Merge tag 'pull-target-arm-20251031' of https://gitlab.com/pm215/qemu into staging

target-arm queue:
 *  hw/gpio/pl061: Declare pullups/pulldowns as 8-bit types
 * docs/system/arm/virt: Document user-creatable SMMUv3
 * docs/system/security: Restrict "virtualization use case" to specific machines
 * target/arm: Add assert to arm_to_core_mmu_idx()
 * hw/arm/virt: remove deprecated virt-4.1 and virt-4.2 machine types
 * hvf: Refactorings and cleanups

# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmkFAKcZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3oSZD/0ekFlrMRFZCYg7ie9t/Cgz
# 7OBZGjK+WfuKsD9odYesZzxJ+aPMBQHu6l/44cYaqf+NTRM2hI9ZeaV9e4fXPG0e
# fYImjYMLKPHj4UTam42uN0btl3poq+oaVPKqDPovy+9E09NctO4fmTl7Zys6pH/1
# EwznCk1x3+JLW0xPXXEvfTniB1nB+hvKA/n7NS0qe6n2ddenhQzG8DpdnGEGB+75
# whMwhE/UJ5Y8rP6/Nfc8XqzgU6fmEpPsDRHjDCULy/CiGCV6k8/C8J94UTf2SExh
# iiMLySUb2Rv6qIL2nJX2+xup79UB7umxxoIL0eeN1U/M1L7zMB64rlcU/cym2I40
# mAFuW2qzdsADnpRP8d4KTMJQmFxtZuKuxpkapvIFuusiKq5vBwTxfzyLWdM6nPI9
# 7tbKImzLxC1mnOAT0QeZYhLrWMZgQi3tBcS852JAXpiW1eT7SWsl59bKNgCVzI7r
# malptTniE1G+F4VWlghApLympBhNMMaFBfY4XBQ+VxEu+JNhO+MQlJhcLVbqX+oY
# m2OQhPHRv2YUM2VGv40JuzaUE1cXHXNsC7s9hHsB/3UwIp3fXOsdGuq6KviHdcbP
# moQn3M8S/vdFB+1spkhVxS7xgIZJo9f2kaTe9VlpEY7/k5n36BTsxPN6Uae2gIVq
# w4qzOjXFEyeIxLLKQZqyZg==
# =9IV+
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 31 Oct 2025 07:32:07 PM CET
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [unknown]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [unknown]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [unknown]
# gpg:                 aka "Peter Maydell <peter@archaic.org.uk>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* tag 'pull-target-arm-20251031' of https://gitlab.com/pm215/qemu: (38 commits)
  accel/hvf: Trace prefetch abort
  target/arm/hvf/hvf: Document $pc adjustment in HVF & SMC
  target/arm: Share ARM_PSCI_CALL trace event between TCG and HVF
  target/arm: Re-use arm_is_psci_call() in HVF
  target/arm/hvf: Rename 'vgic' -> 'emu_reginfo' in trace events
  target/arm: Rename init_cpreg_list() -> arm_init_cpreg_list()
  accel/hvf: Restrict ARM specific fields of AccelCPUState
  target/arm: Call aarch64_add_pauth_properties() once in host_initfn()
  accel/hvf: Guard hv_vcpu_run() between cpu_exec_start/end() calls
  cpus: Trace cpu_exec_start() and cpu_exec_end() calls
  target/arm/hvf: Keep calling hv_vcpu_run() in loop
  target/arm/hvf: Factor hvf_handle_vmexit() out
  target/i386/hvf: Factor hvf_handle_vmexit() out
  target/arm/hvf: Factor hvf_handle_exception() out
  target/arm/hvf: switch hvf_arm_get_host_cpu_features to not create a vCPU
  target/arm/hvf: Simplify hvf_arm_get_host_cpu_features()
  target/arm/hvf: Hardcode Apple MIDR
  accel/hvf: Implement hvf_arch_vcpu_destroy()
  target/arm/hvf: Mention hvf_inject_interrupts() must run on vCPU thread
  accel/hvf: Mention hvf_arch_update_guest_debug() must run on vCPU
  ...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

docs/system/arm/virt.rst

@@ -37,7 +37,8 @@ The virt board supports:
 - An RTC
 - The fw_cfg device that allows a guest to obtain data from QEMU
 - A PL061 GPIO controller
-- An optional SMMUv3 IOMMU
+- An optional machine-wide SMMUv3 IOMMU
+- User-creatable SMMUv3 devices (see below for example)
 - hotpluggable DIMMs
 - hotpluggable NVDIMMs
 - An MSI controller (GICv2M or ITS). GICv2M is selected by default along
@@ -176,7 +177,7 @@ iommu
   ``none``
     Don't create an IOMMU (the default)
   ``smmuv3``
-    Create an SMMUv3
+    Create a machine-wide SMMUv3.
 
 default-bus-bypass-iommu
   Set ``on``/``off`` to enable/disable `bypass_iommu
@@ -219,6 +220,36 @@ x-oem-table-id
   Set string (up to 8 bytes) to override the default value of field OEM Table ID
   in ACPI table header.
 
+SMMU configuration
+""""""""""""""""""
+
+Machine-wide SMMUv3 IOMMU
+  Setting the machine-specific option ``iommu=smmuv3`` causes QEMU to
+  create a single, machine-wide SMMUv3 instance that applies to all
+  devices in the PCIe topology.
+
+  For information about selectively bypassing devices, refer to
+  ``docs/bypass-iommu.txt``.
+
+User-creatable SMMUv3 devices
+  You can use the ``-device arm-smmuv3`` option to create multiple
+  user-defined SMMUv3 devices, each associated with a separate PCIe
+  root complex. This is only permitted if the machine-wide SMMUv3
+  (``iommu=smmuv3``) option is not used. Each ``arm-smmuv3`` device
+  uses the ``primary-bus`` sub-option to specify which PCIe root
+  complex it is associated with.
+
+  This model is useful when you want to mirror a host configuration where
+  each NUMA node typically has its own SMMU, allowing the VM topology to
+  align more closely with the host’s hardware layout.
+
+  Example::
+
+      -device arm-smmuv3,primary-bus=pcie.0,id=smmuv3.0
+      ...
+      -device pxb-pcie,id=pcie.1,numa_node=1
+      -device arm-smmuv3,primary-bus=pcie.1,id=smmuv3.1
+
 Linux guest kernel configuration
 """"""""""""""""""""""""""""""""
 

docs/system/security.rst

@@ -35,6 +35,32 @@ malicious:
 Bugs affecting these entities are evaluated on whether they can cause damage in
 real-world use cases and treated as security bugs if this is the case.
 
+To be covered by this security support policy you must:
+
+- use a virtualization accelerator like KVM or HVF
+- use one of the machine types listed below
+
+It may be possible to use other machine types with a virtualization
+accelerator to provide improved performance with a trusted guest
+workload, but any machine type not listed here should not be
+considered to be providing guest isolation or security guarantees,
+and falls under the "non-virtualization use case".
+
+Supported machine types for the virtualization use case, by target architecture:
+
+aarch64
+  ``virt``
+i386, x86_64
+  ``microvm``, ``xenfv``, ``xenpv``, ``xenpvh``, ``pc``, ``q35``
+s390x
+  ``s390-ccw-virtio``
+loongarch64:
+  ``virt``
+ppc64:
+  ``pseries``
+riscv32, riscv64:
+  ``virt``
+
 Non-virtualization Use Case
 '''''''''''''''''''''''''''