xref: /openbsd/sys/dev/i2c/i2c_scan.c (revision 09467b48) 
1 /*	$OpenBSD: i2c_scan.c,v 1.146 2019/12/16 19:17:04 claudio Exp $	*/
2 
3 /*
4  * Copyright (c) 2005 Theo de Raadt <deraadt@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 /*
20  * I2C bus scanning.  We apologize in advance for the massive overuse of 0x.
21  */
22 
23 #include "ipmi.h"
24 
25 #include <sys/param.h>
26 #include <sys/systm.h>
27 #include <sys/device.h>
28 
29 #define _I2C_PRIVATE
30 #include <dev/i2c/i2cvar.h>
31 
32 #undef I2C_DEBUG
33 #define I2C_VERBOSE
34 
35 #define MAX_IGNORE 8
36 u_int8_t ignore_addrs[MAX_IGNORE];
37 
38 struct iicprobelist {
39 	u_int8_t start, end;
40 };
41 
42 /*
43  * Addresses at which to probe for sensors.  Skip address 0x4f, since
44  * probing it seems to crash at least one Sony VAIO laptop.  Only a
45  * few chips can actually sit at that address, and vendors seem to
46  * place those at other addresses, so this isn't a big loss.
47  */
48 struct iicprobelist probe_addrs_sensor[] = {
49 	{ 0x18, 0x1f },
50 	{ 0x20, 0x2f },
51 	{ 0x48, 0x4e },
52 	{ 0, 0 }
53 };
54 
55 /*
56  * Addresses at which to probe for eeprom devices.
57  */
58 struct iicprobelist probe_addrs_eeprom[] = {
59 	{ 0x50, 0x57 },
60 	{ 0, 0 }
61 };
62 
63 char 	*iic_probe_sensor(struct device *, u_int8_t);
64 char	*iic_probe_eeprom(struct device *, u_int8_t);
65 
66 #define PFLAG_SENSOR	1
67 static struct {
68 	struct iicprobelist *pl;
69 	char	*(*probe)(struct device *, u_int8_t);
70 	int	flags;
71 } probes[] = {
72 	{ probe_addrs_sensor, iic_probe_sensor, PFLAG_SENSOR },
73 	{ probe_addrs_eeprom, iic_probe_eeprom, 0 },
74 	{ NULL, NULL }
75 };
76 
77 /*
78  * Some Maxim 1617 clones MAY NOT even read cmd 0xfc!  When it is
79  * read, they will power-on-reset.  Their default condition
80  * (control register bit 0x80) therefore will be that they assert
81  * /ALERT for the 5 potential errors that may occur.  One of those
82  * errors is that the external temperature diode is missing.  This
83  * is unfortunately a common choice of system designers, except
84  * suddenly now we get a /ALERT, which may on some chipsets cause
85  * us to receive an entirely unexpected SMI .. and then an NMI.
86  *
87  * As we probe each device, if we hit something which looks suspiciously
88  * like it may potentially be a 1617 or clone, we immediately set this
89  * variable to avoid reading that register offset.
90  */
91 int	skip_fc;
92 
93 static i2c_tag_t probe_ic;
94 static u_int8_t probe_addr;
95 static u_int8_t probe_val[256];
96 
97 void		iicprobeinit(struct i2cbus_attach_args *, u_int8_t);
98 u_int8_t	iicprobenc(u_int8_t);
99 u_int8_t	iicprobe(u_int8_t);
100 u_int16_t	iicprobew(u_int8_t);
101 char		*lm75probe(void);
102 char		*adm1032cloneprobe(u_int8_t);
103 void		iic_dump(struct device *, u_int8_t, char *);
104 
105 void
106 iicprobeinit(struct i2cbus_attach_args *iba, u_int8_t addr)
107 {
108 	probe_ic = iba->iba_tag;
109 	probe_addr = addr;
110 	memset(probe_val, 0xff, sizeof probe_val);
111 }
112 
113 u_int8_t
114 iicprobenc(u_int8_t cmd)
115 {
116 	u_int8_t data;
117 
118 	/*
119 	 * If we think we are talking to an evil Maxim 1617 or clone,
120 	 * avoid accessing this register because it is death.
121 	 */
122 	if (skip_fc && cmd == 0xfc)
123 		return (0xff);
124 	iic_acquire_bus(probe_ic, 0);
125 	if (iic_exec(probe_ic, I2C_OP_READ_WITH_STOP,
126 	    probe_addr, &cmd, sizeof cmd, &data, sizeof data, 0) != 0)
127 		data = 0xff;
128 	iic_release_bus(probe_ic, 0);
129 	return (data);
130 }
131 
132 u_int16_t
133 iicprobew(u_int8_t cmd)
134 {
135 	u_int16_t data;
136 
137 	/*
138 	 * If we think we are talking to an evil Maxim 1617 or clone,
139 	 * avoid accessing this register because it is death.
140 	 */
141 	if (skip_fc && cmd == 0xfc)
142 		return (0xffff);
143 	iic_acquire_bus(probe_ic, 0);
144 	if (iic_exec(probe_ic, I2C_OP_READ_WITH_STOP,
145 	    probe_addr, &cmd, sizeof cmd, &data, sizeof data, 0) != 0)
146 		data = 0xffff;
147 	iic_release_bus(probe_ic, 0);
148 	return betoh16(data);
149 }
150 
151 u_int8_t
152 iicprobe(u_int8_t cmd)
153 {
154 	if (probe_val[cmd] != 0xff)
155 		return probe_val[cmd];
156 	probe_val[cmd] = iicprobenc(cmd);
157 	return (probe_val[cmd]);
158 }
159 
160 #define LM75TEMP	0x00
161 #define LM75CONF	0x01
162 #define LM75Thyst	0x02
163 #define LM75Tos		0x03
164 #define LM77Tlow	0x04
165 #define LM77Thigh	0x05
166 #define LM75TMASK	0xff80	/* 9 bits in temperature registers */
167 #define LM77TMASK	0xfff8	/* 13 bits in temperature registers */
168 
169 /*
170  * The LM75/LM75A/LM77 family are very hard to detect.  Thus, we check
171  * for all other possible chips first.  These chips do not have an
172  * ID register.  They do have a few quirks though:
173  * -  on the LM75 and LM77, registers 0x06 and 0x07 return whatever
174  *    value was read before
175  * -  the LM75 lacks registers 0x04 and 0x05, so those act as above
176  * -  the LM75A returns 0xffff for registers 0x04, 0x05, 0x06 and 0x07
177  * -  the chip registers loop every 8 registers
178  * The downside is that we must read almost every register to guess
179  * if this is an LM75, LM75A or LM77.
180  */
181 char *
182 lm75probe(void)
183 {
184 	u_int16_t temp, thyst, tos, tlow, thigh, mask = LM75TMASK;
185 	u_int8_t conf;
186 	int i, echocount, ffffcount, score;
187 	int echoreg67, echoreg45, ffffreg67, ffffreg45;
188 
189 	temp = iicprobew(LM75TEMP);
190 
191 	/*
192 	 * Sometimes the other probes can upset the chip, if we get 0xffff
193 	 * the first time, try it once more.
194 	 */
195 	if (temp == 0xffff)
196 		temp = iicprobew(LM75TEMP);
197 
198 	conf = iicprobenc(LM75CONF);
199 	thyst = iicprobew(LM75Thyst);
200 	tos = iicprobew(LM75Tos);
201 
202 	/* totally bogus data */
203 	if (conf == 0xff && temp == 0xffff && thyst == 0xffff)
204 		return (NULL);
205 
206 	temp &= mask;
207 	thyst &= mask;
208 	tos &= mask;
209 
210 	/* All values the same?  Very unlikely */
211 	if (temp == thyst && thyst == tos)
212 		return (NULL);
213 
214 #if notsure
215 	/* more register aliasing effects that indicate not a lm75 */
216 	if ((temp >> 8) == conf)
217 		return (NULL);
218 #endif
219 
220 	/*
221 	 * LM77/LM75 registers 6, 7
222 	 * echo whatever was read just before them from reg 0, 1, or 2
223 	 *
224 	 * LM75A doesn't appear to do this, but does appear to reliably
225 	 * return 0xffff
226 	 */
227 	for (i = 6, echocount = 2, ffffcount = 0; i <= 7; i++) {
228 		if ((iicprobew(LM75TEMP) & mask) != (iicprobew(i) & mask) ||
229 		    (iicprobew(LM75Thyst) & mask) != (iicprobew(i) & mask) ||
230 		    (iicprobew(LM75Tos) & mask) != (iicprobew(i) & mask))
231 			echocount--;
232 		if (iicprobew(i) == 0xffff)
233 			ffffcount++;
234 	}
235 
236 	/* Make sure either both registers echo, or neither does */
237 	if (echocount == 1 || ffffcount == 1)
238 		return (NULL);
239 
240 	echoreg67 = (echocount == 0) ? 0 : 1;
241 	ffffreg67 = (ffffcount == 0) ? 0 : 1;
242 
243 	/*
244 	 * LM75 has no registers 4 or 5, and they will act as echos too
245 	 *
246 	 * LM75A doesn't appear to do this either, but does appear to
247 	 * reliably return 0xffff
248 	 */
249 	for (i = 4, echocount = 2, ffffcount = 0; i <= 5; i++) {
250 		if ((iicprobew(LM75TEMP) & mask) != (iicprobew(i) & mask) ||
251 		    (iicprobew(LM75Thyst) & mask) != (iicprobew(i) & mask) ||
252 		    (iicprobew(LM75Tos) & mask) != (iicprobew(i) & mask))
253 			echocount--;
254 		if (iicprobew(i) == 0xffff)
255 			ffffcount++;
256 	}
257 
258 	/* Make sure either both registers echo, or neither does */
259 	if (echocount == 1 || ffffcount == 1)
260 		return (NULL);
261 
262 	echoreg45 = (echocount == 0) ? 0 : 1;
263 	ffffreg45 = (ffffcount == 0) ? 0 : 1;
264 
265 	/*
266 	 * If we find that 4 and 5 are not echos, and don't return 0xffff
267 	 * then based on whether the echo test of registers 6 and 7
268 	 * succeeded or not, we may have an LM77
269 	 */
270 	if (echoreg45 == 0 && ffffreg45 == 0 && echoreg67 == 1) {
271 		mask = LM77TMASK;
272 
273 		/* mask size changed, must re-read for the next checks */
274 		thyst = iicprobew(LM75Thyst) & mask;
275 		tos = iicprobew(LM75Tos) & mask;
276 		tlow = iicprobew(LM77Tlow) & mask;
277 		thigh = iicprobew(LM77Thigh) & mask;
278 	}
279 
280 	/* a real LM75/LM75A/LM77 repeats its registers.... */
281 	for (i = 0x08; i <= 0xf8; i += 8) {
282 		if (conf != iicprobenc(LM75CONF + i) ||
283 		    thyst != (iicprobew(LM75Thyst + i) & mask) ||
284 		    tos != (iicprobew(LM75Tos + i) & mask))
285 			return (NULL);
286 
287 		/*
288 		 * Check that the repeated registers 0x06 and 0x07 still
289 		 * either echo or return 0xffff
290 		 */
291 		if (echoreg67 == 1) {
292 			tos = iicprobew(LM75Tos) & mask;
293 			if (tos != (iicprobew(0x06 + i) & mask) ||
294 			    tos != (iicprobew(0x07 + i) & mask))
295 				return (NULL);
296 		} else if (ffffreg67 == 1)
297 			if (iicprobew(0x06 + i) != 0xffff ||
298 			    iicprobew(0x07 + i) != 0xffff)
299 				return (NULL);
300 
301 		/*
302 		 * Check that the repeated registers 0x04 and 0x05 still
303 		 * either echo or return 0xffff. If they do neither, and
304 		 * registers 0x06 and 0x07 echo, then we will be probing
305 		 * for an LM77, so make sure those still repeat
306 		 */
307 		if (echoreg45 == 1) {
308 			tos = iicprobew(LM75Tos) & mask;
309 			if (tos != (iicprobew(LM77Tlow + i) & mask) ||
310 			    tos != (iicprobew(LM77Thigh + i) & mask))
311 				return (NULL);
312 		} else if (ffffreg45 == 1) {
313 			if (iicprobew(LM77Tlow + i) != 0xffff ||
314 			    iicprobew(LM77Thigh + i) != 0xffff)
315 				return (NULL);
316 		} else if (echoreg67 == 1)
317 			if (tlow != (iicprobew(LM77Tlow + i) & mask) ||
318 			    thigh != (iicprobew(LM77Thigh + i) & mask))
319 				return (NULL);
320 	}
321 
322 	/*
323 	 * Given that we now know how the first eight registers behave and
324 	 * that this behaviour is consistently repeated, we can now use
325 	 * the following table:
326 	 *
327 	 * echoreg67 | echoreg45 | ffffreg67 | ffffreg45 | chip
328 	 * ----------+-----------+-----------+-----------+------
329 	 *     1     |     1     |     0     |     0     | LM75
330 	 *     1     |     0     |     0     |     0     | LM77
331 	 *     0     |     0     |     1     |     1     | LM75A
332 	 */
333 
334 	/* Convert the various flags into a single score */
335 	score = (echoreg67 << 3) + (echoreg45 << 2) + (ffffreg67 << 1) +
336 	    ffffreg45;
337 
338 	switch (score) {
339 	case 12:
340 		return ("lm75");
341 	case 8:
342 		return ("lm77");
343 	case 3:
344 		return ("lm75a");
345 	default:
346 #if defined(I2C_DEBUG)
347 		printf("lm75probe: unknown chip, scored %d\n", score);
348 #endif /* defined(I2C_DEBUG) */
349 		return (NULL);
350 	}
351 }
352 
353 char *
354 adm1032cloneprobe(u_int8_t addr)
355 {
356 	if (addr == 0x18 || addr == 0x1a || addr == 0x29 ||
357 	    addr == 0x2b || addr == 0x4c || addr == 0x4e) {
358 		u_int8_t reg, val;
359 		int zero = 0, copy = 0;
360 
361 		val = iicprobe(0x00);
362 		for (reg = 0x00; reg < 0x09; reg++) {
363 			if (iicprobe(reg) == 0xff)
364 				return (NULL);
365 			if (iicprobe(reg) == 0x00)
366 				zero++;
367 			if (val == iicprobe(reg))
368 				copy++;
369 		}
370 		if (zero > 6 || copy > 6)
371 			return (NULL);
372 		val = iicprobe(0x09);
373 		for (reg = 0x0a; reg < 0xfc; reg++) {
374 			if (iicprobe(reg) != val)
375 				return (NULL);
376 		}
377 		/* 0xfe may be Maxim, or some other vendor */
378 		if (iicprobe(0xfe) == 0x4d)
379 			return ("max1617");
380 		/*
381 		 * "xeontemp" is the name we choose for clone chips
382 		 * which have all sorts of buggy bus interactions, such
383 		 * as those we just probed.  Why?
384 		 * Intel is partly to blame for this situation.
385 		 */
386 		return ("xeontemp");
387 	}
388 	return (NULL);
389 }
390 
391 void
392 iic_ignore_addr(u_int8_t addr)
393 {
394 	int i;
395 
396 	for (i = 0; i < sizeof(ignore_addrs); i++)
397 		if (ignore_addrs[i] == 0) {
398 			ignore_addrs[i] = addr;
399 			return;
400 		}
401 }
402 
403 #ifdef I2C_VERBOSE
404 void
405 iic_dump(struct device *dv, u_int8_t addr, char *name)
406 {
407 	static u_int8_t iicvalcnt[256];
408 	u_int8_t val, val2, max;
409 	int i, cnt = 0;
410 
411 	/*
412 	 * Don't bother printing the most often repeated register
413 	 * value, since it is often weird devices that respond
414 	 * incorrectly, busted controller driver, or in the worst
415 	 * case, it in mosts cases, the value 0xff.
416 	 */
417 	bzero(iicvalcnt, sizeof iicvalcnt);
418 	val = iicprobe(0);
419 	iicvalcnt[val]++;
420 	for (i = 1; i <= 0xff; i++) {
421 		val2 = iicprobe(i);
422 		iicvalcnt[val2]++;
423 		if (val == val2)
424 			cnt++;
425 	}
426 
427 	for (val = max = i = 0; i <= 0xff; i++)
428 		if (max < iicvalcnt[i]) {
429 			max = iicvalcnt[i];
430 			val = i;
431 		}
432 
433 	if (cnt == 255)
434 		return;
435 
436 	printf("%s: addr 0x%x", dv->dv_xname, addr);
437 	for (i = 0; i <= 0xff; i++) {
438 		if (iicprobe(i) != val)
439 			printf(" %02x=%02x", i, iicprobe(i));
440 	}
441 	printf(" words");
442 	for (i = 0; i < 8; i++)
443 		printf(" %02x=%04x", i, iicprobew(i));
444 	if (name)
445 		printf(": %s", name);
446 	printf("\n");
447 }
448 #endif /* I2C_VERBOSE */
449 
450 char *
451 iic_probe_sensor(struct device *self, u_int8_t addr)
452 {
453 	char *name = NULL;
454 
455 	skip_fc = 0;
456 
457 	/*
458 	 * Many I2C/SMBus devices use register 0x3e as a vendor ID
459 	 * register.
460 	 */
461 	switch (iicprobe(0x3e)) {
462 	case 0x01:		/* National Semiconductor */
463 		/*
464 		 * Some newer National products use a vendor code at
465 		 * 0x3e of 0x01, and then 0x3f contains a product code
466 		 * But some older products are missing a product code,
467 		 * and contain who knows what in that register.  We assume
468 		 * that some employee was smart enough to keep the numbers
469 		 * unique.
470 		 */
471 		if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
472 		    (iicprobe(0x3f) == 0x73 || iicprobe(0x3f) == 0x72) &&
473 		    iicprobe(0x00) == 0x00)
474 			name = "lm93";	/* product 0x72 is the prototype */
475 		else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
476 		    iicprobe(0x3f) == 0x68)
477 			name = "lm96000";	/* adt7460 compat? */
478 		else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
479 		    (iicprobe(0x3f) == 0x60 || iicprobe(0x3f) == 0x62))
480 			name = "lm85";		/* lm85C/B == adt7460 compat */
481 		else if ((addr & 0x7c) == 0x2c &&	/* addr 0b01011xx */
482 		    iicprobe(0x48) == addr &&
483 		    (iicprobe(0x3f) == 0x03 || iicprobe(0x3f) == 0x04) &&
484 		    (iicprobe(0x40) & 0x80) == 0x00)
485 			name = "lm81";
486 		break;
487 	case 0x02:		/* National Semiconductor? */
488 		if ((iicprobe(0x3f) & 0xfc) == 0x04)
489 			name = "lm87";		/* complete check */
490 		break;
491 	case 0x23:		/* Analog Devices? */
492 		if (iicprobe(0x48) == addr &&
493 		    (iicprobe(0x40) & 0x80) == 0x00 &&
494 		    (addr & 0x7c) == 0x2c)
495 			name = "adm9240";	/* lm87 clone */
496 		break;
497 	case 0x41:		/* Analog Devices */
498 		/*
499 		 * Newer chips have a valid 0x3d product number, while
500 		 * older ones sometimes encoded the product into the
501 		 * upper half of the "step register" at 0x3f.
502 		 */
503 		if ((addr == 0x2c || addr == 0x2e || addr == 0x2f) &&
504 		    iicprobe(0x3d) == 0x70)
505 			name = "adt7470";
506 		else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
507 		    iicprobe(0x3d) == 0x76)
508 			name = "adt7476"; /* or adt7476a */
509 		else if (addr == 0x2e && iicprobe(0x3d) == 0x75)
510 			name = "adt7475";
511 		else if (iicprobe(0x3d) == 0x27 &&
512 		    (iicprobe(0x3f) == 0x60 || iicprobe(0x3f) == 0x6a))
513 			name = "adm1027";	/* or adt7463 */
514 		else if (iicprobe(0x3d) == 0x27 &&
515 		    (iicprobe(0x3f) == 0x62 || iicprobe(0x3f) == 0x6a))
516 			name = "adt7460";	/* complete check */
517 		else if ((addr == 0x2c || addr == 0x2e) &&
518 		    iicprobe(0x3d) == 0x62 && iicprobe(0x3f) == 0x04)
519 			name = "adt7462";
520 		else if (addr == 0x4c &&
521 		    iicprobe(0x3d) == 0x66 && iicprobe(0x3f) == 0x02)
522 			name = "adt7466";
523 		else if (addr == 0x2e &&
524 		    iicprobe(0x3d) == 0x68 && (iicprobe(0x3f) & 0xf0) == 0x70)
525 			name = "adt7467"; /* or adt7468 */
526 		else if (iicprobe(0x3d) == 0x33 && iicprobe(0x3f) == 0x02)
527 			name = "adm1033";
528 		else if (iicprobe(0x3d) == 0x34 && iicprobe(0x3f) == 0x02)
529 			name = "adm1034";
530 		else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
531 		    iicprobe(0x3d) == 0x30 &&
532 		    (iicprobe(0x01) & 0x80) == 0x00 &&
533 		    (iicprobe(0x0d) & 0x70) == 0x00 &&
534 		    (iicprobe(0x0e) & 0x70) == 0x00)
535 			/*
536 			 * Revision 3 seems to be an adm1031 with
537 			 * remote diode 2 shorted.  Therefore we
538 			 * cannot assume the reserved/unused bits of
539 			 * register 0x03 and 0x06 are set to zero.
540 			 */
541 			name = "adm1030";	/* complete check */
542 		else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
543 		    iicprobe(0x3d) == 0x31 &&
544 		    (iicprobe(0x01) & 0x80) == 0x00 &&
545 		    (iicprobe(0x0d) & 0x70) == 0x00 &&
546 		    (iicprobe(0x0e) & 0x70) == 0x00 &&
547 		    (iicprobe(0x0f) & 0x70) == 0x00)
548 			name = "adm1031";	/* complete check */
549 		else if ((addr & 0x7c) == 0x2c &&	/* addr 0b01011xx */
550 		    (iicprobe(0x3f) & 0xf0) == 0x20 &&
551 		    (iicprobe(0x40) & 0x80) == 0x00 &&
552 		    (iicprobe(0x41) & 0xc0) == 0x00 &&
553 		    (iicprobe(0x42) & 0xbc) == 0x00)
554 			name = "adm1025";	/* complete check */
555 		else if ((addr & 0x7c) == 0x2c &&	/* addr 0b01011xx */
556 		    (iicprobe(0x3f) & 0xf0) == 0x10 &&
557 		    (iicprobe(0x40) & 0x80) == 0x00)
558 			name = "adm1024";	/* complete check */
559 		else if ((iicprobe(0xff) & 0xf0) == 0x30)
560 			name = "adm1023";
561 		else if (addr == 0x2e &&
562 		    (iicprobe(0x3f) & 0xf0) == 0xd0 &&
563 		    (iicprobe(0x40) & 0x80) == 0x00)
564 			name = "adm1028";	/* adm1022 clone? */
565 		else if ((addr == 0x2c || addr == 0x2e || addr == 0x2f) &&
566 		    (iicprobe(0x3f) & 0xf0) == 0xc0 &&
567 		    (iicprobe(0x40) & 0x80) == 0x00)
568 			name = "adm1022";
569 		break;
570 	case 0x49:		/* Texas Instruments */
571 		if ((addr == 0x2c || addr == 0x2e || addr == 0x2f) &&
572 		    (iicprobe(0x3f) & 0xf0) == 0xc0 &&
573 		    (iicprobe(0x40) & 0x80) == 0x00)
574 			name = "thmc50";	/* adm1022 clone */
575 		break;
576 	case 0x55:		/* SMSC */
577 		if ((addr & 0x7c) == 0x2c &&		/* addr 0b01011xx */
578 		    iicprobe(0x3f) == 0x20 &&
579 		    (iicprobe(0x47) & 0x70) == 0x00 &&
580 		    (iicprobe(0x49) & 0xfe) == 0x80)
581 			name = "47m192";	/* adm1025 compat */
582 		break;
583 	case 0x5c:		/* SMSC */
584 		if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
585 		    (iicprobe(0x3f) == 0x69))
586 			name = "sch5027";
587 		else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
588 		    (iicprobe(0x3f) & 0xf0) == 0x60)
589 			name = "emc6d100";   /* emc6d101, emc6d102, emc6d103 */
590 		else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
591 		    (iicprobe(0x3f) & 0xf0) == 0x80)
592 			name = "sch5017";
593 		else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
594 		    (iicprobe(0x3f) & 0xf0) == 0xb0)
595 			name = "emc6w201";
596 		break;
597 	case 0x61:		/* Andigilog */
598 		if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
599 		    iicprobe(0x3f) == 0x69 &&
600 		    iicprobe(0x22) >= 0xaf &&		/* Vdd */
601 		    (iicprobe(0x09) & 0xbf) == 0x00 && iicprobe(0x0f) == 0x00 &&
602 		    (iicprobe(0x40) & 0xf0) == 0x00)
603 			name = "asc7611";
604 		else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
605 		    iicprobe(0x3f) == 0x6c &&
606 		    iicprobe(0x22) >= 0xae)		/* Vdd */
607 			name = "asc7621";
608 		break;
609 	case 0xa1:		/* Philips */
610 		if ((iicprobe(0x3f) & 0xf0) == 0x20 &&
611 		    (iicprobe(0x40) & 0x80) == 0x00 &&
612 		    (iicprobe(0x41) & 0xc0) == 0x00 &&
613 		    (iicprobe(0x42) & 0xbc) == 0x00)
614 			name = "ne1619";	/* adm1025 compat */
615 		break;
616 	case 0xda:		/* Dallas Semiconductor */
617 		if (iicprobe(0x3f) == 0x01 && iicprobe(0x48) == addr &&
618 		    (iicprobe(0x40) & 0x80) == 0x00)
619 			name = "ds1780";	/* lm87 clones */
620 		break;
621 	}
622 
623 	switch (iicprobe(0x4e)) {
624 	case 0x41:		/* Analog Devices */
625 		if ((addr == 0x48 || addr == 0x4a || addr == 0x4b) &&
626 		    (iicprobe(0x4d) == 0x03 || iicprobe(0x4d) == 0x08 ||
627 		    iicprobe(0x4d) == 0x07))
628 			name = "adt7516";	/* adt7517, adt7519 */
629 		break;
630 	}
631 
632 	switch (iicprobe(0xfe)) {
633 	case 0x01:		/* National Semiconductor */
634 		if (addr == 0x4c &&
635 		    iicprobe(0xff) == 0x41 && (iicprobe(0x03) & 0x18) == 0 &&
636 		    iicprobe(0x04) <= 0x0f && (iicprobe(0xbf) & 0xf8) == 0)
637 			name = "lm63";
638 		else if (addr == 0x4c &&
639 		    iicprobe(0xff) == 0x11 && (iicprobe(0x03) & 0x2a) == 0 &&
640 		    iicprobe(0x04) <= 0x09 && (iicprobe(0xbf) & 0xf8) == 0)
641 			name = "lm86";
642 		else if (addr == 0x4c &&
643 		    iicprobe(0xff) == 0x31 && (iicprobe(0x03) & 0x2a) == 0 &&
644 		    iicprobe(0x04) <= 0x09 && (iicprobe(0xbf) & 0xf8) == 0)
645 			name = "lm89";		/* or lm99 */
646 		else if (addr == 0x4d &&
647 		    iicprobe(0xff) == 0x34 && (iicprobe(0x03) & 0x2a) == 0 &&
648 		    iicprobe(0x04) <= 0x09 && (iicprobe(0xbf) & 0xf8) == 0)
649 			name = "lm89-1";	/* or lm99-1 */
650 		else if (addr == 0x4c &&
651 		    iicprobe(0xff) == 0x21 && (iicprobe(0x03) & 0x2a) == 0 &&
652 		    iicprobe(0x04) <= 0x09 && (iicprobe(0xbf) & 0xf8) == 0)
653 			name = "lm90";
654 		break;
655 	case 0x23:		/* Genesys Logic? */
656 		if ((addr == 0x4c) &&
657 		    (iicprobe(0x03) & 0x3f) == 0x00 && iicprobe(0x04) <= 0x08)
658 			/*
659 			 * Genesys Logic doesn't make the datasheet
660 			 * for the GL523SM publically available, so
661 			 * the checks above are nothing more than a
662 			 * (conservative) educated guess.
663 			 */
664 			name = "gl523sm";
665 		break;
666 	case 0x41:		/* Analog Devices */
667 		if ((addr == 0x4c || addr == 0x4d) &&
668 		    iicprobe(0xff) == 0x51 &&
669 		    (iicprobe(0x03) & 0x1f) == 0x04 &&
670 		    iicprobe(0x04) <= 0x0a) {
671 			/* If not in adm1032 compatibility mode. */
672 			name = "adt7461";
673 		} else if ((addr == 0x18 || addr == 0x19 || addr == 0x1a ||
674 		    addr == 0x29 || addr == 0x2a || addr == 0x2b ||
675 		    addr == 0x4c || addr == 0x4d || addr == 0x4e) &&
676 		    (iicprobe(0xff) & 0xf0) == 0x00 &&
677 		    (iicprobe(0x03) & 0x3f) == 0x00 &&
678 		    iicprobe(0x04) <= 0x07) {
679 			name = "adm1021";
680 			skip_fc = 1;
681 		} else if ((addr == 0x18 || addr == 0x19 || addr == 0x1a ||
682 		    addr == 0x29 || addr == 0x2a || addr == 0x2b ||
683 		    addr == 0x4c || addr == 0x4d || addr == 0x4e) &&
684 		    (iicprobe(0xff) & 0xf0) == 0x30 &&
685 		    (iicprobe(0x03) & 0x3f) == 0x00 &&
686 		    iicprobe(0x04) <= 0x07) {
687 			name = "adm1023";	/* or adm1021a */
688 			skip_fc = 1;
689 		} else if ((addr == 0x4c || addr == 0x4d || addr == 0x4e) &&
690 		    (iicprobe(0x03) & 0x3f) == 0x00 &&
691 		    iicprobe(0x04) <= 0x0a) {
692 			name = "adm1032";	/* or adm1020 */
693 			skip_fc = 1;
694 		}
695 		break;
696 	case 0x47:		/* Global Mixed-mode Technology */
697 		if (addr == 0x4c && iicprobe(0xff) == 0x01 &&
698 		    (iicprobe(0x03) & 0x3f) == 0x00 && iicprobe(0x04) <= 0x08)
699 			name = "g781";
700 		if (addr == 0x4d && iicprobe(0xff) == 0x03 &&
701 		    (iicprobe(0x03) & 0x3f) == 0x00 && iicprobe(0x04) <= 0x08)
702 			name = "g781-1";
703 		break;
704 	case 0x4d:		/* Maxim */
705 		if ((addr == 0x18 || addr == 0x19 || addr == 0x1a ||
706 		     addr == 0x29 || addr == 0x2a || addr == 0x2b ||
707 		     addr == 0x4c || addr == 0x4d || addr == 0x4e) &&
708 		    iicprobe(0xff) == 0x08 && (iicprobe(0x02) & 0x03) == 0 &&
709 		    (iicprobe(0x03) & 0x07) == 0 && iicprobe(0x04) <= 0x08)
710 			name = "max6690";
711 		else if ((addr == 0x4c || addr == 0x4d || addr == 0x4e) &&
712 		    iicprobe(0xff) == 0x59 && (iicprobe(0x03) & 0x1f) == 0 &&
713 		    iicprobe(0x04) <= 0x07)
714 			name = "max6646";	/* max6647/8/9, max6692 */
715 		else if ((addr == 0x4c || addr == 0x4d || addr == 0x4e) &&
716 		    (iicprobe(0x02) & 0x2b) == 0 &&
717 		    (iicprobe(0x03) & 0x0f) == 0 && iicprobe(0x04) <= 0x09) {
718 			name = "max6657";	/* max6658, max6659 */
719 			skip_fc = 1;
720 		} else if ((addr >= 0x48 && addr <= 0x4f) &&
721 		    (iicprobe(0x02) & 0x2b) == 0 &&
722 		    (iicprobe(0x03) & 0x0f) == 0)
723 			name = "max6642";
724 		break;
725 	case 0x55:		/* Texas Instruments */
726 		if (addr == 0x4c && iicprobe(0xff) == 0x11 &&
727 		    (iicprobe(0x03) & 0x1b) == 0x00 &&
728 		    (iicprobe(0x04) & 0xf0) == 0x00 &&
729 		    (iicprobe(0x10) & 0x0f) == 0x00 &&
730 		    (iicprobe(0x13) & 0x0f) == 0x00 &&
731 		    (iicprobe(0x14) & 0x0f) == 0x00 &&
732 		    (iicprobe(0x15) & 0x0f) == 0x00 &&
733 		    (iicprobe(0x16) & 0x0f) == 0x00 &&
734 		    (iicprobe(0x17) & 0x0f) == 0x00)
735 			name = "tmp401";
736 		break;
737 	case 0xa1:
738 		if ((addr >= 0x48 && addr <= 0x4f) &&
739 		    iicprobe(0xff) == 0x00 &&
740 		    (iicprobe(0x03) & 0xf8) == 0x00 &&
741 		    iicprobe(0x04) <= 0x09) {
742 			name = "sa56004x";	/* NXP sa56004x */
743 			skip_fc = 1;
744 		}
745 		break;
746 	}
747 
748 	if (addr == iicprobe(0x48) &&
749 	    ((iicprobe(0x4f) == 0x5c && (iicprobe(0x4e) & 0x80)) ||
750 	    (iicprobe(0x4f) == 0xa3 && !(iicprobe(0x4e) & 0x80)))) {
751 		/*
752 		 * We could toggle 0x4e bit 0x80, then re-read 0x4f to
753 		 * see if the value changes to 0xa3 (indicating Winbond).
754 		 * But we are trying to avoid writes.
755 		 */
756 		if ((iicprobe(0x4e) & 0x07) == 0) {
757 			switch (iicprobe(0x58)) {
758 			case 0x10:
759 			case 0x11:			/* rev 2? */
760 				name = "w83781d";
761 				break;
762 			case 0x21:
763 				name = "w83627hf";
764 				break;
765 			case 0x30:
766 				name = "w83782d";
767 				break;
768 			case 0x31:
769 				name = "as99127f";	/* rev 2 */
770 				break;
771 			case 0x40:
772 				name = "w83783s";
773 				break;
774 			case 0x71:
775 				name = "w83791d";
776 				break;
777 			case 0x72:
778 				name = "w83791sd";
779 				break;
780 			case 0x7a:
781 				name = "w83792d";
782 				break;
783 			case 0xc1:
784 				name = "w83627dhg";
785 				break;
786 			}
787 		} else {
788 			/*
789 			 * The BIOS left the chip in a non-zero
790 			 * register bank.  Assume it's a W83781D and
791 			 * let lm(4) sort out the real model.
792 			 */
793 			name = "w83781d";
794 		}
795 	} else if (addr == (iicprobe(0xfc) & 0x7f) &&
796 	    iicprobe(0xfe) == 0x79 && iicprobe(0xfb) == 0x51 &&
797 	    ((iicprobe(0xfd) == 0x5c && (iicprobe(0x00) & 0x80)) ||
798 	    (iicprobe(0xfd) == 0xa3 && !(iicprobe(0x00) & 0x80)))) {
799 		/*
800 		 * We could toggle 0x00 bit 0x80, then re-read 0xfd to
801 		 * see if the value changes to 0xa3 (indicating Nuvoton).
802 		 * But we are trying to avoid writes.
803 		 */
804 		name = "w83795g";
805 	} else if (addr == iicprobe(0x4a) && iicprobe(0x4e) == 0x50 &&
806 	    iicprobe(0x4c) == 0xa3 && iicprobe(0x4d) == 0x5c) {
807 		name = "w83l784r";
808 	} else if (addr == 0x2d && iicprobe(0x4e) == 0x60 &&
809 	    iicprobe(0x4c) == 0xa3 && iicprobe(0x4d) == 0x5c) {
810 		name = "w83l785r";
811 	} else if (addr == 0x2e && iicprobe(0x4e) == 0x70 &&
812 	    iicprobe(0x4c) == 0xa3 && iicprobe(0x4d) == 0x5c) {
813 		name = "w83l785ts-l";
814 	} else if (addr >= 0x2c && addr <= 0x2f &&
815 	    ((iicprobe(0x00) & 0x07) != 0x0 ||
816 	    ((iicprobe(0x00) & 0x07) == 0x0 && addr * 2 == iicprobe(0x0b) &&
817 	    (iicprobe(0x0c) & 0x40) && !(iicprobe(0x0c) & 0x04))) &&
818 	    iicprobe(0x0e) == 0x7b &&
819 	    (iicprobe(0x0f) & 0xf0) == 0x10 &&
820 	    ((iicprobe(0x0d) == 0x5c && (iicprobe(0x00) & 0x80)) ||
821 	    (iicprobe(0x0d) == 0xa3 && !(iicprobe(0x00) & 0x80)))) {
822 		name = "w83793g";
823 	} else if (addr >= 0x28 && addr <= 0x2f &&
824 	    iicprobe(0x4f) == 0x12 && (iicprobe(0x4e) & 0x80)) {
825 		/*
826 		 * We could toggle 0x4e bit 0x80, then re-read 0x4f to
827 		 * see if the value changes to 0xc3 (indicating ASUS).
828 		 * But we are trying to avoid writes.
829 		 */
830 		if (iicprobe(0x58) == 0x31)
831 			name = "as99127f";	/* rev 1 */
832 	} else if ((addr == 0x2d || addr == 0x2e) &&
833 	    addr * 2 == iicprobe(0x04) &&
834 	    iicprobe(0x5d) == 0x19 && iicprobe(0x5e) == 0x34 &&
835 	    iicprobe(0x5a) == 0x03 && iicprobe(0x5b) == 0x06) {
836 		name = "f75375";	/* Fintek */
837 	} else if (addr == 0x2d &&
838 	    ((iicprobe(0x4f) == 0x06 && (iicprobe(0x4e) & 0x80)) ||
839 	    (iicprobe(0x4f) == 0x94 && !(iicprobe(0x4e) & 0x80)))) {
840 		/*
841 		 * We could toggle 0x4e bit 0x80, then re-read 0x4f to
842 		 * see if the value changes to 0x94 (indicating ASUS).
843 		 * But we are trying to avoid writes.
844 		 *
845 		 * NB. we won't match if the BIOS has selected a non-zero
846 		 * register bank (set via 0x4e). We could select bank 0 so
847 		 * we see the right registers, but that would require a
848 		 * write.  In general though, we bet no BIOS would leave us
849 		 * in the wrong state.
850 		 */
851 		if ((iicprobe(0x58) & 0x7f) == 0x31 &&
852 		    (iicprobe(0x4e) & 0xf) == 0x00)
853 			name = "asb100";
854 	} else if ((addr == 0x2c || addr == 0x2d) &&
855 	    iicprobe(0x00) == 0x80 &&
856 	    (iicprobe(0x01) == 0x00 || iicprobe(0x01) == 0x80) &&
857 	    iicprobe(0x02) == 0x00 && (iicprobe(0x03) & 0x83) == 0x00 &&
858 	    (iicprobe(0x0f) & 0x07) == 0x00 &&
859 	    (iicprobe(0x11) & 0x80) == 0x00 &&
860 	    (iicprobe(0x12) & 0x80) == 0x00) {
861 		/*
862 		 * The GL518SM is really crappy.  It has both byte and
863 		 * word registers, and reading a word register with a
864 		 * byte read command will make the device crap out and
865 		 * hang the bus.  This has nasty consequences on some
866 		 * machines, like preventing warm reboots.  The word
867 		 * registers are 0x07 through 0x0c, so make sure the
868 		 * checks above don't access those registers.  We
869 		 * don't want to do this check right up front though
870 		 * since this chip is somewhat hard to detect (which
871 		 * is why we check for every single fixed bit it has).
872 		 */
873 		name = "gl518sm";
874 	} else if ((addr == 0x2c || addr == 0x2d || addr == 0x2e) &&
875 	    iicprobe(0x16) == 0x41 && ((iicprobe(0x17) & 0xf0) == 0x40)) {
876 		name = "adm1026";
877 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x1131 &&
878 	    (iicprobew(0x07) & 0xfffc) == 0xa200) {
879 		name = "se97";		/* or se97b */
880 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x1131 &&
881 	    (iicprobew(0x07) & 0xfffc) == 0xa100 &&
882 	    (iicprobew(0x00) & 0xfff0) == 0x0010) {
883 		name = "se98";
884 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x004d &&
885 	    iicprobew(0x07) == 0x3e00 &&
886 	    (iicprobew(0x00) & 0xffe0) == 0x0000) {
887 		name = "max6604";
888 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x0054 &&
889 	    (iicprobew(0x07) & 0xfffc) == 0x0200 &&
890 	    (iicprobew(0x00) & 0xffe0) == 0x0000) {
891 		name = "mcp9804";
892 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x0054 &&
893 	    (iicprobew(0x07) & 0xff00) == 0x0000 &&
894 	    (iicprobew(0x00) & 0xffe0) == 0x0000) {
895 		name = "mcp9805";		/* or mcp9843 */
896 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x0054 &&
897 	    (iicprobew(0x07) & 0xfffc) == 0x2000 &&
898 	    (iicprobew(0x00) & 0xffe0) == 0x0000) {
899 		name = "mcp98242";
900 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x0054 &&
901 	    (iicprobew(0x07) & 0xff00) == 0x2100 &&
902 	    (iicprobew(0x00) & 0xff00) == 0x0000) {
903 		name = "mcp98243";
904 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x0054 &&
905 	    (iicprobew(0x07) & 0xfffc) == 0x2200 &&
906 	    (iicprobew(0x00) & 0xff00) == 0x0000) {
907 		name = "mcp98244";
908 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x11d4 &&
909 	    iicprobew(0x07) == 0x0800 &&
910 	    iicprobew(0x00) == 0x001d) {
911 		name = "adt7408";
912 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x104a &&
913 	    (iicprobew(0x07) & 0xfffe) == 0x0000 &&
914 	    (iicprobew(0x00) == 0x002d || iicprobew(0x00) == 0x002f)) {
915 		name = "stts424e02";
916 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x104a &&
917 	    (iicprobew(0x07) & 0xfffe) == 0x0300 &&
918 	    (iicprobew(0x00) == 0x006f)) {
919 		name = "stts2002";
920 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x104a &&
921 	    (iicprobew(0x07) & 0xffff) == 0x2201 &&
922 	    (iicprobew(0x00) == 0x00ef)) {
923 		name = "stts2004";
924 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x104a &&
925 	    (iicprobew(0x07) & 0xffff) == 0x0200 &&
926 	    (iicprobew(0x00) == 0x006f)) {
927 		name = "stts3000";
928 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x104a &&
929 	    (iicprobew(0x07) & 0xffff) == 0x0101 &&
930 	    (iicprobew(0x00) == 0x002d || iicprobew(0x00) == 0x002f)) {
931 		name = "stts424";
932 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x1b09 &&
933 	    (iicprobew(0x07) & 0xffe0) == 0x0800 &&
934 	    (iicprobew(0x00) & 0x001f) == 0x001f) {
935 		name = "cat34ts02";		/* or cat6095, prod 0x0813 */
936 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x1b09 &&
937 	    (iicprobew(0x07) & 0xffff) == 0x0a00 &&
938 	    (iicprobew(0x00) & 0x001f) == 0x001f) {
939 		name = "cat34ts02c";
940 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x1b09 &&
941 	    (iicprobew(0x07) & 0xffff) == 0x2200 &&
942 	    (iicprobew(0x00) == 0x007f)) {
943 		name = "cat34ts04";
944 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x00b3 &&
945 	    (iicprobew(0x07) & 0xffff) == 0x2903 &&
946 	    (iicprobew(0x00) == 0x004f)) {
947 		name = "ts3000b3";		/* or tse2002b3 */
948 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x00b3 &&
949 	    (iicprobew(0x07) & 0xffff) == 0x2912 &&
950 	    (iicprobew(0x00) == 0x006f)) {
951 		name = "ts3000gb2";		/* or tse2002gb2 */
952 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x00b3 &&
953 	    (iicprobew(0x07) & 0xffff) == 0x2913 &&
954 	    (iicprobew(0x00) == 0x0077)) {
955 		name = "ts3000gb0";
956 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x00b3 &&
957 	    (iicprobew(0x07) & 0xffff) == 0x3001 &&
958 	    (iicprobew(0x00) == 0x006f)) {
959 		name = "ts3001gb2";
960 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x00b3 &&
961 	    (iicprobew(0x07) & 0xffff) == 0x2214 &&
962 	    (iicprobew(0x00) == 0x00ff)) {
963 		name = "tse2004gb2";
964 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x001f &&
965 	    (iicprobew(0x07) & 0xffff) == 0x8201 &&
966 	    (iicprobew(0x00) & 0xff00) == 0x0000) {
967 		name = "at30ts00";		/* or at30tse002 */
968 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x1114 &&
969 	    (iicprobew(0x07) & 0xffff) == 0x2200 &&
970 	    (iicprobew(0x00) & 0xff00) == 0x0000) {
971 		name = "at30tse004";
972 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x1c68 &&
973 	    (iicprobew(0x07) & 0xffff) == 0x2201 &&
974 	    (iicprobew(0x00) & 0xff00) == 0x0000) {
975 		name = "gt30ts00";
976 	} else if ((addr & 0x78) == 0x18 && iicprobew(0x06) == 0x132d &&
977 	    (iicprobew(0x07) & 0xffff) == 0x3300 &&
978 	    (iicprobew(0x00) & 0x001f) == 0x001f) {
979 		name = "gt34ts02";
980 	} else if ((addr & 0x7e) == 0x1c && iicprobe(0x0f) == 0x3b &&
981 	    (iicprobe(0x21) & 0x60) == 0x00 &&
982 	    iicprobe(0x0f) == iicprobe(0x8f) &&	/* registers address is 7 bits */
983 	    iicprobe(0x20) == iicprobe(0xa0) &&
984 	    iicprobe(0x21) == iicprobe(0xa1) &&
985 	    iicprobe(0x22) == iicprobe(0xa2) &&
986 	    iicprobe(0x07) == 0x00) {		/* 0x00 to 0x0e are reserved */
987 		name = "lis331dl";
988 	} else if (name == NULL &&
989 	    (addr & 0x78) == 0x48) {		/* addr 0b1001xxx */
990 		name = lm75probe();
991 	}
992 #if 0
993 	/*
994 	 * XXX This probe needs to be improved; the driver does some
995 	 * dangerous writes.
996 	 */
997 	if (name == NULL && (addr & 0x7c) == 0x48 &&	/* addr 0b1001xxx */
998 	    (iicprobew(0xaa) & 0x0007) == 0x0000 &&
999 	    (iicprobew(0xa1) & 0x0007) == 0x0000 &&
1000 	    (iicprobew(0xa2) & 0x0007) == 0x0000 &&
1001 	    (iicprobe(0xac) & 0x10) == 0x00) {
1002 		if ((iicprobe(0xac) & 0x7e) == 0x0a &&
1003 		    iicprobe(0xab) == 0x00 && iicprobe(0xa8) == 0x00)
1004 			name = "ds1624";
1005 		else if ((iicprobe(0xac) & 0x7e) == 0x0c)
1006 			name = "ds1631";	/* terrible probe */
1007 		else if ((iicprobe(0xac) & 0x2e) == 0x2e)
1008 			name = "ds1721";	/* terrible probe */
1009 	}
1010 #endif
1011 	if (name == NULL && (addr & 0xf8) == 0x28 && iicprobe(0x48) == addr &&
1012 	    (iicprobe(0x00) & 0x90) == 0x10 && iicprobe(0x58) == 0x90) {
1013 		if (iicprobe(0x5b) == 0x12)
1014 			name = "it8712";
1015 		else if (iicprobe(0x5b) == 0x00)
1016 			name = "it8712f-a";		/* sis950 too */
1017 	}
1018 
1019 	if (name == NULL && iicprobe(0x48) == addr &&
1020 	    (iicprobe(0x40) & 0x80) == 0x00 && iicprobe(0x58) == 0xac)
1021 		name = "mtp008";
1022 
1023 	if (name == NULL) {
1024 		name = adm1032cloneprobe(addr);
1025 		if (name)
1026 			skip_fc = 1;
1027 	}
1028 
1029 	return (name);
1030 }
1031 
1032 char *
1033 iic_probe_eeprom(struct device *self, u_int8_t addr)
1034 {
1035 	u_int8_t type;
1036 	char *name = NULL;
1037 
1038 	type = iicprobe(0x02);
1039 	/* limit to SPD types seen in the wild */
1040 	if (type < 4 || type > 16)
1041 		return (name);
1042 
1043 	/* more matching in driver(s) */
1044 	name = "eeprom";
1045 
1046 	return (name);
1047 }
1048 
1049 void
1050 iic_scan(struct device *self, struct i2cbus_attach_args *iba)
1051 {
1052 	i2c_tag_t ic = iba->iba_tag;
1053 	struct i2c_attach_args ia;
1054 	struct iicprobelist *pl;
1055 	u_int8_t cmd = 0, addr;
1056 	char *name;
1057 	int i, j, k;
1058 
1059 	bzero(ignore_addrs, sizeof(ignore_addrs));
1060 
1061 	for (i = 0; probes[i].probe; i++) {
1062 #if NIPMI > 0
1063 		extern int ipmi_enabled;
1064 
1065 		if ((probes[i].flags & PFLAG_SENSOR) && ipmi_enabled) {
1066 			printf("%s: skipping sensors to avoid ipmi0 interactions\n",
1067 			    self->dv_xname);
1068 			continue;
1069 		}
1070 #endif
1071 		pl = probes[i].pl;
1072 		for (j = 0; pl[j].start && pl[j].end; j++) {
1073 			for (addr = pl[j].start; addr <= pl[j].end; addr++) {
1074 				for (k = 0; k < sizeof(ignore_addrs); k++)
1075 					if (ignore_addrs[k] == addr)
1076 						break;
1077 				if (k < sizeof(ignore_addrs))
1078 					continue;
1079 
1080 				/* Perform RECEIVE BYTE command */
1081 				iic_acquire_bus(ic, 0);
1082 				if (iic_exec(ic, I2C_OP_READ_WITH_STOP, addr,
1083 				    &cmd, sizeof cmd, NULL, 0, 0) == 0) {
1084 					iic_release_bus(ic, 0);
1085 
1086 					/* Some device exists */
1087 					iicprobeinit(iba, addr);
1088 					name = (*probes[i].probe)(self, addr);
1089 #ifndef I2C_VERBOSE
1090 					if (name == NULL)
1091 						name = "unknown";
1092 #endif /* !I2C_VERBOSE */
1093 					if (name) {
1094 						memset(&ia, 0, sizeof(ia));
1095 						ia.ia_tag = iba->iba_tag;
1096 						ia.ia_addr = addr;
1097 						ia.ia_size = 1;
1098 						ia.ia_name = name;
1099 						if (config_found(self,
1100 						    &ia, iic_print))
1101 							continue;
1102 					}
1103 #ifdef I2C_VERBOSE
1104 					if ((probes[i].flags & PFLAG_SENSOR))
1105 						iic_dump(self, addr, name);
1106 #endif /* I2C_VERBOSE */
1107 				} else
1108 					iic_release_bus(ic, 0);
1109 			}
1110 		}
1111 	}
1112 }
1113