hpet config mask fix

I discovered a bug in the hpet code that caused Windows to boot without hpet. The config mask I was using was preventing the guest from placing the hpet into 32 bit mode.

qemu/hw/hpet.c +4 -2

index 5c1aca2..7df2d05 100644
@@ -388,7 +388,8 @@ static void hpet_ram_writel(void *opaque, target_phys_addr_t addr,
         switch ((addr - 0x100) % 0x20) {
             case HPET_TN_CFG:
                 dprintf("qemu: hpet_ram_writel HPET_TN_CFG\n");
-                timer->config = hpet_fixup_reg(new_val, old_val, 0x3e4e);
+                timer->config = hpet_fixup_reg(new_val, old_val, 
+                                               HPET_TN_CFG_WRITE_MASK);
                 if (new_val & HPET_TN_32BIT) {
                     timer->cmp = (uint32_t)timer->cmp;
                     timer->period = (uint32_t)timer->period;

@@ -456,7 +457,8 @@ static void hpet_ram_writel(void *opaque, target_phys_addr_t addr,
             case HPET_ID:
                 return;
             case HPET_CFG:
-                s->config = hpet_fixup_reg(new_val, old_val, 0x3);
+                s->config = hpet_fixup_reg(new_val, old_val, 
+                                           HPET_CFG_WRITE_MASK);
                 if (activating_bit(old_val, new_val, HPET_CFG_ENABLE)) {
                     /* Enable main counter and interrupt generation. */
                     s->hpet_offset = ticks_to_ns(s->hpet_counter)

qemu/hw/hpet_emul.h +2 -0

index fbe7a44..60893b6 100644
@@ -36,6 +36,7 @@
 #define HPET_TN_CFG     0x000
 #define HPET_TN_CMP     0x008
 #define HPET_TN_ROUTE   0x010
+#define HPET_CFG_WRITE_MASK  0x3
 
 
 #define HPET_TN_ENABLE           0x004

@@ -45,6 +46,7 @@
 #define HPET_TN_SETVAL           0x040
 #define HPET_TN_32BIT            0x100
 #define HPET_TN_INT_ROUTE_MASK  0x3e00
+#define HPET_TN_CFG_WRITE_MASK  0x3f4e
 #define HPET_TN_INT_ROUTE_SHIFT      9
 #define HPET_TN_INT_ROUTE_CAP_SHIFT 32
 #define HPET_TN_CFG_BITS_READONLY_OR_RESERVED 0xffff80b1U