diff --git a/configs/peach-pi_defconfig b/configs/peach-pi_defconfig
index c17fc73..5050f5b 100644
--- a/configs/peach-pi_defconfig
+++ b/configs/peach-pi_defconfig
@@ -12,3 +12,5 @@
 CONFIG_CROS_EC_KEYB=y
 CONFIG_USB=y
 CONFIG_DM_USB=y
+CONFIG_I2C_MUX=y
+CONFIG_I2C_CROS_EC_TUNNEL=y
diff --git a/configs/peach-pit_defconfig b/configs/peach-pit_defconfig
index 8f21722..d19bff2 100644
--- a/configs/peach-pit_defconfig
+++ b/configs/peach-pit_defconfig
@@ -12,3 +12,5 @@
 CONFIG_CROS_EC_KEYB=y
 CONFIG_USB=y
 CONFIG_DM_USB=y
+CONFIG_I2C_MUX=y
+CONFIG_I2C_CROS_EC_TUNNEL=y
diff --git a/drivers/i2c/Kconfig b/drivers/i2c/Kconfig
index caee3d8..e861b53 100644
--- a/drivers/i2c/Kconfig
+++ b/drivers/i2c/Kconfig
@@ -19,6 +19,17 @@
 	  to convert all code for a board in a single commit. It should not
 	  be enabled for any board in an official release.
 
+config I2C_CROS_EC_TUNNEL
+	tristate "Chrome OS EC tunnel I2C bus"
+	depends on CROS_EC
+	help
+	  This provides an I2C bus that will tunnel i2c commands through to
+	  the other side of the Chrome OS EC to the I2C bus connected there.
+	  This will work whatever the interface used to talk to the EC (SPI,
+	  I2C or LPC). Some Chromebooks use this when the hardware design
+	  does not allow direct access to the main PMIC from the AP.
+
+
 config DM_I2C_GPIO
 	bool "Enable Driver Model for software emulated I2C bus driver"
 	depends on DM_I2C && DM_GPIO
diff --git a/drivers/i2c/Makefile b/drivers/i2c/Makefile
index dc9e81b..7f01fce 100644
--- a/drivers/i2c/Makefile
+++ b/drivers/i2c/Makefile
@@ -7,6 +7,7 @@
 obj-$(CONFIG_DM_I2C) += i2c-uclass.o
 obj-$(CONFIG_DM_I2C_COMPAT) += i2c-uclass-compat.o
 obj-$(CONFIG_DM_I2C_GPIO) += i2c-gpio.o
+obj-$(CONFIG_I2C_CROS_EC_TUNNEL) += cros_ec_tunnel.o
 
 obj-$(CONFIG_SYS_I2C_ADI) += adi_i2c.o
 obj-$(CONFIG_I2C_MV) += mv_i2c.o
diff --git a/drivers/i2c/cros_ec_tunnel.c b/drivers/i2c/cros_ec_tunnel.c
new file mode 100644
index 0000000..7ab1fd8
--- /dev/null
+++ b/drivers/i2c/cros_ec_tunnel.c
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2015 Google, Inc
+ * Written by Simon Glass <sjg@chromium.org>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <dm.h>
+#include <cros_ec.h>
+#include <errno.h>
+#include <i2c.h>
+
+static int cros_ec_i2c_set_bus_speed(struct udevice *dev, unsigned int speed)
+{
+	return 0;
+}
+
+static int cros_ec_i2c_xfer(struct udevice *dev, struct i2c_msg *msg,
+			    int nmsgs)
+{
+	return cros_ec_i2c_tunnel(dev->parent, msg, nmsgs);
+}
+
+static const struct dm_i2c_ops cros_ec_i2c_ops = {
+	.xfer		= cros_ec_i2c_xfer,
+	.set_bus_speed	= cros_ec_i2c_set_bus_speed,
+};
+
+static const struct udevice_id cros_ec_i2c_ids[] = {
+	{ .compatible = "google,cros-ec-i2c-tunnel" },
+	{ }
+};
+
+U_BOOT_DRIVER(cros_ec_tunnel) = {
+	.name	= "cros_ec_tunnel",
+	.id	= UCLASS_I2C,
+	.of_match = cros_ec_i2c_ids,
+	.per_child_auto_alloc_size = sizeof(struct dm_i2c_chip),
+	.ops	= &cros_ec_i2c_ops,
+};
diff --git a/drivers/misc/cros_ec.c b/drivers/misc/cros_ec.c
index 4b6ac6a..ae52561 100644
--- a/drivers/misc/cros_ec.c
+++ b/drivers/misc/cros_ec.c
@@ -26,6 +26,7 @@
 #include <asm/io.h>
 #include <asm-generic/gpio.h>
 #include <dm/device-internal.h>
+#include <dm/root.h>
 #include <dm/uclass-internal.h>
 
 #ifdef DEBUG_TRACE
@@ -1053,8 +1054,8 @@
 	return 0;
 }
 
-int cros_ec_i2c_xfer(struct cros_ec_dev *dev, uchar chip, uint addr,
-		     int alen, uchar *buffer, int len, int is_read)
+int cros_ec_i2c_xfer_old(struct cros_ec_dev *dev, uchar chip, uint addr,
+			 int alen, uchar *buffer, int len, int is_read)
 {
 	union {
 		struct ec_params_i2c_passthru p;
@@ -1134,6 +1135,81 @@
 	return 0;
 }
 
+int cros_ec_i2c_tunnel(struct udevice *dev, struct i2c_msg *in, int nmsgs)
+{
+	struct cros_ec_dev *cdev = dev_get_uclass_priv(dev);
+	union {
+		struct ec_params_i2c_passthru p;
+		uint8_t outbuf[EC_PROTO2_MAX_PARAM_SIZE];
+	} params;
+	union {
+		struct ec_response_i2c_passthru r;
+		uint8_t inbuf[EC_PROTO2_MAX_PARAM_SIZE];
+	} response;
+	struct ec_params_i2c_passthru *p = &params.p;
+	struct ec_response_i2c_passthru *r = &response.r;
+	struct ec_params_i2c_passthru_msg *msg;
+	uint8_t *pdata, *read_ptr = NULL;
+	int read_len;
+	int size;
+	int rv;
+	int i;
+
+	p->port = 0;
+
+	p->num_msgs = nmsgs;
+	size = sizeof(*p) + p->num_msgs * sizeof(*msg);
+
+	/* Create a message to write the register address and optional data */
+	pdata = (uint8_t *)p + size;
+
+	read_len = 0;
+	for (i = 0, msg = p->msg; i < nmsgs; i++, msg++, in++) {
+		bool is_read = in->flags & I2C_M_RD;
+
+		msg->addr_flags = in->addr;
+		msg->len = in->len;
+		if (is_read) {
+			msg->addr_flags |= EC_I2C_FLAG_READ;
+			read_len += in->len;
+			read_ptr = in->buf;
+			if (sizeof(*r) + read_len > sizeof(response)) {
+				puts("Read length too big for buffer\n");
+				return -1;
+			}
+		} else {
+			if (pdata - (uint8_t *)p + in->len > sizeof(params)) {
+				puts("Params too large for buffer\n");
+				return -1;
+			}
+			memcpy(pdata, in->buf, in->len);
+			pdata += in->len;
+		}
+	}
+
+	rv = ec_command(cdev, EC_CMD_I2C_PASSTHRU, 0, p, pdata - (uint8_t *)p,
+			r, sizeof(*r) + read_len);
+	if (rv < 0)
+		return rv;
+
+	/* Parse response */
+	if (r->i2c_status & EC_I2C_STATUS_ERROR) {
+		printf("Transfer failed with status=0x%x\n", r->i2c_status);
+		return -1;
+	}
+
+	if (rv < sizeof(*r) + read_len) {
+		puts("Truncated read response\n");
+		return -1;
+	}
+
+	/* We only support a single read message for each transfer */
+	if (read_len)
+		memcpy(read_ptr, r->data, read_len);
+
+	return 0;
+}
+
 #ifdef CONFIG_CMD_CROS_EC
 
 /**
@@ -1267,8 +1343,8 @@
 
 		linebytes = (nbytes > DISP_LINE_LEN) ? DISP_LINE_LEN : nbytes;
 
-		if (cros_ec_i2c_xfer(dev, chip, addr, alen, linebuf, linebytes,
-				     1))
+		if (cros_ec_i2c_xfer_old(dev, chip, addr, alen, linebuf,
+					 linebytes, 1))
 			puts("Error reading the chip.\n");
 		else {
 			printf("%04x:", addr);
@@ -1333,7 +1409,7 @@
 		count = 1;
 
 	while (count-- > 0) {
-		if (cros_ec_i2c_xfer(dev, chip, addr++, alen, &byte, 1, 0))
+		if (cros_ec_i2c_xfer_old(dev, chip, addr++, alen, &byte, 1, 0))
 			puts("Error writing the chip.\n");
 		/*
 		 * Wait for the write to complete.  The write can take
@@ -1633,6 +1709,12 @@
 	return ret;
 }
 
+int cros_ec_post_bind(struct udevice *dev)
+{
+	/* Scan for available EC devices (e.g. I2C tunnel) */
+	return dm_scan_fdt_node(dev, gd->fdt_blob, dev->of_offset, false);
+}
+
 U_BOOT_CMD(
 	crosec,	6,	1,	do_cros_ec,
 	"CROS-EC utility command",
@@ -1661,4 +1743,5 @@
 	.id		= UCLASS_CROS_EC,
 	.name		= "cros_ec",
 	.per_device_auto_alloc_size = sizeof(struct cros_ec_dev),
+	.post_bind	= cros_ec_post_bind,
 };
diff --git a/drivers/power/pmic/pmic_tps65090_ec.c b/drivers/power/pmic/pmic_tps65090_ec.c
index ac0d44f..f79a878 100644
--- a/drivers/power/pmic/pmic_tps65090_ec.c
+++ b/drivers/power/pmic/pmic_tps65090_ec.c
@@ -56,8 +56,8 @@
  */
 static int tps65090_read(u32 reg, u8 *val)
 {
-	return cros_ec_i2c_xfer(config.dev, TPS65090_ADDR, reg, 1,
-				val, 1, true);
+	return cros_ec_i2c_xfer_old(config.dev, TPS65090_ADDR, reg, 1,
+				    val, 1, true);
 }
 
 /**
@@ -69,8 +69,8 @@
  */
 static int tps65090_write(u32 reg, u8 val)
 {
-	return cros_ec_i2c_xfer(config.dev, TPS65090_ADDR, reg, 1,
-				&val, 1, false);
+	return cros_ec_i2c_xfer_old(config.dev, TPS65090_ADDR, reg, 1,
+				    &val, 1, false);
 }
 
 /**
diff --git a/include/cros_ec.h b/include/cros_ec.h
index 3b2be2c..41951c3 100644
--- a/include/cros_ec.h
+++ b/include/cros_ec.h
@@ -390,10 +390,20 @@
  */
 void cros_ec_check_keyboard(struct cros_ec_dev *dev);
 
+struct i2c_msg;
 /*
  * Tunnel an I2C transfer to the EC
  *
  * @param dev		CROS-EC device
+ * @param msg		List of messages to transfer
+ * @param nmsgs		Number of messages to transfer
+ */
+int cros_ec_i2c_tunnel(struct udevice *dev, struct i2c_msg *msg, int nmsgs);
+
+/*
+ * Tunnel an I2C transfer to the EC
+ *
+ * @param dev		CROS-EC device
  * @param chip		Chip address (7-bit I2C address)
  * @param addr		Register address to read/write
  * @param alen		Length of register address in bytes
@@ -401,7 +411,7 @@
  * @param len		Length of buffer
  * @param is_read	1 if this is a read, 0 if this is a write
  */
-int cros_ec_i2c_xfer(struct cros_ec_dev *dev, uchar chip, uint addr,
-		     int alen, uchar *buffer, int len, int is_read);
+int cros_ec_i2c_xfer_old(struct cros_ec_dev *dev, uchar chip, uint addr,
+			 int alen, uchar *buffer, int len, int is_read);
 
 #endif