Merge tag 'pull-ufs-20240714' of https://gitlab.com/jeuk20.kim/qemu into staging

hw/ufs:
 - Fix invalid address access in mcq register check

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEUBfYMVl8eKPZB+73EuIgTA5dtgIFAmaTiKAACgkQEuIgTA5d
# tgKiAQ//fnlOsp22jEuM6Wf3372XvVWOZJ4IgxmkPNAvAhmzJdFZfx5Z4+k/uFdX
# xSYCXVAH56wQn5MVdyfFNjB9LxwQZzewky7c3kq6QWO8QPxVRoNbWkVqYZ0zlnmf
# HLBENR7sAjINKVa01yR5fkHh2zCX1dW99heY5KXlP4AynFP0QNikgsjhcrDPeDK8
# UWWFPVmx3SAWzTUbTdOJzQ38X25XzRid6xYN/rWAHZSJIsjukWm0nFo6rZkf2BZK
# fqpBqBe2maeeF3iw2BJKQ/KL7pyNJaqk7nXKG4oSBjsm11RU9Zb0Vl4CDRtZ8NJn
# p0v/RwH6E0sOq64r9dC/8QALB8dCl6vdN1WOLiUeT+ukAoUnrmCoIllAXC49gugd
# 68nyTagfHHogzFNW2QrJArsZO+IHzYDZRlSiLoW/PN8JIB9spu44D5HA/HVIQtBh
# 4f5DGl+emKbKiKwYoxm5qL8f5mHpc5PQ4OaoAkHpM/cfAe7o01SQ7doul5HPPApD
# +BnMjHYqv8kvCelNlLRb23MKe+YH7yRNFxWUfdrhj4uznM4fBVyTUC07VuK25m2B
# 9ShInmL1YnTyAbOLoBxwA8DV2dEv1jYXWuXyABTozlrPbWVVR7L4HLk9GLrwI5s+
# YHUa5KOoet8Jnxkh7QvMftPuWV0rTv0HM4m8Ko8GY01Sl7Q2Fos=
# =rxk1
# -----END PGP SIGNATURE-----
# gpg: Signature made Sun 14 Jul 2024 06:13:20 PM AEST
# gpg:                using RSA key 5017D831597C78A3D907EEF712E2204C0E5DB602
# gpg: Good signature from "Jeuk Kim <jeuk20.kim@samsung.com>" [unknown]
# gpg:                 aka "Jeuk Kim <jeuk20.kim@gmail.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 5017 D831 597C 78A3 D907  EEF7 12E2 204C 0E5D B602

* tag 'pull-ufs-20240714' of https://gitlab.com/jeuk20.kim/qemu:
  hw/ufs: Fix mcq register range check logic

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

hw/ufs/ufs.c

@@ -57,14 +57,26 @@ static inline uint64_t ufs_reg_size(UfsHc *u)
 
 static inline bool ufs_is_mcq_reg(UfsHc *u, uint64_t addr, unsigned size)
 {
-    uint64_t mcq_reg_addr = ufs_mcq_reg_addr(u, 0);
+    uint64_t mcq_reg_addr;
+
+    if (!u->params.mcq) {
+        return false;
+    }
+
+    mcq_reg_addr = ufs_mcq_reg_addr(u, 0);
     return (addr >= mcq_reg_addr &&
             addr + size <= mcq_reg_addr + sizeof(u->mcq_reg));
 }
 
 static inline bool ufs_is_mcq_op_reg(UfsHc *u, uint64_t addr, unsigned size)
 {
-    uint64_t mcq_op_reg_addr = ufs_mcq_op_reg_addr(u, 0);
+    uint64_t mcq_op_reg_addr;
+
+    if (!u->params.mcq) {
+        return false;
+    }
+
+    mcq_op_reg_addr = ufs_mcq_op_reg_addr(u, 0);
     return (addr >= mcq_op_reg_addr &&
             addr + size <= mcq_op_reg_addr + sizeof(u->mcq_op_reg));
 }