tmp105: Fix I2C protocol bug

An early length postincrement in the TMP105's I2C TX path led to
transfers of more than one byte to place the second byte in the third
byte's place within the buffer and the third byte to get discarded.

Fix this by explictly incrementing the length after the checks but
before the callback is called, which again checks the length.

Adjust the Coding Style while at it.

Signed-off-by: Alex Horn <[email protected]>
Signed-off-by: Andreas Färber <[email protected]>
Reviewed-by: Anthony Liguori <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

diff --git a/hw/tmp105.c b/hw/tmp105.c
index 0ade4eb6bd9766d7d0fffff3d14747e8c2971e36..10d94c903ca4208773606bac5749fc2a7e677219 100644 (file)
--- a/hw/tmp105.c
+++ b/hw/tmp105.c
@@ -153,11 +153,14 @@ static int tmp105_tx(I2CSlave *i2c, uint8_t data)
 {
     TMP105State *s = (TMP105State *) i2c;
 
-    if (!s->len ++)
+    if (s->len == 0) {
         s->pointer = data;
-    else {
-        if (s->len <= 2)
+        s->len++;
+    } else {
+        if (s->len <= 2) {
             s->buf[s->len - 1] = data;
+        }
+        s->len++;
         tmp105_write(s);
     }