ERR(rx) : -EPROBE_DEFER;
-		if (status != -EPROBE_DEFER) {
-			dev_err(&serdev->dev, "sg5_dma: error requesting rx channel: %d\n", status);
-		} else {
-			dev_dbg(&serdev->dev, "sg5_dma: rx channel not found, deferring probe\n");
-		}
-		goto check_dma_out;
-	}
-
-	tx = dma_request_slave_channel_compat(mask, surfacegen5_idma_filter, dev->parent, dev, "tx");
-	if (IS_ERR_OR_NULL(tx)) {
-		status = tx ? PTR_ERR(tx) : -EPROBE_DEFER;
-		if (status != -EPROBE_DEFER) {
-			dev_err(&serdev->dev, "sg5_dma: error requesting tx channel: %d\n", status);
-		} else {
-			dev_dbg(&serdev->dev, "sg5_dma: tx channel not found, deferring probe\n");
-		}
-		goto check_dma_release_rx;
-	}
-
-	dma_release_channel(tx);
-check_dma_release_rx:
-	dma_release_channel(rx);
-check_dma_out:
-	return status;
-}
-
-
-static int surfacegen5_ssh_suspend(struct device *dev)
-{
-	struct surfacegen5_ec *ec;
-	int status = 0;
-
-	dev_dbg(dev, "suspending\n");
-
-	ec = surfacegen5_ec_acquire_init();
-	if (ec) {
-		status = surfacegen5_ssh_ec_suspend(ec);
-		if (status) {
-			dev_err(dev, "failed to suspend EC: %d\n", status);
-		}
-
-		ec->state = SG5_EC_SUSPENDED;
-		surfacegen5_ec_release(ec);
-	}
-
-	return status;
-}
-
-static int surfacegen5_ssh_resume(struct device *dev)
-{
-	struct surfacegen5_ec *ec;
-	int status = 0;
-
-	dev_dbg(dev, "resuming\n");
-
-	ec = surfacegen5_ec_acquire_init();
-	if (ec) {
-		ec->state = SG5_EC_INITIALIZED;
-
-		status = surfacegen5_ssh_ec_resume(ec);
-		if (status) {
-			dev_err(dev, "failed to resume EC: %d\n", status);
-		}
-
-		surfacegen5_ec_release(ec);
-	}
-
-	return status;
-}
-
-static SIMPLE_DEV_PM_OPS(surfacegen5_ssh_pm_ops, surfacegen5_ssh_suspend, surfacegen5_ssh_resume);
-
-
-static const struct serdev_device_ops surfacegen5_ssh_device_ops = {
-	.receive_buf  = surfacegen5_ssh_receive_buf,
-	.write_wakeup = serdev_device_write_wakeup,
-};
-
-static int surfacegen5_acpi_ssh_probe(struct serdev_device *serdev)
-{
-	struct surfacegen5_ec *ec;
-	struct workqueue_struct *event_queue_ack;
-	struct workqueue_struct *event_queue_evt;
-	u8 *write_buf;
-	u8 *read_buf;
-	u8 *eval_buf;
-	acpi_handle *ssh = ACPI_HANDLE(&serdev->dev);
-	acpi_status status;
-
-	dev_dbg(&serdev->dev, "probing\n");
-
-	// ensure DMA is ready before we set up the device
-	status = surfacegen5_ssh_check_dma(serdev);
-	if (status) {
-		return status;
-	}
-
-	// allocate buffers
-	write_buf = kzalloc(SG5_WRITE_BUF_LEN, GFP_KERNEL);
-	if (!write_buf) {
-		status = -ENOMEM;
-		goto err_probe_write_buf;
-	}
-
-	read_buf = kzalloc(SG5_READ_BUF_LEN, GFP_KERNEL);
-	if (!read_buf) {
-		status = -ENOMEM;
-		goto err_probe_read_buf;
-	}
-
-	eval_buf = kzalloc(SG5_EVAL_BUF_LEN, GFP_KERNEL);
-	if (!eval_buf) {
-		status = -ENOMEM;
-		goto err_probe_eval_buf;
-	}
-
-	event_queue_ack = create_singlethread_workqueue("sg5_ackq");
-	if (!event_queue_ack) {
-		status = -ENOMEM;
-		goto err_probe_ackq;
-	}
-
-	event_queue_evt = create_workqueue("sg5_evtq");
-	if (!event_queue_evt) {
-		status = -ENOMEM;
-		goto err_probe_evtq;
-	}
-
-	// set up EC
-	ec = surfacegen5_ec_acquire();
-	if (ec->state != SG5_EC_UNINITIALIZED) {
-		dev_err(&serdev->dev, "embedded controller already initialized\n");
-		surfacegen5_ec_release(ec);
-
-		status = -EBUSY;
-		goto err_probe_busy;
-	}
-
-	ec->serdev      = serdev;
-	ec->writer.data = write_buf;
-	ec->writer.ptr  = write_buf;
-
-	// initialize receiver
-	init_completion(&ec->receiver.signal);
-	kfifo_init(&ec->receiver.fifo, read_buf, SG5_READ_BUF_LEN);
-	ec->receiver.eval_buf.ptr = eval_buf;
-	ec->receiver.eval_buf.cap = SG5_EVAL_BUF_LEN;
-	ec->receiver.eval_buf.len = 0;
-
-	// initialize event handling
-	ec->events.queue_ack = event_queue_ack;
-	ec->events.queue_evt = event_queue_evt;
-
-	ec->state = SG5_EC_INITIALIZED;
-
-	serdev_device_set_drvdata(serdev, ec);
-
-	// ensure everything is properly set-up before we open the device
-	smp_mb();
-
-	serdev_device_set_client_ops(serdev, &surfacegen5_ssh_device_ops);
-	status = serdev_device_open(serdev);
-	if (status) {
-		goto err_probe_open;
-	}
-
-	status = acpi_walk_resources(ssh, METHOD_NAME__CRS,
-	                             surfacegen5_ssh_setup_from_resource, serdev);
-	if (ACPI_FAILURE(status)) {
-		goto err_probe_devinit;
-	}
-
-	status = surfacegen5_ssh_ec_resume(ec);
-	if (status) {
-		goto err_probe_devinit;
-	}
-
-	status = surfacegen5_ssh_sysfs_register(&serdev->dev);
-	if (status) {
-		goto err_probe_devinit;
-	}
-
-	surfacegen5_ec_release(ec);
-
-	acpi_walk_dep_device_list(ssh);
-
-	return 0;
-
-err_probe_devinit:
-	serdev_device_close(serdev);
-err_probe_open:
-	ec->state = SG5_EC_UNINITIALIZED;
-	serdev_device_set_drvdata(serdev, NULL);
-	surfacegen5_ec_release(ec);
-err_probe_busy:
-	destroy_workqueue(event_queue_evt);
-err_probe_evtq:
-	destroy_workqueue(event_queue_ack);
-err_probe_ackq:
-	kfree(eval_buf);
-err_probe_eval_buf:
-	kfree(read_buf);
-err_probe_read_buf:
-	kfree(write_buf);
-err_probe_write_buf:
-	return status;
-}
-
-static void surfacegen5_acpi_ssh_remove(struct serdev_device *serdev)
-{
-	struct surfacegen5_ec *ec;
-	unsigned long flags;
-	//int status;
-
-	ec = surfacegen5_ec_acquire_init();
-	if (!ec) {
-		return;
-	}
-
-	surfacegen5_ssh_sysfs_unregister(&serdev->dev);
-
-	// suspend EC and disable events
-	//status = surfacegen5_ssh_ec_suspend(ec);
-	//if (status) {
-	//	dev_err(&serdev->dev, "failed to suspend EC: %d\n", status);
-	//}
-
-	// make sure all events (received up to now) have been properly handled
-	flush_workqueue(ec->events.queue_ack);
-	flush_workqueue(ec->events.queue_evt);
-
-	// remove event handlers
-	spin_lock_irqsave(&ec->events.lock, flags);
-	memset(ec->events.handler, 0,
-	       sizeof(struct surfacegen5_ec_event_handler)
-	        * SG5_NUM_EVENT_TYPES);
-	spin_unlock_irqrestore(&ec->events.lock, flags);
-
-	// set device to deinitialized state
-	ec->state  = SG5_EC_UNINITIALIZED;
-	ec->serdev = NULL;
-
-	// ensure state and serdev get set before continuing
-	smp_mb();
-
-	/*
-	 * Flush any event that has not been processed yet to ensure we're not going to
-	 * use the serial device any more (e.g. for ACKing).
-	 */
-	flush_workqueue(ec->events.queue_ack);
-	flush_workqueue(ec->events.queue_evt);
-
-	serdev_device_close(serdev);
-
-	/*
-         * Only at this point, no new events can be received. Destroying the
-         * workqueue here flushes all remaining events. Those events will be
-         * silently ignored and neither ACKed nor any handler gets called.
-	 */
-	destroy_workqueue(ec->events.queue_ack);
-	destroy_workqueue(ec->events.queue_evt);
-
-	// free writer
-	kfree(ec->writer.data);
-	ec->writer.data = NULL;
-	ec->writer.ptr  = NULL;
-
-	// free receiver
-	spin_lock_irqsave(&ec->receiver.lock, flags);
-	ec->receiver.state = SG5_RCV_DISCARD;
-	kfifo_free(&ec->receiver.fifo);
-
-	kfree(ec->receiver.eval_buf.ptr);
-	ec->receiver.eval_buf.ptr = NULL;
-	ec->receiver.eval_buf.cap = 0;
-	ec->receiver.eval_buf.len = 0;
-	spin_unlock_irqrestore(&ec->receiver.lock, flags);
-
-	serdev_device_set_drvdata(serdev, NULL);
-	surfacegen5_ec_release(ec);
-}
-
-
-static const struct acpi_device_id surfacegen5_acpi_ssh_match[] = {
-	{ "MSHW0084", 0 },
-	{ },
-};
-MODULE_DEVICE_TABLE(acpi, surfacegen5_acpi_ssh_match);
-
-struct serdev_device_driver surfacegen5_acpi_ssh = {
-	.probe = surfacegen5_acpi_ssh_probe,
-	.remove = surfacegen5_acpi_ssh_remove,
-	.driver = {
-		.name = "surfacegen5_acpi_ssh",
-		.acpi_match_table = ACPI_PTR(surfacegen5_acpi_ssh_match),
-		.pm = &surfacegen5_ssh_pm_ops,
-	},
-};
-
-inline int surfacegen5_acpi_ssh_register(void)
-{
-	return serdev_device_driver_register(&surfacegen5_acpi_ssh);
-}
-
-inline void surfacegen5_acpi_ssh_unregister(void)
-{
-	serdev_device_driver_unregister(&surfacegen5_acpi_ssh);
-}
-
-#else /* CONFIG_SURFACE_ACPI_SSH */
-
-inline int surfacegen5_acpi_ssh_register(void)
-{
-	return 0;
-}
-
-inline void surfacegen5_acpi_ssh_unregister(void)
-{
-}
-
-
-#endif /* CONFIG_SURFACE_ACPI_SSH */
-
-
-/*************************************************************************
- * Surface Serial Hub Debug Device (private implementation)
- */
-
-#ifdef CONFIG_SURFACE_ACPI_SSH_DEBUG_DEVICE
-
-static char sg5_ssh_debug_rqst_buf_sysfs[SURFACEGEN5_MAX_RQST_RESPONSE + 1] = { 0 };
-static char sg5_ssh_debug_rqst_buf_pld[SURFACEGEN5_MAX_RQST_PAYLOAD] = { 0 };
-static char sg5_ssh_debug_rqst_buf_res[SURFACEGEN5_MAX_RQST_RESPONSE] = { 0 };
-
-static ssize_t rqst_read(struct file *f, struct kobject *kobj, struct bin_attribute *attr,
-                         char *buf, loff_t offs, size_t count)
-{
-	if (offs < 0 || count + offs > SURFACEGEN5_MAX_RQST_RESPONSE) {
-		return -EINVAL;
-	}
-
-	memcpy(buf, sg5_ssh_debug_rqst_buf_sysfs + offs, count);
-	return count;
-}
-
-static ssize_t rqst_write(struct file *f, struct kobject *kobj, struct bin_attribute *attr,
-			  char *buf, loff_t offs, size_t count)
-{
-	struct surfacegen5_rqst rqst = {};
-	struct surfacegen5_buf result = {};
-	int status;
-
-	// check basic write constriants
-	if (offs != 0 || count > SURFACEGEN5_MAX_RQST_PAYLOAD + 5) {
-		return -EINVAL;
-	}
-
-	// payload length should be consistent with data provided
-	if (buf[4] + 5 != count) {
-		return -EINVAL;
-	}
-
-	rqst.tc  = buf[0];
-	rqst.iid = buf[1];
-	rqst.cid = buf[2];
-	rqst.snc = buf[3];
-	rqst.cdl = buf[4];
-	rqst.pld = sg5_ssh_debug_rqst_buf_pld;
-	memcpy(sg5_ssh_debug_rqst_buf_pld, buf + 5, count - 5);
-
-	result.cap = SURFACEGEN5_MAX_RQST_RESPONSE;
-	result.len = 0;
-	result.data = sg5_ssh_debug_rqst_buf_res;
-
-	status = surfacegen5_ec_rqst(&rqst, &result);
-	if (status) {
-		return status;
-	}
-
-	sg5_ssh_debug_rqst_buf_sysfs[0] = result.len;
-	memcpy(sg5_ssh_debug_rqst_buf_sysfs + 1, result.data, result.len);
-	memset(sg5_ssh_debug_rqst_buf_sysfs + result.len + 1, 0,
-	       SURFACEGEN5_MAX_RQST_RESPONSE + 1 - result.len);
-
-	return count;
-}
-
-static const BIN_ATTR_RW(rqst, SURFACEGEN5_MAX_RQST_RESPONSE + 1);
-
-
-inline int surfacegen5_ssh_sysfs_register(struct device *dev)
-{
-	return sysfs_create_bin_file(&dev->kobj, &bin_attr_rqst);
-}
-
-inline void surfacegen5_ssh_sysfs_unregister(struct device *dev)
-{
-	sysfs_remove_bin_file(&dev->kobj, &bin_attr_rqst);
-}
-
-#elif defined(CONFIG_SURFACE_ACPI_SSH)
-
-inline int surfacegen5_ssh_sysfs_register(struct device *dev)
-{
-	return 0;
-}
-
-inline void surfacegen5_ssh_sysfs_unregister(struct device *dev)
-{
-}
-
-#endif /* CONFIG_SURFACE_ACPI_SSH_DEBUG_DEVICE*/
-
-
-/*************************************************************************
- * Surface ACPI Notify driver
- */
-
-#ifdef CONFIG_SURFACE_ACPI_SAN
-
-#define SG5_SAN_RQST_RETRY		5
-
-#define SG5_SAN_DSM_REVISION		0
-#define SG5_SAN_DSM_FN_NOTIFY_SENSOR_TRIP_POINT	0x09
-
-static const guid_t SG5_SAN_DSM_UUID =
-	GUID_INIT(0x93b666c5, 0x70c6, 0x469f, 0xa2, 0x15, 0x3d,
-	          0x48, 0x7c, 0x91, 0xab, 0x3c);
-
-#define SG5_EVENT_DELAY_POWER		msecs_to_jiffies(5000)
-
-#define SG5_EVENT_PWR_TC		0x02
-#define SG5_EVENT_PWR_RQID		0x0002
-#define SG5_EVENT_PWR_CID_HWCHANGE	0x15
-#define SG5_EVENT_PWR_CID_CHARGING	0x16
-#define SG5_EVENT_PWR_CID_ADAPTER	0x17
-#define SG5_EVENT_PWR_CID_STATE		0x4f
-
-#define SG5_EVENT_TEMP_TC		0x03
-#define SG5_EVENT_TEMP_RQID		0x0003
-#define SG5_EVENT_TEMP_CID_NOTIFY_SENSOR_TRIP_POINT	0x0b
-
-#define SG5_SAN_RQST_TAG            	"surfacegen5_ec_rqst: "
-
-#define SG5_QUIRK_BASE_STATE_DELAY	1000
-
-
-struct surfacegen5_san_acpi_consumer {
-	char *path;
-	bool  required;
-	u32   flags;
-};
-
-struct surfacegen5_san_opreg_context {
-	struct acpi_connection_info connection;
-	struct device *dev;
-};
-
-struct surfacegen5_san_consumer_link {
-	const struct surfacegen5_san_acpi_consumer *properties;
-	struct device_link                         *link;
-};
-
-struct surfacegen5_san_consumers {
-	u32                                   num;
-	struct surfacegen5_san_consumer_link *links;
-};
-
-struct surfacegen5_san_drvdata {
-	struct surfacegen5_san_opreg_context opreg_ctx;
-	struct surfacegen5_san_consumers     consumers;
-};
-
-struct gsb_data_in {
-	u8 cv;
-} __packed;
-
-struct gsb_data_rqsx {
-	u8 cv;				// command value (should be 0x01 or 0x03)
-	u8 tc;				// target controller
-	u8 tid;				// expected to be 0x01, could be revision
-	u8 iid;				// target sub-controller (e.g. primary vs. secondary battery)
-	u8 snc;				// expect-response-flag
-	u8 cid;				// command ID
-	u8 cdl;				// payload length
-	u8 _pad;			// padding
-	u8 pld[0];			// payload
-} __packed;
-
-struct gsb_data_etwl {
-	u8 cv;				// command value (should be 0x02)
-	u8 etw3;			// ?
-	u8 etw4;			// ?
-	u8 msg[0];			// error message (ASCIIZ)
-} __packed;
-
-struct gsb_data_out {
-	u8 status;			// _SSH communication status
-	u8 len;				// _SSH payload length
-	u8 pld[0];			// _SSH payload
-} __packed;
-
-union gsb_buffer_data {
-	struct gsb_data_in   in;	// common input
-	struct gsb_data_rqsx rqsx;	// RQSX input
-	struct gsb_data_etwl etwl;	// ETWL input
-	struct gsb_data_out  out;	// output
-};
-
-struct gsb_buffer {
-	u8 status;			// GSB AttribRawProcess status
-	u8 len;				// GSB AttribRawProcess length
-	union gsb_buffer_data data;
-} __packed;
-
-
-enum surfacegen5_pwr_event {
-	SURFACEGEN5_PWR_EVENT_BAT1_STAT	= 0x03,
-	SURFACEGEN5_PWR_EVENT_BAT1_INFO	= 0x04,
-	SURFACEGEN5_PWR_EVENT_ADP1_STAT	= 0x05,
-	SURFACEGEN5_PWR_EVENT_ADP1_INFO	= 0x06,
-	SURFACEGEN5_PWR_EVENT_BAT2_STAT	= 0x07,
-	SURFACEGEN5_PWR_EVENT_BAT2_INFO	= 0x08,
-};
-
-
-static int surfacegen5_acpi_notify_power_event(struct device *dev, enum surfacegen5_pwr_event event)
-{
-	acpi_handle san = ACPI_HANDLE(dev);
-	union acpi_object *obj;
-
-	obj = acpi_evaluate_dsm_typed(san, &SG5_SAN_DSM_UUID, SG5_SAN_DSM_REVISION,
-	                              (u8) event, NULL, ACPI_TYPE_BUFFER);
-
-	if (IS_ERR_OR_NULL(obj)) {
-		return obj ? PTR_ERR(obj) : -ENXIO;
-	}
-
-	if (obj->buffer.length != 1 || obj->buffer.pointer[0] != 0) {
-		dev_err(dev, "got unexpected result from _DSM\n");
-		return -EFAULT;
-	}
-
-	ACPI_FREE(obj);
-	return 0;
-}
-
-static int surfacegen5_acpi_notify_sensor_trip_point(struct device *dev, u8 iid)
-{
-	acpi_handle san = ACPI_HANDLE(dev);
-	union acpi_object *obj;
-	union acpi_object param;
-
-	param.type = ACPI_TYPE_INTEGER;
-	param.integer.value = iid;
-
-	obj = acpi_evaluate_dsm_typed(san, &SG5_SAN_DSM_UUID, SG5_SAN_DSM_REVISION,
-	                              SG5_SAN_DSM_FN_NOTIFY_SENSOR_TRIP_POINT,
-				      &param, ACPI_TYPE_BUFFER);
-
-	if (IS_ERR_OR_NULL(obj)) {
-		return obj ? PTR_ERR(obj) : -ENXIO;
-	}
-
-	if (obj->buffer.length != 1 || obj->buffer.pointer[0] != 0) {
-		dev_err(dev, "got unexpected result from _DSM\n");
-		return -EFAULT;
-	}
-
-	ACPI_FREE(obj);
-	return 0;
-}
-
-
-inline static int surfacegen5_evt_power_adapter(struct device *dev, struct surfacegen5_event *event)
-{
-	int status;
-
-	status = surfacegen5_acpi_notify_power_event(dev, SURFACEGEN5_PWR_EVENT_ADP1_STAT);
-	if (status) {
-		dev_err(dev, "error handling power event (cid = %x)\n", event->cid);
-		return status;
-	}
-
-	return 0;
-}
-
-inline static int surfacegen5_evt_power_hwchange(struct device *dev, struct surfacegen5_event *event)
-{
-	enum surfacegen5_pwr_event evcode;
-	int status;
-
-	if (event->iid == 0x02) {
-		evcode = SURFACEGEN5_PWR_EVENT_BAT2_INFO;
-	} else {
-		evcode = SURFACEGEN5_PWR_EVENT_BAT1_INFO;
-	}
-
-	status = surfacegen5_acpi_notify_power_event(dev, evcode);
-	if (status) {
-		dev_err(dev, "error handling power event (cid = %x)\n", event->cid);
-		return status;
-	}
-
-	return 0;
-}
-
-inline static int surfacegen5_evt_power_state(struct device *dev, struct surfacegen5_event *event)
-{
-	int status;
-
-	status = surfacegen5_acpi_notify_power_event(dev, SURFACEGEN5_PWR_EVENT_BAT1_STAT);
-	if (status) {
-		dev_err(dev, "error handling power event (cid = %x)\n", event->cid);
-		return status;
-	}
-
-	status = surfacegen5_acpi_notify_power_event(dev, SURFACEGEN5_PWR_EVENT_BAT2_STAT);
-	if (status) {
-		dev_err(dev, "error handling power event (cid = %x)\n", event->cid);
-		return status;
-	}
-
-	return 0;
-}
-
-static unsigned long surfacegen5_evt_power_delay(struct surfacegen5_event *event, void *data)
-{
-	switch (event->cid) {
-	case SG5_EVENT_PWR_CID_CHARGING:
-	case SG5_EVENT_PWR_CID_STATE:
-		return SG5_EVENT_DELAY_POWER;
-
-	case SG5_EVENT_PWR_CID_ADAPTER:
-	case SG5_EVENT_PWR_CID_HWCHANGE:
-	default:
-		return 0;
-	}
-}
-
-static int surfacegen5_evt_power(struct surfacegen5_event *event, void *data)
-{
-	struct device *dev = (struct device *)data;
-
-	switch (event->cid) {
-	case SG5_EVENT_PWR_CID_HWCHANGE:
-		return surfacegen5_evt_power_hwchange(dev, event);
-
-	case SG5_EVENT_PWR_CID_ADAPTER:
-		return surfacegen5_evt_power_adapter(dev, event);
-
-	case SG5_EVENT_PWR_CID_CHARGING:
-	case SG5_EVENT_PWR_CID_STATE:
-		return surfacegen5_evt_power_state(dev, event);
-
-	default:
-		dev_warn(dev, "unhandled power event (cid = %x)\n", event->cid);
-	}
-
-	return 0;
-}
-
-
-inline static int surfacegen5_evt_thermal_notify(struct device *dev, struct surfacegen5_event *event)
-{
-	int status;
-
-	status = surfacegen5_acpi_notify_sensor_trip_point(dev, event->iid);
-	if (status) {
-		dev_err(dev, "error handling thermal event (cid = %x)\n", event->cid);
-		return status;
-	}
-
-	return 0;
-}
-
-static int surfacegen5_evt_thermal(struct surfacegen5_event *event, void *data)
-{
-	struct device *dev = (struct device *)data;
-
-	switch (event->cid) {
-	case SG5_EVENT_TEMP_CID_NOTIFY_SENSOR_TRIP_POINT:
-		return surfacegen5_evt_thermal_notify(dev, event);
-
-	default:
-		dev_warn(dev, "unhandled thermal event (cid = %x)\n", event->cid);
-	}
-
-	return 0;
-}
-
-
-static struct gsb_data_rqsx *surfacegen5_san_validate_rqsx(
-	struct device *dev, const char *type, struct gsb_buffer *buffer)
-{
-	struct gsb_data_rqsx *rqsx = &buffer->data.rqsx;
-
-	if (buffer->len < 8) {
-		dev_err(dev, "invalid %s package (len = %d)\n",
-			type, buffer->len);
-		return NULL;
-	}
-
-	if (rqsx->cdl != buffer->len - 8) {
-		dev_err(dev, "bogus %s package (len = %d, cdl = %d)\n",
-			type, buffer->len, rqsx->cdl);
-		return NULL;
-	}
-
-	if (rqsx->tid != 0x01) {
-		dev_warn(dev, "unsupported %s package (tid = 0x%02x)\n",
-			 type, rqsx->tid);
-		return NULL;
-	}
-
-	return rqsx;
-}
-
-static acpi_status
-surfacegen5_san_etwl(struct surfacegen5_san_opreg_context *ctx, struct gsb_buffer *buffer)
-{
-	struct gsb_data_etwl *etwl = &buffer->data.etwl;
-
-	if (buffer->len < 3) {
-		dev_err(ctx->dev, "invalid ETWL package (len = %d)\n", buffer->len);
-		return AE_OK;
-	}
-
-	dev_err(ctx->dev, "ETWL(0x%02x, 0x%02x): %.*s\n",
-		etwl->etw3, etwl->etw4,
-		buffer->len - 3, (char *)etwl->msg);
-
-	// indicate success
-	buffer->status = 0x00;
-	buffer->len = 0x00;
-
-	return AE_OK;
-}
-
-static acpi_status
-surfacegen5_san_rqst(struct surfacegen5_san_opreg_context *ctx, struct gsb_buffer *buffer)
-{
-	struct gsb_data_rqsx *gsb_rqst = surfacegen5_san_validate_rqsx(ctx->dev, "RQST", buffer);
-	struct surfacegen5_rqst rqst = {};
-	struct surfacegen5_buf result = {};
-	int status = 0;
-	int try;
-
-	if (!gsb_rqst) {
-		return AE_OK;
-	}
-
-	rqst.tc  = gsb_rqst->tc;
-	rqst.iid = gsb_rqst->iid;
-	rqst.cid = gsb_rqst->cid;
-	rqst.snc = gsb_rqst->snc;
-	rqst.cdl = gsb_rqst->cdl;
-	rqst.pld = &gsb_rqst->pld[0];
-
-	result.cap  = SURFACEGEN5_MAX_RQST_RESPONSE;
-	result.len  = 0;
-	result.data = kzalloc(result.cap, GFP_KERNEL);
-
-	if (!result.data) {
-		return AE_NO_MEMORY;
-	}
-
-	for (try = 0; try < SG5_SAN_RQST_RETRY; try++) {
-		if (try) {
-			dev_warn(ctx->dev, SG5_SAN_RQST_TAG "IO error occured, trying again\n");
-		}
-
-		status = surfacegen5_ec_rqst(&rqst, &result);
-		if (status != -EIO) break;
-	}
-
-	if (rqst.tc == 0x11 && rqst.cid == 0x0D && status == -EPERM) {
-		/* Base state quirk:
-		 * The base state may be queried from ACPI when the EC is still
-		 * suspended. In this case it will return '-EPERM'. This query
-		 * will only be triggered from the ACPI lid GPE interrupt, thus
-		 * we are either in laptop or studio mode (base status 0x01 or
-		 * 0x02). Furthermore, we will only get here if the device (and
-		 * EC) have been suspended.
-		 *
-		 * We now assume that the device is in laptop mode (0x01). This
-		 * has the drawback that it will wake the device when unfolding
-		 * it in studio mode, but it also allows us to avoid actively
-		 * waiting for the EC to wake up, which may incur a notable
-		 * delay.
-		 */
-
-		buffer->status          = 0x00;
-		buffer->len             = 0x03;
-		buffer->data.out.status = 0x00;
-		buffer->data.out.len    = 0x01;
-		buffer->data.out.pld[0] = 0x01;
-
-	} else if (!status) {		// success
-		buffer->status          = 0x00;
-		buffer->len             = result.len + 2;
-		buffer->data.out.status = 0x00;
-		buffer->data.out.len    = result.len;
-		memcpy(&buffer->data.out.pld[0], result.data, result.len);
-
-	} else {			// failure
-		dev_err(ctx->dev, SG5_SAN_RQST_TAG "failed with error %d\n", status);
-		buffer->status          = 0x00;
-		buffer->len             = 0x02;
-		buffer->data.out.status = 0x01;		// indicate _SSH error
-		buffer->data.out.len    = 0x00;
-	}
-
-	kfree(result.data);
-
-	return AE_OK;
-}
-
-static acpi_status
-surfacegen5_san_rqsg(struct surfacegen5_san_opreg_context *ctx, struct gsb_buffer *buffer)
-{
-	struct gsb_data_rqsx *rqsg = surfacegen5_san_validate_rqsx(ctx->dev, "RQSG", buffer);
-
-	if (!rqsg) {
-		return AE_OK;
-	}
-
-	// TODO: RQSG handler
-
-	dev_warn(ctx->dev, "unsupported request: RQSG(0x%02x, 0x%02x, 0x%02x)\n",
-		 rqsg->tc, rqsg->cid, rqsg->iid);
-
-	return AE_OK;
-}
-
-
-static acpi_status
-surfacegen5_san_opreg_handler(u32 function, acpi_physical_address command,
-                              u32 bits, u64 *value64,
-                              void *opreg_context, void *region_context)
-{
-	struct surfacegen5_san_opreg_context *context = opreg_context;
-	struct gsb_buffer *buffer = (struct gsb_buffer *)value64;
-	int accessor_type = (0xFFFF0000 & function) >> 16;
-
-	if (command != 0) {
-		dev_warn(context->dev, "unsupported command: 0x%02llx\n", command);
-		return AE_OK;
-	}
-
-	if (accessor_type != ACPI_GSB_ACCESS_ATTRIB_RAW_PROCESS) {
-		dev_err(context->dev, "invalid access type: 0x%02x\n", accessor_type);
-		return AE_OK;
-	}
-
-	// buffer must have at least contain the command-value
-	if (buffer->len == 0) {
-		dev_err(context->dev, "request-package too small\n");
-		return AE_OK;
-	}
-
-	switch (buffer->data.in.cv) {
-	case 0x01:  return surfacegen5_san_rqst(context, buffer);
-	case 0x02:  return surfacegen5_san_etwl(context, buffer);
-	case 0x03:  return surfacegen5_san_rqsg(context, buffer);
-	}
-
-	dev_warn(context->dev, "unsupported SAN0 request (cv: 0x%02x)\n", buffer->data.in.cv);
-	return AE_OK;
-}
-
-static int surfacegen5_san_enable_events(struct device *dev)
-{
-	int status;
-
-	status = surfacegen5_ec_set_delayed_event_handler(
-			SG5_EVENT_PWR_RQID, surfacegen5_evt_power,
-			surfacegen5_evt_power_delay, dev);
-	if (status) {
-		goto err_event_handler_power;
-	}
-
-	status = surfacegen5_ec_set_event_handler(
-			SG5_EVENT_TEMP_RQID, surfacegen5_evt_thermal,
-			dev);
-	if (status) {
-		goto err_event_handler_thermal;
-	}
-
-	status = surfacegen5_ec_enable_event_source(SG5_EVENT_PWR_TC, 0x01, SG5_EVENT_PWR_RQID);
-	if (status) {
-		goto err_event_source_power;
-	}
-
-	status = surfacegen5_ec_enable_event_source(SG5_EVENT_TEMP_TC, 0x01, SG5_EVENT_TEMP_RQID);
-	if (status) {
-		goto err_event_source_thermal;
-	}
-
-	return 0;
-
-err_event_source_thermal:
-	surfacegen5_ec_disable_event_source(SG5_EVENT_PWR_TC, 0x01, SG5_EVENT_PWR_RQID);
-err_event_source_power:
-	surfacegen5_ec_remove_event_handler(SG5_EVENT_TEMP_RQID);
-err_event_handler_thermal:
-	surfacegen5_ec_remove_event_handler(SG5_EVENT_PWR_RQID);
-err_event_handler_power:
-	return status;
-}
-
-static void surfacegen5_san_disable_events(void)
-{
-	surfacegen5_ec_disable_event_source(SG5_EVENT_TEMP_TC, 0x01, SG5_EVENT_TEMP_RQID);
-	surfacegen5_ec_disable_event_source(SG5_EVENT_PWR_TC, 0x01, SG5_EVENT_PWR_RQID);
-	surfacegen5_ec_remove_event_handler(SG5_EVENT_TEMP_RQID);
-	surfacegen5_ec_remove_event_handler(SG5_EVENT_PWR_RQID);
-}
-
-
-static int surfacegen5_san_consumers_link(struct platform_device *pdev,
-                                          const struct surfacegen5_san_acpi_consumer *cons,
-                                          struct surfacegen5_san_consumers *out)
-{
-	const struct surfacegen5_san_acpi_consumer *con;
-	struct surfacegen5_san_consumer_link *links, *link;
-	struct acpi_device *adev;
-	acpi_handle handle;
-	u32 max_links = 0;
-	int status;
-
-	if (!cons) {
-		return 0;
-	}
-
-	// count links
-	for (con = cons; con->path; ++con) {
-		max_links += 1;
-	}
-
-	// allocate
-	links = kzalloc(max_links * sizeof(struct surfacegen5_san_consumer_link), GFP_KERNEL);
-	link = &links[0];
-
-	if (!links) {
-		return -ENOMEM;
-	}
-
-	// create links
-	for (con = cons; con->path; ++con) {
-		status = acpi_get_handle(NULL, con->path, &handle);
-		if (status) {
-			if (con->required || status != AE_NOT_FOUND) {
-				status = -ENXIO;
-				goto consumers_link_cleanup;
-			} else {
-				continue;
-			}
-		}
-
-		status = acpi_bus_get_device(handle, &adev);
-		if (status) {
-			goto consumers_link_cleanup;
-		}
-
-		link->link = device_link_add(&adev->dev, &pdev->dev, con->flags);
-		if (!(link->link)) {
-			status = -EFAULT;
-			goto consumers_link_cleanup;
-		}
-		link->properties = con;
-
-		link += 1;
-	}
-
-	out->num = link - links;
-	out->links = links;
-
-	return 0;
-
-consumers_link_cleanup:
-	for (link = link - 1; link >= links; --link) {
-		if (link->properties->flags & DL_FLAG_STATELESS) {
-			device_link_del(link->link);
-		}
-	}
-
-	return status;
-}
-
-static void surfacegen5_san_consumers_unlink(struct surfacegen5_san_consumers *consumers) {
-	u32 i;
-
-	if (!consumers) {
-		return;
-	}
-
-	for (i = 0; i < consumers->num; ++i) {
-		if (consumers->links[i].properties->flags & DL_FLAG_STATELESS) {
-			device_link_del(consumers->links[i].link);
-		}
-	}
-
-	kfree(consumers->links);
-
-	consumers->num = 0;
-	consumers->links = NULL;
-}
-
-static int surfacegen5_acpi_san_probe(struct platform_device *pdev)
-{
-	const struct surfacegen5_san_acpi_consumer *cons;
-	struct surfacegen5_san_drvdata *drvdata;
-	acpi_handle san = ACPI_HANDLE(&pdev->dev);	// _SAN device node
-	int status;
-
-	/*
-	 * Defer probe if the _SSH driver has not set up the controller yet. This
-	 * makes sure we do not fail any initial requests (e.g. _STA request without
-	 * which the battery does not get set up correctly). Otherwise register as
-	 * consumer to set up a device_link.
-	 */
-	status = surfacegen5_ec_consumer_register(&pdev->dev);
-	if (status) {
-		return status == -ENXIO ? -EPROBE_DEFER : status;
-	}
-
-	drvdata = kzalloc(sizeof(struct surfacegen5_san_drvdata), GFP_KERNEL);
-	if (!drvdata) {
-		return -ENOMEM;
-	}
-
-	drvdata->opreg_ctx.dev = &pdev->dev;
-
-	cons = acpi_device_get_match_data(&pdev->dev);
-	status = surfacegen5_san_consumers_link(pdev, cons, &drvdata->consumers);
-	if (status) {
-		goto err_probe_consumers;
-	}
-
-	platform_set_drvdata(pdev, drvdata);
-
-	status = acpi_install_address_space_handler(san,
-			ACPI_ADR_SPACE_GSBUS,
-			&surfacegen5_san_opreg_handler,
-			NULL, &drvdata->opreg_ctx);
-
-	if (ACPI_FAILURE(status)) {
-		status = -ENODEV;
-		goto err_probe_install_handler;
-	}
-
-	status = surfacegen5_san_enable_events(&pdev->dev);
-	if (status) {
-		goto err_probe_enable_events;
-	}
-
-	acpi_walk_dep_device_list(san);
-	return 0;
-
-err_probe_enable_events:
-	acpi_remove_address_space_handler(san, ACPI_ADR_SPACE_GSBUS, &surfacegen5_san_opreg_handler);
-err_probe_install_handler:
-	platform_set_drvdata(san, NULL);
-	surfacegen5_san_consumers_unlink(&drvdata->consumers);
-err_probe_consumers:
-	kfree(drvdata);
-	return status;
-}
-
-static int surfacegen5_acpi_san_remove(struct platform_device *pdev)
-{
-	struct surfacegen5_san_drvdata *drvdata = platform_get_drvdata(pdev);
-	acpi_handle san = ACPI_HANDLE(&pdev->dev);	// _SAN device node
-	acpi_status status = AE_OK;
-
-	acpi_remove_address_space_handler(san, ACPI_ADR_SPACE_GSBUS, &surfacegen5_san_opreg_handler);
-	surfacegen5_san_disable_events();
-
-	surfacegen5_san_consumers_unlink(&drvdata->consumers);
-	kfree(drvdata);
-
-	platform_set_drvdata(pdev, NULL);
-	return status;
-}
-
-
-static const struct surfacegen5_san_acpi_consumer surfacegen5_mshw0091_consumers[] = {
-	{ "\\_SB.SRTC", true,  DL_FLAG_PM_RUNTIME | DL_FLAG_STATELESS },
-	{ "\\ADP1",     true,  DL_FLAG_PM_RUNTIME | DL_FLAG_STATELESS },
-	{ "\\_SB.BAT1", true,  DL_FLAG_PM_RUNTIME | DL_FLAG_STATELESS },
-	{ "\\_SB.BAT2", false, DL_FLAG_PM_RUNTIME | DL_FLAG_STATELESS },
-	{ },
-};
-
-static const struct acpi_device_id surfacegen5_acpi_san_match[] = {
-	{ "MSHW0091", (long unsigned int) surfacegen5_mshw0091_consumers },
-	{ },
-};
-MODULE_DEVICE_TABLE(acpi, surfacegen5_acpi_san_match);
-
-struct platform_driver surfacegen5_acpi_san = {
-	.probe = surfacegen5_acpi_san_probe,
-	.remove = surfacegen5_acpi_san_remove,
-	.driver = {
-		.name = "surfacegen5_acpi_san",
-		.acpi_match_table = ACPI_PTR(surfacegen5_acpi_san_match),
-	},
-};
-
-
-inline int surfacegen5_acpi_san_register(void)
-{
-	return platform_driver_register(&surfacegen5_acpi_san);
-}
-
-inline void surfacegen5_acpi_san_unregister(void)
-{
-	platform_driver_unregister(&surfacegen5_acpi_san);
-}
-
-#else /* CONFIG_SURFACE_ACPI_SAN */
-
-inline int surfacegen5_acpi_san_register(void)
-{
-	return 0;
-}
-
-inline void surfacegen5_acpi_san_unregister(void)
-{
-}
-
-#endif /* CONFIG_SURFACE_ACPI_SAN */
-
-
-/*************************************************************************
- * Virtual HID Framework driver
- */
-
-#ifdef CONFIG_SURFACE_ACPI_VHF
-
-#define SG5_VHF_INPUT_NAME	"Microsoft Virtual HID Framework Device"
-
-/*
- * Request ID for VHF events. This value is based on the output of the Surface
- * EC and should not be changed.
- */
-#define SG5_EVENT_VHF_RQID	0x0001
-#define SG5_EVENT_VHF_TC	0x08
-
-
-struct surfacegen5_vhf_evtctx {
-	struct device     *dev;
-	struct hid_device *hid;
-};
-
-struct surfacegen5_vhf_drvdata {
-	struct surfacegen5_vhf_evtctx event_ctx;
-};
-
-
-/*
- * These report descriptors have been extracted from a Surface Book 2.
- * They seems to be similar enough to be usable on the Surface Laptop.
- */
-static const u8 vhf_hid_desc[] = {
-	// keyboard descriptor (event command ID 0x03)
-	0x05, 0x01,             /*  Usage Page (Desktop),                   */
-	0x09, 0x06,             /*  Usage (Keyboard),                       */
-	0xA1, 0x01,             /*  Collection (Application),               */
-	0x85, 0x01,             /*      Report ID (1),                      */
-	0x15, 0x00,             /*      Logical Minimum (0),                */
-	0x25, 0x01,             /*      Logical Maximum (1),                */
-	0x75, 0x01,             /*      Report Size (1),                    */
-	0x95, 0x08,             /*      Report Count (8),                   */
-	0x05, 0x07,             /*      Usage Page (Keyboard),              */
-	0x19, 0xE0,             /*      Usage Minimum (KB Leftcontrol),     */
-	0x29, 0xE7,             /*      Usage Maximum (KB Right GUI),       */
-	0x81, 0x02,             /*      Input (Variable),                   */
-	0x75, 0x08,             /*      Report Size (8),                    */
-	0x95, 0x0A,             /*      Report Count (10),                  */
-	0x19, 0x00,             /*      Usage Minimum (None),               */
-	0x29, 0x91,             /*      Usage Maximum (KB LANG2),           */
-	0x26, 0xFF, 0x00,       /*      Logical Maximum (255),              */
-	0x81, 0x00,             /*      Input,                              */
-	0x05, 0x0C,             /*      Usage Page (Consumer),              */
-	0x0A, 0xC0, 0x02,       /*      Usage (02C0h),                      */
-	0xA1, 0x02,             /*      Collection (Logical),               */
-	0x1A, 0xC1, 0x02,       /*          Usage Minimum (02C1h),          */
-	0x2A, 0xC6, 0x02,       /*          Usage Maximum (02C6h),          */
-	0x95, 0x06,             /*          Report Count (6),               */
-	0xB1, 0x03,             /*          Feature (Constant, Variable),   */
-	0xC0,                   /*      End Collection,                     */
-	0x05, 0x08,             /*      Usage Page (LED),                   */
-	0x19, 0x01,             /*      Usage Minimum (01h),                */
-	0x29, 0x03,             /*      Usage Maximum (03h),                */
-	0x75, 0x01,             /*      Report Size (1),                    */
-	0x95, 0x03,             /*      Report Count (3),                   */
-	0x25, 0x01,             /*      Logical Maximum (1),                */
-	0x91, 0x02,             /*      Output (Variable),                  */
-	0x95, 0x05,             /*      Report Count (5),                   */
-	0x91, 0x01,             /*      Output (Constant),                  */
-	0xC0,                   /*  End Collection,                         */
-
-	// media key descriptor (event command ID 0x04)
-	0x05, 0x0C,             /*  Usage Page (Consumer),                  */
-	0x09, 0x01,             /*  Usage (Consumer Control),               */
-	0xA1, 0x01,             /*  Collection (Application),               */
-	0x85, 0x03,             /*      Report ID (3),                      */
-	0x75, 0x10,             /*      Report Size (16),                   */
-	0x15, 0x00,             /*      Logical Minimum (0),                */
-	0x26, 0xFF, 0x03,       /*      Logical Maximum (1023),             */
-	0x19, 0x00,             /*      Usage Minimum (00h),                */
-	0x2A, 0xFF, 0x03,       /*      Usage Maximum (03FFh),              */
-	0x81, 0x00,             /*      Input,                              */
-	0xC0,                   /*  End Collection,                         */
-};
-
-
-static int vhf_hid_start(struct hid_device *hid)
-{
-	hid_dbg(hid, "%s\n", __func__);
-	return 0;
-}
-
-static void vhf_hid_stop(struct hid_device *hid)
-{
-	hid_dbg(hid, "%s\n", __func__);
-}
-
-static int vhf_hid_open(struct hid_device *hid)
-{
-	hid_dbg(hid, "%s\n", __func__);
-	return 0;
-}
-
-static void vhf_hid_close(struct hid_device *hid)
-{
-	hid_dbg(hid, "%s\n", __func__);
-}
-
-static int vhf_hid_parse(struct hid_device *hid)
-{
-	return hid_parse_report(hid, (u8 *)vhf_hid_desc, ARRAY_SIZE(vhf_hid_desc));
-}
-
-static int vhf_hid_raw_request(struct hid_device *hid, unsigned char reportnum,
-			       u8 *buf, size_t len, unsigned char rtype,
-			       int reqtype)
-{
-	hid_dbg(hid, "%s\n", __func__);
-	return 0;
-}
-
-static int vhf_hid_output_report(struct hid_device *hid, u8 *buf, size_t len)
-{
-	hid_dbg(hid, "%s\n", __func__);
-	print_hex_dump_debug("report:", DUMP_PREFIX_OFFSET, 16, 1, buf, len, false);
-
-	return len;
-}
-
-static struct hid_ll_driver vhf_hid_ll_driver = {
-	.start         = vhf_hid_start,
-	.stop          = vhf_hid_stop,
-	.open          = vhf_hid_open,
-	.close         = vhf_hid_close,
-	.parse         = vhf_hid_parse,
-	.raw_request   = vhf_hid_raw_request,
-	.output_report = vhf_hid_output_report,
-};
-
-
-static struct hid_device *surfacegen5_vhf_create_hid_device(struct platform_device *pdev)
-{
-	struct hid_device *hid;
-
-	hid = hid_allocate_device();
-	if (IS_ERR(hid)) {
-		return hid;
-	}
-
-	hid->dev.parent = &pdev->dev;
-
-	hid->bus     = BUS_VIRTUAL;
-	hid->vendor  = USB_VENDOR_ID_MICROSOFT;
-	hid->product = USB_DEVICE_ID_MS_VHF;
-
-	hid->ll_driver = &vhf_hid_ll_driver;
-
-	sprintf(hid->name, "%s", SG5_VHF_INPUT_NAME);
-
-	return hid;
-}
-
-static int surfacegen5_vhf_event_handler(struct surfacegen5_event *event, void *data)
-{
-	struct surfacegen5_vhf_evtctx *ctx = (struct surfacegen5_vhf_evtctx *)data;
-
-	if (event->tc == 0x08 && (event->cid == 0x03 || event->cid == 0x04)) {
-		return hid_input_report(ctx->hid, HID_INPUT_REPORT, event->pld, event->len, 1);
-	}
-
-	dev_warn(ctx->dev, "unsupported event (tc = %d, cid = %d)\n", event->tc, event->cid);
-	return 0;
-}
-
-static unsigned long surfacegen5_vhf_event_delay(struct surfacegen5_event *event, void *data)
-{
-	// high priority immediate execution for keyboard events
-	if (event->tc == 0x08 && (event->cid == 0x03 || event->cid == 0x04)) {
-		return SURFACEGEN5_EVENT_IMMEDIATE;
-	}
-
-	return 0;
-}
-
-static int surfacegen5_acpi_vhf_probe(struct platform_device *pdev)
-{
-	struct surfacegen5_vhf_drvdata *drvdata;
-	struct hid_device *hid;
-	int status;
-
-	// add device link to EC
-	status = surfacegen5_ec_consumer_register(&pdev->dev);
-	if (status) {
-		return status == -ENXIO ? -EPROBE_DEFER : status;
-	}
-
-	drvdata = kzalloc(sizeof(struct surfacegen5_vhf_drvdata), GFP_KERNEL);
-	if (!drvdata) {
-		return -ENOMEM;
-	}
-
-	hid = surfacegen5_vhf_create_hid_device(pdev);
-	if (IS_ERR(hid)) {
-		status = PTR_ERR(hid);
-		goto err_probe_hid;
-	}
-
-	status = hid_add_device(hid);
-	if (status) {
-		goto err_add_hid;
-	}
-
-	drvdata->event_ctx.dev = &pdev->dev;
-	drvdata->event_ctx.hid = hid;
-
-	platform_set_drvdata(pdev, drvdata);
-
-	/*
-         * Set event hanlder for VHF events. They seem to be enabled by
-         * default, thus there should be no need to explicitly enable them.
-	 */
-	status = surfacegen5_ec_set_delayed_event_handler(
-			SG5_EVENT_VHF_RQID,
-	                surfacegen5_vhf_event_handler,
-	                surfacegen5_vhf_event_delay,
-			&drvdata->event_ctx);
-	if (status) {
-		goto err_add_hid;
-	}
-
-	status = surfacegen5_ec_enable_event_source(SG5_EVENT_VHF_TC, 0x01, SG5_EVENT_VHF_RQID);
-	if (status) {
-		goto err_event_source;
-	}
-
-	return 0;
-
-err_event_source:
-	surfacegen5_ec_remove_event_handler(SG5_EVENT_VHF_RQID);
-err_add_hid:
-	hid_destroy_device(hid);
-	platform_set_drvdata(pdev, NULL);
-err_probe_hid:
-	kfree(drvdata);
-	return status;
-}
-
-static int surfacegen5_acpi_vhf_remove(struct platform_device *pdev)
-{
-	struct surfacegen5_vhf_drvdata *drvdata = platform_get_drvdata(pdev);
-
-	surfacegen5_ec_disable_event_source(SG5_EVENT_VHF_TC, 0x01, SG5_EVENT_VHF_RQID);
-	surfacegen5_ec_remove_event_handler(SG5_EVENT_VHF_RQID);
-
-	hid_destroy_device(drvdata->event_ctx.hid);
-	kfree(drvdata);
-
-	platform_set_drvdata(pdev, NULL);
-	return 0;
-}
-
-
-static const struct acpi_device_id surfacegen5_acpi_vhf_match[] = {
-	{ "MSHW0096" },
-	{ },
-};
-MODULE_DEVICE_TABLE(acpi, surfacegen5_acpi_vhf_match);
-
-struct platform_driver surfacegen5_acpi_vhf = {
-	.probe = surfacegen5_acpi_vhf_probe,
-	.remove = surfacegen5_acpi_vhf_remove,
-	.driver = {
-		.name = "surfacegen5_acpi_vhf",
-		.acpi_match_table = ACPI_PTR(surfacegen5_acpi_vhf_match),
-	},
-};
-
-
-inline int surfacegen5_acpi_vhf_register(void)
-{
-	return platform_driver_register(&surfacegen5_acpi_vhf);
-}
-
-inline void surfacegen5_acpi_vhf_unregister(void)
-{
-	platform_driver_unregister(&surfacegen5_acpi_vhf);
-}
-
-#else /* CONFIG_SURFACE_ACPI_VHF */
-
-inline int surfacegen5_acpi_vhf_register(void)
-{
-	return 0;
-}
-
-inline void surfacegen5_acpi_vhf_unregister(void)
-{
-}
-
-#endif /* CONFIG_SURFACE_ACPI_VHF */
-
-
-/*************************************************************************
- * Detachment System Driver (DTX)
- */
-
-#ifdef CONFIG_SURFACE_ACPI_DTX
-
-#define SG5_DTX_INPUT_NAME	"Microsoft Surface Base 2 Integration Device"
-
-#define DTX_CMD_LATCH_LOCK				_IO(0x11, 0x01)
-#define DTX_CMD_LATCH_UNLOCK				_IO(0x11, 0x02)
-#define DTX_CMD_LATCH_REQUEST				_IO(0x11, 0x03)
-#define DTX_CMD_LATCH_OPEN				_IO(0x11, 0x04)
-#define DTX_CMD_GET_OPMODE				_IOR(0x11, 0x05, int)
-
-#define SG5_RQST_DTX_TC					0x11
-#define SG5_RQST_DTX_CID_LATCH_LOCK			0x06
-#define SG5_RQST_DTX_CID_LATCH_UNLOCK			0x07
-#define SG5_RQST_DTX_CID_LATCH_REQUEST			0x08
-#define SG5_RQST_DTX_CID_LATCH_OPEN			0x09
-#define SG5_RQST_DTX_CID_GET_OPMODE			0x0D
-
-#define SG5_EVENT_DTX_TC				0x11
-#define SG5_EVENT_DTX_RQID				0x0011
-#define SG5_EVENT_DTX_CID_CONNECTION			0x0c
-#define SG5_EVENT_DTX_CID_BUTTON			0x0e
-#define SG5_EVENT_DTX_CID_ERROR				0x0f
-#define SG5_EVENT_DTX_CID_LATCH_STATUS			0x11
-
-#define DTX_OPMODE_TABLET				0x00
-#define DTX_OPMODE_LAPTOP				0x01
-#define DTX_OPMODE_STUDIO				0x02
-
-#define DTX_LATCH_CLOSED				0x00
-#define DTX_LATCH_OPENED				0x01
-
-// Warning: This must always be a power of 2!
-#define SURFACE_DTX_CLIENT_BUF_SIZE             	16
-
-#define SG5_DTX_CONNECT_OPMODE_DELAY			1000
-
-#define DTX_ERR		KERN_ERR "surfacegen5_acpi_dtx: "
-#define DTX_WARN	KERN_WARNING "surfacegen5_acpi_dtx: "
-
-
-struct surface_dtx_event {
-	u8 type;
-	u8 code;
-	u8 arg0;
-	u8 arg1;
-} __packed;
-
-struct surface_dtx_dev {
-	wait_queue_head_t waitq;
-	struct miscdevice mdev;
-	spinlock_t client_lock;
-	struct list_head client_list;
-	struct mutex mutex;
-	bool active;
-	spinlock_t input_lock;
-	struct input_dev *input_dev;
-};
-
-struct surface_dtx_client {
-	struct list_head node;
-	struct surface_dtx_dev *ddev;
-	struct fasync_struct *fasync;
-	spinlock_t buffer_lock;
-	unsigned int buffer_head;
-	unsigned int buffer_tail;
-	struct surface_dtx_event buffer[SURFACE_DTX_CLIENT_BUF_SIZE];
-};
-
-
-static struct surface_dtx_dev surface_dtx_dev;
-
-
-static int sg5_ec_query_opmpde(void)
-{
-	u8 result_buf[1];
-	int status;
-
-	struct surfacegen5_rqst rqst = {
-		.tc  = SG5_RQST_DTX_TC,
-		.iid = 0,
-		.cid = SG5_RQST_DTX_CID_GET_OPMODE,
-		.snc = 1,
-		.cdl = 0,
-		.pld = NULL,
-	};
-
-	struct surfacegen5_buf result = {
-		.cap = 1,
-		.len = 0,
-		.data = result_buf,
-	};
-
-	status = surfacegen5_ec_rqst(&rqst, &result);
-	if (status) {
-		return status;
-	}
-
-	if (result.len != 1) {
-		return -EFAULT;
-	}
-
-	return result.data[0];
-}
-
-
-static int dtx_cmd_simple(u8 cid)
-{
-	struct surfacegen5_rqst rqst = {
-		.tc  = SG5_RQST_DTX_TC,
-		.iid = 0,
-		.cid = cid,
-		.snc = 0,
-		.cdl = 0,
-		.pld = NULL,
-	};
-
-	return surfacegen5_ec_rqst(&rqst, NULL);
-}
-
-static int dtx_cmd_get_opmode(int __user *buf)
-{
-	int opmode = sg5_ec_query_opmpde();
-	if (opmode < 0) {
-		return opmode;
-	}
-
-	if (put_user(opmode, buf)) {
-		return -EACCES;
-	}
-
-	return 0;
-}
-
-
-static int surface_dtx_open(struct inode *inode, struct file *file)
-{
-	struct surface_dtx_dev *ddev = container_of(file->private_data, struct surface_dtx_dev, mdev);
-	struct surface_dtx_client *client;
-
-	// initialize client
-	client = kzalloc(sizeof(struct surface_dtx_client), GFP_KERNEL);
-	if (!client) {
-		return -ENOMEM;
-	}
-
-	spin_lock_init(&client->buffer_lock);
-	client->buffer_head = 0;
-	client->buffer_tail = 0;
-	client->ddev = ddev;
-
-	// attach client
-	spin_lock(&ddev->client_lock);
-	list_add_tail_rcu(&client->node, &ddev->client_list);
-	spin_unlock(&ddev->client_lock);
-
-	file->private_data = client;
-	nonseekable_open(inode, file);
-
-	return 0;
-}
-
-static int surface_dtx_release(struct inode *inode, struct file *file)
-{
-	struct surface_dtx_client *client = file->private_data;
-
-	// detach client
-	spin_lock(&client->ddev->client_lock);
-	list_del_rcu(&client->node);
-	spin_unlock(&client->ddev->client_lock);
-	synchronize_rcu();
-
-	kfree(client);
-	file->private_data = NULL;
-
-	return 0;
-}
-
-static ssize_t surface_dtx_read(struct file *file, char __user *buf, size_t count, loff_t *offs)
-{
-	struct surface_dtx_client *client = file->private_data;
-	struct surface_dtx_dev *ddev = client->ddev;
-	struct surface_dtx_event event;
-	size_t read = 0;
-	int status = 0;
-
-	if (count != 0 && count < sizeof(struct surface_dtx_event)) {
-		return -EINVAL;
-	}
-
-	if (!ddev->active) {
-		return -ENODEV;
-	}
-
-	// check availability
-	if (client->buffer_head == client->buffer_tail){
-		if (file->f_flags & O_NONBLOCK) {
-			return -EAGAIN;
-		}
-
-		status = wait_event_interruptible(ddev->waitq,
-				client->buffer_head != client->buffer_tail ||
-				!ddev->active);
-		if (status) {
-			return status;
-		}
-
-		if (!ddev->active) {
-			return -ENODEV;
-		}
-	}
-
-	// copy events one by one
-	while (read + sizeof(struct surface_dtx_event) <= count) {
-		spin_lock_irq(&client->buffer_lock);
-
-		if(client->buffer_head == client->buffer_tail) {
-			spin_unlock_irq(&client->buffer_lock);
-			break;
-		}
-
-		// get one event
-		event = client->buffer[client->buffer_tail];
-		client->buffer_tail = (client->buffer_tail + 1) & (SURFACE_DTX_CLIENT_BUF_SIZE - 1);
-		spin_unlock_irq(&client->buffer_lock);
-
-		// copy to userspace
-		if(copy_to_user(buf, &event, sizeof(struct surface_dtx_event))) {
-			return -EFAULT;
-		}
-
-		read += sizeof(struct surface_dtx_event);
-	}
-
-	return read;
-}
-
-static __poll_t surface_dtx_poll(struct file *file, struct poll_table_struct *pt)
-{
-	struct surface_dtx_client *client = file->private_data;
-	int mask;
-
-	poll_wait(file, &client->ddev->waitq, pt);
-
-	if (client->ddev->active) {
-		mask = EPOLLOUT | EPOLLWRNORM;
-	} else {
-		mask = EPOLLHUP | EPOLLERR;
-	}
-
-	if (client->buffer_head != client->buffer_tail) {
-		mask |= EPOLLIN | EPOLLRDNORM;
-	}
-
-	return mask;
-}
-
-static int surface_dtx_fasync(int fd, struct file *file, int on)
-{
-	struct surface_dtx_client *client = file->private_data;
-
-	return fasync_helper(fd, file, on, &client->fasync);
-}
-
-static long surface_dtx_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
-{
-	struct surface_dtx_client *client = file->private_data;
-	struct surface_dtx_dev *ddev = client->ddev;
-	int status;
-
-	status = mutex_lock_interruptible(&ddev->mutex);
-	if (status) {
-		return status;
-	}
-
-	if (!ddev->active) {
-		mutex_unlock(&ddev->mutex);
-		return -ENODEV;
-	}
-
-	switch (cmd) {
-	case DTX_CMD_LATCH_LOCK:
-		status = dtx_cmd_simple(SG5_RQST_DTX_CID_LATCH_LOCK);
-		break;
-
-	case DTX_CMD_LATCH_UNLOCK:
-		status = dtx_cmd_simple(SG5_RQST_DTX_CID_LATCH_UNLOCK);
-		break;
-
-	case DTX_CMD_LATCH_REQUEST:
-		status = dtx_cmd_simple(SG5_RQST_DTX_CID_LATCH_REQUEST);
-		break;
-
-	case DTX_CMD_LATCH_OPEN:
-		status = dtx_cmd_simple(SG5_RQST_DTX_CID_LATCH_OPEN);
-		break;
-
-	case DTX_CMD_GET_OPMODE:
-		status = dtx_cmd_get_opmode((int __user *)arg);
-		break;
-
-	default:
-		status = -EINVAL;
-		break;
-	}
-
-	mutex_unlock(&ddev->mutex);
-	return status;
-}
-
-static const struct file_operations surface_dtx_fops = {
-	.owner          = THIS_MODULE,
-	.open           = surface_dtx_open,
-	.release        = surface_dtx_release,
-	.read           = surface_dtx_read,
-	.poll           = surface_dtx_poll,
-	.fasync         = surface_dtx_fasync,
-	.unlocked_ioctl = surface_dtx_ioctl,
-	.llseek         = no_llseek,
-};
-
-static struct surface_dtx_dev surface_dtx_dev = {
-	.mdev = {
-		.minor = MISC_DYNAMIC_MINOR,
-		.name = "surface_dtx",
-		.fops = &surface_dtx_fops,
-	},
-	.client_lock = __SPIN_LOCK_UNLOCKED(),
-	.input_lock = __SPIN_LOCK_UNLOCKED(),
-	.mutex  = __MUTEX_INITIALIZER(surface_dtx_dev.mutex),
-	.active = false,
-};
-
-
-static void surface_dtx_push_event(struct surface_dtx_dev *ddev, struct surface_dtx_event *event)
-{
-	struct surface_dtx_client *client;
-
-	rcu_read_lock();
-	list_for_each_entry_rcu(client, &ddev->client_list, node) {
-		spin_lock(&client->buffer_lock);
-
-		client->buffer[client->buffer_head++] = *event;
-		client->buffer_head &= SURFACE_DTX_CLIENT_BUF_SIZE - 1;
-
-		if (unlikely(client->buffer_head == client->buffer_tail)) {
-			printk(DTX_WARN "event buffer overrun\n");
-			client->buffer_tail = (client->buffer_tail + 1) & (SURFACE_DTX_CLIENT_BUF_SIZE - 1);
-		}
-
-		spin_unlock(&client->buffer_lock);
-
-		kill_fasync(&client->fasync, SIGIO, POLL_IN);
-	}
-	rcu_read_unlock();
-
-	wake_up_interruptible(&ddev->waitq);
-}
-
-
-static void surface_dtx_update_opmpde(struct surface_dtx_dev *ddev)
-{
-	struct surface_dtx_event event;
-	int opmode;
-
-	// get operation mode
-	opmode = sg5_ec_query_opmpde();
-	if (opmode < 0) {
-		printk(DTX_ERR "EC request failed with error %d\n", opmode);
-	}
-
-	// send DTX event
-	event.type = 0x11;
-	event.code = 0x0D;
-	event.arg0 = opmode;
-	event.arg1 = 0x00;
-
-	surface_dtx_push_event(ddev, &event);
-
-	// send SW_TABLET_MODE event
-	spin_lock(&ddev->input_lock);
-	input_report_switch(ddev->input_dev, SW_TABLET_MODE, opmode == 0x00);
-	input_sync(ddev->input_dev);
-	spin_unlock(&ddev->input_lock);
-}
-
-static int surface_dtx_evt_dtx(struct surfacegen5_event *in_event, void *data)
-{
-	struct surface_dtx_dev *ddev = data;
-	struct surface_dtx_event event;
-
-	switch (in_event->cid) {
-	case SG5_EVENT_DTX_CID_CONNECTION:
-	case SG5_EVENT_DTX_CID_BUTTON:
-	case SG5_EVENT_DTX_CID_ERROR:
-	case SG5_EVENT_DTX_CID_LATCH_STATUS:
-		if (in_event->len > 2) {
-			printk(DTX_ERR "unexpected payload size (cid: %x, len: %u)\n",
-			       in_event->cid, in_event->len);
-			return 0;
-		}
-
-		event.type = in_event->tc;
-		event.code = in_event->cid;
-		event.arg0 = in_event->len >= 1 ? in_event->pld[0] : 0x00;
-		event.arg1 = in_event->len >= 2 ? in_event->pld[1] : 0x00;
-		surface_dtx_push_event(ddev, &event);
-		break;
-
-	default:
-		printk(DTX_WARN "unhandled dtx event (cid: %x)\n", in_event->cid);
-	}
-
-	// update device mode
-	if (in_event->cid == SG5_EVENT_DTX_CID_CONNECTION) {
-		if (in_event->pld[0]) {
-			// Note: we're already in a workqueue task
-			msleep(SG5_DTX_CONNECT_OPMODE_DELAY);
-		}
-
-		surface_dtx_update_opmpde(ddev);
-	}
-
-	return 0;
-}
-
-static int surface_dtx_events_setup(struct surface_dtx_dev *ddev)
-{
-	int status;
-
-	status = surfacegen5_ec_set_event_handler(SG5_EVENT_DTX_RQID, surface_dtx_evt_dtx, ddev);
-	if (status) {
-		goto err_event_handler;
-	}
-
-	status = surfacegen5_ec_enable_event_source(SG5_EVENT_DTX_TC, 0x01, SG5_EVENT_DTX_RQID);
-	if (status) {
-		goto err_event_source;
-	}
-
-	return 0;
-
-err_event_source:
-	surfacegen5_ec_remove_event_handler(SG5_EVENT_DTX_RQID);
-err_event_handler:
-	return status;
-}
-
-static void surface_dtx_events_disable(void)
-{
-	surfacegen5_ec_disable_event_source(SG5_EVENT_DTX_TC, 0x01, SG5_EVENT_DTX_RQID);
-	surfacegen5_ec_remove_event_handler(SG5_EVENT_DTX_RQID);
-}
-
-
-static struct input_dev *surface_dtx_register_inputdev(struct platform_device *pdev)
-{
-	struct input_dev *input_dev;
-	int status;
-
-	input_dev = input_allocate_device();
-	if (!input_dev) {
-		return ERR_PTR(-ENOMEM);
-	}
-
-	input_dev->name = SG5_DTX_INPUT_NAME;
-	input_dev->dev.parent = &pdev->dev;
-	input_dev->id.bustype = BUS_VIRTUAL;
-	input_dev->id.vendor  = USB_VENDOR_ID_MICROSOFT;
-	input_dev->id.product = USB_DEVICE_ID_MS_SURFACE_BASE_2_INTEGRATION;
-
-	input_set_capability(input_dev, EV_SW, SW_TABLET_MODE);
-
-	status = sg5_ec_query_opmpde();
-	if (status < 0) {
-		input_free_device(input_dev);
-		return ERR_PTR(status);
-	}
-
-	input_report_switch(input_dev, SW_TABLET_MODE, status == 0x00);
-
-	status = input_register_device(input_dev);
-	if (status) {
-		input_unregister_device(input_dev);
-		return ERR_PTR(status);
-	}
-
-	return input_dev;
-}
-
-
-static int surfacegen5_acpi_dtx_probe(struct platform_device *pdev)
-{
-	struct surface_dtx_dev *ddev = &surface_dtx_dev;
-	struct input_dev *input_dev;
-	int status;
-
-	// link to ec
-	status = surfacegen5_ec_consumer_register(&pdev->dev);
-	if (status) {
-		return status == -ENXIO ? -EPROBE_DEFER : status;
-	}
-
-	input_dev = surface_dtx_register_inputdev(pdev);
-	if (IS_ERR(input_dev)) {
-		return PTR_ERR(input_dev);
-	}
-
-	// initialize device
-	mutex_lock(&ddev->mutex);
-	if (ddev->active) {
-		mutex_unlock(&ddev->mutex);
-		status = -ENODEV;
-		goto err_register;
-	}
-
-	INIT_LIST_HEAD(&ddev->client_list);
-	init_waitqueue_head(&ddev->waitq);
-	ddev->active = true;
-	ddev->input_dev = input_dev;
-	mutex_unlock(&ddev->mutex);
-
-	status = misc_register(&ddev->mdev);
-	if (status) {
-		goto err_register;
-	}
-
-	// enable events
-	status = surface_dtx_events_setup(ddev);
-	if (status) {
-		goto err_events_setup;
-	}
-
-	return 0;
-
-err_events_setup:
-	misc_deregister(&ddev->mdev);
-err_register:
-	input_unregister_device(ddev->input_dev);
-	return status;
-}
-
-static int surfacegen5_acpi_dtx_remove(struct platform_device *pdev)
-{
-	struct surface_dtx_dev *ddev = &surface_dtx_dev;
-	struct surface_dtx_client *client;
-
-	mutex_lock(&ddev->mutex);
-	if (!ddev->active) {
-		mutex_unlock(&ddev->mutex);
-		return 0;
-	}
-
-	// mark as inactive
-	ddev->active = false;
-	mutex_unlock(&ddev->mutex);
-
-	// After this call we're guaranteed that no more input events will arive
-	surface_dtx_events_disable();
-
-	// wake up clients
-	spin_lock(&ddev->client_lock);
-	list_for_each_entry(client, &ddev->client_list, node) {
-		kill_fasync(&client->fasync, SIGIO, POLL_HUP);
-	}
-	spin_unlock(&ddev->client_lock);
-
-	wake_up_interruptible(&ddev->waitq);
-
-	// unregister user-space devices
-	input_unregister_device(ddev->input_dev);
-	misc_deregister(&ddev->mdev);
-
-	return 0;
-}
-
-
-static const struct acpi_device_id surfacegen5_acpi_dtx_match[] = {
-	{ "MSHW0133", 0 },
-	{ },
-};
-MODULE_DEVICE_TABLE(acpi, surfacegen5_acpi_dtx_match);
-
-struct platform_driver surfacegen5_acpi_dtx = {
-	.probe = surfacegen5_acpi_dtx_probe,
-	.remove = surfacegen5_acpi_dtx_remove,
-	.driver = {
-		.name = "surfacegen5_acpi_dtx",
-		.acpi_match_table = ACPI_PTR(surfacegen5_acpi_dtx_match),
-	},
-};
-
-
-inline int surfacegen5_acpi_dtx_register(void)
-{
-	return platform_driver_register(&surfacegen5_acpi_dtx);
-}
-
-inline void surfacegen5_acpi_dtx_unregister(void)
-{
-	platform_driver_unregister(&surfacegen5_acpi_dtx);
-}
-
-#else /* CONFIG_SURFACE_ACPI_DTX */
-
-inline int surfacegen5_acpi_dtx_register(void)
-{
-	return 0;
-}
-
-inline void surfacegen5_acpi_dtx_unregister(void)
-{
-}
-
-#endif /* CONFIG_SURFACE_ACPI_DTX */
-
-
-/*************************************************************************
- * Surface Platform Integration Driver
- */
-
-#ifdef CONFIG_SURFACE_ACPI_SID
-
-struct si_lid_device {
-	const char *acpi_path;
-	const u32 gpe_number;
-};
-
-struct si_device_info {
-	const bool has_perf_mode;
-	const struct si_lid_device *lid_device;
-};
-
-
-static const struct si_lid_device lid_device_l17 = {
-	.acpi_path = "\\_SB.LID0",
-	.gpe_number = 0x17,
-};
-
-static const struct si_lid_device lid_device_l57 = {
-	.acpi_path = "\\_SB.LID0",
-	.gpe_number = 0x57,
-};
-
-static const struct si_lid_device lid_device_l4F = {
-	.acpi_path = "\\_SB.LID0",
-	.gpe_number = 0x57,
-};
-
-
-static const struct si_device_info si_device_pro_4 = {
-	.has_perf_mode = false,
-	.lid_device = &lid_device_l17,
-};
-
-static const struct si_device_info si_device_pro_5 = {
-	.has_perf_mode = false,
-	.lid_device = &lid_device_l4F,
-};
-
-static const struct si_device_info si_device_pro_6 = {
-	.has_perf_mode = false,
-	.lid_device = &lid_device_l4F,
-};
-
-static const struct si_device_info si_device_book_1 = {
-	.has_perf_mode = false,
-	.lid_device = &lid_device_l17,
-};
-
-static const struct si_device_info si_device_book_2 = {
-	.has_perf_mode = true,
-	.lid_device = &lid_device_l17,
-};
-
-static const struct si_device_info si_device_laptop_1 = {
-	.has_perf_mode = false,
-	.lid_device = &lid_device_l57,
-};
-
-static const struct si_device_info si_device_laptop_2 = {
-	.has_perf_mode = false,
-	.lid_device = &lid_device_l57,
-};
-
-
-static const struct dmi_system_id dmi_lid_device_table[] = {
-	{
-		.ident = "Surface Pro 4",
-		.matches = {
-			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
-			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Pro 4"),
-		},
-		.driver_data = (void *)&si_device_pro_4,
-	},
-	{
-		.ident = "Surface Pro 5",
-		.matches = {
-			/* match for SKU here due to generic product name "Surface Pro" */
-			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
-			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "Surface_Pro_1796"),
-		},
-		.driver_data = (void *)&si_device_pro_5,
-	},
-	{
-		.ident = "Surface Pro 5 (LTE)",
-		.matches = {
-			/* match for SKU here due to generic product name "Surface Pro" */
-			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
-			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "Surface_Pro_1807"),
-		},
-		.driver_data = (void *)&si_device_pro_5,
-	},
-	{
-		.ident = "Surface Pro 6",
-		.matches = {
-			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
-			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Pro 6"),
-		},
-		.driver_data = (void *)&si_device_pro_6,
-	},
-	{
-		.ident = "Surface Book 1",
-		.matches = {
-			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
-			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Book"),
-		},
-		.driver_data = (void *)&si_device_book_1,
-	},
-	{
-		.ident = "Surface Book 2",
-		.matches = {
-			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
-			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Book 2"),
-		},
-		.driver_data = (void *)&si_device_book_2,
-	},
-	{
-		.ident = "Surface Laptop 1",
-		.matches = {
-			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
-			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Laptop"),
-		},
-		.driver_data = (void *)&si_device_laptop_1,
-	},
-	{
-		.ident = "Surface Laptop 2",
-		.matches = {
-			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
-			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Laptop 2"),
-		},
-		.driver_data = (void *)&si_device_laptop_2,
-	},
-	{ }
-};
-
-#define SG5_PARAM_PERM		(S_IRUGO | S_IWUSR)
-
-enum sg5_perf_mode {
-	SG5_PERF_MODE_NORMAL   = 1,
-	SG5_PERF_MODE_BATTERY  = 2,
-	SG5_PERF_MODE_PERF1    = 3,
-	SG5_PERF_MODE_PERF2    = 4,
-
-	__SG5_PERF_MODE__START = 1,
-	__SG5_PERF_MODE__END   = 4,
-};
-
-enum sg5_param_perf_mode {
-	SG5_PARAM_PERF_MODE_AS_IS    = 0,
-	SG5_PARAM_PERF_MODE_NORMAL   = SG5_PERF_MODE_NORMAL,
-	SG5_PARAM_PERF_MODE_BATTERY  = SG5_PERF_MODE_BATTERY,
-	SG5_PARAM_PERF_MODE_PERF1    = SG5_PERF_MODE_PERF1,
-	SG5_PARAM_PERF_MODE_PERF2    = SG5_PERF_MODE_PERF2,
-
-	__SG5_PARAM_PERF_MODE__START = 0,
-	__SG5_PARAM_PERF_MODE__END   = 4,
-};
-
-
-static int sg5_ec_perf_mode_get(void)
-{
-	u8 result_buf[8] = { 0 };
-	int status;
-
-	struct surfacegen5_rqst rqst = {
-		.tc  = 0x03,
-		.iid = 0x00,
-		.cid = 0x02,
-		.snc = 0x01,
-		.cdl = 0x00,
-		.pld = NULL,
-	};
-
-	struct surfacegen5_buf result = {
-		.cap = ARRAY_SIZE(result_buf),
-		.len = 0,
-		.data = result_buf,
-	};
-
-	status = surfacegen5_ec_rqst(&rqst, &result);
-	if (status) {
-		return status;
-	}
-
-	if (result.len != 8) {
-		return -EFAULT;
-	}
-
-	return get_unaligned_le32(&result.data[0]);
-}
-
-static int sg5_ec_perf_mode_set(int perf_mode)
-{
-	u8 payload[4] = { 0 };
-
-	struct surfacegen5_rqst rqst = {
-		.tc  = 0x03,
-		.iid = 0x00,
-		.cid = 0x03,
-		.snc = 0x00,
-		.cdl = ARRAY_SIZE(payload),
-		.pld = payload,
-	};
-
-	if (perf_mode < __SG5_PERF_MODE__START || perf_mode > __SG5_PERF_MODE__END) {
-		return -EINVAL;
-	}
-
-	put_unaligned_le32(perf_mode, &rqst.pld[0]);
-	return surfacegen5_ec_rqst(&rqst, NULL);
-}
-
-
-static int param_perf_mode_set(const char *val, const struct kernel_param *kp)
-{
-	int perf_mode;
-	int status;
-
-	status = kstrtoint(val, 0, &perf_mode);
-	if (status) {
-		return status;
-	}
-
-	if (perf_mode < __SG5_PARAM_PERF_MODE__START || perf_mode > __SG5_PARAM_PERF_MODE__END) {
-		return -EINVAL;
-	}
-
-	return param_set_int(val, kp);
-}
-
-static const struct kernel_param_ops param_perf_mode_ops = {
-	.set = param_perf_mode_set,
-	.get = param_get_int,
-};
-
-static int param_perf_mode_init = SG5_PARAM_PERF_MODE_AS_IS;
-static int param_perf_mode_exit = SG5_PARAM_PERF_MODE_AS_IS;
-
-module_param_cb(perf_mode_init, &param_perf_mode_ops, &param_perf_mode_init, SG5_PARAM_PERM);
-module_param_cb(perf_mode_exit, &param_perf_mode_ops, &param_perf_mode_exit, SG5_PARAM_PERM);
-
-MODULE_PARM_DESC(perf_mode_init, "Performance-mode to be set on module initialization");
-MODULE_PARM_DESC(perf_mode_exit, "Performance-mode to be set on module exit");
-
-static ssize_t perf_mode_show(struct device *dev, struct device_attribute *attr, char *data)
-{
-	int perf_mode;
-
-	perf_mode = sg5_ec_perf_mode_get();
-	if (perf_mode < 0) {
-		dev_err(dev, "failed to get current performance mode: %d", perf_mode);
-		return -EIO;
-	}
-
-	return sprintf(data, "%d\n", perf_mode);
-}
-
-static ssize_t perf_mode_store(struct device *dev, struct device_attribute *attr,
-                               const char *data, size_t count)
-{
-	int perf_mode;
-	int status;
-
-	status = kstrtoint(data, 0, &perf_mode);
-	if (status) {
-		return status;
-	}
-
-	status = sg5_ec_perf_mode_set(perf_mode);
-	if (status) {
-		return status;
-	}
-
-	// TODO: Should we notify ACPI here?
-	//
-	//       There is a _DSM call described as
-	//           WSID._DSM: Notify DPTF on Slider State change
-	//       which calls
-	//           ODV3 = ToInteger (Arg3)
-	//           Notify(IETM, 0x88)
-	//       IETM is an INT3400 Intel Dynamic Power Performance Management
-	//       device, part of the DPTF framework. From the corresponding
-	//       kernel driver, it looks like event 0x88 is being ignored. Also
-	//       it is currently unknown what the consequecnes of setting ODV3
-	//       are.
-
-	return count;
-}
-
-const static DEVICE_ATTR_RW(perf_mode);
-
-static int sid_perf_mode_setup(struct platform_device *pdev, const struct si_device_info *info)
-{
-	int status;
-
-	if (!info->has_perf_mode)
-		return 0;
-
-	// link to ec
-	status = surfacegen5_ec_consumer_register(&pdev->dev);
-	if (status) {
-		return status == -ENXIO ? -EPROBE_DEFER : status;
-	}
-
-	// set initial perf_mode
-	if (param_perf_mode_init != SG5_PARAM_PERF_MODE_AS_IS) {
-		status = sg5_ec_perf_mode_set(param_perf_mode_init);
-		if (status) {
-			return status;
-		}
-	}
-
-	// register perf_mode attribute
-	status = sysfs_create_file(&pdev->dev.kobj, &dev_attr_perf_mode.attr);
-	if (status) {
-		goto err_sysfs;
-	}
-
-	return 0;
-
-err_sysfs:
-	sg5_ec_perf_mode_set(param_perf_mode_exit);
-	return status;
-}
-
-static void sid_perf_mode_remove(struct platform_device *pdev, const struct si_device_info *info)
-{
-	if (!info->has_perf_mode)
-		return;
-
-	// remove perf_mode attribute
-	sysfs_remove_file(&pdev->dev.kobj, &dev_attr_perf_mode.attr);
-
-	// set exit perf_mode
-	sg5_ec_perf_mode_set(param_perf_mode_exit);
-}
-
-
-static int sid_lid_enable_wakeup(const struct si_device_info *info, bool enable)
-{
-	int action = enable ? ACPI_GPE_ENABLE : ACPI_GPE_DISABLE;
-	int status;
-
-	if (!info->lid_device)
-		return 0;
-
-	status = acpi_set_gpe_wake_mask(NULL, info->lid_device->gpe_number, action);
-	if (status)
-		return -EFAULT;
-
-	return 0;
-}
-
-static int sid_lid_device_setup(const struct si_device_info *info)
-{
-	acpi_handle lid_handle;
-	int status;
-
-	if (!info->lid_device)
-		return 0;
-
-	status = acpi_get_handle(NULL, (acpi_string)info->lid_device->acpi_path, &lid_handle);
-	if (status)
-		return -EFAULT;
-
-	status = acpi_setup_gpe_for_wake(lid_handle, NULL, info->lid_device->gpe_number);
-	if (status)
-		return -EFAULT;
-
-	status = acpi_enable_gpe(NULL, info->lid_device->gpe_number);
-	if (status)
-		return -EFAULT;
-
-	return sid_lid_enable_wakeup(info, false);
-}
-
-static void sid_lid_device_remove(const struct si_device_info *info)
-{
-	/* restore default behavior without this module */
-	sid_lid_enable_wakeup(info, false);
-}
-
-
-static int surfacegen5_acpi_sid_suspend(struct device *dev)
-{
-	const struct si_device_info *info = dev_get_drvdata(dev);
-	return sid_lid_enable_wakeup(info, true);
-}
-
-static int surfacegen5_acpi_sid_resume(struct device *dev)
-{
-	const struct si_device_info *info = dev_get_drvdata(dev);
-	return sid_lid_enable_wakeup(info, false);
-}
-
-static SIMPLE_DEV_PM_OPS(surfacegen5_acpi_sid_pm, surfacegen5_acpi_sid_suspend, surfacegen5_acpi_sid_resume);
-
-
-static int surfacegen5_acpi_sid_probe(struct platform_device *pdev)
-{
-	const struct dmi_system_id *dmi_match;
-	struct si_device_info *info;
-	int status;
-
-	dmi_match = dmi_first_match(dmi_lid_device_table);
-	if (!dmi_match)
-		return -ENODEV;
-
-	info = dmi_match->driver_data;
-
-	platform_set_drvdata(pdev, info);
-
-	status = sid_perf_mode_setup(pdev, info);
-	if (status)
-		goto err_perf_mode;
-
-	status = sid_lid_device_setup(info);
-	if (status)
-		goto err_lid;
-
-	return 0;
-
-err_lid:
-	sid_perf_mode_remove(pdev, info);
-err_perf_mode:
-	return status;
-}
-
-static int surfacegen5_acpi_sid_remove(struct platform_device *pdev)
-{
-	const struct si_device_info *info = platform_get_drvdata(pdev);
-
-	sid_perf_mode_remove(pdev, info);
-	sid_lid_device_remove(info);
-
-	platform_set_drvdata(pdev, NULL);
-	return 0;
-}
-
-static const struct acpi_device_id surfacegen5_acpi_sid_match[] = {
-	{ "MSHW0081", },	/* Surface Pro 4, 5, and 6 */
-	{ "MSHW0080", },	/* Surface Book 1 */
-	{ "MSHW0107", },	/* Surface Book 2 */
-	{ "MSHW0086", },	/* Surface Laptop 1 */
-	{ "MSHW0112", },	/* Surface Laptop 2 */
-	{ },
-};
-MODULE_DEVICE_TABLE(acpi, surfacegen5_acpi_sid_match);
-
-struct platform_driver surfacegen5_acpi_sid = {
-	.probe = surfacegen5_acpi_sid_probe,
-	.remove = surfacegen5_acpi_sid_remove,
-	.driver = {
-		.name = "surfacegen5_acpi_sid",
-		.acpi_match_table = ACPI_PTR(surfacegen5_acpi_sid_match),
-		.pm = &surfacegen5_acpi_sid_pm,
-	},
-};
-
-inline int surfacegen5_acpi_sid_register(void)
-{
-	return platform_driver_register(&surfacegen5_acpi_sid);
-}
-
-inline void surfacegen5_acpi_sid_unregister(void)
-{
-	platform_driver_unregister(&surfacegen5_acpi_sid);
-}
-
-#else /* CONFIG_SURFACE_ACPI_SID */
-
-inline int surfacegen5_acpi_sid_register(void)
-{
-	return 0;
-}
-
-inline void surfacegen5_acpi_sid_unregister(void)
-{
-}
-
-#endif /* CONFIG_SURFACE_ACPI_SID */
-
-
-/*************************************************************************
- * Module initialization
- */
-
-int __init surface_acpi_init(void)
-{
-	int status;
-
-	status = surfacegen5_acpi_ssh_register();
-	if (status) {
-		goto err_ssh;
-	}
-
-	status = surfacegen5_acpi_san_register();
-	if (status) {
-		goto err_san;
-	}
-
-	status = surfacegen5_acpi_vhf_register();
-	if (status) {
-		goto err_vhf;
-	}
-
-	status = surfacegen5_acpi_dtx_register();
-	if (status) {
-		goto err_dtx;
-	}
-
-	status = surfacegen5_acpi_sid_register();
-	if (status) {
-		goto err_sid;
-	}
-
-	return 0;
-
-err_sid:
-	surfacegen5_acpi_sid_unregister();
-err_dtx:
-	surfacegen5_acpi_vhf_unregister();
-err_vhf:
-	surfacegen5_acpi_san_unregister();
-err_san:
-	surfacegen5_acpi_ssh_unregister();
-err_ssh:
-	return status;
-}
-
-void __exit surface_acpi_exit(void)
-{
-	surfacegen5_acpi_sid_unregister();
-	surfacegen5_acpi_dtx_unregister();
-	surfacegen5_acpi_vhf_unregister();
-	surfacegen5_acpi_san_unregister();
-	surfacegen5_acpi_ssh_unregister();
-}
-
-module_init(surface_acpi_init)
-module_exit(surface_acpi_exit)
-
-MODULE_AUTHOR("Maximilian Luz <luzmaximilian@gmail.com>");
-MODULE_DESCRIPTION("ACPI/Platform Drivers for Microsoft Surface Devices");
-MODULE_LICENSE("GPL v2");
diff --git a/drivers/platform/x86/surface_sam/Kconfig b/drivers/platform/x86/surface_sam/Kconfig
new file mode 100644
index 000000000000..3ef7d69a214f
--- /dev/null
+++ b/drivers/platform/x86/surface_sam/Kconfig
@@ -0,0 +1,104 @@
+menuconfig SURFACE_SAM
+    depends on ACPI
+    tristate "Microsoft Surface/System Aggregator Module and Platform Drivers"
+    ---help---
+      Drivers for the Surface/System Aggregator Module (SAM) of Microsoft
+      Surface devices.
+
+      SAM is an embedded controller that provides access to various
+      functionalities on these devices, including battery status, keyboard
+      events (on the Laptops) and many more.
+
+      Say Y here if you have a Microsoft Surface device with a SAM device
+      (i.e. 5th generation or later).
+
+config SURFACE_SAM_SSH
+	tristate "Surface Serial Hub Driver"
+	depends on SURFACE_SAM
+	depends on X86_INTEL_LPSS
+	depends on SERIAL_8250_DW
+	depends on SERIAL_8250_DMA
+	depends on SERIAL_DEV_CTRL_TTYPORT
+	select CRC_CCITT
+	default m
+	---help---
+	  Surface Serial Hub driver for 5th generation (or later) Microsoft
+	  Surface devices.
+
+	  This is the base driver for the embedded serial controller found on
+	  5th generation (and later) Microsoft Surface devices (e.g. Book 2,
+	  Laptop, Laptop 2, Pro 2017, Pro 6, ...). This driver itself only
+	  provides access to the embedded controller (SAM) and subsequent
+	  drivers are required for the respective functionalities.
+
+	  If you have a 5th generation (or later) Microsoft Surface device, say
+	  Y or M here.
+
+config SURFACE_SAM_SSH_DEBUG_DEVICE
+	bool "Surface Serial Hub Debug Device"
+	depends on SURFACE_SAM_SSH
+	default n
+	---help---
+	  Debug device for direct communication with the embedded controller
+	  found on 5th generation (and later) Microsoft Surface devices (e.g.
+	  Book 2, Laptop, Laptop 2, Pro 2017, Pro 6, ...) via sysfs.
+
+	  If you are not sure, say N here.
+
+config SURFACE_SAM_SAN
+	tristate "Surface ACPI Notify Driver"
+	depends on SURFACE_SAM_SSH
+	default m
+	---help---
+	  Surface ACPI Notify driver for 5th generation (or later) Microsoft
+	  Surface devices.
+
+	  This driver enables basic ACPI events and requests, such as battery
+	  status requests/events, thermal events, lid status, and possibly more,
+	  which would otherwise not work on these devices.
+
+	  If you are not sure, say Y here.
+
+config SURFACE_SAM_VHF
+	tristate "Surface Virtual HID Framework Driver"
+	depends on SURFACE_SAM_SSH
+	depends on HID
+	default m
+	---help---
+	  Surface Virtual HID Framework driver for 5th generation (or later)
+	  Microsoft Surface devices.
+
+	  This driver provides support for the Microsoft Virtual HID framework,
+	  which is required for the Surface Laptop (1 and newer) keyboard.
+
+	  If you are not sure, say Y here.
+
+config SURFACE_SAM_DTX
+	tristate "Surface Detachment System (DTX) Driver"
+	depends on SURFACE_SAM_SSH
+	depends on INPUT
+	default m
+	---help---
+	  Surface Detachment System (DTX) driver for the Microsoft Surface Book
+	  2. This driver provides support for proper detachment handling in
+	  user-space, status-events relating to the base and support for
+	  the safe-guard keeping the base attached when the discrete GPU
+	  contained in it is running via the special /dev/surface-dtx device.
+
+	  Also provides a standard input device to provide SW_TABLET_MODE events
+	  upon device mode change.
+
+	  If you are not sure, say Y here.
+
+config SURFACE_SAM_SID
+	tristate "Surface Platform Integration Driver"
+	depends on SURFACE_SAM_SSH
+	default m
+	---help---
+	  Surface Platform Integration Driver for the Microsoft Surface Devices.
+	  Currently only supports the Surface Book 2. This driver provides suport
+	  for setting performance-modes via the perf_mode sysfs attribute.
+	  Performance-modes directly influence the fan-profile of the device,
+	  allowing to choose between higher performance or quieter operation.
+
+	  If you are not sure, say Y here.
diff --git a/drivers/platform/x86/surface_sam/Makefile b/drivers/platform/x86/surface_sam/Makefile
new file mode 100644
index 000000000000..5431174ea993
--- /dev/null
+++ b/drivers/platform/x86/surface_sam/Makefile
@@ -0,0 +1,5 @@
+obj-$(CONFIG_SURFACE_SAM_SSH)	+= surface_sam_ssh.o
+obj-$(CONFIG_SURFACE_SAM_SAN)	+= surface_sam_san.o
+obj-$(CONFIG_SURFACE_SAM_SID)	+= surface_sam_sid.o
+obj-$(CONFIG_SURFACE_SAM_DTX)	+= surface_sam_dtx.o
+obj-$(CONFIG_SURFACE_SAM_VHF)	+= surface_sam_vhf.o
diff --git a/drivers/platform/x86/surface_sam/surface_sam_dtx.c b/drivers/platform/x86/surface_sam/surface_sam_dtx.c
new file mode 100644
index 000000000000..9f2c873f1452
--- /dev/null
+++ b/drivers/platform/x86/surface_sam/surface_sam_dtx.c
@@ -0,0 +1,620 @@
+/*
+ * Detachment system (DTX) driver for Microsoft Surface Book 2.
+ */
+
+#include <linux/acpi.h>
+#include <linux/delay.h>
+#include <linux/fs.h>
+#include <linux/input.h>
+#include <linux/ioctl.h>
+#include <linux/kernel.h>
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/poll.h>
+#include <linux/rculist.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/platform_device.h>
+
+#include "surface_sam_ssh.h"
+
+
+#define USB_VENDOR_ID_MICROSOFT				0x045e
+#define USB_DEVICE_ID_MS_SURFACE_BASE_2_INTEGRATION	0x0922
+
+// name copied from MS device manager
+#define DTX_INPUT_NAME	"Microsoft Surface Base 2 Integration Device"
+
+
+#define DTX_CMD_LATCH_LOCK				_IO(0x11, 0x01)
+#define DTX_CMD_LATCH_UNLOCK				_IO(0x11, 0x02)
+#define DTX_CMD_LATCH_REQUEST				_IO(0x11, 0x03)
+#define DTX_CMD_LATCH_OPEN				_IO(0x11, 0x04)
+#define DTX_CMD_GET_OPMODE				_IOR(0x11, 0x05, int)
+
+#define SAM_RQST_DTX_TC					0x11
+#define SAM_RQST_DTX_CID_LATCH_LOCK			0x06
+#define SAM_RQST_DTX_CID_LATCH_UNLOCK			0x07
+#define SAM_RQST_DTX_CID_LATCH_REQUEST			0x08
+#define SAM_RQST_DTX_CID_LATCH_OPEN			0x09
+#define SAM_RQST_DTX_CID_GET_OPMODE			0x0D
+
+#define SAM_EVENT_DTX_TC				0x11
+#define SAM_EVENT_DTX_RQID				0x0011
+#define SAM_EVENT_DTX_CID_CONNECTION			0x0c
+#define SAM_EVENT_DTX_CID_BUTTON			0x0e
+#define SAM_EVENT_DTX_CID_ERROR				0x0f
+#define SAM_EVENT_DTX_CID_LATCH_STATUS			0x11
+
+#define DTX_OPMODE_TABLET				0x00
+#define DTX_OPMODE_LAPTOP				0x01
+#define DTX_OPMODE_STUDIO				0x02
+
+#define DTX_LATCH_CLOSED				0x00
+#define DTX_LATCH_OPENED				0x01
+
+
+// Warning: This must always be a power of 2!
+#define DTX_CLIENT_BUF_SIZE				16
+
+#define DTX_CONNECT_OPMODE_DELAY			1000
+
+#define DTX_ERR		KERN_ERR "surface_sam_dtx: "
+#define DTX_WARN	KERN_WARNING "surface_sam_dtx: "
+
+
+struct surface_dtx_event {
+	u8 type;
+	u8 code;
+	u8 arg0;
+	u8 arg1;
+} __packed;
+
+struct surface_dtx_dev {
+	wait_queue_head_t waitq;
+	struct miscdevice mdev;
+	spinlock_t client_lock;
+	struct list_head client_list;
+	struct mutex mutex;
+	bool active;
+	spinlock_t input_lock;
+	struct input_dev *input_dev;
+};
+
+struct surface_dtx_client {
+	struct list_head node;
+	struct surface_dtx_dev *ddev;
+	struct fasync_struct *fasync;
+	spinlock_t buffer_lock;
+	unsigned int buffer_head;
+	unsigned int buffer_tail;
+	struct surface_dtx_event buffer[DTX_CLIENT_BUF_SIZE];
+};
+
+
+static struct surface_dtx_dev surface_dtx_dev;
+
+
+static int surface_sam_query_opmpde(void)
+{
+	u8 result_buf[1];
+	int status;
+
+	struct surface_sam_ssh_rqst rqst = {
+		.tc  = SAM_RQST_DTX_TC,
+		.iid = 0,
+		.cid = SAM_RQST_DTX_CID_GET_OPMODE,
+		.snc = 1,
+		.cdl = 0,
+		.pld = NULL,
+	};
+
+	struct surface_sam_ssh_buf result = {
+		.cap = 1,
+		.len = 0,
+		.data = result_buf,
+	};
+
+	status = surface_sam_ssh_rqst(&rqst, &result);
+	if (status) {
+		return status;
+	}
+
+	if (result.len != 1) {
+		return -EFAULT;
+	}
+
+	return result.data[0];
+}
+
+
+static int dtx_cmd_simple(u8 cid)
+{
+	struct surface_sam_ssh_rqst rqst = {
+		.tc  = SAM_RQST_DTX_TC,
+		.iid = 0,
+		.cid = cid,
+		.snc = 0,
+		.cdl = 0,
+		.pld = NULL,
+	};
+
+	return surface_sam_ssh_rqst(&rqst, NULL);
+}
+
+static int dtx_cmd_get_opmode(int __user *buf)
+{
+	int opmode = surface_sam_query_opmpde();
+	if (opmode < 0) {
+		return opmode;
+	}
+
+	if (put_user(opmode, buf)) {
+		return -EACCES;
+	}
+
+	return 0;
+}
+
+
+static int surface_dtx_open(struct inode *inode, struct file *file)
+{
+	struct surface_dtx_dev *ddev = container_of(file->private_data, struct surface_dtx_dev, mdev);
+	struct surface_dtx_client *client;
+
+	// initialize client
+	client = kzalloc(sizeof(struct surface_dtx_client), GFP_KERNEL);
+	if (!client) {
+		return -ENOMEM;
+	}
+
+	spin_lock_init(&client->buffer_lock);
+	client->buffer_head = 0;
+	client->buffer_tail = 0;
+	client->ddev = ddev;
+
+	// attach client
+	spin_lock(&ddev->client_lock);
+	list_add_tail_rcu(&client->node, &ddev->client_list);
+	spin_unlock(&ddev->client_lock);
+
+	file->private_data = client;
+	nonseekable_open(inode, file);
+
+	return 0;
+}
+
+static int surface_dtx_release(struct inode *inode, struct file *file)
+{
+	struct surface_dtx_client *client = file->private_data;
+
+	// detach client
+	spin_lock(&client->ddev->client_lock);
+	list_del_rcu(&client->node);
+	spin_unlock(&client->ddev->client_lock);
+	synchronize_rcu();
+
+	kfree(client);
+	file->private_data = NULL;
+
+	return 0;
+}
+
+static ssize_t surface_dtx_read(struct file *file, char __user *buf, size_t count, loff_t *offs)
+{
+	struct surface_dtx_client *client = file->private_data;
+	struct surface_dtx_dev *ddev = client->ddev;
+	struct surface_dtx_event event;
+	size_t read = 0;
+	int status = 0;
+
+	if (count != 0 && count < sizeof(struct surface_dtx_event)) {
+		return -EINVAL;
+	}
+
+	if (!ddev->active) {
+		return -ENODEV;
+	}
+
+	// check availability
+	if (client->buffer_head == client->buffer_tail){
+		if (file->f_flags & O_NONBLOCK) {
+			return -EAGAIN;
+		}
+
+		status = wait_event_interruptible(ddev->waitq,
+				client->buffer_head != client->buffer_tail ||
+				!ddev->active);
+		if (status) {
+			return status;
+		}
+
+		if (!ddev->active) {
+			return -ENODEV;
+		}
+	}
+
+	// copy events one by one
+	while (read + sizeof(struct surface_dtx_event) <= count) {
+		spin_lock_irq(&client->buffer_lock);
+
+		if(client->buffer_head == client->buffer_tail) {
+			spin_unlock_irq(&client->buffer_lock);
+			break;
+		}
+
+		// get one event
+		event = client->buffer[client->buffer_tail];
+		client->buffer_tail = (client->buffer_tail + 1) & (DTX_CLIENT_BUF_SIZE - 1);
+		spin_unlock_irq(&client->buffer_lock);
+
+		// copy to userspace
+		if(copy_to_user(buf, &event, sizeof(struct surface_dtx_event))) {
+			return -EFAULT;
+		}
+
+		read += sizeof(struct surface_dtx_event);
+	}
+
+	return read;
+}
+
+static __poll_t surface_dtx_poll(struct file *file, struct poll_table_struct *pt)
+{
+	struct surface_dtx_client *client = file->private_data;
+	int mask;
+
+	poll_wait(file, &client->ddev->waitq, pt);
+
+	if (client->ddev->active) {
+		mask = EPOLLOUT | EPOLLWRNORM;
+	} else {
+		mask = EPOLLHUP | EPOLLERR;
+	}
+
+	if (client->buffer_head != client->buffer_tail) {
+		mask |= EPOLLIN | EPOLLRDNORM;
+	}
+
+	return mask;
+}
+
+static int surface_dtx_fasync(int fd, struct file *file, int on)
+{
+	struct surface_dtx_client *client = file->private_data;
+
+	return fasync_helper(fd, file, on, &client->fasync);
+}
+
+static long surface_dtx_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+	struct surface_dtx_client *client = file->private_data;
+	struct surface_dtx_dev *ddev = client->ddev;
+	int status;
+
+	status = mutex_lock_interruptible(&ddev->mutex);
+	if (status) {
+		return status;
+	}
+
+	if (!ddev->active) {
+		mutex_unlock(&ddev->mutex);
+		return -ENODEV;
+	}
+
+	switch (cmd) {
+	case DTX_CMD_LATCH_LOCK:
+		status = dtx_cmd_simple(SAM_RQST_DTX_CID_LATCH_LOCK);
+		break;
+
+	case DTX_CMD_LATCH_UNLOCK:
+		status = dtx_cmd_simple(SAM_RQST_DTX_CID_LATCH_UNLOCK);
+		break;
+
+	case DTX_CMD_LATCH_REQUEST:
+		status = dtx_cmd_simple(SAM_RQST_DTX_CID_LATCH_REQUEST);
+		break;
+
+	case DTX_CMD_LATCH_OPEN:
+		status = dtx_cmd_simple(SAM_RQST_DTX_CID_LATCH_OPEN);
+		break;
+
+	case DTX_CMD_GET_OPMODE:
+		status = dtx_cmd_get_opmode((int __user *)arg);
+		break;
+
+	default:
+		status = -EINVAL;
+		break;
+	}
+
+	mutex_unlock(&ddev->mutex);
+	return status;
+}
+
+static const struct file_operations surface_dtx_fops = {
+	.owner          = THIS_MODULE,
+	.open           = surface_dtx_open,
+	.release        = surface_dtx_release,
+	.read           = surface_dtx_read,
+	.poll           = surface_dtx_poll,
+	.fasync         = surface_dtx_fasync,
+	.unlocked_ioctl = surface_dtx_ioctl,
+	.llseek         = no_llseek,
+};
+
+static struct surface_dtx_dev surface_dtx_dev = {
+	.mdev = {
+		.minor = MISC_DYNAMIC_MINOR,
+		.name = "surface_dtx",
+		.fops = &surface_dtx_fops,
+	},
+	.client_lock = __SPIN_LOCK_UNLOCKED(),
+	.input_lock = __SPIN_LOCK_UNLOCKED(),
+	.mutex  = __MUTEX_INITIALIZER(surface_dtx_dev.mutex),
+	.active = false,
+};
+
+
+static void surface_dtx_push_event(struct surface_dtx_dev *ddev, struct surface_dtx_event *event)
+{
+	struct surface_dtx_client *client;
+
+	rcu_read_lock();
+	list_for_each_entry_rcu(client, &ddev->client_list, node) {
+		spin_lock(&client->buffer_lock);
+
+		client->buffer[client->buffer_head++] = *event;
+		client->buffer_head &= DTX_CLIENT_BUF_SIZE - 1;
+
+		if (unlikely(client->buffer_head == client->buffer_tail)) {
+			printk(DTX_WARN "event buffer overrun\n");
+			client->buffer_tail = (client->buffer_tail + 1) & (DTX_CLIENT_BUF_SIZE - 1);
+		}
+
+		spin_unlock(&client->buffer_lock);
+
+		kill_fasync(&client->fasync, SIGIO, POLL_IN);
+	}
+	rcu_read_unlock();
+
+	wake_up_interruptible(&ddev->waitq);
+}
+
+
+static void surface_dtx_update_opmpde(struct surface_dtx_dev *ddev)
+{
+	struct surface_dtx_event event;
+	int opmode;
+
+	// get operation mode
+	opmode = surface_sam_query_opmpde();
+	if (opmode < 0) {
+		printk(DTX_ERR "EC request failed with error %d\n", opmode);
+	}
+
+	// send DTX event
+	event.type = 0x11;
+	event.code = 0x0D;
+	event.arg0 = opmode;
+	event.arg1 = 0x00;
+
+	surface_dtx_push_event(ddev, &event);
+
+	// send SW_TABLET_MODE event
+	spin_lock(&ddev->input_lock);
+	input_report_switch(ddev->input_dev, SW_TABLET_MODE, opmode == 0x00);
+	input_sync(ddev->input_dev);
+	spin_unlock(&ddev->input_lock);
+}
+
+static int surface_dtx_evt_dtx(struct surface_sam_ssh_event *in_event, void *data)
+{
+	struct surface_dtx_dev *ddev = data;
+	struct surface_dtx_event event;
+
+	switch (in_event->cid) {
+	case SAM_EVENT_DTX_CID_CONNECTION:
+	case SAM_EVENT_DTX_CID_BUTTON:
+	case SAM_EVENT_DTX_CID_ERROR:
+	case SAM_EVENT_DTX_CID_LATCH_STATUS:
+		if (in_event->len > 2) {
+			printk(DTX_ERR "unexpected payload size (cid: %x, len: %u)\n",
+			       in_event->cid, in_event->len);
+			return 0;
+		}
+
+		event.type = in_event->tc;
+		event.code = in_event->cid;
+		event.arg0 = in_event->len >= 1 ? in_event->pld[0] : 0x00;
+		event.arg1 = in_event->len >= 2 ? in_event->pld[1] : 0x00;
+		surface_dtx_push_event(ddev, &event);
+		break;
+
+	default:
+		printk(DTX_WARN "unhandled dtx event (cid: %x)\n", in_event->cid);
+	}
+
+	// update device mode
+	if (in_event->cid == SAM_EVENT_DTX_CID_CONNECTION) {
+		if (in_event->pld[0]) {
+			// Note: we're already in a workqueue task
+			msleep(DTX_CONNECT_OPMODE_DELAY);
+		}
+
+		surface_dtx_update_opmpde(ddev);
+	}
+
+	return 0;
+}
+
+static int surface_dtx_events_setup(struct surface_dtx_dev *ddev)
+{
+	int status;
+
+	status = surface_sam_ssh_set_event_handler(SAM_EVENT_DTX_RQID, surface_dtx_evt_dtx, ddev);
+	if (status) {
+		goto err_handler;
+	}
+
+	status = surface_sam_ssh_enable_event_source(SAM_EVENT_DTX_TC, 0x01, SAM_EVENT_DTX_RQID);
+	if (status) {
+		goto err_source;
+	}
+
+	return 0;
+
+err_source:
+	surface_sam_ssh_remove_event_handler(SAM_EVENT_DTX_RQID);
+err_handler:
+	return status;
+}
+
+static void surface_dtx_events_disable(void)
+{
+	surface_sam_ssh_disable_event_source(SAM_EVENT_DTX_TC, 0x01, SAM_EVENT_DTX_RQID);
+	surface_sam_ssh_remove_event_handler(SAM_EVENT_DTX_RQID);
+}
+
+
+static struct input_dev *surface_dtx_register_inputdev(struct platform_device *pdev)
+{
+	struct input_dev *input_dev;
+	int status;
+
+	input_dev = input_allocate_device();
+	if (!input_dev) {
+		return ERR_PTR(-ENOMEM);
+	}
+
+	input_dev->name = DTX_INPUT_NAME;
+	input_dev->dev.parent = &pdev->dev;
+	input_dev->id.bustype = BUS_VIRTUAL;
+	input_dev->id.vendor  = USB_VENDOR_ID_MICROSOFT;
+	input_dev->id.product = USB_DEVICE_ID_MS_SURFACE_BASE_2_INTEGRATION;
+
+	input_set_capability(input_dev, EV_SW, SW_TABLET_MODE);
+
+	status = surface_sam_query_opmpde();
+	if (status < 0) {
+		input_free_device(input_dev);
+		return ERR_PTR(status);
+	}
+
+	input_report_switch(input_dev, SW_TABLET_MODE, status == 0x00);
+
+	status = input_register_device(input_dev);
+	if (status) {
+		input_unregister_device(input_dev);
+		return ERR_PTR(status);
+	}
+
+	return input_dev;
+}
+
+
+static int surface_sam_dtx_probe(struct platform_device *pdev)
+{
+	struct surface_dtx_dev *ddev = &surface_dtx_dev;
+	struct input_dev *input_dev;
+	int status;
+
+	// link to ec
+	status = surface_sam_ssh_consumer_register(&pdev->dev);
+	if (status) {
+		return status == -ENXIO ? -EPROBE_DEFER : status;
+	}
+
+	input_dev = surface_dtx_register_inputdev(pdev);
+	if (IS_ERR(input_dev)) {
+		return PTR_ERR(input_dev);
+	}
+
+	// initialize device
+	mutex_lock(&ddev->mutex);
+	if (ddev->active) {
+		mutex_unlock(&ddev->mutex);
+		status = -ENODEV;
+		goto err_register;
+	}
+
+	INIT_LIST_HEAD(&ddev->client_list);
+	init_waitqueue_head(&ddev->waitq);
+	ddev->active = true;
+	ddev->input_dev = input_dev;
+	mutex_unlock(&ddev->mutex);
+
+	status = misc_register(&ddev->mdev);
+	if (status) {
+		goto err_register;
+	}
+
+	// enable events
+	status = surface_dtx_events_setup(ddev);
+	if (status) {
+		goto err_events_setup;
+	}
+
+	return 0;
+
+err_events_setup:
+	misc_deregister(&ddev->mdev);
+err_register:
+	input_unregister_device(ddev->input_dev);
+	return status;
+}
+
+static int surface_sam_dtx_remove(struct platform_device *pdev)
+{
+	struct surface_dtx_dev *ddev = &surface_dtx_dev;
+	struct surface_dtx_client *client;
+
+	mutex_lock(&ddev->mutex);
+	if (!ddev->active) {
+		mutex_unlock(&ddev->mutex);
+		return 0;
+	}
+
+	// mark as inactive
+	ddev->active = false;
+	mutex_unlock(&ddev->mutex);
+
+	// After this call we're guaranteed that no more input events will arive
+	surface_dtx_events_disable();
+
+	// wake up clients
+	spin_lock(&ddev->client_lock);
+	list_for_each_entry(client, &ddev->client_list, node) {
+		kill_fasync(&client->fasync, SIGIO, POLL_HUP);
+	}
+	spin_unlock(&ddev->client_lock);
+
+	wake_up_interruptible(&ddev->waitq);
+
+	// unregister user-space devices
+	input_unregister_device(ddev->input_dev);
+	misc_deregister(&ddev->mdev);
+
+	return 0;
+}
+
+
+static const struct acpi_device_id surface_sam_dtx_match[] = {
+	{ "MSHW0133", 0 },
+	{ },
+};
+MODULE_DEVICE_TABLE(acpi, surface_sam_dtx_match);
+
+struct platform_driver surface_sam_dtx = {
+	.probe = surface_sam_dtx_probe,
+	.remove = surface_sam_dtx_remove,
+	.driver = {
+		.name = "surface_sam_dtx",
+		.acpi_match_table = ACPI_PTR(surface_sam_dtx_match),
+	},
+};
+module_platform_driver(surface_sam_dtx);
+
+MODULE_AUTHOR("Maximilian Luz <luzmaximilian@gmail.com>");
+MODULE_DESCRIPTION("Surface Detachment System (DTX) Driver for 5th Generation Surface Devices");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/platform/x86/surface_sam/surface_sam_san.c b/drivers/platform/x86/surface_sam/surface_sam_san.c
new file mode 100644
index 000000000000..9da7843167ad
--- /dev/null
+++ b/drivers/platform/x86/surface_sam/surface_sam_san.c
@@ -0,0 +1,708 @@
+/*
+ * Surface ACPI Notify (SAN) and ACPI integration driver for SAM.
+ * Translates communication from ACPI to SSH and back.
+ */
+
+#include <linux/acpi.h>
+#include <linux/delay.h>
+#include <linux/jiffies.h>
+#include <linux/kernel.h>
+#include <linux/platform_device.h>
+
+#include "surface_sam_ssh.h"
+
+
+#define SAN_RQST_RETRY				5
+
+#define SAN_DSM_REVISION			0
+#define SAN_DSM_FN_NOTIFY_SENSOR_TRIP_POINT	0x09
+
+static const guid_t SAN_DSM_UUID =
+	GUID_INIT(0x93b666c5, 0x70c6, 0x469f, 0xa2, 0x15, 0x3d,
+	          0x48, 0x7c, 0x91, 0xab, 0x3c);
+
+#define SAM_EVENT_DELAY_PWR_STATE	msecs_to_jiffies(5000)
+
+#define SAM_EVENT_PWR_TC		0x02
+#define SAM_EVENT_PWR_RQID		0x0002
+#define SAM_EVENT_PWR_CID_HWCHANGE	0x15
+#define SAM_EVENT_PWR_CID_CHARGING	0x16
+#define SAM_EVENT_PWR_CID_ADAPTER	0x17
+#define SAM_EVENT_PWR_CID_STATE		0x4f
+
+#define SAM_EVENT_TEMP_TC		0x03
+#define SAM_EVENT_TEMP_RQID		0x0003
+#define SAM_EVENT_TEMP_CID_NOTIFY_SENSOR_TRIP_POINT	0x0b
+
+#define SAN_RQST_TAG			"surface_sam_san_rqst: "
+
+#define SAN_QUIRK_BASE_STATE_DELAY	1000
+
+
+struct san_acpi_consumer {
+	char *path;
+	bool  required;
+	u32   flags;
+};
+
+struct san_opreg_context {
+	struct acpi_connection_info connection;
+	struct device *dev;
+};
+
+struct san_consumer_link {
+	const struct san_acpi_consumer *properties;
+	struct device_link                         *link;
+};
+
+struct san_consumers {
+	u32                                   num;
+	struct san_consumer_link *links;
+};
+
+struct san_drvdata {
+	struct san_opreg_context opreg_ctx;
+	struct san_consumers     consumers;
+};
+
+struct gsb_data_in {
+	u8 cv;
+} __packed;
+
+struct gsb_data_rqsx {
+	u8 cv;				// command value (should be 0x01 or 0x03)
+	u8 tc;				// target controller
+	u8 tid;				// expected to be 0x01, could be revision
+	u8 iid;				// target sub-controller (e.g. primary vs. secondary battery)
+	u8 snc;				// expect-response-flag
+	u8 cid;				// command ID
+	u8 cdl;				// payload length
+	u8 _pad;			// padding
+	u8 pld[0];			// payload
+} __packed;
+
+struct gsb_data_etwl {
+	u8 cv;				// command value (should be 0x02)
+	u8 etw3;			// ?
+	u8 etw4;			// ?
+	u8 msg[0];			// error message (ASCIIZ)
+} __packed;
+
+struct gsb_data_out {
+	u8 status;			// _SSH communication status
+	u8 len;				// _SSH payload length
+	u8 pld[0];			// _SSH payload
+} __packed;
+
+union gsb_buffer_data {
+	struct gsb_data_in   in;	// common input
+	struct gsb_data_rqsx rqsx;	// RQSX input
+	struct gsb_data_etwl etwl;	// ETWL input
+	struct gsb_data_out  out;	// output
+};
+
+struct gsb_buffer {
+	u8 status;			// GSB AttribRawProcess status
+	u8 len;				// GSB AttribRawProcess length
+	union gsb_buffer_data data;
+} __packed;
+
+
+enum san_pwr_event {
+	SAN_PWR_EVENT_BAT1_STAT	= 0x03,
+	SAN_PWR_EVENT_BAT1_INFO	= 0x04,
+	SAN_PWR_EVENT_ADP1_STAT	= 0x05,
+	SAN_PWR_EVENT_ADP1_INFO	= 0x06,
+	SAN_PWR_EVENT_BAT2_STAT	= 0x07,
+	SAN_PWR_EVENT_BAT2_INFO	= 0x08,
+};
+
+
+static int san_acpi_notify_power_event(struct device *dev, enum san_pwr_event event)
+{
+	acpi_handle san = ACPI_HANDLE(dev);
+	union acpi_object *obj;
+
+	obj = acpi_evaluate_dsm_typed(san, &SAN_DSM_UUID, SAN_DSM_REVISION,
+	                              (u8) event, NULL, ACPI_TYPE_BUFFER);
+
+	if (IS_ERR_OR_NULL(obj)) {
+		return obj ? PTR_ERR(obj) : -ENXIO;
+	}
+
+	if (obj->buffer.length != 1 || obj->buffer.pointer[0] != 0) {
+		dev_err(dev, "got unexpected result from _DSM\n");
+		return -EFAULT;
+	}
+
+	ACPI_FREE(obj);
+	return 0;
+}
+
+static int san_acpi_notify_sensor_trip_point(struct device *dev, u8 iid)
+{
+	acpi_handle san = ACPI_HANDLE(dev);
+	union acpi_object *obj;
+	union acpi_object param;
+
+	param.type = ACPI_TYPE_INTEGER;
+	param.integer.value = iid;
+
+	obj = acpi_evaluate_dsm_typed(san, &SAN_DSM_UUID, SAN_DSM_REVISION,
+	                              SAN_DSM_FN_NOTIFY_SENSOR_TRIP_POINT,
+				      &param, ACPI_TYPE_BUFFER);
+
+	if (IS_ERR_OR_NULL(obj)) {
+		return obj ? PTR_ERR(obj) : -ENXIO;
+	}
+
+	if (obj->buffer.length != 1 || obj->buffer.pointer[0] != 0) {
+		dev_err(dev, "got unexpected result from _DSM\n");
+		return -EFAULT;
+	}
+
+	ACPI_FREE(obj);
+	return 0;
+}
+
+
+inline static int san_evt_power_adapter(struct device *dev, struct surface_sam_ssh_event *event)
+{
+	int status;
+
+	status = san_acpi_notify_power_event(dev, SAN_PWR_EVENT_ADP1_STAT);
+	if (status) {
+		dev_err(dev, "error handling power event (cid = %x)\n", event->cid);
+		return status;
+	}
+
+	return 0;
+}
+
+inline static int san_evt_power_hwchange(struct device *dev, struct surface_sam_ssh_event *event)
+{
+	enum san_pwr_event evcode;
+	int status;
+
+	if (event->iid == 0x02) {
+		evcode = SAN_PWR_EVENT_BAT2_INFO;
+	} else {
+		evcode = SAN_PWR_EVENT_BAT1_INFO;
+	}
+
+	status = san_acpi_notify_power_event(dev, evcode);
+	if (status) {
+		dev_err(dev, "error handling power event (cid = %x)\n", event->cid);
+		return status;
+	}
+
+	return 0;
+}
+
+inline static int san_evt_power_state(struct device *dev, struct surface_sam_ssh_event *event)
+{
+	int status;
+
+	status = san_acpi_notify_power_event(dev, SAN_PWR_EVENT_BAT1_STAT);
+	if (status) {
+		dev_err(dev, "error handling power event (cid = %x)\n", event->cid);
+		return status;
+	}
+
+	status = san_acpi_notify_power_event(dev, SAN_PWR_EVENT_BAT2_STAT);
+	if (status) {
+		dev_err(dev, "error handling power event (cid = %x)\n", event->cid);
+		return status;
+	}
+
+	return 0;
+}
+
+static unsigned long san_evt_power_delay(struct surface_sam_ssh_event *event, void *data)
+{
+	switch (event->cid) {
+	case SAM_EVENT_PWR_CID_CHARGING:
+	case SAM_EVENT_PWR_CID_STATE:
+		return SAM_EVENT_DELAY_PWR_STATE;
+
+	case SAM_EVENT_PWR_CID_ADAPTER:
+	case SAM_EVENT_PWR_CID_HWCHANGE:
+	default:
+		return 0;
+	}
+}
+
+static int san_evt_power(struct surface_sam_ssh_event *event, void *data)
+{
+	struct device *dev = (struct device *)data;
+
+	switch (event->cid) {
+	case SAM_EVENT_PWR_CID_HWCHANGE:
+		return san_evt_power_hwchange(dev, event);
+
+	case SAM_EVENT_PWR_CID_ADAPTER:
+		return san_evt_power_adapter(dev, event);
+
+	case SAM_EVENT_PWR_CID_CHARGING:
+	case SAM_EVENT_PWR_CID_STATE:
+		return san_evt_power_state(dev, event);
+
+	default:
+		dev_warn(dev, "unhandled power event (cid = %x)\n", event->cid);
+	}
+
+	return 0;
+}
+
+
+inline static int san_evt_thermal_notify(struct device *dev, struct surface_sam_ssh_event *event)
+{
+	int status;
+
+	status = san_acpi_notify_sensor_trip_point(dev, event->iid);
+	if (status) {
+		dev_err(dev, "error handling thermal event (cid = %x)\n", event->cid);
+		return status;
+	}
+
+	return 0;
+}
+
+static int san_evt_thermal(struct surface_sam_ssh_event *event, void *data)
+{
+	struct device *dev = (struct device *)data;
+
+	switch (event->cid) {
+	case SAM_EVENT_TEMP_CID_NOTIFY_SENSOR_TRIP_POINT:
+		return san_evt_thermal_notify(dev, event);
+
+	default:
+		dev_warn(dev, "unhandled thermal event (cid = %x)\n", event->cid);
+	}
+
+	return 0;
+}
+
+
+static struct gsb_data_rqsx
+*san_validate_rqsx(struct device *dev, const char *type, struct gsb_buffer *buffer)
+{
+	struct gsb_data_rqsx *rqsx = &buffer->data.rqsx;
+
+	if (buffer->len < 8) {
+		dev_err(dev, "invalid %s package (len = %d)\n",
+			type, buffer->len);
+		return NULL;
+	}
+
+	if (rqsx->cdl != buffer->len - 8) {
+		dev_err(dev, "bogus %s package (len = %d, cdl = %d)\n",
+			type, buffer->len, rqsx->cdl);
+		return NULL;
+	}
+
+	if (rqsx->tid != 0x01) {
+		dev_warn(dev, "unsupported %s package (tid = 0x%02x)\n",
+			 type, rqsx->tid);
+		return NULL;
+	}
+
+	return rqsx;
+}
+
+static acpi_status
+san_etwl(struct san_opreg_context *ctx, struct gsb_buffer *buffer)
+{
+	struct gsb_data_etwl *etwl = &buffer->data.etwl;
+
+	if (buffer->len < 3) {
+		dev_err(ctx->dev, "invalid ETWL package (len = %d)\n", buffer->len);
+		return AE_OK;
+	}
+
+	dev_err(ctx->dev, "ETWL(0x%02x, 0x%02x): %.*s\n",
+		etwl->etw3, etwl->etw4,
+		buffer->len - 3, (char *)etwl->msg);
+
+	// indicate success
+	buffer->status = 0x00;
+	buffer->len = 0x00;
+
+	return AE_OK;
+}
+
+static acpi_status
+san_rqst(struct san_opreg_context *ctx, struct gsb_buffer *buffer)
+{
+	struct gsb_data_rqsx *gsb_rqst = san_validate_rqsx(ctx->dev, "RQST", buffer);
+	struct surface_sam_ssh_rqst rqst = {};
+	struct surface_sam_ssh_buf result = {};
+	int status = 0;
+	int try;
+
+	if (!gsb_rqst) {
+		return AE_OK;
+	}
+
+	rqst.tc  = gsb_rqst->tc;
+	rqst.iid = gsb_rqst->iid;
+	rqst.cid = gsb_rqst->cid;
+	rqst.snc = gsb_rqst->snc;
+	rqst.cdl = gsb_rqst->cdl;
+	rqst.pld = &gsb_rqst->pld[0];
+
+	result.cap  = SURFACE_SAM_SSH_MAX_RQST_RESPONSE;
+	result.len  = 0;
+	result.data = kzalloc(result.cap, GFP_KERNEL);
+
+	if (!result.data) {
+		return AE_NO_MEMORY;
+	}
+
+	for (try = 0; try < SAN_RQST_RETRY; try++) {
+		if (try) {
+			dev_warn(ctx->dev, SAN_RQST_TAG "IO error occured, trying again\n");
+		}
+
+		status = surface_sam_ssh_rqst(&rqst, &result);
+		if (status != -EIO) break;
+	}
+
+	if (rqst.tc == 0x11 && rqst.cid == 0x0D && status == -EPERM) {
+		/* Base state quirk:
+		 * The base state may be queried from ACPI when the EC is still
+		 * suspended. In this case it will return '-EPERM'. This query
+		 * will only be triggered from the ACPI lid GPE interrupt, thus
+		 * we are either in laptop or studio mode (base status 0x01 or
+		 * 0x02). Furthermore, we will only get here if the device (and
+		 * EC) have been suspended.
+		 *
+		 * We now assume that the device is in laptop mode (0x01). This
+		 * has the drawback that it will wake the device when unfolding
+		 * it in studio mode, but it also allows us to avoid actively
+		 * waiting for the EC to wake up, which may incur a notable
+		 * delay.
+		 */
+
+		buffer->status          = 0x00;
+		buffer->len             = 0x03;
+		buffer->data.out.status = 0x00;
+		buffer->data.out.len    = 0x01;
+		buffer->data.out.pld[0] = 0x01;
+
+	} else if (!status) {		// success
+		buffer->status          = 0x00;
+		buffer->len             = result.len + 2;
+		buffer->data.out.status = 0x00;
+		buffer->data.out.len    = result.len;
+		memcpy(&buffer->data.out.pld[0], result.data, result.len);
+
+	} else {			// failure
+		dev_err(ctx->dev, SAN_RQST_TAG "failed with error %d\n", status);
+		buffer->status          = 0x00;
+		buffer->len             = 0x02;
+		buffer->data.out.status = 0x01;		// indicate _SSH error
+		buffer->data.out.len    = 0x00;
+	}
+
+	kfree(result.data);
+
+	return AE_OK;
+}
+
+static acpi_status
+san_rqsg(struct san_opreg_context *ctx, struct gsb_buffer *buffer)
+{
+	struct gsb_data_rqsx *rqsg = san_validate_rqsx(ctx->dev, "RQSG", buffer);
+
+	if (!rqsg) {
+		return AE_OK;
+	}
+
+	// TODO: RQSG handler
+
+	dev_warn(ctx->dev, "unsupported request: RQSG(0x%02x, 0x%02x, 0x%02x)\n",
+		 rqsg->tc, rqsg->cid, rqsg->iid);
+
+	return AE_OK;
+}
+
+
+static acpi_status
+san_opreg_handler(u32 function, acpi_physical_address command,
+		  u32 bits, u64 *value64,
+		  void *opreg_context, void *region_context)
+{
+	struct san_opreg_context *context = opreg_context;
+	struct gsb_buffer *buffer = (struct gsb_buffer *)value64;
+	int accessor_type = (0xFFFF0000 & function) >> 16;
+
+	if (command != 0) {
+		dev_warn(context->dev, "unsupported command: 0x%02llx\n", command);
+		return AE_OK;
+	}
+
+	if (accessor_type != ACPI_GSB_ACCESS_ATTRIB_RAW_PROCESS) {
+		dev_err(context->dev, "invalid access type: 0x%02x\n", accessor_type);
+		return AE_OK;
+	}
+
+	// buffer must have at least contain the command-value
+	if (buffer->len == 0) {
+		dev_err(context->dev, "request-package too small\n");
+		return AE_OK;
+	}
+
+	switch (buffer->data.in.cv) {
+	case 0x01:  return san_rqst(context, buffer);
+	case 0x02:  return san_etwl(context, buffer);
+	case 0x03:  return san_rqsg(context, buffer);
+	}
+
+	dev_warn(context->dev, "unsupported SAN0 request (cv: 0x%02x)\n", buffer->data.in.cv);
+	return AE_OK;
+}
+
+static int san_enable_events(struct device *dev)
+{
+	int status;
+
+	status = surface_sam_ssh_set_delayed_event_handler(
+			SAM_EVENT_PWR_RQID, san_evt_power,
+			san_evt_power_delay, dev);
+	if (status) {
+		goto err_handler_power;
+	}
+
+	status = surface_sam_ssh_set_event_handler(
+			SAM_EVENT_TEMP_RQID, san_evt_thermal,
+			dev);
+	if (status) {
+		goto err_handler_thermal;
+	}
+
+	status = surface_sam_ssh_enable_event_source(SAM_EVENT_PWR_TC, 0x01, SAM_EVENT_PWR_RQID);
+	if (status) {
+		goto err_source_power;
+	}
+
+	status = surface_sam_ssh_enable_event_source(SAM_EVENT_TEMP_TC, 0x01, SAM_EVENT_TEMP_RQID);
+	if (status) {
+		goto err_source_thermal;
+	}
+
+	return 0;
+
+err_source_thermal:
+	surface_sam_ssh_disable_event_source(SAM_EVENT_PWR_TC, 0x01, SAM_EVENT_PWR_RQID);
+err_source_power:
+	surface_sam_ssh_remove_event_handler(SAM_EVENT_TEMP_RQID);
+err_handler_thermal:
+	surface_sam_ssh_remove_event_handler(SAM_EVENT_PWR_RQID);
+err_handler_power:
+	return status;
+}
+
+static void san_disable_events(void)
+{
+	surface_sam_ssh_disable_event_source(SAM_EVENT_TEMP_TC, 0x01, SAM_EVENT_TEMP_RQID);
+	surface_sam_ssh_disable_event_source(SAM_EVENT_PWR_TC, 0x01, SAM_EVENT_PWR_RQID);
+	surface_sam_ssh_remove_event_handler(SAM_EVENT_TEMP_RQID);
+	surface_sam_ssh_remove_event_handler(SAM_EVENT_PWR_RQID);
+}
+
+
+static int san_consumers_link(struct platform_device *pdev,
+			      const struct san_acpi_consumer *cons,
+			      struct san_consumers *out)
+{
+	const struct san_acpi_consumer *con;
+	struct san_consumer_link *links, *link;
+	struct acpi_device *adev;
+	acpi_handle handle;
+	u32 max_links = 0;
+	int status;
+
+	if (!cons) {
+		return 0;
+	}
+
+	// count links
+	for (con = cons; con->path; ++con) {
+		max_links += 1;
+	}
+
+	// allocate
+	links = kzalloc(max_links * sizeof(struct san_consumer_link), GFP_KERNEL);
+	link = &links[0];
+
+	if (!links) {
+		return -ENOMEM;
+	}
+
+	// create links
+	for (con = cons; con->path; ++con) {
+		status = acpi_get_handle(NULL, con->path, &handle);
+		if (status) {
+			if (con->required || status != AE_NOT_FOUND) {
+				status = -ENXIO;
+				goto cleanup;
+			} else {
+				continue;
+			}
+		}
+
+		status = acpi_bus_get_device(handle, &adev);
+		if (status) {
+			goto cleanup;
+		}
+
+		link->link = device_link_add(&adev->dev, &pdev->dev, con->flags);
+		if (!(link->link)) {
+			status = -EFAULT;
+			goto cleanup;
+		}
+		link->properties = con;
+
+		link += 1;
+	}
+
+	out->num = link - links;
+	out->links = links;
+
+	return 0;
+
+cleanup:
+	for (link = link - 1; link >= links; --link) {
+		if (link->properties->flags & DL_FLAG_STATELESS) {
+			device_link_del(link->link);
+		}
+	}
+
+	return status;
+}
+
+static void san_consumers_unlink(struct san_consumers *consumers) {
+	u32 i;
+
+	if (!consumers) {
+		return;
+	}
+
+	for (i = 0; i < consumers->num; ++i) {
+		if (consumers->links[i].properties->flags & DL_FLAG_STATELESS) {
+			device_link_del(consumers->links[i].link);
+		}
+	}
+
+	kfree(consumers->links);
+
+	consumers->num = 0;
+	consumers->links = NULL;
+}
+
+static int surface_sam_san_probe(struct platform_device *pdev)
+{
+	const struct san_acpi_consumer *cons;
+	struct san_drvdata *drvdata;
+	acpi_handle san = ACPI_HANDLE(&pdev->dev);	// _SAN device node
+	int status;
+
+	/*
+	 * Defer probe if the _SSH driver has not set up the controller yet. This
+	 * makes sure we do not fail any initial requests (e.g. _STA request without
+	 * which the battery does not get set up correctly). Otherwise register as
+	 * consumer to set up a device_link.
+	 */
+	status = surface_sam_ssh_consumer_register(&pdev->dev);
+	if (status) {
+		return status == -ENXIO ? -EPROBE_DEFER : status;
+	}
+
+	drvdata = kzalloc(sizeof(struct san_drvdata), GFP_KERNEL);
+	if (!drvdata) {
+		return -ENOMEM;
+	}
+
+	drvdata->opreg_ctx.dev = &pdev->dev;
+
+	cons = acpi_device_get_match_data(&pdev->dev);
+	status = san_consumers_link(pdev, cons, &drvdata->consumers);
+	if (status) {
+		goto err_consumers;
+	}
+
+	platform_set_drvdata(pdev, drvdata);
+
+	status = acpi_install_address_space_handler(san,
+			ACPI_ADR_SPACE_GSBUS,
+			&san_opreg_handler,
+			NULL, &drvdata->opreg_ctx);
+
+	if (ACPI_FAILURE(status)) {
+		status = -ENODEV;
+		goto err_install_handler;
+	}
+
+	status = san_enable_events(&pdev->dev);
+	if (status) {
+		goto err_enable_events;
+	}
+
+	acpi_walk_dep_device_list(san);
+	return 0;
+
+err_enable_events:
+	acpi_remove_address_space_handler(san, ACPI_ADR_SPACE_GSBUS, &san_opreg_handler);
+err_install_handler:
+	platform_set_drvdata(san, NULL);
+	san_consumers_unlink(&drvdata->consumers);
+err_consumers:
+	kfree(drvdata);
+	return status;
+}
+
+static int surface_sam_san_remove(struct platform_device *pdev)
+{
+	struct san_drvdata *drvdata = platform_get_drvdata(pdev);
+	acpi_handle san = ACPI_HANDLE(&pdev->dev);	// _SAN device node
+	acpi_status status = AE_OK;
+
+	acpi_remove_address_space_handler(san, ACPI_ADR_SPACE_GSBUS, &san_opreg_handler);
+	san_disable_events();
+
+	san_consumers_unlink(&drvdata->consumers);
+	kfree(drvdata);
+
+	platform_set_drvdata(pdev, NULL);
+	return status;
+}
+
+
+static const struct san_acpi_consumer san_mshw0091_consumers[] = {
+	{ "\\_SB.SRTC", true,  DL_FLAG_PM_RUNTIME | DL_FLAG_STATELESS },
+	{ "\\ADP1",     true,  DL_FLAG_PM_RUNTIME | DL_FLAG_STATELESS },
+	{ "\\_SB.BAT1", true,  DL_FLAG_PM_RUNTIME | DL_FLAG_STATELESS },
+	{ "\\_SB.BAT2", false, DL_FLAG_PM_RUNTIME | DL_FLAG_STATELESS },
+	{ },
+};
+
+static const struct acpi_device_id surface_sam_san_match[] = {
+	{ "MSHW0091", (long unsigned int) san_mshw0091_consumers },
+	{ },
+};
+MODULE_DEVICE_TABLE(acpi, surface_sam_san_match);
+
+struct platform_driver surface_sam_san = {
+	.probe = surface_sam_san_probe,
+	.remove = surface_sam_san_remove,
+	.driver = {
+		.name = "surface_sam_san",
+		.acpi_match_table = ACPI_PTR(surface_sam_san_match),
+	},
+};
+module_platform_driver(surface_sam_san);
+
+MODULE_AUTHOR("Maximilian Luz <luzmaximilian@gmail.com>");
+MODULE_DESCRIPTION("Surface ACPI Notify Driver for 5th Generation Surface Devices");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/platform/x86/surface_sam/surface_sam_sid.c b/drivers/platform/x86/surface_sam/surface_sam_sid.c
new file mode 100644
index 000000000000..ff440619bcf2
--- /dev/null
+++ b/drivers/platform/x86/surface_sam/surface_sam_sid.c
@@ -0,0 +1,483 @@
+/*
+ * Surface/System Integration Device (SID) driver.
+ * Intended for device-dependent configuration and minor functionality.
+ * Handles performance-modes and wakeup via lid open.
+ */
+
+#include <asm/unaligned.h>
+#include <linux/acpi.h>
+#include <linux/dmi.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/platform_device.h>
+#include <linux/sysfs.h>
+
+#include "surface_sam_ssh.h"
+
+
+struct sid_lid_device {
+	const char *acpi_path;
+	const u32 gpe_number;
+};
+
+struct sid_device_info {
+	const bool has_perf_mode;
+	const struct sid_lid_device *lid_device;
+};
+
+
+static const struct sid_lid_device lid_device_l17 = {
+	.acpi_path = "\\_SB.LID0",
+	.gpe_number = 0x17,
+};
+
+static const struct sid_lid_device lid_device_l4F = {
+	.acpi_path = "\\_SB.LID0",
+	.gpe_number = 0x4F,
+};
+
+static const struct sid_lid_device lid_device_l57 = {
+	.acpi_path = "\\_SB.LID0",
+	.gpe_number = 0x57,
+};
+
+
+static const struct sid_device_info si_device_pro_4 = {
+	.has_perf_mode = false,
+	.lid_device = &lid_device_l17,
+};
+
+static const struct sid_device_info si_device_pro_5 = {
+	.has_perf_mode = false,
+	.lid_device = &lid_device_l4F,
+};
+
+static const struct sid_device_info si_device_pro_6 = {
+	.has_perf_mode = false,
+	.lid_device = &lid_device_l4F,
+};
+
+static const struct sid_device_info si_device_book_1 = {
+	.has_perf_mode = false,
+	.lid_device = &lid_device_l17,
+};
+
+static const struct sid_device_info si_device_book_2 = {
+	.has_perf_mode = true,
+	.lid_device = &lid_device_l17,
+};
+
+static const struct sid_device_info si_device_laptop_1 = {
+	.has_perf_mode = false,
+	.lid_device = &lid_device_l57,
+};
+
+static const struct sid_device_info si_device_laptop_2 = {
+	.has_perf_mode = false,
+	.lid_device = &lid_device_l57,
+};
+
+
+static const struct dmi_system_id dmi_lid_device_table[] = {
+	{
+		.ident = "Surface Pro 4",
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Pro 4"),
+		},
+		.driver_data = (void *)&si_device_pro_4,
+	},
+	{
+		.ident = "Surface Pro 5",
+		.matches = {
+			/* match for SKU here due to generic product name "Surface Pro" */
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "Surface_Pro_1796"),
+		},
+		.driver_data = (void *)&si_device_pro_5,
+	},
+	{
+		.ident = "Surface Pro 5 (LTE)",
+		.matches = {
+			/* match for SKU here due to generic product name "Surface Pro" */
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "Surface_Pro_1807"),
+		},
+		.driver_data = (void *)&si_device_pro_5,
+	},
+	{
+		.ident = "Surface Pro 6",
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Pro 6"),
+		},
+		.driver_data = (void *)&si_device_pro_6,
+	},
+	{
+		.ident = "Surface Book 1",
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Book"),
+		},
+		.driver_data = (void *)&si_device_book_1,
+	},
+	{
+		.ident = "Surface Book 2",
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Book 2"),
+		},
+		.driver_data = (void *)&si_device_book_2,
+	},
+	{
+		.ident = "Surface Laptop 1",
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Laptop"),
+		},
+		.driver_data = (void *)&si_device_laptop_1,
+	},
+	{
+		.ident = "Surface Laptop 2",
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Laptop 2"),
+		},
+		.driver_data = (void *)&si_device_laptop_2,
+	},
+	{ }
+};
+
+
+#define SID_PARAM_PERM		(S_IRUGO | S_IWUSR)
+
+enum sam_perf_mode {
+	SAM_PERF_MODE_NORMAL   = 1,
+	SAM_PERF_MODE_BATTERY  = 2,
+	SAM_PERF_MODE_PERF1    = 3,
+	SAM_PERF_MODE_PERF2    = 4,
+
+	__SAM_PERF_MODE__START = 1,
+	__SAM_PERF_MODE__END   = 4,
+};
+
+enum sid_param_perf_mode {
+	SID_PARAM_PERF_MODE_AS_IS    = 0,
+	SID_PARAM_PERF_MODE_NORMAL   = SAM_PERF_MODE_NORMAL,
+	SID_PARAM_PERF_MODE_BATTERY  = SAM_PERF_MODE_BATTERY,
+	SID_PARAM_PERF_MODE_PERF1    = SAM_PERF_MODE_PERF1,
+	SID_PARAM_PERF_MODE_PERF2    = SAM_PERF_MODE_PERF2,
+
+	__SID_PARAM_PERF_MODE__START = 0,
+	__SID_PARAM_PERF_MODE__END   = 4,
+};
+
+
+static int surface_sam_perf_mode_get(void)
+{
+	u8 result_buf[8] = { 0 };
+	int status;
+
+	struct surface_sam_ssh_rqst rqst = {
+		.tc  = 0x03,
+		.iid = 0x00,
+		.cid = 0x02,
+		.snc = 0x01,
+		.cdl = 0x00,
+		.pld = NULL,
+	};
+
+	struct surface_sam_ssh_buf result = {
+		.cap = ARRAY_SIZE(result_buf),
+		.len = 0,
+		.data = result_buf,
+	};
+
+	status = surface_sam_ssh_rqst(&rqst, &result);
+	if (status) {
+		return status;
+	}
+
+	if (result.len != 8) {
+		return -EFAULT;
+	}
+
+	return get_unaligned_le32(&result.data[0]);
+}
+
+static int surface_sam_perf_mode_set(int perf_mode)
+{
+	u8 payload[4] = { 0 };
+
+	struct surface_sam_ssh_rqst rqst = {
+		.tc  = 0x03,
+		.iid = 0x00,
+		.cid = 0x03,
+		.snc = 0x00,
+		.cdl = ARRAY_SIZE(payload),
+		.pld = payload,
+	};
+
+	if (perf_mode < __SAM_PERF_MODE__START || perf_mode > __SAM_PERF_MODE__END) {
+		return -EINVAL;
+	}
+
+	put_unaligned_le32(perf_mode, &rqst.pld[0]);
+	return surface_sam_ssh_rqst(&rqst, NULL);
+}
+
+
+static int param_perf_mode_set(const char *val, const struct kernel_param *kp)
+{
+	int perf_mode;
+	int status;
+
+	status = kstrtoint(val, 0, &perf_mode);
+	if (status) {
+		return status;
+	}
+
+	if (perf_mode < __SID_PARAM_PERF_MODE__START || perf_mode > __SID_PARAM_PERF_MODE__END) {
+		return -EINVAL;
+	}
+
+	return param_set_int(val, kp);
+}
+
+static const struct kernel_param_ops param_perf_mode_ops = {
+	.set = param_perf_mode_set,
+	.get = param_get_int,
+};
+
+static int param_perf_mode_init = SID_PARAM_PERF_MODE_AS_IS;
+static int param_perf_mode_exit = SID_PARAM_PERF_MODE_AS_IS;
+
+module_param_cb(perf_mode_init, &param_perf_mode_ops, &param_perf_mode_init, SID_PARAM_PERM);
+module_param_cb(perf_mode_exit, &param_perf_mode_ops, &param_perf_mode_exit, SID_PARAM_PERM);
+
+MODULE_PARM_DESC(perf_mode_init, "Performance-mode to be set on module initialization");
+MODULE_PARM_DESC(perf_mode_exit, "Performance-mode to be set on module exit");
+
+
+static ssize_t perf_mode_show(struct device *dev, struct device_attribute *attr, char *data)
+{
+	int perf_mode;
+
+	perf_mode = surface_sam_perf_mode_get();
+	if (perf_mode < 0) {
+		dev_err(dev, "failed to get current performance mode: %d", perf_mode);
+		return -EIO;
+	}
+
+	return sprintf(data, "%d\n", perf_mode);
+}
+
+static ssize_t perf_mode_store(struct device *dev, struct device_attribute *attr,
+                               const char *data, size_t count)
+{
+	int perf_mode;
+	int status;
+
+	status = kstrtoint(data, 0, &perf_mode);
+	if (status) {
+		return status;
+	}
+
+	status = surface_sam_perf_mode_set(perf_mode);
+	if (status) {
+		return status;
+	}
+
+	// TODO: Should we notify ACPI here?
+	//
+	//       There is a _DSM call described as
+	//           WSID._DSM: Notify DPTF on Slider State change
+	//       which calls
+	//           ODV3 = ToInteger (Arg3)
+	//           Notify(IETM, 0x88)
+	//       IETM is an INT3400 Intel Dynamic Power Performance Management
+	//       device, part of the DPTF framework. From the corresponding
+	//       kernel driver, it looks like event 0x88 is being ignored. Also
+	//       it is currently unknown what the consequecnes of setting ODV3
+	//       are.
+
+	return count;
+}
+
+const static DEVICE_ATTR_RW(perf_mode);
+
+
+static int sid_perf_mode_setup(struct platform_device *pdev, const struct sid_device_info *info)
+{
+	int status;
+
+	if (!info->has_perf_mode)
+		return 0;
+
+	// link to ec
+	status = surface_sam_ssh_consumer_register(&pdev->dev);
+	if (status) {
+		return status == -ENXIO ? -EPROBE_DEFER : status;
+	}
+
+	// set initial perf_mode
+	if (param_perf_mode_init != SID_PARAM_PERF_MODE_AS_IS) {
+		status = surface_sam_perf_mode_set(param_perf_mode_init);
+		if (status) {
+			return status;
+		}
+	}
+
+	// register perf_mode attribute
+	status = sysfs_create_file(&pdev->dev.kobj, &dev_attr_perf_mode.attr);
+	if (status) {
+		goto err_sysfs;
+	}
+
+	return 0;
+
+err_sysfs:
+	surface_sam_perf_mode_set(param_perf_mode_exit);
+	return status;
+}
+
+static void sid_perf_mode_remove(struct platform_device *pdev, const struct sid_device_info *info)
+{
+	if (!info->has_perf_mode)
+		return;
+
+	// remove perf_mode attribute
+	sysfs_remove_file(&pdev->dev.kobj, &dev_attr_perf_mode.attr);
+
+	// set exit perf_mode
+	surface_sam_perf_mode_set(param_perf_mode_exit);
+}
+
+
+static int sid_lid_enable_wakeup(const struct sid_device_info *info, bool enable)
+{
+	int action = enable ? ACPI_GPE_ENABLE : ACPI_GPE_DISABLE;
+	int status;
+
+	if (!info->lid_device)
+		return 0;
+
+	status = acpi_set_gpe_wake_mask(NULL, info->lid_device->gpe_number, action);
+	if (status)
+		return -EFAULT;
+
+	return 0;
+}
+
+static int sid_lid_device_setup(const struct sid_device_info *info)
+{
+	acpi_handle lid_handle;
+	int status;
+
+	if (!info->lid_device)
+		return 0;
+
+	status = acpi_get_handle(NULL, (acpi_string)info->lid_device->acpi_path, &lid_handle);
+	if (status)
+		return -EFAULT;
+
+	status = acpi_setup_gpe_for_wake(lid_handle, NULL, info->lid_device->gpe_number);
+	if (status)
+		return -EFAULT;
+
+	status = acpi_enable_gpe(NULL, info->lid_device->gpe_number);
+	if (status)
+		return -EFAULT;
+
+	return sid_lid_enable_wakeup(info, false);
+}
+
+static void sid_lid_device_remove(const struct sid_device_info *info)
+{
+	/* restore default behavior without this module */
+	sid_lid_enable_wakeup(info, false);
+}
+
+
+static int surface_sam_sid_suspend(struct device *dev)
+{
+	const struct sid_device_info *info = dev_get_drvdata(dev);
+	return sid_lid_enable_wakeup(info, true);
+}
+
+static int surface_sam_sid_resume(struct device *dev)
+{
+	const struct sid_device_info *info = dev_get_drvdata(dev);
+	return sid_lid_enable_wakeup(info, false);
+}
+
+static SIMPLE_DEV_PM_OPS(surface_sam_sid_pm, surface_sam_sid_suspend, surface_sam_sid_resume);
+
+
+static int surface_sam_sid_probe(struct platform_device *pdev)
+{
+	const struct dmi_system_id *dmi_match;
+	struct sid_device_info *info;
+	int status;
+
+	dmi_match = dmi_first_match(dmi_lid_device_table);
+	if (!dmi_match)
+		return -ENODEV;
+
+	info = dmi_match->driver_data;
+
+	platform_set_drvdata(pdev, info);
+
+	status = sid_perf_mode_setup(pdev, info);
+	if (status)
+		goto err_perf_mode;
+
+	status = sid_lid_device_setup(info);
+	if (status)
+		goto err_lid;
+
+	return 0;
+
+err_lid:
+	sid_perf_mode_remove(pdev, info);
+err_perf_mode:
+	return status;
+}
+
+static int surface_sam_sid_remove(struct platform_device *pdev)
+{
+	const struct sid_device_info *info = platform_get_drvdata(pdev);
+
+	sid_perf_mode_remove(pdev, info);
+	sid_lid_device_remove(info);
+
+	platform_set_drvdata(pdev, NULL);
+	return 0;
+}
+
+
+static const struct acpi_device_id surface_sam_sid_match[] = {
+	{ "MSHW0081", },	/* Surface Pro 4, 5, and 6 */
+	{ "MSHW0080", },	/* Surface Book 1 */
+	{ "MSHW0107", },	/* Surface Book 2 */
+	{ "MSHW0086", },	/* Surface Laptop 1 */
+	{ "MSHW0112", },	/* Surface Laptop 2 */
+	{ },
+};
+MODULE_DEVICE_TABLE(acpi, surface_sam_sid_match);
+
+struct platform_driver surface_sam_sid = {
+	.probe = surface_sam_sid_probe,
+	.remove = surface_sam_sid_remove,
+	.driver = {
+		.name = "surface_sam_sid",
+		.acpi_match_table = ACPI_PTR(surface_sam_sid_match),
+		.pm = &surface_sam_sid_pm,
+	},
+};
+module_platform_driver(surface_sam_sid);
+
+MODULE_AUTHOR("Maximilian Luz <luzmaximilian@gmail.com>");
+MODULE_DESCRIPTION("Surface Integration Driver for 5th Generation Surface Devices");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/platform/x86/surface_sam/surface_sam_ssh.c b/drivers/platform/x86/surface_sam/surface_sam_ssh.c
new file mode 100644
index 000000000000..f190efcf8705
--- /dev/null
+++ b/drivers/platform/x86/surface_sam/surface_sam_ssh.c
@@ -0,0 +1,1691 @@
+/*
+ * Surface Serial Hub (SSH) driver for communication with the Surface/System
+ * Aggregator Module.
+ */
+
+#include <asm/unaligned.h>
+#include <linux/acpi.h>
+#include <linux/completion.h>
+#include <linux/crc-ccitt.h>
+#include <linux/device.h>
+#include <linux/dmaengine.h>
+#include <linux/jiffies.h>
+#include <linux/kernel.h>
+#include <linux/kfifo.h>
+#include <linux/mutex.h>
+#include <linux/pm.h>
+#include <linux/refcount.h>
+#include <linux/serdev.h>
+#include <linux/spinlock.h>
+#include <linux/workqueue.h>
+
+#include "surface_sam_ssh.h"
+
+
+#define SSH_RQST_TAG_FULL			"surface_sam_ssh_rqst: "
+#define SSH_RQST_TAG				"rqst: "
+#define SSH_EVENT_TAG				"event: "
+#define SSH_RECV_TAG				"recv: "
+
+#define SSH_SUPPORTED_FLOW_CONTROL_MASK		(~((u8) ACPI_UART_FLOW_CONTROL_HW))
+
+#define SSH_BYTELEN_SYNC			2
+#define SSH_BYTELEN_TERM			2
+#define SSH_BYTELEN_CRC				2
+#define SSH_BYTELEN_CTRL			4	// command-header, ACK, or RETRY
+#define SSH_BYTELEN_CMDFRAME			8	// without payload
+
+#define SSH_MAX_WRITE (				\
+	  SSH_BYTELEN_SYNC			\
+	+ SSH_BYTELEN_CTRL			\
+	+ SSH_BYTELEN_CRC			\
+	+ SSH_BYTELEN_CMDFRAME			\
+	+ SURFACE_SAM_SSH_MAX_RQST_PAYLOAD	\
+	+ SSH_BYTELEN_CRC			\
+)
+
+#define SSH_MSG_LEN_CTRL (			\
+	  SSH_BYTELEN_SYNC			\
+	+ SSH_BYTELEN_CTRL			\
+	+ SSH_BYTELEN_CRC			\
+	+ SSH_BYTELEN_TERM			\
+)
+
+#define SSH_MSG_LEN_CMD_BASE (			\
+	  SSH_BYTELEN_SYNC			\
+	+ SSH_BYTELEN_CTRL			\
+	+ SSH_BYTELEN_CRC			\
+	+ SSH_BYTELEN_CRC			\
+)	// without payload and command-frame
+
+#define SSH_WRITE_TIMEOUT		msecs_to_jiffies(1000)
+#define SSH_READ_TIMEOUT		msecs_to_jiffies(1000)
+#define SSH_NUM_RETRY			3
+
+#define SSH_WRITE_BUF_LEN		SSH_MAX_WRITE
+#define SSH_READ_BUF_LEN		512		// must be power of 2
+#define SSH_EVAL_BUF_LEN		SSH_MAX_WRITE	// also works for reading
+
+#define SSH_FRAME_TYPE_CMD		0x80
+#define SSH_FRAME_TYPE_ACK		0x40
+#define SSH_FRAME_TYPE_RETRY		0x04
+
+#define SSH_FRAME_OFFS_CTRL		SSH_BYTELEN_SYNC
+#define SSH_FRAME_OFFS_CTRL_CRC		(SSH_FRAME_OFFS_CTRL + SSH_BYTELEN_CTRL)
+#define SSH_FRAME_OFFS_TERM		(SSH_FRAME_OFFS_CTRL_CRC + SSH_BYTELEN_CRC)
+#define SSH_FRAME_OFFS_CMD		SSH_FRAME_OFFS_TERM	// either TERM or CMD
+#define SSH_FRAME_OFFS_CMD_PLD		(SSH_FRAME_OFFS_CMD + SSH_BYTELEN_CMDFRAME)
+
+/*
+ * A note on Request IDs (RQIDs):
+ *	0x0000 is not a valid RQID
+ *	0x0001 is valid, but reserved for Surface Laptop keyboard events
+ */
+#define SAM_NUM_EVENT_TYPES		((1 << SURFACE_SAM_SSH_RQID_EVENT_BITS) - 1)
+
+/*
+ * Sync:			aa 55
+ * Terminate:			ff ff
+ *
+ * Request Message:		sync cmd-hdr crc(cmd-hdr) cmd-rqst-frame crc(cmd-rqst-frame)
+ * Ack Message:			sync ack crc(ack) terminate
+ * Retry Message:		sync retry crc(retry) terminate
+ * Response Message:		sync cmd-hdr crc(cmd-hdr) cmd-resp-frame crc(cmd-resp-frame)
+ *
+ * Command Header:		80 LEN 00 SEQ
+ * Ack:				40 00 00 SEQ
+ * Retry:			04 00 00 00
+ * Command Request Frame:	80 RTC 01 00 RIID RQID RCID PLD
+ * Command Response Frame:	80 RTC 00 01 RIID RQID RCID PLD
+ */
+
+struct ssh_frame_ctrl {
+	u8 type;
+	u8 len;			// without crc
+	u8 pad;
+	u8 seq;
+} __packed;
+
+struct ssh_frame_cmd {
+	u8 type;
+	u8 tc;
+	u8 outgoing;		// assumed to be 0x01 for SSH to SAM messages, 0x00 otherwise
+	u8 incoming;		// assumed to be 0x01 for SAM to SSH messages, 0x00 otherwise
+	u8 iid;
+	u8 rqid_lo;		// id for request/response matching (low byte)
+	u8 rqid_hi;		// id for request/response matching (high byte)
+	u8 cid;
+} __packed;
+
+
+enum ssh_ec_state {
+	SSH_EC_UNINITIALIZED,
+	SSH_EC_INITIALIZED,
+	SSH_EC_SUSPENDED,
+};
+
+struct ssh_counters {
+	u8  seq;		// control sequence id
+	u16 rqid;		// id for request/response matching
+};
+
+struct ssh_writer {
+	u8 *data;
+	u8 *ptr;
+} __packed;
+
+enum ssh_receiver_state {
+	SSH_RCV_DISCARD,
+	SSH_RCV_CONTROL,
+	SSH_RCV_COMMAND,
+};
+
+struct ssh_receiver {
+	spinlock_t lock;
+	enum ssh_receiver_state state;
+	struct completion signal;
+	struct kfifo fifo;
+	struct {
+		bool pld;
+		u8 seq;
+		u16 rqid;
+	} expect;
+	struct {
+		u16 cap;
+		u16 len;
+		u8 *ptr;
+	} eval_buf;
+};
+
+struct ssh_event_handler {
+	surface_sam_ssh_event_handler_fn handler;
+	surface_sam_ssh_event_handler_delay delay;
+	void *data;
+};
+
+struct ssh_events {
+	spinlock_t lock;
+	struct workqueue_struct *queue_ack;
+	struct workqueue_struct *queue_evt;
+	struct ssh_event_handler handler[SAM_NUM_EVENT_TYPES];
+};
+
+struct sam_ssh_ec {
+	struct mutex lock;
+	enum ssh_ec_state state;
+	struct serdev_device *serdev;
+	struct ssh_counters counter;
+	struct ssh_writer writer;
+	struct ssh_receiver receiver;
+	struct ssh_events events;
+};
+
+struct ssh_fifo_packet {
+	u8 type;	// packet type (ACK/RETRY/CMD)
+	u8 seq;
+	u8 len;
+};
+
+struct ssh_event_work {
+	refcount_t refcount;
+	struct sam_ssh_ec *ec;
+	struct work_struct work_ack;
+	struct delayed_work work_evt;
+	struct surface_sam_ssh_event event;
+	u8 seq;
+};
+
+
+static struct sam_ssh_ec ssh_ec = {
+	.lock   = __MUTEX_INITIALIZER(ssh_ec.lock),
+	.state  = SSH_EC_UNINITIALIZED,
+	.serdev = NULL,
+	.counter = {
+		.seq  = 0,
+		.rqid = 0,
+	},
+	.writer = {
+		.data = NULL,
+		.ptr  = NULL,
+	},
+	.receiver = {
+		.lock = __SPIN_LOCK_UNLOCKED(),
+		.state = SSH_RCV_DISCARD,
+		.expect = {},
+	},
+	.events = {
+		.lock = __SPIN_LOCK_UNLOCKED(),
+		.handler = {},
+	}
+};
+
+
+static int surface_sam_ssh_rqst_unlocked(struct sam_ssh_ec *ec,
+					 const struct surface_sam_ssh_rqst *rqst,
+					 struct surface_sam_ssh_buf *result);
+
+
+inline static struct sam_ssh_ec *surface_sam_ssh_acquire(void)
+{
+	struct sam_ssh_ec *ec = &ssh_ec;
+
+	mutex_lock(&ec->lock);
+	return ec;
+}
+
+inline static void surface_sam_ssh_release(struct sam_ssh_ec *ec)
+{
+	mutex_unlock(&ec->lock);
+}
+
+inline static struct sam_ssh_ec *surface_sam_ssh_acquire_init(void)
+{
+	struct sam_ssh_ec *ec = surface_sam_ssh_acquire();
+
+	if (ec->state == SSH_EC_UNINITIALIZED) {
+		surface_sam_ssh_release(ec);
+		return NULL;
+	}
+
+	return ec;
+}
+
+int surface_sam_ssh_consumer_register(struct device *consumer)
+{
+	u32 flags = DL_FLAG_PM_RUNTIME | DL_FLAG_AUTOREMOVE_CONSUMER;
+	struct sam_ssh_ec *ec;
+	struct device_link *link;
+
+	ec = surface_sam_ssh_acquire_init();
+	if (!ec) {
+		return -ENXIO;
+	}
+
+	link = device_link_add(consumer, &ec->serdev->dev, flags);
+	if (!link) {
+		return -EFAULT;
+	}
+
+	surface_sam_ssh_release(ec);
+	return 0;
+}
+EXPORT_SYMBOL_GPL(surface_sam_ssh_consumer_register);
+
+
+inline static u16 sam_rqid_to_rqst(u16 rqid) {
+	return rqid << SURFACE_SAM_SSH_RQID_EVENT_BITS;
+}
+
+inline static bool sam_rqid_is_event(u16 rqid) {
+	const u16 mask = (1 << SURFACE_SAM_SSH_RQID_EVENT_BITS) - 1;
+	return rqid != 0 && (rqid | mask) == mask;
+}
+
+int surface_sam_ssh_enable_event_source(u8 tc, u8 unknown, u16 rqid)
+{
+	struct sam_ssh_ec *ec;
+
+	u8 pld[4] = { tc, unknown, rqid & 0xff, rqid >> 8 };
+	u8 buf[1] = { 0x00 };
+
+	struct surface_sam_ssh_rqst rqst = {
+		.tc  = 0x01,
+		.iid = 0x00,
+		.cid = 0x0b,
+		.snc = 0x01,
+		.cdl = 0x04,
+		.pld = pld,
+	};
+
+	struct surface_sam_ssh_buf result = {
+		result.cap = ARRAY_SIZE(buf),
+		result.len = 0,
+		result.data = buf,
+	};
+
+	int status;
+
+	// only allow RQIDs that lie within event spectrum
+	if (!sam_rqid_is_event(rqid)) {
+		return -EINVAL;
+	}
+
+	ec = surface_sam_ssh_acquire_init();
+	if (!ec) {
+		printk(KERN_WARNING SSH_RQST_TAG_FULL "embedded controller is uninitialized\n");
+		return -ENXIO;
+	}
+
+	if (ec->state == SSH_EC_SUSPENDED) {
+		dev_warn(&ec->serdev->dev, SSH_RQST_TAG "embedded controller is suspended\n");
+
+		surface_sam_ssh_release(ec);
+		return -EPERM;
+	}
+
+	status = surface_sam_ssh_rqst_unlocked(ec, &rqst, &result);
+
+	if (buf[0] != 0x00) {
+		dev_warn(&ec->serdev->dev,
+		         "unexpected result while enabling event source: 0x%02x\n",
+			 buf[0]);
+	}
+
+	surface_sam_ssh_release(ec);
+	return status;
+
+}
+EXPORT_SYMBOL_GPL(surface_sam_ssh_enable_event_source);
+
+int surface_sam_ssh_disable_event_source(u8 tc, u8 unknown, u16 rqid)
+{
+	struct sam_ssh_ec *ec;
+
+	u8 pld[4] = { tc, unknown, rqid & 0xff, rqid >> 8 };
+	u8 buf[1] = { 0x00 };
+
+	struct surface_sam_ssh_rqst rqst = {
+		.tc  = 0x01,
+		.iid = 0x00,
+		.cid = 0x0c,
+		.snc = 0x01,
+		.cdl = 0x04,
+		.pld = pld,
+	};
+
+	struct surface_sam_ssh_buf result = {
+		result.cap = ARRAY_SIZE(buf),
+		result.len = 0,
+		result.data = buf,
+	};
+
+	int status;
+
+	// only allow RQIDs that lie within event spectrum
+	if (!sam_rqid_is_event(rqid)) {
+		return -EINVAL;
+	}
+
+	ec = surface_sam_ssh_acquire_init();
+	if (!ec) {
+		printk(KERN_WARNING SSH_RQST_TAG_FULL "embedded controller is uninitialized\n");
+		return -ENXIO;
+	}
+
+	if (ec->state == SSH_EC_SUSPENDED) {
+		dev_warn(&ec->serdev->dev, SSH_RQST_TAG "embedded controller is suspended\n");
+
+		surface_sam_ssh_release(ec);
+		return -EPERM;
+	}
+
+	status = surface_sam_ssh_rqst_unlocked(ec, &rqst, &result);
+
+	if (buf[0] != 0x00) {
+		dev_warn(&ec->serdev->dev,
+		         "unexpected result while disabling event source: 0x%02x\n",
+			 buf[0]);
+	}
+
+	surface_sam_ssh_release(ec);
+	return status;
+}
+EXPORT_SYMBOL_GPL(surface_sam_ssh_disable_event_source);
+
+int surface_sam_ssh_set_delayed_event_handler(
+		u16 rqid, surface_sam_ssh_event_handler_fn fn,
+		surface_sam_ssh_event_handler_delay delay,
+		void *data)
+{
+	struct sam_ssh_ec *ec;
+	unsigned long flags;
+
+	if (!sam_rqid_is_event(rqid)) {
+		return -EINVAL;
+	}
+
+	ec = surface_sam_ssh_acquire_init();
+	if (!ec) {
+		return -ENXIO;
+	}
+
+	spin_lock_irqsave(&ec->events.lock, flags);
+
+	// 0 is not a valid event RQID
+	ec->events.handler[rqid - 1].handler = fn;
+	ec->events.handler[rqid - 1].delay = delay;
+	ec->events.handler[rqid - 1].data = data;
+
+	spin_unlock_irqrestore(&ec->events.lock, flags);
+	surface_sam_ssh_release(ec);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(surface_sam_ssh_set_delayed_event_handler);
+
+int surface_sam_ssh_remove_event_handler(u16 rqid)
+{
+	struct sam_ssh_ec *ec;
+	unsigned long flags;
+
+	if (!sam_rqid_is_event(rqid)) {
+		return -EINVAL;
+	}
+
+	ec = surface_sam_ssh_acquire_init();
+	if (!ec) {
+		return -ENXIO;
+	}
+
+	spin_lock_irqsave(&ec->events.lock, flags);
+
+	// 0 is not a valid event RQID
+	ec->events.handler[rqid - 1].handler = NULL;
+	ec->events.handler[rqid - 1].delay = NULL;
+	ec->events.handler[rqid - 1].data = NULL;
+
+	spin_unlock_irqrestore(&ec->events.lock, flags);
+	surface_sam_ssh_release(ec);
+
+	/*
+	 * Make sure that the handler is not in use any more after we've
+	 * removed it.
+	 */
+	flush_workqueue(ec->events.queue_evt);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(surface_sam_ssh_remove_event_handler);
+
+
+inline static u16 ssh_crc(const u8 *buf, size_t size)
+{
+	return crc_ccitt_false(0xffff, buf, size);
+}
+
+inline static void ssh_write_u16(struct ssh_writer *writer, u16 in)
+{
+	put_unaligned_le16(in, writer->ptr);
+	writer->ptr += 2;
+}
+
+inline static void ssh_write_crc(struct ssh_writer *writer,
+				 const u8 *buf, size_t size)
+{
+	ssh_write_u16(writer, ssh_crc(buf, size));
+}
+
+inline static void ssh_write_syn(struct ssh_writer *writer)
+{
+	u8 *w = writer->ptr;
+
+	*w++ = 0xaa;
+	*w++ = 0x55;
+
+	writer->ptr = w;
+}
+
+inline static void ssh_write_ter(struct ssh_writer *writer)
+{
+	u8 *w = writer->ptr;
+
+	*w++ = 0xff;
+	*w++ = 0xff;
+
+	writer->ptr = w;
+}
+
+inline static void ssh_write_buf(struct ssh_writer *writer,
+				 u8 *in, size_t len)
+{
+	writer->ptr = memcpy(writer->ptr, in, len) + len;
+}
+
+inline static void ssh_write_hdr(struct ssh_writer *writer,
+				 const struct surface_sam_ssh_rqst *rqst,
+				 struct sam_ssh_ec *ec)
+{
+	struct ssh_frame_ctrl *hdr = (struct ssh_frame_ctrl *)writer->ptr;
+	u8 *begin = writer->ptr;
+
+	hdr->type = SSH_FRAME_TYPE_CMD;
+	hdr->len  = SSH_BYTELEN_CMDFRAME + rqst->cdl;	// without CRC
+	hdr->pad  = 0x00;
+	hdr->seq  = ec->counter.seq;
+
+	writer->ptr += sizeof(*hdr);
+
+	ssh_write_crc(writer, begin, writer->ptr - begin);
+}
+
+inline static void ssh_write_cmd(struct ssh_writer *writer,
+				 const struct surface_sam_ssh_rqst *rqst,
+				 struct sam_ssh_ec *ec)
+{
+	struct ssh_frame_cmd *cmd = (struct ssh_frame_cmd *)writer->ptr;
+	u8 *begin = writer->ptr;
+
+	u16 rqid = sam_rqid_to_rqst(ec->counter.rqid);
+	u8 rqid_lo = rqid & 0xFF;
+	u8 rqid_hi = rqid >> 8;
+
+	cmd->type     = SSH_FRAME_TYPE_CMD;
+	cmd->tc       = rqst->tc;
+	cmd->outgoing = 0x01;
+	cmd->incoming = 0x00;
+	cmd->iid      = rqst->iid;
+	cmd->rqid_lo  = rqid_lo;
+	cmd->rqid_hi  = rqid_hi;
+	cmd->cid      = rqst->cid;
+
+	writer->ptr += sizeof(*cmd);
+
+	ssh_write_buf(writer, rqst->pld, rqst->cdl);
+	ssh_write_crc(writer, begin, writer->ptr - begin);
+}
+
+inline static void ssh_write_ack(struct ssh_writer *writer, u8 seq)
+{
+	struct ssh_frame_ctrl *ack = (struct ssh_frame_ctrl *)writer->ptr;
+	u8 *begin = writer->ptr;
+
+	ack->type = SSH_FRAME_TYPE_ACK;
+	ack->len  = 0x00;
+	ack->pad  = 0x00;
+	ack->seq  = seq;
+
+	writer->ptr += sizeof(*ack);
+
+	ssh_write_crc(writer, begin, writer->ptr - begin);
+}
+
+inline static void ssh_writer_reset(struct ssh_writer *writer)
+{
+	writer->ptr = writer->data;
+}
+
+inline static int ssh_writer_flush(struct sam_ssh_ec *ec)
+{
+	struct ssh_writer *writer = &ec->writer;
+	struct serdev_device *serdev = ec->serdev;
+	int status;
+
+	size_t len = writer->ptr - writer->data;
+
+	dev_dbg(&ec->serdev->dev, "sending message\n");
+	print_hex_dump_debug("send: ", DUMP_PREFIX_OFFSET, 16, 1,
+	                     writer->data, writer->ptr - writer->data, false);
+
+	status = serdev_device_write(serdev, writer->data, len, SSH_WRITE_TIMEOUT);
+	return status >= 0 ? 0 : status;
+}
+
+inline static void ssh_write_msg_cmd(struct sam_ssh_ec *ec,
+				     const struct surface_sam_ssh_rqst *rqst)
+{
+	ssh_writer_reset(&ec->writer);
+	ssh_write_syn(&ec->writer);
+	ssh_write_hdr(&ec->writer, rqst, ec);
+	ssh_write_cmd(&ec->writer, rqst, ec);
+}
+
+inline static void ssh_write_msg_ack(struct sam_ssh_ec *ec, u8 seq)
+{
+	ssh_writer_reset(&ec->writer);
+	ssh_write_syn(&ec->writer);
+	ssh_write_ack(&ec->writer, seq);
+	ssh_write_ter(&ec->writer);
+}
+
+inline static void ssh_receiver_restart(struct sam_ssh_ec *ec,
+					const struct surface_sam_ssh_rqst *rqst)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&ec->receiver.lock, flags);
+	reinit_completion(&ec->receiver.signal);
+	ec->receiver.state = SSH_RCV_CONTROL;
+	ec->receiver.expect.pld = rqst->snc;
+	ec->receiver.expect.seq = ec->counter.seq;
+	ec->receiver.expect.rqid = sam_rqid_to_rqst(ec->counter.rqid);
+	ec->receiver.eval_buf.len = 0;
+	spin_unlock_irqrestore(&ec->receiver.lock, flags);
+}
+
+inline static void ssh_receiver_discard(struct sam_ssh_ec *ec)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&ec->receiver.lock, flags);
+	ec->receiver.state = SSH_RCV_DISCARD;
+	ec->receiver.eval_buf.len = 0;
+	kfifo_reset(&ec->receiver.fifo);
+	spin_unlock_irqrestore(&ec->receiver.lock, flags);
+}
+
+static int surface_sam_ssh_rqst_unlocked(struct sam_ssh_ec *ec,
+					 const struct surface_sam_ssh_rqst *rqst,
+					 struct surface_sam_ssh_buf *result)
+{
+	struct device *dev = &ec->serdev->dev;
+	struct ssh_fifo_packet packet = {};
+	int status;
+	int try;
+	unsigned int rem;
+
+	if (rqst->cdl > SURFACE_SAM_SSH_MAX_RQST_PAYLOAD) {
+		dev_err(dev, SSH_RQST_TAG "request payload too large\n");
+		return -EINVAL;
+	}
+
+	// write command in buffer, we may need it multiple times
+	ssh_write_msg_cmd(ec, rqst);
+	ssh_receiver_restart(ec, rqst);
+
+	// send command, try to get an ack response
+	for (try = 0; try < SSH_NUM_RETRY; try++) {
+		status = ssh_writer_flush(ec);
+		if (status) {
+			goto out;
+		}
+
+		rem = wait_for_completion_timeout(&ec->receiver.signal, SSH_READ_TIMEOUT);
+		if (rem) {
+			// completion assures valid packet, thus ignore returned length
+			(void) !kfifo_out(&ec->receiver.fifo, &packet, sizeof(packet));
+
+			if (packet.type == SSH_FRAME_TYPE_ACK) {
+				break;
+			}
+		}
+	}
+
+	// check if we ran out of tries?
+	if (try >= SSH_NUM_RETRY) {
+		dev_err(dev, SSH_RQST_TAG "communication failed %d times, giving up\n", try);
+		status = -EIO;
+		goto out;
+	}
+
+	ec->counter.seq  += 1;
+	ec->counter.rqid += 1;
+
+	// get command response/payload
+	if (rqst->snc && result) {
+		rem = wait_for_completion_timeout(&ec->receiver.signal, SSH_READ_TIMEOUT);
+		if (rem) {
+			// completion assures valid packet, thus ignore returned length
+			(void) !kfifo_out(&ec->receiver.fifo, &packet, sizeof(packet));
+
+			if (result->cap < packet.len) {
+				status = -EINVAL;
+				goto out;
+			}
+
+			// completion assures valid packet, thus ignore returned length
+			(void) !kfifo_out(&ec->receiver.fifo, result->data, packet.len);
+			result->len = packet.len;
+		} else {
+			dev_err(dev, SSH_RQST_TAG "communication timed out\n");
+			status = -EIO;
+			goto out;
+		}
+
+		// send ACK
+		ssh_write_msg_ack(ec, packet.seq);
+		status = ssh_writer_flush(ec);
+		if (status) {
+			goto out;
+		}
+	}
+
+out:
+	ssh_receiver_discard(ec);
+	return status;
+}
+
+int surface_sam_ssh_rqst(const struct surface_sam_ssh_rqst *rqst, struct surface_sam_ssh_buf *result)
+{
+	struct sam_ssh_ec *ec;
+	int status;
+
+	ec = surface_sam_ssh_acquire_init();
+	if (!ec) {
+		printk(KERN_WARNING SSH_RQST_TAG_FULL "embedded controller is uninitialized\n");
+		return -ENXIO;
+	}
+
+	if (ec->state == SSH_EC_SUSPENDED) {
+		dev_warn(&ec->serdev->dev, SSH_RQST_TAG "embedded controller is suspended\n");
+
+		surface_sam_ssh_release(ec);
+		return -EPERM;
+	}
+
+	status = surface_sam_ssh_rqst_unlocked(ec, rqst, result);
+
+	surface_sam_ssh_release(ec);
+	return status;
+}
+EXPORT_SYMBOL_GPL(surface_sam_ssh_rqst);
+
+
+static int surface_sam_ssh_ec_resume(struct sam_ssh_ec *ec)
+{
+	u8 buf[1] = { 0x00 };
+
+	struct surface_sam_ssh_rqst rqst = {
+		.tc  = 0x01,
+		.iid = 0x00,
+		.cid = 0x16,
+		.snc = 0x01,
+		.cdl = 0x00,
+		.pld = NULL,
+	};
+
+	struct surface_sam_ssh_buf result = {
+		result.cap = ARRAY_SIZE(buf),
+		result.len = 0,
+		result.data = buf,
+	};
+
+	int status = surface_sam_ssh_rqst_unlocked(ec, &rqst, &result);
+	if (status) {
+		return status;
+	}
+
+	if (buf[0] != 0x00) {
+		dev_warn(&ec->serdev->dev,
+		         "unexpected result while trying to resume EC: 0x%02x\n",
+			 buf[0]);
+	}
+
+	return 0;
+}
+
+static int surface_sam_ssh_ec_suspend(struct sam_ssh_ec *ec)
+{
+	u8 buf[1] = { 0x00 };
+
+	struct surface_sam_ssh_rqst rqst = {
+		.tc  = 0x01,
+		.iid = 0x00,
+		.cid = 0x15,
+		.snc = 0x01,
+		.cdl = 0x00,
+		.pld = NULL,
+	};
+
+	struct surface_sam_ssh_buf result = {
+		result.cap = ARRAY_SIZE(buf),
+		result.len = 0,
+		result.data = buf,
+	};
+
+	int status = surface_sam_ssh_rqst_unlocked(ec, &rqst, &result);
+	if (status) {
+		return status;
+	}
+
+	if (buf[0] != 0x00) {
+		dev_warn(&ec->serdev->dev,
+		         "unexpected result while trying to suspend EC: 0x%02x\n",
+			 buf[0]);
+	}
+
+	return 0;
+}
+
+
+inline static bool ssh_is_valid_syn(const u8 *ptr)
+{
+	return ptr[0] == 0xaa && ptr[1] == 0x55;
+}
+
+inline static bool ssh_is_valid_ter(const u8 *ptr)
+{
+	return ptr[0] == 0xff && ptr[1] == 0xff;
+}
+
+inline static bool ssh_is_valid_crc(const u8 *begin, const u8 *end)
+{
+	u16 crc = ssh_crc(begin, end - begin);
+	return (end[0] == (crc & 0xff)) && (end[1] == (crc >> 8));
+}
+
+
+static int surface_sam_ssh_send_ack(struct sam_ssh_ec *ec, u8 seq)
+{
+	int status;
+	u8 buf[SSH_MSG_LEN_CTRL];
+	u16 crc;
+
+	buf[0] = 0xaa;
+	buf[1] = 0x55;
+	buf[2] = 0x40;
+	buf[3] = 0x00;
+	buf[4] = 0x00;
+	buf[5] = seq;
+
+	crc = ssh_crc(buf + SSH_FRAME_OFFS_CTRL, SSH_BYTELEN_CTRL);
+	buf[6] = crc & 0xff;
+	buf[7] = crc >> 8;
+
+	buf[8] = 0xff;
+	buf[9] = 0xff;
+
+	dev_dbg(&ec->serdev->dev, "sending message\n");
+	print_hex_dump_debug("send: ", DUMP_PREFIX_OFFSET, 16, 1,
+	                     buf, SSH_MSG_LEN_CTRL, false);
+
+	status = serdev_device_write(ec->serdev, buf, SSH_MSG_LEN_CTRL, SSH_WRITE_TIMEOUT);
+	return status >= 0 ? 0 : status;
+}
+
+static void surface_sam_ssh_event_work_ack_handler(struct work_struct *_work)
+{
+	struct surface_sam_ssh_event *event;
+	struct ssh_event_work *work;
+	struct sam_ssh_ec *ec;
+	struct device *dev;
+	int status;
+
+	work = container_of(_work, struct ssh_event_work, work_ack);
+	event = &work->event;
+	ec = work->ec;
+	dev = &ec->serdev->dev;
+
+	// make sure we load a fresh ec state
+	smp_mb();
+
+	if (ec->state == SSH_EC_INITIALIZED) {
+		status = surface_sam_ssh_send_ack(ec, work->seq);
+		if (status) {
+			dev_err(dev, SSH_EVENT_TAG "failed to send ACK: %d\n", status);
+		}
+	}
+
+	if (refcount_dec_and_test(&work->refcount)) {
+		kfree(work);
+	}
+}
+
+static void surface_sam_ssh_event_work_evt_handler(struct work_struct *_work)
+{
+	struct delayed_work *dwork = (struct delayed_work *)_work;
+	struct ssh_event_work *work;
+	struct surface_sam_ssh_event *event;
+	struct sam_ssh_ec *ec;
+	struct device *dev;
+	unsigned long flags;
+
+	surface_sam_ssh_event_handler_fn handler;
+	void *handler_data;
+
+	int status = 0;
+
+	work = container_of(dwork, struct ssh_event_work, work_evt);
+	event = &work->event;
+	ec = work->ec;
+	dev = &ec->serdev->dev;
+
+	spin_lock_irqsave(&ec->events.lock, flags);
+	handler       = ec->events.handler[event->rqid - 1].handler;
+	handler_data  = ec->events.handler[event->rqid - 1].data;
+	spin_unlock_irqrestore(&ec->events.lock, flags);
+
+	/*
+	 * During handler removal or driver release, we ensure every event gets
+	 * handled before return of that function. Thus a handler obtained here is
+	 * guaranteed to be valid at least until this function returns.
+	 */
+
+	if (handler) {
+		status = handler(event, handler_data);
+	} else {
+		dev_warn(dev, SSH_EVENT_TAG "unhandled event (rqid: %04x)\n", event->rqid);
+	}
+
+	if (status) {
+		dev_err(dev, SSH_EVENT_TAG "error handling event: %d\n", status);
+	}
+
+	if (refcount_dec_and_test(&work->refcount)) {
+		kfree(work);
+	}
+}
+
+static void ssh_handle_event(struct sam_ssh_ec *ec, const u8 *buf)
+{
+	struct device *dev = &ec->serdev->dev;
+	const struct ssh_frame_ctrl *ctrl;
+	const struct ssh_frame_cmd *cmd;
+	struct ssh_event_work *work;
+	unsigned long flags;
+	u16 pld_len;
+
+	surface_sam_ssh_event_handler_delay delay_fn;
+	void *handler_data;
+	unsigned long delay = 0;
+
+	ctrl = (const struct ssh_frame_ctrl *)(buf + SSH_FRAME_OFFS_CTRL);
+	cmd  = (const struct ssh_frame_cmd  *)(buf + SSH_FRAME_OFFS_CMD);
+
+	pld_len = ctrl->len - SSH_BYTELEN_CMDFRAME;
+
+	work = kzalloc(sizeof(struct ssh_event_work) + pld_len, GFP_ATOMIC);
+	if (!work) {
+		dev_warn(dev, SSH_EVENT_TAG "failed to allocate memory, dropping event\n");
+		return;
+	}
+
+	refcount_set(&work->refcount, 2);
+	work->ec         = ec;
+	work->seq        = ctrl->seq;
+	work->event.rqid = (cmd->rqid_hi << 8) | cmd->rqid_lo;
+	work->event.tc   = cmd->tc;
+	work->event.iid  = cmd->iid;
+	work->event.cid  = cmd->cid;
+	work->event.len  = pld_len;
+	work->event.pld  = ((u8*) work) + sizeof(struct ssh_event_work);
+
+	memcpy(work->event.pld, buf + SSH_FRAME_OFFS_CMD_PLD, pld_len);
+
+	INIT_WORK(&work->work_ack, surface_sam_ssh_event_work_ack_handler);
+	queue_work(ec->events.queue_ack, &work->work_ack);
+
+	spin_lock_irqsave(&ec->events.lock, flags);
+	handler_data = ec->events.handler[work->event.rqid - 1].data;
+	delay_fn     = ec->events.handler[work->event.rqid - 1].delay;
+	if (delay_fn) {
+		delay = delay_fn(&work->event, handler_data);
+	}
+	spin_unlock_irqrestore(&ec->events.lock, flags);
+
+	// immediate execution for high priority events (e.g. keyboard)
+	if (delay == SURFACE_SAM_SSH_EVENT_IMMEDIATE) {
+		surface_sam_ssh_event_work_evt_handler(&work->work_evt.work);
+	} else {
+		INIT_DELAYED_WORK(&work->work_evt, surface_sam_ssh_event_work_evt_handler);
+		queue_delayed_work(ec->events.queue_evt, &work->work_evt, delay);
+	}
+}
+
+static int ssh_receive_msg_ctrl(struct sam_ssh_ec *ec, const u8 *buf, size_t size)
+{
+	struct device *dev = &ec->serdev->dev;
+	struct ssh_receiver *rcv = &ec->receiver;
+	const struct ssh_frame_ctrl *ctrl;
+	struct ssh_fifo_packet packet;
+
+	const u8 *ctrl_begin = buf + SSH_FRAME_OFFS_CTRL;
+	const u8 *ctrl_end   = buf + SSH_FRAME_OFFS_CTRL_CRC;
+
+	ctrl = (const struct ssh_frame_ctrl *)(ctrl_begin);
+
+	// actual length check
+	if (size < SSH_MSG_LEN_CTRL) {
+		return 0;			// need more bytes
+	}
+
+	// validate TERM
+	if (!ssh_is_valid_ter(buf + SSH_FRAME_OFFS_TERM)) {
+		dev_err(dev, SSH_RECV_TAG "invalid end of message\n");
+		return size;			// discard everything
+	}
+
+	// validate CRC
+	if (!ssh_is_valid_crc(ctrl_begin, ctrl_end)) {
+		dev_err(dev, SSH_RECV_TAG "invalid checksum (ctrl)\n");
+		return SSH_MSG_LEN_CTRL;	// only discard message
+	}
+
+	// check if we expect the message
+	if (rcv->state != SSH_RCV_CONTROL) {
+		dev_err(dev, SSH_RECV_TAG "discarding message: ctrl not expected\n");
+		return SSH_MSG_LEN_CTRL;	// discard message
+	}
+
+	// check if it is for our request
+	if (ctrl->type == SSH_FRAME_TYPE_ACK && ctrl->seq != rcv->expect.seq) {
+		dev_err(dev, SSH_RECV_TAG "discarding message: ack does not match\n");
+		return SSH_MSG_LEN_CTRL;	// discard message
+	}
+
+	// we now have a valid & expected ACK/RETRY message
+	dev_dbg(dev, SSH_RECV_TAG "valid control message received (type: 0x%02x)\n", ctrl->type);
+
+	packet.type = ctrl->type;
+	packet.seq  = ctrl->seq;
+	packet.len  = 0;
+
+	if (kfifo_avail(&rcv->fifo) >= sizeof(packet)) {
+		kfifo_in(&rcv->fifo, (u8 *) &packet, sizeof(packet));
+
+	} else {
+		dev_warn(dev, SSH_RECV_TAG
+			 "dropping frame: not enough space in fifo (type = %d)\n",
+			 SSH_FRAME_TYPE_CMD);
+
+		return SSH_MSG_LEN_CTRL;	// discard message
+	}
+
+	// update decoder state
+	if (ctrl->type == SSH_FRAME_TYPE_ACK) {
+		rcv->state = rcv->expect.pld
+			? SSH_RCV_COMMAND
+			: SSH_RCV_DISCARD;
+	}
+
+	complete(&rcv->signal);
+	return SSH_MSG_LEN_CTRL;		// handled message
+}
+
+static int ssh_receive_msg_cmd(struct sam_ssh_ec *ec, const u8 *buf, size_t size)
+{
+	struct device *dev = &ec->serdev->dev;
+	struct ssh_receiver *rcv = &ec->receiver;
+	const struct ssh_frame_ctrl *ctrl;
+	const struct ssh_frame_cmd *cmd;
+	struct ssh_fifo_packet packet;
+
+	const u8 *ctrl_begin     = buf + SSH_FRAME_OFFS_CTRL;
+	const u8 *ctrl_end       = buf + SSH_FRAME_OFFS_CTRL_CRC;
+	const u8 *cmd_begin      = buf + SSH_FRAME_OFFS_CMD;
+	const u8 *cmd_begin_pld  = buf + SSH_FRAME_OFFS_CMD_PLD;
+	const u8 *cmd_end;
+
+	size_t msg_len;
+
+	ctrl = (const struct ssh_frame_ctrl *)(ctrl_begin);
+	cmd  = (const struct ssh_frame_cmd  *)(cmd_begin);
+
+	// we need at least a full control frame
+	if (size < (SSH_BYTELEN_SYNC + SSH_BYTELEN_CTRL + SSH_BYTELEN_CRC)) {
+		return 0;		// need more bytes
+	}
+
+	// validate control-frame CRC
+	if (!ssh_is_valid_crc(ctrl_begin, ctrl_end)) {
+		dev_err(dev, SSH_RECV_TAG "invalid checksum (cmd-ctrl)\n");
+		/*
+		 * We can't be sure here if length is valid, thus
+		 * discard everything.
+		 */
+		return size;
+	}
+
+	// actual length check (ctrl->len contains command-frame but not crc)
+	msg_len = SSH_MSG_LEN_CMD_BASE + ctrl->len;
+	if (size < msg_len) {
+		return 0;			// need more bytes
+	}
+
+	cmd_end = cmd_begin + ctrl->len;
+
+	// validate command-frame type
+	if (cmd->type != SSH_FRAME_TYPE_CMD) {
+		dev_err(dev, SSH_RECV_TAG "expected command frame type but got 0x%02x\n", cmd->type);
+		return size;			// discard everything
+	}
+
+	// validate command-frame CRC
+	if (!ssh_is_valid_crc(cmd_begin, cmd_end)) {
+		dev_err(dev, SSH_RECV_TAG "invalid checksum (cmd-pld)\n");
+
+		/*
+		 * The message length is provided in the control frame. As we
+		 * already validated that, we can be sure here that it's
+		 * correct, so we only need to discard the message.
+		 */
+		return msg_len;
+	}
+
+	// check if we received an event notification
+	if (sam_rqid_is_event((cmd->rqid_hi << 8) | cmd->rqid_lo)) {
+		ssh_handle_event(ec, buf);
+		return msg_len;			// handled message
+	}
+
+	// check if we expect the message
+	if (rcv->state != SSH_RCV_COMMAND) {
+		dev_dbg(dev, SSH_RECV_TAG "discarding message: command not expected\n");
+		return msg_len;			// discard message
+	}
+
+	// check if response is for our request
+	if (rcv->expect.rqid != (cmd->rqid_lo | (cmd->rqid_hi << 8))) {
+		dev_dbg(dev, SSH_RECV_TAG "discarding message: command not a match\n");
+		return msg_len;			// discard message
+	}
+
+	// we now have a valid & expected command message
+	dev_dbg(dev, SSH_RECV_TAG "valid command message received\n");
+
+	packet.type = ctrl->type;
+	packet.seq = ctrl->seq;
+	packet.len = cmd_end - cmd_begin_pld;
+
+	if (kfifo_avail(&rcv->fifo) >= sizeof(packet) + packet.len) {
+		kfifo_in(&rcv->fifo, &packet, sizeof(packet));
+		kfifo_in(&rcv->fifo, cmd_begin_pld, packet.len);
+
+	} else {
+		dev_warn(dev, SSH_RECV_TAG
+			 "dropping frame: not enough space in fifo (type = %d)\n",
+			 SSH_FRAME_TYPE_CMD);
+
+		return SSH_MSG_LEN_CTRL;	// discard message
+	}
+
+	rcv->state = SSH_RCV_DISCARD;
+
+	complete(&rcv->signal);
+	return msg_len;				// handled message
+}
+
+static int ssh_eval_buf(struct sam_ssh_ec *ec, const u8 *buf, size_t size)
+{
+	struct device *dev = &ec->serdev->dev;
+	struct ssh_frame_ctrl *ctrl;
+
+	// we need at least a control frame to check what to do
+	if (size < (SSH_BYTELEN_SYNC + SSH_BYTELEN_CTRL)) {
+		return 0;		// need more bytes
+	}
+
+	// make sure we're actually at the start of a new message
+	if (!ssh_is_valid_syn(buf)) {
+		dev_err(dev, SSH_RECV_TAG "invalid start of message\n");
+		return size;		// discard everything
+	}
+
+	// handle individual message types seperately
+	ctrl = (struct ssh_frame_ctrl *)(buf + SSH_FRAME_OFFS_CTRL);
+
+	switch (ctrl->type) {
+	case SSH_FRAME_TYPE_ACK:
+	case SSH_FRAME_TYPE_RETRY:
+		return ssh_receive_msg_ctrl(ec, buf, size);
+
+	case SSH_FRAME_TYPE_CMD:
+		return ssh_receive_msg_cmd(ec, buf, size);
+
+	default:
+		dev_err(dev, SSH_RECV_TAG "unknown frame type 0x%02x\n", ctrl->type);
+		return size;		// discard everything
+	}
+}
+
+static int ssh_receive_buf(struct serdev_device *serdev,
+			   const unsigned char *buf, size_t size)
+{
+	struct sam_ssh_ec *ec = serdev_device_get_drvdata(serdev);
+	struct ssh_receiver *rcv = &ec->receiver;
+	unsigned long flags;
+	int offs = 0;
+	int used, n;
+
+	dev_dbg(&serdev->dev, SSH_RECV_TAG "received buffer (size: %zu)\n", size);
+	print_hex_dump_debug(SSH_RECV_TAG, DUMP_PREFIX_OFFSET, 16, 1, buf, size, false);
+
+	/*
+	 * The battery _BIX message gets a bit long, thus we have to add some
+	 * additional buffering here.
+	 */
+
+	spin_lock_irqsave(&rcv->lock, flags);
+
+	// copy to eval-buffer
+	used = min(size, (size_t)(rcv->eval_buf.cap - rcv->eval_buf.len));
+	memcpy(rcv->eval_buf.ptr + rcv->eval_buf.len, buf, used);
+	rcv->eval_buf.len += used;
+
+	// evaluate buffer until we need more bytes or eval-buf is empty
+	while (offs < rcv->eval_buf.len) {
+		n = rcv->eval_buf.len - offs;
+		n = ssh_eval_buf(ec, rcv->eval_buf.ptr + offs, n);
+		if (n <= 0) break;	// need more bytes
+
+		offs += n;
+	}
+
+	// throw away the evaluated parts
+	rcv->eval_buf.len -= offs;
+	memmove(rcv->eval_buf.ptr, rcv->eval_buf.ptr + offs, rcv->eval_buf.len);
+
+	spin_unlock_irqrestore(&rcv->lock, flags);
+
+	return used;
+}
+
+
+#ifdef CONFIG_SURFACE_ACPI_SSH_DEBUG_DEVICE
+
+#include <linux/sysfs.h>
+
+static char sam_ssh_debug_rqst_buf_sysfs[SURFACE_SAM_SSH_MAX_RQST_RESPONSE + 1] = { 0 };
+static char sam_ssh_debug_rqst_buf_pld[SURFACE_SAM_SSH_MAX_RQST_PAYLOAD] = { 0 };
+static char sam_ssh_debug_rqst_buf_res[SURFACE_SAM_SSH_MAX_RQST_RESPONSE] = { 0 };
+
+
+static ssize_t rqst_read(struct file *f, struct kobject *kobj, struct bin_attribute *attr,
+                         char *buf, loff_t offs, size_t count)
+{
+	if (offs < 0 || count + offs > SURFACE_SAM_SSH_MAX_RQST_RESPONSE) {
+		return -EINVAL;
+	}
+
+	memcpy(buf, sam_ssh_debug_rqst_buf_sysfs + offs, count);
+	return count;
+}
+
+static ssize_t rqst_write(struct file *f, struct kobject *kobj, struct bin_attribute *attr,
+			  char *buf, loff_t offs, size_t count)
+{
+	struct surface_sam_ssh_rqst rqst = {};
+	struct surface_sam_ssh_buf result = {};
+	int status;
+
+	// check basic write constriants
+	if (offs != 0 || count > SURFACE_SAM_SSH_MAX_RQST_PAYLOAD + 5) {
+		return -EINVAL;
+	}
+
+	// payload length should be consistent with data provided
+	if (buf[4] + 5 != count) {
+		return -EINVAL;
+	}
+
+	rqst.tc  = buf[0];
+	rqst.iid = buf[1];
+	rqst.cid = buf[2];
+	rqst.snc = buf[3];
+	rqst.cdl = buf[4];
+	rqst.pld = sam_ssh_debug_rqst_buf_pld;
+	memcpy(sam_ssh_debug_rqst_buf_pld, buf + 5, count - 5);
+
+	result.cap = SURFACE_SAM_SSH_MAX_RQST_RESPONSE;
+	result.len = 0;
+	result.data = sam_ssh_debug_rqst_buf_res;
+
+	status = surface_sam_ssh_rqst(&rqst, &result);
+	if (status) {
+		return status;
+	}
+
+	sam_ssh_debug_rqst_buf_sysfs[0] = result.len;
+	memcpy(sam_ssh_debug_rqst_buf_sysfs + 1, result.data, result.len);
+	memset(sam_ssh_debug_rqst_buf_sysfs + result.len + 1, 0,
+	       SURFACE_SAM_SSH_MAX_RQST_RESPONSE + 1 - result.len);
+
+	return count;
+}
+
+static const BIN_ATTR_RW(rqst, SURFACE_SAM_SSH_MAX_RQST_RESPONSE + 1);
+
+
+int surface_sam_ssh_sysfs_register(struct device *dev)
+{
+	return sysfs_create_bin_file(&dev->kobj, &bin_attr_rqst);
+}
+
+void surface_sam_ssh_sysfs_unregister(struct device *dev)
+{
+	sysfs_remove_bin_file(&dev->kobj, &bin_attr_rqst);
+}
+
+#else	/* CONFIG_SURFACE_ACPI_SSH_DEBUG_DEVICE */
+
+int surface_sam_ssh_sysfs_register(struct device *dev)
+{
+	return 0;
+}
+
+void surface_sam_ssh_sysfs_unregister(struct device *dev)
+{
+}
+
+#endif	/* CONFIG_SURFACE_ACPI_SSH_DEBUG_DEVICE */
+
+
+static acpi_status
+ssh_setup_from_resource(struct acpi_resource *resource, void *context)
+{
+	struct serdev_device *serdev = context;
+	struct acpi_resource_common_serialbus *serial;
+	struct acpi_resource_uart_serialbus *uart;
+	int status = 0;
+
+	if (resource->type != ACPI_RESOURCE_TYPE_SERIAL_BUS) {
+		return AE_OK;
+	}
+
+	serial = &resource->data.common_serial_bus;
+	if (serial->type != ACPI_RESOURCE_SERIAL_TYPE_UART) {
+		return AE_OK;
+	}
+
+	uart = &resource->data.uart_serial_bus;
+
+	// set up serdev device
+	serdev_device_set_baudrate(serdev, uart->default_baud_rate);
+
+	// serdev currently only supports RTSCTS flow control
+	if (uart->flow_control & SSH_SUPPORTED_FLOW_CONTROL_MASK) {
+		dev_warn(&serdev->dev, "unsupported flow control (value: 0x%02x)\n", uart->flow_control);
+	}
+
+	// set RTSCTS flow control
+	serdev_device_set_flow_control(serdev, uart->flow_control & ACPI_UART_FLOW_CONTROL_HW);
+
+	// serdev currently only supports EVEN/ODD parity
+	switch (uart->parity) {
+	case ACPI_UART_PARITY_NONE:
+		status = serdev_device_set_parity(serdev, SERDEV_PARITY_NONE);
+		break;
+	case ACPI_UART_PARITY_EVEN:
+		status = serdev_device_set_parity(serdev, SERDEV_PARITY_EVEN);
+		break;
+	case ACPI_UART_PARITY_ODD:
+		status = serdev_device_set_parity(serdev, SERDEV_PARITY_ODD);
+		break;
+	default:
+		dev_warn(&serdev->dev, "unsupported parity (value: 0x%02x)\n", uart->parity);
+		break;
+	}
+
+	if (status) {
+		dev_err(&serdev->dev, "failed to set parity (value: 0x%02x)\n", uart->parity);
+		return status;
+	}
+
+	return AE_CTRL_TERMINATE;       // we've found the resource and are done
+}
+
+
+static bool ssh_idma_filter(struct dma_chan *chan, void *param)
+{
+	// see dw8250_idma_filter
+	return param == chan->device->dev;
+}
+
+static int ssh_check_dma(struct serdev_device *serdev)
+{
+	struct device *dev = serdev->ctrl->dev.parent;
+	struct dma_chan *rx, *tx;
+	dma_cap_mask_t mask;
+	int status = 0;
+
+	/*
+	 * The EC UART requires DMA for proper communication. If we don't use DMA,
+	 * we'll drop bytes when the system has high load, e.g. during boot. This
+	 * causes some ugly behaviour, i.e. battery information (_BIX) messages
+	 * failing frequently. We're making sure the required DMA channels are
+	 * available here so serial8250_do_startup is able to grab them later
+	 * instead of silently falling back to a non-DMA approach.
+	 */
+
+	dma_cap_zero(mask);
+	dma_cap_set(DMA_SLAVE, mask);
+
+	rx = dma_request_slave_channel_compat(mask, ssh_idma_filter, dev->parent, dev, "rx");
+	if (IS_ERR_OR_NULL(rx)) {
+		status = rx ? PTR_ERR(rx) : -EPROBE_DEFER;
+		goto out;
+	}
+
+	tx = dma_request_slave_channel_compat(mask, ssh_idma_filter, dev->parent, dev, "tx");
+	if (IS_ERR_OR_NULL(tx)) {
+		status = tx ? PTR_ERR(tx) : -EPROBE_DEFER;
+		goto release_rx;
+	}
+
+	dma_release_channel(tx);
+release_rx:
+	dma_release_channel(rx);
+out:
+	return status;
+}
+
+
+static int surface_sam_ssh_suspend(struct device *dev)
+{
+	struct sam_ssh_ec *ec;
+	int status = 0;
+
+	dev_dbg(dev, "suspending\n");
+
+	ec = surface_sam_ssh_acquire_init();
+	if (ec) {
+		status = surface_sam_ssh_ec_suspend(ec);
+		if (status) {
+			dev_err(dev, "failed to suspend EC: %d\n", status);
+		}
+
+		ec->state = SSH_EC_SUSPENDED;
+		surface_sam_ssh_release(ec);
+	}
+
+	return status;
+}
+
+static int surface_sam_ssh_resume(struct device *dev)
+{
+	struct sam_ssh_ec *ec;
+	int status = 0;
+
+	dev_dbg(dev, "resuming\n");
+
+	ec = surface_sam_ssh_acquire_init();
+	if (ec) {
+		ec->state = SSH_EC_INITIALIZED;
+
+		status = surface_sam_ssh_ec_resume(ec);
+		if (status) {
+			dev_err(dev, "failed to resume EC: %d\n", status);
+		}
+
+		surface_sam_ssh_release(ec);
+	}
+
+	return status;
+}
+
+static SIMPLE_DEV_PM_OPS(surface_sam_ssh_pm_ops, surface_sam_ssh_suspend, surface_sam_ssh_resume);
+
+
+static const struct serdev_device_ops ssh_device_ops = {
+	.receive_buf  = ssh_receive_buf,
+	.write_wakeup = serdev_device_write_wakeup,
+};
+
+
+int surface_sam_ssh_sysfs_register(struct device *dev);
+void surface_sam_ssh_sysfs_unregister(struct device *dev);
+
+static int surface_sam_ssh_probe(struct serdev_device *serdev)
+{
+	struct sam_ssh_ec *ec;
+	struct workqueue_struct *event_queue_ack;
+	struct workqueue_struct *event_queue_evt;
+	u8 *write_buf;
+	u8 *read_buf;
+	u8 *eval_buf;
+	acpi_handle *ssh = ACPI_HANDLE(&serdev->dev);
+	acpi_status status;
+
+	dev_dbg(&serdev->dev, "probing\n");
+
+	// ensure DMA is ready before we set up the device
+	status = ssh_check_dma(serdev);
+	if (status) {
+		return status;
+	}
+
+	// allocate buffers
+	write_buf = kzalloc(SSH_WRITE_BUF_LEN, GFP_KERNEL);
+	if (!write_buf) {
+		status = -ENOMEM;
+		goto err_write_buf;
+	}
+
+	read_buf = kzalloc(SSH_READ_BUF_LEN, GFP_KERNEL);
+	if (!read_buf) {
+		status = -ENOMEM;
+		goto err_read_buf;
+	}
+
+	eval_buf = kzalloc(SSH_EVAL_BUF_LEN, GFP_KERNEL);
+	if (!eval_buf) {
+		status = -ENOMEM;
+		goto err_eval_buf;
+	}
+
+	event_queue_ack = create_singlethread_workqueue("surface_sh_ackq");
+	if (!event_queue_ack) {
+		status = -ENOMEM;
+		goto err_ackq;
+	}
+
+	event_queue_evt = create_workqueue("surface_sh_evtq");
+	if (!event_queue_evt) {
+		status = -ENOMEM;
+		goto err_evtq;
+	}
+
+	// set up EC
+	ec = surface_sam_ssh_acquire();
+	if (ec->state != SSH_EC_UNINITIALIZED) {
+		dev_err(&serdev->dev, "embedded controller already initialized\n");
+		surface_sam_ssh_release(ec);
+
+		status = -EBUSY;
+		goto err_busy;
+	}
+
+	ec->serdev      = serdev;
+	ec->writer.data = write_buf;
+	ec->writer.ptr  = write_buf;
+
+	// initialize receiver
+	init_completion(&ec->receiver.signal);
+	kfifo_init(&ec->receiver.fifo, read_buf, SSH_READ_BUF_LEN);
+	ec->receiver.eval_buf.ptr = eval_buf;
+	ec->receiver.eval_buf.cap = SSH_EVAL_BUF_LEN;
+	ec->receiver.eval_buf.len = 0;
+
+	// initialize event handling
+	ec->events.queue_ack = event_queue_ack;
+	ec->events.queue_evt = event_queue_evt;
+
+	ec->state = SSH_EC_INITIALIZED;
+
+	serdev_device_set_drvdata(serdev, ec);
+
+	// ensure everything is properly set-up before we open the device
+	smp_mb();
+
+	serdev_device_set_client_ops(serdev, &ssh_device_ops);
+	status = serdev_device_open(serdev);
+	if (status) {
+		goto err_open;
+	}
+
+	status = acpi_walk_resources(ssh, METHOD_NAME__CRS,
+	                             ssh_setup_from_resource, serdev);
+	if (ACPI_FAILURE(status)) {
+		goto err_devinit;
+	}
+
+	status = surface_sam_ssh_ec_resume(ec);
+	if (status) {
+		goto err_devinit;
+	}
+
+	status = surface_sam_ssh_sysfs_register(&serdev->dev);
+	if (status) {
+		goto err_devinit;
+	}
+
+	surface_sam_ssh_release(ec);
+
+	acpi_walk_dep_device_list(ssh);
+
+	return 0;
+
+err_devinit:
+	serdev_device_close(serdev);
+err_open:
+	ec->state = SSH_EC_UNINITIALIZED;
+	serdev_device_set_drvdata(serdev, NULL);
+	surface_sam_ssh_release(ec);
+err_busy:
+	destroy_workqueue(event_queue_evt);
+err_evtq:
+	destroy_workqueue(event_queue_ack);
+err_ackq:
+	kfree(eval_buf);
+err_eval_buf:
+	kfree(read_buf);
+err_read_buf:
+	kfree(write_buf);
+err_write_buf:
+	return status;
+}
+
+static void surface_sam_ssh_remove(struct serdev_device *serdev)
+{
+	struct sam_ssh_ec *ec;
+	unsigned long flags;
+	int status;
+
+	ec = surface_sam_ssh_acquire_init();
+	if (!ec) {
+		return;
+	}
+
+	surface_sam_ssh_sysfs_unregister(&serdev->dev);
+
+	// suspend EC and disable events
+	status = surface_sam_ssh_ec_suspend(ec);
+	if (status) {
+		dev_err(&serdev->dev, "failed to suspend EC: %d\n", status);
+	}
+
+	// make sure all events (received up to now) have been properly handled
+	flush_workqueue(ec->events.queue_ack);
+	flush_workqueue(ec->events.queue_evt);
+
+	// remove event handlers
+	spin_lock_irqsave(&ec->events.lock, flags);
+	memset(ec->events.handler, 0,
+	       sizeof(struct ssh_event_handler)
+	        * SAM_NUM_EVENT_TYPES);
+	spin_unlock_irqrestore(&ec->events.lock, flags);
+
+	// set device to deinitialized state
+	ec->state  = SSH_EC_UNINITIALIZED;
+	ec->serdev = NULL;
+
+	// ensure state and serdev get set before continuing
+	smp_mb();
+
+	/*
+	 * Flush any event that has not been processed yet to ensure we're not going to
+	 * use the serial device any more (e.g. for ACKing).
+	 */
+	flush_workqueue(ec->events.queue_ack);
+	flush_workqueue(ec->events.queue_evt);
+
+	serdev_device_close(serdev);
+
+	/*
+         * Only at this point, no new events can be received. Destroying the
+         * workqueue here flushes all remaining events. Those events will be
+         * silently ignored and neither ACKed nor any handler gets called.
+	 */
+	destroy_workqueue(ec->events.queue_ack);
+	destroy_workqueue(ec->events.queue_evt);
+
+	// free writer
+	kfree(ec->writer.data);
+	ec->writer.data = NULL;
+	ec->writer.ptr  = NULL;
+
+	// free receiver
+	spin_lock_irqsave(&ec->receiver.lock, flags);
+	ec->receiver.state = SSH_RCV_DISCARD;
+	kfifo_free(&ec->receiver.fifo);
+
+	kfree(ec->receiver.eval_buf.ptr);
+	ec->receiver.eval_buf.ptr = NULL;
+	ec->receiver.eval_buf.cap = 0;
+	ec->receiver.eval_buf.len = 0;
+	spin_unlock_irqrestore(&ec->receiver.lock, flags);
+
+	serdev_device_set_drvdata(serdev, NULL);
+	surface_sam_ssh_release(ec);
+}
+
+
+static const struct acpi_device_id surface_sam_ssh_match[] = {
+	{ "MSHW0084", 0 },
+	{ },
+};
+MODULE_DEVICE_TABLE(acpi, surface_sam_ssh_match);
+
+struct serdev_device_driver surface_sam_ssh = {
+	.probe = surface_sam_ssh_probe,
+	.remove = surface_sam_ssh_remove,
+	.driver = {
+		.name = "surface_sam_ssh",
+		.acpi_match_table = ACPI_PTR(surface_sam_ssh_match),
+		.pm = &surface_sam_ssh_pm_ops,
+	},
+};
+module_serdev_device_driver(surface_sam_ssh);
+
+MODULE_AUTHOR("Maximilian Luz <luzmaximilian@gmail.com>");
+MODULE_DESCRIPTION("Surface Serial Hub Driver for 5th Generation Surface Devices");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/platform/x86/surface_sam/surface_sam_ssh.h b/drivers/platform/x86/surface_sam/surface_sam_ssh.h
new file mode 100644
index 000000000000..89407ec2d4a4
--- /dev/null
+++ b/drivers/platform/x86/surface_sam/surface_sam_ssh.h
@@ -0,0 +1,91 @@
+/*
+ * Interface for Surface Serial Hub (SSH).
+ *
+ * The SSH is the main communication hub for communication between host and
+ * the Surface/System Aggregator Module (SAM) on newer Microsoft Surface
+ * devices (Book 2, Pro 5, Laptops, ...). Also referred to as SAM-over-SSH.
+ * Older devices (Book 1, Pro 4) use SAM-over-I2C.
+ */
+
+#ifndef _SURFACE_SAM_SSH_H
+#define _SURFACE_SAM_SSH_H
+
+#include <linux/types.h>
+#include <linux/device.h>
+
+
+/*
+ * Maximum request payload size in bytes.
+ * Value based on ACPI (255 bytes minus header/status bytes).
+ */
+#define SURFACE_SAM_SSH_MAX_RQST_PAYLOAD	(255 - 10)
+
+/*
+ * Maximum response payload size in bytes.
+ * Value based on ACPI (255 bytes minus header/status bytes).
+ */
+#define SURFACE_SAM_SSH_MAX_RQST_RESPONSE	(255 - 4)
+
+/*
+ * The number of (lower) bits of the request ID (RQID) reserved for events.
+ * These bits may only be used exclusively for events sent from the EC to the
+ * host.
+ */
+#define SURFACE_SAM_SSH_RQID_EVENT_BITS		5
+
+/*
+ * Special event-handler delay value indicating that the corresponding event
+ * should be handled immediately in the interrupt and not be relayed through
+ * the workqueue. Intended for low-latency events, such as keyboard events.
+ */
+#define SURFACE_SAM_SSH_EVENT_IMMEDIATE		((unsigned long) -1)
+
+
+struct surface_sam_ssh_buf {
+	u8 cap;
+	u8 len;
+	u8 *data;
+};
+
+struct surface_sam_ssh_rqst {
+	u8 tc;
+	u8 iid;
+	u8 cid;
+	u8 snc;
+	u8 cdl;
+	u8 *pld;
+};
+
+struct surface_sam_ssh_event {
+	u16 rqid;
+	u8  tc;
+	u8  iid;
+	u8  cid;
+	u8  len;
+	u8 *pld;
+};
+
+
+typedef int (*surface_sam_ssh_event_handler_fn)(struct surface_sam_ssh_event *event, void *data);
+typedef unsigned long (*surface_sam_ssh_event_handler_delay)(struct surface_sam_ssh_event *event, void *data);
+
+int surface_sam_ssh_consumer_register(struct device *consumer);
+
+int surface_sam_ssh_rqst(const struct surface_sam_ssh_rqst *rqst, struct surface_sam_ssh_buf *result);
+
+int surface_sam_ssh_enable_event_source(u8 tc, u8 unknown, u16 rqid);
+int surface_sam_ssh_disable_event_source(u8 tc, u8 unknown, u16 rqid);
+int surface_sam_ssh_remove_event_handler(u16 rqid);
+
+int surface_sam_ssh_set_delayed_event_handler(u16 rqid,
+		surface_sam_ssh_event_handler_fn fn,
+		surface_sam_ssh_event_handler_delay delay,
+		void *data);
+
+static inline int surface_sam_ssh_set_event_handler(u16 rqid, surface_sam_ssh_event_handler_fn fn, void *data)
+{
+	return surface_sam_ssh_set_delayed_event_handler(rqid, fn, NULL, data);
+}
+
+
+#endif /* _SURFACE_SAM_SSH_H */
diff --git a/drivers/platform/x86/surface_sam/surface_sam_vhf.c b/drivers/platform/x86/surface_sam/surface_sam_vhf.c
new file mode 100644
index 000000000000..38851a07ea80
--- /dev/null
+++ b/drivers/platform/x86/surface_sam/surface_sam_vhf.c
@@ -0,0 +1,286 @@
+/*
+ * Virtual HID Framwork (VHF) driver for input events via SAM.
+ * Used for keyboard input events on the Surface Laptops.
+ */
+
+#include <linux/acpi.h>
+#include <linux/hid.h>
+#include <linux/input.h>
+#include <linux/platform_device.h>
+#include <linux/types.h>
+
+#include "surface_sam_ssh.h"
+
+
+#define USB_VENDOR_ID_MICROSOFT		0x045e
+#define USB_DEVICE_ID_MS_VHF		0xf001
+
+#define VHF_INPUT_NAME			"Microsoft Virtual HID Framework Device"
+
+/*
+ * Request ID for VHF events. This value is based on the output of the Surface
+ * EC and should not be changed.
+ */
+#define SAM_EVENT_VHF_RQID		0x0001
+#define SAM_EVENT_VHF_TC		0x08
+
+
+struct vhf_evtctx {
+	struct device     *dev;
+	struct hid_device *hid;
+};
+
+struct vhf_drvdata {
+	struct vhf_evtctx event_ctx;
+};
+
+
+/*
+ * These report descriptors have been extracted from a Surface Book 2.
+ * They seems to be similar enough to be usable on the Surface Laptop.
+ */
+static const u8 vhf_hid_desc[] = {
+	// keyboard descriptor (event command ID 0x03)
+	0x05, 0x01,             /*  Usage Page (Desktop),                   */
+	0x09, 0x06,             /*  Usage (Keyboard),                       */
+	0xA1, 0x01,             /*  Collection (Application),               */
+	0x85, 0x01,             /*      Report ID (1),                      */
+	0x15, 0x00,             /*      Logical Minimum (0),                */
+	0x25, 0x01,             /*      Logical Maximum (1),                */
+	0x75, 0x01,             /*      Report Size (1),                    */
+	0x95, 0x08,             /*      Report Count (8),                   */
+	0x05, 0x07,             /*      Usage Page (Keyboard),              */
+	0x19, 0xE0,             /*      Usage Minimum (KB Leftcontrol),     */
+	0x29, 0xE7,             /*      Usage Maximum (KB Right GUI),       */
+	0x81, 0x02,             /*      Input (Variable),                   */
+	0x75, 0x08,             /*      Report Size (8),                    */
+	0x95, 0x0A,             /*      Report Count (10),                  */
+	0x19, 0x00,             /*      Usage Minimum (None),               */
+	0x29, 0x91,             /*      Usage Maximum (KB LANG2),           */
+	0x26, 0xFF, 0x00,       /*      Logical Maximum (255),              */
+	0x81, 0x00,             /*      Input,                              */
+	0x05, 0x0C,             /*      Usage Page (Consumer),              */
+	0x0A, 0xC0, 0x02,       /*      Usage (02C0h),                      */
+	0xA1, 0x02,             /*      Collection (Logical),               */
+	0x1A, 0xC1, 0x02,       /*          Usage Minimum (02C1h),          */
+	0x2A, 0xC6, 0x02,       /*          Usage Maximum (02C6h),          */
+	0x95, 0x06,             /*          Report Count (6),               */
+	0xB1, 0x03,             /*          Feature (Constant, Variable),   */
+	0xC0,                   /*      End Collection,                     */
+	0x05, 0x08,             /*      Usage Page (LED),                   */
+	0x19, 0x01,             /*      Usage Minimum (01h),                */
+	0x29, 0x03,             /*      Usage Maximum (03h),                */
+	0x75, 0x01,             /*      Report Size (1),                    */
+	0x95, 0x03,             /*      Report Count (3),                   */
+	0x25, 0x01,             /*      Logical Maximum (1),                */
+	0x91, 0x02,             /*      Output (Variable),                  */
+	0x95, 0x05,             /*      Report Count (5),                   */
+	0x91, 0x01,             /*      Output (Constant),                  */
+	0xC0,                   /*  End Collection,                         */
+
+	// media key descriptor (event command ID 0x04)
+	0x05, 0x0C,             /*  Usage Page (Consumer),                  */
+	0x09, 0x01,             /*  Usage (Consumer Control),               */
+	0xA1, 0x01,             /*  Collection (Application),               */
+	0x85, 0x03,             /*      Report ID (3),                      */
+	0x75, 0x10,             /*      Report Size (16),                   */
+	0x15, 0x00,             /*      Logical Minimum (0),                */
+	0x26, 0xFF, 0x03,       /*      Logical Maximum (1023),             */
+	0x19, 0x00,             /*      Usage Minimum (00h),                */
+	0x2A, 0xFF, 0x03,       /*      Usage Maximum (03FFh),              */
+	0x81, 0x00,             /*      Input,                              */
+	0xC0,                   /*  End Collection,                         */
+};
+
+
+static int vhf_hid_start(struct hid_device *hid)
+{
+	hid_dbg(hid, "%s\n", __func__);
+	return 0;
+}
+
+static void vhf_hid_stop(struct hid_device *hid)
+{
+	hid_dbg(hid, "%s\n", __func__);
+}
+
+static int vhf_hid_open(struct hid_device *hid)
+{
+	hid_dbg(hid, "%s\n", __func__);
+	return 0;
+}
+
+static void vhf_hid_close(struct hid_device *hid)
+{
+	hid_dbg(hid, "%s\n", __func__);
+}
+
+static int vhf_hid_parse(struct hid_device *hid)
+{
+	return hid_parse_report(hid, (u8 *)vhf_hid_desc, ARRAY_SIZE(vhf_hid_desc));
+}
+
+static int vhf_hid_raw_request(struct hid_device *hid, unsigned char reportnum,
+			       u8 *buf, size_t len, unsigned char rtype,
+			       int reqtype)
+{
+	hid_dbg(hid, "%s\n", __func__);
+	return 0;
+}
+
+static int vhf_hid_output_report(struct hid_device *hid, u8 *buf, size_t len)
+{
+	hid_dbg(hid, "%s\n", __func__);
+	print_hex_dump_debug("report:", DUMP_PREFIX_OFFSET, 16, 1, buf, len, false);
+
+	return len;
+}
+
+static struct hid_ll_driver vhf_hid_ll_driver = {
+	.start         = vhf_hid_start,
+	.stop          = vhf_hid_stop,
+	.open          = vhf_hid_open,
+	.close         = vhf_hid_close,
+	.parse         = vhf_hid_parse,
+	.raw_request   = vhf_hid_raw_request,
+	.output_report = vhf_hid_output_report,
+};
+
+
+static struct hid_device *vhf_create_hid_device(struct platform_device *pdev)
+{
+	struct hid_device *hid;
+
+	hid = hid_allocate_device();
+	if (IS_ERR(hid)) {
+		return hid;
+	}
+
+	hid->dev.parent = &pdev->dev;
+
+	hid->bus     = BUS_VIRTUAL;
+	hid->vendor  = USB_VENDOR_ID_MICROSOFT;
+	hid->product = USB_DEVICE_ID_MS_VHF;
+
+	hid->ll_driver = &vhf_hid_ll_driver;
+
+	sprintf(hid->name, "%s", VHF_INPUT_NAME);
+
+	return hid;
+}
+
+static int vhf_event_handler(struct surface_sam_ssh_event *event, void *data)
+{
+	struct vhf_evtctx *ctx = (struct vhf_evtctx *)data;
+
+	if (event->tc == 0x08 && (event->cid == 0x03 || event->cid == 0x04)) {
+		return hid_input_report(ctx->hid, HID_INPUT_REPORT, event->pld, event->len, 1);
+	}
+
+	dev_warn(ctx->dev, "unsupported event (tc = %d, cid = %d)\n", event->tc, event->cid);
+	return 0;
+}
+
+static unsigned long vhf_event_delay(struct surface_sam_ssh_event *event, void *data)
+{
+	// high priority immediate execution for keyboard events
+	if (event->tc == 0x08 && (event->cid == 0x03 || event->cid == 0x04)) {
+		return SURFACE_SAM_SSH_EVENT_IMMEDIATE;
+	}
+
+	return 0;
+}
+
+static int surface_sam_vhf_probe(struct platform_device *pdev)
+{
+	struct vhf_drvdata *drvdata;
+	struct hid_device *hid;
+	int status;
+
+	// add device link to EC
+	status = surface_sam_ssh_consumer_register(&pdev->dev);
+	if (status) {
+		return status == -ENXIO ? -EPROBE_DEFER : status;
+	}
+
+	drvdata = kzalloc(sizeof(struct vhf_drvdata), GFP_KERNEL);
+	if (!drvdata) {
+		return -ENOMEM;
+	}
+
+	hid = vhf_create_hid_device(pdev);
+	if (IS_ERR(hid)) {
+		status = PTR_ERR(hid);
+		goto err_probe_hid;
+	}
+
+	status = hid_add_device(hid);
+	if (status) {
+		goto err_add_hid;
+	}
+
+	drvdata->event_ctx.dev = &pdev->dev;
+	drvdata->event_ctx.hid = hid;
+
+	platform_set_drvdata(pdev, drvdata);
+
+	status = surface_sam_ssh_set_delayed_event_handler(
+			SAM_EVENT_VHF_RQID,
+	                vhf_event_handler,
+	                vhf_event_delay,
+			&drvdata->event_ctx);
+	if (status) {
+		goto err_add_hid;
+	}
+
+	status = surface_sam_ssh_enable_event_source(SAM_EVENT_VHF_TC, 0x01, SAM_EVENT_VHF_RQID);
+	if (status) {
+		goto err_event_source;
+	}
+
+	return 0;
+
+err_event_source:
+	surface_sam_ssh_remove_event_handler(SAM_EVENT_VHF_RQID);
+err_add_hid:
+	hid_destroy_device(hid);
+	platform_set_drvdata(pdev, NULL);
+err_probe_hid:
+	kfree(drvdata);
+	return status;
+}
+
+static int surface_sam_vhf_remove(struct platform_device *pdev)
+{
+	struct vhf_drvdata *drvdata = platform_get_drvdata(pdev);
+
+	surface_sam_ssh_disable_event_source(SAM_EVENT_VHF_TC, 0x01, SAM_EVENT_VHF_RQID);
+	surface_sam_ssh_remove_event_handler(SAM_EVENT_VHF_RQID);
+
+	hid_destroy_device(drvdata->event_ctx.hid);
+	kfree(drvdata);
+
+	platform_set_drvdata(pdev, NULL);
+	return 0;
+}
+
+
+static const struct acpi_device_id surface_sam_vhf_match[] = {
+	{ "MSHW0096" },
+	{ },
+};
+MODULE_DEVICE_TABLE(acpi, surface_sam_vhf_match);
+
+struct platform_driver surface_sam_vhf = {
+	.probe = surface_sam_vhf_probe,
+	.remove = surface_sam_vhf_remove,
+	.driver = {
+		.name = "surface_sam_vhf",
+		.acpi_match_table = ACPI_PTR(surface_sam_vhf_match),
+	},
+};
+module_platform_driver(surface_sam_vhf);
+
+MODULE_AUTHOR("Maximilian Luz <luzmaximilian@gmail.com>");
+MODULE_DESCRIPTION("Virtual HID Framework Driver for 5th Generation Surface Devices");
+MODULE_LICENSE("GPL v2");
diff --git a/include/linux/intel_ipts_fw.h b/include/linux/intel_ipts_fw.h
new file mode 100644
index 000000000000..adbfd29459a2
--- /dev/null
+++ b/include/linux/intel_ipts_fw.h
@@ -0,0 +1,14 @@
+#ifndef _INTEL_IPTS_FW_H_
+#define _INTEL_IPTS_FW_H_
+
+#include <linux/firmware.h>
+
+#define MAX_IOCL_FILE_NAME_LEN 80
+#define MAX_IOCL_FILE_PATH_LEN 256
+#define IPTS_FW_HANDLER(name) int(*name)(const struct firmware **, \
+	const char *, struct device *, void *)
+
+int intel_ipts_add_fw_handler(IPTS_FW_HANDLER(handler), void *data);
+int intel_ipts_rm_fw_handler(IPTS_FW_HANDLER(handler));
+
+#endif // _INTEL_IPTS_FW_H_
diff --git a/include/linux/intel_ipts_if.h b/include/linux/intel_ipts_if.h
new file mode 100644
index 000000000000..bad44fb4f233
--- /dev/null
+++ b/include/linux/intel_ipts_if.h
@@ -0,0 +1,76 @@
+/*
+ *
+ * GFX interface to support Intel Precise Touch & Stylus
+ * Copyright (c) 2016 Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ */
+
+#ifndef INTEL_IPTS_IF_H
+#define INTEL_IPTS_IF_H
+
+enum {
+	IPTS_INTERFACE_V1 = 1,
+};
+
+#define IPTS_BUF_FLAG_CONTIGUOUS	0x01
+
+#define IPTS_NOTIFY_STA_BACKLIGHT_OFF	0x00
+#define IPTS_NOTIFY_STA_BACKLIGHT_ON	0x01
+
+typedef struct intel_ipts_mapbuffer {
+	u32	size;
+	u32	flags;
+	void	*gfx_addr;
+	void	*cpu_addr;
+	u64	buf_handle;
+	u64	phy_addr;
+} intel_ipts_mapbuffer_t;
+
+typedef struct intel_ipts_wq_info {
+	u64 db_addr;
+	u64 db_phy_addr;
+	u32 db_cookie_offset;
+	u32 wq_size;
+	u64 wq_addr;
+	u64 wq_phy_addr;
+	u64 wq_head_addr;	/* head of wq is managed by GPU */
+	u64 wq_head_phy_addr;	/* head of wq is managed by GPU */
+	u64 wq_tail_addr;	/* tail of wq is managed by CSME */
+	u64 wq_tail_phy_addr;	/* tail of wq is managed by CSME */
+} intel_ipts_wq_info_t;
+
+typedef struct intel_ipts_ops {
+	int (*get_wq_info)(uint64_t gfx_handle, intel_ipts_wq_info_t *wq_info);
+	int (*map_buffer)(uint64_t gfx_handle, intel_ipts_mapbuffer_t *mapbuffer);
+	int (*unmap_buffer)(uint64_t gfx_handle, uint64_t buf_handle);
+} intel_ipts_ops_t;
+
+typedef struct intel_ipts_callback {
+        void (*workload_complete)(void *data);
+        void (*notify_gfx_status)(u32 status, void *data);
+} intel_ipts_callback_t;
+
+typedef struct intel_ipts_connect {
+	struct device *client;		/* input : client device for PM setup */
+        intel_ipts_callback_t ipts_cb;	/* input : callback addresses */
+	void *data;			/* input : callback data */
+        u32 if_version;			/* input : interface version */
+
+        u32 gfx_version;		/* output : gfx version */
+        u64 gfx_handle;			/* output : gfx handle */
+	intel_ipts_ops_t ipts_ops;	/* output : gfx ops for IPTS */
+} intel_ipts_connect_t;
+
+int intel_ipts_connect(intel_ipts_connect_t *ipts_connect);
+void intel_ipts_disconnect(uint64_t gfx_handle);
+
+#endif // INTEL_IPTS_IF_H
-- 
2.23.0