commit 6da67de6803e93cbb7e93ac3497865832f8c00ea
author Ladi Prosek <lprosek@redhat.com> Thu Jan 26 15:22:37 2017 +0100
committer Paolo Bonzini <pbonzini@redhat.com> Fri Jan 27 18:08:00 2017 +0100
tree b2c3d76a34f230b34c012482cc7f7c189f5f97f3
parent 777357d758d937c9dd83082c39aff9f1e53e9ba3

memory: don't sign-extend 32-bit writes

ldl_p has a signed return type so assigning it to uint64_t implicitly
sign-extends the value. This results in devices with min_access_size = 8
seeing unexpected values passed to their write handlers.

Example: guest performs a 32-bit write of 0x80000000 to an mmio region
and the handler receives 0xFFFFFFFF80000000 in its value argument.

Signed-off-by: Ladi Prosek <lprosek@redhat.com>
Message-Id: <1485440557-10384-1-git-send-email-lprosek@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

exec.c

diff --git a/exec.c b/exec.c
index f2bed92..b05c5d2 100644
--- a/exec.c
+++ b/exec.c
@@ -2630,7 +2630,7 @@
                 break;
             case 4:
                 /* 32 bit write access */
-                val = ldl_p(buf);
+                val = (uint32_t)ldl_p(buf);
                 result |= memory_region_dispatch_write(mr, addr1, val, 4,
                                                        attrs);
                 break;