From 6da67de6803e93cbb7e93ac3497865832f8c00ea Mon Sep 17 00:00:00 2001 From: Ladi Prosek Date: Thu, 26 Jan 2017 15:22:37 +0100 Subject: [PATCH] memory: don't sign-extend 32-bit writes ldl_p has a signed return type so assigning it to uint64_t implicitly sign-extends the value. This results in devices with min_access_size = 8 seeing unexpected values passed to their write handlers. Example: guest performs a 32-bit write of 0x80000000 to an mmio region and the handler receives 0xFFFFFFFF80000000 in its value argument. Signed-off-by: Ladi Prosek Message-Id: <1485440557-10384-1-git-send-email-lprosek@redhat.com> Signed-off-by: Paolo Bonzini --- exec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/exec.c b/exec.c index f2bed92b64..b05c5d2d74 100644 --- a/exec.c +++ b/exec.c @@ -2630,7 +2630,7 @@ static MemTxResult address_space_write_continue(AddressSpace *as, hwaddr addr, break; case 4: /* 32 bit write access */ - val = ldl_p(buf); + val = (uint32_t)ldl_p(buf); result |= memory_region_dispatch_write(mr, addr1, val, 4, attrs); break; -- GitLab