From babf848b825fb3dcbbc8e8f64b406757e5b4bb83 Mon Sep 17 00:00:00 2001
From: Ladi Prosek <lprosek@redhat.com>
Date: Fri, 2 Mar 2018 00:00:13 -0500
Subject: [PATCH] memory: don't sign-extend 32-bit writes

ldl_p has a signed return type so assigning it to uint64_t implicitly
sign-extends the value. This results in devices with min_access_size = 8
seeing unexpected values passed to their write handlers.

Example: guest performs a 32-bit write of 0x80000000 to an mmio region
and the handler receives 0xFFFFFFFF80000000 in its value argument.

Backports commit 6da67de6803e93cbb7e93ac3497865832f8c00ea from qemu
---
 qemu/exec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qemu/exec.c b/qemu/exec.c
index d8cc07c6..7b071766 100644
--- a/qemu/exec.c
+++ b/qemu/exec.c
@@ -2026,7 +2026,7 @@ static MemTxResult address_space_write_continue(AddressSpace *as, hwaddr addr,
                 break;
             case 4:
                 /* 32 bit write access */
-                val = ldl_p(buf);
+                val = (uint32_t)ldl_p(buf);
                 result |= memory_region_dispatch_write(mr, addr1, val, 4,
                                                        attrs);
                 break;