fix(pkg): bump qemu pkgrel to 5 so it upgrades over 11.1.2-4

docs/ANALYSIS.md

@@ -105,7 +105,9 @@ Links, in order:
 5. ~~FACP C2/C3 latencies, vmaware.hpp:9242~~ - `0xfff` -> `0xffe`
 6. Debug Port OperationRegion at `0x0402` - already dead on this tree
 7. HPET register-validation loop - dormant, domain sets `hpet present='no'`. Re-arms if enabled.
-8. Dummy SATA, DMAR, APIC source overrides - already dead on this tree
+8. Dummy SATA, DMAR, APIC source overrides - dead on this tree (SATA at `1f.2`: see the SATA
+   subsection below - device 31's functions carry no generic `_ADR` node, so the `D0FA`+`0x1F0002`
+   pair never forms)
 
 Link 3 requires **all four** of `LNKE`, `LNKH`, `GSIE`, `GSIH`, which is QEMU's eight-link plus
 eight-GSI layout. Real boards have four PCI link devices and no GSI-named ones, so rename the
@@ -181,6 +183,50 @@ Verified on QEMU 11.1.2 with this fix in the default series: the DSDT keeps `\_S
 login and powers off via S5 in ~12 s; VMAware v2.8.1 and HEAD both report `detected=0` / `FIRMWARE=0`
 on the stealth guest; Windows (secboot + SMM) and Linux boot unchanged. The opt-in split is gone.
 
+### CLEARED - the SATA controller OVMF must find at 1f.2 (`03-pci-ids`, 1.4.1)
+
+`03-pci-ids` originally relocated the ICH9 SATA controller off its standard slot
+(`ICH9_SATA1_DEV` 31 -> 20) to move the dummy-SATA DSDT node away from `00:1f.2`. That breaks
+OVMF first-boot for any SATA-booted guest: OVMF expects the q35 AHCI at `00:1f.2`, so with it at
+`00:14.2` OVMF never builds the disk boot option and falls through to `Start PXE over IPv4`. Only
+macOS exposed this - it boots OpenCore off AHCI; the Windows identity guests boot from NVMe and
+never touched the moved controller. A/B confirmed it: stock QEMU reaches the OpenCore picker, the
+1.4.0 patched binary PXEs, and restoring `ICH9_SATA1_DEV = 31` reaches the picker again
+(`BdsDxe: loading ... from PciRoot(0x0)/Pci(0x1F,0x2)/Sata`).
+
+The relocation was never load-bearing for the score. The dummy-SATA FIRMWARE link
+(vmaware.hpp ~9963) fires only on **both** the NameSeg `D0FA` **and** `Name(_ADR, 0x001F0002)`.
+With SATA back at `1f.2`, neither is present: QEMU describes device 31's functions under the ICH9
+LPC/ISA scope, not through `build_append_pci_bus_devices`, so the controller gets no generic
+`_ADR` node at all, and `get_mimic_pci_name` never emits `D0FA` for any devfn. Dumped the DSDT of a
+`1f.2`-SATA guest on the fixed build: zero `D0FA`, zero `08 5F 41 44 52 0C 02 00 1F 00`. No vendor
+or device ID changes, so `DEVICES` / `PCI_VENDOR` / `CPU_HEURISTIC` are untouched.
+
+Fix: drop the `ICH9_SATA1_DEV` hunk, leave SATA at stock `1f.2`. macOS boots on the default series;
+0/85 preserved.
+
+### CLEARED - the dangling ACPI name macOS aborts the DSDT on (folded into `01-firmware`)
+
+`01-firmware` renames the cold-plug PCI device ACPI nodes through `get_mimic_pci_name`
+(`build_append_pci_bus_devices`) to break the stock `S`+hex NameSeg signature. It left the hotplug
+and bus-notification code naming/referencing the *same* devices by the old `S%.02X` scheme, in four
+spots: the child-bridge `Scope` and `^S%.02X.PCNT` cross-reference in
+`build_append_notification_callback`, the `Notify()` target in `build_append_pcihp_notify_entry`,
+and the per-slot `Scope`/`Device` in `build_append_pcihp_slots`. So the DSDT opens `Scope(S13)` on a
+device actually declared `GFX3` - a dangling NameSeg.
+
+Only macOS exposes it. Its ACPI parser aborts the whole DSDT load on the missing name:
+`[S13_] Namespace lookup failure` -> `[DSDT] table load failed` -> `[\_SB.PCI0] ... AE_NOT_FOUND`,
+then it hangs in early IOKit (last line `AppleACPIPlatformExpert/cpus`). Linux and Windows swallow
+the `AE_NOT_FOUND` and boot on, which is why the identity guests never showed it - only a from-scratch
+macOS recovery boot did. Diagnosed with macOS IOKit verbose (`boot-args io=0xffffffff`).
+
+Fix (in `01-firmware`, alongside the `get_mimic_pci_name` definition it completes): route those four
+sites through `get_mimic_pci_name` so definitions and references agree. It *removes* `S%.02X`
+NameSegs rather than adding any, so the score is unaffected - re-measured on the rebuilt binary,
+VMAware v2.8.1 and HEAD both `detected=0`/`FIRMWARE=0`, and a Tahoe recovery boots to the installer
+GUI.
+
 ---
 
 ## CLEARED - CTYPE and SMBIOS_VM_BIT (the SMBIOS QEMU synthesises)

packaging/vfio-native-kvm-dkms/PKGBUILD

@@ -27,7 +27,7 @@
 pkgname=vfio-native-kvm-dkms
 _pkgbase=vfio-native-kvm
 _kver=7.2.3
-_tag=1.4.0
+_tag=1.4.3
 pkgver=${_kver}
 pkgrel=1
 pkgdesc="KVM modules patched to raise the exceptions the architecture specifies (DKMS, 7.2.x kernels)"

packaging/vfio-native-qemu/PKGBUILD

@@ -7,9 +7,9 @@
 
 pkgname=vfio-native-qemu
 _qver=11.1.2
-_tag=1.4.0
+_tag=1.4.3
 pkgver=${_qver}
-pkgrel=2
+pkgrel=5
 pkgdesc="QEMU ${_qver} with the vfio-native platform-identity patches, in /opt/qemu-native"
 arch=('x86_64')
 url="https://git.archworks.co/sandwich/vfio-native"

packaging/vfio-native/PKGBUILD

@@ -8,7 +8,7 @@
 #   vfio-native-qemu       QEMU 11.1.2 with the platform-identity patches, in /opt
 
 pkgname=vfio-native
-pkgver=1.4.0
+pkgver=1.4.3
 pkgrel=1
 pkgdesc="Present a libvirt guest as a self-consistent physical machine, and tune it"
 arch=('any')

patches/README.md

@@ -42,7 +42,7 @@ Against QEMU v11.1.2. Apply in numeric order.
 | `02-disk-identity` | `VIRTUAL_DISK`, `DISK_SERIAL` - `QEMU HARDDISK`, empty serials, SCSI inquiry strings |
 | `03-pci-ids` | `PCI_VENDOR`, `DEVICES` - Red Hat/QEMU vendor and subsystem IDs, ICH9 layout |
 | `04-fw-cfg` | `QEMU_FW_CFG` - the fw_cfg device signature |
-| `05-usb-hid` | `QEMU_USB` - USB HID descriptor strings |
+| `05-usb-identity` | `QEMU_USB` - USB HID descriptor strings, and the usb-net CDC/RNDIS device-identity strings (keeps the `0525:a4a1` CDC id so generic CDC-ECM drivers still bind it) |
 | `06-audio` | `DEVICES` - HDA codec and controller identity |
 | `07-edid` | none. Carried for other detectors; VMAware does not read EDID. |
 | `08-cpu-misc` | none. CPU feature plumbing and one upstream backport. |
@@ -52,7 +52,11 @@ Against QEMU v11.1.2. Apply in numeric order.
 
 The numbered patches are the default series and score 0/85 on both VMAware HEAD and v2.8.1.
 `03-pci-ids` scopes the virtio subsystem-id change so OVMF still binds virtio (its generic default
-goes to Intel/0, virtio devices keep the Red Hat subsystem ids their drivers and OVMF expect).
+goes to Intel/0, virtio devices keep the Red Hat subsystem ids their drivers and OVMF expect). It
+also leaves the ICH9 SATA controller at its stock slot `1f.2`: OVMF locates the q35 AHCI there, so
+moving it broke first-boot for SATA-booted UEFI guests (macOS fell through to PXE) while buying
+nothing for the score - the dummy-SATA FIRMWARE tell needs both the `D0FA` name and `_ADR 0x1F0002`,
+and device 31's functions emit neither. See `docs/ANALYSIS.md`.
 
 `11-macos-cpu-hotplug` makes the series universal: macOS boots (it needs the `\_SB.CPUS.Cxxx`
 objects from `build_cpus_aml`) and both VMAware builds still read bare metal, with no opt-in. The

patches/qemu/01-firmware.patch

@@ -193,10 +193,9 @@ index 8837b69..4001d9d 100644
      if (pcms->wdat_enabled == true) {
          g_assert(pm.tco_io_base);
 diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
-index 87162ff2c..3616c580a 100644
 --- a/hw/acpi/pcihp.c
 +++ b/hw/acpi/pcihp.c
-@@ -687,10 +687,10 @@ void build_append_pcihp_resources(Aml *scope /* \\_SB.PCI0 */,
+@@ -687,10 +687,10 @@
  {
      Aml *dev, *crs;
  
@@ -209,7 +208,7 @@ index 87162ff2c..3616c580a 100644
      /* device present, functioning, decoding, not shown in UI */
      aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
      crs = aml_resource_template();
-@@ -699,6 +699,89 @@ void build_append_pcihp_resources(Aml *scope /* \\_SB.PCI0 */,
+@@ -699,6 +699,89 @@
      aml_append(scope, dev);
  }
  
@@ -299,7 +298,57 @@ index 87162ff2c..3616c580a 100644
  bool build_append_notification_callback(Aml *parent_scope, const PCIBus *bus)
  {
      Aml *method;
-@@ -912,7 +995,11 @@ void build_append_pci_bus_devices(Aml *parent_scope, PCIBus *bus)
+@@ -708,7 +791,9 @@
+     GQueue *pcnt_bus_list = g_queue_new();
+ 
+     QLIST_FOREACH(sec, &bus->child, sibling) {
+-        Aml *br_scope = aml_scope("S%.02X", sec->parent_dev->devfn);
++        char mimic_nm[5];
++        get_mimic_pci_name(mimic_nm, sec->parent_dev->devfn);
++        Aml *br_scope = aml_scope("%s", mimic_nm);
+         if (pci_bus_is_root(sec)) {
+             continue;
+         }
+@@ -747,7 +832,9 @@
+ 
+     /* Notify about child bus events in any case */
+     while ((sec = g_queue_pop_head(pcnt_bus_list))) {
+-        aml_append(method, aml_name("^S%.02X.PCNT", sec->parent_dev->devfn));
++        char mimic_nm[5];
++        get_mimic_pci_name(mimic_nm, sec->parent_dev->devfn);
++        aml_append(method, aml_name("^%s.PCNT", mimic_nm));
+     }
+ 
+     aml_append(parent_scope, method);
+@@ -802,9 +889,11 @@
+ {
+     Aml *if_ctx;
+     int32_t devfn = PCI_DEVFN(slot, 0);
++    char mimic_nm[5];
+ 
++    get_mimic_pci_name(mimic_nm, devfn);
+     if_ctx = aml_if(aml_and(aml_arg(0), aml_int(0x1U << slot), NULL));
+-    aml_append(if_ctx, aml_notify(aml_name("S%.02X", devfn), aml_arg(1)));
++    aml_append(if_ctx, aml_notify(aml_name("%s", mimic_nm), aml_arg(1)));
+     aml_append(method, if_ctx);
+ }
+ 
+@@ -867,10 +956,12 @@
+             continue;
+         }
+ 
++        char mimic_nm[5];
++        get_mimic_pci_name(mimic_nm, devfn);
+         if (bus->devices[devfn]) {
+-            dev = aml_scope("S%.02X", devfn);
++            dev = aml_scope("%s", mimic_nm);
+         } else {
+-            dev = aml_device("S%.02X", devfn);
++            dev = aml_device("%s", mimic_nm);
+             aml_append(dev, aml_name_decl("_ADR", aml_int(adr)));
+         }
+ 
+@@ -912,7 +1003,11 @@
          }
  
          /* start to compose PCI device descriptor */

patches/qemu/03-pci-ids.patch

@@ -90,15 +90,6 @@ index 2c35dd0..2b6a39c 100644
  #define ICH9_LPC_NB_PIRQS                       8       /* PCI A-H */
  
  #define ICH9_LPC_PMBASE                         0x40
-@@ -177,7 +177,7 @@ struct ICH9LPCState {
- #define ICH9_GPIO_GSI "gsi"
- 
- /* D31:F2 SATA Controller #1 */
--#define ICH9_SATA1_DEV                          31
-+#define ICH9_SATA1_DEV                          20
- #define ICH9_SATA1_FUNC                         2
- 
- /* D31:F0 power management I/O registers
 @@ -213,7 +213,7 @@ struct ICH9LPCState {
  /* D31:F3 SMBus controller */
  #define TYPE_ICH9_SMB_DEVICE "ICH9-SMB"

patches/qemu/05-usb-identity.patch

@@ -1,11 +1,15 @@
-Subject: [PATCH] usb-hid: QEMU_USB
+Subject: [PATCH] usb: QEMU_USB
 
 Targets VMAware check: QEMU_USB
 
-USB HID descriptors carrying QEMU vendor strings and product IDs.
+USB device identity strings that name QEMU: the HID descriptors (dev-hid.c)
+and the usb-net CDC/RNDIS descriptors plus its RNDIS vendor-description and
+product_desc (dev-network.c). The usb-net VID/PID (0525:a4a1, a real Linux
+USB Ethernet Gadget id) is left intact so the device stays CDC-class and the
+guest's generic CDC-ECM driver (e.g. macOS AppleUSBEthernet) still binds it.
 
 Applies to QEMU v11.1.2. Apply from the source root with:
-    patch -p1 < 05-usb-hid.patch
+    patch -p1 < 05-usb-identity.patch
 
 ---
 diff --git a/hw/usb/dev-hid.c b/hw/usb/dev-hid.c
@@ -109,3 +113,49 @@ index ae19d60..9fe1223 100644
      dc->vmsd = &vmstate_usb_kbd;
      device_class_set_props(dc, usb_keyboard_properties);
      set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
+
+diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
+--- a/hw/usb/dev-network.c
++++ b/hw/usb/dev-network.c
+@@ -99,15 +99,15 @@
+ #define ETH_FRAME_LEN                   1514 /* Max. octets in frame sans FCS */
+ 
+ static const USBDescStrings usb_net_stringtable = {
+-    [STRING_MANUFACTURER]       = "QEMU",
+-    [STRING_PRODUCT]            = "RNDIS/QEMU USB Network Device",
++    [STRING_MANUFACTURER]       = "Linux",
++    [STRING_PRODUCT]            = "USB Ethernet",
+     [STRING_ETHADDR]            = "400102030405",
+-    [STRING_DATA]               = "QEMU USB Net Data Interface",
+-    [STRING_CONTROL]            = "QEMU USB Net Control Interface",
+-    [STRING_RNDIS_CONTROL]      = "QEMU USB Net RNDIS Control Interface",
+-    [STRING_CDC]                = "QEMU USB Net CDC",
+-    [STRING_SUBSET]             = "QEMU USB Net Subset",
+-    [STRING_RNDIS]              = "QEMU USB Net RNDIS",
++    [STRING_DATA]               = "CDC Ethernet Data",
++    [STRING_CONTROL]            = "CDC Ethernet Control",
++    [STRING_RNDIS_CONTROL]      = "RNDIS Communications Control",
++    [STRING_CDC]                = "CDC Ethernet",
++    [STRING_SUBSET]             = "CDC Subset Ethernet",
++    [STRING_RNDIS]              = "RNDIS Ethernet",
+     [STRING_SERIALNUMBER]       = "1",
+ };
+ 
+@@ -717,7 +717,7 @@
+ 
+     /* mandatory */
+     case OID_GEN_VENDOR_DESCRIPTION:
+-        pstrcpy((char *)outbuf, outlen, "QEMU USB RNDIS Net");
++        pstrcpy((char *)outbuf, outlen, "USB Ethernet");
+         return strlen((char *)outbuf) + 1;
+ 
+     case OID_GEN_VENDOR_DRIVER_VERSION:
+@@ -1417,7 +1417,7 @@
+     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
+ 
+     uc->realize        = usb_net_realize;
+-    uc->product_desc   = "QEMU USB Network Interface";
++    uc->product_desc   = "USB Ethernet Adapter";
+     uc->usb_desc       = &desc_net;
+     uc->handle_reset   = usb_net_handle_reset;
+     uc->handle_control = usb_net_handle_control;