Looks good to me.
On Fri, Oct 23, 2026, 17:31 Peter Maydell <[email protected]> wrote:
> In allwinner_h3_dramc_map_rows(), we take a row_bits count from a
> register, and calculate (1 << (row_bits - 3)). If the guest programs
> row_bits to less than 3 then this is undefined behaviour.
>
> Treat overly small row_bits values as "doesn't match actual RAM
> size".
>
> Fixes: b71d0385e97e ("hw/arm/allwinner-h3: add SDRAM controller device")
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4210
> Signed-off-by: Peter Maydell <[email protected]>
> ---
> hw/misc/allwinner-h3-dramc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/misc/allwinner-h3-dramc.c b/hw/misc/allwinner-h3-dramc.c
> index 10d929a3039..2a4b33aa182 100644
> --- a/hw/misc/allwinner-h3-dramc.c
> +++ b/hw/misc/allwinner-h3-dramc.c
> @@ -78,7 +78,7 @@ static void allwinner_h3_dramc_map_rows(AwH3DramCtlState
> *s, uint8_t row_bits,
> }
> }
>
> - if (s->ram_size == (1 << (row_bits - 3))) {
> + if (row_bits >= 3 && s->ram_size == (1 << (row_bits - 3))) {
> /* When row bits is the expected value, remove the mirror */
> memory_region_set_enabled(&s->row_mirror_alias, false);
> trace_allwinner_h3_dramc_rowmirror_disable();
> --
> 2.43.0
>
Reviewed-by: Strahinja Jankovic <[email protected]>
Best regards,
Strahinja
>
