[RESEND PATCH 0/8] cros_ec: Add multiple EC and protocol v3 support

[RESEND PATCH 0/8] cros_ec: Add multiple EC and protocol v3 support

[Javier Martinez Canillas]

Hello,

Newer Chromebooks have more than one Embedded Controller (EC) in the
system. These additional ECs are connected through I2C with a host EC
which is the one that is connected to the Application Processor (AP)
through I2C, SPI or LPC.

So on these platforms, sub-processors are chained to each other:

AP <--> Host EC <--> Power Delivery (PD) EC

The AP sends commands to the additional EC through the host EC using
a set of passthru commands and the host redirects to the correct EC.

This series adds support for multiple EC in a system and also for the
protocol version 3 that is used on newer ECs.

Most patches were taken from the downstream ChromiumOS v3.14 tree with
fixes squashed, split to minimise the cross subsystem churn and changes
for mainline inclusion but were not modified functionality wise.

The series depend on "platform/chrome: Add user-space dev inferface support"
[0] that is already merged in the chrome-platform tree so probably these
patches should also go through that tree once the mfd patches are acked.

The series is a resend of a patch-set posted a month ago [1]. The only big
change besides cleanups and bugfixes is a rework of the cros_ec IOCTL API
as suggested by Gwendal Grignou to use a zero-length for the data buffer to
make the API both 64-bit safe and flexible for variable commands lengths.

The patches were tested on an Exynos5250 Snow, Exynos5420 Peach Pit,
Exynos5800 Peach Pi and x86 Pixel Chromebook using a modified ectool [2]
that uses the new API and no regressions were found.

I don't have access neither to a Chromebook with more than one EC nor one
that supports the protocol version 3 though, so testing on those systems
will be highly appreciated.

The series is composed of the following patches:

Gwendal Grignou (2):
  mfd: cros ec: Remove parent field
  mfd: cros-ec: Support multiple EC in a system

Javier Martinez Canillas (2):
  platform/chrome: cros_ec_lpc - Use existing function to check EC
    result
  mfd: cros_ec: Use a zero-length array for command data

Stephen Barber (3):
  mfd: cros_ec: rev cros_ec_commands.h
  mfd: cros_ec: add proto v3 skeleton
  mfd: cros_ec: add bus-specific proto v3 code

Todd Broch (1):
  mfd: cros_ec: Instantiate sub-devices from device tree

 drivers/i2c/busses/i2c-cros-ec-tunnel.c    |  44 ++--
 drivers/input/keyboard/cros_ec_keyb.c      |  27 +-
 drivers/mfd/cros_ec.c                      | 386 ++++++++++++++++++++++++----
 drivers/mfd/cros_ec_i2c.c                  | 169 ++++++++++++-
 drivers/mfd/cros_ec_spi.c                  | 390 ++++++++++++++++++++++++-----
 drivers/platform/chrome/cros_ec_dev.c      |  53 ++--
 drivers/platform/chrome/cros_ec_lightbar.c | 165 +++++++-----
 drivers/platform/chrome/cros_ec_lpc.c      |  98 ++++++--
 drivers/platform/chrome/cros_ec_sysfs.c    | 149 ++++++-----
 include/linux/mfd/cros_ec.h                |  36 ++-
 include/linux/mfd/cros_ec_commands.h       | 277 ++++++++++++++++++--
 11 files changed, 1477 insertions(+), 317 deletions(-)

Patches #1 and #2 are just small cleanups.

Patch #3 allows the driver to instantiate sub-devices defined in DT instead
of using a fixed list of mfd cells.

Patch #4 modifies the struct cros_ec_command to use a zero-length array for
the buffer used for EC input and output data.

Patch #5 adds support to make multiple EC have a different device id and
also exposing a per EC character device interface.

Patch #6 synchronises the cros_ec_commands.h with a newer version of the
file in the EC firmware repository.

Patch #7 adds the EC host command protocol v3 support to the cros_ec driver
and patch #8 adds the bus specific proto v3 support for I2C, SPI and LPC.

Best regards,
Javier

[0]: https://lkml.org/lkml/2015/2/2/214
[1]: https://lkml.org/lkml/2015/3/12/621
[2]: http://cgit.collabora.com/git/user/javier/ec.git/log/?h=mainline-ioctl-zero-length

[RESEND PATCH 1/8] mfd: cros ec: Remove parent field

[Javier Martinez Canillas]

From: Gwendal Grignou <gwendal@chromium.org>

parent and dev were pointing to the same device structure.
parent is unused, removed.

Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Puthikorn Voravootivat <puthik@chromium.org>
Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
---
 drivers/mfd/cros_ec_i2c.c             | 1 -
 drivers/mfd/cros_ec_spi.c             | 1 -
 drivers/platform/chrome/cros_ec_lpc.c | 1 -
 include/linux/mfd/cros_ec.h           | 2 --
 4 files changed, 5 deletions(-)

diff --git a/drivers/mfd/cros_ec_i2c.c b/drivers/mfd/cros_ec_i2c.c
index c0c30f4f946f..82b4d6148698 100644
--- a/drivers/mfd/cros_ec_i2c.c
+++ b/drivers/mfd/cros_ec_i2c.c
@@ -145,7 +145,6 @@ static int cros_ec_i2c_probe(struct i2c_client *client,
 	ec_dev->cmd_xfer = cros_ec_cmd_xfer_i2c;
 	ec_dev->ec_name = client->name;
 	ec_dev->phys_name = client->adapter->name;
-	ec_dev->parent = &client->dev;
 
 	err = cros_ec_register(ec_dev);
 	if (err) {
diff --git a/drivers/mfd/cros_ec_spi.c b/drivers/mfd/cros_ec_spi.c
index bf6e08e8013e..27bd52e5e8b7 100644
--- a/drivers/mfd/cros_ec_spi.c
+++ b/drivers/mfd/cros_ec_spi.c
@@ -363,7 +363,6 @@ static int cros_ec_spi_probe(struct spi_device *spi)
 	ec_dev->cmd_xfer = cros_ec_cmd_xfer_spi;
 	ec_dev->ec_name = ec_spi->spi->modalias;
 	ec_dev->phys_name = dev_name(&ec_spi->spi->dev);
-	ec_dev->parent = &ec_spi->spi->dev;
 	ec_dev->din_size = EC_MSG_BYTES + EC_MSG_PREAMBLE_COUNT;
 	ec_dev->dout_size = EC_MSG_BYTES;
 
diff --git a/drivers/platform/chrome/cros_ec_lpc.c b/drivers/platform/chrome/cros_ec_lpc.c
index 8f9ac4d7bbd0..860310513cf0 100644
--- a/drivers/platform/chrome/cros_ec_lpc.c
+++ b/drivers/platform/chrome/cros_ec_lpc.c
@@ -214,7 +214,6 @@ static int cros_ec_lpc_probe(struct platform_device *pdev)
 	ec_dev->dev = dev;
 	ec_dev->ec_name = pdev->name;
 	ec_dev->phys_name = dev_name(dev);
-	ec_dev->parent = dev;
 	ec_dev->cmd_xfer = cros_ec_cmd_xfer_lpc;
 	ec_dev->cmd_readmem = cros_ec_lpc_readmem;
 
diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
index 324a34683971..14cf522123dd 100644
--- a/include/linux/mfd/cros_ec.h
+++ b/include/linux/mfd/cros_ec.h
@@ -85,7 +85,6 @@ struct cros_ec_command {
  * to using dword.
  * @din_size: size of din buffer to allocate (zero to use static din)
  * @dout_size: size of dout buffer to allocate (zero to use static dout)
- * @parent: pointer to parent device (e.g. i2c or spi device)
  * @wake_enabled: true if this device can wake the system from sleep
  * @cmd_xfer: send command to EC and get response
  *     Returns the number of bytes received if the communication succeeded, but
@@ -113,7 +112,6 @@ struct cros_ec_device {
 	uint8_t *dout;
 	int din_size;
 	int dout_size;
-	struct device *parent;
 	bool wake_enabled;
 	int (*cmd_xfer)(struct cros_ec_device *ec,
 			struct cros_ec_command *msg);
-- 
2.1.4

[RESEND PATCH 2/8] platform/chrome: cros_ec_lpc - Use existing function to check EC result

[Javier Martinez Canillas]

Commit 6db07b633658 ("mfd: cros_ec: Check result code from EC messages")
added a common cros_ec_check_result() function that can be used to check
the ec_msg->result for errors and warns about them.

Use the existing function instead of duplicating same check in the driver.

Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
---
 drivers/platform/chrome/cros_ec_lpc.c | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/drivers/platform/chrome/cros_ec_lpc.c b/drivers/platform/chrome/cros_ec_lpc.c
index 860310513cf0..3a675817c95d 100644
--- a/drivers/platform/chrome/cros_ec_lpc.c
+++ b/drivers/platform/chrome/cros_ec_lpc.c
@@ -95,19 +95,9 @@ static int cros_ec_cmd_xfer_lpc(struct cros_ec_device *ec,
 
 	/* Check result */
 	msg->result = inb(EC_LPC_ADDR_HOST_DATA);
-
-	switch (msg->result) {
-	case EC_RES_SUCCESS:
-		break;
-	case EC_RES_IN_PROGRESS:
-		ret = -EAGAIN;
-		dev_dbg(ec->dev, "command 0x%02x in progress\n",
-			msg->command);
+	ret = cros_ec_check_result(ec, msg);
+	if (ret)
 		goto done;
-	default:
-		dev_dbg(ec->dev, "command 0x%02x returned %d\n",
-			msg->command, msg->result);
-	}
 
 	/* Read back args */
 	args.flags = inb(EC_LPC_ADDR_HOST_ARGS);
-- 
2.1.4

[RESEND PATCH 3/8] mfd: cros_ec: Instantiate sub-devices from device tree

[Javier Martinez Canillas]

From: Todd Broch <tbroch@chromium.org>

If the EC device tree node has sub-nodes, try to instantiate them as
MFD sub-devices.  We can configure the EC features provided by the board.

Signed-off-by: Todd Broch <tbroch@chromium.org>
Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
---
 drivers/mfd/cros_ec.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/drivers/mfd/cros_ec.c b/drivers/mfd/cros_ec.c
index c4aecc6f8373..8aa83b91e25c 100644
--- a/drivers/mfd/cros_ec.c
+++ b/drivers/mfd/cros_ec.c
@@ -17,6 +17,7 @@
  * battery charging and regulator control, firmware update.
  */
 
+#include <linux/of_platform.h>
 #include <linux/interrupt.h>
 #include <linux/slab.h>
 #include <linux/module.h>
@@ -109,18 +110,8 @@ EXPORT_SYMBOL(cros_ec_cmd_xfer);
 
 static const struct mfd_cell cros_devs[] = {
 	{
-		.name = "cros-ec-keyb",
-		.id = 1,
-		.of_compatible = "google,cros-ec-keyb",
-	},
-	{
-		.name = "cros-ec-i2c-tunnel",
-		.id = 2,
-		.of_compatible = "google,cros-ec-i2c-tunnel",
-	},
-	{
 		.name = "cros-ec-ctl",
-		.id = 3,
+		.id = 1,
 	},
 };
 
@@ -150,6 +141,15 @@ int cros_ec_register(struct cros_ec_device *ec_dev)
 		return err;
 	}
 
+#ifdef CONFIG_OF
+	err = of_platform_populate(dev->of_node, NULL, NULL, dev);
+	if (err) {
+		mfd_remove_devices(dev);
+		dev_err(dev, "Failed to register sub-devices\n");
+		return err;
+	}
+#endif
+
 	dev_info(dev, "Chrome EC device registered\n");
 
 	return 0;
-- 
2.1.4

[RESEND PATCH 4/8] mfd: cros_ec: Use a zero-length array for command data

[Javier Martinez Canillas]

Commit 1b84f2a4cd4a ("mfd: cros_ec: Use fixed size arrays to transfer
data with the EC") modified the struct cros_ec_command fields to not
use pointers for the input and output buffers and use fixed length
arrays instead.

This change was made because the cros_ec ioctl API uses that struct
cros_ec_command to allow user-space to send commands to the EC and
to get data from the EC. So using pointers made the API not 64-bit
safe. Unfortunately this approach was not flexible enough for all
the use-cases since there may be a need to send larger commands
on newer versions of the EC command protocol.

So to avoid to choose a constant length that it may be too big for
most commands and thus wasting memory and CPU cycles on copy from
and to user-space or having a size that is too small for some big
commands, use a zero-length array that is both 64-bit safe and
flexible. The same buffer is used for both output and input data
so the maximum of these values should be used to allocate it.

Suggested-by: Gwendal Grignou <gwendal@chromium.org>
Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
---
 drivers/i2c/busses/i2c-cros-ec-tunnel.c    |  44 ++++++---
 drivers/input/keyboard/cros_ec_keyb.c      |  27 ++++--
 drivers/mfd/cros_ec.c                      |  26 +++--
 drivers/mfd/cros_ec_i2c.c                  |   4 +-
 drivers/mfd/cros_ec_spi.c                  |   2 +-
 drivers/platform/chrome/cros_ec_dev.c      |  49 ++++++----
 drivers/platform/chrome/cros_ec_lightbar.c | 151 +++++++++++++++++++----------
 drivers/platform/chrome/cros_ec_lpc.c      |   8 +-
 drivers/platform/chrome/cros_ec_sysfs.c    | 149 +++++++++++++++++-----------
 include/linux/mfd/cros_ec.h                |   6 +-
 10 files changed, 297 insertions(+), 169 deletions(-)

diff --git a/drivers/i2c/busses/i2c-cros-ec-tunnel.c b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
index fa8dedd8c3a2..4139ede8e6ed 100644
--- a/drivers/i2c/busses/i2c-cros-ec-tunnel.c
+++ b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
@@ -183,7 +183,7 @@ static int ec_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg i2c_msgs[],
 	int request_len;
 	int response_len;
 	int result;
-	struct cros_ec_command msg = { };
+	struct cros_ec_command *msg;
 
 	request_len = ec_i2c_count_message(i2c_msgs, num);
 	if (request_len < 0) {
@@ -198,25 +198,39 @@ static int ec_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg i2c_msgs[],
 		return response_len;
 	}
 
-	result = ec_i2c_construct_message(msg.outdata, i2c_msgs, num, bus_num);
-	if (result)
-		return result;
+	msg = kzalloc(sizeof(*msg) + max(request_len, response_len),
+		      GFP_KERNEL);
+	if (!msg)
+		return -ENOMEM;
 
-	msg.version = 0;
-	msg.command = EC_CMD_I2C_PASSTHRU;
-	msg.outsize = request_len;
-	msg.insize = response_len;
+	result = ec_i2c_construct_message(msg->data, i2c_msgs, num, bus_num);
+	if (result) {
+		dev_err(dev, "Error constructing EC i2c message %d\n", result);
+		goto exit;
+	}
 
-	result = cros_ec_cmd_xfer(bus->ec, &msg);
-	if (result < 0)
-		return result;
+	msg->version = 0;
+	msg->command = EC_CMD_I2C_PASSTHRU;
+	msg->outsize = request_len;
+	msg->insize = response_len;
 
-	result = ec_i2c_parse_response(msg.indata, i2c_msgs, &num);
-	if (result < 0)
-		return result;
+	result = cros_ec_cmd_xfer(bus->ec, msg);
+	if (result < 0) {
+		dev_err(dev, "Error transferring EC i2c message %d\n", result);
+		goto exit;
+	}
+
+	result = ec_i2c_parse_response(msg->data, i2c_msgs, &num);
+	if (result < 0) {
+		dev_err(dev, "Error parsing EC i2c message %d\n", result);
+		goto exit;
+	}
 
 	/* Indicate success by saying how many messages were sent */
-	return num;
+	result = num;
+exit:
+	kfree(msg);
+	return result;
 }
 
 static u32 ec_i2c_functionality(struct i2c_adapter *adap)
diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c
index 769f8f7f62b7..df12cf15b306 100644
--- a/drivers/input/keyboard/cros_ec_keyb.c
+++ b/drivers/input/keyboard/cros_ec_keyb.c
@@ -148,19 +148,26 @@ static void cros_ec_keyb_process(struct cros_ec_keyb *ckdev,
 
 static int cros_ec_keyb_get_state(struct cros_ec_keyb *ckdev, uint8_t *kb_state)
 {
-	int ret;
-	struct cros_ec_command msg = {
-		.command = EC_CMD_MKBP_STATE,
-		.insize = ckdev->cols,
-	};
+	int ret = 0;
+	struct cros_ec_command *msg;
 
-	ret = cros_ec_cmd_xfer(ckdev->ec, &msg);
-	if (ret < 0)
-		return ret;
+	msg = kzalloc(sizeof(*msg) + ckdev->cols, GFP_KERNEL);
+	if (!msg)
+		return -ENOMEM;
 
-	memcpy(kb_state, msg.indata, ckdev->cols);
+	msg->command = EC_CMD_MKBP_STATE;
+	msg->insize = ckdev->cols;
 
-	return 0;
+	ret = cros_ec_cmd_xfer(ckdev->ec, msg);
+	if (ret < 0) {
+		dev_err(ckdev->dev, "Error transferring EC message %d\n", ret);
+		goto exit;
+	}
+
+	memcpy(kb_state, msg->data, ckdev->cols);
+exit:
+	kfree(msg);
+	return ret;
 }
 
 static irqreturn_t cros_ec_keyb_irq(int irq, void *data)
diff --git a/drivers/mfd/cros_ec.c b/drivers/mfd/cros_ec.c
index 8aa83b91e25c..c532dbca7404 100644
--- a/drivers/mfd/cros_ec.c
+++ b/drivers/mfd/cros_ec.c
@@ -41,7 +41,7 @@ int cros_ec_prepare_tx(struct cros_ec_device *ec_dev,
 	out[2] = msg->outsize;
 	csum = out[0] + out[1] + out[2];
 	for (i = 0; i < msg->outsize; i++)
-		csum += out[EC_MSG_TX_HEADER_BYTES + i] = msg->outdata[i];
+		csum += out[EC_MSG_TX_HEADER_BYTES + i] = msg->data[i];
 	out[EC_MSG_TX_HEADER_BYTES + msg->outsize] = (uint8_t)(csum & 0xff);
 
 	return EC_MSG_TX_PROTO_BYTES + msg->outsize;
@@ -75,11 +75,18 @@ int cros_ec_cmd_xfer(struct cros_ec_device *ec_dev,
 	ret = ec_dev->cmd_xfer(ec_dev, msg);
 	if (msg->result == EC_RES_IN_PROGRESS) {
 		int i;
-		struct cros_ec_command status_msg = { };
+		struct cros_ec_command *status_msg;
 		struct ec_response_get_comms_status *status;
 
-		status_msg.command = EC_CMD_GET_COMMS_STATUS;
-		status_msg.insize = sizeof(*status);
+		status_msg = kzalloc(sizeof(*status_msg) + sizeof(*status),
+				     GFP_KERNEL);
+		if (!status_msg) {
+			ret = -ENOMEM;
+			goto exit;
+		}
+
+		status_msg->command = EC_CMD_GET_COMMS_STATUS;
+		status_msg->insize = sizeof(*status);
 
 		/*
 		 * Query the EC's status until it's no longer busy or
@@ -88,20 +95,23 @@ int cros_ec_cmd_xfer(struct cros_ec_device *ec_dev,
 		for (i = 0; i < EC_COMMAND_RETRIES; i++) {
 			usleep_range(10000, 11000);
 
-			ret = ec_dev->cmd_xfer(ec_dev, &status_msg);
+			ret = ec_dev->cmd_xfer(ec_dev, status_msg);
 			if (ret < 0)
 				break;
 
-			msg->result = status_msg.result;
-			if (status_msg.result != EC_RES_SUCCESS)
+			msg->result = status_msg->result;
+			if (status_msg->result != EC_RES_SUCCESS)
 				break;
 
 			status = (struct ec_response_get_comms_status *)
-				 status_msg.indata;
+				 status_msg->data;
 			if (!(status->flags & EC_COMMS_STATUS_PROCESSING))
 				break;
 		}
+
+		kfree(status_msg);
 	}
+exit:
 	mutex_unlock(&ec_dev->lock);
 
 	return ret;
diff --git a/drivers/mfd/cros_ec_i2c.c b/drivers/mfd/cros_ec_i2c.c
index 82b4d6148698..fbf7819f5de5 100644
--- a/drivers/mfd/cros_ec_i2c.c
+++ b/drivers/mfd/cros_ec_i2c.c
@@ -76,7 +76,7 @@ static int cros_ec_cmd_xfer_i2c(struct cros_ec_device *ec_dev,
 	/* copy message payload and compute checksum */
 	sum = out_buf[0] + out_buf[1] + out_buf[2];
 	for (i = 0; i < msg->outsize; i++) {
-		out_buf[3 + i] = msg->outdata[i];
+		out_buf[3 + i] = msg->data[i];
 		sum += out_buf[3 + i];
 	}
 	out_buf[3 + msg->outsize] = sum;
@@ -109,7 +109,7 @@ static int cros_ec_cmd_xfer_i2c(struct cros_ec_device *ec_dev,
 	/* copy response packet payload and compute checksum */
 	sum = in_buf[0] + in_buf[1];
 	for (i = 0; i < len; i++) {
-		msg->indata[i] = in_buf[2 + i];
+		msg->data[i] = in_buf[2 + i];
 		sum += in_buf[2 + i];
 	}
 	dev_dbg(ec_dev->dev, "packet: %*ph, sum = %02x\n",
diff --git a/drivers/mfd/cros_ec_spi.c b/drivers/mfd/cros_ec_spi.c
index 27bd52e5e8b7..573730fec947 100644
--- a/drivers/mfd/cros_ec_spi.c
+++ b/drivers/mfd/cros_ec_spi.c
@@ -299,7 +299,7 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
 	for (i = 0; i < len; i++) {
 		sum += ptr[i + 2];
 		if (ec_msg->insize)
-			ec_msg->indata[i] = ptr[i + 2];
+			ec_msg->data[i] = ptr[i + 2];
 	}
 	sum &= 0xff;
 
diff --git a/drivers/platform/chrome/cros_ec_dev.c b/drivers/platform/chrome/cros_ec_dev.c
index 6090d0b2826f..e7e50f18097f 100644
--- a/drivers/platform/chrome/cros_ec_dev.c
+++ b/drivers/platform/chrome/cros_ec_dev.c
@@ -20,6 +20,7 @@
 #include <linux/fs.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
+#include <linux/slab.h>
 #include <linux/uaccess.h>
 
 #include "cros_ec_dev.h"
@@ -36,28 +37,30 @@ static int ec_get_version(struct cros_ec_device *ec, char *str, int maxlen)
 	static const char * const current_image_name[] = {
 		"unknown", "read-only", "read-write", "invalid",
 	};
-	struct cros_ec_command msg = {
-		.version = 0,
-		.command = EC_CMD_GET_VERSION,
-		.outdata = { 0 },
-		.outsize = 0,
-		.indata = { 0 },
-		.insize = sizeof(*resp),
-	};
+	struct cros_ec_command *msg;
 	int ret;
 
-	ret = cros_ec_cmd_xfer(ec, &msg);
+	msg = kzalloc(sizeof(*msg) + sizeof(*resp), GFP_KERNEL);
+	if (!msg)
+		return -ENOMEM;
+
+	msg->version = 0;
+	msg->command = EC_CMD_GET_VERSION;
+	msg->insize = sizeof(*resp);
+
+	ret = cros_ec_cmd_xfer(ec, msg);
 	if (ret < 0)
-		return ret;
+		goto exit;
 
-	if (msg.result != EC_RES_SUCCESS) {
+	if (msg->result != EC_RES_SUCCESS) {
 		snprintf(str, maxlen,
 			 "%s\nUnknown EC version: EC returned %d\n",
-			 CROS_EC_DEV_VERSION, msg.result);
-		return 0;
+			 CROS_EC_DEV_VERSION, msg->result);
+		ret = -EINVAL;
+		goto exit;
 	}
 
-	resp = (struct ec_response_get_version *)msg.indata;
+	resp = (struct ec_response_get_version *)msg->data;
 	if (resp->current_image >= ARRAY_SIZE(current_image_name))
 		resp->current_image = 3; /* invalid */
 
@@ -65,6 +68,8 @@ static int ec_get_version(struct cros_ec_device *ec, char *str, int maxlen)
 		 resp->version_string_ro, resp->version_string_rw,
 		 current_image_name[resp->current_image]);
 
+exit:
+	kfree(msg);
 	return 0;
 }
 
@@ -110,17 +115,25 @@ static ssize_t ec_device_read(struct file *filp, char __user *buffer,
 static long ec_device_ioctl_xcmd(struct cros_ec_device *ec, void __user *arg)
 {
 	long ret;
-	struct cros_ec_command s_cmd = { };
+	int len;
+	struct cros_ec_command *u_cmd = arg;
+	struct cros_ec_command *s_cmd;
+
+	len = max(u_cmd->outsize, u_cmd->insize);
+
+	s_cmd = kzalloc(sizeof(*s_cmd) + len, GFP_KERNEL);
+	if (!s_cmd)
+		return -ENOMEM;
 
-	if (copy_from_user(&s_cmd, arg, sizeof(s_cmd)))
+	if (copy_from_user(s_cmd, arg, sizeof(*s_cmd) + len))
 		return -EFAULT;
 
-	ret = cros_ec_cmd_xfer(ec, &s_cmd);
+	ret = cros_ec_cmd_xfer(ec, s_cmd);
 	/* Only copy data to userland if data was received. */
 	if (ret < 0)
 		return ret;
 
-	if (copy_to_user(arg, &s_cmd, sizeof(s_cmd)))
+	if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + len))
 		return -EFAULT;
 
 	return 0;
diff --git a/drivers/platform/chrome/cros_ec_lightbar.c b/drivers/platform/chrome/cros_ec_lightbar.c
index b4ff47a9069a..8ffec6649ead 100644
--- a/drivers/platform/chrome/cros_ec_lightbar.c
+++ b/drivers/platform/chrome/cros_ec_lightbar.c
@@ -31,6 +31,7 @@
 #include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/uaccess.h>
+#include <linux/slab.h>
 
 #include "cros_ec_dev.h"
 
@@ -91,54 +92,78 @@ out:
 	return ret;
 }
 
-#define INIT_MSG(P, R) { \
-		.command = EC_CMD_LIGHTBAR_CMD, \
-		.outsize = sizeof(*P), \
-		.insize = sizeof(*R), \
-	}
+static struct cros_ec_command *alloc_command_msg(void)
+{
+	struct cros_ec_command *msg;
+	int len;
+
+	len = max(sizeof(struct ec_params_lightbar),
+		  sizeof(struct ec_response_lightbar));
+
+	msg = kzalloc(sizeof(*msg) + len, GFP_KERNEL);
+	if (!msg)
+		return NULL;
+
+	msg->command = EC_CMD_LIGHTBAR_CMD;
+	msg->outsize = sizeof(struct ec_params_lightbar);
+	msg->insize = sizeof(struct ec_response_lightbar);
+
+	return msg;
+}
 
 static int get_lightbar_version(struct cros_ec_device *ec,
 				uint32_t *ver_ptr, uint32_t *flg_ptr)
 {
 	struct ec_params_lightbar *param;
 	struct ec_response_lightbar *resp;
-	struct cros_ec_command msg = INIT_MSG(param, resp);
+	struct cros_ec_command *msg;
 	int ret;
 
-	param = (struct ec_params_lightbar *)msg.outdata;
-	param->cmd = LIGHTBAR_CMD_VERSION;
-	ret = cros_ec_cmd_xfer(ec, &msg);
-	if (ret < 0)
+	msg = alloc_command_msg();
+	if (!msg)
 		return 0;
 
-	switch (msg.result) {
+	param = (struct ec_params_lightbar *)msg->data;
+	param->cmd = LIGHTBAR_CMD_VERSION;
+	ret = cros_ec_cmd_xfer(ec, msg);
+	if (ret < 0) {
+		ret = 0;
+		goto exit;
+	}
+
+	switch (msg->result) {
 	case EC_RES_INVALID_PARAM:
 		/* Pixel had no version command. */
 		if (ver_ptr)
 			*ver_ptr = 0;
 		if (flg_ptr)
 			*flg_ptr = 0;
-		return 1;
+		ret = 1;
+		goto exit;
 
 	case EC_RES_SUCCESS:
-		resp = (struct ec_response_lightbar *)msg.indata;
+		resp = (struct ec_response_lightbar *)msg->data;
 
 		/* Future devices w/lightbars should implement this command */
 		if (ver_ptr)
 			*ver_ptr = resp->version.num;
 		if (flg_ptr)
 			*flg_ptr = resp->version.flags;
-		return 1;
+		ret = 1;
+		goto exit;
 	}
 
 	/* Anything else (ie, EC_RES_INVALID_COMMAND) - no lightbar */
-	return 0;
+	ret = 0;
+exit:
+	kfree(msg);
+	return ret;
 }
 
 static ssize_t version_show(struct device *dev,
 			    struct device_attribute *attr, char *buf)
 {
-	uint32_t version, flags;
+	uint32_t version = 0, flags = 0;
 	struct cros_ec_device *ec = dev_get_drvdata(dev);
 	int ret;
 
@@ -158,8 +183,7 @@ static ssize_t brightness_store(struct device *dev,
 				const char *buf, size_t count)
 {
 	struct ec_params_lightbar *param;
-	struct ec_response_lightbar *resp;
-	struct cros_ec_command msg = INIT_MSG(param, resp);
+	struct cros_ec_command *msg;
 	int ret;
 	unsigned int val;
 	struct cros_ec_device *ec = dev_get_drvdata(dev);
@@ -167,21 +191,30 @@ static ssize_t brightness_store(struct device *dev,
 	if (kstrtouint(buf, 0, &val))
 		return -EINVAL;
 
-	param = (struct ec_params_lightbar *)msg.outdata;
+	msg = alloc_command_msg();
+	if (!msg)
+		return -ENOMEM;
+
+	param = (struct ec_params_lightbar *)msg->data;
 	param->cmd = LIGHTBAR_CMD_BRIGHTNESS;
 	param->brightness.num = val;
 	ret = lb_throttle();
 	if (ret)
-		return ret;
+		goto exit;
 
-	ret = cros_ec_cmd_xfer(ec, &msg);
+	ret = cros_ec_cmd_xfer(ec, msg);
 	if (ret < 0)
-		return ret;
+		goto exit;
 
-	if (msg.result != EC_RES_SUCCESS)
-		return -EINVAL;
+	if (msg->result != EC_RES_SUCCESS) {
+		ret = -EINVAL;
+		goto exit;
+	}
 
-	return count;
+	ret = count;
+exit:
+	kfree(msg);
+	return ret;
 }
 
 
@@ -196,12 +229,15 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
 			     const char *buf, size_t count)
 {
 	struct ec_params_lightbar *param;
-	struct ec_response_lightbar *resp;
-	struct cros_ec_command msg = INIT_MSG(param, resp);
+	struct cros_ec_command *msg;
 	struct cros_ec_device *ec = dev_get_drvdata(dev);
 	unsigned int val[4];
 	int ret, i = 0, j = 0, ok = 0;
 
+	msg = alloc_command_msg();
+	if (!msg)
+		return -ENOMEM;
+
 	do {
 		/* Skip any whitespace */
 		while (*buf && isspace(*buf))
@@ -215,7 +251,7 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
 			return -EINVAL;
 
 		if (i == 4) {
-			param = (struct ec_params_lightbar *)msg.outdata;
+			param = (struct ec_params_lightbar *)msg->data;
 			param->cmd = LIGHTBAR_CMD_RGB;
 			param->rgb.led = val[0];
 			param->rgb.red = val[1];
@@ -231,12 +267,14 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
 					return ret;
 			}
 
-			ret = cros_ec_cmd_xfer(ec, &msg);
+			ret = cros_ec_cmd_xfer(ec, msg);
 			if (ret < 0)
-				return ret;
+				goto exit;
 
-			if (msg.result != EC_RES_SUCCESS)
-				return -EINVAL;
+			if (msg->result != EC_RES_SUCCESS) {
+				ret = -EINVAL;
+				goto exit;
+			}
 
 			i = 0;
 			ok = 1;
@@ -248,6 +286,8 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
 
 	} while (*buf);
 
+exit:
+	kfree(msg);
 	return (ok && i == 0) ? count : -EINVAL;
 }
 
@@ -261,42 +301,55 @@ static ssize_t sequence_show(struct device *dev,
 {
 	struct ec_params_lightbar *param;
 	struct ec_response_lightbar *resp;
-	struct cros_ec_command msg = INIT_MSG(param, resp);
+	struct cros_ec_command *msg;
 	int ret;
 	struct cros_ec_device *ec = dev_get_drvdata(dev);
 
-	param = (struct ec_params_lightbar *)msg.outdata;
+	msg = alloc_command_msg();
+	if (!msg)
+		return -ENOMEM;
+
+	param = (struct ec_params_lightbar *)msg->data;
 	param->cmd = LIGHTBAR_CMD_GET_SEQ;
 	ret = lb_throttle();
 	if (ret)
-		return ret;
+		goto exit;
 
-	ret = cros_ec_cmd_xfer(ec, &msg);
+	ret = cros_ec_cmd_xfer(ec, msg);
 	if (ret < 0)
-		return ret;
+		goto exit;
 
-	if (msg.result != EC_RES_SUCCESS)
-		return scnprintf(buf, PAGE_SIZE,
-				 "ERROR: EC returned %d\n", msg.result);
+	if (msg->result != EC_RES_SUCCESS) {
+		ret = scnprintf(buf, PAGE_SIZE,
+				"ERROR: EC returned %d\n", msg->result);
+		goto exit;
+	}
 
-	resp = (struct ec_response_lightbar *)msg.indata;
+	resp = (struct ec_response_lightbar *)msg->data;
 	if (resp->get_seq.num >= ARRAY_SIZE(seqname))
-		return scnprintf(buf, PAGE_SIZE, "%d\n", resp->get_seq.num);
+		ret = scnprintf(buf, PAGE_SIZE, "%d\n", resp->get_seq.num);
 	else
-		return scnprintf(buf, PAGE_SIZE, "%s\n",
-				 seqname[resp->get_seq.num]);
+		ret = scnprintf(buf, PAGE_SIZE, "%s\n",
+				seqname[resp->get_seq.num]);
+
+exit:
+	kfree(msg);
+	return ret;
 }
 
 static ssize_t sequence_store(struct device *dev, struct device_attribute *attr,
 			      const char *buf, size_t count)
 {
 	struct ec_params_lightbar *param;
-	struct ec_response_lightbar *resp;
-	struct cros_ec_command msg = INIT_MSG(param, resp);
+	struct cros_ec_command *msg;
 	unsigned int num;
 	int ret, len;
 	struct cros_ec_device *ec = dev_get_drvdata(dev);
 
+	msg = alloc_command_msg();
+	if (!msg)
+		return -ENOMEM;
+
 	for (len = 0; len < count; len++)
 		if (!isalnum(buf[len]))
 			break;
@@ -311,18 +364,18 @@ static ssize_t sequence_store(struct device *dev, struct device_attribute *attr,
 			return ret;
 	}
 
-	param = (struct ec_params_lightbar *)msg.outdata;
+	param = (struct ec_params_lightbar *)msg->data;
 	param->cmd = LIGHTBAR_CMD_SEQ;
 	param->seq.num = num;
 	ret = lb_throttle();
 	if (ret)
 		return ret;
 
-	ret = cros_ec_cmd_xfer(ec, &msg);
+	ret = cros_ec_cmd_xfer(ec, msg);
 	if (ret < 0)
 		return ret;
 
-	if (msg.result != EC_RES_SUCCESS)
+	if (msg->result != EC_RES_SUCCESS)
 		return -EINVAL;
 
 	return count;
diff --git a/drivers/platform/chrome/cros_ec_lpc.c b/drivers/platform/chrome/cros_ec_lpc.c
index 3a675817c95d..32b1df29fc58 100644
--- a/drivers/platform/chrome/cros_ec_lpc.c
+++ b/drivers/platform/chrome/cros_ec_lpc.c
@@ -73,8 +73,8 @@ static int cros_ec_cmd_xfer_lpc(struct cros_ec_device *ec,
 
 	/* Copy data and update checksum */
 	for (i = 0; i < msg->outsize; i++) {
-		outb(msg->outdata[i], EC_LPC_ADDR_HOST_PARAM + i);
-		csum += msg->outdata[i];
+		outb(msg->data[i], EC_LPC_ADDR_HOST_PARAM + i);
+		csum += msg->data[i];
 	}
 
 	/* Finalize checksum and write args */
@@ -119,8 +119,8 @@ static int cros_ec_cmd_xfer_lpc(struct cros_ec_device *ec,
 
 	/* Read response and update checksum */
 	for (i = 0; i < args.data_size; i++) {
-		msg->indata[i] = inb(EC_LPC_ADDR_HOST_PARAM + i);
-		csum += msg->indata[i];
+		msg->data[i] = inb(EC_LPC_ADDR_HOST_PARAM + i);
+		csum += msg->data[i];
 	}
 
 	/* Verify checksum */
diff --git a/drivers/platform/chrome/cros_ec_sysfs.c b/drivers/platform/chrome/cros_ec_sysfs.c
index fb62ab6cc659..6f309f2b4efb 100644
--- a/drivers/platform/chrome/cros_ec_sysfs.c
+++ b/drivers/platform/chrome/cros_ec_sysfs.c
@@ -29,6 +29,7 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/printk.h>
+#include <linux/slab.h>
 #include <linux/stat.h>
 #include <linux/types.h>
 #include <linux/uaccess.h>
@@ -66,14 +67,19 @@ static ssize_t store_ec_reboot(struct device *dev,
 		{"hibernate",    EC_REBOOT_HIBERNATE, 0},
 		{"at-shutdown",  -1, EC_REBOOT_FLAG_ON_AP_SHUTDOWN},
 	};
-	struct cros_ec_command msg = { 0 };
-	struct ec_params_reboot_ec *param =
-		(struct ec_params_reboot_ec *)msg.outdata;
+	struct cros_ec_command *msg;
+	struct ec_params_reboot_ec *param;
 	int got_cmd = 0, offset = 0;
 	int i;
 	int ret;
 	struct cros_ec_device *ec = dev_get_drvdata(dev);
 
+	msg = kzalloc(sizeof(*msg) + sizeof(*param), GFP_KERNEL);
+	if (!msg)
+		return -ENOMEM;
+
+	param = (struct ec_params_reboot_ec *)msg->data;
+
 	param->flags = 0;
 	while (1) {
 		/* Find word to start scanning */
@@ -100,19 +106,25 @@ static ssize_t store_ec_reboot(struct device *dev,
 			offset++;
 	}
 
-	if (!got_cmd)
-		return -EINVAL;
+	if (!got_cmd) {
+		count = -EINVAL;
+		goto exit;
+	}
 
-	msg.command = EC_CMD_REBOOT_EC;
-	msg.outsize = sizeof(param);
-	ret = cros_ec_cmd_xfer(ec, &msg);
-	if (ret < 0)
-		return ret;
-	if (msg.result != EC_RES_SUCCESS) {
-		dev_dbg(ec->dev, "EC result %d\n", msg.result);
-		return -EINVAL;
+	msg->command = EC_CMD_REBOOT_EC;
+	msg->outsize = sizeof(*param);
+	ret = cros_ec_cmd_xfer(ec, msg);
+	if (ret < 0) {
+		count = ret;
+		goto exit;
+	}
+	if (msg->result != EC_RES_SUCCESS) {
+		dev_err(ec->dev, "EC result %d\n", msg->result);
+		count = -EINVAL;
 	}
 
+exit:
+	kfree(msg);
 	return count;
 }
 
@@ -123,22 +135,30 @@ static ssize_t show_ec_version(struct device *dev,
 	struct ec_response_get_version *r_ver;
 	struct ec_response_get_chip_info *r_chip;
 	struct ec_response_board_version *r_board;
-	struct cros_ec_command msg = { 0 };
+	struct cros_ec_command *msg;
 	int ret;
 	int count = 0;
 	struct cros_ec_device *ec = dev_get_drvdata(dev);
 
+	msg = kzalloc(sizeof(*msg) + EC_HOST_PARAM_SIZE, GFP_KERNEL);
+	if (!msg)
+		return -ENOMEM;
+
 	/* Get versions. RW may change. */
-	msg.command = EC_CMD_GET_VERSION;
-	msg.insize = sizeof(*r_ver);
-	ret = cros_ec_cmd_xfer(ec, &msg);
-	if (ret < 0)
-		return ret;
-	if (msg.result != EC_RES_SUCCESS)
-		return scnprintf(buf, PAGE_SIZE,
-				 "ERROR: EC returned %d\n", msg.result);
+	msg->command = EC_CMD_GET_VERSION;
+	msg->insize = sizeof(*r_ver);
+	ret = cros_ec_cmd_xfer(ec, msg);
+	if (ret < 0) {
+		count = ret;
+		goto exit;
+	}
+	if (msg->result != EC_RES_SUCCESS) {
+		count = scnprintf(buf, PAGE_SIZE,
+				 "ERROR: EC returned %d\n", msg->result);
+		goto exit;
+	}
 
-	r_ver = (struct ec_response_get_version *)msg.indata;
+	r_ver = (struct ec_response_get_version *)msg->data;
 	/* Strings should be null-terminated, but let's be sure. */
 	r_ver->version_string_ro[sizeof(r_ver->version_string_ro) - 1] = '\0';
 	r_ver->version_string_rw[sizeof(r_ver->version_string_rw) - 1] = '\0';
@@ -152,33 +172,33 @@ static ssize_t show_ec_version(struct device *dev,
 			    image_names[r_ver->current_image] : "?"));
 
 	/* Get build info. */
-	msg.command = EC_CMD_GET_BUILD_INFO;
-	msg.insize = sizeof(msg.indata);
-	ret = cros_ec_cmd_xfer(ec, &msg);
+	msg->command = EC_CMD_GET_BUILD_INFO;
+	msg->insize = EC_HOST_PARAM_SIZE;
+	ret = cros_ec_cmd_xfer(ec, msg);
 	if (ret < 0)
 		count += scnprintf(buf + count, PAGE_SIZE - count,
 				   "Build info:    XFER ERROR %d\n", ret);
-	else if (msg.result != EC_RES_SUCCESS)
+	else if (msg->result != EC_RES_SUCCESS)
 		count += scnprintf(buf + count, PAGE_SIZE - count,
-				   "Build info:    EC error %d\n", msg.result);
+				   "Build info:    EC error %d\n", msg->result);
 	else {
-		msg.indata[sizeof(msg.indata) - 1] = '\0';
+		msg->data[sizeof(msg->data) - 1] = '\0';
 		count += scnprintf(buf + count, PAGE_SIZE - count,
-				   "Build info:    %s\n", msg.indata);
+				   "Build info:    %s\n", msg->data);
 	}
 
 	/* Get chip info. */
-	msg.command = EC_CMD_GET_CHIP_INFO;
-	msg.insize = sizeof(*r_chip);
-	ret = cros_ec_cmd_xfer(ec, &msg);
+	msg->command = EC_CMD_GET_CHIP_INFO;
+	msg->insize = sizeof(*r_chip);
+	ret = cros_ec_cmd_xfer(ec, msg);
 	if (ret < 0)
 		count += scnprintf(buf + count, PAGE_SIZE - count,
 				   "Chip info:     XFER ERROR %d\n", ret);
-	else if (msg.result != EC_RES_SUCCESS)
+	else if (msg->result != EC_RES_SUCCESS)
 		count += scnprintf(buf + count, PAGE_SIZE - count,
-				   "Chip info:     EC error %d\n", msg.result);
+				   "Chip info:     EC error %d\n", msg->result);
 	else {
-		r_chip = (struct ec_response_get_chip_info *)msg.indata;
+		r_chip = (struct ec_response_get_chip_info *)msg->data;
 
 		r_chip->vendor[sizeof(r_chip->vendor) - 1] = '\0';
 		r_chip->name[sizeof(r_chip->name) - 1] = '\0';
@@ -192,23 +212,25 @@ static ssize_t show_ec_version(struct device *dev,
 	}
 
 	/* Get board version */
-	msg.command = EC_CMD_GET_BOARD_VERSION;
-	msg.insize = sizeof(*r_board);
-	ret = cros_ec_cmd_xfer(ec, &msg);
+	msg->command = EC_CMD_GET_BOARD_VERSION;
+	msg->insize = sizeof(*r_board);
+	ret = cros_ec_cmd_xfer(ec, msg);
 	if (ret < 0)
 		count += scnprintf(buf + count, PAGE_SIZE - count,
 				   "Board version: XFER ERROR %d\n", ret);
-	else if (msg.result != EC_RES_SUCCESS)
+	else if (msg->result != EC_RES_SUCCESS)
 		count += scnprintf(buf + count, PAGE_SIZE - count,
-				   "Board version: EC error %d\n", msg.result);
+				   "Board version: EC error %d\n", msg->result);
 	else {
-		r_board = (struct ec_response_board_version *)msg.indata;
+		r_board = (struct ec_response_board_version *)msg->data;
 
 		count += scnprintf(buf + count, PAGE_SIZE - count,
 				   "Board version: %d\n",
 				   r_board->board_version);
 	}
 
+exit:
+	kfree(msg);
 	return count;
 }
 
@@ -216,27 +238,37 @@ static ssize_t show_ec_flashinfo(struct device *dev,
 				 struct device_attribute *attr, char *buf)
 {
 	struct ec_response_flash_info *resp;
-	struct cros_ec_command msg = { 0 };
+	struct cros_ec_command *msg;
 	int ret;
 	struct cros_ec_device *ec = dev_get_drvdata(dev);
 
+	msg = kzalloc(sizeof(*msg) + sizeof(*resp), GFP_KERNEL);
+	if (!msg)
+		return -ENOMEM;
+
 	/* The flash info shouldn't ever change, but ask each time anyway. */
-	msg.command = EC_CMD_FLASH_INFO;
-	msg.insize = sizeof(*resp);
-	ret = cros_ec_cmd_xfer(ec, &msg);
+	msg->command = EC_CMD_FLASH_INFO;
+	msg->insize = sizeof(*resp);
+	ret = cros_ec_cmd_xfer(ec, msg);
 	if (ret < 0)
-		return ret;
-	if (msg.result != EC_RES_SUCCESS)
-		return scnprintf(buf, PAGE_SIZE,
-				 "ERROR: EC returned %d\n", msg.result);
-
-	resp = (struct ec_response_flash_info *)msg.indata;
-
-	return scnprintf(buf, PAGE_SIZE,
-			 "FlashSize %d\nWriteSize %d\n"
-			 "EraseSize %d\nProtectSize %d\n",
-			 resp->flash_size, resp->write_block_size,
-			 resp->erase_block_size, resp->protect_block_size);
+		goto exit;
+	if (msg->result != EC_RES_SUCCESS) {
+		ret = scnprintf(buf, PAGE_SIZE,
+				"ERROR: EC returned %d\n", msg->result);
+		goto exit;
+	}
+
+	resp = (struct ec_response_flash_info *)msg->data;
+
+	ret = scnprintf(buf, PAGE_SIZE,
+			"FlashSize %d\nWriteSize %d\n"
+			"EraseSize %d\nProtectSize %d\n",
+			resp->flash_size, resp->write_block_size,
+			resp->erase_block_size, resp->protect_block_size);
+
+exit:
+	kfree(msg);
+	return ret;
 }
 
 /* Module initialization */
@@ -269,3 +301,4 @@ void ec_dev_sysfs_remove(struct cros_ec_device *ec)
 {
 	sysfs_remove_group(&ec->vdev->kobj, &ec_attr_group);
 }
+
diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
index 14cf522123dd..7eee38abd02a 100644
--- a/include/linux/mfd/cros_ec.h
+++ b/include/linux/mfd/cros_ec.h
@@ -42,8 +42,7 @@ enum {
  * @outsize: Outgoing length in bytes
  * @insize: Max number of bytes to accept from EC
  * @result: EC's response to the command (separate from communication failure)
- * @outdata: Outgoing data to EC
- * @indata: Where to put the incoming data from EC
+ * @data: Where to put the incoming data from EC and outgoing data to EC
  */
 struct cros_ec_command {
 	uint32_t version;
@@ -51,8 +50,7 @@ struct cros_ec_command {
 	uint32_t outsize;
 	uint32_t insize;
 	uint32_t result;
-	uint8_t outdata[EC_PROTO2_MAX_PARAM_SIZE];
-	uint8_t indata[EC_PROTO2_MAX_PARAM_SIZE];
+	uint8_t data[0];
 };
 
 /**
-- 
2.1.4

[RESEND PATCH 5/8] mfd: cros-ec: Support multiple EC in a system

[Javier Martinez Canillas]

From: Gwendal Grignou <gwendal@chromium.org>

Chromebooks can have more than one Embedded Controller so the
cros_ec device id has to be incremented for each EC registered.

Add code to handle multiple EC. First ec found is cros-ec0,
second cros-ec1 and so on.

Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Reviewed-by: Dmitry Torokhov <dtor@chromium.org>
Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
---
 drivers/mfd/cros_ec.c                 | 7 ++++++-
 drivers/platform/chrome/cros_ec_dev.c | 4 ++--
 include/linux/mfd/cros_ec.h           | 2 ++
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/mfd/cros_ec.c b/drivers/mfd/cros_ec.c
index c532dbca7404..70f6e55a096e 100644
--- a/drivers/mfd/cros_ec.c
+++ b/drivers/mfd/cros_ec.c
@@ -28,6 +28,8 @@
 
 #define EC_COMMAND_RETRIES	50
 
+static int dev_id;
+
 int cros_ec_prepare_tx(struct cros_ec_device *ec_dev,
 		       struct cros_ec_command *msg)
 {
@@ -130,6 +132,8 @@ int cros_ec_register(struct cros_ec_device *ec_dev)
 	struct device *dev = ec_dev->dev;
 	int err = 0;
 
+	ec_dev->id = dev_id;
+
 	if (ec_dev->din_size) {
 		ec_dev->din = devm_kzalloc(dev, ec_dev->din_size, GFP_KERNEL);
 		if (!ec_dev->din)
@@ -143,7 +147,7 @@ int cros_ec_register(struct cros_ec_device *ec_dev)
 
 	mutex_init(&ec_dev->lock);
 
-	err = mfd_add_devices(dev, 0, cros_devs,
+	err = mfd_add_devices(dev, ec_dev->id, cros_devs,
 			      ARRAY_SIZE(cros_devs),
 			      NULL, ec_dev->irq, NULL);
 	if (err) {
@@ -159,6 +163,7 @@ int cros_ec_register(struct cros_ec_device *ec_dev)
 		return err;
 	}
 #endif
+	dev_id += ARRAY_SIZE(cros_devs);
 
 	dev_info(dev, "Chrome EC device registered\n");
 
diff --git a/drivers/platform/chrome/cros_ec_dev.c b/drivers/platform/chrome/cros_ec_dev.c
index e7e50f18097f..7173f0ea6ae5 100644
--- a/drivers/platform/chrome/cros_ec_dev.c
+++ b/drivers/platform/chrome/cros_ec_dev.c
@@ -191,7 +191,7 @@ static int ec_device_probe(struct platform_device *pdev)
 {
 	struct cros_ec_device *ec = dev_get_drvdata(pdev->dev.parent);
 	int retval = -ENOTTY;
-	dev_t devno = MKDEV(ec_major, 0);
+	dev_t devno = MKDEV(ec_major, ec->id);
 
 	/* Instantiate it (and remember the EC) */
 	cdev_init(&ec->cdev, &fops);
@@ -203,7 +203,7 @@ static int ec_device_probe(struct platform_device *pdev)
 	}
 
 	ec->vdev = device_create(cros_class, NULL, devno, ec,
-				 CROS_EC_DEV_NAME);
+				 CROS_EC_DEV_NAME "%d", ec->id);
 	if (IS_ERR(ec->vdev)) {
 		retval = PTR_ERR(ec->vdev);
 		dev_err(&pdev->dev, ": failed to create device\n");
diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
index 7eee38abd02a..2bee6ac74ffb 100644
--- a/include/linux/mfd/cros_ec.h
+++ b/include/linux/mfd/cros_ec.h
@@ -72,6 +72,7 @@ struct cros_ec_command {
  *
  * @priv: Private data
  * @irq: Interrupt to use
+ * @id: Device id
  * @din: input buffer (for data from EC)
  * @dout: output buffer (for data to EC)
  * \note
@@ -106,6 +107,7 @@ struct cros_ec_device {
 	/* These are used to implement the platform-specific interface */
 	void *priv;
 	int irq;
+	int id;
 	uint8_t *din;
 	uint8_t *dout;
 	int din_size;
-- 
2.1.4

[RESEND PATCH 6/8] mfd: cros_ec: rev cros_ec_commands.h

[Javier Martinez Canillas]

From: Stephen Barber <smbarber@chromium.org>

Update cros_ec_commands.h to the latest version in the EC
firmware sources and add power domain and passthru commands.

Also, update lightbar to use new command names.

Signed-off-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
---
 drivers/platform/chrome/cros_ec_lightbar.c |  14 +-
 include/linux/mfd/cros_ec_commands.h       | 277 ++++++++++++++++++++++++++---
 2 files changed, 262 insertions(+), 29 deletions(-)

diff --git a/drivers/platform/chrome/cros_ec_lightbar.c b/drivers/platform/chrome/cros_ec_lightbar.c
index 8ffec6649ead..38a9e58a9d2c 100644
--- a/drivers/platform/chrome/cros_ec_lightbar.c
+++ b/drivers/platform/chrome/cros_ec_lightbar.c
@@ -196,8 +196,8 @@ static ssize_t brightness_store(struct device *dev,
 		return -ENOMEM;
 
 	param = (struct ec_params_lightbar *)msg->data;
-	param->cmd = LIGHTBAR_CMD_BRIGHTNESS;
-	param->brightness.num = val;
+	param->cmd = LIGHTBAR_CMD_SET_BRIGHTNESS;
+	param->set_brightness.num = val;
 	ret = lb_throttle();
 	if (ret)
 		goto exit;
@@ -252,11 +252,11 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
 
 		if (i == 4) {
 			param = (struct ec_params_lightbar *)msg->data;
-			param->cmd = LIGHTBAR_CMD_RGB;
-			param->rgb.led = val[0];
-			param->rgb.red = val[1];
-			param->rgb.green = val[2];
-			param->rgb.blue = val[3];
+			param->cmd = LIGHTBAR_CMD_SET_RGB;
+			param->set_rgb.led = val[0];
+			param->set_rgb.red = val[1];
+			param->set_rgb.green = val[2];
+			param->set_rgb.blue = val[3];
 			/*
 			 * Throttle only the first of every four transactions,
 			 * so that the user can update all four LEDs at once.
diff --git a/include/linux/mfd/cros_ec_commands.h b/include/linux/mfd/cros_ec_commands.h
index a49cd41feea7..13b630c10d4c 100644
--- a/include/linux/mfd/cros_ec_commands.h
+++ b/include/linux/mfd/cros_ec_commands.h
@@ -515,7 +515,7 @@ struct ec_host_response {
 /*
  * Notes on commands:
  *
- * Each command is an 8-byte command value.  Commands which take params or
+ * Each command is an 16-bit command value.  Commands which take params or
  * return response data specify structs for that data.  If no struct is
  * specified, the command does not input or output data, respectively.
  * Parameter/response length is implicit in the structs.  Some underlying
@@ -966,7 +966,7 @@ struct rgb_s {
 /* List of tweakable parameters. NOTE: It's __packed so it can be sent in a
  * host command, but the alignment is the same regardless. Keep it that way.
  */
-struct lightbar_params {
+struct lightbar_params_v0 {
 	/* Timing */
 	int32_t google_ramp_up;
 	int32_t google_ramp_down;
@@ -1000,32 +1000,81 @@ struct lightbar_params {
 	struct rgb_s color[8];			/* 0-3 are Google colors */
 } __packed;
 
+struct lightbar_params_v1 {
+	/* Timing */
+	int32_t google_ramp_up;
+	int32_t google_ramp_down;
+	int32_t s3s0_ramp_up;
+	int32_t s0_tick_delay[2];		/* AC=0/1 */
+	int32_t s0a_tick_delay[2];		/* AC=0/1 */
+	int32_t s0s3_ramp_down;
+	int32_t s3_sleep_for;
+	int32_t s3_ramp_up;
+	int32_t s3_ramp_down;
+	int32_t tap_tick_delay;
+	int32_t tap_display_time;
+
+	/* Tap-for-battery params */
+	uint8_t tap_pct_red;
+	uint8_t tap_pct_green;
+	uint8_t tap_seg_min_on;
+	uint8_t tap_seg_max_on;
+	uint8_t tap_seg_osc;
+	uint8_t tap_idx[3];
+
+	/* Oscillation */
+	uint8_t osc_min[2];			/* AC=0/1 */
+	uint8_t osc_max[2];			/* AC=0/1 */
+	uint8_t w_ofs[2];			/* AC=0/1 */
+
+	/* Brightness limits based on the backlight and AC. */
+	uint8_t bright_bl_off_fixed[2];		/* AC=0/1 */
+	uint8_t bright_bl_on_min[2];		/* AC=0/1 */
+	uint8_t bright_bl_on_max[2];		/* AC=0/1 */
+
+	/* Battery level thresholds */
+	uint8_t battery_threshold[LB_BATTERY_LEVELS - 1];
+
+	/* Map [AC][battery_level] to color index */
+	uint8_t s0_idx[2][LB_BATTERY_LEVELS];	/* AP is running */
+	uint8_t s3_idx[2][LB_BATTERY_LEVELS];	/* AP is sleeping */
+
+	/* Color palette */
+	struct rgb_s color[8];			/* 0-3 are Google colors */
+} __packed;
+
 struct ec_params_lightbar {
 	uint8_t cmd;		      /* Command (see enum lightbar_command) */
 	union {
 		struct {
 			/* no args */
-		} dump, off, on, init, get_seq, get_params, version;
+		} dump, off, on, init, get_seq, get_params_v0, get_params_v1,
+			version, get_brightness, get_demo;
 
-		struct num {
+		struct {
 			uint8_t num;
-		} brightness, seq, demo;
+		} set_brightness, seq, demo;
 
-		struct reg {
+		struct {
 			uint8_t ctrl, reg, value;
 		} reg;
 
-		struct rgb {
+		struct {
 			uint8_t led, red, green, blue;
-		} rgb;
+		} set_rgb;
+
+		struct {
+			uint8_t led;
+		} get_rgb;
 
-		struct lightbar_params set_params;
+		struct lightbar_params_v0 set_params_v0;
+		struct lightbar_params_v1 set_params_v1;
 	};
 } __packed;
 
 struct ec_response_lightbar {
 	union {
-		struct dump {
+		struct {
 			struct {
 				uint8_t reg;
 				uint8_t ic0;
@@ -1033,20 +1082,26 @@ struct ec_response_lightbar {
 			} vals[23];
 		} dump;
 
-		struct get_seq {
+		struct  {
 			uint8_t num;
-		} get_seq;
+		} get_seq, get_brightness, get_demo;
 
-		struct lightbar_params get_params;
+		struct lightbar_params_v0 get_params_v0;
+		struct lightbar_params_v1 get_params_v1;
 
-		struct version {
+		struct {
 			uint32_t num;
 			uint32_t flags;
 		} version;
 
 		struct {
+			uint8_t red, green, blue;
+		} get_rgb;
+
+		struct {
 			/* no return params */
-		} off, on, init, brightness, seq, reg, rgb, demo, set_params;
+		} off, on, init, set_brightness, seq, reg, set_rgb,
+			demo, set_params_v0, set_params_v1;
 	};
 } __packed;
 
@@ -1056,15 +1111,20 @@ enum lightbar_command {
 	LIGHTBAR_CMD_OFF = 1,
 	LIGHTBAR_CMD_ON = 2,
 	LIGHTBAR_CMD_INIT = 3,
-	LIGHTBAR_CMD_BRIGHTNESS = 4,
+	LIGHTBAR_CMD_SET_BRIGHTNESS = 4,
 	LIGHTBAR_CMD_SEQ = 5,
 	LIGHTBAR_CMD_REG = 6,
-	LIGHTBAR_CMD_RGB = 7,
+	LIGHTBAR_CMD_SET_RGB = 7,
 	LIGHTBAR_CMD_GET_SEQ = 8,
 	LIGHTBAR_CMD_DEMO = 9,
-	LIGHTBAR_CMD_GET_PARAMS = 10,
-	LIGHTBAR_CMD_SET_PARAMS = 11,
+	LIGHTBAR_CMD_GET_PARAMS_V0 = 10,
+	LIGHTBAR_CMD_SET_PARAMS_V0 = 11,
 	LIGHTBAR_CMD_VERSION = 12,
+	LIGHTBAR_CMD_GET_BRIGHTNESS = 13,
+	LIGHTBAR_CMD_GET_RGB = 14,
+	LIGHTBAR_CMD_GET_DEMO = 15,
+	LIGHTBAR_CMD_GET_PARAMS_V1 = 16,
+	LIGHTBAR_CMD_SET_PARAMS_V1 = 17,
 	LIGHTBAR_NUM_CMDS
 };
 
@@ -1421,8 +1481,40 @@ struct ec_response_rtc {
 /*****************************************************************************/
 /* Port80 log access */
 
+/* Maximum entries that can be read/written in a single command */
+#define EC_PORT80_SIZE_MAX 32
+
 /* Get last port80 code from previous boot */
 #define EC_CMD_PORT80_LAST_BOOT 0x48
+#define EC_CMD_PORT80_READ 0x48
+
+enum ec_port80_subcmd {
+	EC_PORT80_GET_INFO = 0,
+	EC_PORT80_READ_BUFFER,
+};
+
+struct ec_params_port80_read {
+	uint16_t subcmd;
+	union {
+		struct {
+			uint32_t offset;
+			uint32_t num_entries;
+		} read_buffer;
+	};
+} __packed;
+
+struct ec_response_port80_read {
+	union {
+		struct {
+			uint32_t writes;
+			uint32_t history_size;
+			uint32_t last_boot;
+		} get_info;
+		struct {
+			uint16_t codes[EC_PORT80_SIZE_MAX];
+		} data;
+	};
+} __packed;
 
 struct ec_response_port80_last_boot {
 	uint16_t code;
@@ -1782,6 +1874,7 @@ struct ec_params_gpio_set {
 /* Get GPIO value */
 #define EC_CMD_GPIO_GET 0x93
 
+/* Version 0 of input params and response */
 struct ec_params_gpio_get {
 	char name[32];
 } __packed;
@@ -1789,6 +1882,38 @@ struct ec_response_gpio_get {
 	uint8_t val;
 } __packed;
 
+/* Version 1 of input params and response */
+struct ec_params_gpio_get_v1 {
+	uint8_t subcmd;
+	union {
+		struct {
+			char name[32];
+		} get_value_by_name;
+		struct {
+			uint8_t index;
+		} get_info;
+	};
+} __packed;
+
+struct ec_response_gpio_get_v1 {
+	union {
+		struct {
+			uint8_t val;
+		} get_value_by_name, get_count;
+		struct {
+			uint8_t val;
+			char name[32];
+			uint32_t flags;
+		} get_info;
+	};
+} __packed;
+
+enum gpio_get_subcmd {
+	EC_GPIO_GET_BY_NAME = 0,
+	EC_GPIO_GET_COUNT = 1,
+	EC_GPIO_GET_INFO = 2,
+};
+
 /*****************************************************************************/
 /* I2C commands. Only available when flash write protect is unlocked. */
 
@@ -1857,13 +1982,21 @@ struct ec_params_charge_control {
 /*****************************************************************************/
 
 /*
- * Cut off battery power output if the battery supports.
+ * Cut off battery power immediately or after the host has shut down.
  *
- * For unsupported battery, just don't implement this command and lets EC
- * return EC_RES_INVALID_COMMAND.
+ * return EC_RES_INVALID_COMMAND if unsupported by a board/battery.
+ *	  EC_RES_SUCCESS if the command was successful.
+ *	  EC_RES_ERROR if the cut off command failed.
  */
+
 #define EC_CMD_BATTERY_CUT_OFF 0x99
 
+#define EC_BATTERY_CUTOFF_FLAG_AT_SHUTDOWN	(1 << 0)
+
+struct ec_params_battery_cutoff {
+	uint8_t flags;
+} __packed;
+
 /*****************************************************************************/
 /* USB port mux control. */
 
@@ -2142,6 +2275,32 @@ struct ec_params_sb_wr_block {
 } __packed;
 
 /*****************************************************************************/
+/* Battery vendor parameters
+ *
+ * Get or set vendor-specific parameters in the battery. Implementations may
+ * differ between boards or batteries. On a set operation, the response
+ * contains the actual value set, which may be rounded or clipped from the
+ * requested value.
+ */
+
+#define EC_CMD_BATTERY_VENDOR_PARAM 0xb4
+
+enum ec_battery_vendor_param_mode {
+	BATTERY_VENDOR_PARAM_MODE_GET = 0,
+	BATTERY_VENDOR_PARAM_MODE_SET,
+};
+
+struct ec_params_battery_vendor_param {
+	uint32_t param;
+	uint32_t value;
+	uint8_t mode;
+} __packed;
+
+struct ec_response_battery_vendor_param {
+	uint32_t value;
+} __packed;
+
+/*****************************************************************************/
 /* System commands */
 
 /*
@@ -2338,6 +2497,80 @@ struct ec_params_reboot_ec {
 
 /*****************************************************************************/
 /*
+ * PD commands
+ *
+ * These commands are for PD MCU communication.
+ */
+
+/* EC to PD MCU exchange status command */
+#define EC_CMD_PD_EXCHANGE_STATUS 0x100
+
+/* Status of EC being sent to PD */
+struct ec_params_pd_status {
+	int8_t batt_soc; /* battery state of charge */
+} __packed;
+
+/* Status of PD being sent back to EC */
+struct ec_response_pd_status {
+	int8_t status;        /* PD MCU status */
+	uint32_t curr_lim_ma; /* input current limit */
+} __packed;
+
+/* Set USB type-C port role and muxes */
+#define EC_CMD_USB_PD_CONTROL 0x101
+
+enum usb_pd_control_role {
+	USB_PD_CTRL_ROLE_NO_CHANGE = 0,
+	USB_PD_CTRL_ROLE_TOGGLE_ON = 1, /* == AUTO */
+	USB_PD_CTRL_ROLE_TOGGLE_OFF = 2,
+	USB_PD_CTRL_ROLE_FORCE_SINK = 3,
+	USB_PD_CTRL_ROLE_FORCE_SOURCE = 4,
+};
+
+enum usb_pd_control_mux {
+	USB_PD_CTRL_MUX_NO_CHANGE = 0,
+	USB_PD_CTRL_MUX_NONE = 1,
+	USB_PD_CTRL_MUX_USB = 2,
+	USB_PD_CTRL_MUX_DP = 3,
+	USB_PD_CTRL_MUX_DOCK = 4,
+	USB_PD_CTRL_MUX_AUTO = 5,
+};
+
+struct ec_params_usb_pd_control {
+	uint8_t port;
+	uint8_t role;
+	uint8_t mux;
+} __packed;
+
+/*****************************************************************************/
+/*
+ * Passthru commands
+ *
+ * Some platforms have sub-processors chained to each other.  For example.
+ *
+ *     AP <--> EC <--> PD MCU
+ *
+ * The top 2 bits of the command number are used to indicate which device the
+ * command is intended for.  Device 0 is always the device receiving the
+ * command; other device mapping is board-specific.
+ *
+ * When a device receives a command to be passed to a sub-processor, it passes
+ * it on with the device number set back to 0.  This allows the sub-processor
+ * to remain blissfully unaware of whether the command originated on the next
+ * device up the chain, or was passed through from the AP.
+ *
+ * In the above example, if the AP wants to send command 0x0002 to the PD MCU,
+ *     AP sends command 0x4002 to the EC
+ *     EC sends command 0x0002 to the PD MCU
+ *     EC forwards PD MCU response back to the AP
+ */
+
+/* Offset and max command number for sub-device n */
+#define EC_CMD_PASSTHRU_OFFSET(n) (0x4000 * (n))
+#define EC_CMD_PASSTHRU_MAX(n) (EC_CMD_PASSTHRU_OFFSET(n) + 0x3fff)
+
+/*****************************************************************************/
+/*
  * Deprecated constants. These constants have been renamed for clarity. The
  * meaning and size has not changed. Programs that use the old names should
  * switch to the new names soon, as the old names may not be carried forward
-- 
2.1.4

[RESEND PATCH 7/8] mfd: cros_ec: add proto v3 skeleton

[Javier Martinez Canillas]

From: Stephen Barber <smbarber@chromium.org>

Add support in cros_ec.c to handle EC host command protocol v3.
For v3+, probe for maximum shared protocol version and max
request, response, and passthrough sizes. For now, this will
always fall back to v2, since there is no bus-specific code
for handling proto v3 packets.

Signed-off-by: Stephen Barber <smbarber@chromium.org>
Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
---
 drivers/mfd/cros_ec.c                 | 363 +++++++++++++++++++++++++++++-----
 drivers/mfd/cros_ec_i2c.c             |   4 +
 drivers/mfd/cros_ec_spi.c             |   7 +-
 drivers/platform/chrome/cros_ec_lpc.c |   4 +
 include/linux/mfd/cros_ec.h           |  20 +-
 5 files changed, 347 insertions(+), 51 deletions(-)

diff --git a/drivers/mfd/cros_ec.c b/drivers/mfd/cros_ec.c
index 70f6e55a096e..0972a7d36199 100644
--- a/drivers/mfd/cros_ec.c
+++ b/drivers/mfd/cros_ec.c
@@ -30,11 +30,281 @@
 
 static int dev_id;
 
+static int prepare_packet(struct cros_ec_device *ec_dev,
+			  struct cros_ec_command *msg)
+{
+	struct ec_host_request *request;
+	u8 *out;
+	int i;
+	u8 csum = 0;
+
+	BUG_ON(ec_dev->proto_version != EC_HOST_REQUEST_VERSION);
+	BUG_ON(msg->outsize + sizeof(*request) > ec_dev->dout_size);
+
+	out = ec_dev->dout;
+	request = (struct ec_host_request *)out;
+	request->struct_version = EC_HOST_REQUEST_VERSION;
+	request->checksum = 0;
+	request->command = msg->command;
+	request->command_version = msg->version;
+	request->reserved = 0;
+	request->data_len = msg->outsize;
+
+	for (i = 0; i < sizeof(*request); i++)
+		csum += out[i];
+
+	/* Copy data and update checksum */
+	memcpy(out + sizeof(*request), msg->data, msg->outsize);
+	for (i = 0; i < msg->outsize; i++)
+		csum += msg->data[i];
+
+	request->checksum = -csum;
+
+	return sizeof(*request) + msg->outsize;
+}
+
+static int send_command(struct cros_ec_device *ec_dev,
+			struct cros_ec_command *msg)
+{
+	int ret;
+
+	if (ec_dev->proto_version > 2)
+		ret = ec_dev->pkt_xfer(ec_dev, msg);
+	else
+		ret = ec_dev->cmd_xfer(ec_dev, msg);
+
+	if (msg->result == EC_RES_IN_PROGRESS) {
+		int i;
+		struct cros_ec_command *status_msg;
+		struct ec_response_get_comms_status *status;
+
+		status_msg = kzalloc(sizeof(*status_msg) + sizeof(*status),
+				     GFP_KERNEL);
+		if (!status_msg)
+			return -ENOMEM;
+
+		status_msg->command = EC_CMD_GET_COMMS_STATUS;
+		status_msg->insize = sizeof(*status);
+
+		/*
+		 * Query the EC's status until it's no longer busy or
+		 * we encounter an error.
+		 */
+		for (i = 0; i < EC_COMMAND_RETRIES; i++) {
+			usleep_range(10000, 11000);
+
+			ret = ec_dev->cmd_xfer(ec_dev, status_msg);
+			if (ret < 0)
+				break;
+
+			msg->result = status_msg->result;
+			if (status_msg->result != EC_RES_SUCCESS)
+				break;
+
+			status = (struct ec_response_get_comms_status *)
+				 status_msg->data;
+			if (!(status->flags & EC_COMMS_STATUS_PROCESSING))
+				break;
+		}
+
+		kfree(status_msg);
+	}
+
+	return ret;
+}
+
+static int cros_ec_host_command_proto_probe(struct cros_ec_device *ec_dev,
+					    int devidx,
+					    struct cros_ec_command *msg)
+{
+	/*
+	 * Try using v3+ to query for supported protocols. If this
+	 * command fails, fall back to v2. Returns the highest protocol
+	 * supported by the EC.
+	 * Also sets the max request/response/passthru size.
+	 */
+	int ret;
+
+	if (!ec_dev->pkt_xfer)
+		return -EPROTONOSUPPORT;
+
+	memset(msg, 0, sizeof(*msg));
+	msg->command = EC_CMD_PASSTHRU_OFFSET(devidx) | EC_CMD_GET_PROTOCOL_INFO;
+	msg->insize = sizeof(struct ec_response_get_protocol_info);
+
+	ret = send_command(ec_dev, msg);
+
+	if (ret < 0) {
+		dev_dbg(ec_dev->dev,
+			"failed to probe for EC[%d] protocol version: %d\n",
+			devidx, ret);
+		return ret;
+	}
+
+	if (devidx > 0 && msg->result == EC_RES_INVALID_COMMAND)
+		return -ENODEV;
+	else if (msg->result != EC_RES_SUCCESS)
+		return msg->result;
+
+	return 0;
+}
+
+static int cros_ec_host_command_proto_probe_v2(struct cros_ec_device *ec_dev)
+{
+	struct cros_ec_command *msg;
+	struct ec_params_hello *hello_params;
+	struct ec_response_hello *hello_response;
+	int ret;
+	int len = max(sizeof(*hello_params), sizeof(*hello_response));
+
+	msg = kzalloc(sizeof(*msg) + len, GFP_KERNEL);
+	if (!msg)
+		return -ENOMEM;
+
+	msg->command = EC_CMD_HELLO;
+	hello_params = (struct ec_params_hello *)msg->data;
+	msg->outsize = sizeof(*hello_params);
+	hello_response = (struct ec_response_hello *)msg->data;
+	msg->insize = sizeof(*hello_response);
+
+	hello_params->in_data = 0xa0b0c0d0;
+
+	ret = send_command(ec_dev, msg);
+
+	if (ret < 0) {
+		dev_dbg(ec_dev->dev,
+			"EC failed to respond to v2 hello: %d\n",
+			ret);
+		goto exit;
+	} else if (msg->result != EC_RES_SUCCESS) {
+		dev_err(ec_dev->dev,
+			"EC responded to v2 hello with error: %d\n",
+			msg->result);
+		ret = msg->result;
+		goto exit;
+	} else if (hello_response->out_data != 0xa1b2c3d4) {
+		dev_err(ec_dev->dev,
+			"EC responded to v2 hello with bad result: %u\n",
+			hello_response->out_data);
+		ret = -EBADMSG;
+		goto exit;
+	}
+
+	ret = 0;
+
+exit:
+	kfree(msg);
+	return ret;
+}
+
+static int cros_ec_probe_all(struct cros_ec_device *ec_dev)
+{
+	struct device *dev = ec_dev->dev;
+	struct cros_ec_command *proto_msg;
+	struct ec_response_get_protocol_info *proto_info;
+	int ret;
+
+	proto_msg = kzalloc(sizeof(*proto_msg) + sizeof(*proto_info),
+			    GFP_KERNEL);
+	if (!proto_msg)
+		return -ENOMEM;
+
+	/* First try sending with proto v3. */
+	ec_dev->proto_version = 3;
+	ret = cros_ec_host_command_proto_probe(ec_dev, 0, proto_msg);
+
+	if (ret == 0) {
+		proto_info = (struct ec_response_get_protocol_info *)
+			proto_msg->data;
+		ec_dev->max_request = proto_info->max_request_packet_size -
+			sizeof(struct ec_host_request);
+		ec_dev->max_response = proto_info->max_response_packet_size -
+			sizeof(struct ec_host_response);
+		ec_dev->proto_version =
+			min(EC_HOST_REQUEST_VERSION,
+					fls(proto_info->protocol_versions) - 1);
+		dev_dbg(ec_dev->dev,
+			"using proto v%u\n",
+			ec_dev->proto_version);
+
+		ec_dev->din_size = ec_dev->max_response +
+			sizeof(struct ec_host_response) +
+			EC_MAX_RESPONSE_OVERHEAD;
+		ec_dev->dout_size = ec_dev->max_request +
+			sizeof(struct ec_host_request) +
+			EC_MAX_REQUEST_OVERHEAD;
+
+		/*
+		 * Check for PD
+		 */
+		ret = cros_ec_host_command_proto_probe(ec_dev, 1, proto_msg);
+
+		if (ret) {
+			dev_dbg(ec_dev->dev, "no PD chip found: %d\n", ret);
+			ec_dev->max_passthru = 0;
+		} else {
+			dev_dbg(ec_dev->dev, "found PD chip\n");
+			ec_dev->max_passthru =
+				proto_info->max_request_packet_size -
+				sizeof(struct ec_host_request);
+		}
+	} else {
+		/* Try probing with a v2 hello message. */
+		ec_dev->proto_version = 2;
+		ret = cros_ec_host_command_proto_probe_v2(ec_dev);
+
+		if (ret == 0) {
+			/* V2 hello succeeded. */
+			dev_dbg(ec_dev->dev, "falling back to proto v2\n");
+
+			ec_dev->max_request = EC_PROTO2_MAX_PARAM_SIZE;
+			ec_dev->max_response = EC_PROTO2_MAX_PARAM_SIZE;
+			ec_dev->max_passthru = 0;
+			ec_dev->pkt_xfer = NULL;
+			ec_dev->din_size = EC_MSG_BYTES;
+			ec_dev->dout_size = EC_MSG_BYTES;
+		} else {
+			/*
+			 * It's possible for a probe to occur too early when
+			 * the EC isn't listening. If this happens, we'll
+			 * probe later when the first command is run.
+			 */
+			ec_dev->proto_version = EC_PROTO_VERSION_UNKNOWN;
+			dev_dbg(ec_dev->dev, "EC probe failed: %d\n", ret);
+			goto exit;
+		}
+	}
+
+	devm_kfree(dev, ec_dev->din);
+	devm_kfree(dev, ec_dev->dout);
+
+	ec_dev->din = devm_kzalloc(dev, ec_dev->din_size, GFP_KERNEL);
+	if (!ec_dev->din) {
+		ret = -ENOMEM;
+		goto exit;
+	}
+
+	ec_dev->dout = devm_kzalloc(dev, ec_dev->dout_size, GFP_KERNEL);
+	if (!ec_dev->dout) {
+		devm_kfree(dev, ec_dev->din);
+		ret = -ENOMEM;
+		goto exit;
+	}
+
+exit:
+	kfree(proto_msg);
+	return ret;
+}
+
 int cros_ec_prepare_tx(struct cros_ec_device *ec_dev,
 		       struct cros_ec_command *msg)
 {
-	uint8_t *out;
-	int csum, i;
+	u8 *out;
+	u8 csum;
+	int i;
+
+	if (ec_dev->proto_version > 2)
+		return prepare_packet(ec_dev, msg);
 
 	BUG_ON(msg->outsize > EC_PROTO2_MAX_PARAM_SIZE);
 	out = ec_dev->dout;
@@ -44,7 +314,7 @@ int cros_ec_prepare_tx(struct cros_ec_device *ec_dev,
 	csum = out[0] + out[1] + out[2];
 	for (i = 0; i < msg->outsize; i++)
 		csum += out[EC_MSG_TX_HEADER_BYTES + i] = msg->data[i];
-	out[EC_MSG_TX_HEADER_BYTES + msg->outsize] = (uint8_t)(csum & 0xff);
+	out[EC_MSG_TX_HEADER_BYTES + msg->outsize] = csum;
 
 	return EC_MSG_TX_PROTO_BYTES + msg->outsize;
 }
@@ -74,46 +344,43 @@ int cros_ec_cmd_xfer(struct cros_ec_device *ec_dev,
 	int ret;
 
 	mutex_lock(&ec_dev->lock);
-	ret = ec_dev->cmd_xfer(ec_dev, msg);
-	if (msg->result == EC_RES_IN_PROGRESS) {
-		int i;
-		struct cros_ec_command *status_msg;
-		struct ec_response_get_comms_status *status;
 
-		status_msg = kzalloc(sizeof(*status_msg) + sizeof(*status),
-				     GFP_KERNEL);
-		if (!status_msg) {
-			ret = -ENOMEM;
-			goto exit;
+	if (ec_dev->proto_version == EC_PROTO_VERSION_UNKNOWN) {
+		ret = cros_ec_probe_all(ec_dev);
+		if (ret) {
+			dev_err(ec_dev->dev,
+				"EC version unknown and probe failed; aborting command\n");
+			mutex_unlock(&ec_dev->lock);
+			return ret;
 		}
+	}
 
-		status_msg->command = EC_CMD_GET_COMMS_STATUS;
-		status_msg->insize = sizeof(*status);
-
-		/*
-		 * Query the EC's status until it's no longer busy or
-		 * we encounter an error.
-		 */
-		for (i = 0; i < EC_COMMAND_RETRIES; i++) {
-			usleep_range(10000, 11000);
-
-			ret = ec_dev->cmd_xfer(ec_dev, status_msg);
-			if (ret < 0)
-				break;
-
-			msg->result = status_msg->result;
-			if (status_msg->result != EC_RES_SUCCESS)
-				break;
+	if (msg->insize > ec_dev->max_response) {
+		dev_dbg(ec_dev->dev, "clamping message receive buffer\n");
+		msg->insize = ec_dev->max_response;
+	}
 
-			status = (struct ec_response_get_comms_status *)
-				 status_msg->data;
-			if (!(status->flags & EC_COMMS_STATUS_PROCESSING))
-				break;
+	if (msg->command < EC_CMD_PASSTHRU_OFFSET(1)) {
+		if (msg->outsize > ec_dev->max_request) {
+			dev_err(ec_dev->dev,
+				"request of size %u is too big (max: %u)\n",
+				msg->outsize,
+				ec_dev->max_request);
+			mutex_unlock(&ec_dev->lock);
+			return -EMSGSIZE;
+		}
+	} else {
+		if (msg->outsize > ec_dev->max_passthru) {
+			dev_err(ec_dev->dev,
+				"passthru rq of size %u is too big (max: %u)\n",
+				msg->outsize,
+				ec_dev->max_passthru);
+			mutex_unlock(&ec_dev->lock);
+			return -EMSGSIZE;
 		}
-
-		kfree(status_msg);
 	}
-exit:
+
+	ret = send_command(ec_dev, msg);
 	mutex_unlock(&ec_dev->lock);
 
 	return ret;
@@ -132,21 +399,23 @@ int cros_ec_register(struct cros_ec_device *ec_dev)
 	struct device *dev = ec_dev->dev;
 	int err = 0;
 
+	ec_dev->max_request = sizeof(struct ec_params_hello);
+	ec_dev->max_response = sizeof(struct ec_response_get_protocol_info);
+	ec_dev->max_passthru = 0;
 	ec_dev->id = dev_id;
 
-	if (ec_dev->din_size) {
-		ec_dev->din = devm_kzalloc(dev, ec_dev->din_size, GFP_KERNEL);
-		if (!ec_dev->din)
-			return -ENOMEM;
-	}
-	if (ec_dev->dout_size) {
-		ec_dev->dout = devm_kzalloc(dev, ec_dev->dout_size, GFP_KERNEL);
-		if (!ec_dev->dout)
-			return -ENOMEM;
-	}
+	ec_dev->din = devm_kzalloc(dev, ec_dev->din_size, GFP_KERNEL);
+	if (!ec_dev->din)
+		return -ENOMEM;
+
+	ec_dev->dout = devm_kzalloc(dev, ec_dev->dout_size, GFP_KERNEL);
+	if (!ec_dev->dout)
+		return -ENOMEM;
 
 	mutex_init(&ec_dev->lock);
 
+	cros_ec_probe_all(ec_dev);
+
 	err = mfd_add_devices(dev, ec_dev->id, cros_devs,
 			      ARRAY_SIZE(cros_devs),
 			      NULL, ec_dev->irq, NULL);
diff --git a/drivers/mfd/cros_ec_i2c.c b/drivers/mfd/cros_ec_i2c.c
index fbf7819f5de5..b400bfa2772a 100644
--- a/drivers/mfd/cros_ec_i2c.c
+++ b/drivers/mfd/cros_ec_i2c.c
@@ -143,8 +143,12 @@ static int cros_ec_i2c_probe(struct i2c_client *client,
 	ec_dev->priv = client;
 	ec_dev->irq = client->irq;
 	ec_dev->cmd_xfer = cros_ec_cmd_xfer_i2c;
+	ec_dev->pkt_xfer = NULL;
 	ec_dev->ec_name = client->name;
 	ec_dev->phys_name = client->adapter->name;
+	ec_dev->din_size = sizeof(struct ec_host_response) +
+			   sizeof(struct ec_response_get_protocol_info);
+	ec_dev->dout_size = sizeof(struct ec_host_request);
 
 	err = cros_ec_register(ec_dev);
 	if (err) {
diff --git a/drivers/mfd/cros_ec_spi.c b/drivers/mfd/cros_ec_spi.c
index 573730fec947..04da2f288ef8 100644
--- a/drivers/mfd/cros_ec_spi.c
+++ b/drivers/mfd/cros_ec_spi.c
@@ -361,10 +361,13 @@ static int cros_ec_spi_probe(struct spi_device *spi)
 	ec_dev->priv = ec_spi;
 	ec_dev->irq = spi->irq;
 	ec_dev->cmd_xfer = cros_ec_cmd_xfer_spi;
+	ec_dev->pkt_xfer = NULL;
 	ec_dev->ec_name = ec_spi->spi->modalias;
 	ec_dev->phys_name = dev_name(&ec_spi->spi->dev);
-	ec_dev->din_size = EC_MSG_BYTES + EC_MSG_PREAMBLE_COUNT;
-	ec_dev->dout_size = EC_MSG_BYTES;
+	ec_dev->din_size = EC_MSG_PREAMBLE_COUNT +
+			   sizeof(struct ec_host_response) +
+			   sizeof(struct ec_response_get_protocol_info);
+	ec_dev->dout_size = sizeof(struct ec_host_request);
 
 	err = cros_ec_register(ec_dev);
 	if (err) {
diff --git a/drivers/platform/chrome/cros_ec_lpc.c b/drivers/platform/chrome/cros_ec_lpc.c
index 32b1df29fc58..d56dfb9dd463 100644
--- a/drivers/platform/chrome/cros_ec_lpc.c
+++ b/drivers/platform/chrome/cros_ec_lpc.c
@@ -205,7 +205,11 @@ static int cros_ec_lpc_probe(struct platform_device *pdev)
 	ec_dev->ec_name = pdev->name;
 	ec_dev->phys_name = dev_name(dev);
 	ec_dev->cmd_xfer = cros_ec_cmd_xfer_lpc;
+	ec_dev->pkt_xfer = NULL;
 	ec_dev->cmd_readmem = cros_ec_lpc_readmem;
+	ec_dev->din_size = sizeof(struct ec_host_response) +
+			   sizeof(struct ec_response_get_protocol_info);
+	ec_dev->dout_size = sizeof(struct ec_host_request);
 
 	ret = cros_ec_register(ec_dev);
 	if (ret) {
diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
index 2bee6ac74ffb..f27ce4b7736b 100644
--- a/include/linux/mfd/cros_ec.h
+++ b/include/linux/mfd/cros_ec.h
@@ -22,6 +22,15 @@
 #include <linux/mutex.h>
 
 /*
+ * Max bus-specific overhead incurred by request/responses.
+ * I2C requires 1 additional byte for requests.
+ * I2C requires 2 additional bytes for responses.
+ * */
+#define EC_PROTO_VERSION_UNKNOWN	0
+#define EC_MAX_REQUEST_OVERHEAD		1
+#define EC_MAX_RESPONSE_OVERHEAD	2
+
+/*
  * Command interface between EC and AP, for LPC, I2C and SPI interfaces.
  */
 enum {
@@ -89,6 +98,7 @@ struct cros_ec_command {
  *     Returns the number of bytes received if the communication succeeded, but
  *     that doesn't mean the EC was happy with the command. The caller
  *     should check msg.result for the EC's result code.
+ * @pkt_xfer: send packet to EC and get response
  * @lock: one transaction at a time
  */
 struct cros_ec_device {
@@ -105,16 +115,22 @@ struct cros_ec_device {
 			   unsigned int bytes, void *dest);
 
 	/* These are used to implement the platform-specific interface */
+	u16 max_request;
+	u16 max_response;
+	u16 max_passthru;
+	u16 proto_version;
 	void *priv;
 	int irq;
 	int id;
-	uint8_t *din;
-	uint8_t *dout;
+	u8 *din;
+	u8 *dout;
 	int din_size;
 	int dout_size;
 	bool wake_enabled;
 	int (*cmd_xfer)(struct cros_ec_device *ec,
 			struct cros_ec_command *msg);
+	int (*pkt_xfer)(struct cros_ec_device *ec,
+			struct cros_ec_command *msg);
 	struct mutex lock;
 };
 
-- 
2.1.4

[RESEND PATCH 8/8] mfd: cros_ec: add bus-specific proto v3 code

[Javier Martinez Canillas]

From: Stephen Barber <smbarber@chromium.org>

Add proto v3 support to the SPI, I2C, and LPC.

Signed-off-by: Stephen Barber <smbarber@chromium.org>
Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
---
 drivers/mfd/cros_ec_i2c.c             | 166 ++++++++++++++-
 drivers/mfd/cros_ec_spi.c             | 382 +++++++++++++++++++++++++++++-----
 drivers/platform/chrome/cros_ec_lpc.c |  73 ++++++-
 include/linux/mfd/cros_ec.h           |   6 +
 4 files changed, 569 insertions(+), 58 deletions(-)

diff --git a/drivers/mfd/cros_ec_i2c.c b/drivers/mfd/cros_ec_i2c.c
index b400bfa2772a..22e8a4ae1711 100644
--- a/drivers/mfd/cros_ec_i2c.c
+++ b/drivers/mfd/cros_ec_i2c.c
@@ -13,6 +13,7 @@
  * GNU General Public License for more details.
  */
 
+#include <linux/delay.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/i2c.h>
@@ -22,6 +23,32 @@
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 
+/**
+ * Request format for protocol v3
+ * byte 0	0xda (EC_COMMAND_PROTOCOL_3)
+ * byte 1-8	struct ec_host_request
+ * byte 10-	response data
+ */
+struct ec_host_request_i2c {
+	/* Always 0xda to backward compatible with v2 struct */
+	uint8_t  command_protocol;
+	struct ec_host_request ec_request;
+} __packed;
+
+
+/*
+ * Response format for protocol v3
+ * byte 0	result code
+ * byte 1	packet_length
+ * byte 2-9	struct ec_host_response
+ * byte 10-	response data
+ */
+struct ec_host_response_i2c {
+	uint8_t result;
+	uint8_t packet_length;
+	struct ec_host_response ec_response;
+} __packed;
+
 static inline struct cros_ec_device *to_ec_dev(struct device *dev)
 {
 	struct i2c_client *client = to_i2c_client(dev);
@@ -29,6 +56,134 @@ static inline struct cros_ec_device *to_ec_dev(struct device *dev)
 	return i2c_get_clientdata(client);
 }
 
+static int cros_ec_pkt_xfer_i2c(struct cros_ec_device *ec_dev,
+				struct cros_ec_command *msg)
+{
+	struct i2c_client *client = ec_dev->priv;
+	int ret = -ENOMEM;
+	int i;
+	int packet_len;
+	u8 *out_buf = NULL;
+	u8 *in_buf = NULL;
+	u8 sum;
+	struct i2c_msg i2c_msg[2];
+	struct ec_host_response *ec_response;
+	struct ec_host_request_i2c *ec_request_i2c;
+	struct ec_host_response_i2c *ec_response_i2c;
+	int request_header_size = sizeof(struct ec_host_request_i2c);
+	int response_header_size = sizeof(struct ec_host_response_i2c);
+
+	i2c_msg[0].addr = client->addr;
+	i2c_msg[0].flags = 0;
+	i2c_msg[1].addr = client->addr;
+	i2c_msg[1].flags = I2C_M_RD;
+
+	packet_len = msg->insize + response_header_size;
+	BUG_ON(packet_len > ec_dev->din_size);
+	in_buf = ec_dev->din;
+	i2c_msg[1].len = packet_len;
+	i2c_msg[1].buf = (char *) in_buf;
+
+	packet_len = msg->outsize + request_header_size;
+	BUG_ON(packet_len > ec_dev->dout_size);
+	out_buf = ec_dev->dout;
+	i2c_msg[0].len = packet_len;
+	i2c_msg[0].buf = (char *) out_buf;
+
+	/* create request data */
+	ec_request_i2c = (struct ec_host_request_i2c *) out_buf;
+	ec_request_i2c->command_protocol = EC_COMMAND_PROTOCOL_3;
+
+	ec_dev->dout++;
+	ret = cros_ec_prepare_tx(ec_dev, msg);
+	ec_dev->dout--;
+
+	/* send command to EC and read answer */
+	ret = i2c_transfer(client->adapter, i2c_msg, 2);
+	if (ret < 0) {
+		dev_dbg(ec_dev->dev, "i2c transfer failed: %d\n", ret);
+		goto done;
+	} else if (ret != 2) {
+		dev_err(ec_dev->dev, "failed to get response: %d\n", ret);
+		ret = -EIO;
+		goto done;
+	}
+
+	ec_response_i2c = (struct ec_host_response_i2c *) in_buf;
+	msg->result = ec_response_i2c->result;
+	ec_response = &ec_response_i2c->ec_response;
+
+	switch (msg->result) {
+	case EC_RES_SUCCESS:
+		break;
+	case EC_RES_IN_PROGRESS:
+		ret = -EAGAIN;
+		dev_dbg(ec_dev->dev, "command 0x%02x in progress\n",
+			msg->command);
+		goto done;
+
+	default:
+		dev_dbg(ec_dev->dev, "command 0x%02x returned %d\n",
+			msg->command, msg->result);
+		/*
+		 * When we send v3 request to v2 ec, ec won't recognize the
+		 * 0xda (EC_COMMAND_PROTOCOL_3) and will return with status
+		 * EC_RES_INVALID_COMMAND with zero data length.
+		 *
+		 * In case of invalid command for v3 protocol the data length
+		 * will be at least sizeof(struct ec_host_response)
+		 */
+		if (ec_response_i2c->result == EC_RES_INVALID_COMMAND &&
+		    ec_response_i2c->packet_length == 0) {
+			ret = -EPROTONOSUPPORT;
+			goto done;
+		}
+	}
+
+	if (ec_response_i2c->packet_length < sizeof(struct ec_host_response)) {
+		dev_err(ec_dev->dev,
+			"response of %u bytes too short; not a full header\n",
+			ec_response_i2c->packet_length);
+		ret = -EBADMSG;
+		goto done;
+	}
+
+	if (msg->insize < ec_response->data_len) {
+		dev_err(ec_dev->dev,
+			"response data size is too large: expected %u, got %u\n",
+			msg->insize,
+			ec_response->data_len);
+		ret = -EMSGSIZE;
+		goto done;
+	}
+
+	/* copy response packet payload and compute checksum */
+	sum = 0;
+	for (i = 0; i < sizeof(struct ec_host_response); i++)
+		sum += ((u8 *)ec_response)[i];
+
+	memcpy(msg->data,
+	       in_buf + response_header_size,
+	       ec_response->data_len);
+	for (i = 0; i < ec_response->data_len; i++)
+		sum += msg->data[i];
+
+	/* All bytes should sum to zero */
+	if (sum) {
+		dev_err(ec_dev->dev, "bad packet checksum\n");
+		ret = -EBADMSG;
+		goto done;
+	}
+
+	ret = ec_response->data_len;
+
+done:
+	if (msg->command == EC_CMD_REBOOT_EC)
+		msleep(EC_REBOOT_DELAY_MS);
+
+	return ret;
+}
+
 static int cros_ec_cmd_xfer_i2c(struct cros_ec_device *ec_dev,
 				struct cros_ec_command *msg)
 {
@@ -121,9 +276,12 @@ static int cros_ec_cmd_xfer_i2c(struct cros_ec_device *ec_dev,
 	}
 
 	ret = len;
- done:
+done:
 	kfree(in_buf);
 	kfree(out_buf);
+	if (msg->command == EC_CMD_REBOOT_EC)
+		msleep(EC_REBOOT_DELAY_MS);
+
 	return ret;
 }
 
@@ -143,12 +301,12 @@ static int cros_ec_i2c_probe(struct i2c_client *client,
 	ec_dev->priv = client;
 	ec_dev->irq = client->irq;
 	ec_dev->cmd_xfer = cros_ec_cmd_xfer_i2c;
-	ec_dev->pkt_xfer = NULL;
+	ec_dev->pkt_xfer = cros_ec_pkt_xfer_i2c;
 	ec_dev->ec_name = client->name;
 	ec_dev->phys_name = client->adapter->name;
-	ec_dev->din_size = sizeof(struct ec_host_response) +
+	ec_dev->din_size = sizeof(struct ec_host_response_i2c) +
 			   sizeof(struct ec_response_get_protocol_info);
-	ec_dev->dout_size = sizeof(struct ec_host_request);
+	ec_dev->dout_size = sizeof(struct ec_host_request_i2c);
 
 	err = cros_ec_register(ec_dev);
 	if (err) {
diff --git a/drivers/mfd/cros_ec_spi.c b/drivers/mfd/cros_ec_spi.c
index 04da2f288ef8..4e6f2f6b1095 100644
--- a/drivers/mfd/cros_ec_spi.c
+++ b/drivers/mfd/cros_ec_spi.c
@@ -65,12 +65,6 @@
   */
 #define EC_SPI_RECOVERY_TIME_NS	(200 * 1000)
 
-/*
- * The EC is unresponsive for a time after a reboot command.  Add a
- * simple delay to make sure that the bus stays locked.
- */
-#define EC_REBOOT_DELAY_MS	50
-
 /**
  * struct cros_ec_spi - information about a SPI-connected EC
  *
@@ -87,7 +81,7 @@ struct cros_ec_spi {
 };
 
 static void debug_packet(struct device *dev, const char *name, u8 *ptr,
-			  int len)
+			 int len)
 {
 #ifdef DEBUG
 	int i;
@@ -100,6 +94,172 @@ static void debug_packet(struct device *dev, const char *name, u8 *ptr,
 #endif
 }
 
+static int terminate_request(struct cros_ec_device *ec_dev)
+{
+	struct cros_ec_spi *ec_spi = ec_dev->priv;
+	struct spi_message msg;
+	struct spi_transfer trans;
+	int ret;
+
+	/*
+	 * Turn off CS, possibly adding a delay to ensure the rising edge
+	 * doesn't come too soon after the end of the data.
+	 */
+	spi_message_init(&msg);
+	memset(&trans, 0, sizeof(trans));
+	trans.delay_usecs = ec_spi->end_of_msg_delay;
+	spi_message_add_tail(&trans, &msg);
+
+	ret = spi_sync(ec_spi->spi, &msg);
+
+	/* Reset end-of-response timer */
+	ec_spi->last_transfer_ns = ktime_get_ns();
+	if (ret < 0) {
+		dev_err(ec_dev->dev,
+			"cs-deassert spi transfer failed: %d\n",
+			ret);
+	}
+
+	return ret;
+}
+
+/**
+ * receive_n_bytes - receive n bytes from the EC.
+ *
+ * Assumes buf is a pointer into the ec_dev->din buffer
+ */
+static int receive_n_bytes(struct cros_ec_device *ec_dev, u8 *buf, int n)
+{
+	struct cros_ec_spi *ec_spi = ec_dev->priv;
+	struct spi_transfer trans;
+	struct spi_message msg;
+	int ret;
+
+	BUG_ON(buf - ec_dev->din + n > ec_dev->din_size);
+
+	memset(&trans, 0, sizeof(trans));
+	trans.cs_change = 1;
+	trans.rx_buf = buf;
+	trans.len = n;
+
+	spi_message_init(&msg);
+	spi_message_add_tail(&trans, &msg);
+	ret = spi_sync(ec_spi->spi, &msg);
+	if (ret < 0)
+		dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
+
+	return ret;
+}
+
+/**
+ * cros_ec_spi_receive_packet - Receive a packet from the EC.
+ *
+ * This function has two phases: reading the preamble bytes (since if we read
+ * data from the EC before it is ready to send, we just get preamble) and
+ * reading the actual message.
+ *
+ * The received data is placed into ec_dev->din.
+ *
+ * @ec_dev: ChromeOS EC device
+ * @need_len: Number of message bytes we need to read
+ */
+static int cros_ec_spi_receive_packet(struct cros_ec_device *ec_dev,
+				      int need_len)
+{
+	struct ec_host_response *response;
+	u8 *ptr, *end;
+	int ret;
+	unsigned long deadline;
+	int todo;
+
+	BUG_ON(EC_MSG_PREAMBLE_COUNT > ec_dev->din_size);
+
+	/* Receive data until we see the header byte */
+	deadline = jiffies + msecs_to_jiffies(EC_MSG_DEADLINE_MS);
+	while (true) {
+		unsigned long start_jiffies = jiffies;
+
+		ret = receive_n_bytes(ec_dev,
+				      ec_dev->din,
+				      EC_MSG_PREAMBLE_COUNT);
+		if (ret < 0)
+			return ret;
+
+		ptr = ec_dev->din;
+		for (end = ptr + EC_MSG_PREAMBLE_COUNT; ptr != end; ptr++) {
+			if (*ptr == EC_SPI_FRAME_START) {
+				dev_dbg(ec_dev->dev, "msg found at %zd\n",
+					ptr - ec_dev->din);
+				break;
+			}
+		}
+		if (ptr != end)
+			break;
+
+		/*
+		 * Use the time at the start of the loop as a timeout.  This
+		 * gives us one last shot at getting the transfer and is useful
+		 * in case we got context switched out for a while.
+		 */
+		if (time_after(start_jiffies, deadline)) {
+			dev_warn(ec_dev->dev, "EC failed to respond in time\n");
+			return -ETIMEDOUT;
+		}
+	}
+
+	/*
+	 * ptr now points to the header byte. Copy any valid data to the
+	 * start of our buffer
+	 */
+	todo = end - ++ptr;
+	BUG_ON(todo < 0 || todo > ec_dev->din_size);
+	todo = min(todo, need_len);
+	memmove(ec_dev->din, ptr, todo);
+	ptr = ec_dev->din + todo;
+	dev_dbg(ec_dev->dev, "need %d, got %d bytes from preamble\n",
+		need_len, todo);
+	need_len -= todo;
+
+	/* If the entire response struct wasn't read, get the rest of it. */
+	if (todo < sizeof(*response)) {
+		ret = receive_n_bytes(ec_dev, ptr, sizeof(*response) - todo);
+		if (ret < 0)
+			return -EBADMSG;
+		ptr += (sizeof(*response) - todo);
+		todo = sizeof(*response);
+	}
+
+	response = (struct ec_host_response *)ec_dev->din;
+
+	/* Abort if data_len is too large. */
+	if (response->data_len > ec_dev->din_size)
+		return -EMSGSIZE;
+
+	/* Receive data until we have it all */
+	while (need_len > 0) {
+		/*
+		 * We can't support transfers larger than the SPI FIFO size
+		 * unless we have DMA. We don't have DMA on the ISP SPI ports
+		 * for Exynos. We need a way of asking SPI driver for
+		 * maximum-supported transfer size.
+		 */
+		todo = min(need_len, 256);
+		dev_dbg(ec_dev->dev, "loop, todo=%d, need_len=%d, ptr=%zd\n",
+			todo, need_len, ptr - ec_dev->din);
+
+		ret = receive_n_bytes(ec_dev, ptr, todo);
+		if (ret < 0)
+			return ret;
+
+		ptr += todo;
+		need_len -= todo;
+	}
+
+	dev_dbg(ec_dev->dev, "loop done, ptr=%zd\n", ptr - ec_dev->din);
+
+	return 0;
+}
+
 /**
  * cros_ec_spi_receive_response - Receive a response from the EC.
  *
@@ -115,34 +275,27 @@ static void debug_packet(struct device *dev, const char *name, u8 *ptr,
 static int cros_ec_spi_receive_response(struct cros_ec_device *ec_dev,
 					int need_len)
 {
-	struct cros_ec_spi *ec_spi = ec_dev->priv;
-	struct spi_transfer trans;
-	struct spi_message msg;
 	u8 *ptr, *end;
 	int ret;
 	unsigned long deadline;
 	int todo;
 
+	BUG_ON(EC_MSG_PREAMBLE_COUNT > ec_dev->din_size);
+
 	/* Receive data until we see the header byte */
 	deadline = jiffies + msecs_to_jiffies(EC_MSG_DEADLINE_MS);
 	while (true) {
 		unsigned long start_jiffies = jiffies;
 
-		memset(&trans, 0, sizeof(trans));
-		trans.cs_change = 1;
-		trans.rx_buf = ptr = ec_dev->din;
-		trans.len = EC_MSG_PREAMBLE_COUNT;
-
-		spi_message_init(&msg);
-		spi_message_add_tail(&trans, &msg);
-		ret = spi_sync(ec_spi->spi, &msg);
-		if (ret < 0) {
-			dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
+		ret = receive_n_bytes(ec_dev,
+				      ec_dev->din,
+				      EC_MSG_PREAMBLE_COUNT);
+		if (ret < 0)
 			return ret;
-		}
 
+		ptr = ec_dev->din;
 		for (end = ptr + EC_MSG_PREAMBLE_COUNT; ptr != end; ptr++) {
-			if (*ptr == EC_MSG_HEADER) {
+			if (*ptr == EC_SPI_FRAME_START) {
 				dev_dbg(ec_dev->dev, "msg found at %zd\n",
 					ptr - ec_dev->din);
 				break;
@@ -187,21 +340,9 @@ static int cros_ec_spi_receive_response(struct cros_ec_device *ec_dev,
 		dev_dbg(ec_dev->dev, "loop, todo=%d, need_len=%d, ptr=%zd\n",
 			todo, need_len, ptr - ec_dev->din);
 
-		memset(&trans, 0, sizeof(trans));
-		trans.cs_change = 1;
-		trans.rx_buf = ptr;
-		trans.len = todo;
-		spi_message_init(&msg);
-		spi_message_add_tail(&trans, &msg);
-
-		/* send command to EC and read answer */
-		BUG_ON((u8 *)trans.rx_buf - ec_dev->din + todo >
-				ec_dev->din_size);
-		ret = spi_sync(ec_spi->spi, &msg);
-		if (ret < 0) {
-			dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
+		ret = receive_n_bytes(ec_dev, ptr, todo);
+		if (ret < 0)
 			return ret;
-		}
 
 		debug_packet(ec_dev->dev, "interim", ptr, todo);
 		ptr += todo;
@@ -214,6 +355,128 @@ static int cros_ec_spi_receive_response(struct cros_ec_device *ec_dev,
 }
 
 /**
+ * cros_ec_pkt_xfer_spi - Transfer a packet over SPI and receive the reply
+ *
+ * @ec_dev: ChromeOS EC device
+ * @ec_msg: Message to transfer
+ */
+static int cros_ec_pkt_xfer_spi(struct cros_ec_device *ec_dev,
+				struct cros_ec_command *ec_msg)
+{
+	struct ec_host_request *request;
+	struct ec_host_response *response;
+	struct cros_ec_spi *ec_spi = ec_dev->priv;
+	struct spi_transfer trans;
+	struct spi_message msg;
+	int i, len;
+	u8 *ptr;
+	u8 *rx_buf;
+	u8 sum;
+	int ret = 0, final_ret;
+
+	len = cros_ec_prepare_tx(ec_dev, ec_msg);
+	request = (struct ec_host_request *)ec_dev->dout;
+	dev_dbg(ec_dev->dev, "prepared, len=%d\n", len);
+
+	/* If it's too soon to do another transaction, wait */
+	if (ec_spi->last_transfer_ns) {
+		unsigned long delay;	/* The delay completed so far */
+
+		delay = ktime_get_ns() - ec_spi->last_transfer_ns;
+		if (delay < EC_SPI_RECOVERY_TIME_NS)
+			ndelay(EC_SPI_RECOVERY_TIME_NS - delay);
+	}
+
+	rx_buf = kzalloc(len, GFP_KERNEL);
+	if (!rx_buf) {
+		ret = -ENOMEM;
+		goto exit;
+	}
+
+	/* Transmit phase - send our message */
+	memset(&trans, 0, sizeof(trans));
+	trans.tx_buf = ec_dev->dout;
+	trans.rx_buf = rx_buf;
+	trans.len = len;
+	trans.cs_change = 1;
+	spi_message_init(&msg);
+	spi_message_add_tail(&trans, &msg);
+	ret = spi_sync(ec_spi->spi, &msg);
+
+	/* Get the response */
+	if (!ret) {
+		/* Verify that EC can process command */
+		for (i = 0; i < len; i++) {
+			switch (rx_buf[i]) {
+			case EC_SPI_PAST_END:
+			case EC_SPI_RX_BAD_DATA:
+			case EC_SPI_NOT_READY:
+				ret = -EAGAIN;
+				ec_msg->result = EC_RES_IN_PROGRESS;
+			default:
+				break;
+			}
+			if (ret)
+				break;
+		}
+		if (!ret)
+			ret = cros_ec_spi_receive_packet(ec_dev,
+					ec_msg->insize + sizeof(*response));
+	} else {
+		dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
+	}
+
+	final_ret = terminate_request(ec_dev);
+	if (!ret)
+		ret = final_ret;
+	if (ret < 0)
+		goto exit;
+
+	ptr = ec_dev->din;
+
+	/* check response error code */
+	response = (struct ec_host_response *)ptr;
+	ec_msg->result = response->result;
+
+	ret = cros_ec_check_result(ec_dev, ec_msg);
+	if (ret)
+		goto exit;
+
+	len = response->data_len;
+	sum = 0;
+	if (len > ec_msg->insize) {
+		dev_err(ec_dev->dev, "packet too long (%d bytes, expected %d)",
+			len, ec_msg->insize);
+		ret = -EMSGSIZE;
+		goto exit;
+	}
+
+	for (i = 0; i < sizeof(*response); i++)
+		sum += ptr[i];
+
+	/* copy response packet payload and compute checksum */
+	memcpy(ec_msg->data, ptr + sizeof(*response), len);
+	for (i = 0; i < len; i++)
+		sum += ec_msg->data[i];
+
+	if (sum) {
+		dev_err(ec_dev->dev,
+			"bad packet checksum, calculated %x\n",
+			sum);
+		ret = -EBADMSG;
+		goto exit;
+	}
+
+	ret = len;
+exit:
+	kfree(rx_buf);
+	if (ec_msg->command == EC_CMD_REBOOT_EC)
+		msleep(EC_REBOOT_DELAY_MS);
+
+	return ret;
+}
+
+/**
  * cros_ec_cmd_xfer_spi - Transfer a message over SPI and receive the reply
  *
  * @ec_dev: ChromeOS EC device
@@ -227,6 +490,7 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
 	struct spi_message msg;
 	int i, len;
 	u8 *ptr;
+	u8 *rx_buf;
 	int sum;
 	int ret = 0, final_ret;
 
@@ -242,10 +506,17 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
 			ndelay(EC_SPI_RECOVERY_TIME_NS - delay);
 	}
 
+	rx_buf = kzalloc(len, GFP_KERNEL);
+	if (!rx_buf) {
+		ret = -ENOMEM;
+		goto exit;
+	}
+
 	/* Transmit phase - send our message */
 	debug_packet(ec_dev->dev, "out", ec_dev->dout, len);
 	memset(&trans, 0, sizeof(trans));
 	trans.tx_buf = ec_dev->dout;
+	trans.rx_buf = rx_buf;
 	trans.len = len;
 	trans.cs_change = 1;
 	spi_message_init(&msg);
@@ -254,29 +525,32 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
 
 	/* Get the response */
 	if (!ret) {
-		ret = cros_ec_spi_receive_response(ec_dev,
-				ec_msg->insize + EC_MSG_TX_PROTO_BYTES);
+		/* Verify that EC can process command */
+		for (i = 0; i < len; i++) {
+			switch (rx_buf[i]) {
+			case EC_SPI_PAST_END:
+			case EC_SPI_RX_BAD_DATA:
+			case EC_SPI_NOT_READY:
+				ret = -EAGAIN;
+				ec_msg->result = EC_RES_IN_PROGRESS;
+			default:
+				break;
+			}
+			if (ret)
+				break;
+		}
+		if (!ret)
+			ret = cros_ec_spi_receive_response(ec_dev,
+					ec_msg->insize + EC_MSG_TX_PROTO_BYTES);
 	} else {
 		dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
 	}
 
-	/*
-	 * Turn off CS, possibly adding a delay to ensure the rising edge
-	 * doesn't come too soon after the end of the data.
-	 */
-	spi_message_init(&msg);
-	memset(&trans, 0, sizeof(trans));
-	trans.delay_usecs = ec_spi->end_of_msg_delay;
-	spi_message_add_tail(&trans, &msg);
-
-	final_ret = spi_sync(ec_spi->spi, &msg);
-	ec_spi->last_transfer_ns = ktime_get_ns();
+	final_ret = terminate_request(ec_dev);
 	if (!ret)
 		ret = final_ret;
-	if (ret < 0) {
-		dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
+	if (ret < 0)
 		goto exit;
-	}
 
 	ptr = ec_dev->din;
 
@@ -315,6 +589,7 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
 
 	ret = len;
 exit:
+	kfree(rx_buf);
 	if (ec_msg->command == EC_CMD_REBOOT_EC)
 		msleep(EC_REBOOT_DELAY_MS);
 
@@ -361,7 +636,7 @@ static int cros_ec_spi_probe(struct spi_device *spi)
 	ec_dev->priv = ec_spi;
 	ec_dev->irq = spi->irq;
 	ec_dev->cmd_xfer = cros_ec_cmd_xfer_spi;
-	ec_dev->pkt_xfer = NULL;
+	ec_dev->pkt_xfer = cros_ec_pkt_xfer_spi;
 	ec_dev->ec_name = ec_spi->spi->modalias;
 	ec_dev->phys_name = dev_name(&ec_spi->spi->dev);
 	ec_dev->din_size = EC_MSG_PREAMBLE_COUNT +
@@ -369,6 +644,7 @@ static int cros_ec_spi_probe(struct spi_device *spi)
 			   sizeof(struct ec_response_get_protocol_info);
 	ec_dev->dout_size = sizeof(struct ec_host_request);
 
+
 	err = cros_ec_register(ec_dev);
 	if (err) {
 		dev_err(dev, "cannot register EC\n");
diff --git a/drivers/platform/chrome/cros_ec_lpc.c b/drivers/platform/chrome/cros_ec_lpc.c
index d56dfb9dd463..e98b0345288a 100644
--- a/drivers/platform/chrome/cros_ec_lpc.c
+++ b/drivers/platform/chrome/cros_ec_lpc.c
@@ -46,6 +46,77 @@ static int ec_response_timed_out(void)
 	return 1;
 }
 
+static int cros_ec_pkt_xfer_lpc(struct cros_ec_device *ec,
+				struct cros_ec_command *msg)
+{
+	struct ec_host_request *request;
+	struct ec_host_response response;
+	u8 sum = 0;
+	int i;
+	int ret = 0;
+	u8 *dout;
+
+	ret = cros_ec_prepare_tx(ec, msg);
+
+	/* Write buffer */
+	for (i = 0; i < ret; i++)
+		outb(ec->dout[i], EC_LPC_ADDR_HOST_PACKET + i);
+
+	request = (struct ec_host_request *)ec->dout;
+
+	/* Here we go */
+	outb(EC_COMMAND_PROTOCOL_3, EC_LPC_ADDR_HOST_CMD);
+
+	if (ec_response_timed_out()) {
+		dev_warn(ec->dev, "EC responsed timed out\n");
+		ret = -EIO;
+		goto done;
+	}
+
+	/* Check result */
+	msg->result = inb(EC_LPC_ADDR_HOST_DATA);
+	ret = cros_ec_check_result(ec, msg);
+	if (ret)
+		goto done;
+
+	/* Read back response */
+	dout = (u8 *)&response;
+	for (i = 0; i < sizeof(response); i++) {
+		dout[i] = inb(EC_LPC_ADDR_HOST_PACKET + i);
+		sum += dout[i];
+	}
+
+	msg->result = response.result;
+
+	if (response.data_len > msg->insize) {
+		dev_err(ec->dev,
+			"packet too long (%d bytes, expected %d)",
+			response.data_len, msg->insize);
+		ret = -EMSGSIZE;
+		goto done;
+	}
+
+	/* Read response and process checksum */
+	for (i = 0; i < response.data_len; i++) {
+		msg->data[i] =
+			inb(EC_LPC_ADDR_HOST_PACKET + sizeof(response) + i);
+		sum += msg->data[i];
+	}
+
+	if (sum) {
+		dev_err(ec->dev,
+			"bad packet checksum %02x\n",
+			response.checksum);
+		ret = -EBADMSG;
+		goto done;
+	}
+
+	/* Return actual amount of data received */
+	ret = response.data_len;
+done:
+	return ret;
+}
+
 static int cros_ec_cmd_xfer_lpc(struct cros_ec_device *ec,
 				struct cros_ec_command *msg)
 {
@@ -205,7 +276,7 @@ static int cros_ec_lpc_probe(struct platform_device *pdev)
 	ec_dev->ec_name = pdev->name;
 	ec_dev->phys_name = dev_name(dev);
 	ec_dev->cmd_xfer = cros_ec_cmd_xfer_lpc;
-	ec_dev->pkt_xfer = NULL;
+	ec_dev->pkt_xfer = cros_ec_pkt_xfer_lpc;
 	ec_dev->cmd_readmem = cros_ec_lpc_readmem;
 	ec_dev->din_size = sizeof(struct ec_host_response) +
 			   sizeof(struct ec_response_get_protocol_info);
diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
index f27ce4b7736b..7a201caa60c8 100644
--- a/include/linux/mfd/cros_ec.h
+++ b/include/linux/mfd/cros_ec.h
@@ -22,6 +22,12 @@
 #include <linux/mutex.h>
 
 /*
+ * The EC is unresponsive for a time after a reboot command.  Add a
+ * simple delay to make sure that the bus stays locked.
+ */
+#define EC_REBOOT_DELAY_MS             50
+
+/*
  * Max bus-specific overhead incurred by request/responses.
  * I2C requires 1 additional byte for requests.
  * I2C requires 2 additional bytes for responses.
-- 
2.1.4

Re: [RESEND PATCH 0/8] cros_ec: Add multiple EC and protocol v3 support

[Javier Martinez Canillas]

Hello,

On 04/06/2015 06:14 PM, Javier Martinez Canillas wrote:
> 
> Newer Chromebooks have more than one Embedded Controller (EC) in the
> system. These additional ECs are connected through I2C with a host EC
> which is the one that is connected to the Application Processor (AP)
> through I2C, SPI or LPC.
> 
> So on these platforms, sub-processors are chained to each other:
> 
> AP <--> Host EC <--> Power Delivery (PD) EC
> 
> The AP sends commands to the additional EC through the host EC using
> a set of passthru commands and the host redirects to the correct EC.
> 
> This series adds support for multiple EC in a system and also for the
> protocol version 3 that is used on newer ECs.
> 

Any comments about this series? I know that we are in the middle of the
merge window but it would be great if I can get some feedback to get it
ready and re-post for 4.2 (addressing any issue) once 4.1-rc1 is out.

> Most patches were taken from the downstream ChromiumOS v3.14 tree with
> fixes squashed, split to minimise the cross subsystem churn and changes
> for mainline inclusion but were not modified functionality wise.
> 
> The series depend on "platform/chrome: Add user-space dev inferface support"
> [0] that is already merged in the chrome-platform tree so probably these
> patches should also go through that tree once the mfd patches are acked.
> 
> The series is a resend of a patch-set posted a month ago [1]. The only big

As I said, the original patchset was post about a month ago and this re-sent
10 days ago so it would be great to have some feedback on the series.

[snip]

> 
> [0]: https://lkml.org/lkml/2015/2/2/214
> [1]: https://lkml.org/lkml/2015/3/12/621
> [2]: http://cgit.collabora.com/git/user/javier/ec.git/log/?h=mainline-ioctl-zero-length
> 

Best regards,
Javier

Re: [RESEND PATCH 4/8] mfd: cros_ec: Use a zero-length array for command data

[Heiko Stübner]

Am Montag, 6. April 2015, 18:15:02 schrieb Javier Martinez Canillas:
> Commit 1b84f2a4cd4a ("mfd: cros_ec: Use fixed size arrays to transfer
> data with the EC") modified the struct cros_ec_command fields to not
> use pointers for the input and output buffers and use fixed length
> arrays instead.
> 
> This change was made because the cros_ec ioctl API uses that struct
> cros_ec_command to allow user-space to send commands to the EC and
> to get data from the EC. So using pointers made the API not 64-bit
> safe. Unfortunately this approach was not flexible enough for all
> the use-cases since there may be a need to send larger commands
> on newer versions of the EC command protocol.
> 
> So to avoid to choose a constant length that it may be too big for
> most commands and thus wasting memory and CPU cycles on copy from
> and to user-space or having a size that is too small for some big
> commands, use a zero-length array that is both 64-bit safe and
> flexible. The same buffer is used for both output and input data
> so the maximum of these values should be used to allocate it.
> 
> Suggested-by: Gwendal Grignou <gwendal@chromium.org>
> Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
> ---

[...]

>  /* Module initialization */
> @@ -269,3 +301,4 @@ void ec_dev_sysfs_remove(struct cros_ec_device *ec)
>  {
>  	sysfs_remove_group(&ec->vdev->kobj, &ec_attr_group);
>  }
> +

.git/rebase-apply/patch:893: new blank line at EOF.


> diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
> index 14cf522123dd..7eee38abd02a 100644
> --- a/include/linux/mfd/cros_ec.h
> +++ b/include/linux/mfd/cros_ec.h

Re: [RESEND PATCH 0/8] cros_ec: Add multiple EC and protocol v3 support

[Heiko Stübner]

Hi Javier,

Am Donnerstag, 16. April 2015, 09:29:59 schrieb Javier Martinez Canillas:
> Hello,
> 
> On 04/06/2015 06:14 PM, Javier Martinez Canillas wrote:
> > Newer Chromebooks have more than one Embedded Controller (EC) in the
> > system. These additional ECs are connected through I2C with a host EC
> > which is the one that is connected to the Application Processor (AP)
> > through I2C, SPI or LPC.
> > 
> > So on these platforms, sub-processors are chained to each other:
> > 
> > AP <--> Host EC <--> Power Delivery (PD) EC
> > 
> > The AP sends commands to the additional EC through the host EC using
> > a set of passthru commands and the host redirects to the correct EC.
> > 
> > This series adds support for multiple EC in a system and also for the
> > protocol version 3 that is used on newer ECs.
> 
> Any comments about this series? I know that we are in the middle of the
> merge window but it would be great if I can get some feedback to get it
> ready and re-post for 4.2 (addressing any issue) once 4.1-rc1 is out.
> 
> > Most patches were taken from the downstream ChromiumOS v3.14 tree with
> > fixes squashed, split to minimise the cross subsystem churn and changes
> > for mainline inclusion but were not modified functionality wise.
> > 
> > The series depend on "platform/chrome: Add user-space dev inferface
> > support" [0] that is already merged in the chrome-platform tree so
> > probably these patches should also go through that tree once the mfd
> > patches are acked.
> > 
> > The series is a resend of a patch-set posted a month ago [1]. The only big
> 
> As I said, the original patchset was post about a month ago and this re-sent
> 10 days ago so it would be great to have some feedback on the series.

on a veyron-pinky-rev2, with
cros-ec-spi spi0.0: using proto v3
cros-ec-spi spi0.0: no PD chip found: -19

Tested-by: Heiko Stuebner <heiko@sntech.de>


with the catch of the device needing two additional patches from the Chromeos-
tree:

c7ae1e2ef996 mfd: cros ec: spi: put the delay and send msg in one cycle
8558460450c1 mfd: cros ec: spi: Add delay for asserting CS

and I'm not sure if they are submitted yet.


Heiko

Re: [RESEND PATCH 4/8] mfd: cros_ec: Use a zero-length array for command data

[Javier Martinez Canillas]

Hello Heiko,

[snip]

On 04/16/2015 11:45 AM, Heiko Stübner wrote:
> 
>>  /* Module initialization */
>> @@ -269,3 +301,4 @@ void ec_dev_sysfs_remove(struct cros_ec_device *ec)
>>  {
>>  	sysfs_remove_group(&ec->vdev->kobj, &ec_attr_group);
>>  }
>> +
> 
> .git/rebase-apply/patch:893: new blank line at EOF.
> 
> 

Thanks for pointing out this, I'll fix it when re-posting after 4.1-rc1.

Best regards,
Javier

Re: [RESEND PATCH 0/8] cros_ec: Add multiple EC and protocol v3 support

[Javier Martinez Canillas]

Hello Heiko,

On 04/16/2015 11:49 AM, Heiko Stübner wrote:
> Hi Javier,
> 
> Am Donnerstag, 16. April 2015, 09:29:59 schrieb Javier Martinez Canillas:
>> Hello,
>> 
>> On 04/06/2015 06:14 PM, Javier Martinez Canillas wrote:
>> > Newer Chromebooks have more than one Embedded Controller (EC) in the
>> > system. These additional ECs are connected through I2C with a host EC
>> > which is the one that is connected to the Application Processor (AP)
>> > through I2C, SPI or LPC.
>> > 
>> > So on these platforms, sub-processors are chained to each other:
>> > 
>> > AP <--> Host EC <--> Power Delivery (PD) EC
>> > 
>> > The AP sends commands to the additional EC through the host EC using
>> > a set of passthru commands and the host redirects to the correct EC.
>> > 
>> > This series adds support for multiple EC in a system and also for the
>> > protocol version 3 that is used on newer ECs.
>> 
>> Any comments about this series? I know that we are in the middle of the
>> merge window but it would be great if I can get some feedback to get it
>> ready and re-post for 4.2 (addressing any issue) once 4.1-rc1 is out.
>> 
>> > Most patches were taken from the downstream ChromiumOS v3.14 tree with
>> > fixes squashed, split to minimise the cross subsystem churn and changes
>> > for mainline inclusion but were not modified functionality wise.
>> > 
>> > The series depend on "platform/chrome: Add user-space dev inferface
>> > support" [0] that is already merged in the chrome-platform tree so
>> > probably these patches should also go through that tree once the mfd
>> > patches are acked.
>> > 
>> > The series is a resend of a patch-set posted a month ago [1]. The only big
>> 
>> As I said, the original patchset was post about a month ago and this re-sent
>> 10 days ago so it would be great to have some feedback on the series.
> 
> on a veyron-pinky-rev2, with
> cros-ec-spi spi0.0: using proto v3
> cros-ec-spi spi0.0: no PD chip found: -19
> 
> Tested-by: Heiko Stuebner <heiko@sntech.de>
> 

Thanks a lot for testing!

> 
> with the catch of the device needing two additional patches from the Chromeos-
> tree:
> 
> c7ae1e2ef996 mfd: cros ec: spi: put the delay and send msg in one cycle
> 8558460450c1 mfd: cros ec: spi: Add delay for asserting CS
> 
> and I'm not sure if they are submitted yet.

Yes, those patches have not been posted yet. The delta for the cros_ec
drivers between the ChromiumOS tree and mainline is still very big but
I've been trying to reduce it with each series.

I was planning to include those in the next series once this one lands.
You can refer to http://crbug.com/391797 for the current status.

> 
> 
> Heiko
> 

Best regards,
Javier

Re: [RESEND PATCH 1/8] mfd: cros ec: Remove parent field

[Gwendal Grignou]

Be consistent, use cros_ec instead of "cros ec" or "cros-ec".
Otherwise:

Reviewed-by: Gwendal Grignou <gwendal@chromium.org>
Tested-by: Gwendal Grignou <gwendal@chromium.org>

On Mon, Apr 6, 2015 at 9:14 AM, Javier Martinez Canillas
<javier.martinez@collabora.co.uk> wrote:
> From: Gwendal Grignou <gwendal@chromium.org>
>
> parent and dev were pointing to the same device structure.
> parent is unused, removed.
>
> Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
> Reviewed-by: Stephen Barber <smbarber@chromium.org>
> Tested-by: Stephen Barber <smbarber@chromium.org>
> Reviewed-by: Puthikorn Voravootivat <puthik@chromium.org>
> Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
> ---
>  drivers/mfd/cros_ec_i2c.c             | 1 -
>  drivers/mfd/cros_ec_spi.c             | 1 -
>  drivers/platform/chrome/cros_ec_lpc.c | 1 -
>  include/linux/mfd/cros_ec.h           | 2 --
>  4 files changed, 5 deletions(-)
>
> diff --git a/drivers/mfd/cros_ec_i2c.c b/drivers/mfd/cros_ec_i2c.c
> index c0c30f4f946f..82b4d6148698 100644
> --- a/drivers/mfd/cros_ec_i2c.c
> +++ b/drivers/mfd/cros_ec_i2c.c
> @@ -145,7 +145,6 @@ static int cros_ec_i2c_probe(struct i2c_client *client,
>         ec_dev->cmd_xfer = cros_ec_cmd_xfer_i2c;
>         ec_dev->ec_name = client->name;
>         ec_dev->phys_name = client->adapter->name;
> -       ec_dev->parent = &client->dev;
>
>         err = cros_ec_register(ec_dev);
>         if (err) {
> diff --git a/drivers/mfd/cros_ec_spi.c b/drivers/mfd/cros_ec_spi.c
> index bf6e08e8013e..27bd52e5e8b7 100644
> --- a/drivers/mfd/cros_ec_spi.c
> +++ b/drivers/mfd/cros_ec_spi.c
> @@ -363,7 +363,6 @@ static int cros_ec_spi_probe(struct spi_device *spi)
>         ec_dev->cmd_xfer = cros_ec_cmd_xfer_spi;
>         ec_dev->ec_name = ec_spi->spi->modalias;
>         ec_dev->phys_name = dev_name(&ec_spi->spi->dev);
> -       ec_dev->parent = &ec_spi->spi->dev;
>         ec_dev->din_size = EC_MSG_BYTES + EC_MSG_PREAMBLE_COUNT;
>         ec_dev->dout_size = EC_MSG_BYTES;
>
> diff --git a/drivers/platform/chrome/cros_ec_lpc.c b/drivers/platform/chrome/cros_ec_lpc.c
> index 8f9ac4d7bbd0..860310513cf0 100644
> --- a/drivers/platform/chrome/cros_ec_lpc.c
> +++ b/drivers/platform/chrome/cros_ec_lpc.c
> @@ -214,7 +214,6 @@ static int cros_ec_lpc_probe(struct platform_device *pdev)
>         ec_dev->dev = dev;
>         ec_dev->ec_name = pdev->name;
>         ec_dev->phys_name = dev_name(dev);
> -       ec_dev->parent = dev;
>         ec_dev->cmd_xfer = cros_ec_cmd_xfer_lpc;
>         ec_dev->cmd_readmem = cros_ec_lpc_readmem;
>
> diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
> index 324a34683971..14cf522123dd 100644
> --- a/include/linux/mfd/cros_ec.h
> +++ b/include/linux/mfd/cros_ec.h
> @@ -85,7 +85,6 @@ struct cros_ec_command {
>   * to using dword.
>   * @din_size: size of din buffer to allocate (zero to use static din)
>   * @dout_size: size of dout buffer to allocate (zero to use static dout)
> - * @parent: pointer to parent device (e.g. i2c or spi device)
>   * @wake_enabled: true if this device can wake the system from sleep
>   * @cmd_xfer: send command to EC and get response
>   *     Returns the number of bytes received if the communication succeeded, but
> @@ -113,7 +112,6 @@ struct cros_ec_device {
>         uint8_t *dout;
>         int din_size;
>         int dout_size;
> -       struct device *parent;
>         bool wake_enabled;
>         int (*cmd_xfer)(struct cros_ec_device *ec,
>                         struct cros_ec_command *msg);
> --
> 2.1.4
>

Re: [RESEND PATCH 5/8] mfd: cros-ec: Support multiple EC in a system

[Gwendal Grignou]

This patch needs  https://chromium-review.googlesource.com/217297:
/dev/cros_ec0 was not a good idea, because it is difficult to know
what it represents.

On Mon, Apr 6, 2015 at 9:15 AM, Javier Martinez Canillas
<javier.martinez@collabora.co.uk> wrote:
> From: Gwendal Grignou <gwendal@chromium.org>
>
> Chromebooks can have more than one Embedded Controller so the
> cros_ec device id has to be incremented for each EC registered.
>
> Add code to handle multiple EC. First ec found is cros-ec0,
cros_ec0
> second cros-ec1 and so on.
cros_ec1
>
> Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
> Reviewed-by: Dmitry Torokhov <dtor@chromium.org>
> Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
> ---
>  drivers/mfd/cros_ec.c                 | 7 ++++++-
>  drivers/platform/chrome/cros_ec_dev.c | 4 ++--
>  include/linux/mfd/cros_ec.h           | 2 ++
>  3 files changed, 10 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/mfd/cros_ec.c b/drivers/mfd/cros_ec.c
> index c532dbca7404..70f6e55a096e 100644
> --- a/drivers/mfd/cros_ec.c
> +++ b/drivers/mfd/cros_ec.c
> @@ -28,6 +28,8 @@
>
>  #define EC_COMMAND_RETRIES     50
>
> +static int dev_id;
> +
>  int cros_ec_prepare_tx(struct cros_ec_device *ec_dev,
>                        struct cros_ec_command *msg)
>  {
> @@ -130,6 +132,8 @@ int cros_ec_register(struct cros_ec_device *ec_dev)
>         struct device *dev = ec_dev->dev;
>         int err = 0;
>
> +       ec_dev->id = dev_id;
> +
>         if (ec_dev->din_size) {
>                 ec_dev->din = devm_kzalloc(dev, ec_dev->din_size, GFP_KERNEL);
>                 if (!ec_dev->din)
> @@ -143,7 +147,7 @@ int cros_ec_register(struct cros_ec_device *ec_dev)
>
>         mutex_init(&ec_dev->lock);
>
> -       err = mfd_add_devices(dev, 0, cros_devs,
> +       err = mfd_add_devices(dev, ec_dev->id, cros_devs,
>                               ARRAY_SIZE(cros_devs),
>                               NULL, ec_dev->irq, NULL);
>         if (err) {
> @@ -159,6 +163,7 @@ int cros_ec_register(struct cros_ec_device *ec_dev)
>                 return err;
>         }
>  #endif
> +       dev_id += ARRAY_SIZE(cros_devs);
>
>         dev_info(dev, "Chrome EC device registered\n");
>
> diff --git a/drivers/platform/chrome/cros_ec_dev.c b/drivers/platform/chrome/cros_ec_dev.c
> index e7e50f18097f..7173f0ea6ae5 100644
> --- a/drivers/platform/chrome/cros_ec_dev.c
> +++ b/drivers/platform/chrome/cros_ec_dev.c
> @@ -191,7 +191,7 @@ static int ec_device_probe(struct platform_device *pdev)
>  {
>         struct cros_ec_device *ec = dev_get_drvdata(pdev->dev.parent);
>         int retval = -ENOTTY;
> -       dev_t devno = MKDEV(ec_major, 0);
> +       dev_t devno = MKDEV(ec_major, ec->id);
>
>         /* Instantiate it (and remember the EC) */
>         cdev_init(&ec->cdev, &fops);
> @@ -203,7 +203,7 @@ static int ec_device_probe(struct platform_device *pdev)
>         }
>
>         ec->vdev = device_create(cros_class, NULL, devno, ec,
> -                                CROS_EC_DEV_NAME);
> +                                CROS_EC_DEV_NAME "%d", ec->id);
>         if (IS_ERR(ec->vdev)) {
>                 retval = PTR_ERR(ec->vdev);
>                 dev_err(&pdev->dev, ": failed to create device\n");
> diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
> index 7eee38abd02a..2bee6ac74ffb 100644
> --- a/include/linux/mfd/cros_ec.h
> +++ b/include/linux/mfd/cros_ec.h
> @@ -72,6 +72,7 @@ struct cros_ec_command {
>   *
>   * @priv: Private data
>   * @irq: Interrupt to use
> + * @id: Device id
>   * @din: input buffer (for data from EC)
>   * @dout: output buffer (for data to EC)
>   * \note
> @@ -106,6 +107,7 @@ struct cros_ec_device {
>         /* These are used to implement the platform-specific interface */
>         void *priv;
>         int irq;
> +       int id;
>         uint8_t *din;
>         uint8_t *dout;
>         int din_size;
> --
> 2.1.4
>

Re: [RESEND PATCH 4/8] mfd: cros_ec: Use a zero-length array for command data

[Gwendal Grignou]

In general we can use kmalloc instead of kzalloc. Also some commands
do not need malloc at all. We could allocate on stack for known small
commands and for the keyboard case use the caller argument.

Gwendal.

On Mon, Apr 6, 2015 at 9:15 AM, Javier Martinez Canillas
<javier.martinez@collabora.co.uk> wrote:
> Commit 1b84f2a4cd4a ("mfd: cros_ec: Use fixed size arrays to transfer
> data with the EC") modified the struct cros_ec_command fields to not
> use pointers for the input and output buffers and use fixed length
> arrays instead.
>
> This change was made because the cros_ec ioctl API uses that struct
> cros_ec_command to allow user-space to send commands to the EC and
> to get data from the EC. So using pointers made the API not 64-bit
> safe. Unfortunately this approach was not flexible enough for all
> the use-cases since there may be a need to send larger commands
> on newer versions of the EC command protocol.
>
> So to avoid to choose a constant length that it may be too big for
> most commands and thus wasting memory and CPU cycles on copy from
> and to user-space or having a size that is too small for some big
> commands, use a zero-length array that is both 64-bit safe and
> flexible. The same buffer is used for both output and input data
> so the maximum of these values should be used to allocate it.
>
> Suggested-by: Gwendal Grignou <gwendal@chromium.org>
> Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
> ---
>  drivers/i2c/busses/i2c-cros-ec-tunnel.c    |  44 ++++++---
>  drivers/input/keyboard/cros_ec_keyb.c      |  27 ++++--
>  drivers/mfd/cros_ec.c                      |  26 +++--
>  drivers/mfd/cros_ec_i2c.c                  |   4 +-
>  drivers/mfd/cros_ec_spi.c                  |   2 +-
>  drivers/platform/chrome/cros_ec_dev.c      |  49 ++++++----
>  drivers/platform/chrome/cros_ec_lightbar.c | 151 +++++++++++++++++++----------
>  drivers/platform/chrome/cros_ec_lpc.c      |   8 +-
>  drivers/platform/chrome/cros_ec_sysfs.c    | 149 +++++++++++++++++-----------
>  include/linux/mfd/cros_ec.h                |   6 +-
>  10 files changed, 297 insertions(+), 169 deletions(-)
>
> diff --git a/drivers/i2c/busses/i2c-cros-ec-tunnel.c b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
> index fa8dedd8c3a2..4139ede8e6ed 100644
> --- a/drivers/i2c/busses/i2c-cros-ec-tunnel.c
> +++ b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
> @@ -183,7 +183,7 @@ static int ec_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg i2c_msgs[],
>         int request_len;
>         int response_len;
>         int result;
> -       struct cros_ec_command msg = { };
> +       struct cros_ec_command *msg;
>
>         request_len = ec_i2c_count_message(i2c_msgs, num);
>         if (request_len < 0) {
> @@ -198,25 +198,39 @@ static int ec_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg i2c_msgs[],
>                 return response_len;
>         }
>
> -       result = ec_i2c_construct_message(msg.outdata, i2c_msgs, num, bus_num);
> -       if (result)
> -               return result;
> +       msg = kzalloc(sizeof(*msg) + max(request_len, response_len),
I2C commands are generally very small. We may want to pre-allocate a
small message and use kmalloc for larger one.
They usually come in pair: write 1 byte (the address), read/write 1
byte (the data).
Therefore a message that can accommodate 4 bytes for request and 4
bytes response would be plenty.
Also kmalloc is better than kzalloc, given we initialize the message
in ec_i2c_construct_message() bellow.

> +                     GFP_KERNEL);
> +       if (!msg)
> +               return -ENOMEM;
>
> -       msg.version = 0;
> -       msg.command = EC_CMD_I2C_PASSTHRU;
> -       msg.outsize = request_len;
> -       msg.insize = response_len;
> +       result = ec_i2c_construct_message(msg->data, i2c_msgs, num, bus_num);
> +       if (result) {
> +               dev_err(dev, "Error constructing EC i2c message %d\n", result);
> +               goto exit;
> +       }
>
> -       result = cros_ec_cmd_xfer(bus->ec, &msg);
> -       if (result < 0)
> -               return result;
> +       msg->version = 0;
> +       msg->command = EC_CMD_I2C_PASSTHRU;
> +       msg->outsize = request_len;
> +       msg->insize = response_len;
>
> -       result = ec_i2c_parse_response(msg.indata, i2c_msgs, &num);
> -       if (result < 0)
> -               return result;
> +       result = cros_ec_cmd_xfer(bus->ec, msg);
> +       if (result < 0) {
> +               dev_err(dev, "Error transferring EC i2c message %d\n", result);
> +               goto exit;
> +       }
> +
> +       result = ec_i2c_parse_response(msg->data, i2c_msgs, &num);
> +       if (result < 0) {
> +               dev_err(dev, "Error parsing EC i2c message %d\n", result);
> +               goto exit;
> +       }
>
>         /* Indicate success by saying how many messages were sent */
> -       return num;
> +       result = num;
> +exit:
> +       kfree(msg);
> +       return result;
>  }
>
>  static u32 ec_i2c_functionality(struct i2c_adapter *adap)
> diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c
> index 769f8f7f62b7..df12cf15b306 100644
> --- a/drivers/input/keyboard/cros_ec_keyb.c
> +++ b/drivers/input/keyboard/cros_ec_keyb.c
> @@ -148,19 +148,26 @@ static void cros_ec_keyb_process(struct cros_ec_keyb *ckdev,
>
>  static int cros_ec_keyb_get_state(struct cros_ec_keyb *ckdev, uint8_t *kb_state)
>  {
> -       int ret;
> -       struct cros_ec_command msg = {
> -               .command = EC_CMD_MKBP_STATE,
> -               .insize = ckdev->cols,
> -       };
> +       int ret = 0;
> +       struct cros_ec_command *msg;
>
> -       ret = cros_ec_cmd_xfer(ckdev->ec, &msg);
> -       if (ret < 0)
> -               return ret;
> +       msg = kzalloc(sizeof(*msg) + ckdev->cols, GFP_KERNEL);
This kzalloc would not be necessary if kb_state (an array of already
ckdev->cols bytes) also include struct cros_ec_command.
> +       if (!msg)
> +               return -ENOMEM;
>
> -       memcpy(kb_state, msg.indata, ckdev->cols);
> +       msg->command = EC_CMD_MKBP_STATE;
> +       msg->insize = ckdev->cols;
>
> -       return 0;
> +       ret = cros_ec_cmd_xfer(ckdev->ec, msg);
> +       if (ret < 0) {
> +               dev_err(ckdev->dev, "Error transferring EC message %d\n", ret);
> +               goto exit;
> +       }
> +
> +       memcpy(kb_state, msg->data, ckdev->cols);
> +exit:
> +       kfree(msg);
> +       return ret;
>  }
>
>  static irqreturn_t cros_ec_keyb_irq(int irq, void *data)
> diff --git a/drivers/mfd/cros_ec.c b/drivers/mfd/cros_ec.c
> index 8aa83b91e25c..c532dbca7404 100644
> --- a/drivers/mfd/cros_ec.c
> +++ b/drivers/mfd/cros_ec.c
> @@ -41,7 +41,7 @@ int cros_ec_prepare_tx(struct cros_ec_device *ec_dev,
>         out[2] = msg->outsize;
>         csum = out[0] + out[1] + out[2];
>         for (i = 0; i < msg->outsize; i++)
> -               csum += out[EC_MSG_TX_HEADER_BYTES + i] = msg->outdata[i];
> +               csum += out[EC_MSG_TX_HEADER_BYTES + i] = msg->data[i];
>         out[EC_MSG_TX_HEADER_BYTES + msg->outsize] = (uint8_t)(csum & 0xff);
>
>         return EC_MSG_TX_PROTO_BYTES + msg->outsize;
> @@ -75,11 +75,18 @@ int cros_ec_cmd_xfer(struct cros_ec_device *ec_dev,
>         ret = ec_dev->cmd_xfer(ec_dev, msg);
>         if (msg->result == EC_RES_IN_PROGRESS) {
>                 int i;
> -               struct cros_ec_command status_msg = { };
> +               struct cros_ec_command *status_msg;
>                 struct ec_response_get_comms_status *status;
>
> -               status_msg.command = EC_CMD_GET_COMMS_STATUS;
> -               status_msg.insize = sizeof(*status);
> +               status_msg = kzalloc(sizeof(*status_msg) + sizeof(*status),
> +                                    GFP_KERNEL);
kzalloc is not necessary: the size is well known, status_msg can be
allocated on the stack.
> +               if (!status_msg) {
> +                       ret = -ENOMEM;
> +                       goto exit;
> +               }
> +
> +               status_msg->command = EC_CMD_GET_COMMS_STATUS;
> +               status_msg->insize = sizeof(*status);
>
>                 /*
>                  * Query the EC's status until it's no longer busy or
> @@ -88,20 +95,23 @@ int cros_ec_cmd_xfer(struct cros_ec_device *ec_dev,
>                 for (i = 0; i < EC_COMMAND_RETRIES; i++) {
>                         usleep_range(10000, 11000);
>
> -                       ret = ec_dev->cmd_xfer(ec_dev, &status_msg);
> +                       ret = ec_dev->cmd_xfer(ec_dev, status_msg);
>                         if (ret < 0)
>                                 break;
>
> -                       msg->result = status_msg.result;
> -                       if (status_msg.result != EC_RES_SUCCESS)
> +                       msg->result = status_msg->result;
> +                       if (status_msg->result != EC_RES_SUCCESS)
>                                 break;
>
>                         status = (struct ec_response_get_comms_status *)
> -                                status_msg.indata;
> +                                status_msg->data;
>                         if (!(status->flags & EC_COMMS_STATUS_PROCESSING))
>                                 break;
>                 }
> +
> +               kfree(status_msg);
>         }
> +exit:
>         mutex_unlock(&ec_dev->lock);
>
>         return ret;
> diff --git a/drivers/mfd/cros_ec_i2c.c b/drivers/mfd/cros_ec_i2c.c
> index 82b4d6148698..fbf7819f5de5 100644
> --- a/drivers/mfd/cros_ec_i2c.c
> +++ b/drivers/mfd/cros_ec_i2c.c
> @@ -76,7 +76,7 @@ static int cros_ec_cmd_xfer_i2c(struct cros_ec_device *ec_dev,
>         /* copy message payload and compute checksum */
>         sum = out_buf[0] + out_buf[1] + out_buf[2];
>         for (i = 0; i < msg->outsize; i++) {
> -               out_buf[3 + i] = msg->outdata[i];
> +               out_buf[3 + i] = msg->data[i];
>                 sum += out_buf[3 + i];
>         }
>         out_buf[3 + msg->outsize] = sum;
> @@ -109,7 +109,7 @@ static int cros_ec_cmd_xfer_i2c(struct cros_ec_device *ec_dev,
>         /* copy response packet payload and compute checksum */
>         sum = in_buf[0] + in_buf[1];
>         for (i = 0; i < len; i++) {
> -               msg->indata[i] = in_buf[2 + i];
> +               msg->data[i] = in_buf[2 + i];
>                 sum += in_buf[2 + i];
>         }
>         dev_dbg(ec_dev->dev, "packet: %*ph, sum = %02x\n",
> diff --git a/drivers/mfd/cros_ec_spi.c b/drivers/mfd/cros_ec_spi.c
> index 27bd52e5e8b7..573730fec947 100644
> --- a/drivers/mfd/cros_ec_spi.c
> +++ b/drivers/mfd/cros_ec_spi.c
> @@ -299,7 +299,7 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
>         for (i = 0; i < len; i++) {
>                 sum += ptr[i + 2];
>                 if (ec_msg->insize)
> -                       ec_msg->indata[i] = ptr[i + 2];
> +                       ec_msg->data[i] = ptr[i + 2];
>         }
>         sum &= 0xff;
>
> diff --git a/drivers/platform/chrome/cros_ec_dev.c b/drivers/platform/chrome/cros_ec_dev.c
> index 6090d0b2826f..e7e50f18097f 100644
> --- a/drivers/platform/chrome/cros_ec_dev.c
> +++ b/drivers/platform/chrome/cros_ec_dev.c
> @@ -20,6 +20,7 @@
>  #include <linux/fs.h>
>  #include <linux/module.h>
>  #include <linux/platform_device.h>
> +#include <linux/slab.h>
>  #include <linux/uaccess.h>
>
>  #include "cros_ec_dev.h"
> @@ -36,28 +37,30 @@ static int ec_get_version(struct cros_ec_device *ec, char *str, int maxlen)
>         static const char * const current_image_name[] = {
>                 "unknown", "read-only", "read-write", "invalid",
>         };
> -       struct cros_ec_command msg = {
> -               .version = 0,
> -               .command = EC_CMD_GET_VERSION,
> -               .outdata = { 0 },
> -               .outsize = 0,
> -               .indata = { 0 },
> -               .insize = sizeof(*resp),
> -       };
> +       struct cros_ec_command *msg;
>         int ret;
>
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> +       msg = kzalloc(sizeof(*msg) + sizeof(*resp), GFP_KERNEL);
Same comment as cros_ec_cmd_xfer().
> +       if (!msg)
> +               return -ENOMEM;
> +
> +       msg->version = 0;
> +       msg->command = EC_CMD_GET_VERSION;
> +       msg->insize = sizeof(*resp);
> +
> +       ret = cros_ec_cmd_xfer(ec, msg);
>         if (ret < 0)
> -               return ret;
> +               goto exit;
>
> -       if (msg.result != EC_RES_SUCCESS) {
> +       if (msg->result != EC_RES_SUCCESS) {
>                 snprintf(str, maxlen,
>                          "%s\nUnknown EC version: EC returned %d\n",
> -                        CROS_EC_DEV_VERSION, msg.result);
> -               return 0;
> +                        CROS_EC_DEV_VERSION, msg->result);
> +               ret = -EINVAL;
> +               goto exit;
>         }
>
> -       resp = (struct ec_response_get_version *)msg.indata;
> +       resp = (struct ec_response_get_version *)msg->data;
>         if (resp->current_image >= ARRAY_SIZE(current_image_name))
>                 resp->current_image = 3; /* invalid */
>
> @@ -65,6 +68,8 @@ static int ec_get_version(struct cros_ec_device *ec, char *str, int maxlen)
>                  resp->version_string_ro, resp->version_string_rw,
>                  current_image_name[resp->current_image]);
>
> +exit:
> +       kfree(msg);
>         return 0;
>  }
>
> @@ -110,17 +115,25 @@ static ssize_t ec_device_read(struct file *filp, char __user *buffer,
>  static long ec_device_ioctl_xcmd(struct cros_ec_device *ec, void __user *arg)
>  {
>         long ret;
> -       struct cros_ec_command s_cmd = { };
> +       int len;
> +       struct cros_ec_command *u_cmd = arg;
> +       struct cros_ec_command *s_cmd;
> +
> +       len = max(u_cmd->outsize, u_cmd->insize);
> +
> +       s_cmd = kzalloc(sizeof(*s_cmd) + len, GFP_KERNEL);
For small commands we could preallocate the buffer ~64 bytes cover 80%
of the commands.
> +       if (!s_cmd)
> +               return -ENOMEM;
>
> -       if (copy_from_user(&s_cmd, arg, sizeof(s_cmd)))
> +       if (copy_from_user(s_cmd, arg, sizeof(*s_cmd) + len))
>                 return -EFAULT;
>
> -       ret = cros_ec_cmd_xfer(ec, &s_cmd);
> +       ret = cros_ec_cmd_xfer(ec, s_cmd);
>         /* Only copy data to userland if data was received. */
>         if (ret < 0)
>                 return ret;
>
> -       if (copy_to_user(arg, &s_cmd, sizeof(s_cmd)))
> +       if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + len))
>                 return -EFAULT;
>
>         return 0;
> diff --git a/drivers/platform/chrome/cros_ec_lightbar.c b/drivers/platform/chrome/cros_ec_lightbar.c
> index b4ff47a9069a..8ffec6649ead 100644
> --- a/drivers/platform/chrome/cros_ec_lightbar.c
> +++ b/drivers/platform/chrome/cros_ec_lightbar.c
> @@ -31,6 +31,7 @@
>  #include <linux/sched.h>
>  #include <linux/types.h>
>  #include <linux/uaccess.h>
> +#include <linux/slab.h>
>
>  #include "cros_ec_dev.h"
>
> @@ -91,54 +92,78 @@ out:
>         return ret;
>  }
>
> -#define INIT_MSG(P, R) { \
> -               .command = EC_CMD_LIGHTBAR_CMD, \
> -               .outsize = sizeof(*P), \
> -               .insize = sizeof(*R), \
> -       }
> +static struct cros_ec_command *alloc_command_msg(void)
Make it lightbar specific: alloc_lightbar_cmd__msg?
> +{
> +       struct cros_ec_command *msg;
> +       int len;
> +
> +       len = max(sizeof(struct ec_params_lightbar),
> +                 sizeof(struct ec_response_lightbar));
> +
> +       msg = kzalloc(sizeof(*msg) + len, GFP_KERNEL);
Use kmalloc. Given these commands are (currently) big, it does not
make sense to allocate them on the stack.
It will change with cl:
> +       if (!msg)
> +               return NULL;
> +
> +       msg->command = EC_CMD_LIGHTBAR_CMD;
> +       msg->outsize = sizeof(struct ec_params_lightbar);
> +       msg->insize = sizeof(struct ec_response_lightbar);
> +
> +       return msg;
> +}
>
>  static int get_lightbar_version(struct cros_ec_device *ec,
>                                 uint32_t *ver_ptr, uint32_t *flg_ptr)
>  {
>         struct ec_params_lightbar *param;
>         struct ec_response_lightbar *resp;
> -       struct cros_ec_command msg = INIT_MSG(param, resp);
> +       struct cros_ec_command *msg;
>         int ret;
>
> -       param = (struct ec_params_lightbar *)msg.outdata;
> -       param->cmd = LIGHTBAR_CMD_VERSION;
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> -       if (ret < 0)
> +       msg = alloc_command_msg();
> +       if (!msg)
>                 return 0;
>
> -       switch (msg.result) {
> +       param = (struct ec_params_lightbar *)msg->data;
> +       param->cmd = LIGHTBAR_CMD_VERSION;
> +       ret = cros_ec_cmd_xfer(ec, msg);
> +       if (ret < 0) {
> +               ret = 0;
> +               goto exit;
> +       }
> +
> +       switch (msg->result) {
>         case EC_RES_INVALID_PARAM:
>                 /* Pixel had no version command. */
>                 if (ver_ptr)
>                         *ver_ptr = 0;
>                 if (flg_ptr)
>                         *flg_ptr = 0;
> -               return 1;
> +               ret = 1;
> +               goto exit;
>
>         case EC_RES_SUCCESS:
> -               resp = (struct ec_response_lightbar *)msg.indata;
> +               resp = (struct ec_response_lightbar *)msg->data;
>
>                 /* Future devices w/lightbars should implement this command */
>                 if (ver_ptr)
>                         *ver_ptr = resp->version.num;
>                 if (flg_ptr)
>                         *flg_ptr = resp->version.flags;
> -               return 1;
> +               ret = 1;
> +               goto exit;
>         }
>
>         /* Anything else (ie, EC_RES_INVALID_COMMAND) - no lightbar */
> -       return 0;
> +       ret = 0;
> +exit:
> +       kfree(msg);
> +       return ret;
>  }
>
>  static ssize_t version_show(struct device *dev,
>                             struct device_attribute *attr, char *buf)
>  {
> -       uint32_t version, flags;
> +       uint32_t version = 0, flags = 0;
>         struct cros_ec_device *ec = dev_get_drvdata(dev);
>         int ret;
>
> @@ -158,8 +183,7 @@ static ssize_t brightness_store(struct device *dev,
>                                 const char *buf, size_t count)
>  {
>         struct ec_params_lightbar *param;
> -       struct ec_response_lightbar *resp;
> -       struct cros_ec_command msg = INIT_MSG(param, resp);
> +       struct cros_ec_command *msg;
>         int ret;
>         unsigned int val;
>         struct cros_ec_device *ec = dev_get_drvdata(dev);
> @@ -167,21 +191,30 @@ static ssize_t brightness_store(struct device *dev,
>         if (kstrtouint(buf, 0, &val))
>                 return -EINVAL;
>
> -       param = (struct ec_params_lightbar *)msg.outdata;
> +       msg = alloc_command_msg();
> +       if (!msg)
> +               return -ENOMEM;
> +
> +       param = (struct ec_params_lightbar *)msg->data;
>         param->cmd = LIGHTBAR_CMD_BRIGHTNESS;
>         param->brightness.num = val;
>         ret = lb_throttle();
>         if (ret)
> -               return ret;
> +               goto exit;
>
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> +       ret = cros_ec_cmd_xfer(ec, msg);
>         if (ret < 0)
> -               return ret;
> +               goto exit;
>
> -       if (msg.result != EC_RES_SUCCESS)
> -               return -EINVAL;
> +       if (msg->result != EC_RES_SUCCESS) {
> +               ret = -EINVAL;
> +               goto exit;
> +       }
>
> -       return count;
> +       ret = count;
> +exit:
> +       kfree(msg);
> +       return ret;
>  }
>
>
> @@ -196,12 +229,15 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
>                              const char *buf, size_t count)
>  {
>         struct ec_params_lightbar *param;
> -       struct ec_response_lightbar *resp;
> -       struct cros_ec_command msg = INIT_MSG(param, resp);
> +       struct cros_ec_command *msg;
>         struct cros_ec_device *ec = dev_get_drvdata(dev);
>         unsigned int val[4];
>         int ret, i = 0, j = 0, ok = 0;
>
> +       msg = alloc_command_msg();
> +       if (!msg)
> +               return -ENOMEM;
> +
>         do {
>                 /* Skip any whitespace */
>                 while (*buf && isspace(*buf))
> @@ -215,7 +251,7 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
>                         return -EINVAL;
>
>                 if (i == 4) {
> -                       param = (struct ec_params_lightbar *)msg.outdata;
> +                       param = (struct ec_params_lightbar *)msg->data;
>                         param->cmd = LIGHTBAR_CMD_RGB;
>                         param->rgb.led = val[0];
>                         param->rgb.red = val[1];
> @@ -231,12 +267,14 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
>                                         return ret;
>                         }
>
> -                       ret = cros_ec_cmd_xfer(ec, &msg);
> +                       ret = cros_ec_cmd_xfer(ec, msg);
>                         if (ret < 0)
> -                               return ret;
> +                               goto exit;
>
> -                       if (msg.result != EC_RES_SUCCESS)
> -                               return -EINVAL;
> +                       if (msg->result != EC_RES_SUCCESS) {
> +                               ret = -EINVAL;
> +                               goto exit;
> +                       }
>
>                         i = 0;
>                         ok = 1;
> @@ -248,6 +286,8 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
>
>         } while (*buf);
>
> +exit:
> +       kfree(msg);
>         return (ok && i == 0) ? count : -EINVAL;
>  }
>
> @@ -261,42 +301,55 @@ static ssize_t sequence_show(struct device *dev,
>  {
>         struct ec_params_lightbar *param;
>         struct ec_response_lightbar *resp;
> -       struct cros_ec_command msg = INIT_MSG(param, resp);
> +       struct cros_ec_command *msg;
>         int ret;
>         struct cros_ec_device *ec = dev_get_drvdata(dev);
>
> -       param = (struct ec_params_lightbar *)msg.outdata;
> +       msg = alloc_command_msg();
> +       if (!msg)
> +               return -ENOMEM;
> +
> +       param = (struct ec_params_lightbar *)msg->data;
>         param->cmd = LIGHTBAR_CMD_GET_SEQ;
>         ret = lb_throttle();
>         if (ret)
> -               return ret;
> +               goto exit;
>
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> +       ret = cros_ec_cmd_xfer(ec, msg);
>         if (ret < 0)
> -               return ret;
> +               goto exit;
>
> -       if (msg.result != EC_RES_SUCCESS)
> -               return scnprintf(buf, PAGE_SIZE,
> -                                "ERROR: EC returned %d\n", msg.result);
> +       if (msg->result != EC_RES_SUCCESS) {
> +               ret = scnprintf(buf, PAGE_SIZE,
> +                               "ERROR: EC returned %d\n", msg->result);
> +               goto exit;
> +       }
>
> -       resp = (struct ec_response_lightbar *)msg.indata;
> +       resp = (struct ec_response_lightbar *)msg->data;
>         if (resp->get_seq.num >= ARRAY_SIZE(seqname))
> -               return scnprintf(buf, PAGE_SIZE, "%d\n", resp->get_seq.num);
> +               ret = scnprintf(buf, PAGE_SIZE, "%d\n", resp->get_seq.num);
>         else
> -               return scnprintf(buf, PAGE_SIZE, "%s\n",
> -                                seqname[resp->get_seq.num]);
> +               ret = scnprintf(buf, PAGE_SIZE, "%s\n",
> +                               seqname[resp->get_seq.num]);
> +
> +exit:
> +       kfree(msg);
> +       return ret;
>  }
>
>  static ssize_t sequence_store(struct device *dev, struct device_attribute *attr,
>                               const char *buf, size_t count)
>  {
>         struct ec_params_lightbar *param;
> -       struct ec_response_lightbar *resp;
> -       struct cros_ec_command msg = INIT_MSG(param, resp);
> +       struct cros_ec_command *msg;
>         unsigned int num;
>         int ret, len;
>         struct cros_ec_device *ec = dev_get_drvdata(dev);
>
> +       msg = alloc_command_msg();
> +       if (!msg)
> +               return -ENOMEM;
> +
>         for (len = 0; len < count; len++)
>                 if (!isalnum(buf[len]))
>                         break;
> @@ -311,18 +364,18 @@ static ssize_t sequence_store(struct device *dev, struct device_attribute *attr,
>                         return ret;
>         }
>
> -       param = (struct ec_params_lightbar *)msg.outdata;
> +       param = (struct ec_params_lightbar *)msg->data;
>         param->cmd = LIGHTBAR_CMD_SEQ;
>         param->seq.num = num;
>         ret = lb_throttle();
>         if (ret)
>                 return ret;
>
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> +       ret = cros_ec_cmd_xfer(ec, msg);
>         if (ret < 0)
>                 return ret;
>
> -       if (msg.result != EC_RES_SUCCESS)
> +       if (msg->result != EC_RES_SUCCESS)
>                 return -EINVAL;
>
>         return count;
> diff --git a/drivers/platform/chrome/cros_ec_lpc.c b/drivers/platform/chrome/cros_ec_lpc.c
> index 3a675817c95d..32b1df29fc58 100644
> --- a/drivers/platform/chrome/cros_ec_lpc.c
> +++ b/drivers/platform/chrome/cros_ec_lpc.c
> @@ -73,8 +73,8 @@ static int cros_ec_cmd_xfer_lpc(struct cros_ec_device *ec,
>
>         /* Copy data and update checksum */
>         for (i = 0; i < msg->outsize; i++) {
> -               outb(msg->outdata[i], EC_LPC_ADDR_HOST_PARAM + i);
> -               csum += msg->outdata[i];
> +               outb(msg->data[i], EC_LPC_ADDR_HOST_PARAM + i);
> +               csum += msg->data[i];
>         }
>
>         /* Finalize checksum and write args */
> @@ -119,8 +119,8 @@ static int cros_ec_cmd_xfer_lpc(struct cros_ec_device *ec,
>
>         /* Read response and update checksum */
>         for (i = 0; i < args.data_size; i++) {
> -               msg->indata[i] = inb(EC_LPC_ADDR_HOST_PARAM + i);
> -               csum += msg->indata[i];
> +               msg->data[i] = inb(EC_LPC_ADDR_HOST_PARAM + i);
> +               csum += msg->data[i];
>         }
>
>         /* Verify checksum */
> diff --git a/drivers/platform/chrome/cros_ec_sysfs.c b/drivers/platform/chrome/cros_ec_sysfs.c
> index fb62ab6cc659..6f309f2b4efb 100644
> --- a/drivers/platform/chrome/cros_ec_sysfs.c
> +++ b/drivers/platform/chrome/cros_ec_sysfs.c
> @@ -29,6 +29,7 @@
>  #include <linux/module.h>
>  #include <linux/platform_device.h>
>  #include <linux/printk.h>
> +#include <linux/slab.h>
>  #include <linux/stat.h>
>  #include <linux/types.h>
>  #include <linux/uaccess.h>
> @@ -66,14 +67,19 @@ static ssize_t store_ec_reboot(struct device *dev,
>                 {"hibernate",    EC_REBOOT_HIBERNATE, 0},
>                 {"at-shutdown",  -1, EC_REBOOT_FLAG_ON_AP_SHUTDOWN},
>         };
> -       struct cros_ec_command msg = { 0 };
> -       struct ec_params_reboot_ec *param =
> -               (struct ec_params_reboot_ec *)msg.outdata;
> +       struct cros_ec_command *msg;
> +       struct ec_params_reboot_ec *param;
>         int got_cmd = 0, offset = 0;
>         int i;
>         int ret;
>         struct cros_ec_device *ec = dev_get_drvdata(dev);
>
> +       msg = kzalloc(sizeof(*msg) + sizeof(*param), GFP_KERNEL);
alloc on the stack.
> +       if (!msg)
> +               return -ENOMEM;
> +
> +       param = (struct ec_params_reboot_ec *)msg->data;
> +
>         param->flags = 0;
>         while (1) {
>                 /* Find word to start scanning */
> @@ -100,19 +106,25 @@ static ssize_t store_ec_reboot(struct device *dev,
>                         offset++;
>         }
>
> -       if (!got_cmd)
> -               return -EINVAL;
> +       if (!got_cmd) {
> +               count = -EINVAL;
> +               goto exit;
> +       }
>
> -       msg.command = EC_CMD_REBOOT_EC;
> -       msg.outsize = sizeof(param);
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> -       if (ret < 0)
> -               return ret;
> -       if (msg.result != EC_RES_SUCCESS) {
> -               dev_dbg(ec->dev, "EC result %d\n", msg.result);
> -               return -EINVAL;
> +       msg->command = EC_CMD_REBOOT_EC;
> +       msg->outsize = sizeof(*param);
> +       ret = cros_ec_cmd_xfer(ec, msg);
> +       if (ret < 0) {
> +               count = ret;
> +               goto exit;
> +       }
> +       if (msg->result != EC_RES_SUCCESS) {
> +               dev_err(ec->dev, "EC result %d\n", msg->result);
> +               count = -EINVAL;
>         }
>
> +exit:
> +       kfree(msg);
>         return count;
>  }
>
> @@ -123,22 +135,30 @@ static ssize_t show_ec_version(struct device *dev,
>         struct ec_response_get_version *r_ver;
>         struct ec_response_get_chip_info *r_chip;
>         struct ec_response_board_version *r_board;
> -       struct cros_ec_command msg = { 0 };
> +       struct cros_ec_command *msg;
>         int ret;
>         int count = 0;
>         struct cros_ec_device *ec = dev_get_drvdata(dev);
>
> +       msg = kzalloc(sizeof(*msg) + EC_HOST_PARAM_SIZE, GFP_KERNEL);
alloc on the stack.
> +       if (!msg)
> +               return -ENOMEM;
> +
>         /* Get versions. RW may change. */
> -       msg.command = EC_CMD_GET_VERSION;
> -       msg.insize = sizeof(*r_ver);
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> -       if (ret < 0)
> -               return ret;
> -       if (msg.result != EC_RES_SUCCESS)
> -               return scnprintf(buf, PAGE_SIZE,
> -                                "ERROR: EC returned %d\n", msg.result);
> +       msg->command = EC_CMD_GET_VERSION;
> +       msg->insize = sizeof(*r_ver);
> +       ret = cros_ec_cmd_xfer(ec, msg);
> +       if (ret < 0) {
> +               count = ret;
> +               goto exit;
> +       }
> +       if (msg->result != EC_RES_SUCCESS) {
> +               count = scnprintf(buf, PAGE_SIZE,
> +                                "ERROR: EC returned %d\n", msg->result);
> +               goto exit;
> +       }
>
> -       r_ver = (struct ec_response_get_version *)msg.indata;
> +       r_ver = (struct ec_response_get_version *)msg->data;
>         /* Strings should be null-terminated, but let's be sure. */
>         r_ver->version_string_ro[sizeof(r_ver->version_string_ro) - 1] = '\0';
>         r_ver->version_string_rw[sizeof(r_ver->version_string_rw) - 1] = '\0';
> @@ -152,33 +172,33 @@ static ssize_t show_ec_version(struct device *dev,
>                             image_names[r_ver->current_image] : "?"));
>
>         /* Get build info. */
> -       msg.command = EC_CMD_GET_BUILD_INFO;
> -       msg.insize = sizeof(msg.indata);
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> +       msg->command = EC_CMD_GET_BUILD_INFO;
> +       msg->insize = EC_HOST_PARAM_SIZE;
> +       ret = cros_ec_cmd_xfer(ec, msg);
>         if (ret < 0)
>                 count += scnprintf(buf + count, PAGE_SIZE - count,
>                                    "Build info:    XFER ERROR %d\n", ret);
> -       else if (msg.result != EC_RES_SUCCESS)
> +       else if (msg->result != EC_RES_SUCCESS)
>                 count += scnprintf(buf + count, PAGE_SIZE - count,
> -                                  "Build info:    EC error %d\n", msg.result);
> +                                  "Build info:    EC error %d\n", msg->result);
>         else {
> -               msg.indata[sizeof(msg.indata) - 1] = '\0';
> +               msg->data[sizeof(msg->data) - 1] = '\0';
>                 count += scnprintf(buf + count, PAGE_SIZE - count,
> -                                  "Build info:    %s\n", msg.indata);
> +                                  "Build info:    %s\n", msg->data);
>         }
>
>         /* Get chip info. */
> -       msg.command = EC_CMD_GET_CHIP_INFO;
> -       msg.insize = sizeof(*r_chip);
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> +       msg->command = EC_CMD_GET_CHIP_INFO;
> +       msg->insize = sizeof(*r_chip);
> +       ret = cros_ec_cmd_xfer(ec, msg);
>         if (ret < 0)
>                 count += scnprintf(buf + count, PAGE_SIZE - count,
>                                    "Chip info:     XFER ERROR %d\n", ret);
> -       else if (msg.result != EC_RES_SUCCESS)
> +       else if (msg->result != EC_RES_SUCCESS)
>                 count += scnprintf(buf + count, PAGE_SIZE - count,
> -                                  "Chip info:     EC error %d\n", msg.result);
> +                                  "Chip info:     EC error %d\n", msg->result);
>         else {
> -               r_chip = (struct ec_response_get_chip_info *)msg.indata;
> +               r_chip = (struct ec_response_get_chip_info *)msg->data;
>
>                 r_chip->vendor[sizeof(r_chip->vendor) - 1] = '\0';
>                 r_chip->name[sizeof(r_chip->name) - 1] = '\0';
> @@ -192,23 +212,25 @@ static ssize_t show_ec_version(struct device *dev,
>         }
>
>         /* Get board version */
> -       msg.command = EC_CMD_GET_BOARD_VERSION;
> -       msg.insize = sizeof(*r_board);
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> +       msg->command = EC_CMD_GET_BOARD_VERSION;
> +       msg->insize = sizeof(*r_board);
> +       ret = cros_ec_cmd_xfer(ec, msg);
>         if (ret < 0)
>                 count += scnprintf(buf + count, PAGE_SIZE - count,
>                                    "Board version: XFER ERROR %d\n", ret);
> -       else if (msg.result != EC_RES_SUCCESS)
> +       else if (msg->result != EC_RES_SUCCESS)
>                 count += scnprintf(buf + count, PAGE_SIZE - count,
> -                                  "Board version: EC error %d\n", msg.result);
> +                                  "Board version: EC error %d\n", msg->result);
>         else {
> -               r_board = (struct ec_response_board_version *)msg.indata;
> +               r_board = (struct ec_response_board_version *)msg->data;
>
>                 count += scnprintf(buf + count, PAGE_SIZE - count,
>                                    "Board version: %d\n",
>                                    r_board->board_version);
>         }
>
> +exit:
> +       kfree(msg);
>         return count;
>  }
>
> @@ -216,27 +238,37 @@ static ssize_t show_ec_flashinfo(struct device *dev,
>                                  struct device_attribute *attr, char *buf)
>  {
>         struct ec_response_flash_info *resp;
> -       struct cros_ec_command msg = { 0 };
> +       struct cros_ec_command *msg;
>         int ret;
>         struct cros_ec_device *ec = dev_get_drvdata(dev);
>
> +       msg = kzalloc(sizeof(*msg) + sizeof(*resp), GFP_KERNEL);
alloc on the stack.
> +       if (!msg)
> +               return -ENOMEM;
> +
>         /* The flash info shouldn't ever change, but ask each time anyway. */
> -       msg.command = EC_CMD_FLASH_INFO;
> -       msg.insize = sizeof(*resp);
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> +       msg->command = EC_CMD_FLASH_INFO;
> +       msg->insize = sizeof(*resp);
> +       ret = cros_ec_cmd_xfer(ec, msg);
>         if (ret < 0)
> -               return ret;
> -       if (msg.result != EC_RES_SUCCESS)
> -               return scnprintf(buf, PAGE_SIZE,
> -                                "ERROR: EC returned %d\n", msg.result);
> -
> -       resp = (struct ec_response_flash_info *)msg.indata;
> -
> -       return scnprintf(buf, PAGE_SIZE,
> -                        "FlashSize %d\nWriteSize %d\n"
> -                        "EraseSize %d\nProtectSize %d\n",
> -                        resp->flash_size, resp->write_block_size,
> -                        resp->erase_block_size, resp->protect_block_size);
> +               goto exit;
> +       if (msg->result != EC_RES_SUCCESS) {
> +               ret = scnprintf(buf, PAGE_SIZE,
> +                               "ERROR: EC returned %d\n", msg->result);
> +               goto exit;
> +       }
> +
> +       resp = (struct ec_response_flash_info *)msg->data;
> +
> +       ret = scnprintf(buf, PAGE_SIZE,
> +                       "FlashSize %d\nWriteSize %d\n"
> +                       "EraseSize %d\nProtectSize %d\n",
> +                       resp->flash_size, resp->write_block_size,
> +                       resp->erase_block_size, resp->protect_block_size);
> +
> +exit:
> +       kfree(msg);
> +       return ret;
>  }
>
>  /* Module initialization */
> @@ -269,3 +301,4 @@ void ec_dev_sysfs_remove(struct cros_ec_device *ec)
>  {
>         sysfs_remove_group(&ec->vdev->kobj, &ec_attr_group);
>  }
> +
> diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
> index 14cf522123dd..7eee38abd02a 100644
> --- a/include/linux/mfd/cros_ec.h
> +++ b/include/linux/mfd/cros_ec.h
> @@ -42,8 +42,7 @@ enum {
>   * @outsize: Outgoing length in bytes
>   * @insize: Max number of bytes to accept from EC
>   * @result: EC's response to the command (separate from communication failure)
> - * @outdata: Outgoing data to EC
> - * @indata: Where to put the incoming data from EC
> + * @data: Where to put the incoming data from EC and outgoing data to EC
>   */
>  struct cros_ec_command {
>         uint32_t version;
> @@ -51,8 +50,7 @@ struct cros_ec_command {
>         uint32_t outsize;
>         uint32_t insize;
>         uint32_t result;
> -       uint8_t outdata[EC_PROTO2_MAX_PARAM_SIZE];
> -       uint8_t indata[EC_PROTO2_MAX_PARAM_SIZE];
> +       uint8_t data[0];
>  };
>
>  /**
> --
> 2.1.4
>

Re: [RESEND PATCH 4/8] mfd: cros_ec: Use a zero-length array for command data

[Gwendal Grignou]

On Mon, Apr 6, 2015 at 9:15 AM, Javier Martinez Canillas
<javier.martinez@collabora.co.uk> wrote:
> Commit 1b84f2a4cd4a ("mfd: cros_ec: Use fixed size arrays to transfer
> data with the EC") modified the struct cros_ec_command fields to not
> use pointers for the input and output buffers and use fixed length
> arrays instead.
>
> This change was made because the cros_ec ioctl API uses that struct
> cros_ec_command to allow user-space to send commands to the EC and
> to get data from the EC. So using pointers made the API not 64-bit
> safe. Unfortunately this approach was not flexible enough for all
> the use-cases since there may be a need to send larger commands
> on newer versions of the EC command protocol.
>
> So to avoid to choose a constant length that it may be too big for
> most commands and thus wasting memory and CPU cycles on copy from
> and to user-space or having a size that is too small for some big
> commands, use a zero-length array that is both 64-bit safe and
> flexible. The same buffer is used for both output and input data
> so the maximum of these values should be used to allocate it.
>
> Suggested-by: Gwendal Grignou <gwendal@chromium.org>
> Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
> ---
>  drivers/i2c/busses/i2c-cros-ec-tunnel.c    |  44 ++++++---
>  drivers/input/keyboard/cros_ec_keyb.c      |  27 ++++--
>  drivers/mfd/cros_ec.c                      |  26 +++--
>  drivers/mfd/cros_ec_i2c.c                  |   4 +-
>  drivers/mfd/cros_ec_spi.c                  |   2 +-
>  drivers/platform/chrome/cros_ec_dev.c      |  49 ++++++----
>  drivers/platform/chrome/cros_ec_lightbar.c | 151 +++++++++++++++++++----------
>  drivers/platform/chrome/cros_ec_lpc.c      |   8 +-
>  drivers/platform/chrome/cros_ec_sysfs.c    | 149 +++++++++++++++++-----------
>  include/linux/mfd/cros_ec.h                |   6 +-
>  10 files changed, 297 insertions(+), 169 deletions(-)
>
> diff --git a/drivers/i2c/busses/i2c-cros-ec-tunnel.c b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
> index fa8dedd8c3a2..4139ede8e6ed 100644
> --- a/drivers/i2c/busses/i2c-cros-ec-tunnel.c
> +++ b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
> @@ -183,7 +183,7 @@ static int ec_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg i2c_msgs[],
>         int request_len;
>         int response_len;
>         int result;
> -       struct cros_ec_command msg = { };
> +       struct cros_ec_command *msg;
>
>         request_len = ec_i2c_count_message(i2c_msgs, num);
>         if (request_len < 0) {
> @@ -198,25 +198,39 @@ static int ec_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg i2c_msgs[],
>                 return response_len;
>         }
>
> -       result = ec_i2c_construct_message(msg.outdata, i2c_msgs, num, bus_num);
> -       if (result)
> -               return result;
> +       msg = kzalloc(sizeof(*msg) + max(request_len, response_len),
> +                     GFP_KERNEL);
> +       if (!msg)
> +               return -ENOMEM;
>
> -       msg.version = 0;
> -       msg.command = EC_CMD_I2C_PASSTHRU;
> -       msg.outsize = request_len;
> -       msg.insize = response_len;
> +       result = ec_i2c_construct_message(msg->data, i2c_msgs, num, bus_num);
> +       if (result) {
> +               dev_err(dev, "Error constructing EC i2c message %d\n", result);
> +               goto exit;
> +       }
>
> -       result = cros_ec_cmd_xfer(bus->ec, &msg);
> -       if (result < 0)
> -               return result;
> +       msg->version = 0;
> +       msg->command = EC_CMD_I2C_PASSTHRU;
> +       msg->outsize = request_len;
> +       msg->insize = response_len;
>
> -       result = ec_i2c_parse_response(msg.indata, i2c_msgs, &num);
> -       if (result < 0)
> -               return result;
> +       result = cros_ec_cmd_xfer(bus->ec, msg);
> +       if (result < 0) {
> +               dev_err(dev, "Error transferring EC i2c message %d\n", result);
> +               goto exit;
> +       }
> +
> +       result = ec_i2c_parse_response(msg->data, i2c_msgs, &num);
> +       if (result < 0) {
> +               dev_err(dev, "Error parsing EC i2c message %d\n", result);
> +               goto exit;
> +       }
>
>         /* Indicate success by saying how many messages were sent */
> -       return num;
> +       result = num;
> +exit:
> +       kfree(msg);
> +       return result;
>  }
>
>  static u32 ec_i2c_functionality(struct i2c_adapter *adap)
> diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c
> index 769f8f7f62b7..df12cf15b306 100644
> --- a/drivers/input/keyboard/cros_ec_keyb.c
> +++ b/drivers/input/keyboard/cros_ec_keyb.c
> @@ -148,19 +148,26 @@ static void cros_ec_keyb_process(struct cros_ec_keyb *ckdev,
>
>  static int cros_ec_keyb_get_state(struct cros_ec_keyb *ckdev, uint8_t *kb_state)
>  {
> -       int ret;
> -       struct cros_ec_command msg = {
> -               .command = EC_CMD_MKBP_STATE,
> -               .insize = ckdev->cols,
> -       };
> +       int ret = 0;
> +       struct cros_ec_command *msg;
>
> -       ret = cros_ec_cmd_xfer(ckdev->ec, &msg);
> -       if (ret < 0)
> -               return ret;
> +       msg = kzalloc(sizeof(*msg) + ckdev->cols, GFP_KERNEL);
> +       if (!msg)
> +               return -ENOMEM;
>
> -       memcpy(kb_state, msg.indata, ckdev->cols);
> +       msg->command = EC_CMD_MKBP_STATE;
> +       msg->insize = ckdev->cols;
>
> -       return 0;
> +       ret = cros_ec_cmd_xfer(ckdev->ec, msg);
> +       if (ret < 0) {
> +               dev_err(ckdev->dev, "Error transferring EC message %d\n", ret);
> +               goto exit;
> +       }
> +
> +       memcpy(kb_state, msg->data, ckdev->cols);
> +exit:
> +       kfree(msg);
> +       return ret;
>  }
>
>  static irqreturn_t cros_ec_keyb_irq(int irq, void *data)
> diff --git a/drivers/mfd/cros_ec.c b/drivers/mfd/cros_ec.c
> index 8aa83b91e25c..c532dbca7404 100644
> --- a/drivers/mfd/cros_ec.c
> +++ b/drivers/mfd/cros_ec.c
> @@ -41,7 +41,7 @@ int cros_ec_prepare_tx(struct cros_ec_device *ec_dev,
>         out[2] = msg->outsize;
>         csum = out[0] + out[1] + out[2];
>         for (i = 0; i < msg->outsize; i++)
> -               csum += out[EC_MSG_TX_HEADER_BYTES + i] = msg->outdata[i];
> +               csum += out[EC_MSG_TX_HEADER_BYTES + i] = msg->data[i];
>         out[EC_MSG_TX_HEADER_BYTES + msg->outsize] = (uint8_t)(csum & 0xff);
>
>         return EC_MSG_TX_PROTO_BYTES + msg->outsize;
> @@ -75,11 +75,18 @@ int cros_ec_cmd_xfer(struct cros_ec_device *ec_dev,
>         ret = ec_dev->cmd_xfer(ec_dev, msg);
>         if (msg->result == EC_RES_IN_PROGRESS) {
>                 int i;
> -               struct cros_ec_command status_msg = { };
> +               struct cros_ec_command *status_msg;
>                 struct ec_response_get_comms_status *status;
>
> -               status_msg.command = EC_CMD_GET_COMMS_STATUS;
> -               status_msg.insize = sizeof(*status);
> +               status_msg = kzalloc(sizeof(*status_msg) + sizeof(*status),
> +                                    GFP_KERNEL);
> +               if (!status_msg) {
> +                       ret = -ENOMEM;
> +                       goto exit;
> +               }
> +
> +               status_msg->command = EC_CMD_GET_COMMS_STATUS;
> +               status_msg->insize = sizeof(*status);
>
>                 /*
>                  * Query the EC's status until it's no longer busy or
> @@ -88,20 +95,23 @@ int cros_ec_cmd_xfer(struct cros_ec_device *ec_dev,
>                 for (i = 0; i < EC_COMMAND_RETRIES; i++) {
>                         usleep_range(10000, 11000);
>
> -                       ret = ec_dev->cmd_xfer(ec_dev, &status_msg);
> +                       ret = ec_dev->cmd_xfer(ec_dev, status_msg);
>                         if (ret < 0)
>                                 break;
>
> -                       msg->result = status_msg.result;
> -                       if (status_msg.result != EC_RES_SUCCESS)
> +                       msg->result = status_msg->result;
> +                       if (status_msg->result != EC_RES_SUCCESS)
>                                 break;
>
>                         status = (struct ec_response_get_comms_status *)
> -                                status_msg.indata;
> +                                status_msg->data;
>                         if (!(status->flags & EC_COMMS_STATUS_PROCESSING))
>                                 break;
>                 }
> +
> +               kfree(status_msg);
>         }
> +exit:
>         mutex_unlock(&ec_dev->lock);
>
>         return ret;
> diff --git a/drivers/mfd/cros_ec_i2c.c b/drivers/mfd/cros_ec_i2c.c
> index 82b4d6148698..fbf7819f5de5 100644
> --- a/drivers/mfd/cros_ec_i2c.c
> +++ b/drivers/mfd/cros_ec_i2c.c
> @@ -76,7 +76,7 @@ static int cros_ec_cmd_xfer_i2c(struct cros_ec_device *ec_dev,
>         /* copy message payload and compute checksum */
>         sum = out_buf[0] + out_buf[1] + out_buf[2];
>         for (i = 0; i < msg->outsize; i++) {
> -               out_buf[3 + i] = msg->outdata[i];
> +               out_buf[3 + i] = msg->data[i];
>                 sum += out_buf[3 + i];
>         }
>         out_buf[3 + msg->outsize] = sum;
> @@ -109,7 +109,7 @@ static int cros_ec_cmd_xfer_i2c(struct cros_ec_device *ec_dev,
>         /* copy response packet payload and compute checksum */
>         sum = in_buf[0] + in_buf[1];
>         for (i = 0; i < len; i++) {
> -               msg->indata[i] = in_buf[2 + i];
> +               msg->data[i] = in_buf[2 + i];
>                 sum += in_buf[2 + i];
>         }
>         dev_dbg(ec_dev->dev, "packet: %*ph, sum = %02x\n",
> diff --git a/drivers/mfd/cros_ec_spi.c b/drivers/mfd/cros_ec_spi.c
> index 27bd52e5e8b7..573730fec947 100644
> --- a/drivers/mfd/cros_ec_spi.c
> +++ b/drivers/mfd/cros_ec_spi.c
> @@ -299,7 +299,7 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
>         for (i = 0; i < len; i++) {
>                 sum += ptr[i + 2];
>                 if (ec_msg->insize)
> -                       ec_msg->indata[i] = ptr[i + 2];
> +                       ec_msg->data[i] = ptr[i + 2];
>         }
>         sum &= 0xff;
>
> diff --git a/drivers/platform/chrome/cros_ec_dev.c b/drivers/platform/chrome/cros_ec_dev.c
> index 6090d0b2826f..e7e50f18097f 100644
> --- a/drivers/platform/chrome/cros_ec_dev.c
> +++ b/drivers/platform/chrome/cros_ec_dev.c
> @@ -20,6 +20,7 @@
>  #include <linux/fs.h>
>  #include <linux/module.h>
>  #include <linux/platform_device.h>
> +#include <linux/slab.h>
>  #include <linux/uaccess.h>
>
>  #include "cros_ec_dev.h"
> @@ -36,28 +37,30 @@ static int ec_get_version(struct cros_ec_device *ec, char *str, int maxlen)
>         static const char * const current_image_name[] = {
>                 "unknown", "read-only", "read-write", "invalid",
>         };
> -       struct cros_ec_command msg = {
> -               .version = 0,
> -               .command = EC_CMD_GET_VERSION,
> -               .outdata = { 0 },
> -               .outsize = 0,
> -               .indata = { 0 },
> -               .insize = sizeof(*resp),
> -       };
> +       struct cros_ec_command *msg;
>         int ret;
>
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> +       msg = kzalloc(sizeof(*msg) + sizeof(*resp), GFP_KERNEL);
> +       if (!msg)
> +               return -ENOMEM;
> +
> +       msg->version = 0;
> +       msg->command = EC_CMD_GET_VERSION;
> +       msg->insize = sizeof(*resp);
> +
> +       ret = cros_ec_cmd_xfer(ec, msg);
>         if (ret < 0)
> -               return ret;
> +               goto exit;
>
> -       if (msg.result != EC_RES_SUCCESS) {
> +       if (msg->result != EC_RES_SUCCESS) {
>                 snprintf(str, maxlen,
>                          "%s\nUnknown EC version: EC returned %d\n",
> -                        CROS_EC_DEV_VERSION, msg.result);
> -               return 0;
> +                        CROS_EC_DEV_VERSION, msg->result);
> +               ret = -EINVAL;
> +               goto exit;
>         }
>
> -       resp = (struct ec_response_get_version *)msg.indata;
> +       resp = (struct ec_response_get_version *)msg->data;
>         if (resp->current_image >= ARRAY_SIZE(current_image_name))
>                 resp->current_image = 3; /* invalid */
>
> @@ -65,6 +68,8 @@ static int ec_get_version(struct cros_ec_device *ec, char *str, int maxlen)
>                  resp->version_string_ro, resp->version_string_rw,
>                  current_image_name[resp->current_image]);
>
> +exit:
> +       kfree(msg);
>         return 0;
>  }
>
> @@ -110,17 +115,25 @@ static ssize_t ec_device_read(struct file *filp, char __user *buffer,
>  static long ec_device_ioctl_xcmd(struct cros_ec_device *ec, void __user *arg)
>  {
>         long ret;
> -       struct cros_ec_command s_cmd = { };
> +       int len;
> +       struct cros_ec_command *u_cmd = arg;
> +       struct cros_ec_command *s_cmd;
> +
> +       len = max(u_cmd->outsize, u_cmd->insize);
It does not work, u_cmd is not accessible yet. You should do:
struct cros_ec_command u_cmd;
if (copy_from_user(&u_cmd, arg, sizeof(u_cmd)))
  return -EFAULT;
len = max(u_cmd.outsize, u_cmd.insize);


> +
> +       s_cmd = kzalloc(sizeof(*s_cmd) + len, GFP_KERNEL);
> +       if (!s_cmd)
> +               return -ENOMEM;
>
> -       if (copy_from_user(&s_cmd, arg, sizeof(s_cmd)))
> +       if (copy_from_user(s_cmd, arg, sizeof(*s_cmd) + len))
sizeof(*s_cmd) + u_cmd.outsize is good enough.
>                 return -EFAULT;
>
> -       ret = cros_ec_cmd_xfer(ec, &s_cmd);
> +       ret = cros_ec_cmd_xfer(ec, s_cmd);
>         /* Only copy data to userland if data was received. */
>         if (ret < 0)
>                 return ret;
>
> -       if (copy_to_user(arg, &s_cmd, sizeof(s_cmd)))
> +       if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + len))
sizeof(*s_cmd) + min(ret, u_cmd.insize) is safer
>                 return -EFAULT;
>
>         return 0;
I missed this one earlier. Tools expect the number of byte read, so it should be
return ret;

> diff --git a/drivers/platform/chrome/cros_ec_lightbar.c b/drivers/platform/chrome/cros_ec_lightbar.c
> index b4ff47a9069a..8ffec6649ead 100644
> --- a/drivers/platform/chrome/cros_ec_lightbar.c
> +++ b/drivers/platform/chrome/cros_ec_lightbar.c
> @@ -31,6 +31,7 @@
>  #include <linux/sched.h>
>  #include <linux/types.h>
>  #include <linux/uaccess.h>
> +#include <linux/slab.h>
>
>  #include "cros_ec_dev.h"
>
> @@ -91,54 +92,78 @@ out:
>         return ret;
>  }
>
> -#define INIT_MSG(P, R) { \
> -               .command = EC_CMD_LIGHTBAR_CMD, \
> -               .outsize = sizeof(*P), \
> -               .insize = sizeof(*R), \
> -       }
> +static struct cros_ec_command *alloc_command_msg(void)
> +{
> +       struct cros_ec_command *msg;
> +       int len;
> +
> +       len = max(sizeof(struct ec_params_lightbar),
> +                 sizeof(struct ec_response_lightbar));
> +
> +       msg = kzalloc(sizeof(*msg) + len, GFP_KERNEL);
> +       if (!msg)
> +               return NULL;
> +
> +       msg->command = EC_CMD_LIGHTBAR_CMD;
> +       msg->outsize = sizeof(struct ec_params_lightbar);
> +       msg->insize = sizeof(struct ec_response_lightbar);
> +
> +       return msg;
> +}
>
>  static int get_lightbar_version(struct cros_ec_device *ec,
>                                 uint32_t *ver_ptr, uint32_t *flg_ptr)
>  {
>         struct ec_params_lightbar *param;
>         struct ec_response_lightbar *resp;
> -       struct cros_ec_command msg = INIT_MSG(param, resp);
> +       struct cros_ec_command *msg;
>         int ret;
>
> -       param = (struct ec_params_lightbar *)msg.outdata;
> -       param->cmd = LIGHTBAR_CMD_VERSION;
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> -       if (ret < 0)
> +       msg = alloc_command_msg();
> +       if (!msg)
>                 return 0;
>
> -       switch (msg.result) {
> +       param = (struct ec_params_lightbar *)msg->data;
> +       param->cmd = LIGHTBAR_CMD_VERSION;
> +       ret = cros_ec_cmd_xfer(ec, msg);
> +       if (ret < 0) {
> +               ret = 0;
> +               goto exit;
> +       }
> +
> +       switch (msg->result) {
>         case EC_RES_INVALID_PARAM:
>                 /* Pixel had no version command. */
>                 if (ver_ptr)
>                         *ver_ptr = 0;
>                 if (flg_ptr)
>                         *flg_ptr = 0;
> -               return 1;
> +               ret = 1;
> +               goto exit;
>
>         case EC_RES_SUCCESS:
> -               resp = (struct ec_response_lightbar *)msg.indata;
> +               resp = (struct ec_response_lightbar *)msg->data;
>
>                 /* Future devices w/lightbars should implement this command */
>                 if (ver_ptr)
>                         *ver_ptr = resp->version.num;
>                 if (flg_ptr)
>                         *flg_ptr = resp->version.flags;
> -               return 1;
> +               ret = 1;
> +               goto exit;
>         }
>
>         /* Anything else (ie, EC_RES_INVALID_COMMAND) - no lightbar */
> -       return 0;
> +       ret = 0;
> +exit:
> +       kfree(msg);
> +       return ret;
>  }
>
>  static ssize_t version_show(struct device *dev,
>                             struct device_attribute *attr, char *buf)
>  {
> -       uint32_t version, flags;
> +       uint32_t version = 0, flags = 0;
>         struct cros_ec_device *ec = dev_get_drvdata(dev);
>         int ret;
>
> @@ -158,8 +183,7 @@ static ssize_t brightness_store(struct device *dev,
>                                 const char *buf, size_t count)
>  {
>         struct ec_params_lightbar *param;
> -       struct ec_response_lightbar *resp;
> -       struct cros_ec_command msg = INIT_MSG(param, resp);
> +       struct cros_ec_command *msg;
>         int ret;
>         unsigned int val;
>         struct cros_ec_device *ec = dev_get_drvdata(dev);
> @@ -167,21 +191,30 @@ static ssize_t brightness_store(struct device *dev,
>         if (kstrtouint(buf, 0, &val))
>                 return -EINVAL;
>
> -       param = (struct ec_params_lightbar *)msg.outdata;
> +       msg = alloc_command_msg();
> +       if (!msg)
> +               return -ENOMEM;
> +
> +       param = (struct ec_params_lightbar *)msg->data;
>         param->cmd = LIGHTBAR_CMD_BRIGHTNESS;
>         param->brightness.num = val;
>         ret = lb_throttle();
>         if (ret)
> -               return ret;
> +               goto exit;
>
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> +       ret = cros_ec_cmd_xfer(ec, msg);
>         if (ret < 0)
> -               return ret;
> +               goto exit;
>
> -       if (msg.result != EC_RES_SUCCESS)
> -               return -EINVAL;
> +       if (msg->result != EC_RES_SUCCESS) {
> +               ret = -EINVAL;
> +               goto exit;
> +       }
>
> -       return count;
> +       ret = count;
> +exit:
> +       kfree(msg);
> +       return ret;
>  }
>
>
> @@ -196,12 +229,15 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
>                              const char *buf, size_t count)
>  {
>         struct ec_params_lightbar *param;
> -       struct ec_response_lightbar *resp;
> -       struct cros_ec_command msg = INIT_MSG(param, resp);
> +       struct cros_ec_command *msg;
>         struct cros_ec_device *ec = dev_get_drvdata(dev);
>         unsigned int val[4];
>         int ret, i = 0, j = 0, ok = 0;
>
> +       msg = alloc_command_msg();
> +       if (!msg)
> +               return -ENOMEM;
> +
>         do {
>                 /* Skip any whitespace */
>                 while (*buf && isspace(*buf))
> @@ -215,7 +251,7 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
>                         return -EINVAL;
>
>                 if (i == 4) {
> -                       param = (struct ec_params_lightbar *)msg.outdata;
> +                       param = (struct ec_params_lightbar *)msg->data;
>                         param->cmd = LIGHTBAR_CMD_RGB;
>                         param->rgb.led = val[0];
>                         param->rgb.red = val[1];
> @@ -231,12 +267,14 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
>                                         return ret;
>                         }
>
> -                       ret = cros_ec_cmd_xfer(ec, &msg);
> +                       ret = cros_ec_cmd_xfer(ec, msg);
>                         if (ret < 0)
> -                               return ret;
> +                               goto exit;
>
> -                       if (msg.result != EC_RES_SUCCESS)
> -                               return -EINVAL;
> +                       if (msg->result != EC_RES_SUCCESS) {
> +                               ret = -EINVAL;
> +                               goto exit;
> +                       }
>
>                         i = 0;
>                         ok = 1;
> @@ -248,6 +286,8 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
>
>         } while (*buf);
>
> +exit:
> +       kfree(msg);
>         return (ok && i == 0) ? count : -EINVAL;
>  }
>
> @@ -261,42 +301,55 @@ static ssize_t sequence_show(struct device *dev,
>  {
>         struct ec_params_lightbar *param;
>         struct ec_response_lightbar *resp;
> -       struct cros_ec_command msg = INIT_MSG(param, resp);
> +       struct cros_ec_command *msg;
>         int ret;
>         struct cros_ec_device *ec = dev_get_drvdata(dev);
>
> -       param = (struct ec_params_lightbar *)msg.outdata;
> +       msg = alloc_command_msg();
> +       if (!msg)
> +               return -ENOMEM;
> +
> +       param = (struct ec_params_lightbar *)msg->data;
>         param->cmd = LIGHTBAR_CMD_GET_SEQ;
>         ret = lb_throttle();
>         if (ret)
> -               return ret;
> +               goto exit;
>
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> +       ret = cros_ec_cmd_xfer(ec, msg);
>         if (ret < 0)
> -               return ret;
> +               goto exit;
>
> -       if (msg.result != EC_RES_SUCCESS)
> -               return scnprintf(buf, PAGE_SIZE,
> -                                "ERROR: EC returned %d\n", msg.result);
> +       if (msg->result != EC_RES_SUCCESS) {
> +               ret = scnprintf(buf, PAGE_SIZE,
> +                               "ERROR: EC returned %d\n", msg->result);
> +               goto exit;
> +       }
>
> -       resp = (struct ec_response_lightbar *)msg.indata;
> +       resp = (struct ec_response_lightbar *)msg->data;
>         if (resp->get_seq.num >= ARRAY_SIZE(seqname))
> -               return scnprintf(buf, PAGE_SIZE, "%d\n", resp->get_seq.num);
> +               ret = scnprintf(buf, PAGE_SIZE, "%d\n", resp->get_seq.num);
>         else
> -               return scnprintf(buf, PAGE_SIZE, "%s\n",
> -                                seqname[resp->get_seq.num]);
> +               ret = scnprintf(buf, PAGE_SIZE, "%s\n",
> +                               seqname[resp->get_seq.num]);
> +
> +exit:
> +       kfree(msg);
> +       return ret;
>  }
>
>  static ssize_t sequence_store(struct device *dev, struct device_attribute *attr,
>                               const char *buf, size_t count)
>  {
>         struct ec_params_lightbar *param;
> -       struct ec_response_lightbar *resp;
> -       struct cros_ec_command msg = INIT_MSG(param, resp);
> +       struct cros_ec_command *msg;
>         unsigned int num;
>         int ret, len;
>         struct cros_ec_device *ec = dev_get_drvdata(dev);
>
> +       msg = alloc_command_msg();
> +       if (!msg)
> +               return -ENOMEM;
> +
>         for (len = 0; len < count; len++)
>                 if (!isalnum(buf[len]))
>                         break;
> @@ -311,18 +364,18 @@ static ssize_t sequence_store(struct device *dev, struct device_attribute *attr,
>                         return ret;
>         }
>
> -       param = (struct ec_params_lightbar *)msg.outdata;
> +       param = (struct ec_params_lightbar *)msg->data;
>         param->cmd = LIGHTBAR_CMD_SEQ;
>         param->seq.num = num;
>         ret = lb_throttle();
>         if (ret)
>                 return ret;
>
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> +       ret = cros_ec_cmd_xfer(ec, msg);
>         if (ret < 0)
>                 return ret;
>
> -       if (msg.result != EC_RES_SUCCESS)
> +       if (msg->result != EC_RES_SUCCESS)
>                 return -EINVAL;
>
>         return count;
> diff --git a/drivers/platform/chrome/cros_ec_lpc.c b/drivers/platform/chrome/cros_ec_lpc.c
> index 3a675817c95d..32b1df29fc58 100644
> --- a/drivers/platform/chrome/cros_ec_lpc.c
> +++ b/drivers/platform/chrome/cros_ec_lpc.c
> @@ -73,8 +73,8 @@ static int cros_ec_cmd_xfer_lpc(struct cros_ec_device *ec,
>
>         /* Copy data and update checksum */
>         for (i = 0; i < msg->outsize; i++) {
> -               outb(msg->outdata[i], EC_LPC_ADDR_HOST_PARAM + i);
> -               csum += msg->outdata[i];
> +               outb(msg->data[i], EC_LPC_ADDR_HOST_PARAM + i);
> +               csum += msg->data[i];
>         }
>
>         /* Finalize checksum and write args */
> @@ -119,8 +119,8 @@ static int cros_ec_cmd_xfer_lpc(struct cros_ec_device *ec,
>
>         /* Read response and update checksum */
>         for (i = 0; i < args.data_size; i++) {
> -               msg->indata[i] = inb(EC_LPC_ADDR_HOST_PARAM + i);
> -               csum += msg->indata[i];
> +               msg->data[i] = inb(EC_LPC_ADDR_HOST_PARAM + i);
> +               csum += msg->data[i];
>         }
>
>         /* Verify checksum */
> diff --git a/drivers/platform/chrome/cros_ec_sysfs.c b/drivers/platform/chrome/cros_ec_sysfs.c
> index fb62ab6cc659..6f309f2b4efb 100644
> --- a/drivers/platform/chrome/cros_ec_sysfs.c
> +++ b/drivers/platform/chrome/cros_ec_sysfs.c
> @@ -29,6 +29,7 @@
>  #include <linux/module.h>
>  #include <linux/platform_device.h>
>  #include <linux/printk.h>
> +#include <linux/slab.h>
>  #include <linux/stat.h>
>  #include <linux/types.h>
>  #include <linux/uaccess.h>
> @@ -66,14 +67,19 @@ static ssize_t store_ec_reboot(struct device *dev,
>                 {"hibernate",    EC_REBOOT_HIBERNATE, 0},
>                 {"at-shutdown",  -1, EC_REBOOT_FLAG_ON_AP_SHUTDOWN},
>         };
> -       struct cros_ec_command msg = { 0 };
> -       struct ec_params_reboot_ec *param =
> -               (struct ec_params_reboot_ec *)msg.outdata;
> +       struct cros_ec_command *msg;
> +       struct ec_params_reboot_ec *param;
>         int got_cmd = 0, offset = 0;
>         int i;
>         int ret;
>         struct cros_ec_device *ec = dev_get_drvdata(dev);
>
> +       msg = kzalloc(sizeof(*msg) + sizeof(*param), GFP_KERNEL);
> +       if (!msg)
> +               return -ENOMEM;
> +
> +       param = (struct ec_params_reboot_ec *)msg->data;
> +
>         param->flags = 0;
>         while (1) {
>                 /* Find word to start scanning */
> @@ -100,19 +106,25 @@ static ssize_t store_ec_reboot(struct device *dev,
>                         offset++;
>         }
>
> -       if (!got_cmd)
> -               return -EINVAL;
> +       if (!got_cmd) {
> +               count = -EINVAL;
> +               goto exit;
> +       }
>
> -       msg.command = EC_CMD_REBOOT_EC;
> -       msg.outsize = sizeof(param);
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> -       if (ret < 0)
> -               return ret;
> -       if (msg.result != EC_RES_SUCCESS) {
> -               dev_dbg(ec->dev, "EC result %d\n", msg.result);
> -               return -EINVAL;
> +       msg->command = EC_CMD_REBOOT_EC;
> +       msg->outsize = sizeof(*param);
> +       ret = cros_ec_cmd_xfer(ec, msg);
> +       if (ret < 0) {
> +               count = ret;
> +               goto exit;
> +       }
> +       if (msg->result != EC_RES_SUCCESS) {
> +               dev_err(ec->dev, "EC result %d\n", msg->result);
> +               count = -EINVAL;
>         }
>
> +exit:
> +       kfree(msg);
>         return count;
>  }
>
> @@ -123,22 +135,30 @@ static ssize_t show_ec_version(struct device *dev,
>         struct ec_response_get_version *r_ver;
>         struct ec_response_get_chip_info *r_chip;
>         struct ec_response_board_version *r_board;
> -       struct cros_ec_command msg = { 0 };
> +       struct cros_ec_command *msg;
>         int ret;
>         int count = 0;
>         struct cros_ec_device *ec = dev_get_drvdata(dev);
>
> +       msg = kzalloc(sizeof(*msg) + EC_HOST_PARAM_SIZE, GFP_KERNEL);
> +       if (!msg)
> +               return -ENOMEM;
> +
>         /* Get versions. RW may change. */
> -       msg.command = EC_CMD_GET_VERSION;
> -       msg.insize = sizeof(*r_ver);
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> -       if (ret < 0)
> -               return ret;
> -       if (msg.result != EC_RES_SUCCESS)
> -               return scnprintf(buf, PAGE_SIZE,
> -                                "ERROR: EC returned %d\n", msg.result);
> +       msg->command = EC_CMD_GET_VERSION;
> +       msg->insize = sizeof(*r_ver);
> +       ret = cros_ec_cmd_xfer(ec, msg);
> +       if (ret < 0) {
> +               count = ret;
> +               goto exit;
> +       }
> +       if (msg->result != EC_RES_SUCCESS) {
> +               count = scnprintf(buf, PAGE_SIZE,
> +                                "ERROR: EC returned %d\n", msg->result);
> +               goto exit;
> +       }
>
> -       r_ver = (struct ec_response_get_version *)msg.indata;
> +       r_ver = (struct ec_response_get_version *)msg->data;
>         /* Strings should be null-terminated, but let's be sure. */
>         r_ver->version_string_ro[sizeof(r_ver->version_string_ro) - 1] = '\0';
>         r_ver->version_string_rw[sizeof(r_ver->version_string_rw) - 1] = '\0';
> @@ -152,33 +172,33 @@ static ssize_t show_ec_version(struct device *dev,
>                             image_names[r_ver->current_image] : "?"));
>
>         /* Get build info. */
> -       msg.command = EC_CMD_GET_BUILD_INFO;
> -       msg.insize = sizeof(msg.indata);
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> +       msg->command = EC_CMD_GET_BUILD_INFO;
> +       msg->insize = EC_HOST_PARAM_SIZE;
> +       ret = cros_ec_cmd_xfer(ec, msg);
>         if (ret < 0)
>                 count += scnprintf(buf + count, PAGE_SIZE - count,
>                                    "Build info:    XFER ERROR %d\n", ret);
> -       else if (msg.result != EC_RES_SUCCESS)
> +       else if (msg->result != EC_RES_SUCCESS)
>                 count += scnprintf(buf + count, PAGE_SIZE - count,
> -                                  "Build info:    EC error %d\n", msg.result);
> +                                  "Build info:    EC error %d\n", msg->result);
>         else {
> -               msg.indata[sizeof(msg.indata) - 1] = '\0';
> +               msg->data[sizeof(msg->data) - 1] = '\0';
>                 count += scnprintf(buf + count, PAGE_SIZE - count,
> -                                  "Build info:    %s\n", msg.indata);
> +                                  "Build info:    %s\n", msg->data);
>         }
>
>         /* Get chip info. */
> -       msg.command = EC_CMD_GET_CHIP_INFO;
> -       msg.insize = sizeof(*r_chip);
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> +       msg->command = EC_CMD_GET_CHIP_INFO;
> +       msg->insize = sizeof(*r_chip);
> +       ret = cros_ec_cmd_xfer(ec, msg);
>         if (ret < 0)
>                 count += scnprintf(buf + count, PAGE_SIZE - count,
>                                    "Chip info:     XFER ERROR %d\n", ret);
> -       else if (msg.result != EC_RES_SUCCESS)
> +       else if (msg->result != EC_RES_SUCCESS)
>                 count += scnprintf(buf + count, PAGE_SIZE - count,
> -                                  "Chip info:     EC error %d\n", msg.result);
> +                                  "Chip info:     EC error %d\n", msg->result);
>         else {
> -               r_chip = (struct ec_response_get_chip_info *)msg.indata;
> +               r_chip = (struct ec_response_get_chip_info *)msg->data;
>
>                 r_chip->vendor[sizeof(r_chip->vendor) - 1] = '\0';
>                 r_chip->name[sizeof(r_chip->name) - 1] = '\0';
> @@ -192,23 +212,25 @@ static ssize_t show_ec_version(struct device *dev,
>         }
>
>         /* Get board version */
> -       msg.command = EC_CMD_GET_BOARD_VERSION;
> -       msg.insize = sizeof(*r_board);
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> +       msg->command = EC_CMD_GET_BOARD_VERSION;
> +       msg->insize = sizeof(*r_board);
> +       ret = cros_ec_cmd_xfer(ec, msg);
>         if (ret < 0)
>                 count += scnprintf(buf + count, PAGE_SIZE - count,
>                                    "Board version: XFER ERROR %d\n", ret);
> -       else if (msg.result != EC_RES_SUCCESS)
> +       else if (msg->result != EC_RES_SUCCESS)
>                 count += scnprintf(buf + count, PAGE_SIZE - count,
> -                                  "Board version: EC error %d\n", msg.result);
> +                                  "Board version: EC error %d\n", msg->result);
>         else {
> -               r_board = (struct ec_response_board_version *)msg.indata;
> +               r_board = (struct ec_response_board_version *)msg->data;
>
>                 count += scnprintf(buf + count, PAGE_SIZE - count,
>                                    "Board version: %d\n",
>                                    r_board->board_version);
>         }
>
> +exit:
> +       kfree(msg);
>         return count;
>  }
>
> @@ -216,27 +238,37 @@ static ssize_t show_ec_flashinfo(struct device *dev,
>                                  struct device_attribute *attr, char *buf)
>  {
>         struct ec_response_flash_info *resp;
> -       struct cros_ec_command msg = { 0 };
> +       struct cros_ec_command *msg;
>         int ret;
>         struct cros_ec_device *ec = dev_get_drvdata(dev);
>
> +       msg = kzalloc(sizeof(*msg) + sizeof(*resp), GFP_KERNEL);
> +       if (!msg)
> +               return -ENOMEM;
> +
>         /* The flash info shouldn't ever change, but ask each time anyway. */
> -       msg.command = EC_CMD_FLASH_INFO;
> -       msg.insize = sizeof(*resp);
> -       ret = cros_ec_cmd_xfer(ec, &msg);
> +       msg->command = EC_CMD_FLASH_INFO;
> +       msg->insize = sizeof(*resp);
> +       ret = cros_ec_cmd_xfer(ec, msg);
>         if (ret < 0)
> -               return ret;
> -       if (msg.result != EC_RES_SUCCESS)
> -               return scnprintf(buf, PAGE_SIZE,
> -                                "ERROR: EC returned %d\n", msg.result);
> -
> -       resp = (struct ec_response_flash_info *)msg.indata;
> -
> -       return scnprintf(buf, PAGE_SIZE,
> -                        "FlashSize %d\nWriteSize %d\n"
> -                        "EraseSize %d\nProtectSize %d\n",
> -                        resp->flash_size, resp->write_block_size,
> -                        resp->erase_block_size, resp->protect_block_size);
> +               goto exit;
> +       if (msg->result != EC_RES_SUCCESS) {
> +               ret = scnprintf(buf, PAGE_SIZE,
> +                               "ERROR: EC returned %d\n", msg->result);
> +               goto exit;
> +       }
> +
> +       resp = (struct ec_response_flash_info *)msg->data;
> +
> +       ret = scnprintf(buf, PAGE_SIZE,
> +                       "FlashSize %d\nWriteSize %d\n"
> +                       "EraseSize %d\nProtectSize %d\n",
> +                       resp->flash_size, resp->write_block_size,
> +                       resp->erase_block_size, resp->protect_block_size);
> +
> +exit:
> +       kfree(msg);
> +       return ret;
>  }
>
>  /* Module initialization */
> @@ -269,3 +301,4 @@ void ec_dev_sysfs_remove(struct cros_ec_device *ec)
>  {
>         sysfs_remove_group(&ec->vdev->kobj, &ec_attr_group);
>  }
> +
> diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
> index 14cf522123dd..7eee38abd02a 100644
> --- a/include/linux/mfd/cros_ec.h
> +++ b/include/linux/mfd/cros_ec.h
> @@ -42,8 +42,7 @@ enum {
>   * @outsize: Outgoing length in bytes
>   * @insize: Max number of bytes to accept from EC
>   * @result: EC's response to the command (separate from communication failure)
> - * @outdata: Outgoing data to EC
> - * @indata: Where to put the incoming data from EC
> + * @data: Where to put the incoming data from EC and outgoing data to EC
>   */
>  struct cros_ec_command {
>         uint32_t version;
> @@ -51,8 +50,7 @@ struct cros_ec_command {
>         uint32_t outsize;
>         uint32_t insize;
>         uint32_t result;
> -       uint8_t outdata[EC_PROTO2_MAX_PARAM_SIZE];
> -       uint8_t indata[EC_PROTO2_MAX_PARAM_SIZE];
> +       uint8_t data[0];
>  };
>
>  /**
> --
> 2.1.4
>

Re: [RESEND PATCH 2/8] platform/chrome: cros_ec_lpc - Use existing function to check EC result

[Gwendal Grignou]

Reviewed-by: Gwendal Grignou <gwendal@chromium.org>
Tested-by: Gwendal Grignou <gwendal@chromium.org>

On Mon, Apr 6, 2015 at 9:15 AM, Javier Martinez Canillas
<javier.martinez@collabora.co.uk> wrote:
> Commit 6db07b633658 ("mfd: cros_ec: Check result code from EC messages")
> added a common cros_ec_check_result() function that can be used to check
> the ec_msg->result for errors and warns about them.
>
> Use the existing function instead of duplicating same check in the driver.
>
> Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
> ---
>  drivers/platform/chrome/cros_ec_lpc.c | 14 ++------------
>  1 file changed, 2 insertions(+), 12 deletions(-)
>
> diff --git a/drivers/platform/chrome/cros_ec_lpc.c b/drivers/platform/chrome/cros_ec_lpc.c
> index 860310513cf0..3a675817c95d 100644
> --- a/drivers/platform/chrome/cros_ec_lpc.c
> +++ b/drivers/platform/chrome/cros_ec_lpc.c
> @@ -95,19 +95,9 @@ static int cros_ec_cmd_xfer_lpc(struct cros_ec_device *ec,
>
>         /* Check result */
>         msg->result = inb(EC_LPC_ADDR_HOST_DATA);
> -
> -       switch (msg->result) {
> -       case EC_RES_SUCCESS:
> -               break;
> -       case EC_RES_IN_PROGRESS:
> -               ret = -EAGAIN;
> -               dev_dbg(ec->dev, "command 0x%02x in progress\n",
> -                       msg->command);
> +       ret = cros_ec_check_result(ec, msg);
> +       if (ret)
>                 goto done;
> -       default:
> -               dev_dbg(ec->dev, "command 0x%02x returned %d\n",
> -                       msg->command, msg->result);
> -       }
>
>         /* Read back args */
>         args.flags = inb(EC_LPC_ADDR_HOST_ARGS);
> --
> 2.1.4
>

Re: [RESEND PATCH 3/8] mfd: cros_ec: Instantiate sub-devices from device tree

[Gwendal Grignou]

Reviewed-by: Gwendal Grignou <gwendal@chromium.org>
Tested-by: Gwendal Grignou <gwendal@chromium.org>

On Mon, Apr 6, 2015 at 9:15 AM, Javier Martinez Canillas
<javier.martinez@collabora.co.uk> wrote:
> From: Todd Broch <tbroch@chromium.org>
>
> If the EC device tree node has sub-nodes, try to instantiate them as
> MFD sub-devices.  We can configure the EC features provided by the board.
>
> Signed-off-by: Todd Broch <tbroch@chromium.org>
> Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
> ---
>  drivers/mfd/cros_ec.c | 22 +++++++++++-----------
>  1 file changed, 11 insertions(+), 11 deletions(-)
>
> diff --git a/drivers/mfd/cros_ec.c b/drivers/mfd/cros_ec.c
> index c4aecc6f8373..8aa83b91e25c 100644
> --- a/drivers/mfd/cros_ec.c
> +++ b/drivers/mfd/cros_ec.c
> @@ -17,6 +17,7 @@
>   * battery charging and regulator control, firmware update.
>   */
>
> +#include <linux/of_platform.h>
>  #include <linux/interrupt.h>
>  #include <linux/slab.h>
>  #include <linux/module.h>
> @@ -109,18 +110,8 @@ EXPORT_SYMBOL(cros_ec_cmd_xfer);
>
>  static const struct mfd_cell cros_devs[] = {
>         {
> -               .name = "cros-ec-keyb",
> -               .id = 1,
> -               .of_compatible = "google,cros-ec-keyb",
> -       },
> -       {
> -               .name = "cros-ec-i2c-tunnel",
> -               .id = 2,
> -               .of_compatible = "google,cros-ec-i2c-tunnel",
> -       },
> -       {
>                 .name = "cros-ec-ctl",
> -               .id = 3,
> +               .id = 1,
>         },
>  };
>
> @@ -150,6 +141,15 @@ int cros_ec_register(struct cros_ec_device *ec_dev)
>                 return err;
>         }
>
> +#ifdef CONFIG_OF
> +       err = of_platform_populate(dev->of_node, NULL, NULL, dev);
> +       if (err) {
> +               mfd_remove_devices(dev);
> +               dev_err(dev, "Failed to register sub-devices\n");
> +               return err;
> +       }
> +#endif
> +
>         dev_info(dev, "Chrome EC device registered\n");
>
>         return 0;
> --
> 2.1.4
>

Re: [RESEND PATCH 6/8] mfd: cros_ec: rev cros_ec_commands.h

[Gwendal Grignou]

Reviewed-by: Gwendal Grignou <gwendal@chromium.org>
Tested-by: Gwendal Grignou <gwendal@chromium.org>

On Mon, Apr 6, 2015 at 9:15 AM, Javier Martinez Canillas
<javier.martinez@collabora.co.uk> wrote:
> From: Stephen Barber <smbarber@chromium.org>
>
> Update cros_ec_commands.h to the latest version in the EC
> firmware sources and add power domain and passthru commands.
>
> Also, update lightbar to use new command names.
>
> Signed-off-by: Stephen Barber <smbarber@chromium.org>
> Reviewed-by: Randall Spangler <rspangler@chromium.org>
> Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
> ---
>  drivers/platform/chrome/cros_ec_lightbar.c |  14 +-
>  include/linux/mfd/cros_ec_commands.h       | 277 ++++++++++++++++++++++++++---
>  2 files changed, 262 insertions(+), 29 deletions(-)
>
> diff --git a/drivers/platform/chrome/cros_ec_lightbar.c b/drivers/platform/chrome/cros_ec_lightbar.c
> index 8ffec6649ead..38a9e58a9d2c 100644
> --- a/drivers/platform/chrome/cros_ec_lightbar.c
> +++ b/drivers/platform/chrome/cros_ec_lightbar.c
> @@ -196,8 +196,8 @@ static ssize_t brightness_store(struct device *dev,
>                 return -ENOMEM;
>
>         param = (struct ec_params_lightbar *)msg->data;
> -       param->cmd = LIGHTBAR_CMD_BRIGHTNESS;
> -       param->brightness.num = val;
> +       param->cmd = LIGHTBAR_CMD_SET_BRIGHTNESS;
> +       param->set_brightness.num = val;
>         ret = lb_throttle();
>         if (ret)
>                 goto exit;
> @@ -252,11 +252,11 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
>
>                 if (i == 4) {
>                         param = (struct ec_params_lightbar *)msg->data;
> -                       param->cmd = LIGHTBAR_CMD_RGB;
> -                       param->rgb.led = val[0];
> -                       param->rgb.red = val[1];
> -                       param->rgb.green = val[2];
> -                       param->rgb.blue = val[3];
> +                       param->cmd = LIGHTBAR_CMD_SET_RGB;
> +                       param->set_rgb.led = val[0];
> +                       param->set_rgb.red = val[1];
> +                       param->set_rgb.green = val[2];
> +                       param->set_rgb.blue = val[3];
>                         /*
>                          * Throttle only the first of every four transactions,
>                          * so that the user can update all four LEDs at once.
> diff --git a/include/linux/mfd/cros_ec_commands.h b/include/linux/mfd/cros_ec_commands.h
> index a49cd41feea7..13b630c10d4c 100644
> --- a/include/linux/mfd/cros_ec_commands.h
> +++ b/include/linux/mfd/cros_ec_commands.h
> @@ -515,7 +515,7 @@ struct ec_host_response {
>  /*
>   * Notes on commands:
>   *
> - * Each command is an 8-byte command value.  Commands which take params or
> + * Each command is an 16-bit command value.  Commands which take params or
>   * return response data specify structs for that data.  If no struct is
>   * specified, the command does not input or output data, respectively.
>   * Parameter/response length is implicit in the structs.  Some underlying
> @@ -966,7 +966,7 @@ struct rgb_s {
>  /* List of tweakable parameters. NOTE: It's __packed so it can be sent in a
>   * host command, but the alignment is the same regardless. Keep it that way.
>   */
> -struct lightbar_params {
> +struct lightbar_params_v0 {
>         /* Timing */
>         int32_t google_ramp_up;
>         int32_t google_ramp_down;
> @@ -1000,32 +1000,81 @@ struct lightbar_params {
>         struct rgb_s color[8];                  /* 0-3 are Google colors */
>  } __packed;
>
> +struct lightbar_params_v1 {
> +       /* Timing */
> +       int32_t google_ramp_up;
> +       int32_t google_ramp_down;
> +       int32_t s3s0_ramp_up;
> +       int32_t s0_tick_delay[2];               /* AC=0/1 */
> +       int32_t s0a_tick_delay[2];              /* AC=0/1 */
> +       int32_t s0s3_ramp_down;
> +       int32_t s3_sleep_for;
> +       int32_t s3_ramp_up;
> +       int32_t s3_ramp_down;
> +       int32_t tap_tick_delay;
> +       int32_t tap_display_time;
> +
> +       /* Tap-for-battery params */
> +       uint8_t tap_pct_red;
> +       uint8_t tap_pct_green;
> +       uint8_t tap_seg_min_on;
> +       uint8_t tap_seg_max_on;
> +       uint8_t tap_seg_osc;
> +       uint8_t tap_idx[3];
> +
> +       /* Oscillation */
> +       uint8_t osc_min[2];                     /* AC=0/1 */
> +       uint8_t osc_max[2];                     /* AC=0/1 */
> +       uint8_t w_ofs[2];                       /* AC=0/1 */
> +
> +       /* Brightness limits based on the backlight and AC. */
> +       uint8_t bright_bl_off_fixed[2];         /* AC=0/1 */
> +       uint8_t bright_bl_on_min[2];            /* AC=0/1 */
> +       uint8_t bright_bl_on_max[2];            /* AC=0/1 */
> +
> +       /* Battery level thresholds */
> +       uint8_t battery_threshold[LB_BATTERY_LEVELS - 1];
> +
> +       /* Map [AC][battery_level] to color index */
> +       uint8_t s0_idx[2][LB_BATTERY_LEVELS];   /* AP is running */
> +       uint8_t s3_idx[2][LB_BATTERY_LEVELS];   /* AP is sleeping */
> +
> +       /* Color palette */
> +       struct rgb_s color[8];                  /* 0-3 are Google colors */
> +} __packed;
> +
>  struct ec_params_lightbar {
>         uint8_t cmd;                  /* Command (see enum lightbar_command) */
>         union {
>                 struct {
>                         /* no args */
> -               } dump, off, on, init, get_seq, get_params, version;
> +               } dump, off, on, init, get_seq, get_params_v0, get_params_v1,
> +                       version, get_brightness, get_demo;
>
> -               struct num {
> +               struct {
>                         uint8_t num;
> -               } brightness, seq, demo;
> +               } set_brightness, seq, demo;
>
> -               struct reg {
> +               struct {
>                         uint8_t ctrl, reg, value;
>                 } reg;
>
> -               struct rgb {
> +               struct {
>                         uint8_t led, red, green, blue;
> -               } rgb;
> +               } set_rgb;
> +
> +               struct {
> +                       uint8_t led;
> +               } get_rgb;
>
> -               struct lightbar_params set_params;
> +               struct lightbar_params_v0 set_params_v0;
> +               struct lightbar_params_v1 set_params_v1;
>         };
>  } __packed;
>
>  struct ec_response_lightbar {
>         union {
> -               struct dump {
> +               struct {
>                         struct {
>                                 uint8_t reg;
>                                 uint8_t ic0;
> @@ -1033,20 +1082,26 @@ struct ec_response_lightbar {
>                         } vals[23];
>                 } dump;
>
> -               struct get_seq {
> +               struct  {
>                         uint8_t num;
> -               } get_seq;
> +               } get_seq, get_brightness, get_demo;
>
> -               struct lightbar_params get_params;
> +               struct lightbar_params_v0 get_params_v0;
> +               struct lightbar_params_v1 get_params_v1;
>
> -               struct version {
> +               struct {
>                         uint32_t num;
>                         uint32_t flags;
>                 } version;
>
>                 struct {
> +                       uint8_t red, green, blue;
> +               } get_rgb;
> +
> +               struct {
>                         /* no return params */
> -               } off, on, init, brightness, seq, reg, rgb, demo, set_params;
> +               } off, on, init, set_brightness, seq, reg, set_rgb,
> +                       demo, set_params_v0, set_params_v1;
>         };
>  } __packed;
>
> @@ -1056,15 +1111,20 @@ enum lightbar_command {
>         LIGHTBAR_CMD_OFF = 1,
>         LIGHTBAR_CMD_ON = 2,
>         LIGHTBAR_CMD_INIT = 3,
> -       LIGHTBAR_CMD_BRIGHTNESS = 4,
> +       LIGHTBAR_CMD_SET_BRIGHTNESS = 4,
>         LIGHTBAR_CMD_SEQ = 5,
>         LIGHTBAR_CMD_REG = 6,
> -       LIGHTBAR_CMD_RGB = 7,
> +       LIGHTBAR_CMD_SET_RGB = 7,
>         LIGHTBAR_CMD_GET_SEQ = 8,
>         LIGHTBAR_CMD_DEMO = 9,
> -       LIGHTBAR_CMD_GET_PARAMS = 10,
> -       LIGHTBAR_CMD_SET_PARAMS = 11,
> +       LIGHTBAR_CMD_GET_PARAMS_V0 = 10,
> +       LIGHTBAR_CMD_SET_PARAMS_V0 = 11,
>         LIGHTBAR_CMD_VERSION = 12,
> +       LIGHTBAR_CMD_GET_BRIGHTNESS = 13,
> +       LIGHTBAR_CMD_GET_RGB = 14,
> +       LIGHTBAR_CMD_GET_DEMO = 15,
> +       LIGHTBAR_CMD_GET_PARAMS_V1 = 16,
> +       LIGHTBAR_CMD_SET_PARAMS_V1 = 17,
>         LIGHTBAR_NUM_CMDS
>  };
>
> @@ -1421,8 +1481,40 @@ struct ec_response_rtc {
>  /*****************************************************************************/
>  /* Port80 log access */
>
> +/* Maximum entries that can be read/written in a single command */
> +#define EC_PORT80_SIZE_MAX 32
> +
>  /* Get last port80 code from previous boot */
>  #define EC_CMD_PORT80_LAST_BOOT 0x48
> +#define EC_CMD_PORT80_READ 0x48
> +
> +enum ec_port80_subcmd {
> +       EC_PORT80_GET_INFO = 0,
> +       EC_PORT80_READ_BUFFER,
> +};
> +
> +struct ec_params_port80_read {
> +       uint16_t subcmd;
> +       union {
> +               struct {
> +                       uint32_t offset;
> +                       uint32_t num_entries;
> +               } read_buffer;
> +       };
> +} __packed;
> +
> +struct ec_response_port80_read {
> +       union {
> +               struct {
> +                       uint32_t writes;
> +                       uint32_t history_size;
> +                       uint32_t last_boot;
> +               } get_info;
> +               struct {
> +                       uint16_t codes[EC_PORT80_SIZE_MAX];
> +               } data;
> +       };
> +} __packed;
>
>  struct ec_response_port80_last_boot {
>         uint16_t code;
> @@ -1782,6 +1874,7 @@ struct ec_params_gpio_set {
>  /* Get GPIO value */
>  #define EC_CMD_GPIO_GET 0x93
>
> +/* Version 0 of input params and response */
>  struct ec_params_gpio_get {
>         char name[32];
>  } __packed;
> @@ -1789,6 +1882,38 @@ struct ec_response_gpio_get {
>         uint8_t val;
>  } __packed;
>
> +/* Version 1 of input params and response */
> +struct ec_params_gpio_get_v1 {
> +       uint8_t subcmd;
> +       union {
> +               struct {
> +                       char name[32];
> +               } get_value_by_name;
> +               struct {
> +                       uint8_t index;
> +               } get_info;
> +       };
> +} __packed;
> +
> +struct ec_response_gpio_get_v1 {
> +       union {
> +               struct {
> +                       uint8_t val;
> +               } get_value_by_name, get_count;
> +               struct {
> +                       uint8_t val;
> +                       char name[32];
> +                       uint32_t flags;
> +               } get_info;
> +       };
> +} __packed;
> +
> +enum gpio_get_subcmd {
> +       EC_GPIO_GET_BY_NAME = 0,
> +       EC_GPIO_GET_COUNT = 1,
> +       EC_GPIO_GET_INFO = 2,
> +};
> +
>  /*****************************************************************************/
>  /* I2C commands. Only available when flash write protect is unlocked. */
>
> @@ -1857,13 +1982,21 @@ struct ec_params_charge_control {
>  /*****************************************************************************/
>
>  /*
> - * Cut off battery power output if the battery supports.
> + * Cut off battery power immediately or after the host has shut down.
>   *
> - * For unsupported battery, just don't implement this command and lets EC
> - * return EC_RES_INVALID_COMMAND.
> + * return EC_RES_INVALID_COMMAND if unsupported by a board/battery.
> + *       EC_RES_SUCCESS if the command was successful.
> + *       EC_RES_ERROR if the cut off command failed.
>   */
> +
>  #define EC_CMD_BATTERY_CUT_OFF 0x99
>
> +#define EC_BATTERY_CUTOFF_FLAG_AT_SHUTDOWN     (1 << 0)
> +
> +struct ec_params_battery_cutoff {
> +       uint8_t flags;
> +} __packed;
> +
>  /*****************************************************************************/
>  /* USB port mux control. */
>
> @@ -2142,6 +2275,32 @@ struct ec_params_sb_wr_block {
>  } __packed;
>
>  /*****************************************************************************/
> +/* Battery vendor parameters
> + *
> + * Get or set vendor-specific parameters in the battery. Implementations may
> + * differ between boards or batteries. On a set operation, the response
> + * contains the actual value set, which may be rounded or clipped from the
> + * requested value.
> + */
> +
> +#define EC_CMD_BATTERY_VENDOR_PARAM 0xb4
> +
> +enum ec_battery_vendor_param_mode {
> +       BATTERY_VENDOR_PARAM_MODE_GET = 0,
> +       BATTERY_VENDOR_PARAM_MODE_SET,
> +};
> +
> +struct ec_params_battery_vendor_param {
> +       uint32_t param;
> +       uint32_t value;
> +       uint8_t mode;
> +} __packed;
> +
> +struct ec_response_battery_vendor_param {
> +       uint32_t value;
> +} __packed;
> +
> +/*****************************************************************************/
>  /* System commands */
>
>  /*
> @@ -2338,6 +2497,80 @@ struct ec_params_reboot_ec {
>
>  /*****************************************************************************/
>  /*
> + * PD commands
> + *
> + * These commands are for PD MCU communication.
> + */
> +
> +/* EC to PD MCU exchange status command */
> +#define EC_CMD_PD_EXCHANGE_STATUS 0x100
> +
> +/* Status of EC being sent to PD */
> +struct ec_params_pd_status {
> +       int8_t batt_soc; /* battery state of charge */
> +} __packed;
> +
> +/* Status of PD being sent back to EC */
> +struct ec_response_pd_status {
> +       int8_t status;        /* PD MCU status */
> +       uint32_t curr_lim_ma; /* input current limit */
> +} __packed;
> +
> +/* Set USB type-C port role and muxes */
> +#define EC_CMD_USB_PD_CONTROL 0x101
> +
> +enum usb_pd_control_role {
> +       USB_PD_CTRL_ROLE_NO_CHANGE = 0,
> +       USB_PD_CTRL_ROLE_TOGGLE_ON = 1, /* == AUTO */
> +       USB_PD_CTRL_ROLE_TOGGLE_OFF = 2,
> +       USB_PD_CTRL_ROLE_FORCE_SINK = 3,
> +       USB_PD_CTRL_ROLE_FORCE_SOURCE = 4,
> +};
> +
> +enum usb_pd_control_mux {
> +       USB_PD_CTRL_MUX_NO_CHANGE = 0,
> +       USB_PD_CTRL_MUX_NONE = 1,
> +       USB_PD_CTRL_MUX_USB = 2,
> +       USB_PD_CTRL_MUX_DP = 3,
> +       USB_PD_CTRL_MUX_DOCK = 4,
> +       USB_PD_CTRL_MUX_AUTO = 5,
> +};
> +
> +struct ec_params_usb_pd_control {
> +       uint8_t port;
> +       uint8_t role;
> +       uint8_t mux;
> +} __packed;
> +
> +/*****************************************************************************/
> +/*
> + * Passthru commands
> + *
> + * Some platforms have sub-processors chained to each other.  For example.
> + *
> + *     AP <--> EC <--> PD MCU
> + *
> + * The top 2 bits of the command number are used to indicate which device the
> + * command is intended for.  Device 0 is always the device receiving the
> + * command; other device mapping is board-specific.
> + *
> + * When a device receives a command to be passed to a sub-processor, it passes
> + * it on with the device number set back to 0.  This allows the sub-processor
> + * to remain blissfully unaware of whether the command originated on the next
> + * device up the chain, or was passed through from the AP.
> + *
> + * In the above example, if the AP wants to send command 0x0002 to the PD MCU,
> + *     AP sends command 0x4002 to the EC
> + *     EC sends command 0x0002 to the PD MCU
> + *     EC forwards PD MCU response back to the AP
> + */
> +
> +/* Offset and max command number for sub-device n */
> +#define EC_CMD_PASSTHRU_OFFSET(n) (0x4000 * (n))
> +#define EC_CMD_PASSTHRU_MAX(n) (EC_CMD_PASSTHRU_OFFSET(n) + 0x3fff)
> +
> +/*****************************************************************************/
> +/*
>   * Deprecated constants. These constants have been renamed for clarity. The
>   * meaning and size has not changed. Programs that use the old names should
>   * switch to the new names soon, as the old names may not be carried forward
> --
> 2.1.4
>

Re: [RESEND PATCH 7/8] mfd: cros_ec: add proto v3 skeleton

[Gwendal Grignou]

You can merge change
https://chromium-review.googlesource.com/#/c/262870/ with it, that
fixes an issue with newer firmware.

Reviewed-by: Gwendal Grignou <gwendal@chromium.org>
Tested-by: Gwendal Grignou <gwendal@chromium.org>

On Mon, Apr 6, 2015 at 9:15 AM, Javier Martinez Canillas
<javier.martinez@collabora.co.uk> wrote:
> From: Stephen Barber <smbarber@chromium.org>
>
> Add support in cros_ec.c to handle EC host command protocol v3.
> For v3+, probe for maximum shared protocol version and max
> request, response, and passthrough sizes. For now, this will
> always fall back to v2, since there is no bus-specific code
> for handling proto v3 packets.
>
> Signed-off-by: Stephen Barber <smbarber@chromium.org>
> Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
> ---
>  drivers/mfd/cros_ec.c                 | 363 +++++++++++++++++++++++++++++-----
>  drivers/mfd/cros_ec_i2c.c             |   4 +
>  drivers/mfd/cros_ec_spi.c             |   7 +-
>  drivers/platform/chrome/cros_ec_lpc.c |   4 +
>  include/linux/mfd/cros_ec.h           |  20 +-
>  5 files changed, 347 insertions(+), 51 deletions(-)
>
> diff --git a/drivers/mfd/cros_ec.c b/drivers/mfd/cros_ec.c
> index 70f6e55a096e..0972a7d36199 100644
> --- a/drivers/mfd/cros_ec.c
> +++ b/drivers/mfd/cros_ec.c
> @@ -30,11 +30,281 @@
>
>  static int dev_id;
>
> +static int prepare_packet(struct cros_ec_device *ec_dev,
> +                         struct cros_ec_command *msg)
> +{
> +       struct ec_host_request *request;
> +       u8 *out;
> +       int i;
> +       u8 csum = 0;
> +
> +       BUG_ON(ec_dev->proto_version != EC_HOST_REQUEST_VERSION);
> +       BUG_ON(msg->outsize + sizeof(*request) > ec_dev->dout_size);
> +
> +       out = ec_dev->dout;
> +       request = (struct ec_host_request *)out;
> +       request->struct_version = EC_HOST_REQUEST_VERSION;
> +       request->checksum = 0;
> +       request->command = msg->command;
> +       request->command_version = msg->version;
> +       request->reserved = 0;
> +       request->data_len = msg->outsize;
> +
> +       for (i = 0; i < sizeof(*request); i++)
> +               csum += out[i];
> +
> +       /* Copy data and update checksum */
> +       memcpy(out + sizeof(*request), msg->data, msg->outsize);
> +       for (i = 0; i < msg->outsize; i++)
> +               csum += msg->data[i];
> +
> +       request->checksum = -csum;
> +
> +       return sizeof(*request) + msg->outsize;
> +}
> +
> +static int send_command(struct cros_ec_device *ec_dev,
> +                       struct cros_ec_command *msg)
> +{
> +       int ret;
> +
> +       if (ec_dev->proto_version > 2)
> +               ret = ec_dev->pkt_xfer(ec_dev, msg);
> +       else
> +               ret = ec_dev->cmd_xfer(ec_dev, msg);
> +
> +       if (msg->result == EC_RES_IN_PROGRESS) {
> +               int i;
> +               struct cros_ec_command *status_msg;
> +               struct ec_response_get_comms_status *status;
> +
> +               status_msg = kzalloc(sizeof(*status_msg) + sizeof(*status),
> +                                    GFP_KERNEL);
> +               if (!status_msg)
> +                       return -ENOMEM;
> +
> +               status_msg->command = EC_CMD_GET_COMMS_STATUS;
> +               status_msg->insize = sizeof(*status);
> +
> +               /*
> +                * Query the EC's status until it's no longer busy or
> +                * we encounter an error.
> +                */
> +               for (i = 0; i < EC_COMMAND_RETRIES; i++) {
> +                       usleep_range(10000, 11000);
> +
> +                       ret = ec_dev->cmd_xfer(ec_dev, status_msg);
> +                       if (ret < 0)
> +                               break;
> +
> +                       msg->result = status_msg->result;
> +                       if (status_msg->result != EC_RES_SUCCESS)
> +                               break;
> +
> +                       status = (struct ec_response_get_comms_status *)
> +                                status_msg->data;
> +                       if (!(status->flags & EC_COMMS_STATUS_PROCESSING))
> +                               break;
> +               }
> +
> +               kfree(status_msg);
> +       }
> +
> +       return ret;
> +}
> +
> +static int cros_ec_host_command_proto_probe(struct cros_ec_device *ec_dev,
> +                                           int devidx,
> +                                           struct cros_ec_command *msg)
> +{
> +       /*
> +        * Try using v3+ to query for supported protocols. If this
> +        * command fails, fall back to v2. Returns the highest protocol
> +        * supported by the EC.
> +        * Also sets the max request/response/passthru size.
> +        */
> +       int ret;
> +
> +       if (!ec_dev->pkt_xfer)
> +               return -EPROTONOSUPPORT;
> +
> +       memset(msg, 0, sizeof(*msg));
> +       msg->command = EC_CMD_PASSTHRU_OFFSET(devidx) | EC_CMD_GET_PROTOCOL_INFO;
> +       msg->insize = sizeof(struct ec_response_get_protocol_info);
> +
> +       ret = send_command(ec_dev, msg);
> +
> +       if (ret < 0) {
> +               dev_dbg(ec_dev->dev,
> +                       "failed to probe for EC[%d] protocol version: %d\n",
> +                       devidx, ret);
> +               return ret;
> +       }
> +
> +       if (devidx > 0 && msg->result == EC_RES_INVALID_COMMAND)
> +               return -ENODEV;
> +       else if (msg->result != EC_RES_SUCCESS)
> +               return msg->result;
> +
> +       return 0;
> +}
> +
> +static int cros_ec_host_command_proto_probe_v2(struct cros_ec_device *ec_dev)
> +{
> +       struct cros_ec_command *msg;
> +       struct ec_params_hello *hello_params;
> +       struct ec_response_hello *hello_response;
> +       int ret;
> +       int len = max(sizeof(*hello_params), sizeof(*hello_response));
> +
> +       msg = kzalloc(sizeof(*msg) + len, GFP_KERNEL);
> +       if (!msg)
> +               return -ENOMEM;
> +
> +       msg->command = EC_CMD_HELLO;
> +       hello_params = (struct ec_params_hello *)msg->data;
> +       msg->outsize = sizeof(*hello_params);
> +       hello_response = (struct ec_response_hello *)msg->data;
> +       msg->insize = sizeof(*hello_response);
> +
> +       hello_params->in_data = 0xa0b0c0d0;
> +
> +       ret = send_command(ec_dev, msg);
> +
> +       if (ret < 0) {
> +               dev_dbg(ec_dev->dev,
> +                       "EC failed to respond to v2 hello: %d\n",
> +                       ret);
> +               goto exit;
> +       } else if (msg->result != EC_RES_SUCCESS) {
> +               dev_err(ec_dev->dev,
> +                       "EC responded to v2 hello with error: %d\n",
> +                       msg->result);
> +               ret = msg->result;
> +               goto exit;
> +       } else if (hello_response->out_data != 0xa1b2c3d4) {
> +               dev_err(ec_dev->dev,
> +                       "EC responded to v2 hello with bad result: %u\n",
> +                       hello_response->out_data);
> +               ret = -EBADMSG;
> +               goto exit;
> +       }
> +
> +       ret = 0;
> +
> +exit:
> +       kfree(msg);
> +       return ret;
> +}
> +
> +static int cros_ec_probe_all(struct cros_ec_device *ec_dev)
> +{
> +       struct device *dev = ec_dev->dev;
> +       struct cros_ec_command *proto_msg;
> +       struct ec_response_get_protocol_info *proto_info;
> +       int ret;
> +
> +       proto_msg = kzalloc(sizeof(*proto_msg) + sizeof(*proto_info),
> +                           GFP_KERNEL);
> +       if (!proto_msg)
> +               return -ENOMEM;
> +
> +       /* First try sending with proto v3. */
> +       ec_dev->proto_version = 3;
> +       ret = cros_ec_host_command_proto_probe(ec_dev, 0, proto_msg);
> +
> +       if (ret == 0) {
> +               proto_info = (struct ec_response_get_protocol_info *)
> +                       proto_msg->data;
> +               ec_dev->max_request = proto_info->max_request_packet_size -
> +                       sizeof(struct ec_host_request);
> +               ec_dev->max_response = proto_info->max_response_packet_size -
> +                       sizeof(struct ec_host_response);
> +               ec_dev->proto_version =
> +                       min(EC_HOST_REQUEST_VERSION,
> +                                       fls(proto_info->protocol_versions) - 1);
> +               dev_dbg(ec_dev->dev,
> +                       "using proto v%u\n",
> +                       ec_dev->proto_version);
> +
> +               ec_dev->din_size = ec_dev->max_response +
> +                       sizeof(struct ec_host_response) +
> +                       EC_MAX_RESPONSE_OVERHEAD;
> +               ec_dev->dout_size = ec_dev->max_request +
> +                       sizeof(struct ec_host_request) +
> +                       EC_MAX_REQUEST_OVERHEAD;
> +
> +               /*
> +                * Check for PD
> +                */
> +               ret = cros_ec_host_command_proto_probe(ec_dev, 1, proto_msg);
> +
> +               if (ret) {
> +                       dev_dbg(ec_dev->dev, "no PD chip found: %d\n", ret);
> +                       ec_dev->max_passthru = 0;
> +               } else {
> +                       dev_dbg(ec_dev->dev, "found PD chip\n");
> +                       ec_dev->max_passthru =
> +                               proto_info->max_request_packet_size -
> +                               sizeof(struct ec_host_request);
> +               }
> +       } else {
> +               /* Try probing with a v2 hello message. */
> +               ec_dev->proto_version = 2;
> +               ret = cros_ec_host_command_proto_probe_v2(ec_dev);
> +
> +               if (ret == 0) {
> +                       /* V2 hello succeeded. */
> +                       dev_dbg(ec_dev->dev, "falling back to proto v2\n");
> +
> +                       ec_dev->max_request = EC_PROTO2_MAX_PARAM_SIZE;
> +                       ec_dev->max_response = EC_PROTO2_MAX_PARAM_SIZE;
> +                       ec_dev->max_passthru = 0;
> +                       ec_dev->pkt_xfer = NULL;
> +                       ec_dev->din_size = EC_MSG_BYTES;
> +                       ec_dev->dout_size = EC_MSG_BYTES;
> +               } else {
> +                       /*
> +                        * It's possible for a probe to occur too early when
> +                        * the EC isn't listening. If this happens, we'll
> +                        * probe later when the first command is run.
> +                        */
> +                       ec_dev->proto_version = EC_PROTO_VERSION_UNKNOWN;
> +                       dev_dbg(ec_dev->dev, "EC probe failed: %d\n", ret);
> +                       goto exit;
> +               }
> +       }
> +
> +       devm_kfree(dev, ec_dev->din);
> +       devm_kfree(dev, ec_dev->dout);
> +
> +       ec_dev->din = devm_kzalloc(dev, ec_dev->din_size, GFP_KERNEL);
> +       if (!ec_dev->din) {
> +               ret = -ENOMEM;
> +               goto exit;
> +       }
> +
> +       ec_dev->dout = devm_kzalloc(dev, ec_dev->dout_size, GFP_KERNEL);
> +       if (!ec_dev->dout) {
> +               devm_kfree(dev, ec_dev->din);
> +               ret = -ENOMEM;
> +               goto exit;
> +       }
> +
> +exit:
> +       kfree(proto_msg);
> +       return ret;
> +}
> +
>  int cros_ec_prepare_tx(struct cros_ec_device *ec_dev,
>                        struct cros_ec_command *msg)
>  {
> -       uint8_t *out;
> -       int csum, i;
> +       u8 *out;
> +       u8 csum;
> +       int i;
> +
> +       if (ec_dev->proto_version > 2)
> +               return prepare_packet(ec_dev, msg);
>
>         BUG_ON(msg->outsize > EC_PROTO2_MAX_PARAM_SIZE);
>         out = ec_dev->dout;
> @@ -44,7 +314,7 @@ int cros_ec_prepare_tx(struct cros_ec_device *ec_dev,
>         csum = out[0] + out[1] + out[2];
>         for (i = 0; i < msg->outsize; i++)
>                 csum += out[EC_MSG_TX_HEADER_BYTES + i] = msg->data[i];
> -       out[EC_MSG_TX_HEADER_BYTES + msg->outsize] = (uint8_t)(csum & 0xff);
> +       out[EC_MSG_TX_HEADER_BYTES + msg->outsize] = csum;
>
>         return EC_MSG_TX_PROTO_BYTES + msg->outsize;
>  }
> @@ -74,46 +344,43 @@ int cros_ec_cmd_xfer(struct cros_ec_device *ec_dev,
>         int ret;
>
>         mutex_lock(&ec_dev->lock);
> -       ret = ec_dev->cmd_xfer(ec_dev, msg);
> -       if (msg->result == EC_RES_IN_PROGRESS) {
> -               int i;
> -               struct cros_ec_command *status_msg;
> -               struct ec_response_get_comms_status *status;
>
> -               status_msg = kzalloc(sizeof(*status_msg) + sizeof(*status),
> -                                    GFP_KERNEL);
> -               if (!status_msg) {
> -                       ret = -ENOMEM;
> -                       goto exit;
> +       if (ec_dev->proto_version == EC_PROTO_VERSION_UNKNOWN) {
> +               ret = cros_ec_probe_all(ec_dev);
> +               if (ret) {
> +                       dev_err(ec_dev->dev,
> +                               "EC version unknown and probe failed; aborting command\n");
> +                       mutex_unlock(&ec_dev->lock);
> +                       return ret;
>                 }
> +       }
>
> -               status_msg->command = EC_CMD_GET_COMMS_STATUS;
> -               status_msg->insize = sizeof(*status);
> -
> -               /*
> -                * Query the EC's status until it's no longer busy or
> -                * we encounter an error.
> -                */
> -               for (i = 0; i < EC_COMMAND_RETRIES; i++) {
> -                       usleep_range(10000, 11000);
> -
> -                       ret = ec_dev->cmd_xfer(ec_dev, status_msg);
> -                       if (ret < 0)
> -                               break;
> -
> -                       msg->result = status_msg->result;
> -                       if (status_msg->result != EC_RES_SUCCESS)
> -                               break;
> +       if (msg->insize > ec_dev->max_response) {
> +               dev_dbg(ec_dev->dev, "clamping message receive buffer\n");
> +               msg->insize = ec_dev->max_response;
> +       }
>
> -                       status = (struct ec_response_get_comms_status *)
> -                                status_msg->data;
> -                       if (!(status->flags & EC_COMMS_STATUS_PROCESSING))
> -                               break;
> +       if (msg->command < EC_CMD_PASSTHRU_OFFSET(1)) {
> +               if (msg->outsize > ec_dev->max_request) {
> +                       dev_err(ec_dev->dev,
> +                               "request of size %u is too big (max: %u)\n",
> +                               msg->outsize,
> +                               ec_dev->max_request);
> +                       mutex_unlock(&ec_dev->lock);
> +                       return -EMSGSIZE;
> +               }
> +       } else {
> +               if (msg->outsize > ec_dev->max_passthru) {
> +                       dev_err(ec_dev->dev,
> +                               "passthru rq of size %u is too big (max: %u)\n",
> +                               msg->outsize,
> +                               ec_dev->max_passthru);
> +                       mutex_unlock(&ec_dev->lock);
> +                       return -EMSGSIZE;
>                 }
> -
> -               kfree(status_msg);
>         }
> -exit:
> +
> +       ret = send_command(ec_dev, msg);
>         mutex_unlock(&ec_dev->lock);
>
>         return ret;
> @@ -132,21 +399,23 @@ int cros_ec_register(struct cros_ec_device *ec_dev)
>         struct device *dev = ec_dev->dev;
>         int err = 0;
>
> +       ec_dev->max_request = sizeof(struct ec_params_hello);
> +       ec_dev->max_response = sizeof(struct ec_response_get_protocol_info);
> +       ec_dev->max_passthru = 0;
>         ec_dev->id = dev_id;
>
> -       if (ec_dev->din_size) {
> -               ec_dev->din = devm_kzalloc(dev, ec_dev->din_size, GFP_KERNEL);
> -               if (!ec_dev->din)
> -                       return -ENOMEM;
> -       }
> -       if (ec_dev->dout_size) {
> -               ec_dev->dout = devm_kzalloc(dev, ec_dev->dout_size, GFP_KERNEL);
> -               if (!ec_dev->dout)
> -                       return -ENOMEM;
> -       }
> +       ec_dev->din = devm_kzalloc(dev, ec_dev->din_size, GFP_KERNEL);
> +       if (!ec_dev->din)
> +               return -ENOMEM;
> +
> +       ec_dev->dout = devm_kzalloc(dev, ec_dev->dout_size, GFP_KERNEL);
> +       if (!ec_dev->dout)
> +               return -ENOMEM;
>
>         mutex_init(&ec_dev->lock);
>
> +       cros_ec_probe_all(ec_dev);
> +
>         err = mfd_add_devices(dev, ec_dev->id, cros_devs,
>                               ARRAY_SIZE(cros_devs),
>                               NULL, ec_dev->irq, NULL);
> diff --git a/drivers/mfd/cros_ec_i2c.c b/drivers/mfd/cros_ec_i2c.c
> index fbf7819f5de5..b400bfa2772a 100644
> --- a/drivers/mfd/cros_ec_i2c.c
> +++ b/drivers/mfd/cros_ec_i2c.c
> @@ -143,8 +143,12 @@ static int cros_ec_i2c_probe(struct i2c_client *client,
>         ec_dev->priv = client;
>         ec_dev->irq = client->irq;
>         ec_dev->cmd_xfer = cros_ec_cmd_xfer_i2c;
> +       ec_dev->pkt_xfer = NULL;
>         ec_dev->ec_name = client->name;
>         ec_dev->phys_name = client->adapter->name;
> +       ec_dev->din_size = sizeof(struct ec_host_response) +
> +                          sizeof(struct ec_response_get_protocol_info);
> +       ec_dev->dout_size = sizeof(struct ec_host_request);
>
>         err = cros_ec_register(ec_dev);
>         if (err) {
> diff --git a/drivers/mfd/cros_ec_spi.c b/drivers/mfd/cros_ec_spi.c
> index 573730fec947..04da2f288ef8 100644
> --- a/drivers/mfd/cros_ec_spi.c
> +++ b/drivers/mfd/cros_ec_spi.c
> @@ -361,10 +361,13 @@ static int cros_ec_spi_probe(struct spi_device *spi)
>         ec_dev->priv = ec_spi;
>         ec_dev->irq = spi->irq;
>         ec_dev->cmd_xfer = cros_ec_cmd_xfer_spi;
> +       ec_dev->pkt_xfer = NULL;
>         ec_dev->ec_name = ec_spi->spi->modalias;
>         ec_dev->phys_name = dev_name(&ec_spi->spi->dev);
> -       ec_dev->din_size = EC_MSG_BYTES + EC_MSG_PREAMBLE_COUNT;
> -       ec_dev->dout_size = EC_MSG_BYTES;
> +       ec_dev->din_size = EC_MSG_PREAMBLE_COUNT +
> +                          sizeof(struct ec_host_response) +
> +                          sizeof(struct ec_response_get_protocol_info);
> +       ec_dev->dout_size = sizeof(struct ec_host_request);
>
>         err = cros_ec_register(ec_dev);
>         if (err) {
> diff --git a/drivers/platform/chrome/cros_ec_lpc.c b/drivers/platform/chrome/cros_ec_lpc.c
> index 32b1df29fc58..d56dfb9dd463 100644
> --- a/drivers/platform/chrome/cros_ec_lpc.c
> +++ b/drivers/platform/chrome/cros_ec_lpc.c
> @@ -205,7 +205,11 @@ static int cros_ec_lpc_probe(struct platform_device *pdev)
>         ec_dev->ec_name = pdev->name;
>         ec_dev->phys_name = dev_name(dev);
>         ec_dev->cmd_xfer = cros_ec_cmd_xfer_lpc;
> +       ec_dev->pkt_xfer = NULL;
>         ec_dev->cmd_readmem = cros_ec_lpc_readmem;
> +       ec_dev->din_size = sizeof(struct ec_host_response) +
> +                          sizeof(struct ec_response_get_protocol_info);
> +       ec_dev->dout_size = sizeof(struct ec_host_request);
>
>         ret = cros_ec_register(ec_dev);
>         if (ret) {
> diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
> index 2bee6ac74ffb..f27ce4b7736b 100644
> --- a/include/linux/mfd/cros_ec.h
> +++ b/include/linux/mfd/cros_ec.h
> @@ -22,6 +22,15 @@
>  #include <linux/mutex.h>
>
>  /*
> + * Max bus-specific overhead incurred by request/responses.
> + * I2C requires 1 additional byte for requests.
> + * I2C requires 2 additional bytes for responses.
> + * */
> +#define EC_PROTO_VERSION_UNKNOWN       0
> +#define EC_MAX_REQUEST_OVERHEAD                1
> +#define EC_MAX_RESPONSE_OVERHEAD       2
> +
> +/*
>   * Command interface between EC and AP, for LPC, I2C and SPI interfaces.
>   */
>  enum {
> @@ -89,6 +98,7 @@ struct cros_ec_command {
>   *     Returns the number of bytes received if the communication succeeded, but
>   *     that doesn't mean the EC was happy with the command. The caller
>   *     should check msg.result for the EC's result code.
> + * @pkt_xfer: send packet to EC and get response
>   * @lock: one transaction at a time
>   */
>  struct cros_ec_device {
> @@ -105,16 +115,22 @@ struct cros_ec_device {
>                            unsigned int bytes, void *dest);
>
>         /* These are used to implement the platform-specific interface */
> +       u16 max_request;
> +       u16 max_response;
> +       u16 max_passthru;
> +       u16 proto_version;
>         void *priv;
>         int irq;
>         int id;
> -       uint8_t *din;
> -       uint8_t *dout;
> +       u8 *din;
> +       u8 *dout;
>         int din_size;
>         int dout_size;
>         bool wake_enabled;
>         int (*cmd_xfer)(struct cros_ec_device *ec,
>                         struct cros_ec_command *msg);
> +       int (*pkt_xfer)(struct cros_ec_device *ec,
> +                       struct cros_ec_command *msg);
>         struct mutex lock;
>  };
>
> --
> 2.1.4
>

Re: [RESEND PATCH 8/8] mfd: cros_ec: add bus-specific proto v3 code

[Gwendal Grignou]

Reviewed-by: Gwendal Grignou <gwendal@chromium.org>
Tested-by: Gwendal Grignou <gwendal@chromium.org>

On Mon, Apr 6, 2015 at 9:15 AM, Javier Martinez Canillas
<javier.martinez@collabora.co.uk> wrote:
> From: Stephen Barber <smbarber@chromium.org>
>
> Add proto v3 support to the SPI, I2C, and LPC.
>
> Signed-off-by: Stephen Barber <smbarber@chromium.org>
> Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
> ---
>  drivers/mfd/cros_ec_i2c.c             | 166 ++++++++++++++-
>  drivers/mfd/cros_ec_spi.c             | 382 +++++++++++++++++++++++++++++-----
>  drivers/platform/chrome/cros_ec_lpc.c |  73 ++++++-
>  include/linux/mfd/cros_ec.h           |   6 +
>  4 files changed, 569 insertions(+), 58 deletions(-)
>
> diff --git a/drivers/mfd/cros_ec_i2c.c b/drivers/mfd/cros_ec_i2c.c
> index b400bfa2772a..22e8a4ae1711 100644
> --- a/drivers/mfd/cros_ec_i2c.c
> +++ b/drivers/mfd/cros_ec_i2c.c
> @@ -13,6 +13,7 @@
>   * GNU General Public License for more details.
>   */
>
> +#include <linux/delay.h>
>  #include <linux/kernel.h>
>  #include <linux/module.h>
>  #include <linux/i2c.h>
> @@ -22,6 +23,32 @@
>  #include <linux/platform_device.h>
>  #include <linux/slab.h>
>
> +/**
> + * Request format for protocol v3
> + * byte 0      0xda (EC_COMMAND_PROTOCOL_3)
> + * byte 1-8    struct ec_host_request
> + * byte 10-    response data
> + */
> +struct ec_host_request_i2c {
> +       /* Always 0xda to backward compatible with v2 struct */
> +       uint8_t  command_protocol;
> +       struct ec_host_request ec_request;
> +} __packed;
> +
> +
> +/*
> + * Response format for protocol v3
> + * byte 0      result code
> + * byte 1      packet_length
> + * byte 2-9    struct ec_host_response
> + * byte 10-    response data
> + */
> +struct ec_host_response_i2c {
> +       uint8_t result;
> +       uint8_t packet_length;
> +       struct ec_host_response ec_response;
> +} __packed;
> +
>  static inline struct cros_ec_device *to_ec_dev(struct device *dev)
>  {
>         struct i2c_client *client = to_i2c_client(dev);
> @@ -29,6 +56,134 @@ static inline struct cros_ec_device *to_ec_dev(struct device *dev)
>         return i2c_get_clientdata(client);
>  }
>
> +static int cros_ec_pkt_xfer_i2c(struct cros_ec_device *ec_dev,
> +                               struct cros_ec_command *msg)
> +{
> +       struct i2c_client *client = ec_dev->priv;
> +       int ret = -ENOMEM;
> +       int i;
> +       int packet_len;
> +       u8 *out_buf = NULL;
> +       u8 *in_buf = NULL;
> +       u8 sum;
> +       struct i2c_msg i2c_msg[2];
> +       struct ec_host_response *ec_response;
> +       struct ec_host_request_i2c *ec_request_i2c;
> +       struct ec_host_response_i2c *ec_response_i2c;
> +       int request_header_size = sizeof(struct ec_host_request_i2c);
> +       int response_header_size = sizeof(struct ec_host_response_i2c);
> +
> +       i2c_msg[0].addr = client->addr;
> +       i2c_msg[0].flags = 0;
> +       i2c_msg[1].addr = client->addr;
> +       i2c_msg[1].flags = I2C_M_RD;
> +
> +       packet_len = msg->insize + response_header_size;
> +       BUG_ON(packet_len > ec_dev->din_size);
> +       in_buf = ec_dev->din;
> +       i2c_msg[1].len = packet_len;
> +       i2c_msg[1].buf = (char *) in_buf;
> +
> +       packet_len = msg->outsize + request_header_size;
> +       BUG_ON(packet_len > ec_dev->dout_size);
> +       out_buf = ec_dev->dout;
> +       i2c_msg[0].len = packet_len;
> +       i2c_msg[0].buf = (char *) out_buf;
> +
> +       /* create request data */
> +       ec_request_i2c = (struct ec_host_request_i2c *) out_buf;
> +       ec_request_i2c->command_protocol = EC_COMMAND_PROTOCOL_3;
> +
> +       ec_dev->dout++;
> +       ret = cros_ec_prepare_tx(ec_dev, msg);
> +       ec_dev->dout--;
> +
> +       /* send command to EC and read answer */
> +       ret = i2c_transfer(client->adapter, i2c_msg, 2);
> +       if (ret < 0) {
> +               dev_dbg(ec_dev->dev, "i2c transfer failed: %d\n", ret);
> +               goto done;
> +       } else if (ret != 2) {
> +               dev_err(ec_dev->dev, "failed to get response: %d\n", ret);
> +               ret = -EIO;
> +               goto done;
> +       }
> +
> +       ec_response_i2c = (struct ec_host_response_i2c *) in_buf;
> +       msg->result = ec_response_i2c->result;
> +       ec_response = &ec_response_i2c->ec_response;
> +
> +       switch (msg->result) {
> +       case EC_RES_SUCCESS:
> +               break;
> +       case EC_RES_IN_PROGRESS:
> +               ret = -EAGAIN;
> +               dev_dbg(ec_dev->dev, "command 0x%02x in progress\n",
> +                       msg->command);
> +               goto done;
> +
> +       default:
> +               dev_dbg(ec_dev->dev, "command 0x%02x returned %d\n",
> +                       msg->command, msg->result);
> +               /*
> +                * When we send v3 request to v2 ec, ec won't recognize the
> +                * 0xda (EC_COMMAND_PROTOCOL_3) and will return with status
> +                * EC_RES_INVALID_COMMAND with zero data length.
> +                *
> +                * In case of invalid command for v3 protocol the data length
> +                * will be at least sizeof(struct ec_host_response)
> +                */
> +               if (ec_response_i2c->result == EC_RES_INVALID_COMMAND &&
> +                   ec_response_i2c->packet_length == 0) {
> +                       ret = -EPROTONOSUPPORT;
> +                       goto done;
> +               }
> +       }
> +
> +       if (ec_response_i2c->packet_length < sizeof(struct ec_host_response)) {
> +               dev_err(ec_dev->dev,
> +                       "response of %u bytes too short; not a full header\n",
> +                       ec_response_i2c->packet_length);
> +               ret = -EBADMSG;
> +               goto done;
> +       }
> +
> +       if (msg->insize < ec_response->data_len) {
> +               dev_err(ec_dev->dev,
> +                       "response data size is too large: expected %u, got %u\n",
> +                       msg->insize,
> +                       ec_response->data_len);
> +               ret = -EMSGSIZE;
> +               goto done;
> +       }
> +
> +       /* copy response packet payload and compute checksum */
> +       sum = 0;
> +       for (i = 0; i < sizeof(struct ec_host_response); i++)
> +               sum += ((u8 *)ec_response)[i];
> +
> +       memcpy(msg->data,
> +              in_buf + response_header_size,
> +              ec_response->data_len);
> +       for (i = 0; i < ec_response->data_len; i++)
> +               sum += msg->data[i];
> +
> +       /* All bytes should sum to zero */
> +       if (sum) {
> +               dev_err(ec_dev->dev, "bad packet checksum\n");
> +               ret = -EBADMSG;
> +               goto done;
> +       }
> +
> +       ret = ec_response->data_len;
> +
> +done:
> +       if (msg->command == EC_CMD_REBOOT_EC)
> +               msleep(EC_REBOOT_DELAY_MS);
> +
> +       return ret;
> +}
> +
>  static int cros_ec_cmd_xfer_i2c(struct cros_ec_device *ec_dev,
>                                 struct cros_ec_command *msg)
>  {
> @@ -121,9 +276,12 @@ static int cros_ec_cmd_xfer_i2c(struct cros_ec_device *ec_dev,
>         }
>
>         ret = len;
> - done:
> +done:
>         kfree(in_buf);
>         kfree(out_buf);
> +       if (msg->command == EC_CMD_REBOOT_EC)
> +               msleep(EC_REBOOT_DELAY_MS);
> +
>         return ret;
>  }
>
> @@ -143,12 +301,12 @@ static int cros_ec_i2c_probe(struct i2c_client *client,
>         ec_dev->priv = client;
>         ec_dev->irq = client->irq;
>         ec_dev->cmd_xfer = cros_ec_cmd_xfer_i2c;
> -       ec_dev->pkt_xfer = NULL;
> +       ec_dev->pkt_xfer = cros_ec_pkt_xfer_i2c;
>         ec_dev->ec_name = client->name;
>         ec_dev->phys_name = client->adapter->name;
> -       ec_dev->din_size = sizeof(struct ec_host_response) +
> +       ec_dev->din_size = sizeof(struct ec_host_response_i2c) +
>                            sizeof(struct ec_response_get_protocol_info);
> -       ec_dev->dout_size = sizeof(struct ec_host_request);
> +       ec_dev->dout_size = sizeof(struct ec_host_request_i2c);
>
>         err = cros_ec_register(ec_dev);
>         if (err) {
> diff --git a/drivers/mfd/cros_ec_spi.c b/drivers/mfd/cros_ec_spi.c
> index 04da2f288ef8..4e6f2f6b1095 100644
> --- a/drivers/mfd/cros_ec_spi.c
> +++ b/drivers/mfd/cros_ec_spi.c
> @@ -65,12 +65,6 @@
>    */
>  #define EC_SPI_RECOVERY_TIME_NS        (200 * 1000)
>
> -/*
> - * The EC is unresponsive for a time after a reboot command.  Add a
> - * simple delay to make sure that the bus stays locked.
> - */
> -#define EC_REBOOT_DELAY_MS     50
> -
>  /**
>   * struct cros_ec_spi - information about a SPI-connected EC
>   *
> @@ -87,7 +81,7 @@ struct cros_ec_spi {
>  };
>
>  static void debug_packet(struct device *dev, const char *name, u8 *ptr,
> -                         int len)
> +                        int len)
>  {
>  #ifdef DEBUG
>         int i;
> @@ -100,6 +94,172 @@ static void debug_packet(struct device *dev, const char *name, u8 *ptr,
>  #endif
>  }
>
> +static int terminate_request(struct cros_ec_device *ec_dev)
> +{
> +       struct cros_ec_spi *ec_spi = ec_dev->priv;
> +       struct spi_message msg;
> +       struct spi_transfer trans;
> +       int ret;
> +
> +       /*
> +        * Turn off CS, possibly adding a delay to ensure the rising edge
> +        * doesn't come too soon after the end of the data.
> +        */
> +       spi_message_init(&msg);
> +       memset(&trans, 0, sizeof(trans));
> +       trans.delay_usecs = ec_spi->end_of_msg_delay;
> +       spi_message_add_tail(&trans, &msg);
> +
> +       ret = spi_sync(ec_spi->spi, &msg);
> +
> +       /* Reset end-of-response timer */
> +       ec_spi->last_transfer_ns = ktime_get_ns();
> +       if (ret < 0) {
> +               dev_err(ec_dev->dev,
> +                       "cs-deassert spi transfer failed: %d\n",
> +                       ret);
> +       }
> +
> +       return ret;
> +}
> +
> +/**
> + * receive_n_bytes - receive n bytes from the EC.
> + *
> + * Assumes buf is a pointer into the ec_dev->din buffer
> + */
> +static int receive_n_bytes(struct cros_ec_device *ec_dev, u8 *buf, int n)
> +{
> +       struct cros_ec_spi *ec_spi = ec_dev->priv;
> +       struct spi_transfer trans;
> +       struct spi_message msg;
> +       int ret;
> +
> +       BUG_ON(buf - ec_dev->din + n > ec_dev->din_size);
> +
> +       memset(&trans, 0, sizeof(trans));
> +       trans.cs_change = 1;
> +       trans.rx_buf = buf;
> +       trans.len = n;
> +
> +       spi_message_init(&msg);
> +       spi_message_add_tail(&trans, &msg);
> +       ret = spi_sync(ec_spi->spi, &msg);
> +       if (ret < 0)
> +               dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
> +
> +       return ret;
> +}
> +
> +/**
> + * cros_ec_spi_receive_packet - Receive a packet from the EC.
> + *
> + * This function has two phases: reading the preamble bytes (since if we read
> + * data from the EC before it is ready to send, we just get preamble) and
> + * reading the actual message.
> + *
> + * The received data is placed into ec_dev->din.
> + *
> + * @ec_dev: ChromeOS EC device
> + * @need_len: Number of message bytes we need to read
> + */
> +static int cros_ec_spi_receive_packet(struct cros_ec_device *ec_dev,
> +                                     int need_len)
> +{
> +       struct ec_host_response *response;
> +       u8 *ptr, *end;
> +       int ret;
> +       unsigned long deadline;
> +       int todo;
> +
> +       BUG_ON(EC_MSG_PREAMBLE_COUNT > ec_dev->din_size);
> +
> +       /* Receive data until we see the header byte */
> +       deadline = jiffies + msecs_to_jiffies(EC_MSG_DEADLINE_MS);
> +       while (true) {
> +               unsigned long start_jiffies = jiffies;
> +
> +               ret = receive_n_bytes(ec_dev,
> +                                     ec_dev->din,
> +                                     EC_MSG_PREAMBLE_COUNT);
> +               if (ret < 0)
> +                       return ret;
> +
> +               ptr = ec_dev->din;
> +               for (end = ptr + EC_MSG_PREAMBLE_COUNT; ptr != end; ptr++) {
> +                       if (*ptr == EC_SPI_FRAME_START) {
> +                               dev_dbg(ec_dev->dev, "msg found at %zd\n",
> +                                       ptr - ec_dev->din);
> +                               break;
> +                       }
> +               }
> +               if (ptr != end)
> +                       break;
> +
> +               /*
> +                * Use the time at the start of the loop as a timeout.  This
> +                * gives us one last shot at getting the transfer and is useful
> +                * in case we got context switched out for a while.
> +                */
> +               if (time_after(start_jiffies, deadline)) {
> +                       dev_warn(ec_dev->dev, "EC failed to respond in time\n");
> +                       return -ETIMEDOUT;
> +               }
> +       }
> +
> +       /*
> +        * ptr now points to the header byte. Copy any valid data to the
> +        * start of our buffer
> +        */
> +       todo = end - ++ptr;
> +       BUG_ON(todo < 0 || todo > ec_dev->din_size);
> +       todo = min(todo, need_len);
> +       memmove(ec_dev->din, ptr, todo);
> +       ptr = ec_dev->din + todo;
> +       dev_dbg(ec_dev->dev, "need %d, got %d bytes from preamble\n",
> +               need_len, todo);
> +       need_len -= todo;
> +
> +       /* If the entire response struct wasn't read, get the rest of it. */
> +       if (todo < sizeof(*response)) {
> +               ret = receive_n_bytes(ec_dev, ptr, sizeof(*response) - todo);
> +               if (ret < 0)
> +                       return -EBADMSG;
> +               ptr += (sizeof(*response) - todo);
> +               todo = sizeof(*response);
> +       }
> +
> +       response = (struct ec_host_response *)ec_dev->din;
> +
> +       /* Abort if data_len is too large. */
> +       if (response->data_len > ec_dev->din_size)
> +               return -EMSGSIZE;
> +
> +       /* Receive data until we have it all */
> +       while (need_len > 0) {
> +               /*
> +                * We can't support transfers larger than the SPI FIFO size
> +                * unless we have DMA. We don't have DMA on the ISP SPI ports
> +                * for Exynos. We need a way of asking SPI driver for
> +                * maximum-supported transfer size.
> +                */
> +               todo = min(need_len, 256);
> +               dev_dbg(ec_dev->dev, "loop, todo=%d, need_len=%d, ptr=%zd\n",
> +                       todo, need_len, ptr - ec_dev->din);
> +
> +               ret = receive_n_bytes(ec_dev, ptr, todo);
> +               if (ret < 0)
> +                       return ret;
> +
> +               ptr += todo;
> +               need_len -= todo;
> +       }
> +
> +       dev_dbg(ec_dev->dev, "loop done, ptr=%zd\n", ptr - ec_dev->din);
> +
> +       return 0;
> +}
> +
>  /**
>   * cros_ec_spi_receive_response - Receive a response from the EC.
>   *
> @@ -115,34 +275,27 @@ static void debug_packet(struct device *dev, const char *name, u8 *ptr,
>  static int cros_ec_spi_receive_response(struct cros_ec_device *ec_dev,
>                                         int need_len)
>  {
> -       struct cros_ec_spi *ec_spi = ec_dev->priv;
> -       struct spi_transfer trans;
> -       struct spi_message msg;
>         u8 *ptr, *end;
>         int ret;
>         unsigned long deadline;
>         int todo;
>
> +       BUG_ON(EC_MSG_PREAMBLE_COUNT > ec_dev->din_size);
> +
>         /* Receive data until we see the header byte */
>         deadline = jiffies + msecs_to_jiffies(EC_MSG_DEADLINE_MS);
>         while (true) {
>                 unsigned long start_jiffies = jiffies;
>
> -               memset(&trans, 0, sizeof(trans));
> -               trans.cs_change = 1;
> -               trans.rx_buf = ptr = ec_dev->din;
> -               trans.len = EC_MSG_PREAMBLE_COUNT;
> -
> -               spi_message_init(&msg);
> -               spi_message_add_tail(&trans, &msg);
> -               ret = spi_sync(ec_spi->spi, &msg);
> -               if (ret < 0) {
> -                       dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
> +               ret = receive_n_bytes(ec_dev,
> +                                     ec_dev->din,
> +                                     EC_MSG_PREAMBLE_COUNT);
> +               if (ret < 0)
>                         return ret;
> -               }
>
> +               ptr = ec_dev->din;
>                 for (end = ptr + EC_MSG_PREAMBLE_COUNT; ptr != end; ptr++) {
> -                       if (*ptr == EC_MSG_HEADER) {
> +                       if (*ptr == EC_SPI_FRAME_START) {
>                                 dev_dbg(ec_dev->dev, "msg found at %zd\n",
>                                         ptr - ec_dev->din);
>                                 break;
> @@ -187,21 +340,9 @@ static int cros_ec_spi_receive_response(struct cros_ec_device *ec_dev,
>                 dev_dbg(ec_dev->dev, "loop, todo=%d, need_len=%d, ptr=%zd\n",
>                         todo, need_len, ptr - ec_dev->din);
>
> -               memset(&trans, 0, sizeof(trans));
> -               trans.cs_change = 1;
> -               trans.rx_buf = ptr;
> -               trans.len = todo;
> -               spi_message_init(&msg);
> -               spi_message_add_tail(&trans, &msg);
> -
> -               /* send command to EC and read answer */
> -               BUG_ON((u8 *)trans.rx_buf - ec_dev->din + todo >
> -                               ec_dev->din_size);
> -               ret = spi_sync(ec_spi->spi, &msg);
> -               if (ret < 0) {
> -                       dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
> +               ret = receive_n_bytes(ec_dev, ptr, todo);
> +               if (ret < 0)
>                         return ret;
> -               }
>
>                 debug_packet(ec_dev->dev, "interim", ptr, todo);
>                 ptr += todo;
> @@ -214,6 +355,128 @@ static int cros_ec_spi_receive_response(struct cros_ec_device *ec_dev,
>  }
>
>  /**
> + * cros_ec_pkt_xfer_spi - Transfer a packet over SPI and receive the reply
> + *
> + * @ec_dev: ChromeOS EC device
> + * @ec_msg: Message to transfer
> + */
> +static int cros_ec_pkt_xfer_spi(struct cros_ec_device *ec_dev,
> +                               struct cros_ec_command *ec_msg)
> +{
> +       struct ec_host_request *request;
> +       struct ec_host_response *response;
> +       struct cros_ec_spi *ec_spi = ec_dev->priv;
> +       struct spi_transfer trans;
> +       struct spi_message msg;
> +       int i, len;
> +       u8 *ptr;
> +       u8 *rx_buf;
> +       u8 sum;
> +       int ret = 0, final_ret;
> +
> +       len = cros_ec_prepare_tx(ec_dev, ec_msg);
> +       request = (struct ec_host_request *)ec_dev->dout;
> +       dev_dbg(ec_dev->dev, "prepared, len=%d\n", len);
> +
> +       /* If it's too soon to do another transaction, wait */
> +       if (ec_spi->last_transfer_ns) {
> +               unsigned long delay;    /* The delay completed so far */
> +
> +               delay = ktime_get_ns() - ec_spi->last_transfer_ns;
> +               if (delay < EC_SPI_RECOVERY_TIME_NS)
> +                       ndelay(EC_SPI_RECOVERY_TIME_NS - delay);
> +       }
> +
> +       rx_buf = kzalloc(len, GFP_KERNEL);
> +       if (!rx_buf) {
> +               ret = -ENOMEM;
> +               goto exit;
> +       }
> +
> +       /* Transmit phase - send our message */
> +       memset(&trans, 0, sizeof(trans));
> +       trans.tx_buf = ec_dev->dout;
> +       trans.rx_buf = rx_buf;
> +       trans.len = len;
> +       trans.cs_change = 1;
> +       spi_message_init(&msg);
> +       spi_message_add_tail(&trans, &msg);
> +       ret = spi_sync(ec_spi->spi, &msg);
> +
> +       /* Get the response */
> +       if (!ret) {
> +               /* Verify that EC can process command */
> +               for (i = 0; i < len; i++) {
> +                       switch (rx_buf[i]) {
> +                       case EC_SPI_PAST_END:
> +                       case EC_SPI_RX_BAD_DATA:
> +                       case EC_SPI_NOT_READY:
> +                               ret = -EAGAIN;
> +                               ec_msg->result = EC_RES_IN_PROGRESS;
> +                       default:
> +                               break;
> +                       }
> +                       if (ret)
> +                               break;
> +               }
> +               if (!ret)
> +                       ret = cros_ec_spi_receive_packet(ec_dev,
> +                                       ec_msg->insize + sizeof(*response));
> +       } else {
> +               dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
> +       }
> +
> +       final_ret = terminate_request(ec_dev);
> +       if (!ret)
> +               ret = final_ret;
> +       if (ret < 0)
> +               goto exit;
> +
> +       ptr = ec_dev->din;
> +
> +       /* check response error code */
> +       response = (struct ec_host_response *)ptr;
> +       ec_msg->result = response->result;
> +
> +       ret = cros_ec_check_result(ec_dev, ec_msg);
> +       if (ret)
> +               goto exit;
> +
> +       len = response->data_len;
> +       sum = 0;
> +       if (len > ec_msg->insize) {
> +               dev_err(ec_dev->dev, "packet too long (%d bytes, expected %d)",
> +                       len, ec_msg->insize);
> +               ret = -EMSGSIZE;
> +               goto exit;
> +       }
> +
> +       for (i = 0; i < sizeof(*response); i++)
> +               sum += ptr[i];
> +
> +       /* copy response packet payload and compute checksum */
> +       memcpy(ec_msg->data, ptr + sizeof(*response), len);
> +       for (i = 0; i < len; i++)
> +               sum += ec_msg->data[i];
> +
> +       if (sum) {
> +               dev_err(ec_dev->dev,
> +                       "bad packet checksum, calculated %x\n",
> +                       sum);
> +               ret = -EBADMSG;
> +               goto exit;
> +       }
> +
> +       ret = len;
> +exit:
> +       kfree(rx_buf);
> +       if (ec_msg->command == EC_CMD_REBOOT_EC)
> +               msleep(EC_REBOOT_DELAY_MS);
> +
> +       return ret;
> +}
> +
> +/**
>   * cros_ec_cmd_xfer_spi - Transfer a message over SPI and receive the reply
>   *
>   * @ec_dev: ChromeOS EC device
> @@ -227,6 +490,7 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
>         struct spi_message msg;
>         int i, len;
>         u8 *ptr;
> +       u8 *rx_buf;
>         int sum;
>         int ret = 0, final_ret;
>
> @@ -242,10 +506,17 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
>                         ndelay(EC_SPI_RECOVERY_TIME_NS - delay);
>         }
>
> +       rx_buf = kzalloc(len, GFP_KERNEL);
> +       if (!rx_buf) {
> +               ret = -ENOMEM;
> +               goto exit;
> +       }
> +
>         /* Transmit phase - send our message */
>         debug_packet(ec_dev->dev, "out", ec_dev->dout, len);
>         memset(&trans, 0, sizeof(trans));
>         trans.tx_buf = ec_dev->dout;
> +       trans.rx_buf = rx_buf;
>         trans.len = len;
>         trans.cs_change = 1;
>         spi_message_init(&msg);
> @@ -254,29 +525,32 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
>
>         /* Get the response */
>         if (!ret) {
> -               ret = cros_ec_spi_receive_response(ec_dev,
> -                               ec_msg->insize + EC_MSG_TX_PROTO_BYTES);
> +               /* Verify that EC can process command */
> +               for (i = 0; i < len; i++) {
> +                       switch (rx_buf[i]) {
> +                       case EC_SPI_PAST_END:
> +                       case EC_SPI_RX_BAD_DATA:
> +                       case EC_SPI_NOT_READY:
> +                               ret = -EAGAIN;
> +                               ec_msg->result = EC_RES_IN_PROGRESS;
> +                       default:
> +                               break;
> +                       }
> +                       if (ret)
> +                               break;
> +               }
> +               if (!ret)
> +                       ret = cros_ec_spi_receive_response(ec_dev,
> +                                       ec_msg->insize + EC_MSG_TX_PROTO_BYTES);
>         } else {
>                 dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
>         }
>
> -       /*
> -        * Turn off CS, possibly adding a delay to ensure the rising edge
> -        * doesn't come too soon after the end of the data.
> -        */
> -       spi_message_init(&msg);
> -       memset(&trans, 0, sizeof(trans));
> -       trans.delay_usecs = ec_spi->end_of_msg_delay;
> -       spi_message_add_tail(&trans, &msg);
> -
> -       final_ret = spi_sync(ec_spi->spi, &msg);
> -       ec_spi->last_transfer_ns = ktime_get_ns();
> +       final_ret = terminate_request(ec_dev);
>         if (!ret)
>                 ret = final_ret;
> -       if (ret < 0) {
> -               dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
> +       if (ret < 0)
>                 goto exit;
> -       }
>
>         ptr = ec_dev->din;
>
> @@ -315,6 +589,7 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
>
>         ret = len;
>  exit:
> +       kfree(rx_buf);
>         if (ec_msg->command == EC_CMD_REBOOT_EC)
>                 msleep(EC_REBOOT_DELAY_MS);
>
> @@ -361,7 +636,7 @@ static int cros_ec_spi_probe(struct spi_device *spi)
>         ec_dev->priv = ec_spi;
>         ec_dev->irq = spi->irq;
>         ec_dev->cmd_xfer = cros_ec_cmd_xfer_spi;
> -       ec_dev->pkt_xfer = NULL;
> +       ec_dev->pkt_xfer = cros_ec_pkt_xfer_spi;
>         ec_dev->ec_name = ec_spi->spi->modalias;
>         ec_dev->phys_name = dev_name(&ec_spi->spi->dev);
>         ec_dev->din_size = EC_MSG_PREAMBLE_COUNT +
> @@ -369,6 +644,7 @@ static int cros_ec_spi_probe(struct spi_device *spi)
>                            sizeof(struct ec_response_get_protocol_info);
>         ec_dev->dout_size = sizeof(struct ec_host_request);
>
> +
>         err = cros_ec_register(ec_dev);
>         if (err) {
>                 dev_err(dev, "cannot register EC\n");
> diff --git a/drivers/platform/chrome/cros_ec_lpc.c b/drivers/platform/chrome/cros_ec_lpc.c
> index d56dfb9dd463..e98b0345288a 100644
> --- a/drivers/platform/chrome/cros_ec_lpc.c
> +++ b/drivers/platform/chrome/cros_ec_lpc.c
> @@ -46,6 +46,77 @@ static int ec_response_timed_out(void)
>         return 1;
>  }
>
> +static int cros_ec_pkt_xfer_lpc(struct cros_ec_device *ec,
> +                               struct cros_ec_command *msg)
> +{
> +       struct ec_host_request *request;
> +       struct ec_host_response response;
> +       u8 sum = 0;
> +       int i;
> +       int ret = 0;
> +       u8 *dout;
> +
> +       ret = cros_ec_prepare_tx(ec, msg);
> +
> +       /* Write buffer */
> +       for (i = 0; i < ret; i++)
> +               outb(ec->dout[i], EC_LPC_ADDR_HOST_PACKET + i);
> +
> +       request = (struct ec_host_request *)ec->dout;
> +
> +       /* Here we go */
> +       outb(EC_COMMAND_PROTOCOL_3, EC_LPC_ADDR_HOST_CMD);
> +
> +       if (ec_response_timed_out()) {
> +               dev_warn(ec->dev, "EC responsed timed out\n");
> +               ret = -EIO;
> +               goto done;
> +       }
> +
> +       /* Check result */
> +       msg->result = inb(EC_LPC_ADDR_HOST_DATA);
> +       ret = cros_ec_check_result(ec, msg);
> +       if (ret)
> +               goto done;
> +
> +       /* Read back response */
> +       dout = (u8 *)&response;
> +       for (i = 0; i < sizeof(response); i++) {
> +               dout[i] = inb(EC_LPC_ADDR_HOST_PACKET + i);
> +               sum += dout[i];
> +       }
> +
> +       msg->result = response.result;
> +
> +       if (response.data_len > msg->insize) {
> +               dev_err(ec->dev,
> +                       "packet too long (%d bytes, expected %d)",
> +                       response.data_len, msg->insize);
> +               ret = -EMSGSIZE;
> +               goto done;
> +       }
> +
> +       /* Read response and process checksum */
> +       for (i = 0; i < response.data_len; i++) {
> +               msg->data[i] =
> +                       inb(EC_LPC_ADDR_HOST_PACKET + sizeof(response) + i);
> +               sum += msg->data[i];
> +       }
> +
> +       if (sum) {
> +               dev_err(ec->dev,
> +                       "bad packet checksum %02x\n",
> +                       response.checksum);
> +               ret = -EBADMSG;
> +               goto done;
> +       }
> +
> +       /* Return actual amount of data received */
> +       ret = response.data_len;
> +done:
> +       return ret;
> +}
> +
>  static int cros_ec_cmd_xfer_lpc(struct cros_ec_device *ec,
>                                 struct cros_ec_command *msg)
>  {
> @@ -205,7 +276,7 @@ static int cros_ec_lpc_probe(struct platform_device *pdev)
>         ec_dev->ec_name = pdev->name;
>         ec_dev->phys_name = dev_name(dev);
>         ec_dev->cmd_xfer = cros_ec_cmd_xfer_lpc;
> -       ec_dev->pkt_xfer = NULL;
> +       ec_dev->pkt_xfer = cros_ec_pkt_xfer_lpc;
>         ec_dev->cmd_readmem = cros_ec_lpc_readmem;
>         ec_dev->din_size = sizeof(struct ec_host_response) +
>                            sizeof(struct ec_response_get_protocol_info);
> diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
> index f27ce4b7736b..7a201caa60c8 100644
> --- a/include/linux/mfd/cros_ec.h
> +++ b/include/linux/mfd/cros_ec.h
> @@ -22,6 +22,12 @@
>  #include <linux/mutex.h>
>
>  /*
> + * The EC is unresponsive for a time after a reboot command.  Add a
> + * simple delay to make sure that the bus stays locked.
> + */
> +#define EC_REBOOT_DELAY_MS             50
> +
> +/*
>   * Max bus-specific overhead incurred by request/responses.
>   * I2C requires 1 additional byte for requests.
>   * I2C requires 2 additional bytes for responses.
> --
> 2.1.4
>

Re: [RESEND PATCH 1/8] mfd: cros ec: Remove parent field

[Lee Jones]

On Thu, 23 Apr 2015, Gwendal Grignou wrote:

> Be consistent, use cros_ec instead of "cros ec" or "cros-ec".

What is this in reference to?

> Otherwise:
> 
> Reviewed-by: Gwendal Grignou <gwendal@chromium.org>
> Tested-by: Gwendal Grignou <gwendal@chromium.org>
> 
> On Mon, Apr 6, 2015 at 9:14 AM, Javier Martinez Canillas
> <javier.martinez@collabora.co.uk> wrote:
> > From: Gwendal Grignou <gwendal@chromium.org>
> >
> > parent and dev were pointing to the same device structure.
> > parent is unused, removed.
> >
> > Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
> > Reviewed-by: Stephen Barber <smbarber@chromium.org>
> > Tested-by: Stephen Barber <smbarber@chromium.org>
> > Reviewed-by: Puthikorn Voravootivat <puthik@chromium.org>
> > Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
> > ---
> >  drivers/mfd/cros_ec_i2c.c             | 1 -
> >  drivers/mfd/cros_ec_spi.c             | 1 -
> >  drivers/platform/chrome/cros_ec_lpc.c | 1 -
> >  include/linux/mfd/cros_ec.h           | 2 --
> >  4 files changed, 5 deletions(-)

For when you re-submit:

Acked-by: Lee Jones <lee.jones@linaro.org>

> > diff --git a/drivers/mfd/cros_ec_i2c.c b/drivers/mfd/cros_ec_i2c.c
> > index c0c30f4f946f..82b4d6148698 100644
> > --- a/drivers/mfd/cros_ec_i2c.c
> > +++ b/drivers/mfd/cros_ec_i2c.c
> > @@ -145,7 +145,6 @@ static int cros_ec_i2c_probe(struct i2c_client *client,
> >         ec_dev->cmd_xfer = cros_ec_cmd_xfer_i2c;
> >         ec_dev->ec_name = client->name;
> >         ec_dev->phys_name = client->adapter->name;
> > -       ec_dev->parent = &client->dev;
> >
> >         err = cros_ec_register(ec_dev);
> >         if (err) {
> > diff --git a/drivers/mfd/cros_ec_spi.c b/drivers/mfd/cros_ec_spi.c
> > index bf6e08e8013e..27bd52e5e8b7 100644
> > --- a/drivers/mfd/cros_ec_spi.c
> > +++ b/drivers/mfd/cros_ec_spi.c
> > @@ -363,7 +363,6 @@ static int cros_ec_spi_probe(struct spi_device *spi)
> >         ec_dev->cmd_xfer = cros_ec_cmd_xfer_spi;
> >         ec_dev->ec_name = ec_spi->spi->modalias;
> >         ec_dev->phys_name = dev_name(&ec_spi->spi->dev);
> > -       ec_dev->parent = &ec_spi->spi->dev;
> >         ec_dev->din_size = EC_MSG_BYTES + EC_MSG_PREAMBLE_COUNT;
> >         ec_dev->dout_size = EC_MSG_BYTES;
> >
> > diff --git a/drivers/platform/chrome/cros_ec_lpc.c b/drivers/platform/chrome/cros_ec_lpc.c
> > index 8f9ac4d7bbd0..860310513cf0 100644
> > --- a/drivers/platform/chrome/cros_ec_lpc.c
> > +++ b/drivers/platform/chrome/cros_ec_lpc.c
> > @@ -214,7 +214,6 @@ static int cros_ec_lpc_probe(struct platform_device *pdev)
> >         ec_dev->dev = dev;
> >         ec_dev->ec_name = pdev->name;
> >         ec_dev->phys_name = dev_name(dev);
> > -       ec_dev->parent = dev;
> >         ec_dev->cmd_xfer = cros_ec_cmd_xfer_lpc;
> >         ec_dev->cmd_readmem = cros_ec_lpc_readmem;
> >
> > diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
> > index 324a34683971..14cf522123dd 100644
> > --- a/include/linux/mfd/cros_ec.h
> > +++ b/include/linux/mfd/cros_ec.h
> > @@ -85,7 +85,6 @@ struct cros_ec_command {
> >   * to using dword.
> >   * @din_size: size of din buffer to allocate (zero to use static din)
> >   * @dout_size: size of dout buffer to allocate (zero to use static dout)
> > - * @parent: pointer to parent device (e.g. i2c or spi device)
> >   * @wake_enabled: true if this device can wake the system from sleep
> >   * @cmd_xfer: send command to EC and get response
> >   *     Returns the number of bytes received if the communication succeeded, but
> > @@ -113,7 +112,6 @@ struct cros_ec_device {
> >         uint8_t *dout;
> >         int din_size;
> >         int dout_size;
> > -       struct device *parent;
> >         bool wake_enabled;
> >         int (*cmd_xfer)(struct cros_ec_device *ec,
> >                         struct cros_ec_command *msg);
> >

-- 
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog

Re: [RESEND PATCH 3/8] mfd: cros_ec: Instantiate sub-devices from device tree

[Lee Jones]

On Mon, 06 Apr 2015, Javier Martinez Canillas wrote:

> From: Todd Broch <tbroch@chromium.org>
> 
> If the EC device tree node has sub-nodes, try to instantiate them as
> MFD sub-devices.  We can configure the EC features provided by the board.
> 
> Signed-off-by: Todd Broch <tbroch@chromium.org>
> Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
> ---
>  drivers/mfd/cros_ec.c | 22 +++++++++++-----------
>  1 file changed, 11 insertions(+), 11 deletions(-)
> 
> diff --git a/drivers/mfd/cros_ec.c b/drivers/mfd/cros_ec.c
> index c4aecc6f8373..8aa83b91e25c 100644
> --- a/drivers/mfd/cros_ec.c
> +++ b/drivers/mfd/cros_ec.c
> @@ -17,6 +17,7 @@
>   * battery charging and regulator control, firmware update.
>   */
>  
> +#include <linux/of_platform.h>
>  #include <linux/interrupt.h>
>  #include <linux/slab.h>
>  #include <linux/module.h>
> @@ -109,18 +110,8 @@ EXPORT_SYMBOL(cros_ec_cmd_xfer);
>  
>  static const struct mfd_cell cros_devs[] = {
>  	{
> -		.name = "cros-ec-keyb",
> -		.id = 1,
> -		.of_compatible = "google,cros-ec-keyb",
> -	},
> -	{
> -		.name = "cros-ec-i2c-tunnel",
> -		.id = 2,
> -		.of_compatible = "google,cros-ec-i2c-tunnel",
> -	},
> -	{
>  		.name = "cros-ec-ctl",
> -		.id = 3,
> +		.id = 1,

Can't you use PLATFORM_DEVID_AUTO?

>  	},
>  };
>  
> @@ -150,6 +141,15 @@ int cros_ec_register(struct cros_ec_device *ec_dev)
>  		return err;
>  	}
>  
> +#ifdef CONFIG_OF
> +	err = of_platform_populate(dev->of_node, NULL, NULL, dev);
> +	if (err) {
> +		mfd_remove_devices(dev);
> +		dev_err(dev, "Failed to register sub-devices\n");
> +		return err;
> +	}
> +#endif

And if we don't support OF?

>  	dev_info(dev, "Chrome EC device registered\n");
>  
>  	return 0;

-- 
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog

Re: [RESEND PATCH 6/8] mfd: cros_ec: rev cros_ec_commands.h

[Lee Jones]

On Mon, 06 Apr 2015, Javier Martinez Canillas wrote:

> From: Stephen Barber <smbarber@chromium.org>
> 
> Update cros_ec_commands.h to the latest version in the EC
> firmware sources and add power domain and passthru commands.
> 
> Also, update lightbar to use new command names.
> 
> Signed-off-by: Stephen Barber <smbarber@chromium.org>
> Reviewed-by: Randall Spangler <rspangler@chromium.org>
> Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
> ---
>  drivers/platform/chrome/cros_ec_lightbar.c |  14 +-
>  include/linux/mfd/cros_ec_commands.h       | 277 ++++++++++++++++++++++++++---
>  2 files changed, 262 insertions(+), 29 deletions(-)

Acked-by: Lee Jones <lee.jones@linaro.org>

> diff --git a/drivers/platform/chrome/cros_ec_lightbar.c b/drivers/platform/chrome/cros_ec_lightbar.c
> index 8ffec6649ead..38a9e58a9d2c 100644
> --- a/drivers/platform/chrome/cros_ec_lightbar.c
> +++ b/drivers/platform/chrome/cros_ec_lightbar.c
> @@ -196,8 +196,8 @@ static ssize_t brightness_store(struct device *dev,
>  		return -ENOMEM;
>  
>  	param = (struct ec_params_lightbar *)msg->data;
> -	param->cmd = LIGHTBAR_CMD_BRIGHTNESS;
> -	param->brightness.num = val;
> +	param->cmd = LIGHTBAR_CMD_SET_BRIGHTNESS;
> +	param->set_brightness.num = val;
>  	ret = lb_throttle();
>  	if (ret)
>  		goto exit;
> @@ -252,11 +252,11 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
>  
>  		if (i == 4) {
>  			param = (struct ec_params_lightbar *)msg->data;
> -			param->cmd = LIGHTBAR_CMD_RGB;
> -			param->rgb.led = val[0];
> -			param->rgb.red = val[1];
> -			param->rgb.green = val[2];
> -			param->rgb.blue = val[3];
> +			param->cmd = LIGHTBAR_CMD_SET_RGB;
> +			param->set_rgb.led = val[0];
> +			param->set_rgb.red = val[1];
> +			param->set_rgb.green = val[2];
> +			param->set_rgb.blue = val[3];
>  			/*
>  			 * Throttle only the first of every four transactions,
>  			 * so that the user can update all four LEDs at once.
> diff --git a/include/linux/mfd/cros_ec_commands.h b/include/linux/mfd/cros_ec_commands.h
> index a49cd41feea7..13b630c10d4c 100644
> --- a/include/linux/mfd/cros_ec_commands.h
> +++ b/include/linux/mfd/cros_ec_commands.h
> @@ -515,7 +515,7 @@ struct ec_host_response {
>  /*
>   * Notes on commands:
>   *
> - * Each command is an 8-byte command value.  Commands which take params or
> + * Each command is an 16-bit command value.  Commands which take params or
>   * return response data specify structs for that data.  If no struct is
>   * specified, the command does not input or output data, respectively.
>   * Parameter/response length is implicit in the structs.  Some underlying
> @@ -966,7 +966,7 @@ struct rgb_s {
>  /* List of tweakable parameters. NOTE: It's __packed so it can be sent in a
>   * host command, but the alignment is the same regardless. Keep it that way.
>   */
> -struct lightbar_params {
> +struct lightbar_params_v0 {
>  	/* Timing */
>  	int32_t google_ramp_up;
>  	int32_t google_ramp_down;
> @@ -1000,32 +1000,81 @@ struct lightbar_params {
>  	struct rgb_s color[8];			/* 0-3 are Google colors */
>  } __packed;
>  
> +struct lightbar_params_v1 {
> +	/* Timing */
> +	int32_t google_ramp_up;
> +	int32_t google_ramp_down;
> +	int32_t s3s0_ramp_up;
> +	int32_t s0_tick_delay[2];		/* AC=0/1 */
> +	int32_t s0a_tick_delay[2];		/* AC=0/1 */
> +	int32_t s0s3_ramp_down;
> +	int32_t s3_sleep_for;
> +	int32_t s3_ramp_up;
> +	int32_t s3_ramp_down;
> +	int32_t tap_tick_delay;
> +	int32_t tap_display_time;
> +
> +	/* Tap-for-battery params */
> +	uint8_t tap_pct_red;
> +	uint8_t tap_pct_green;
> +	uint8_t tap_seg_min_on;
> +	uint8_t tap_seg_max_on;
> +	uint8_t tap_seg_osc;
> +	uint8_t tap_idx[3];
> +
> +	/* Oscillation */
> +	uint8_t osc_min[2];			/* AC=0/1 */
> +	uint8_t osc_max[2];			/* AC=0/1 */
> +	uint8_t w_ofs[2];			/* AC=0/1 */
> +
> +	/* Brightness limits based on the backlight and AC. */
> +	uint8_t bright_bl_off_fixed[2];		/* AC=0/1 */
> +	uint8_t bright_bl_on_min[2];		/* AC=0/1 */
> +	uint8_t bright_bl_on_max[2];		/* AC=0/1 */
> +
> +	/* Battery level thresholds */
> +	uint8_t battery_threshold[LB_BATTERY_LEVELS - 1];
> +
> +	/* Map [AC][battery_level] to color index */
> +	uint8_t s0_idx[2][LB_BATTERY_LEVELS];	/* AP is running */
> +	uint8_t s3_idx[2][LB_BATTERY_LEVELS];	/* AP is sleeping */
> +
> +	/* Color palette */
> +	struct rgb_s color[8];			/* 0-3 are Google colors */
> +} __packed;
> +
>  struct ec_params_lightbar {
>  	uint8_t cmd;		      /* Command (see enum lightbar_command) */
>  	union {
>  		struct {
>  			/* no args */
> -		} dump, off, on, init, get_seq, get_params, version;
> +		} dump, off, on, init, get_seq, get_params_v0, get_params_v1,
> +			version, get_brightness, get_demo;
>  
> -		struct num {
> +		struct {
>  			uint8_t num;
> -		} brightness, seq, demo;
> +		} set_brightness, seq, demo;
>  
> -		struct reg {
> +		struct {
>  			uint8_t ctrl, reg, value;
>  		} reg;
>  
> -		struct rgb {
> +		struct {
>  			uint8_t led, red, green, blue;
> -		} rgb;
> +		} set_rgb;
> +
> +		struct {
> +			uint8_t led;
> +		} get_rgb;
>  
> -		struct lightbar_params set_params;
> +		struct lightbar_params_v0 set_params_v0;
> +		struct lightbar_params_v1 set_params_v1;
>  	};
>  } __packed;
>  
>  struct ec_response_lightbar {
>  	union {
> -		struct dump {
> +		struct {
>  			struct {
>  				uint8_t reg;
>  				uint8_t ic0;
> @@ -1033,20 +1082,26 @@ struct ec_response_lightbar {
>  			} vals[23];
>  		} dump;
>  
> -		struct get_seq {
> +		struct  {
>  			uint8_t num;
> -		} get_seq;
> +		} get_seq, get_brightness, get_demo;
>  
> -		struct lightbar_params get_params;
> +		struct lightbar_params_v0 get_params_v0;
> +		struct lightbar_params_v1 get_params_v1;
>  
> -		struct version {
> +		struct {
>  			uint32_t num;
>  			uint32_t flags;
>  		} version;
>  
>  		struct {
> +			uint8_t red, green, blue;
> +		} get_rgb;
> +
> +		struct {
>  			/* no return params */
> -		} off, on, init, brightness, seq, reg, rgb, demo, set_params;
> +		} off, on, init, set_brightness, seq, reg, set_rgb,
> +			demo, set_params_v0, set_params_v1;
>  	};
>  } __packed;
>  
> @@ -1056,15 +1111,20 @@ enum lightbar_command {
>  	LIGHTBAR_CMD_OFF = 1,
>  	LIGHTBAR_CMD_ON = 2,
>  	LIGHTBAR_CMD_INIT = 3,
> -	LIGHTBAR_CMD_BRIGHTNESS = 4,
> +	LIGHTBAR_CMD_SET_BRIGHTNESS = 4,
>  	LIGHTBAR_CMD_SEQ = 5,
>  	LIGHTBAR_CMD_REG = 6,
> -	LIGHTBAR_CMD_RGB = 7,
> +	LIGHTBAR_CMD_SET_RGB = 7,
>  	LIGHTBAR_CMD_GET_SEQ = 8,
>  	LIGHTBAR_CMD_DEMO = 9,
> -	LIGHTBAR_CMD_GET_PARAMS = 10,
> -	LIGHTBAR_CMD_SET_PARAMS = 11,
> +	LIGHTBAR_CMD_GET_PARAMS_V0 = 10,
> +	LIGHTBAR_CMD_SET_PARAMS_V0 = 11,
>  	LIGHTBAR_CMD_VERSION = 12,
> +	LIGHTBAR_CMD_GET_BRIGHTNESS = 13,
> +	LIGHTBAR_CMD_GET_RGB = 14,
> +	LIGHTBAR_CMD_GET_DEMO = 15,
> +	LIGHTBAR_CMD_GET_PARAMS_V1 = 16,
> +	LIGHTBAR_CMD_SET_PARAMS_V1 = 17,
>  	LIGHTBAR_NUM_CMDS
>  };
>  
> @@ -1421,8 +1481,40 @@ struct ec_response_rtc {
>  /*****************************************************************************/
>  /* Port80 log access */
>  
> +/* Maximum entries that can be read/written in a single command */
> +#define EC_PORT80_SIZE_MAX 32
> +
>  /* Get last port80 code from previous boot */
>  #define EC_CMD_PORT80_LAST_BOOT 0x48
> +#define EC_CMD_PORT80_READ 0x48
> +
> +enum ec_port80_subcmd {
> +	EC_PORT80_GET_INFO = 0,
> +	EC_PORT80_READ_BUFFER,
> +};
> +
> +struct ec_params_port80_read {
> +	uint16_t subcmd;
> +	union {
> +		struct {
> +			uint32_t offset;
> +			uint32_t num_entries;
> +		} read_buffer;
> +	};
> +} __packed;
> +
> +struct ec_response_port80_read {
> +	union {
> +		struct {
> +			uint32_t writes;
> +			uint32_t history_size;
> +			uint32_t last_boot;
> +		} get_info;
> +		struct {
> +			uint16_t codes[EC_PORT80_SIZE_MAX];
> +		} data;
> +	};
> +} __packed;
>  
>  struct ec_response_port80_last_boot {
>  	uint16_t code;
> @@ -1782,6 +1874,7 @@ struct ec_params_gpio_set {
>  /* Get GPIO value */
>  #define EC_CMD_GPIO_GET 0x93
>  
> +/* Version 0 of input params and response */
>  struct ec_params_gpio_get {
>  	char name[32];
>  } __packed;
> @@ -1789,6 +1882,38 @@ struct ec_response_gpio_get {
>  	uint8_t val;
>  } __packed;
>  
> +/* Version 1 of input params and response */
> +struct ec_params_gpio_get_v1 {
> +	uint8_t subcmd;
> +	union {
> +		struct {
> +			char name[32];
> +		} get_value_by_name;
> +		struct {
> +			uint8_t index;
> +		} get_info;
> +	};
> +} __packed;
> +
> +struct ec_response_gpio_get_v1 {
> +	union {
> +		struct {
> +			uint8_t val;
> +		} get_value_by_name, get_count;
> +		struct {
> +			uint8_t val;
> +			char name[32];
> +			uint32_t flags;
> +		} get_info;
> +	};
> +} __packed;
> +
> +enum gpio_get_subcmd {
> +	EC_GPIO_GET_BY_NAME = 0,
> +	EC_GPIO_GET_COUNT = 1,
> +	EC_GPIO_GET_INFO = 2,
> +};
> +
>  /*****************************************************************************/
>  /* I2C commands. Only available when flash write protect is unlocked. */
>  
> @@ -1857,13 +1982,21 @@ struct ec_params_charge_control {
>  /*****************************************************************************/
>  
>  /*
> - * Cut off battery power output if the battery supports.
> + * Cut off battery power immediately or after the host has shut down.
>   *
> - * For unsupported battery, just don't implement this command and lets EC
> - * return EC_RES_INVALID_COMMAND.
> + * return EC_RES_INVALID_COMMAND if unsupported by a board/battery.
> + *	  EC_RES_SUCCESS if the command was successful.
> + *	  EC_RES_ERROR if the cut off command failed.
>   */
> +
>  #define EC_CMD_BATTERY_CUT_OFF 0x99
>  
> +#define EC_BATTERY_CUTOFF_FLAG_AT_SHUTDOWN	(1 << 0)
> +
> +struct ec_params_battery_cutoff {
> +	uint8_t flags;
> +} __packed;
> +
>  /*****************************************************************************/
>  /* USB port mux control. */
>  
> @@ -2142,6 +2275,32 @@ struct ec_params_sb_wr_block {
>  } __packed;
>  
>  /*****************************************************************************/
> +/* Battery vendor parameters
> + *
> + * Get or set vendor-specific parameters in the battery. Implementations may
> + * differ between boards or batteries. On a set operation, the response
> + * contains the actual value set, which may be rounded or clipped from the
> + * requested value.
> + */
> +
> +#define EC_CMD_BATTERY_VENDOR_PARAM 0xb4
> +
> +enum ec_battery_vendor_param_mode {
> +	BATTERY_VENDOR_PARAM_MODE_GET = 0,
> +	BATTERY_VENDOR_PARAM_MODE_SET,
> +};
> +
> +struct ec_params_battery_vendor_param {
> +	uint32_t param;
> +	uint32_t value;
> +	uint8_t mode;
> +} __packed;
> +
> +struct ec_response_battery_vendor_param {
> +	uint32_t value;
> +} __packed;
> +
> +/*****************************************************************************/
>  /* System commands */
>  
>  /*
> @@ -2338,6 +2497,80 @@ struct ec_params_reboot_ec {
>  
>  /*****************************************************************************/
>  /*
> + * PD commands
> + *
> + * These commands are for PD MCU communication.
> + */
> +
> +/* EC to PD MCU exchange status command */
> +#define EC_CMD_PD_EXCHANGE_STATUS 0x100
> +
> +/* Status of EC being sent to PD */
> +struct ec_params_pd_status {
> +	int8_t batt_soc; /* battery state of charge */
> +} __packed;
> +
> +/* Status of PD being sent back to EC */
> +struct ec_response_pd_status {
> +	int8_t status;        /* PD MCU status */
> +	uint32_t curr_lim_ma; /* input current limit */
> +} __packed;
> +
> +/* Set USB type-C port role and muxes */
> +#define EC_CMD_USB_PD_CONTROL 0x101
> +
> +enum usb_pd_control_role {
> +	USB_PD_CTRL_ROLE_NO_CHANGE = 0,
> +	USB_PD_CTRL_ROLE_TOGGLE_ON = 1, /* == AUTO */
> +	USB_PD_CTRL_ROLE_TOGGLE_OFF = 2,
> +	USB_PD_CTRL_ROLE_FORCE_SINK = 3,
> +	USB_PD_CTRL_ROLE_FORCE_SOURCE = 4,
> +};
> +
> +enum usb_pd_control_mux {
> +	USB_PD_CTRL_MUX_NO_CHANGE = 0,
> +	USB_PD_CTRL_MUX_NONE = 1,
> +	USB_PD_CTRL_MUX_USB = 2,
> +	USB_PD_CTRL_MUX_DP = 3,
> +	USB_PD_CTRL_MUX_DOCK = 4,
> +	USB_PD_CTRL_MUX_AUTO = 5,
> +};
> +
> +struct ec_params_usb_pd_control {
> +	uint8_t port;
> +	uint8_t role;
> +	uint8_t mux;
> +} __packed;
> +
> +/*****************************************************************************/
> +/*
> + * Passthru commands
> + *
> + * Some platforms have sub-processors chained to each other.  For example.
> + *
> + *     AP <--> EC <--> PD MCU
> + *
> + * The top 2 bits of the command number are used to indicate which device the
> + * command is intended for.  Device 0 is always the device receiving the
> + * command; other device mapping is board-specific.
> + *
> + * When a device receives a command to be passed to a sub-processor, it passes
> + * it on with the device number set back to 0.  This allows the sub-processor
> + * to remain blissfully unaware of whether the command originated on the next
> + * device up the chain, or was passed through from the AP.
> + *
> + * In the above example, if the AP wants to send command 0x0002 to the PD MCU,
> + *     AP sends command 0x4002 to the EC
> + *     EC sends command 0x0002 to the PD MCU
> + *     EC forwards PD MCU response back to the AP
> + */
> +
> +/* Offset and max command number for sub-device n */
> +#define EC_CMD_PASSTHRU_OFFSET(n) (0x4000 * (n))
> +#define EC_CMD_PASSTHRU_MAX(n) (EC_CMD_PASSTHRU_OFFSET(n) + 0x3fff)
> +
> +/*****************************************************************************/
> +/*
>   * Deprecated constants. These constants have been renamed for clarity. The
>   * meaning and size has not changed. Programs that use the old names should
>   * switch to the new names soon, as the old names may not be carried forward

-- 
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog

Re: [RESEND PATCH 1/8] mfd: cros ec: Remove parent field

[Javier Martinez Canillas]

Hello Lee,

On 04/29/2015 12:37 PM, Lee Jones wrote:
> On Thu, 23 Apr 2015, Gwendal Grignou wrote:
> 
>> Be consistent, use cros_ec instead of "cros ec" or "cros-ec".
> 
> What is this in reference to?
>

I think Gwendal meant that I should be consistent in general and was not
referring to this patch particular.
 
>> Otherwise:
>> 
>> Reviewed-by: Gwendal Grignou <gwendal@chromium.org>
>> Tested-by: Gwendal Grignou <gwendal@chromium.org>
>> 
>> On Mon, Apr 6, 2015 at 9:14 AM, Javier Martinez Canillas
>> <javier.martinez@collabora.co.uk> wrote:
>> > From: Gwendal Grignou <gwendal@chromium.org>
>> >
>> > parent and dev were pointing to the same device structure.
>> > parent is unused, removed.
>> >
>> > Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
>> > Reviewed-by: Stephen Barber <smbarber@chromium.org>
>> > Tested-by: Stephen Barber <smbarber@chromium.org>
>> > Reviewed-by: Puthikorn Voravootivat <puthik@chromium.org>
>> > Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
>> > ---
>> >  drivers/mfd/cros_ec_i2c.c             | 1 -
>> >  drivers/mfd/cros_ec_spi.c             | 1 -
>> >  drivers/platform/chrome/cros_ec_lpc.c | 1 -
>> >  include/linux/mfd/cros_ec.h           | 2 --
>> >  4 files changed, 5 deletions(-)
> 
> For when you re-submit:
> 
> Acked-by: Lee Jones <lee.jones@linaro.org>
> 

Thanks a lot for your ack.

Best regards,
Javier

Re: [RESEND PATCH 3/8] mfd: cros_ec: Instantiate sub-devices from device tree

[Javier Martinez Canillas]

Hello Lee,

On 04/29/2015 12:39 PM, Lee Jones wrote:
> On Mon, 06 Apr 2015, Javier Martinez Canillas wrote:
> 
>> From: Todd Broch <tbroch@chromium.org>
>> 
>> If the EC device tree node has sub-nodes, try to instantiate them as
>> MFD sub-devices.  We can configure the EC features provided by the board.
>> 
>> Signed-off-by: Todd Broch <tbroch@chromium.org>
>> Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
>> ---
>>  drivers/mfd/cros_ec.c | 22 +++++++++++-----------
>>  1 file changed, 11 insertions(+), 11 deletions(-)
>> 
>> diff --git a/drivers/mfd/cros_ec.c b/drivers/mfd/cros_ec.c
>> index c4aecc6f8373..8aa83b91e25c 100644
>> --- a/drivers/mfd/cros_ec.c
>> +++ b/drivers/mfd/cros_ec.c
>> @@ -17,6 +17,7 @@
>>   * battery charging and regulator control, firmware update.
>>   */
>>  
>> +#include <linux/of_platform.h>
>>  #include <linux/interrupt.h>
>>  #include <linux/slab.h>
>>  #include <linux/module.h>
>> @@ -109,18 +110,8 @@ EXPORT_SYMBOL(cros_ec_cmd_xfer);
>>  
>>  static const struct mfd_cell cros_devs[] = {
>>  	{
>> -		.name = "cros-ec-keyb",
>> -		.id = 1,
>> -		.of_compatible = "google,cros-ec-keyb",
>> -	},
>> -	{
>> -		.name = "cros-ec-i2c-tunnel",
>> -		.id = 2,
>> -		.of_compatible = "google,cros-ec-i2c-tunnel",
>> -	},
>> -	{
>>  		.name = "cros-ec-ctl",
>> -		.id = 3,
>> +		.id = 1,
> 
> Can't you use PLATFORM_DEVID_AUTO?
>

Yes, I think that will work as well so I'll change it.
 
>>  	},
>>  };
>>  
>> @@ -150,6 +141,15 @@ int cros_ec_register(struct cros_ec_device *ec_dev)
>>  		return err;
>>  	}
>>  
>> +#ifdef CONFIG_OF
>> +	err = of_platform_populate(dev->of_node, NULL, NULL, dev);
>> +	if (err) {
>> +		mfd_remove_devices(dev);
>> +		dev_err(dev, "Failed to register sub-devices\n");
>> +		return err;
>> +	}
>> +#endif
> 
> And if we don't support OF?
>

These sub-devices are only present on machines that support OF so
is more flexible to use of_platform_populate() to register those.

Both machines using and not using DT, register a cros-ec-ctl which
is still a mfd_cell in the cros_devs array.

>>  	dev_info(dev, "Chrome EC device registered\n");
>>  
>>  	return 0;
> 

Best regards,
Javier

Re: [RESEND PATCH 3/8] mfd: cros_ec: Instantiate sub-devices from device tree

[Lee Jones]

On Tue, 05 May 2015, Javier Martinez Canillas wrote:

> Hello Lee,
> 
> On 04/29/2015 12:39 PM, Lee Jones wrote:
> > On Mon, 06 Apr 2015, Javier Martinez Canillas wrote:
> > 
> >> From: Todd Broch <tbroch@chromium.org>
> >> 
> >> If the EC device tree node has sub-nodes, try to instantiate them as
> >> MFD sub-devices.  We can configure the EC features provided by the board.
> >> 
> >> Signed-off-by: Todd Broch <tbroch@chromium.org>
> >> Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
> >> ---
> >>  drivers/mfd/cros_ec.c | 22 +++++++++++-----------
> >>  1 file changed, 11 insertions(+), 11 deletions(-)
> >> 
> >> diff --git a/drivers/mfd/cros_ec.c b/drivers/mfd/cros_ec.c
> >> index c4aecc6f8373..8aa83b91e25c 100644
> >> --- a/drivers/mfd/cros_ec.c
> >> +++ b/drivers/mfd/cros_ec.c
> >> @@ -17,6 +17,7 @@
> >>   * battery charging and regulator control, firmware update.
> >>   */
> >>  
> >> +#include <linux/of_platform.h>
> >>  #include <linux/interrupt.h>
> >>  #include <linux/slab.h>
> >>  #include <linux/module.h>
> >> @@ -109,18 +110,8 @@ EXPORT_SYMBOL(cros_ec_cmd_xfer);
> >>  
> >>  static const struct mfd_cell cros_devs[] = {
> >>  	{
> >> -		.name = "cros-ec-keyb",
> >> -		.id = 1,
> >> -		.of_compatible = "google,cros-ec-keyb",
> >> -	},
> >> -	{
> >> -		.name = "cros-ec-i2c-tunnel",
> >> -		.id = 2,
> >> -		.of_compatible = "google,cros-ec-i2c-tunnel",
> >> -	},
> >> -	{
> >>  		.name = "cros-ec-ctl",
> >> -		.id = 3,
> >> +		.id = 1,
> > 
> > Can't you use PLATFORM_DEVID_AUTO?
> >
> 
> Yes, I think that will work as well so I'll change it.
>  
> >>  	},
> >>  };
> >>  
> >> @@ -150,6 +141,15 @@ int cros_ec_register(struct cros_ec_device *ec_dev)
> >>  		return err;
> >>  	}
> >>  
> >> +#ifdef CONFIG_OF
> >> +	err = of_platform_populate(dev->of_node, NULL, NULL, dev);
> >> +	if (err) {
> >> +		mfd_remove_devices(dev);
> >> +		dev_err(dev, "Failed to register sub-devices\n");
> >> +		return err;
> >> +	}
> >> +#endif
> > 
> > And if we don't support OF?
> >
> 
> These sub-devices are only present on machines that support OF so
> is more flexible to use of_platform_populate() to register those.
> 
> Both machines using and not using DT, register a cros-ec-ctl which
> is still a mfd_cell in the cros_devs array.

I'm not really a fan of #ifdiffery if it can be avoided.

How about?

if (np)
   cros_ec_of_register();

> >>  	dev_info(dev, "Chrome EC device registered\n");
> >>  
> >>  	return 0;
> > 
> 
> Best regards,
> Javier

-- 
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog

Re: [RESEND PATCH 1/8] mfd: cros ec: Remove parent field

[Lee Jones]

On Tue, 05 May 2015, Javier Martinez Canillas wrote:
> On 04/29/2015 12:37 PM, Lee Jones wrote:
> > On Thu, 23 Apr 2015, Gwendal Grignou wrote:
> > 
> >> Be consistent, use cros_ec instead of "cros ec" or "cros-ec".
> > 
> > What is this in reference to?
> >
> 
> I think Gwendal meant that I should be consistent in general and was not
> referring to this patch particular.

Better to quote one of the offending occurrences than to randomly
top-post helpful comments.

> >> Otherwise:
> >> 
> >> Reviewed-by: Gwendal Grignou <gwendal@chromium.org>
> >> Tested-by: Gwendal Grignou <gwendal@chromium.org>
> >> 
> >> On Mon, Apr 6, 2015 at 9:14 AM, Javier Martinez Canillas
> >> <javier.martinez@collabora.co.uk> wrote:
> >> > From: Gwendal Grignou <gwendal@chromium.org>
> >> >
> >> > parent and dev were pointing to the same device structure.
> >> > parent is unused, removed.
> >> >
> >> > Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
> >> > Reviewed-by: Stephen Barber <smbarber@chromium.org>
> >> > Tested-by: Stephen Barber <smbarber@chromium.org>
> >> > Reviewed-by: Puthikorn Voravootivat <puthik@chromium.org>
> >> > Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
> >> > ---
> >> >  drivers/mfd/cros_ec_i2c.c             | 1 -
> >> >  drivers/mfd/cros_ec_spi.c             | 1 -
> >> >  drivers/platform/chrome/cros_ec_lpc.c | 1 -
> >> >  include/linux/mfd/cros_ec.h           | 2 --
> >> >  4 files changed, 5 deletions(-)
> > 
> > For when you re-submit:
> > 
> > Acked-by: Lee Jones <lee.jones@linaro.org>
> > 
> 
> Thanks a lot for your ack.
> 
> Best regards,
> Javier

-- 
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog

Re: [RESEND PATCH 3/8] mfd: cros_ec: Instantiate sub-devices from device tree

[Javier Martinez Canillas]

Hello Lee,

On 05/05/2015 12:53 PM, Lee Jones wrote:
> On Tue, 05 May 2015, Javier Martinez Canillas wrote:
>> >>  };
>> >>  
>> >> @@ -150,6 +141,15 @@ int cros_ec_register(struct cros_ec_device *ec_dev)
>> >>  		return err;
>> >>  	}
>> >>  
>> >> +#ifdef CONFIG_OF
>> >> +	err = of_platform_populate(dev->of_node, NULL, NULL, dev);
>> >> +	if (err) {
>> >> +		mfd_remove_devices(dev);
>> >> +		dev_err(dev, "Failed to register sub-devices\n");
>> >> +		return err;
>> >> +	}
>> >> +#endif
>> > 
>> > And if we don't support OF?
>> >
>> 
>> These sub-devices are only present on machines that support OF so
>> is more flexible to use of_platform_populate() to register those.
>> 
>> Both machines using and not using DT, register a cros-ec-ctl which
>> is still a mfd_cell in the cros_devs array.
> 
> I'm not really a fan of #ifdiffery if it can be avoided.
> 
> How about?
> 
> if (np)
>    cros_ec_of_register();
> 

Works for me, I'll change it to avoid the ifdeffery.

Best regards,
Javier

Re: [RESEND PATCH 5/8] mfd: cros-ec: Support multiple EC in a system

[Javier Martinez Canillas]

Hello Gwendal,

On 04/24/2015 01:54 AM, Gwendal Grignou wrote:
> This patch needs  https://chromium-review.googlesource.com/217297:
> /dev/cros_ec0 was not a good idea, because it is difficult to know
> what it represents.
>

Thanks for the information, I'll squash $subject and the patch you
pointed out then if you agree.

Best regards,
Javier

Re: [RESEND PATCH 4/8] mfd: cros_ec: Use a zero-length array for command data

[Javier Martinez Canillas]

Hello Gwendal,

Thanks a lot for your feedback.

On 04/24/2015 07:19 AM, Gwendal Grignou wrote:
> In general we can use kmalloc instead of kzalloc. Also some commands
> do not need malloc at all. We could allocate on stack for known small
> commands and for the keyboard case use the caller argument.
>

Sure, I'll do all the changes that you suggested when respinning the patches.
 
> Gwendal.
> 

Best regards,
Javier

Re: [RESEND PATCH 4/8] mfd: cros_ec: Use a zero-length array for command data

[Javier Martinez Canillas]

Hello Gwendal,

On 04/24/2015 10:29 PM, Gwendal Grignou wrote:
> On Mon, Apr 6, 2015 at 9:15 AM, Javier Martinez Canillas
> <javier.martinez@collabora.co.uk> wrote:

[snip]

>>
>> @@ -110,17 +115,25 @@ static ssize_t ec_device_read(struct file *filp, char __user *buffer,
>>  static long ec_device_ioctl_xcmd(struct cros_ec_device *ec, void __user *arg)
>>  {
>>         long ret;
>> -       struct cros_ec_command s_cmd = { };
>> +       int len;
>> +       struct cros_ec_command *u_cmd = arg;
>> +       struct cros_ec_command *s_cmd;
>> +
>> +       len = max(u_cmd->outsize, u_cmd->insize);
> It does not work, u_cmd is not accessible yet. You should do:
> struct cros_ec_command u_cmd;
> if (copy_from_user(&u_cmd, arg, sizeof(u_cmd)))
>   return -EFAULT;
> len = max(u_cmd.outsize, u_cmd.insize);
> 
>

Right, I'll change that.
 
>> +
>> +       s_cmd = kzalloc(sizeof(*s_cmd) + len, GFP_KERNEL);
>> +       if (!s_cmd)
>> +               return -ENOMEM;
>>
>> -       if (copy_from_user(&s_cmd, arg, sizeof(s_cmd)))
>> +       if (copy_from_user(s_cmd, arg, sizeof(*s_cmd) + len))
> sizeof(*s_cmd) + u_cmd.outsize is good enough.

Ok.

>>                 return -EFAULT;
>>
>> -       ret = cros_ec_cmd_xfer(ec, &s_cmd);
>> +       ret = cros_ec_cmd_xfer(ec, s_cmd);
>>         /* Only copy data to userland if data was received. */
>>         if (ret < 0)
>>                 return ret;
>>
>> -       if (copy_to_user(arg, &s_cmd, sizeof(s_cmd)))
>> +       if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + len))
> sizeof(*s_cmd) + min(ret, u_cmd.insize) is safer

Sure.

>>                 return -EFAULT;
>>
>>         return 0;
> I missed this one earlier. Tools expect the number of byte read, so it should be
> return ret;
> 

Ok, I'll change that as well.

Thanks a lot for your feedback!

Best regards,
Javier

Re: [RESEND PATCH 7/8] mfd: cros_ec: add proto v3 skeleton

[Javier Martinez Canillas]

Hello Gwendal,

On 04/26/2015 03:39 AM, Gwendal Grignou wrote:
> You can merge change
> https://chromium-review.googlesource.com/#/c/262870/ with it, that
> fixes an issue with newer firmware.
> 

Thanks a lot for the pointer, I'll squash that fix then.

> Reviewed-by: Gwendal Grignou <gwendal@chromium.org>
> Tested-by: Gwendal Grignou <gwendal@chromium.org>
> 

Best regards,
Javier

Re: [RESEND PATCH 1/8] mfd: cros ec: Remove parent field

[Javier Martinez Canillas]

Hello Lee,

On 05/05/2015 12:54 PM, Lee Jones wrote:
> On Tue, 05 May 2015, Javier Martinez Canillas wrote:
>> On 04/29/2015 12:37 PM, Lee Jones wrote:
>> > On Thu, 23 Apr 2015, Gwendal Grignou wrote:
>> > 
>> >> Be consistent, use cros_ec instead of "cros ec" or "cros-ec".
>> > 
>> > What is this in reference to?
>> >
>> 
>> I think Gwendal meant that I should be consistent in general and was not
>> referring to this patch particular.
> 
> Better to quote one of the offending occurrences than to randomly
> top-post helpful comments.
> 

Just for clarification, on a second read I noticed that Gwendal was talking
about the subject line since $subject uses "mfd: cros ec" as a prefix while
most of the commits in the subsystem (and in the series) use "mfd: cros_ec".
Also, there is another patch (5/8) that used "mfd: cros-ec" so he is right
that I should had used cros_ec consistently.

Sorry for missing that and I will fix when posting v2.

Best regards,
Javier