Hi; here's an arm pullreq. These are all bugfixes and minor docs updates.

thanks
-- PMM

The following changes since commit 499039798cdad7d86b787fec0eaf1da4151c0f05:

  Merge tag 'pull-request-2026-07-12' of https://gitlab.com/huth/qemu into staging (2026-07-12 21:49:04 +0200)

are available in the Git repository at:

  https://gitlab.com/pm215/qemu.git tags/pull-target-arm-20260713

for you to fetch changes up to 3c2749443429a2a6b60bfa5c32964628631dfa23:

  hw/misc/stm32_rcc: Correct offset-to-irq calculation (2026-07-13 12:34:17 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/misc/zynq_slcr.c: drop duplicate reset value for DDRIOB_DCI_CTRL
 * hw/arm/tegra241-cmdqv: Do not sync GERRORN on VCMDQ allocation
 * hw/arm/smmuv3: Sanitize fields provided by guest
 * hw/i2c: pmbus: clear output buffer on write
 * docs/system/arm: Add some missing FEAT_FOO we already implement
 * arm/virt: fix smmuv3_devices leak
 * target/arm: Be more defensive for invalid tlbi_aa64_get_range
 * hw/dma: don't allow weird transfer lengths for bcm2835
 * hw/net/vmxnet3: Correct bounds check on tx queue index
 * hw/usb/dev-wacom: Don't write off end of buffer
 * hw/display/sm501: Don't let guest write off end of buffer
 * hw/misc/allwinner-r40-ccu.c: Correct handling of out of range accesses
 * hw/misc/stm32_rcc: Correct offset-to-irq calculation

----------------------------------------------------------------
Alex Bennée (9):
      docs/system: declare support for FEAT_EVT2
      docs/system: add big and little endian features names
      docs/system: document FEAT_Secure
      docs/system: document FEAT_MTE4
      docs/system: document FEAT_IVIPT
      docs/system: fix sorting of FEAT_S2[PIE|FWB]
      docs/system: add FEAT_S2TGran[4|16|64]K features
      docs/system: add FEAT_HAF
      hw/dma: don't allow weird transfer lengths for bcm2835

Corvin Köhne (1):
      hw/misc/zynq_slcr.c: drop duplicate reset value for DDRIOB_DCI_CTRL

Eric Auger (5):
      hw/arm/smmuv3: Fix off-by-one bug in alignment strtab mask
      hw/arm/smmuv3: Sanitize SMMU_S_STRTAB_BASE_CFG.SPLIT
      hw/arm/smmuv3: Fix possible overflow in strtab_base computation
      hw/arm/smmuv3: Check L1STD.SPAN
      hw/arm/smmuv3: Enforce alignment of L2Ptr according to the span

Marc-André Lureau (1):
      arm/virt: fix smmuv3_devices leak

Peter Maydell (7):
      hw/net/vmxnet3: Correct bounds check on tx queue index
      hw/usb/dev-wacom: Don't write off end of buffer
      hw/display/sm501: Catch bad coordinates for RTL operations
      hw/display/sm501: Avoid overflow problems in bounds check calculations
      hw/display/sm501: Don't allow guest to set ram size larger than it is
      hw/misc/allwinner-r40-ccu.c: Correct handling of out of range accesses
      hw/misc/stm32_rcc: Correct offset-to-irq calculation

Richard Henderson (1):
      target/arm: Be more defensive for invalid tlbi_aa64_get_range

Shameer Kolothum (1):
      hw/arm/tegra241-cmdqv: Do not sync GERRORN on VCMDQ allocation

titusr (1):
      hw/i2c: pmbus: clear output buffer on write

 docs/system/arm/emulation.rst | 14 +++++++++-
 hw/arm/smmuv3-internal.h      |  3 ++
 hw/arm/smmuv3.c               | 32 ++++++++++++++++++----
 hw/arm/tegra241-cmdqv.c       |  7 ++---
 hw/arm/virt.c                 |  1 +
 hw/display/sm501.c            | 64 +++++++++++++++++++++++++++++++++++++------
 hw/dma/bcm2835_dma.c          | 17 ++++++++++++
 hw/i2c/pmbus_device.c         | 10 +++++++
 hw/misc/allwinner-r40-ccu.c   |  6 ++--
 hw/misc/stm32_rcc.c           | 31 ++++++++++++++++++---
 hw/misc/zynq_slcr.c           |  1 -
 hw/net/vmxnet3.c              |  2 +-
 hw/usb/dev-wacom.c            |  4 +++
 include/hw/misc/stm32_rcc.h   |  6 +++-
 target/arm/cpu-max.c          |  2 +-
 target/arm/tcg/tlb-insns.c    |  2 +-
 tests/qtest/adm1266-test.c    | 10 ++++---
 17 files changed, 176 insertions(+), 36 deletions(-)

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.