From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:52784) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TvHKU-0003xe-IP for qemu-devel@nongnu.org; Tue, 15 Jan 2013 19:58:14 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TvHKT-0002SS-GB for qemu-devel@nongnu.org; Tue, 15 Jan 2013 19:58:10 -0500 Received: from mout.web.de ([212.227.17.11]:64223) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TvHKT-0002SJ-6U for qemu-devel@nongnu.org; Tue, 15 Jan 2013 19:58:09 -0500 From: =?UTF-8?q?Andreas=20F=C3=A4rber?= Date: Wed, 16 Jan 2013 01:57:56 +0100 Message-Id: <1358297879-26576-4-git-send-email-andreas.faerber@web.de> In-Reply-To: <1358297879-26576-1-git-send-email-andreas.faerber@web.de> References: <1358297879-26576-1-git-send-email-andreas.faerber@web.de> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] [PATCH for-1.4 v4 3/6] tmp105: Fix I2C protocol bug List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Alex Horn , =?UTF-8?q?Andreas=20F=C3=A4rber?= , anthony@codemonkey.ws An early length postincrement in the TMP105's I2C TX path led to transfers of more than one byte to place the second byte in the third byte's place within the buffer and the third byte to get discarded. Fix this by explictly incrementing the length after the checks but before the callback is called, which again checks the length. Adjust the Coding Style while at it. Signed-off-by: Alex Horn Signed-off-by: Andreas Färber Reviewed-by: Anthony Liguori --- hw/tmp105.c | 9 ++++++--- 1 Datei geändert, 6 Zeilen hinzugefügt(+), 3 Zeilen entfernt(-) diff --git a/hw/tmp105.c b/hw/tmp105.c index 0ade4eb..10d94c9 100644 --- a/hw/tmp105.c +++ b/hw/tmp105.c @@ -153,11 +153,14 @@ static int tmp105_tx(I2CSlave *i2c, uint8_t data) { TMP105State *s = (TMP105State *) i2c; - if (!s->len ++) + if (s->len == 0) { s->pointer = data; - else { - if (s->len <= 2) + s->len++; + } else { + if (s->len <= 2) { s->buf[s->len - 1] = data; + } + s->len++; tmp105_write(s); } -- 1.7.10.4