The commit 58229933 introduced a 1-shift for
some offset in DMA emulation.

Before the previous commit, which converted ioport_register_* to
MemoryRegion, the DMA controller registered 8 ioports with the following
formula:
base + ((8 + i) << d->shift) where 0 <= i < 8
When an IO occured within a Memory Region, DMA callback receives an
offset relative to the start address. Here the start address is:
base + (8 << d->shift).
The offset should be: (i << d->shift). After the shift is reverted, the
offsets are 0..7 not 1..8.

Fixes LP#1089996.
Reported-by: NAndreas Gustafsson <gson@gson.org>
Signed-off-by: NJulien Grall <julien.grall@citrix.com>
Tested-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>