Commit 0844faa204 for qemu.org

commit 0844faa2043a5541db991ab6200e5a3253d82b80
Author: Peter Maydell <peter.maydell@linaro.org>
Date:   Fri Oct 23 16:31:50 2026 +0100

    hw/misc/allwinner-h3-dramc: Avoid shift by negative amount

    In allwinner_h3_dramc_map_rows(), we take a row_bits count from a
    register, and calculate (1 << (row_bits - 3)).  If the guest programs
    row_bits to less than 3 then this is undefined behaviour.

    Treat overly small row_bits values as "doesn't match actual RAM
    size".

    Fixes: b71d0385e97e ("hw/arm/allwinner-h3: add SDRAM controller device")
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4210
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
    Reviewed-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
    Message-ID: <20261023153150.1710372-1-peter.maydell@linaro.org>
    Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

diff --git a/hw/misc/allwinner-h3-dramc.c b/hw/misc/allwinner-h3-dramc.c
index 10d929a303..2a4b33aa18 100644
--- a/hw/misc/allwinner-h3-dramc.c
+++ b/hw/misc/allwinner-h3-dramc.c
@@ -78,7 +78,7 @@ static void allwinner_h3_dramc_map_rows(AwH3DramCtlState *s, uint8_t row_bits,
         }
     }

-    if (s->ram_size == (1 << (row_bits - 3))) {
+    if (row_bits >= 3 && s->ram_size == (1 << (row_bits - 3))) {
         /* When row bits is the expected value, remove the mirror */
         memory_region_set_enabled(&s->row_mirror_alias, false);
         trace_allwinner_h3_dramc_rowmirror_disable();