Thinking more...

AD71471 的 Device address 是 0x58，Linux driver 在處理這個時，其實會自行左移一位，因此，在 I2C_SLAVE_FORCE 的 ioctl 裡，應該是要傳 0x2c。這邊因為我暈頭，把 0x58>>1 算成 0x4c，導致我搞了好一陣子，直到 M 同事指正以後，才弄對。

再來，AD71471 在做讀寫時，Register address 與 data 都是 2 bytes，而 i2ctools 裡，處理 Register address 都只傳 1 byte(I2C_SMBUS)，因此不適用在 AD71471 上。我把 Linux kernel i2c-core.c 裡的 code 翻出來改寫，改用 I2C_RDWR 來處理：

bool Write( uint16_t address, uint16_t value ) {
 int res=0;
 struct i2c_rdwr_ioctl_data msg_rdwr;
 char msgbuf0[I2C_SMBUS_BLOCK_MAX+4];
 char msgbuf1[I2C_SMBUS_BLOCK_MAX+2];
 struct i2c_msg msg[1] = { { _address, 0, 4, msgbuf0 } };
 uint8_t* pAddr = (uint8_t*)&address;
 uint8_t* pValue = (uint8_t*)&value;

 msg_rdwr.msgs = &msg[0];
 msg_rdwr.nmsgs = 1; // write // read = 2

 // 因為 little endian，所以要作調整
 msgbuf0[0] = *(pAddr+1);
 msgbuf0[1] = *(pAddr+0);
 msgbuf0[2] = *(pValue+1); // (1)
 msgbuf0[3] = *(pValue+0);

 res = ioctl( _file, I2C_RDWR, &msg_rdwr );
 usleep(10000);

 return true;
}
bool Read( uint16_t address, uint16_t& data ) {
 int res=0;
 struct i2c_rdwr_ioctl_data msg_rdwr;
 char msgbuf0[I2C_SMBUS_BLOCK_MAX+2];
 char msgbuf1[I2C_SMBUS_BLOCK_MAX+2]={0};
 struct i2c_msg msg[2] = { { _address, 0, 2, msgbuf0 },
                           { _address, I2C_M_RD, 2, msgbuf1 }
                         };
 uint8_t* pAddr = (uint8_t*)&address;

 msg_rdwr.msgs = &msg[0];
 msg_rdwr.nmsgs = 1; // read = 2
 // 因為 little endian，所以要作調整
 msgbuf0[0] = *(pAddr+1);
 msgbuf0[1] = *(pAddr+0);
 res = ioctl( _file, I2C_RDWR, &msg_rdwr );
 usleep(10000);

 msg_rdwr.msgs = &msg[1];
 msg_rdwr.nmsgs = 1; // read = 2
 res = ioctl( _file, I2C_RDWR, &msg_rdwr ); #ifdef DEBUG
 data = msgbuf1[0] | (msgbuf1[1] << 8);

 return true;
}
int main( int argc, char* argv[] )
{
 int data=0;

 Read( 0x17, data );
 printf("data=%d\n", data );

 // 這邊其實不好，實際上寫 0x0052會比較清楚，這邊必須寫 0x5200，因為我在 Write() 裡有作對調，參看(1)
 Write( 0x00, 0x5200 );  
}