esp: check command buffer length before write(CVE-2016-4439)
[qemu/ar7.git] / tests / tmp105-test.c
blob235cae0137cbc02739ef4ae72762fbfff3e7ff54
1 /*
2 * QTest testcase for the TMP105 temperature sensor
4 * Copyright (c) 2012 Andreas Färber
6 * This work is licensed under the terms of the GNU GPL, version 2 or later.
7 * See the COPYING file in the top-level directory.
8 */
10 #include "qemu/osdep.h"
11 #include <glib.h>
13 #include "libqtest.h"
14 #include "libqos/i2c.h"
15 #include "hw/misc/tmp105_regs.h"
17 #define OMAP2_I2C_1_BASE 0x48070000
19 #define TMP105_TEST_ID "tmp105-test"
20 #define TMP105_TEST_ADDR 0x49
22 static I2CAdapter *i2c;
24 static uint16_t tmp105_get8(I2CAdapter *i2c, uint8_t addr, uint8_t reg)
26 uint8_t resp[1];
27 i2c_send(i2c, addr, &reg, 1);
28 i2c_recv(i2c, addr, resp, 1);
29 return resp[0];
32 static uint16_t tmp105_get16(I2CAdapter *i2c, uint8_t addr, uint8_t reg)
34 uint8_t resp[2];
35 i2c_send(i2c, addr, &reg, 1);
36 i2c_recv(i2c, addr, resp, 2);
37 return (resp[0] << 8) | resp[1];
40 static void tmp105_set8(I2CAdapter *i2c, uint8_t addr, uint8_t reg,
41 uint8_t value)
43 uint8_t cmd[2];
44 uint8_t resp[1];
46 cmd[0] = reg;
47 cmd[1] = value;
48 i2c_send(i2c, addr, cmd, 2);
49 i2c_recv(i2c, addr, resp, 1);
50 g_assert_cmphex(resp[0], ==, cmd[1]);
53 static void tmp105_set16(I2CAdapter *i2c, uint8_t addr, uint8_t reg,
54 uint16_t value)
56 uint8_t cmd[3];
57 uint8_t resp[2];
59 cmd[0] = reg;
60 cmd[1] = value >> 8;
61 cmd[2] = value & 255;
62 i2c_send(i2c, addr, cmd, 3);
63 i2c_recv(i2c, addr, resp, 2);
64 g_assert_cmphex(resp[0], ==, cmd[1]);
65 g_assert_cmphex(resp[1], ==, cmd[2]);
68 static int qmp_tmp105_get_temperature(const char *id)
70 QDict *response;
71 int ret;
73 response = qmp("{ 'execute': 'qom-get', 'arguments': { 'path': %s, "
74 "'property': 'temperature' } }", id);
75 g_assert(qdict_haskey(response, "return"));
76 ret = qdict_get_int(response, "return");
77 QDECREF(response);
78 return ret;
81 static void qmp_tmp105_set_temperature(const char *id, int value)
83 QDict *response;
85 response = qmp("{ 'execute': 'qom-set', 'arguments': { 'path': %s, "
86 "'property': 'temperature', 'value': %d } }", id, value);
87 g_assert(qdict_haskey(response, "return"));
88 QDECREF(response);
91 #define TMP105_PRECISION (1000/16)
92 static void send_and_receive(void)
94 uint16_t value;
96 value = qmp_tmp105_get_temperature(TMP105_TEST_ID);
97 g_assert_cmpuint(value, ==, 0);
99 value = tmp105_get16(i2c, TMP105_TEST_ADDR, TMP105_REG_TEMPERATURE);
100 g_assert_cmphex(value, ==, 0);
102 qmp_tmp105_set_temperature(TMP105_TEST_ID, 20000);
103 value = qmp_tmp105_get_temperature(TMP105_TEST_ID);
104 g_assert_cmpuint(value, ==, 20000);
106 value = tmp105_get16(i2c, TMP105_TEST_ADDR, TMP105_REG_TEMPERATURE);
107 g_assert_cmphex(value, ==, 0x1400);
109 qmp_tmp105_set_temperature(TMP105_TEST_ID, 20938); /* 20 + 15/16 */
110 value = qmp_tmp105_get_temperature(TMP105_TEST_ID);
111 g_assert_cmpuint(value, >=, 20938 - TMP105_PRECISION/2);
112 g_assert_cmpuint(value, <, 20938 + TMP105_PRECISION/2);
114 /* Set config */
115 tmp105_set8(i2c, TMP105_TEST_ADDR, TMP105_REG_CONFIG, 0x60);
116 value = tmp105_get8(i2c, TMP105_TEST_ADDR, TMP105_REG_CONFIG);
117 g_assert_cmphex(value, ==, 0x60);
119 value = tmp105_get16(i2c, TMP105_TEST_ADDR, TMP105_REG_TEMPERATURE);
120 g_assert_cmphex(value, ==, 0x14f0);
122 /* Set precision to 9, 10, 11 bits. */
123 tmp105_set8(i2c, TMP105_TEST_ADDR, TMP105_REG_CONFIG, 0x00);
124 value = tmp105_get16(i2c, TMP105_TEST_ADDR, TMP105_REG_TEMPERATURE);
125 g_assert_cmphex(value, ==, 0x1480);
127 tmp105_set8(i2c, TMP105_TEST_ADDR, TMP105_REG_CONFIG, 0x20);
128 value = tmp105_get16(i2c, TMP105_TEST_ADDR, TMP105_REG_TEMPERATURE);
129 g_assert_cmphex(value, ==, 0x14c0);
131 tmp105_set8(i2c, TMP105_TEST_ADDR, TMP105_REG_CONFIG, 0x40);
132 value = tmp105_get16(i2c, TMP105_TEST_ADDR, TMP105_REG_TEMPERATURE);
133 g_assert_cmphex(value, ==, 0x14e0);
135 /* stored precision remains the same */
136 value = qmp_tmp105_get_temperature(TMP105_TEST_ID);
137 g_assert_cmpuint(value, >=, 20938 - TMP105_PRECISION/2);
138 g_assert_cmpuint(value, <, 20938 + TMP105_PRECISION/2);
140 tmp105_set8(i2c, TMP105_TEST_ADDR, TMP105_REG_CONFIG, 0x60);
141 value = tmp105_get16(i2c, TMP105_TEST_ADDR, TMP105_REG_TEMPERATURE);
142 g_assert_cmphex(value, ==, 0x14f0);
144 tmp105_set16(i2c, TMP105_TEST_ADDR, TMP105_REG_T_LOW, 0x1234);
145 tmp105_set16(i2c, TMP105_TEST_ADDR, TMP105_REG_T_HIGH, 0x4231);
148 int main(int argc, char **argv)
150 QTestState *s = NULL;
151 int ret;
153 g_test_init(&argc, &argv, NULL);
155 s = qtest_start("-machine n800 "
156 "-device tmp105,bus=i2c-bus.0,id=" TMP105_TEST_ID
157 ",address=0x49");
158 i2c = omap_i2c_create(OMAP2_I2C_1_BASE);
160 qtest_add_func("/tmp105/tx-rx", send_and_receive);
162 ret = g_test_run();
164 if (s) {
165 qtest_quit(s);
167 g_free(i2c);
169 return ret;