[PATCH] hw/timer/hpet: Detect invalid access to TN registers

[Zhao Liu <zhao1.liu@intel.com>]

"addr & 0x18" ignores invalid address, so that the trace in default
branch (trace_hpet_ram_{read|write}_invalid()) doesn't work.

Mask addr by "0x1f & ~4", in which 0x1f means to get the complete TN
registers access and ~4 means to keep any invalid address offset.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
---
 * Note: This patch applies the changes from Rust HPET [*] to C HPET to
   ensure logic consistency.
   [*]: The original comment should use "(0x1f & ~4)":
        https://lore.kernel.org/qemu-devel/Z6edKxYFzA6suDlj@intel.com/
---
 hw/timer/hpet.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
index dcff18a9871d..0f786047e54f 100644
--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
@@ -455,7 +455,7 @@ static uint64_t hpet_ram_read(void *opaque, hwaddr addr,
             return 0;
         }
 
-        switch (addr & 0x18) {
+        switch (addr & (0x1f & ~4)) {
         case HPET_TN_CFG: // including interrupt capabilities
             return timer->config >> shift;
         case HPET_TN_CMP: // comparator register
@@ -511,7 +511,8 @@ static void hpet_ram_write(void *opaque, hwaddr addr,
             trace_hpet_timer_id_out_of_range(timer_id);
             return;
         }
-        switch (addr & 0x18) {
+
+        switch (addr & (0x1f & ~4)) {
         case HPET_TN_CFG:
             trace_hpet_ram_write_tn_cfg(addr & 4);
             old_val = timer->config;
-- 
2.34.1