1 /* $OpenBSD: i2c_scan.c,v 1.97 2007/04/10 17:47:55 miod Exp $ */
2
3 /*
4 * Copyright (c) 2005 Theo de Raadt <deraadt@openbsd.org>
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19 /*
20 * I2C bus scanning.
21 */
22
23 #include <sys/param.h>
24 #include <sys/systm.h>
25 #include <sys/device.h>
26
27 #define _I2C_PRIVATE
28 #include <dev/i2c/i2cvar.h>
29
30 #undef I2C_DEBUG
31 #define I2C_VERBOSE
32
33 void iic_probe(struct device *, struct i2cbus_attach_args *, u_int8_t);
34
35 /*
36 * Addresses at which to probe for sensors. Skip address 0x4f, since
37 * probing it seems to crash at least one Sony VAIO laptop. Only a
38 * few chips can actually sit at that address, and vendors seem to
39 * place those at other addresses, so this isn't a big loss.
40 */
41 struct {
42 u_int8_t start, end;
43 } probe_addrs[] = {
44 { 0x18, 0x18 },
45 { 0x1a, 0x1a },
46 { 0x20, 0x2f },
47 { 0x48, 0x4e }
48 };
49
50 #define MAX_IGNORE 8
51 u_int8_t ignore_addrs[MAX_IGNORE];
52
53 /*
54 * Some Maxim 1617 clones MAY NOT even read cmd 0xfc! When it is
55 * read, they will power-on-reset. Their default condition
56 * (control register bit 0x80) therefore will be that they assert
57 * /ALERT for the 5 potential errors that may occur. One of those
58 * errors is that the external temperature diode is missing. This
59 * is unfortunately a common choice of system designers, except
60 * suddenly now we get a /ALERT, which may on some chipsets cause
61 * us to receive an entirely unexpected SMI .. and then an NMI.
62 *
63 * As we probe each device, if we hit something which looks suspiciously
64 * like it may potentially be a 1617 or clone, we immediately set this
65 * variable to avoid reading that register offset.
66 */
67 int skip_fc;
68
69 static i2c_tag_t probe_ic;
70 static u_int8_t probe_addr;
71 static u_int8_t probe_val[256];
72
73 void iicprobeinit(struct i2cbus_attach_args *, u_int8_t);
74 u_int8_t iicprobenc(u_int8_t);
75 u_int8_t iicprobe(u_int8_t);
76 u_int16_t iicprobew(u_int8_t);
77 char *lm75probe(void);
78 char *adm1032cloneprobe(u_int8_t);
79 void iic_dump(struct device *, u_int8_t, char *);
80
81 void
82 iicprobeinit(struct i2cbus_attach_args *iba, u_int8_t addr)
83 {
84 probe_ic = iba->iba_tag;
85 probe_addr = addr;
86 memset(probe_val, 0xff, sizeof probe_val);
87 }
88
89 u_int8_t
90 iicprobenc(u_int8_t cmd)
91 {
92 u_int8_t data;
93
94 /*
95 * If we think we are talking to an evil Maxim 1617 or clone,
96 * avoid accessing this register because it is death.
97 */
98 if (skip_fc && cmd == 0xfc)
99 return (0xff);
100 iic_acquire_bus(probe_ic, 0);
101 if (iic_exec(probe_ic, I2C_OP_READ_WITH_STOP,
102 probe_addr, &cmd, 1, &data, 1, 0) != 0)
103 data = 0xff;
104 iic_release_bus(probe_ic, 0);
105 return (data);
106 }
107
108 u_int16_t
109 iicprobew(u_int8_t cmd)
110 {
111 u_int8_t data[2];
112
113 /*
114 * If we think we are talking to an evil Maxim 1617 or clone,
115 * avoid accessing this register because it is death.
116 */
117 if (skip_fc && cmd == 0xfc)
118 return (0xffff);
119 iic_acquire_bus(probe_ic, 0);
120 if (iic_exec(probe_ic, I2C_OP_READ_WITH_STOP,
121 probe_addr, &cmd, 1, &data, 2, 0) != 0)
122 data[0] = data[1] = 0xff;
123 iic_release_bus(probe_ic, 0);
124 return ((data[0] << 8) | data[1]);
125 }
126
127 u_int8_t
128 iicprobe(u_int8_t cmd)
129 {
130 if (probe_val[cmd] != 0xff)
131 return probe_val[cmd];
132 probe_val[cmd] = iicprobenc(cmd);
133 return (probe_val[cmd]);
134 }
135
136 #define LM75TEMP 0x00
137 #define LM75CONF 0x01
138 #define LM75Thyst 0x02
139 #define LM75Tos 0x03
140 #define LM77Tlow 0x04
141 #define LM77Thigh 0x05
142 #define LM75TMASK 0xff80 /* 9 bits in temperature registers */
143 #define LM77TMASK 0xfff8 /* 13 bits in temperature registers */
144
145 /*
146 * The LM75/LM75A/LM77 family are very hard to detect. Thus, we check
147 * for all other possible chips first. These chips do not have an
148 * ID register. They do have a few quirks though:
149 * - on the LM75 and LM77, registers 0x06 and 0x07 return whatever
150 * value was read before
151 * - the LM75 lacks registers 0x04 and 0x05, so those act as above
152 * - the LM75A returns 0xffff for registers 0x04, 0x05, 0x06 and 0x07
153 * - the chip registers loop every 8 registers
154 * The downside is that we must read almost every register to guess
155 * if this is an LM75, LM75A or LM77.
156 */
157 char *
158 lm75probe(void)
159 {
160 u_int16_t temp, thyst, tos, tlow, thigh, mask = LM75TMASK;
161 u_int8_t conf;
162 int i, echocount, ffffcount, score;
163 int echoreg67, echoreg45, ffffreg67, ffffreg45;
164
165 temp = iicprobew(LM75TEMP);
166
167 /*
168 * Sometimes the other probes can upset the chip, if we get 0xffff
169 * the first time, try it once more.
170 */
171 if (temp == 0xffff)
172 temp = iicprobew(LM75TEMP);
173
174 conf = iicprobenc(LM75CONF);
175 thyst = iicprobew(LM75Thyst);
176 tos = iicprobew(LM75Tos);
177
178 /* totally bogus data */
179 if (conf == 0xff && temp == 0xffff && thyst == 0xffff)
180 return (NULL);
181
182 temp &= mask;
183 thyst &= mask;
184 tos &= mask;
185
186 /* All values the same? Very unlikely */
187 if (temp == thyst && thyst == tos)
188 return (NULL);
189
190 #if notsure
191 /* more register aliasing effects that indicate not a lm75 */
192 if ((temp >> 8) == conf)
193 return (NULL);
194 #endif
195
196 /*
197 * LM77/LM75 registers 6, 7
198 * echo whatever was read just before them from reg 0, 1, or 2
199 *
200 * LM75A doesn't appear to do this, but does appear to reliably
201 * return 0xffff
202 */
203 for (i = 6, echocount = 2, ffffcount = 0; i <= 7; i++) {
204 if ((iicprobew(LM75TEMP) & mask) != (iicprobew(i) & mask) ||
205 (iicprobew(LM75Thyst) & mask) != (iicprobew(i) & mask) ||
206 (iicprobew(LM75Tos) & mask) != (iicprobew(i) & mask))
207 echocount--;
208 if (iicprobew(i) == 0xffff)
209 ffffcount++;
210 }
211
212 /* Make sure either both registers echo, or neither does */
213 if (echocount == 1 || ffffcount == 1)
214 return (NULL);
215
216 echoreg67 = (echocount == 0) ? 0 : 1;
217 ffffreg67 = (ffffcount == 0) ? 0 : 1;
218
219 /*
220 * LM75 has no registers 4 or 5, and they will act as echos too
221 *
222 * LM75A doesn't appear to do this either, but does appear to
223 * reliably return 0xffff
224 */
225 for (i = 4, echocount = 2, ffffcount = 0; i <= 5; i++) {
226 if ((iicprobew(LM75TEMP) & mask) != (iicprobew(i) & mask) ||
227 (iicprobew(LM75Thyst) & mask) != (iicprobew(i) & mask) ||
228 (iicprobew(LM75Tos) & mask) != (iicprobew(i) & mask))
229 echocount--;
230 if (iicprobew(i) == 0xffff)
231 ffffcount++;
232 }
233
234 /* Make sure either both registers echo, or neither does */
235 if (echocount == 1 || ffffcount == 1)
236 return (NULL);
237
238 echoreg45 = (echocount == 0) ? 0 : 1;
239 ffffreg45 = (ffffcount == 0) ? 0 : 1;
240
241 /*
242 * If we find that 4 and 5 are not echos, and don't return 0xffff
243 * then based on whether the echo test of registers 6 and 7
244 * succeeded or not, we may have an LM77
245 */
246 if (echoreg45 == 0 && ffffreg45 == 0 && echoreg67 == 1) {
247 mask = LM77TMASK;
248
249 /* mask size changed, must re-read for the next checks */
250 thyst = iicprobew(LM75Thyst) & mask;
251 tos = iicprobew(LM75Tos) & mask;
252 tlow = iicprobew(LM77Tlow) & mask;
253 thigh = iicprobew(LM77Thigh) & mask;
254 }
255
256 /* a real LM75/LM75A/LM77 repeats its registers.... */
257 for (i = 0x08; i <= 0xf8; i += 8) {
258 if (conf != iicprobenc(LM75CONF + i) ||
259 thyst != (iicprobew(LM75Thyst + i) & mask) ||
260 tos != (iicprobew(LM75Tos + i) & mask))
261 return (NULL);
262
263 /*
264 * Check that the repeated registers 0x06 and 0x07 still
265 * either echo or return 0xffff
266 */
267 if (echoreg67 == 1) {
268 tos = iicprobew(LM75Tos) & mask;
269 if (tos != (iicprobew(0x06 + i) & mask) ||
270 tos != (iicprobew(0x07 + i) & mask))
271 return (NULL);
272 } else if (ffffreg67 == 1)
273 if (iicprobew(0x06 + i) != 0xffff ||
274 iicprobew(0x07 + i) != 0xffff)
275 return (NULL);
276
277 /*
278 * Check that the repeated registers 0x04 and 0x05 still
279 * either echo or return 0xffff. If they do neither, and
280 * registers 0x06 and 0x07 echo, then we will be probing
281 * for an LM77, so make sure those still repeat
282 */
283 if (echoreg45 == 1) {
284 tos = iicprobew(LM75Tos) & mask;
285 if (tos != (iicprobew(LM77Tlow + i) & mask) ||
286 tos != (iicprobew(LM77Thigh + i) & mask))
287 return (NULL);
288 } else if (ffffreg45 == 1) {
289 if (iicprobew(LM77Tlow + i) != 0xffff ||
290 iicprobew(LM77Thigh + i) != 0xffff)
291 return (NULL);
292 } else if (echoreg67 == 1)
293 if (tlow != (iicprobew(LM77Tlow + i) & mask) ||
294 thigh != (iicprobew(LM77Thigh + i) & mask))
295 return (NULL);
296 }
297
298 /*
299 * Given that we now know how the first eight registers behave and
300 * that this behaviour is consistently repeated, we can now use
301 * the following table:
302 *
303 * echoreg67 | echoreg45 | ffffreg67 | ffffreg45 | chip
304 * ----------+-----------+-----------+-----------+------
305 * 1 | 1 | 0 | 0 | LM75
306 * 1 | 0 | 0 | 0 | LM77
307 * 0 | 0 | 1 | 1 | LM75A
308 */
309
310 /* Convert the various flags into a single score */
311 score = (echoreg67 << 3) + (echoreg45 << 2) + (ffffreg67 << 1) +
312 ffffreg45;
313
314 switch (score) {
315 case 12:
316 return ("lm75");
317 case 8:
318 return ("lm77");
319 case 3:
320 return ("lm75a");
321 default:
322 #if defined(I2C_DEBUG)
323 printf("lm75probe: unknown chip, scored %d\n", score);
324 #endif /* defined(I2C_DEBUG) */
325 return (NULL);
326 }
327 }
328
329 char *
330 adm1032cloneprobe(u_int8_t addr)
331 {
332 if (addr == 0x18 || addr == 0x1a || addr == 0x29 ||
333 addr == 0x2b || addr == 0x4c || addr == 0x4e) {
334 u_int8_t reg, val;
335 int zero = 0, copy = 0;
336
337 val = iicprobe(0x00);
338 for (reg = 0x00; reg < 0x09; reg++) {
339 if (iicprobe(reg) == 0xff)
340 return (NULL);
341 if (iicprobe(reg) == 0x00)
342 zero++;
343 if (val == iicprobe(reg))
344 copy++;
345 }
346 if (zero > 6 || copy > 6)
347 return (NULL);
348 val = iicprobe(0x09);
349 for (reg = 0x0a; reg < 0xfc; reg++) {
350 if (iicprobe(reg) != val)
351 return (NULL);
352 }
353 /* 0xfe may be Maxim, or some other vendor */
354 if (iicprobe(0xfe) == 0x4d)
355 return ("max1617");
356 /*
357 * "xeontemp" is the name we choose for clone chips
358 * which have all sorts of buggy bus interactions, such
359 * as those we just probed. Why?
360 * Intel is partly to blame for this situation.
361 */
362 return ("xeontemp");
363 }
364 return (NULL);
365 }
366
367 void
368 iic_ignore_addr(u_int8_t addr)
369 {
370 int i;
371
372 for (i = 0; i < sizeof(ignore_addrs); i++)
373 if (ignore_addrs[i] == 0) {
374 ignore_addrs[i] = addr;
375 return;
376 }
377 }
378
379 #if defined(I2C_DEBUG) || defined(I2C_VERBOSE)
380 void
381 iic_dump(struct device *dv, u_int8_t addr, char *name)
382 {
383 static u_int8_t iicvalcnt[256];
384 u_int8_t val, val2, max;
385 int i, cnt = 0;
386
387 /*
388 * Don't bother printing the most often repeated register
389 * value, since it is often weird devices that respond
390 * incorrectly, busted controller driver, or in the worst
391 * case, it in mosts cases, the value 0xff.
392 */
393 bzero(iicvalcnt, sizeof iicvalcnt);
394 val = iicprobe(0);
395 iicvalcnt[val]++;
396 for (i = 1; i <= 0xff; i++) {
397 val2 = iicprobe(i);
398 iicvalcnt[val2]++;
399 if (val == val2)
400 cnt++;
401 }
402
403 for (val = max = i = 0; i <= 0xff; i++)
404 if (max < iicvalcnt[i]) {
405 max = iicvalcnt[i];
406 val = i;
407 }
408
409 if (cnt <= 254) {
410 printf("%s: addr 0x%x", dv->dv_xname, addr);
411 for (i = 0; i <= 0xff; i++) {
412 if (iicprobe(i) != val)
413 printf(" %02x=%02x", i, iicprobe(i));
414 }
415 if (name)
416 printf(": %s", name);
417 printf("\n");
418 }
419 }
420 #endif /* defined(I2C_DEBUG) || defined(I2C_VERBOSE) */
421
422 void
423 iic_probe(struct device *self, struct i2cbus_attach_args *iba, u_int8_t addr)
424 {
425 struct i2c_attach_args ia;
426 char *name = NULL;
427 int i;
428
429 for (i = 0; i < sizeof(ignore_addrs); i++)
430 if (ignore_addrs[i] == addr)
431 return;
432
433 iicprobeinit(iba, addr);
434 skip_fc = 0;
435
436 /*
437 * Many I2C/SMBus devices use register 0x3e as a vendor ID
438 * register.
439 */
440 switch (iicprobe(0x3e)) {
441 case 0x01: /* National Semiconductor */
442 /*
443 * Some newer National products use a vendor code at
444 * 0x3e of 0x01, and then 0x3f contains a product code
445 * But some older products are missing a product code,
446 * and contain who knows what in that register. We assume
447 * that some employee was smart enough to keep the numbers
448 * unique.
449 */
450 if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
451 iicprobe(0x3f) == 0x73)
452 name = "lm93";
453 else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
454 iicprobe(0x3f) == 0x68)
455 name = "lm96000"; /* adt7460 compat? */
456 else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
457 (iicprobe(0x3f) == 0x60 || iicprobe(0x3f) == 0x62))
458 name = "lm85"; /* lm85C/B == adt7460 compat */
459 else if ((addr & 0x7c) == 0x2c && /* addr 0b01011xx */
460 iicprobe(0x48) == addr &&
461 (iicprobe(0x3f) == 0x03 || iicprobe(0x3f) == 0x04) &&
462 (iicprobe(0x40) & 0x80) == 0x00)
463 name = "lm81";
464 break;
465 case 0x02: /* National Semiconductor? */
466 if ((iicprobe(0x3f) & 0xfc) == 0x04)
467 name = "lm87"; /* complete check */
468 break;
469 case 0x23: /* Analog Devices? */
470 if (iicprobe(0x48) == addr &&
471 (iicprobe(0x40) & 0x80) == 0x00 &&
472 (addr & 0x7c) == 0x2c)
473 name = "adm9240"; /* lm87 clone */
474 break;
475 case 0x41: /* Analog Devices */
476 /*
477 * Newer chips have a valid 0x3d product number, while
478 * older ones sometimes encoded the product into the
479 * upper half of the "step register" at 0x3f.
480 */
481 if ((addr == 0x2c || addr == 0x2e || addr == 0x2f) &&
482 iicprobe(0x3d) == 0x70)
483 name = "adt7470";
484 else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
485 iicprobe(0x3d) == 0x76)
486 name = "adt7476";
487 else if (addr == 0x2e && iicprobe(0x3d) == 0x75)
488 name = "adt7475";
489 else if (iicprobe(0x3d) == 0x27 &&
490 (iicprobe(0x3f) == 0x60 || iicprobe(0x3f) == 0x6a))
491 name = "adm1027"; /* complete check */
492 else if (iicprobe(0x3d) == 0x27 &&
493 (iicprobe(0x3f) == 0x62 || iicprobe(0x3f) == 0x6a))
494 name = "adt7460"; /* complete check */
495 else if (addr == 0x2e &&
496 iicprobe(0x3d) == 0x68 && (iicprobe(0x3f) & 0xf0) == 0x70)
497 name = "adt7467";
498 else if (iicprobe(0x3d) == 0x33)
499 name = "adm1033";
500 else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
501 iicprobe(0x3d) == 0x30 &&
502 (iicprobe(0x01) & 0x80) == 0x00 &&
503 (iicprobe(0x0d) & 0x70) == 0x00 &&
504 (iicprobe(0x0e) & 0x70) == 0x00)
505 /*
506 * Revision 3 seems to be an adm1031 with
507 * remote diode 2 shorted. Therefore we
508 * cannot assume the reserved/unused bits of
509 * register 0x03 and 0x06 are set to zero.
510 */
511 name = "adm1030"; /* complete check */
512 else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
513 iicprobe(0x3d) == 0x31 &&
514 (iicprobe(0x01) & 0x80) == 0x00 &&
515 (iicprobe(0x0d) & 0x70) == 0x00 &&
516 (iicprobe(0x0e) & 0x70) == 0x00 &&
517 (iicprobe(0x0f) & 0x70) == 0x00)
518 name = "adm1031"; /* complete check */
519 else if ((addr & 0x7c) == 0x2c && /* addr 0b01011xx */
520 (iicprobe(0x3f) & 0xf0) == 0x20 &&
521 (iicprobe(0x40) & 0x80) == 0x00 &&
522 (iicprobe(0x41) & 0xc0) == 0x00 &&
523 (iicprobe(0x42) & 0xbc) == 0x00)
524 name = "adm1025"; /* complete check */
525 else if ((addr & 0x7c) == 0x2c && /* addr 0b01011xx */
526 (iicprobe(0x3f) & 0xf0) == 0x10 &&
527 (iicprobe(0x40) & 0x80) == 0x00)
528 name = "adm1024"; /* complete check */
529 else if ((iicprobe(0xff) & 0xf0) == 0x30)
530 name = "adm1023";
531 else if (addr == 0x2e &&
532 (iicprobe(0x3f) & 0xf0) == 0xd0 &&
533 (iicprobe(0x40) & 0x80) == 0x00)
534 name = "adm1028"; /* adm1022 clone? */
535 else if ((addr == 0x2c || addr == 0x2e || addr == 0x2f) &&
536 (iicprobe(0x3f) & 0xf0) == 0xc0 &&
537 (iicprobe(0x40) & 0x80) == 0x00)
538 name = "adm1022";
539 break;
540 case 0x49: /* Texas Instruments */
541 if ((addr == 0x2c || addr == 0x2e || addr == 0x2f) &&
542 (iicprobe(0x3f) & 0xf0) == 0xc0 &&
543 (iicprobe(0x40) & 0x80) == 0x00)
544 name = "thmc50"; /* adm1022 clone */
545 break;
546 case 0x55: /* SMSC */
547 if ((addr & 0x7c) == 0x2c && /* addr 0b01011xx */
548 iicprobe(0x3f) == 0x20 &&
549 (iicprobe(0x47) & 0x70) == 0x00 &&
550 (iicprobe(0x49) & 0xfe) == 0x80)
551 name = "47m192"; /* adm1025 compat */
552 break;
553 case 0x5c: /* SMSC */
554 if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
555 (iicprobe(0x3f) & 0xf0) == 0x60)
556 name = "emc6d100"; /* emc6d101, emc6d102, emc6d103 */
557 else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
558 (iicprobe(0x3f) & 0xf0) == 0x80)
559 name = "sch5017";
560 else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
561 (iicprobe(0x3f) & 0xf0) == 0xb0)
562 name = "emc6w201";
563 break;
564 case 0xa1: /* Philips */
565 if ((iicprobe(0x3f) & 0xf0) == 0x20 &&
566 (iicprobe(0x40) & 0x80) == 0x00 &&
567 (iicprobe(0x41) & 0xc0) == 0x00 &&
568 (iicprobe(0x42) & 0xbc) == 0x00)
569 name = "ne1619"; /* adm1025 compat */
570 break;
571 case 0xda: /* Dallas Semiconductor */
572 if (iicprobe(0x3f) == 0x01 && iicprobe(0x48) == addr &&
573 (iicprobe(0x40) & 0x80) == 0x00)
574 name = "ds1780"; /* lm87 clones */
575 break;
576 }
577
578 switch (iicprobe(0x4e)) {
579 case 0x41: /* Analog Devices */
580 if ((addr == 0x48 || addr == 0x4a || addr == 0x4b) &&
581 (iicprobe(0x4d) == 0x03 || iicprobe(0x4d) == 0x08 ||
582 iicprobe(0x4d) == 0x07))
583 name = "adt7516"; /* adt7517, adt7519 */
584 break;
585 }
586
587 switch (iicprobe(0xfe)) {
588 case 0x01: /* National Semiconductor */
589 if (addr == 0x4c &&
590 iicprobe(0xff) == 0x41 && (iicprobe(0x03) & 0x18) == 0 &&
591 iicprobe(0x04) <= 0x0f && (iicprobe(0xbf) & 0xf8) == 0)
592 name = "lm63";
593 else if (addr == 0x4c &&
594 iicprobe(0xff) == 0x11 && (iicprobe(0x03) & 0x2a) == 0 &&
595 iicprobe(0x04) <= 0x09 && (iicprobe(0xbf) & 0xf8) == 0)
596 name = "lm86";
597 else if (addr == 0x4c &&
598 iicprobe(0xff) == 0x31 && (iicprobe(0x03) & 0x2a) == 0 &&
599 iicprobe(0x04) <= 0x09 && (iicprobe(0xbf) & 0xf8) == 0)
600 name = "lm89"; /* or lm99 */
601 else if (addr == 0x4d &&
602 iicprobe(0xff) == 0x34 && (iicprobe(0x03) & 0x2a) == 0 &&
603 iicprobe(0x04) <= 0x09 && (iicprobe(0xbf) & 0xf8) == 0)
604 name = "lm89-1"; /* or lm99-1 */
605 else if (addr == 0x4c &&
606 iicprobe(0xff) == 0x21 && (iicprobe(0x03) & 0x2a) == 0 &&
607 iicprobe(0x04) <= 0x09 && (iicprobe(0xbf) & 0xf8) == 0)
608 name = "lm90";
609 break;
610 case 0x23: /* Genesys Logic? */
611 if ((addr == 0x4c) &&
612 (iicprobe(0x03) & 0x3f) == 0x00 && iicprobe(0x04) <= 0x08)
613 /*
614 * Genesys Logic doesn't make the datasheet
615 * for the GL523SM publically available, so
616 * the checks above are nothing more than a
617 * (conservative) educated guess.
618 */
619 name = "gl523sm";
620 break;
621 case 0x41: /* Analog Devices */
622 if ((addr == 0x4c || addr == 0x4d) &&
623 iicprobe(0xff) == 0x51 &&
624 (iicprobe(0x03) & 0x1f) == 0x04 &&
625 iicprobe(0x04) <= 0x0a) {
626 /* If not in adm1032 compatibility mode. */
627 name = "adt7461";
628 } else if ((addr == 0x18 || addr == 0x19 || addr == 0x1a ||
629 addr == 0x29 || addr == 0x2a || addr == 0x2b ||
630 addr == 0x4c || addr == 0x4d || addr == 0x4e) &&
631 (iicprobe(0xff) & 0xf0) == 0x00 &&
632 (iicprobe(0x03) & 0x3f) == 0x00 &&
633 iicprobe(0x04) <= 0x07) {
634 name = "adm1021";
635 skip_fc = 1;
636 } else if ((addr == 0x18 || addr == 0x19 || addr == 0x1a ||
637 addr == 0x29 || addr == 0x2a || addr == 0x2b ||
638 addr == 0x4c || addr == 0x4d || addr == 0x4e) &&
639 (iicprobe(0xff) & 0xf0) == 0x30 &&
640 (iicprobe(0x03) & 0x3f) == 0x00 &&
641 iicprobe(0x04) <= 0x07) {
642 name = "adm1023"; /* or adm1021a */
643 skip_fc = 1;
644 } else if ((addr == 0x4c || addr == 0x4d || addr == 0x4e) &&
645 (iicprobe(0x03) & 0x3f) == 0x00 &&
646 iicprobe(0x04) <= 0x0a) {
647 name = "adm1032"; /* or adm1020 */
648 skip_fc = 1;
649 }
650 break;
651 case 0x47: /* Global Mixed-mode Technology */
652 if (addr == 0x4c && iicprobe(0xff) == 0x01 &&
653 (iicprobe(0x03) & 0x3f) == 0x00 && iicprobe(0x04) <= 0x08)
654 name = "g781";
655 if (addr == 0x4d && iicprobe(0xff) == 0x03 &&
656 (iicprobe(0x03) & 0x3f) == 0x00 && iicprobe(0x04) <= 0x08)
657 name = "g781-1";
658 break;
659 case 0x4d: /* Maxim */
660 if ((addr == 0x18 || addr == 0x19 || addr == 0x1a ||
661 addr == 0x29 || addr == 0x2a || addr == 0x2b ||
662 addr == 0x4c || addr == 0x4d || addr == 0x4e) &&
663 iicprobe(0xff) == 0x08 && (iicprobe(0x02) & 0x03) == 0 &&
664 (iicprobe(0x03) & 0x07) == 0 && iicprobe(0x04) <= 0x08)
665 name = "max6690";
666 else if ((addr == 0x4c || addr == 0x4d || addr == 0x4e) &&
667 iicprobe(0xff) == 0x59 && (iicprobe(0x03) & 0x1f) == 0 &&
668 iicprobe(0x04) <= 0x07)
669 name = "max6646"; /* max6647/8/9, max6692 */
670 else if ((addr == 0x4c || addr == 0x4d || addr == 0x4e) &&
671 (iicprobe(0x02) & 0x2b) == 0 &&
672 (iicprobe(0x03) & 0x0f) == 0 && iicprobe(0x04) <= 0x09) {
673 name = "max6657"; /* max6658, max6659 */
674 skip_fc = 1;
675 } else if ((addr >= 0x48 && addr <= 0x4f) &&
676 (iicprobe(0x02) & 0x2b) == 0 &&
677 (iicprobe(0x03) & 0x0f) == 0)
678 name = "max6642";
679 break;
680 }
681
682 if (addr == iicprobe(0x48) &&
683 ((iicprobe(0x4f) == 0x5c && (iicprobe(0x4e) & 0x80)) ||
684 (iicprobe(0x4f) == 0xa3 && !(iicprobe(0x4e) & 0x80)))) {
685 /*
686 * We could toggle 0x4e bit 0x80, then re-read 0x4f to
687 * see if the value changes to 0xa3 (indicating Winbond).
688 * But we are trying to avoid writes.
689 */
690 if ((iicprobe(0x4e) & 0x07) == 0) {
691 switch (iicprobe(0x58)) {
692 case 0x10:
693 case 0x11: /* rev 2? */
694 name = "w83781d";
695 break;
696 case 0x21:
697 name = "w83627hf";
698 break;
699 case 0x30:
700 name = "w83782d";
701 break;
702 case 0x31:
703 name = "as99127f"; /* rev 2 */
704 break;
705 case 0x40:
706 name = "w83783s";
707 break;
708 case 0x71:
709 name = "w83791d";
710 break;
711 case 0x72:
712 name = "w83791sd";
713 break;
714 case 0x7a:
715 name = "w83792d";
716 break;
717 }
718 } else {
719 /*
720 * The BIOS left the chip in a non-zero
721 * register bank. Assume it's a W83781D and
722 * let lm(4) sort out the real model.
723 */
724 name = "w83781d";
725 }
726 } else if (addr == iicprobe (0x4a) && iicprobe(0x4e) == 0x50 &&
727 iicprobe(0x4c) == 0xa3 && iicprobe(0x4d) == 0x5c) {
728 name = "w83l784r";
729 } else if (addr == 0x2d && iicprobe(0x4e) == 0x60 &&
730 iicprobe(0x4c) == 0xa3 && iicprobe(0x4d) == 0x5c) {
731 name = "w83l785r";
732 } else if (addr == 0x2e && iicprobe(0x4e) == 0x70 &&
733 iicprobe(0x4c) == 0xa3 && iicprobe(0x4d) == 0x5c) {
734 name = "w83l785ts-l";
735 } else if (addr >= 0x28 && addr <= 0x2f &&
736 iicprobe(0x4f) == 0x12 && (iicprobe(0x4e) & 0x80)) {
737 /*
738 * We could toggle 0x4e bit 0x80, then re-read 0x4f to
739 * see if the value changes to 0xc3 (indicating ASUS).
740 * But we are trying to avoid writes.
741 */
742 if (iicprobe(0x58) == 0x31)
743 name = "as99127f"; /* rev 1 */
744 } else if ((addr == 0x2d || addr == 0x2e) &&
745 addr * 2 == iicprobe(0x04) &&
746 iicprobe(0x5d) == 0x19 && iicprobe(0x5e) == 0x34 &&
747 iicprobe(0x5a) == 0x03 && iicprobe(0x5b) == 0x06) {
748 name = "f75375"; /* Fintek */
749 } else if (addr == 0x2d &&
750 ((iicprobe(0x4f) == 0x06 && (iicprobe(0x4e) & 0x80)) ||
751 (iicprobe(0x4f) == 0x94 && !(iicprobe(0x4e) & 0x80)))) {
752 /*
753 * We could toggle 0x4e bit 0x80, then re-read 0x4f to
754 * see if the value changes to 0x94 (indicating ASUS).
755 * But we are trying to avoid writes.
756 *
757 * NB. we won't match if the BIOS has selected a non-zero
758 * register bank (set via 0x4e). We could select bank 0 so
759 * we see the right registers, but that would require a
760 * write. In general though, we bet no BIOS would leave us
761 * in the wrong state.
762 */
763 if ((iicprobe(0x58) & 0x7f) == 0x31 &&
764 (iicprobe(0x4e) & 0xf) == 0x00)
765 name = "asb100";
766 } else if ((addr == 0x2c || addr == 0x2d) &&
767 iicprobe(0x00) == 0x80 &&
768 (iicprobe(0x01) == 0x00 || iicprobe(0x01) == 0x80) &&
769 iicprobe(0x02) == 0x00 && (iicprobe(0x03) & 0x83) == 0x00 &&
770 (iicprobe(0x0f) & 0x07) == 0x00 &&
771 (iicprobe(0x11) & 0x80) == 0x00 &&
772 (iicprobe(0x12) & 0x80) == 0x00) {
773 /*
774 * The GL518SM is really crappy. It has both byte and
775 * word registers, and reading a word register with a
776 * byte read command will make the device crap out and
777 * hang the bus. This has nasty consequences on some
778 * machines, like preventing warm reboots. The word
779 * registers are 0x07 through 0x0c, so make sure the
780 * checks above don't access those registers. We
781 * don't want to do this check right up front though
782 * since this chip is somewhat hard to detect (which
783 * is why we check for every single fixed bit it has).
784 */
785 name = "gl518sm";
786 } else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
787 iicprobe(0x16) == 0x41 && ((iicprobe(0x17) & 0xf0) == 0x40)) {
788 name = "adm1026";
789 } else if (name == NULL &&
790 (addr & 0x78) == 0x48) { /* addr 0b1001xxx */
791 name = lm75probe();
792 }
793 #if 0
794 /*
795 * XXX This probe needs to be improved; the driver does some
796 * dangerous writes.
797 */
798 if (name == NULL && (addr & 0x7c) == 0x48 && /* addr 0b1001xxx */
799 (iicprobew(0xaa) & 0x0007) == 0x0000 &&
800 (iicprobew(0xa1) & 0x0007) == 0x0000 &&
801 (iicprobew(0xa2) & 0x0007) == 0x0000 &&
802 (iicprobe(0xac) & 0x10) == 0x00) {
803 if ((iicprobe(0xac) & 0x7e) == 0x0a &&
804 iicprobe(0xab) == 0x00 && iicprobe(0xa8) == 0x00)
805 name = "ds1624";
806 else if ((iicprobe(0xac) & 0x7e) == 0x0c)
807 name = "ds1631"; /* terrible probe */
808 else if ((iicprobe(0xac) & 0x2e) == 0x2e)
809 name = "ds1721"; /* terrible probe */
810 }
811 #endif
812 if (name == NULL && (addr & 0xf8) == 0x28 && iicprobe(0x48) == addr &&
813 (iicprobe(0x00) & 0x90) == 0x10 && iicprobe(0x58) == 0x90) {
814 if (iicprobe(0x5b) == 0x12)
815 name = "it8712";
816 else if (iicprobe(0x5b) == 0x00)
817 name = "it8712f-a"; /* sis950 too */
818 }
819
820 if (name == NULL && iicprobe(0x48) == addr &&
821 (iicprobe(0x40) & 0x80) == 0x00 && iicprobe(0x58) == 0xac)
822 name = "mtp008";
823
824 if (name == NULL) {
825 name = adm1032cloneprobe(addr);
826 if (name)
827 skip_fc = 1;
828 }
829
830 #ifdef I2C_DEBUG
831 iic_dump(self, addr, name);
832 #endif /* I2C_DEBUG */
833
834 #if !defined(I2C_VERBOSE) && !defined(I2C_DEBUG)
835 if (name == NULL)
836 name = "unknown";
837 #endif
838
839 if (name) {
840 memset(&ia, 0, sizeof(ia));
841 ia.ia_tag = iba->iba_tag;
842 ia.ia_addr = addr;
843 ia.ia_size = 1;
844 ia.ia_name = name;
845 if (config_found(self, &ia, iic_print))
846 return;
847 }
848
849 #if defined(I2C_VERBOSE) && !defined(I2C_DEBUG)
850 iic_dump(self, addr, name);
851 #endif /* defined(I2C_VERBOSE) && !defined(I2C_DEBUG) */
852 }
853
854 void
855 iic_scan(struct device *self, struct i2cbus_attach_args *iba)
856 {
857 i2c_tag_t ic = iba->iba_tag;
858 u_int8_t cmd = 0, addr;
859 int i;
860
861 bzero(ignore_addrs, sizeof(ignore_addrs));
862 for (i = 0; i < sizeof(probe_addrs)/sizeof(probe_addrs[0]); i++) {
863 for (addr = probe_addrs[i].start; addr <= probe_addrs[i].end;
864 addr++) {
865 /* Perform RECEIVE BYTE command */
866 iic_acquire_bus(ic, 0);
867 if (iic_exec(ic, I2C_OP_READ_WITH_STOP, addr,
868 &cmd, 1, NULL, 0, 0) == 0) {
869 iic_release_bus(ic, 0);
870
871 /* Some device exists, so go scope it out */
872 iic_probe(self, iba, addr);
873
874 iic_acquire_bus(ic, 0);
875
876 }
877 iic_release_bus(ic, 0);
878 }
879 }
880 }