* GNU General Public License for more details.
  */
 
+#include <linux/delay.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/i2c.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 
+/**
+ * Request format for protocol v3
+ * byte 0      0xda (EC_COMMAND_PROTOCOL_3)
+ * byte 1-8    struct ec_host_request
+ * byte 10-    response data
+ */
+struct ec_host_request_i2c {
+       /* Always 0xda to backward compatible with v2 struct */
+       uint8_t  command_protocol;
+       struct ec_host_request ec_request;
+} __packed;
+
+
+/*
+ * Response format for protocol v3
+ * byte 0      result code
+ * byte 1      packet_length
+ * byte 2-9    struct ec_host_response
+ * byte 10-    response data
+ */
+struct ec_host_response_i2c {
+       uint8_t result;
+       uint8_t packet_length;
+       struct ec_host_response ec_response;
+} __packed;
+
 static inline struct cros_ec_device *to_ec_dev(struct device *dev)
 {
        struct i2c_client *client = to_i2c_client(dev);
        return i2c_get_clientdata(client);
 }
 
+static int cros_ec_pkt_xfer_i2c(struct cros_ec_device *ec_dev,
+                               struct cros_ec_command *msg)
+{
+       struct i2c_client *client = ec_dev->priv;
+       int ret = -ENOMEM;
+       int i;
+       int packet_len;
+       u8 *out_buf = NULL;
+       u8 *in_buf = NULL;
+       u8 sum;
+       struct i2c_msg i2c_msg[2];
+       struct ec_host_response *ec_response;
+       struct ec_host_request_i2c *ec_request_i2c;
+       struct ec_host_response_i2c *ec_response_i2c;
+       int request_header_size = sizeof(struct ec_host_request_i2c);
+       int response_header_size = sizeof(struct ec_host_response_i2c);
+
+       i2c_msg[0].addr = client->addr;
+       i2c_msg[0].flags = 0;
+       i2c_msg[1].addr = client->addr;
+       i2c_msg[1].flags = I2C_M_RD;
+
+       packet_len = msg->insize + response_header_size;
+       BUG_ON(packet_len > ec_dev->din_size);
+       in_buf = ec_dev->din;
+       i2c_msg[1].len = packet_len;
+       i2c_msg[1].buf = (char *) in_buf;
+
+       packet_len = msg->outsize + request_header_size;
+       BUG_ON(packet_len > ec_dev->dout_size);
+       out_buf = ec_dev->dout;
+       i2c_msg[0].len = packet_len;
+       i2c_msg[0].buf = (char *) out_buf;
+
+       /* create request data */
+       ec_request_i2c = (struct ec_host_request_i2c *) out_buf;
+       ec_request_i2c->command_protocol = EC_COMMAND_PROTOCOL_3;
+
+       ec_dev->dout++;
+       ret = cros_ec_prepare_tx(ec_dev, msg);
+       ec_dev->dout--;
+
+       /* send command to EC and read answer */
+       ret = i2c_transfer(client->adapter, i2c_msg, 2);
+       if (ret < 0) {
+               dev_dbg(ec_dev->dev, "i2c transfer failed: %d\n", ret);
+               goto done;
+       } else if (ret != 2) {
+               dev_err(ec_dev->dev, "failed to get response: %d\n", ret);
+               ret = -EIO;
+               goto done;
+       }
+
+       ec_response_i2c = (struct ec_host_response_i2c *) in_buf;
+       msg->result = ec_response_i2c->result;
+       ec_response = &ec_response_i2c->ec_response;
+
+       switch (msg->result) {
+       case EC_RES_SUCCESS:
+               break;
+       case EC_RES_IN_PROGRESS:
+               ret = -EAGAIN;
+               dev_dbg(ec_dev->dev, "command 0x%02x in progress\n",
+                       msg->command);
+               goto done;
+
+       default:
+               dev_dbg(ec_dev->dev, "command 0x%02x returned %d\n",
+                       msg->command, msg->result);
+               /*
+                * When we send v3 request to v2 ec, ec won't recognize the
+                * 0xda (EC_COMMAND_PROTOCOL_3) and will return with status
+                * EC_RES_INVALID_COMMAND with zero data length.
+                *
+                * In case of invalid command for v3 protocol the data length
+                * will be at least sizeof(struct ec_host_response)
+                */
+               if (ec_response_i2c->result == EC_RES_INVALID_COMMAND &&
+                   ec_response_i2c->packet_length == 0) {
+                       ret = -EPROTONOSUPPORT;
+                       goto done;
+               }
+       }
+
+       if (ec_response_i2c->packet_length < sizeof(struct ec_host_response)) {
+               dev_err(ec_dev->dev,
+                       "response of %u bytes too short; not a full header\n",
+                       ec_response_i2c->packet_length);
+               ret = -EBADMSG;
+               goto done;
+       }
+
+       if (msg->insize < ec_response->data_len) {
+               dev_err(ec_dev->dev,
+                       "response data size is too large: expected %u, got %u\n",
+                       msg->insize,
+                       ec_response->data_len);
+               ret = -EMSGSIZE;
+               goto done;
+       }
+
+       /* copy response packet payload and compute checksum */
+       sum = 0;
+       for (i = 0; i < sizeof(struct ec_host_response); i++)
+               sum += ((u8 *)ec_response)[i];
+
+       memcpy(msg->data,
+              in_buf + response_header_size,
+              ec_response->data_len);
+       for (i = 0; i < ec_response->data_len; i++)
+               sum += msg->data[i];
+
+       /* All bytes should sum to zero */
+       if (sum) {
+               dev_err(ec_dev->dev, "bad packet checksum\n");
+               ret = -EBADMSG;
+               goto done;
+       }
+
+       ret = ec_response->data_len;
+
+done:
+       if (msg->command == EC_CMD_REBOOT_EC)
+               msleep(EC_REBOOT_DELAY_MS);
+
+       return ret;
+}
+
 static int cros_ec_cmd_xfer_i2c(struct cros_ec_device *ec_dev,
                                struct cros_ec_command *msg)
 {
        }
 
        ret = len;
- done:
+done:
        kfree(in_buf);
        kfree(out_buf);
+       if (msg->command == EC_CMD_REBOOT_EC)
+               msleep(EC_REBOOT_DELAY_MS);
+
        return ret;
 }
 
        ec_dev->priv = client;
        ec_dev->irq = client->irq;
        ec_dev->cmd_xfer = cros_ec_cmd_xfer_i2c;
-       ec_dev->pkt_xfer = NULL;
+       ec_dev->pkt_xfer = cros_ec_pkt_xfer_i2c;
        ec_dev->ec_name = client->name;
        ec_dev->phys_name = client->adapter->name;
-       ec_dev->din_size = sizeof(struct ec_host_response) +
+       ec_dev->din_size = sizeof(struct ec_host_response_i2c) +
                           sizeof(struct ec_response_get_protocol_info);
-       ec_dev->dout_size = sizeof(struct ec_host_request);
+       ec_dev->dout_size = sizeof(struct ec_host_request_i2c);
 
        err = cros_ec_register(ec_dev);
        if (err) {
 
   */
 #define EC_SPI_RECOVERY_TIME_NS        (200 * 1000)
 
-/*
- * The EC is unresponsive for a time after a reboot command.  Add a
- * simple delay to make sure that the bus stays locked.
- */
-#define EC_REBOOT_DELAY_MS     50
-
 /**
  * struct cros_ec_spi - information about a SPI-connected EC
  *
 };
 
 static void debug_packet(struct device *dev, const char *name, u8 *ptr,
-                         int len)
+                        int len)
 {
 #ifdef DEBUG
        int i;
 #endif
 }
 
+static int terminate_request(struct cros_ec_device *ec_dev)
+{
+       struct cros_ec_spi *ec_spi = ec_dev->priv;
+       struct spi_message msg;
+       struct spi_transfer trans;
+       int ret;
+
+       /*
+        * Turn off CS, possibly adding a delay to ensure the rising edge
+        * doesn't come too soon after the end of the data.
+        */
+       spi_message_init(&msg);
+       memset(&trans, 0, sizeof(trans));
+       trans.delay_usecs = ec_spi->end_of_msg_delay;
+       spi_message_add_tail(&trans, &msg);
+
+       ret = spi_sync(ec_spi->spi, &msg);
+
+       /* Reset end-of-response timer */
+       ec_spi->last_transfer_ns = ktime_get_ns();
+       if (ret < 0) {
+               dev_err(ec_dev->dev,
+                       "cs-deassert spi transfer failed: %d\n",
+                       ret);
+       }
+
+       return ret;
+}
+
+/**
+ * receive_n_bytes - receive n bytes from the EC.
+ *
+ * Assumes buf is a pointer into the ec_dev->din buffer
+ */
+static int receive_n_bytes(struct cros_ec_device *ec_dev, u8 *buf, int n)
+{
+       struct cros_ec_spi *ec_spi = ec_dev->priv;
+       struct spi_transfer trans;
+       struct spi_message msg;
+       int ret;
+
+       BUG_ON(buf - ec_dev->din + n > ec_dev->din_size);
+
+       memset(&trans, 0, sizeof(trans));
+       trans.cs_change = 1;
+       trans.rx_buf = buf;
+       trans.len = n;
+
+       spi_message_init(&msg);
+       spi_message_add_tail(&trans, &msg);
+       ret = spi_sync(ec_spi->spi, &msg);
+       if (ret < 0)
+               dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
+
+       return ret;
+}
+
+/**
+ * cros_ec_spi_receive_packet - Receive a packet from the EC.
+ *
+ * This function has two phases: reading the preamble bytes (since if we read
+ * data from the EC before it is ready to send, we just get preamble) and
+ * reading the actual message.
+ *
+ * The received data is placed into ec_dev->din.
+ *
+ * @ec_dev: ChromeOS EC device
+ * @need_len: Number of message bytes we need to read
+ */
+static int cros_ec_spi_receive_packet(struct cros_ec_device *ec_dev,
+                                     int need_len)
+{
+       struct ec_host_response *response;
+       u8 *ptr, *end;
+       int ret;
+       unsigned long deadline;
+       int todo;
+
+       BUG_ON(EC_MSG_PREAMBLE_COUNT > ec_dev->din_size);
+
+       /* Receive data until we see the header byte */
+       deadline = jiffies + msecs_to_jiffies(EC_MSG_DEADLINE_MS);
+       while (true) {
+               unsigned long start_jiffies = jiffies;
+
+               ret = receive_n_bytes(ec_dev,
+                                     ec_dev->din,
+                                     EC_MSG_PREAMBLE_COUNT);
+               if (ret < 0)
+                       return ret;
+
+               ptr = ec_dev->din;
+               for (end = ptr + EC_MSG_PREAMBLE_COUNT; ptr != end; ptr++) {
+                       if (*ptr == EC_SPI_FRAME_START) {
+                               dev_dbg(ec_dev->dev, "msg found at %zd\n",
+                                       ptr - ec_dev->din);
+                               break;
+                       }
+               }
+               if (ptr != end)
+                       break;
+
+               /*
+                * Use the time at the start of the loop as a timeout.  This
+                * gives us one last shot at getting the transfer and is useful
+                * in case we got context switched out for a while.
+                */
+               if (time_after(start_jiffies, deadline)) {
+                       dev_warn(ec_dev->dev, "EC failed to respond in time\n");
+                       return -ETIMEDOUT;
+               }
+       }
+
+       /*
+        * ptr now points to the header byte. Copy any valid data to the
+        * start of our buffer
+        */
+       todo = end - ++ptr;
+       BUG_ON(todo < 0 || todo > ec_dev->din_size);
+       todo = min(todo, need_len);
+       memmove(ec_dev->din, ptr, todo);
+       ptr = ec_dev->din + todo;
+       dev_dbg(ec_dev->dev, "need %d, got %d bytes from preamble\n",
+               need_len, todo);
+       need_len -= todo;
+
+       /* If the entire response struct wasn't read, get the rest of it. */
+       if (todo < sizeof(*response)) {
+               ret = receive_n_bytes(ec_dev, ptr, sizeof(*response) - todo);
+               if (ret < 0)
+                       return -EBADMSG;
+               ptr += (sizeof(*response) - todo);
+               todo = sizeof(*response);
+       }
+
+       response = (struct ec_host_response *)ec_dev->din;
+
+       /* Abort if data_len is too large. */
+       if (response->data_len > ec_dev->din_size)
+               return -EMSGSIZE;
+
+       /* Receive data until we have it all */
+       while (need_len > 0) {
+               /*
+                * We can't support transfers larger than the SPI FIFO size
+                * unless we have DMA. We don't have DMA on the ISP SPI ports
+                * for Exynos. We need a way of asking SPI driver for
+                * maximum-supported transfer size.
+                */
+               todo = min(need_len, 256);
+               dev_dbg(ec_dev->dev, "loop, todo=%d, need_len=%d, ptr=%zd\n",
+                       todo, need_len, ptr - ec_dev->din);
+
+               ret = receive_n_bytes(ec_dev, ptr, todo);
+               if (ret < 0)
+                       return ret;
+
+               ptr += todo;
+               need_len -= todo;
+       }
+
+       dev_dbg(ec_dev->dev, "loop done, ptr=%zd\n", ptr - ec_dev->din);
+
+       return 0;
+}
+
 /**
  * cros_ec_spi_receive_response - Receive a response from the EC.
  *
 static int cros_ec_spi_receive_response(struct cros_ec_device *ec_dev,
                                        int need_len)
 {
-       struct cros_ec_spi *ec_spi = ec_dev->priv;
-       struct spi_transfer trans;
-       struct spi_message msg;
        u8 *ptr, *end;
        int ret;
        unsigned long deadline;
        int todo;
 
+       BUG_ON(EC_MSG_PREAMBLE_COUNT > ec_dev->din_size);
+
        /* Receive data until we see the header byte */
        deadline = jiffies + msecs_to_jiffies(EC_MSG_DEADLINE_MS);
        while (true) {
                unsigned long start_jiffies = jiffies;
 
-               memset(&trans, 0, sizeof(trans));
-               trans.cs_change = 1;
-               trans.rx_buf = ptr = ec_dev->din;
-               trans.len = EC_MSG_PREAMBLE_COUNT;
-
-               spi_message_init(&msg);
-               spi_message_add_tail(&trans, &msg);
-               ret = spi_sync(ec_spi->spi, &msg);
-               if (ret < 0) {
-                       dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
+               ret = receive_n_bytes(ec_dev,
+                                     ec_dev->din,
+                                     EC_MSG_PREAMBLE_COUNT);
+               if (ret < 0)
                        return ret;
-               }
 
+               ptr = ec_dev->din;
                for (end = ptr + EC_MSG_PREAMBLE_COUNT; ptr != end; ptr++) {
-                       if (*ptr == EC_MSG_HEADER) {
+                       if (*ptr == EC_SPI_FRAME_START) {
                                dev_dbg(ec_dev->dev, "msg found at %zd\n",
                                        ptr - ec_dev->din);
                                break;
                dev_dbg(ec_dev->dev, "loop, todo=%d, need_len=%d, ptr=%zd\n",
                        todo, need_len, ptr - ec_dev->din);
 
-               memset(&trans, 0, sizeof(trans));
-               trans.cs_change = 1;
-               trans.rx_buf = ptr;
-               trans.len = todo;
-               spi_message_init(&msg);
-               spi_message_add_tail(&trans, &msg);
-
-               /* send command to EC and read answer */
-               BUG_ON((u8 *)trans.rx_buf - ec_dev->din + todo >
-                               ec_dev->din_size);
-               ret = spi_sync(ec_spi->spi, &msg);
-               if (ret < 0) {
-                       dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
+               ret = receive_n_bytes(ec_dev, ptr, todo);
+               if (ret < 0)
                        return ret;
-               }
 
                debug_packet(ec_dev->dev, "interim", ptr, todo);
                ptr += todo;
        return 0;
 }
 
+/**
+ * cros_ec_pkt_xfer_spi - Transfer a packet over SPI and receive the reply
+ *
+ * @ec_dev: ChromeOS EC device
+ * @ec_msg: Message to transfer
+ */
+static int cros_ec_pkt_xfer_spi(struct cros_ec_device *ec_dev,
+                               struct cros_ec_command *ec_msg)
+{
+       struct ec_host_request *request;
+       struct ec_host_response *response;
+       struct cros_ec_spi *ec_spi = ec_dev->priv;
+       struct spi_transfer trans;
+       struct spi_message msg;
+       int i, len;
+       u8 *ptr;
+       u8 *rx_buf;
+       u8 sum;
+       int ret = 0, final_ret;
+
+       len = cros_ec_prepare_tx(ec_dev, ec_msg);
+       request = (struct ec_host_request *)ec_dev->dout;
+       dev_dbg(ec_dev->dev, "prepared, len=%d\n", len);
+
+       /* If it's too soon to do another transaction, wait */
+       if (ec_spi->last_transfer_ns) {
+               unsigned long delay;    /* The delay completed so far */
+
+               delay = ktime_get_ns() - ec_spi->last_transfer_ns;
+               if (delay < EC_SPI_RECOVERY_TIME_NS)
+                       ndelay(EC_SPI_RECOVERY_TIME_NS - delay);
+       }
+
+       rx_buf = kzalloc(len, GFP_KERNEL);
+       if (!rx_buf) {
+               ret = -ENOMEM;
+               goto exit;
+       }
+
+       /* Transmit phase - send our message */
+       memset(&trans, 0, sizeof(trans));
+       trans.tx_buf = ec_dev->dout;
+       trans.rx_buf = rx_buf;
+       trans.len = len;
+       trans.cs_change = 1;
+       spi_message_init(&msg);
+       spi_message_add_tail(&trans, &msg);
+       ret = spi_sync(ec_spi->spi, &msg);
+
+       /* Get the response */
+       if (!ret) {
+               /* Verify that EC can process command */
+               for (i = 0; i < len; i++) {
+                       switch (rx_buf[i]) {
+                       case EC_SPI_PAST_END:
+                       case EC_SPI_RX_BAD_DATA:
+                       case EC_SPI_NOT_READY:
+                               ret = -EAGAIN;
+                               ec_msg->result = EC_RES_IN_PROGRESS;
+                       default:
+                               break;
+                       }
+                       if (ret)
+                               break;
+               }
+               if (!ret)
+                       ret = cros_ec_spi_receive_packet(ec_dev,
+                                       ec_msg->insize + sizeof(*response));
+       } else {
+               dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
+       }
+
+       final_ret = terminate_request(ec_dev);
+       if (!ret)
+               ret = final_ret;
+       if (ret < 0)
+               goto exit;
+
+       ptr = ec_dev->din;
+
+       /* check response error code */
+       response = (struct ec_host_response *)ptr;
+       ec_msg->result = response->result;
+
+       ret = cros_ec_check_result(ec_dev, ec_msg);
+       if (ret)
+               goto exit;
+
+       len = response->data_len;
+       sum = 0;
+       if (len > ec_msg->insize) {
+               dev_err(ec_dev->dev, "packet too long (%d bytes, expected %d)",
+                       len, ec_msg->insize);
+               ret = -EMSGSIZE;
+               goto exit;
+       }
+
+       for (i = 0; i < sizeof(*response); i++)
+               sum += ptr[i];
+
+       /* copy response packet payload and compute checksum */
+       memcpy(ec_msg->data, ptr + sizeof(*response), len);
+       for (i = 0; i < len; i++)
+               sum += ec_msg->data[i];
+
+       if (sum) {
+               dev_err(ec_dev->dev,
+                       "bad packet checksum, calculated %x\n",
+                       sum);
+               ret = -EBADMSG;
+               goto exit;
+       }
+
+       ret = len;
+exit:
+       kfree(rx_buf);
+       if (ec_msg->command == EC_CMD_REBOOT_EC)
+               msleep(EC_REBOOT_DELAY_MS);
+
+       return ret;
+}
+
 /**
  * cros_ec_cmd_xfer_spi - Transfer a message over SPI and receive the reply
  *
        struct spi_message msg;
        int i, len;
        u8 *ptr;
+       u8 *rx_buf;
        int sum;
        int ret = 0, final_ret;
 
                        ndelay(EC_SPI_RECOVERY_TIME_NS - delay);
        }
 
+       rx_buf = kzalloc(len, GFP_KERNEL);
+       if (!rx_buf) {
+               ret = -ENOMEM;
+               goto exit;
+       }
+
        /* Transmit phase - send our message */
        debug_packet(ec_dev->dev, "out", ec_dev->dout, len);
        memset(&trans, 0, sizeof(trans));
        trans.tx_buf = ec_dev->dout;
+       trans.rx_buf = rx_buf;
        trans.len = len;
        trans.cs_change = 1;
        spi_message_init(&msg);
 
        /* Get the response */
        if (!ret) {
-               ret = cros_ec_spi_receive_response(ec_dev,
-                               ec_msg->insize + EC_MSG_TX_PROTO_BYTES);
+               /* Verify that EC can process command */
+               for (i = 0; i < len; i++) {
+                       switch (rx_buf[i]) {
+                       case EC_SPI_PAST_END:
+                       case EC_SPI_RX_BAD_DATA:
+                       case EC_SPI_NOT_READY:
+                               ret = -EAGAIN;
+                               ec_msg->result = EC_RES_IN_PROGRESS;
+                       default:
+                               break;
+                       }
+                       if (ret)
+                               break;
+               }
+               if (!ret)
+                       ret = cros_ec_spi_receive_response(ec_dev,
+                                       ec_msg->insize + EC_MSG_TX_PROTO_BYTES);
        } else {
                dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
        }
 
-       /*
-        * Turn off CS, possibly adding a delay to ensure the rising edge
-        * doesn't come too soon after the end of the data.
-        */
-       spi_message_init(&msg);
-       memset(&trans, 0, sizeof(trans));
-       trans.delay_usecs = ec_spi->end_of_msg_delay;
-       spi_message_add_tail(&trans, &msg);
-
-       final_ret = spi_sync(ec_spi->spi, &msg);
-       ec_spi->last_transfer_ns = ktime_get_ns();
+       final_ret = terminate_request(ec_dev);
        if (!ret)
                ret = final_ret;
-       if (ret < 0) {
-               dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
+       if (ret < 0)
                goto exit;
-       }
 
        ptr = ec_dev->din;
 
 
        ret = len;
 exit:
+       kfree(rx_buf);
        if (ec_msg->command == EC_CMD_REBOOT_EC)
                msleep(EC_REBOOT_DELAY_MS);
 
        ec_dev->priv = ec_spi;
        ec_dev->irq = spi->irq;
        ec_dev->cmd_xfer = cros_ec_cmd_xfer_spi;
-       ec_dev->pkt_xfer = NULL;
+       ec_dev->pkt_xfer = cros_ec_pkt_xfer_spi;
        ec_dev->ec_name = ec_spi->spi->modalias;
        ec_dev->phys_name = dev_name(&ec_spi->spi->dev);
        ec_dev->din_size = EC_MSG_PREAMBLE_COUNT +
                           sizeof(struct ec_response_get_protocol_info);
        ec_dev->dout_size = sizeof(struct ec_host_request);
 
+
        err = cros_ec_register(ec_dev);
        if (err) {
                dev_err(dev, "cannot register EC\n");