Fix 32-bit overflow in parallels image support
[qemu-kvm/fedora.git] / hw / tmp105.c
blobc9756c5e96722169b6b29e2eb272c6c00577b36c
1 /*
2 * Texas Instruments TMP105 temperature sensor.
4 * Copyright (C) 2008 Nokia Corporation
5 * Written by Andrzej Zaborowski <andrew@openedhand.com>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License as
9 * published by the Free Software Foundation; either version 2 or
10 * (at your option) version 3 of the License.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License along
18 * with this program; if not, see <http://www.gnu.org/licenses/>.
21 #include "hw.h"
22 #include "i2c.h"
24 typedef struct {
25 i2c_slave i2c;
26 int len;
27 uint8_t buf[2];
28 qemu_irq pin;
30 uint8_t pointer;
31 uint8_t config;
32 int16_t temperature;
33 int16_t limit[2];
34 int faults;
35 int alarm;
36 } TMP105State;
38 static void tmp105_interrupt_update(TMP105State *s)
40 qemu_set_irq(s->pin, s->alarm ^ ((~s->config >> 2) & 1)); /* POL */
43 static void tmp105_alarm_update(TMP105State *s)
45 if ((s->config >> 0) & 1) { /* SD */
46 if ((s->config >> 7) & 1) /* OS */
47 s->config &= ~(1 << 7); /* OS */
48 else
49 return;
52 if ((s->config >> 1) & 1) { /* TM */
53 if (s->temperature >= s->limit[1])
54 s->alarm = 1;
55 else if (s->temperature < s->limit[0])
56 s->alarm = 1;
57 } else {
58 if (s->temperature >= s->limit[1])
59 s->alarm = 1;
60 else if (s->temperature < s->limit[0])
61 s->alarm = 0;
64 tmp105_interrupt_update(s);
67 /* Units are 0.001 centigrades relative to 0 C. */
68 void tmp105_set(i2c_slave *i2c, int temp)
70 TMP105State *s = (TMP105State *) i2c;
72 if (temp >= 128000 || temp < -128000) {
73 fprintf(stderr, "%s: values is out of range (%i.%03i C)\n",
74 __FUNCTION__, temp / 1000, temp % 1000);
75 exit(-1);
78 s->temperature = ((int16_t) (temp * 0x800 / 128000)) << 4;
80 tmp105_alarm_update(s);
83 static const int tmp105_faultq[4] = { 1, 2, 4, 6 };
85 static void tmp105_read(TMP105State *s)
87 s->len = 0;
89 if ((s->config >> 1) & 1) { /* TM */
90 s->alarm = 0;
91 tmp105_interrupt_update(s);
94 switch (s->pointer & 3) {
95 case 0: /* Temperature */
96 s->buf[s->len ++] = (((uint16_t) s->temperature) >> 8);
97 s->buf[s->len ++] = (((uint16_t) s->temperature) >> 0) &
98 (0xf0 << ((~s->config >> 5) & 3)); /* R */
99 break;
101 case 1: /* Configuration */
102 s->buf[s->len ++] = s->config;
103 break;
105 case 2: /* T_LOW */
106 s->buf[s->len ++] = ((uint16_t) s->limit[0]) >> 8;
107 s->buf[s->len ++] = ((uint16_t) s->limit[0]) >> 0;
108 break;
110 case 3: /* T_HIGH */
111 s->buf[s->len ++] = ((uint16_t) s->limit[1]) >> 8;
112 s->buf[s->len ++] = ((uint16_t) s->limit[1]) >> 0;
113 break;
117 static void tmp105_write(TMP105State *s)
119 switch (s->pointer & 3) {
120 case 0: /* Temperature */
121 break;
123 case 1: /* Configuration */
124 if (s->buf[0] & ~s->config & (1 << 0)) /* SD */
125 printf("%s: TMP105 shutdown\n", __FUNCTION__);
126 s->config = s->buf[0];
127 s->faults = tmp105_faultq[(s->config >> 3) & 3]; /* F */
128 tmp105_alarm_update(s);
129 break;
131 case 2: /* T_LOW */
132 case 3: /* T_HIGH */
133 if (s->len >= 3)
134 s->limit[s->pointer & 1] = (int16_t)
135 ((((uint16_t) s->buf[0]) << 8) | s->buf[1]);
136 tmp105_alarm_update(s);
137 break;
141 static int tmp105_rx(i2c_slave *i2c)
143 TMP105State *s = (TMP105State *) i2c;
145 if (s->len < 2)
146 return s->buf[s->len ++];
147 else
148 return 0xff;
151 static int tmp105_tx(i2c_slave *i2c, uint8_t data)
153 TMP105State *s = (TMP105State *) i2c;
155 if (!s->len ++)
156 s->pointer = data;
157 else {
158 if (s->len <= 2)
159 s->buf[s->len - 1] = data;
160 tmp105_write(s);
163 return 0;
166 static void tmp105_event(i2c_slave *i2c, enum i2c_event event)
168 TMP105State *s = (TMP105State *) i2c;
170 if (event == I2C_START_RECV)
171 tmp105_read(s);
173 s->len = 0;
176 static void tmp105_save(QEMUFile *f, void *opaque)
178 TMP105State *s = (TMP105State *) opaque;
180 qemu_put_byte(f, s->len);
181 qemu_put_8s(f, &s->buf[0]);
182 qemu_put_8s(f, &s->buf[1]);
184 qemu_put_8s(f, &s->pointer);
185 qemu_put_8s(f, &s->config);
186 qemu_put_sbe16s(f, &s->temperature);
187 qemu_put_sbe16s(f, &s->limit[0]);
188 qemu_put_sbe16s(f, &s->limit[1]);
189 qemu_put_byte(f, s->alarm);
190 s->faults = tmp105_faultq[(s->config >> 3) & 3]; /* F */
192 i2c_slave_save(f, &s->i2c);
195 static int tmp105_load(QEMUFile *f, void *opaque, int version_id)
197 TMP105State *s = (TMP105State *) opaque;
199 s->len = qemu_get_byte(f);
200 qemu_get_8s(f, &s->buf[0]);
201 qemu_get_8s(f, &s->buf[1]);
203 qemu_get_8s(f, &s->pointer);
204 qemu_get_8s(f, &s->config);
205 qemu_get_sbe16s(f, &s->temperature);
206 qemu_get_sbe16s(f, &s->limit[0]);
207 qemu_get_sbe16s(f, &s->limit[1]);
208 s->alarm = qemu_get_byte(f);
210 tmp105_interrupt_update(s);
212 i2c_slave_load(f, &s->i2c);
213 return 0;
216 static void tmp105_reset(i2c_slave *i2c)
218 TMP105State *s = (TMP105State *) i2c;
220 s->temperature = 0;
221 s->pointer = 0;
222 s->config = 0;
223 s->faults = tmp105_faultq[(s->config >> 3) & 3];
224 s->alarm = 0;
226 tmp105_interrupt_update(s);
229 static void tmp105_init(i2c_slave *i2c)
231 TMP105State *s = FROM_I2C_SLAVE(TMP105State, i2c);
233 qdev_init_gpio_out(&i2c->qdev, &s->pin, 1);
235 tmp105_reset(&s->i2c);
237 register_savevm("TMP105", -1, 0, tmp105_save, tmp105_load, s);
240 static I2CSlaveInfo tmp105_info = {
241 .qdev.name = "tmp105",
242 .qdev.size = sizeof(TMP105State),
243 .init = tmp105_init,
244 .event = tmp105_event,
245 .recv = tmp105_rx,
246 .send = tmp105_tx
249 static void tmp105_register_devices(void)
251 i2c_register_slave(&tmp105_info);
254 device_init(tmp105_register_devices)