Merge tag 'pull-target-arm-20260713' of https://gitlab.com/pm215/qemu into staging

target-arm queue: * hw/misc/zynq_slcr.c: drop duplicate reset value for DDRIOB_DCI_CTRL * hw/arm/tegra241-cmdqv: Do not sync GERRORN on VCMDQ allocation * hw/arm/smmuv3: Sanitize fields provided by guest * hw/i2c: pmbus: clear output buffer on write * docs/system/arm: Add some missing FEAT_FOO we already implement * arm/virt: fix smmuv3_devices leak * target/arm: Be more defensive for invalid tlbi_aa64_get_range * hw/dma: don't allow weird transfer lengths for bcm2835 * hw/net/vmxnet3: Correct bounds check on tx queue index * hw/usb/dev-wacom: Don't write off end of buffer * hw/display/sm501: Don't let guest write off end of buffer * hw/misc/allwinner-r40-ccu.c: Correct handling of out of range accesses * hw/misc/stm32_rcc: Correct offset-to-irq calculation # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmpU09QZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3ksND/9RYq9Ki0OneG6XDcjWRRz9 # 9j6fEBFZlDTD9UsK+ypjD/gLkPqmYdBm9eAk5BBKXy1nAGOYrIQQKZcUOrpdVjey # 4HWUc2fUWqijSnyhHMrswgI/HarxZAZEBX6TcrVYyuuVwm/LIIlqfGg4R5M3JGgY # uEmexaCt4c/fIBLAbTmhzwQ4xDUKFceoB4GiI66gdNZQ6889xAu5JPYwmqK+ljnX # u98Y0UatBgTF3ya7TMHL1D5KkF9S7yzNQwYoh+WT654PfjUlAlsCQfdeqZ3rWAxZ # IFvpOjljAbrohXqeKGqf5+ShX6Tmb2Xd9sHBiWwbZhQ4NMOGfoAhTdtmYAUNOS+T # aolThLAliOf5cvXM3yrXCfYrJiDTbvlkWxOInFYk61iKCzDMm7Yb/jcrS0xr6l50 # rhrOh/ydJtJIa31Dz2wvk+22Q84ZqyBy+1RTJ1thlAxycQ8o3a35mSiAUGwzcI98 # 6VTw4gOWaKiOqpbaPvv1ofEkhDWcIUGJK6k9JdVNuCppL7BGfbJXqkKSBqxjExqn # G3A3QdWF6Ko/7US23gaMk4GO5k9ELSDZKiysnQUs4zs1r+nr21e8hsFfKyOYJ/nq # l+0TSzCHkpYEGRyO1AsCWDrw7b8mIvF6ty5RmE7e6B/W+WmsectLDnnlX6rTxYSU # BGQivwgrfdDWRsVGXTr1Lw== # =E6wg # -----END PGP SIGNATURE----- # gpg: Signature made Mon 13 Jul 2026 13:02:28 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20260713' of https://gitlab.com/pm215/qemu: (26 commits) hw/misc/stm32_rcc: Correct offset-to-irq calculation hw/misc/allwinner-r40-ccu.c: Correct handling of out of range accesses hw/display/sm501: Don't allow guest to set ram size larger than it is hw/display/sm501: Avoid overflow problems in bounds check calculations hw/display/sm501: Catch bad coordinates for RTL operations hw/usb/dev-wacom: Don't write off end of buffer hw/net/vmxnet3: Correct bounds check on tx queue index hw/dma: don't allow weird transfer lengths for bcm2835 target/arm: Be more defensive for invalid tlbi_aa64_get_range arm/virt: fix smmuv3_devices leak docs/system: add FEAT_HAF docs/system: add FEAT_S2TGran[4|16|64]K features docs/system: fix sorting of FEAT_S2[PIE|FWB] docs/system: document FEAT_IVIPT docs/system: document FEAT_MTE4 docs/system: document FEAT_Secure docs/system: add big and little endian features names docs/system: declare support for FEAT_EVT2 hw/i2c: pmbus: clear output buffer on write hw/arm/smmuv3: Enforce alignment of L2Ptr according to the span ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>