1 /* $OpenBSD: i2c_scan.c,v 1.97 2007/04/10 17:47:55 miod Exp $ */ 2 3 /* 4 * Copyright (c) 2005 Theo de Raadt <deraadt@openbsd.org> 5 * 6 * Permission to use, copy, modify, and distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19 /* 20 * I2C bus scanning. 21 */ 22 23 #include <sys/param.h> 24 #include <sys/systm.h> 25 #include <sys/device.h> 26 27 #define _I2C_PRIVATE 28 #include <dev/i2c/i2cvar.h> 29 30 #undef I2C_DEBUG 31 #define I2C_VERBOSE 32 33 void iic_probe(struct device *, struct i2cbus_attach_args *, u_int8_t); 34 35 /* 36 * Addresses at which to probe for sensors. Skip address 0x4f, since 37 * probing it seems to crash at least one Sony VAIO laptop. Only a 38 * few chips can actually sit at that address, and vendors seem to 39 * place those at other addresses, so this isn't a big loss. 40 */ 41 struct { 42 u_int8_t start, end; 43 } probe_addrs[] = { 44 { 0x18, 0x18 }, 45 { 0x1a, 0x1a }, 46 { 0x20, 0x2f }, 47 { 0x48, 0x4e } 48 }; 49 50 #define MAX_IGNORE 8 51 u_int8_t ignore_addrs[MAX_IGNORE]; 52 53 /* 54 * Some Maxim 1617 clones MAY NOT even read cmd 0xfc! When it is 55 * read, they will power-on-reset. Their default condition 56 * (control register bit 0x80) therefore will be that they assert 57 * /ALERT for the 5 potential errors that may occur. One of those 58 * errors is that the external temperature diode is missing. This 59 * is unfortunately a common choice of system designers, except 60 * suddenly now we get a /ALERT, which may on some chipsets cause 61 * us to receive an entirely unexpected SMI .. and then an NMI. 62 * 63 * As we probe each device, if we hit something which looks suspiciously 64 * like it may potentially be a 1617 or clone, we immediately set this 65 * variable to avoid reading that register offset. 66 */ 67 int skip_fc; 68 69 static i2c_tag_t probe_ic; 70 static u_int8_t probe_addr; 71 static u_int8_t probe_val[256]; 72 73 void iicprobeinit(struct i2cbus_attach_args *, u_int8_t); 74 u_int8_t iicprobenc(u_int8_t); 75 u_int8_t iicprobe(u_int8_t); 76 u_int16_t iicprobew(u_int8_t); 77 char *lm75probe(void); 78 char *adm1032cloneprobe(u_int8_t); 79 void iic_dump(struct device *, u_int8_t, char *); 80 81 void 82 iicprobeinit(struct i2cbus_attach_args *iba, u_int8_t addr) 83 { 84 probe_ic = iba->iba_tag; 85 probe_addr = addr; 86 memset(probe_val, 0xff, sizeof probe_val); 87 } 88 89 u_int8_t 90 iicprobenc(u_int8_t cmd) 91 { 92 u_int8_t data; 93 94 /* 95 * If we think we are talking to an evil Maxim 1617 or clone, 96 * avoid accessing this register because it is death. 97 */ 98 if (skip_fc && cmd == 0xfc) 99 return (0xff); 100 iic_acquire_bus(probe_ic, 0); 101 if (iic_exec(probe_ic, I2C_OP_READ_WITH_STOP, 102 probe_addr, &cmd, 1, &data, 1, 0) != 0) 103 data = 0xff; 104 iic_release_bus(probe_ic, 0); 105 return (data); 106 } 107 108 u_int16_t 109 iicprobew(u_int8_t cmd) 110 { 111 u_int8_t data[2]; 112 113 /* 114 * If we think we are talking to an evil Maxim 1617 or clone, 115 * avoid accessing this register because it is death. 116 */ 117 if (skip_fc && cmd == 0xfc) 118 return (0xffff); 119 iic_acquire_bus(probe_ic, 0); 120 if (iic_exec(probe_ic, I2C_OP_READ_WITH_STOP, 121 probe_addr, &cmd, 1, &data, 2, 0) != 0) 122 data[0] = data[1] = 0xff; 123 iic_release_bus(probe_ic, 0); 124 return ((data[0] << 8) | data[1]); 125 } 126 127 u_int8_t 128 iicprobe(u_int8_t cmd) 129 { 130 if (probe_val[cmd] != 0xff) 131 return probe_val[cmd]; 132 probe_val[cmd] = iicprobenc(cmd); 133 return (probe_val[cmd]); 134 } 135 136 #define LM75TEMP 0x00 137 #define LM75CONF 0x01 138 #define LM75Thyst 0x02 139 #define LM75Tos 0x03 140 #define LM77Tlow 0x04 141 #define LM77Thigh 0x05 142 #define LM75TMASK 0xff80 /* 9 bits in temperature registers */ 143 #define LM77TMASK 0xfff8 /* 13 bits in temperature registers */ 144 145 /* 146 * The LM75/LM75A/LM77 family are very hard to detect. Thus, we check 147 * for all other possible chips first. These chips do not have an 148 * ID register. They do have a few quirks though: 149 * - on the LM75 and LM77, registers 0x06 and 0x07 return whatever 150 * value was read before 151 * - the LM75 lacks registers 0x04 and 0x05, so those act as above 152 * - the LM75A returns 0xffff for registers 0x04, 0x05, 0x06 and 0x07 153 * - the chip registers loop every 8 registers 154 * The downside is that we must read almost every register to guess 155 * if this is an LM75, LM75A or LM77. 156 */ 157 char * 158 lm75probe(void) 159 { 160 u_int16_t temp, thyst, tos, tlow, thigh, mask = LM75TMASK; 161 u_int8_t conf; 162 int i, echocount, ffffcount, score; 163 int echoreg67, echoreg45, ffffreg67, ffffreg45; 164 165 temp = iicprobew(LM75TEMP); 166 167 /* 168 * Sometimes the other probes can upset the chip, if we get 0xffff 169 * the first time, try it once more. 170 */ 171 if (temp == 0xffff) 172 temp = iicprobew(LM75TEMP); 173 174 conf = iicprobenc(LM75CONF); 175 thyst = iicprobew(LM75Thyst); 176 tos = iicprobew(LM75Tos); 177 178 /* totally bogus data */ 179 if (conf == 0xff && temp == 0xffff && thyst == 0xffff) 180 return (NULL); 181 182 temp &= mask; 183 thyst &= mask; 184 tos &= mask; 185 186 /* All values the same? Very unlikely */ 187 if (temp == thyst && thyst == tos) 188 return (NULL); 189 190 #if notsure 191 /* more register aliasing effects that indicate not a lm75 */ 192 if ((temp >> 8) == conf) 193 return (NULL); 194 #endif 195 196 /* 197 * LM77/LM75 registers 6, 7 198 * echo whatever was read just before them from reg 0, 1, or 2 199 * 200 * LM75A doesn't appear to do this, but does appear to reliably 201 * return 0xffff 202 */ 203 for (i = 6, echocount = 2, ffffcount = 0; i <= 7; i++) { 204 if ((iicprobew(LM75TEMP) & mask) != (iicprobew(i) & mask) || 205 (iicprobew(LM75Thyst) & mask) != (iicprobew(i) & mask) || 206 (iicprobew(LM75Tos) & mask) != (iicprobew(i) & mask)) 207 echocount--; 208 if (iicprobew(i) == 0xffff) 209 ffffcount++; 210 } 211 212 /* Make sure either both registers echo, or neither does */ 213 if (echocount == 1 || ffffcount == 1) 214 return (NULL); 215 216 echoreg67 = (echocount == 0) ? 0 : 1; 217 ffffreg67 = (ffffcount == 0) ? 0 : 1; 218 219 /* 220 * LM75 has no registers 4 or 5, and they will act as echos too 221 * 222 * LM75A doesn't appear to do this either, but does appear to 223 * reliably return 0xffff 224 */ 225 for (i = 4, echocount = 2, ffffcount = 0; i <= 5; i++) { 226 if ((iicprobew(LM75TEMP) & mask) != (iicprobew(i) & mask) || 227 (iicprobew(LM75Thyst) & mask) != (iicprobew(i) & mask) || 228 (iicprobew(LM75Tos) & mask) != (iicprobew(i) & mask)) 229 echocount--; 230 if (iicprobew(i) == 0xffff) 231 ffffcount++; 232 } 233 234 /* Make sure either both registers echo, or neither does */ 235 if (echocount == 1 || ffffcount == 1) 236 return (NULL); 237 238 echoreg45 = (echocount == 0) ? 0 : 1; 239 ffffreg45 = (ffffcount == 0) ? 0 : 1; 240 241 /* 242 * If we find that 4 and 5 are not echos, and don't return 0xffff 243 * then based on whether the echo test of registers 6 and 7 244 * succeeded or not, we may have an LM77 245 */ 246 if (echoreg45 == 0 && ffffreg45 == 0 && echoreg67 == 1) { 247 mask = LM77TMASK; 248 249 /* mask size changed, must re-read for the next checks */ 250 thyst = iicprobew(LM75Thyst) & mask; 251 tos = iicprobew(LM75Tos) & mask; 252 tlow = iicprobew(LM77Tlow) & mask; 253 thigh = iicprobew(LM77Thigh) & mask; 254 } 255 256 /* a real LM75/LM75A/LM77 repeats its registers.... */ 257 for (i = 0x08; i <= 0xf8; i += 8) { 258 if (conf != iicprobenc(LM75CONF + i) || 259 thyst != (iicprobew(LM75Thyst + i) & mask) || 260 tos != (iicprobew(LM75Tos + i) & mask)) 261 return (NULL); 262 263 /* 264 * Check that the repeated registers 0x06 and 0x07 still 265 * either echo or return 0xffff 266 */ 267 if (echoreg67 == 1) { 268 tos = iicprobew(LM75Tos) & mask; 269 if (tos != (iicprobew(0x06 + i) & mask) || 270 tos != (iicprobew(0x07 + i) & mask)) 271 return (NULL); 272 } else if (ffffreg67 == 1) 273 if (iicprobew(0x06 + i) != 0xffff || 274 iicprobew(0x07 + i) != 0xffff) 275 return (NULL); 276 277 /* 278 * Check that the repeated registers 0x04 and 0x05 still 279 * either echo or return 0xffff. If they do neither, and 280 * registers 0x06 and 0x07 echo, then we will be probing 281 * for an LM77, so make sure those still repeat 282 */ 283 if (echoreg45 == 1) { 284 tos = iicprobew(LM75Tos) & mask; 285 if (tos != (iicprobew(LM77Tlow + i) & mask) || 286 tos != (iicprobew(LM77Thigh + i) & mask)) 287 return (NULL); 288 } else if (ffffreg45 == 1) { 289 if (iicprobew(LM77Tlow + i) != 0xffff || 290 iicprobew(LM77Thigh + i) != 0xffff) 291 return (NULL); 292 } else if (echoreg67 == 1) 293 if (tlow != (iicprobew(LM77Tlow + i) & mask) || 294 thigh != (iicprobew(LM77Thigh + i) & mask)) 295 return (NULL); 296 } 297 298 /* 299 * Given that we now know how the first eight registers behave and 300 * that this behaviour is consistently repeated, we can now use 301 * the following table: 302 * 303 * echoreg67 | echoreg45 | ffffreg67 | ffffreg45 | chip 304 * ----------+-----------+-----------+-----------+------ 305 * 1 | 1 | 0 | 0 | LM75 306 * 1 | 0 | 0 | 0 | LM77 307 * 0 | 0 | 1 | 1 | LM75A 308 */ 309 310 /* Convert the various flags into a single score */ 311 score = (echoreg67 << 3) + (echoreg45 << 2) + (ffffreg67 << 1) + 312 ffffreg45; 313 314 switch (score) { 315 case 12: 316 return ("lm75"); 317 case 8: 318 return ("lm77"); 319 case 3: 320 return ("lm75a"); 321 default: 322 #if defined(I2C_DEBUG) 323 printf("lm75probe: unknown chip, scored %d\n", score); 324 #endif /* defined(I2C_DEBUG) */ 325 return (NULL); 326 } 327 } 328 329 char * 330 adm1032cloneprobe(u_int8_t addr) 331 { 332 if (addr == 0x18 || addr == 0x1a || addr == 0x29 || 333 addr == 0x2b || addr == 0x4c || addr == 0x4e) { 334 u_int8_t reg, val; 335 int zero = 0, copy = 0; 336 337 val = iicprobe(0x00); 338 for (reg = 0x00; reg < 0x09; reg++) { 339 if (iicprobe(reg) == 0xff) 340 return (NULL); 341 if (iicprobe(reg) == 0x00) 342 zero++; 343 if (val == iicprobe(reg)) 344 copy++; 345 } 346 if (zero > 6 || copy > 6) 347 return (NULL); 348 val = iicprobe(0x09); 349 for (reg = 0x0a; reg < 0xfc; reg++) { 350 if (iicprobe(reg) != val) 351 return (NULL); 352 } 353 /* 0xfe may be Maxim, or some other vendor */ 354 if (iicprobe(0xfe) == 0x4d) 355 return ("max1617"); 356 /* 357 * "xeontemp" is the name we choose for clone chips 358 * which have all sorts of buggy bus interactions, such 359 * as those we just probed. Why? 360 * Intel is partly to blame for this situation. 361 */ 362 return ("xeontemp"); 363 } 364 return (NULL); 365 } 366 367 void 368 iic_ignore_addr(u_int8_t addr) 369 { 370 int i; 371 372 for (i = 0; i < sizeof(ignore_addrs); i++) 373 if (ignore_addrs[i] == 0) { 374 ignore_addrs[i] = addr; 375 return; 376 } 377 } 378 379 #if defined(I2C_DEBUG) || defined(I2C_VERBOSE) 380 void 381 iic_dump(struct device *dv, u_int8_t addr, char *name) 382 { 383 static u_int8_t iicvalcnt[256]; 384 u_int8_t val, val2, max; 385 int i, cnt = 0; 386 387 /* 388 * Don't bother printing the most often repeated register 389 * value, since it is often weird devices that respond 390 * incorrectly, busted controller driver, or in the worst 391 * case, it in mosts cases, the value 0xff. 392 */ 393 bzero(iicvalcnt, sizeof iicvalcnt); 394 val = iicprobe(0); 395 iicvalcnt[val]++; 396 for (i = 1; i <= 0xff; i++) { 397 val2 = iicprobe(i); 398 iicvalcnt[val2]++; 399 if (val == val2) 400 cnt++; 401 } 402 403 for (val = max = i = 0; i <= 0xff; i++) 404 if (max < iicvalcnt[i]) { 405 max = iicvalcnt[i]; 406 val = i; 407 } 408 409 if (cnt <= 254) { 410 printf("%s: addr 0x%x", dv->dv_xname, addr); 411 for (i = 0; i <= 0xff; i++) { 412 if (iicprobe(i) != val) 413 printf(" %02x=%02x", i, iicprobe(i)); 414 } 415 if (name) 416 printf(": %s", name); 417 printf("\n"); 418 } 419 } 420 #endif /* defined(I2C_DEBUG) || defined(I2C_VERBOSE) */ 421 422 void 423 iic_probe(struct device *self, struct i2cbus_attach_args *iba, u_int8_t addr) 424 { 425 struct i2c_attach_args ia; 426 char *name = NULL; 427 int i; 428 429 for (i = 0; i < sizeof(ignore_addrs); i++) 430 if (ignore_addrs[i] == addr) 431 return; 432 433 iicprobeinit(iba, addr); 434 skip_fc = 0; 435 436 /* 437 * Many I2C/SMBus devices use register 0x3e as a vendor ID 438 * register. 439 */ 440 switch (iicprobe(0x3e)) { 441 case 0x01: /* National Semiconductor */ 442 /* 443 * Some newer National products use a vendor code at 444 * 0x3e of 0x01, and then 0x3f contains a product code 445 * But some older products are missing a product code, 446 * and contain who knows what in that register. We assume 447 * that some employee was smart enough to keep the numbers 448 * unique. 449 */ 450 if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) && 451 iicprobe(0x3f) == 0x73) 452 name = "lm93"; 453 else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) && 454 iicprobe(0x3f) == 0x68) 455 name = "lm96000"; /* adt7460 compat? */ 456 else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) && 457 (iicprobe(0x3f) == 0x60 || iicprobe(0x3f) == 0x62)) 458 name = "lm85"; /* lm85C/B == adt7460 compat */ 459 else if ((addr & 0x7c) == 0x2c && /* addr 0b01011xx */ 460 iicprobe(0x48) == addr && 461 (iicprobe(0x3f) == 0x03 || iicprobe(0x3f) == 0x04) && 462 (iicprobe(0x40) & 0x80) == 0x00) 463 name = "lm81"; 464 break; 465 case 0x02: /* National Semiconductor? */ 466 if ((iicprobe(0x3f) & 0xfc) == 0x04) 467 name = "lm87"; /* complete check */ 468 break; 469 case 0x23: /* Analog Devices? */ 470 if (iicprobe(0x48) == addr && 471 (iicprobe(0x40) & 0x80) == 0x00 && 472 (addr & 0x7c) == 0x2c) 473 name = "adm9240"; /* lm87 clone */ 474 break; 475 case 0x41: /* Analog Devices */ 476 /* 477 * Newer chips have a valid 0x3d product number, while 478 * older ones sometimes encoded the product into the 479 * upper half of the "step register" at 0x3f. 480 */ 481 if ((addr == 0x2c || addr == 0x2e || addr == 0x2f) && 482 iicprobe(0x3d) == 0x70) 483 name = "adt7470"; 484 else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) && 485 iicprobe(0x3d) == 0x76) 486 name = "adt7476"; 487 else if (addr == 0x2e && iicprobe(0x3d) == 0x75) 488 name = "adt7475"; 489 else if (iicprobe(0x3d) == 0x27 && 490 (iicprobe(0x3f) == 0x60 || iicprobe(0x3f) == 0x6a)) 491 name = "adm1027"; /* complete check */ 492 else if (iicprobe(0x3d) == 0x27 && 493 (iicprobe(0x3f) == 0x62 || iicprobe(0x3f) == 0x6a)) 494 name = "adt7460"; /* complete check */ 495 else if (addr == 0x2e && 496 iicprobe(0x3d) == 0x68 && (iicprobe(0x3f) & 0xf0) == 0x70) 497 name = "adt7467"; 498 else if (iicprobe(0x3d) == 0x33) 499 name = "adm1033"; 500 else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) && 501 iicprobe(0x3d) == 0x30 && 502 (iicprobe(0x01) & 0x80) == 0x00 && 503 (iicprobe(0x0d) & 0x70) == 0x00 && 504 (iicprobe(0x0e) & 0x70) == 0x00) 505 /* 506 * Revision 3 seems to be an adm1031 with 507 * remote diode 2 shorted. Therefore we 508 * cannot assume the reserved/unused bits of 509 * register 0x03 and 0x06 are set to zero. 510 */ 511 name = "adm1030"; /* complete check */ 512 else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) && 513 iicprobe(0x3d) == 0x31 && 514 (iicprobe(0x01) & 0x80) == 0x00 && 515 (iicprobe(0x0d) & 0x70) == 0x00 && 516 (iicprobe(0x0e) & 0x70) == 0x00 && 517 (iicprobe(0x0f) & 0x70) == 0x00) 518 name = "adm1031"; /* complete check */ 519 else if ((addr & 0x7c) == 0x2c && /* addr 0b01011xx */ 520 (iicprobe(0x3f) & 0xf0) == 0x20 && 521 (iicprobe(0x40) & 0x80) == 0x00 && 522 (iicprobe(0x41) & 0xc0) == 0x00 && 523 (iicprobe(0x42) & 0xbc) == 0x00) 524 name = "adm1025"; /* complete check */ 525 else if ((addr & 0x7c) == 0x2c && /* addr 0b01011xx */ 526 (iicprobe(0x3f) & 0xf0) == 0x10 && 527 (iicprobe(0x40) & 0x80) == 0x00) 528 name = "adm1024"; /* complete check */ 529 else if ((iicprobe(0xff) & 0xf0) == 0x30) 530 name = "adm1023"; 531 else if (addr == 0x2e && 532 (iicprobe(0x3f) & 0xf0) == 0xd0 && 533 (iicprobe(0x40) & 0x80) == 0x00) 534 name = "adm1028"; /* adm1022 clone? */ 535 else if ((addr == 0x2c || addr == 0x2e || addr == 0x2f) && 536 (iicprobe(0x3f) & 0xf0) == 0xc0 && 537 (iicprobe(0x40) & 0x80) == 0x00) 538 name = "adm1022"; 539 break; 540 case 0x49: /* Texas Instruments */ 541 if ((addr == 0x2c || addr == 0x2e || addr == 0x2f) && 542 (iicprobe(0x3f) & 0xf0) == 0xc0 && 543 (iicprobe(0x40) & 0x80) == 0x00) 544 name = "thmc50"; /* adm1022 clone */ 545 break; 546 case 0x55: /* SMSC */ 547 if ((addr & 0x7c) == 0x2c && /* addr 0b01011xx */ 548 iicprobe(0x3f) == 0x20 && 549 (iicprobe(0x47) & 0x70) == 0x00 && 550 (iicprobe(0x49) & 0xfe) == 0x80) 551 name = "47m192"; /* adm1025 compat */ 552 break; 553 case 0x5c: /* SMSC */ 554 if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) && 555 (iicprobe(0x3f) & 0xf0) == 0x60) 556 name = "emc6d100"; /* emc6d101, emc6d102, emc6d103 */ 557 else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) && 558 (iicprobe(0x3f) & 0xf0) == 0x80) 559 name = "sch5017"; 560 else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) && 561 (iicprobe(0x3f) & 0xf0) == 0xb0) 562 name = "emc6w201"; 563 break; 564 case 0xa1: /* Philips */ 565 if ((iicprobe(0x3f) & 0xf0) == 0x20 && 566 (iicprobe(0x40) & 0x80) == 0x00 && 567 (iicprobe(0x41) & 0xc0) == 0x00 && 568 (iicprobe(0x42) & 0xbc) == 0x00) 569 name = "ne1619"; /* adm1025 compat */ 570 break; 571 case 0xda: /* Dallas Semiconductor */ 572 if (iicprobe(0x3f) == 0x01 && iicprobe(0x48) == addr && 573 (iicprobe(0x40) & 0x80) == 0x00) 574 name = "ds1780"; /* lm87 clones */ 575 break; 576 } 577 578 switch (iicprobe(0x4e)) { 579 case 0x41: /* Analog Devices */ 580 if ((addr == 0x48 || addr == 0x4a || addr == 0x4b) && 581 (iicprobe(0x4d) == 0x03 || iicprobe(0x4d) == 0x08 || 582 iicprobe(0x4d) == 0x07)) 583 name = "adt7516"; /* adt7517, adt7519 */ 584 break; 585 } 586 587 switch (iicprobe(0xfe)) { 588 case 0x01: /* National Semiconductor */ 589 if (addr == 0x4c && 590 iicprobe(0xff) == 0x41 && (iicprobe(0x03) & 0x18) == 0 && 591 iicprobe(0x04) <= 0x0f && (iicprobe(0xbf) & 0xf8) == 0) 592 name = "lm63"; 593 else if (addr == 0x4c && 594 iicprobe(0xff) == 0x11 && (iicprobe(0x03) & 0x2a) == 0 && 595 iicprobe(0x04) <= 0x09 && (iicprobe(0xbf) & 0xf8) == 0) 596 name = "lm86"; 597 else if (addr == 0x4c && 598 iicprobe(0xff) == 0x31 && (iicprobe(0x03) & 0x2a) == 0 && 599 iicprobe(0x04) <= 0x09 && (iicprobe(0xbf) & 0xf8) == 0) 600 name = "lm89"; /* or lm99 */ 601 else if (addr == 0x4d && 602 iicprobe(0xff) == 0x34 && (iicprobe(0x03) & 0x2a) == 0 && 603 iicprobe(0x04) <= 0x09 && (iicprobe(0xbf) & 0xf8) == 0) 604 name = "lm89-1"; /* or lm99-1 */ 605 else if (addr == 0x4c && 606 iicprobe(0xff) == 0x21 && (iicprobe(0x03) & 0x2a) == 0 && 607 iicprobe(0x04) <= 0x09 && (iicprobe(0xbf) & 0xf8) == 0) 608 name = "lm90"; 609 break; 610 case 0x23: /* Genesys Logic? */ 611 if ((addr == 0x4c) && 612 (iicprobe(0x03) & 0x3f) == 0x00 && iicprobe(0x04) <= 0x08) 613 /* 614 * Genesys Logic doesn't make the datasheet 615 * for the GL523SM publically available, so 616 * the checks above are nothing more than a 617 * (conservative) educated guess. 618 */ 619 name = "gl523sm"; 620 break; 621 case 0x41: /* Analog Devices */ 622 if ((addr == 0x4c || addr == 0x4d) && 623 iicprobe(0xff) == 0x51 && 624 (iicprobe(0x03) & 0x1f) == 0x04 && 625 iicprobe(0x04) <= 0x0a) { 626 /* If not in adm1032 compatibility mode. */ 627 name = "adt7461"; 628 } else if ((addr == 0x18 || addr == 0x19 || addr == 0x1a || 629 addr == 0x29 || addr == 0x2a || addr == 0x2b || 630 addr == 0x4c || addr == 0x4d || addr == 0x4e) && 631 (iicprobe(0xff) & 0xf0) == 0x00 && 632 (iicprobe(0x03) & 0x3f) == 0x00 && 633 iicprobe(0x04) <= 0x07) { 634 name = "adm1021"; 635 skip_fc = 1; 636 } else if ((addr == 0x18 || addr == 0x19 || addr == 0x1a || 637 addr == 0x29 || addr == 0x2a || addr == 0x2b || 638 addr == 0x4c || addr == 0x4d || addr == 0x4e) && 639 (iicprobe(0xff) & 0xf0) == 0x30 && 640 (iicprobe(0x03) & 0x3f) == 0x00 && 641 iicprobe(0x04) <= 0x07) { 642 name = "adm1023"; /* or adm1021a */ 643 skip_fc = 1; 644 } else if ((addr == 0x4c || addr == 0x4d || addr == 0x4e) && 645 (iicprobe(0x03) & 0x3f) == 0x00 && 646 iicprobe(0x04) <= 0x0a) { 647 name = "adm1032"; /* or adm1020 */ 648 skip_fc = 1; 649 } 650 break; 651 case 0x47: /* Global Mixed-mode Technology */ 652 if (addr == 0x4c && iicprobe(0xff) == 0x01 && 653 (iicprobe(0x03) & 0x3f) == 0x00 && iicprobe(0x04) <= 0x08) 654 name = "g781"; 655 if (addr == 0x4d && iicprobe(0xff) == 0x03 && 656 (iicprobe(0x03) & 0x3f) == 0x00 && iicprobe(0x04) <= 0x08) 657 name = "g781-1"; 658 break; 659 case 0x4d: /* Maxim */ 660 if ((addr == 0x18 || addr == 0x19 || addr == 0x1a || 661 addr == 0x29 || addr == 0x2a || addr == 0x2b || 662 addr == 0x4c || addr == 0x4d || addr == 0x4e) && 663 iicprobe(0xff) == 0x08 && (iicprobe(0x02) & 0x03) == 0 && 664 (iicprobe(0x03) & 0x07) == 0 && iicprobe(0x04) <= 0x08) 665 name = "max6690"; 666 else if ((addr == 0x4c || addr == 0x4d || addr == 0x4e) && 667 iicprobe(0xff) == 0x59 && (iicprobe(0x03) & 0x1f) == 0 && 668 iicprobe(0x04) <= 0x07) 669 name = "max6646"; /* max6647/8/9, max6692 */ 670 else if ((addr == 0x4c || addr == 0x4d || addr == 0x4e) && 671 (iicprobe(0x02) & 0x2b) == 0 && 672 (iicprobe(0x03) & 0x0f) == 0 && iicprobe(0x04) <= 0x09) { 673 name = "max6657"; /* max6658, max6659 */ 674 skip_fc = 1; 675 } else if ((addr >= 0x48 && addr <= 0x4f) && 676 (iicprobe(0x02) & 0x2b) == 0 && 677 (iicprobe(0x03) & 0x0f) == 0) 678 name = "max6642"; 679 break; 680 } 681 682 if (addr == iicprobe(0x48) && 683 ((iicprobe(0x4f) == 0x5c && (iicprobe(0x4e) & 0x80)) || 684 (iicprobe(0x4f) == 0xa3 && !(iicprobe(0x4e) & 0x80)))) { 685 /* 686 * We could toggle 0x4e bit 0x80, then re-read 0x4f to 687 * see if the value changes to 0xa3 (indicating Winbond). 688 * But we are trying to avoid writes. 689 */ 690 if ((iicprobe(0x4e) & 0x07) == 0) { 691 switch (iicprobe(0x58)) { 692 case 0x10: 693 case 0x11: /* rev 2? */ 694 name = "w83781d"; 695 break; 696 case 0x21: 697 name = "w83627hf"; 698 break; 699 case 0x30: 700 name = "w83782d"; 701 break; 702 case 0x31: 703 name = "as99127f"; /* rev 2 */ 704 break; 705 case 0x40: 706 name = "w83783s"; 707 break; 708 case 0x71: 709 name = "w83791d"; 710 break; 711 case 0x72: 712 name = "w83791sd"; 713 break; 714 case 0x7a: 715 name = "w83792d"; 716 break; 717 } 718 } else { 719 /* 720 * The BIOS left the chip in a non-zero 721 * register bank. Assume it's a W83781D and 722 * let lm(4) sort out the real model. 723 */ 724 name = "w83781d"; 725 } 726 } else if (addr == iicprobe (0x4a) && iicprobe(0x4e) == 0x50 && 727 iicprobe(0x4c) == 0xa3 && iicprobe(0x4d) == 0x5c) { 728 name = "w83l784r"; 729 } else if (addr == 0x2d && iicprobe(0x4e) == 0x60 && 730 iicprobe(0x4c) == 0xa3 && iicprobe(0x4d) == 0x5c) { 731 name = "w83l785r"; 732 } else if (addr == 0x2e && iicprobe(0x4e) == 0x70 && 733 iicprobe(0x4c) == 0xa3 && iicprobe(0x4d) == 0x5c) { 734 name = "w83l785ts-l"; 735 } else if (addr >= 0x28 && addr <= 0x2f && 736 iicprobe(0x4f) == 0x12 && (iicprobe(0x4e) & 0x80)) { 737 /* 738 * We could toggle 0x4e bit 0x80, then re-read 0x4f to 739 * see if the value changes to 0xc3 (indicating ASUS). 740 * But we are trying to avoid writes. 741 */ 742 if (iicprobe(0x58) == 0x31) 743 name = "as99127f"; /* rev 1 */ 744 } else if ((addr == 0x2d || addr == 0x2e) && 745 addr * 2 == iicprobe(0x04) && 746 iicprobe(0x5d) == 0x19 && iicprobe(0x5e) == 0x34 && 747 iicprobe(0x5a) == 0x03 && iicprobe(0x5b) == 0x06) { 748 name = "f75375"; /* Fintek */ 749 } else if (addr == 0x2d && 750 ((iicprobe(0x4f) == 0x06 && (iicprobe(0x4e) & 0x80)) || 751 (iicprobe(0x4f) == 0x94 && !(iicprobe(0x4e) & 0x80)))) { 752 /* 753 * We could toggle 0x4e bit 0x80, then re-read 0x4f to 754 * see if the value changes to 0x94 (indicating ASUS). 755 * But we are trying to avoid writes. 756 * 757 * NB. we won't match if the BIOS has selected a non-zero 758 * register bank (set via 0x4e). We could select bank 0 so 759 * we see the right registers, but that would require a 760 * write. In general though, we bet no BIOS would leave us 761 * in the wrong state. 762 */ 763 if ((iicprobe(0x58) & 0x7f) == 0x31 && 764 (iicprobe(0x4e) & 0xf) == 0x00) 765 name = "asb100"; 766 } else if ((addr == 0x2c || addr == 0x2d) && 767 iicprobe(0x00) == 0x80 && 768 (iicprobe(0x01) == 0x00 || iicprobe(0x01) == 0x80) && 769 iicprobe(0x02) == 0x00 && (iicprobe(0x03) & 0x83) == 0x00 && 770 (iicprobe(0x0f) & 0x07) == 0x00 && 771 (iicprobe(0x11) & 0x80) == 0x00 && 772 (iicprobe(0x12) & 0x80) == 0x00) { 773 /* 774 * The GL518SM is really crappy. It has both byte and 775 * word registers, and reading a word register with a 776 * byte read command will make the device crap out and 777 * hang the bus. This has nasty consequences on some 778 * machines, like preventing warm reboots. The word 779 * registers are 0x07 through 0x0c, so make sure the 780 * checks above don't access those registers. We 781 * don't want to do this check right up front though 782 * since this chip is somewhat hard to detect (which 783 * is why we check for every single fixed bit it has). 784 */ 785 name = "gl518sm"; 786 } else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) && 787 iicprobe(0x16) == 0x41 && ((iicprobe(0x17) & 0xf0) == 0x40)) { 788 name = "adm1026"; 789 } else if (name == NULL && 790 (addr & 0x78) == 0x48) { /* addr 0b1001xxx */ 791 name = lm75probe(); 792 } 793 #if 0 794 /* 795 * XXX This probe needs to be improved; the driver does some 796 * dangerous writes. 797 */ 798 if (name == NULL && (addr & 0x7c) == 0x48 && /* addr 0b1001xxx */ 799 (iicprobew(0xaa) & 0x0007) == 0x0000 && 800 (iicprobew(0xa1) & 0x0007) == 0x0000 && 801 (iicprobew(0xa2) & 0x0007) == 0x0000 && 802 (iicprobe(0xac) & 0x10) == 0x00) { 803 if ((iicprobe(0xac) & 0x7e) == 0x0a && 804 iicprobe(0xab) == 0x00 && iicprobe(0xa8) == 0x00) 805 name = "ds1624"; 806 else if ((iicprobe(0xac) & 0x7e) == 0x0c) 807 name = "ds1631"; /* terrible probe */ 808 else if ((iicprobe(0xac) & 0x2e) == 0x2e) 809 name = "ds1721"; /* terrible probe */ 810 } 811 #endif 812 if (name == NULL && (addr & 0xf8) == 0x28 && iicprobe(0x48) == addr && 813 (iicprobe(0x00) & 0x90) == 0x10 && iicprobe(0x58) == 0x90) { 814 if (iicprobe(0x5b) == 0x12) 815 name = "it8712"; 816 else if (iicprobe(0x5b) == 0x00) 817 name = "it8712f-a"; /* sis950 too */ 818 } 819 820 if (name == NULL && iicprobe(0x48) == addr && 821 (iicprobe(0x40) & 0x80) == 0x00 && iicprobe(0x58) == 0xac) 822 name = "mtp008"; 823 824 if (name == NULL) { 825 name = adm1032cloneprobe(addr); 826 if (name) 827 skip_fc = 1; 828 } 829 830 #ifdef I2C_DEBUG 831 iic_dump(self, addr, name); 832 #endif /* I2C_DEBUG */ 833 834 #if !defined(I2C_VERBOSE) && !defined(I2C_DEBUG) 835 if (name == NULL) 836 name = "unknown"; 837 #endif 838 839 if (name) { 840 memset(&ia, 0, sizeof(ia)); 841 ia.ia_tag = iba->iba_tag; 842 ia.ia_addr = addr; 843 ia.ia_size = 1; 844 ia.ia_name = name; 845 if (config_found(self, &ia, iic_print)) 846 return; 847 } 848 849 #if defined(I2C_VERBOSE) && !defined(I2C_DEBUG) 850 iic_dump(self, addr, name); 851 #endif /* defined(I2C_VERBOSE) && !defined(I2C_DEBUG) */ 852 } 853 854 void 855 iic_scan(struct device *self, struct i2cbus_attach_args *iba) 856 { 857 i2c_tag_t ic = iba->iba_tag; 858 u_int8_t cmd = 0, addr; 859 int i; 860 861 bzero(ignore_addrs, sizeof(ignore_addrs)); 862 for (i = 0; i < sizeof(probe_addrs)/sizeof(probe_addrs[0]); i++) { 863 for (addr = probe_addrs[i].start; addr <= probe_addrs[i].end; 864 addr++) { 865 /* Perform RECEIVE BYTE command */ 866 iic_acquire_bus(ic, 0); 867 if (iic_exec(ic, I2C_OP_READ_WITH_STOP, addr, 868 &cmd, 1, NULL, 0, 0) == 0) { 869 iic_release_bus(ic, 0); 870 871 /* Some device exists, so go scope it out */ 872 iic_probe(self, iba, addr); 873 874 iic_acquire_bus(ic, 0); 875 876 } 877 iic_release_bus(ic, 0); 878 } 879 } 880 } 881