memory: fix rom_device I/O mode

When adding a rom_device in I/O mode, we incorrectly masked off the low
bits, resulting in a pure RAM map.  Fix my masking off the high bits and
IO_MEM_ROMD, yielding a pure I/O map.

Signed-off-by: Avi Kivity <avi@redhat.com>
diff --git a/memory.c b/memory.c
index 1491a39..eb31fa8 100644
--- a/memory.c
+++ b/memory.c
@@ -304,7 +304,7 @@
     }
 
     if (!fr->readable) {
-        phys_offset &= TARGET_PAGE_MASK;
+        phys_offset &= ~TARGET_PAGE_MASK & ~IO_MEM_ROMD;
     }
 
     cpu_register_physical_memory_log(fr->addr.start,