From d26739760912da3a2563f3f3378333991657172e Mon Sep 17 00:00:00 2001
From: Stuart Pernsteiner <spernsteiner@galois.com>
Date: Tue, 30 Jul 2024 09:22:35 -0700
Subject: [PATCH 1/9] pkvm_setup: add qemu submodule, including debian
 packaging files

---
 .gitmodules         | 3 +++
 src/pkvm_setup/qemu | 1 +
 2 files changed, 4 insertions(+)
 create mode 160000 src/pkvm_setup/qemu

diff --git a/.gitmodules b/.gitmodules
index 153421fa..cfee0c72 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -23,3 +23,6 @@
 [submodule "src/cerberus"]
 	path = src/cerberus
 	url = https://github.com/rems-project/cerberus.git
+[submodule "src/pkvm_setup/qemu"]
+	path = src/pkvm_setup/qemu
+	url = git@github.com:GaloisInc/verse-debian-qemu.git
diff --git a/src/pkvm_setup/qemu b/src/pkvm_setup/qemu
new file mode 160000
index 00000000..c06e9e5c
--- /dev/null
+++ b/src/pkvm_setup/qemu
@@ -0,0 +1 @@
+Subproject commit c06e9e5c35531968b4e8a1f1d3f7a74cb26678b6

From c4c35c50e130137a69d9d6e9776bb869b4098f0c Mon Sep 17 00:00:00 2001
From: Stuart Pernsteiner <spernsteiner@galois.com>
Date: Tue, 30 Jul 2024 09:24:35 -0700
Subject: [PATCH 2/9] pkvm_setup: build_qemu.sh: don't recreate pbuilder
 base.tgz if it already exists

---
 src/pkvm_setup/build_qemu.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/pkvm_setup/build_qemu.sh b/src/pkvm_setup/build_qemu.sh
index d8dd099d..16d94799 100644
--- a/src/pkvm_setup/build_qemu.sh
+++ b/src/pkvm_setup/build_qemu.sh
@@ -28,8 +28,12 @@ sudo apt install -y pbuilder ubuntu-dev-tools dpkg-dev
 PBUILDFOLDER="$(pwd)/qemu_build"
 export PBUILDFOLDER
 
-echo "Creating pbuilder base.tgz for $dist $target" 1>&2
-pbuilder-dist "$dist" "$target" create
+if [[ -f "$PBUILDFOLDER/${dist}-base.tgz" ]]; then
+    echo "Using existing pbuilder base.tgz for $dist $target" 1>&2
+else
+    echo "Creating pbuilder base.tgz for $dist $target" 1>&2
+    pbuilder-dist "$dist" "$target" create
+fi
 
 sole() {
     if [[ "$#" -ne 1 ]]; then

From 2d730aaeb06d70f82c5dec3303d68ea64582be8e Mon Sep 17 00:00:00 2001
From: Stuart Pernsteiner <spernsteiner@galois.com>
Date: Tue, 30 Jul 2024 09:25:21 -0700
Subject: [PATCH 3/9] pkvm_setup: build_qemu.sh: update for new git +
 pristine-tar source management

---
 src/pkvm_setup/build_qemu.sh | 21 ++++++---------------
 1 file changed, 6 insertions(+), 15 deletions(-)

diff --git a/src/pkvm_setup/build_qemu.sh b/src/pkvm_setup/build_qemu.sh
index 16d94799..f2ee5722 100644
--- a/src/pkvm_setup/build_qemu.sh
+++ b/src/pkvm_setup/build_qemu.sh
@@ -24,7 +24,7 @@ dist=bookworm
 echo "target=$target"
 echo "dist=$dist"
 
-sudo apt install -y pbuilder ubuntu-dev-tools dpkg-dev
+sudo apt install -y pbuilder ubuntu-dev-tools dpkg-dev pristine-tar
 PBUILDFOLDER="$(pwd)/qemu_build"
 export PBUILDFOLDER
 
@@ -44,22 +44,13 @@ sole() {
     fi
 }
 
-patch_dir="$(pwd)/qemu_patches"
 (
-    # TODO: clean old src dir first (avoid reapplying patches)
-    mkdir -p "$PBUILDFOLDER/src"
-    cd "$PBUILDFOLDER/src"
+    cd qemu
     echo "Preparing QEMU sources" 1>&2
-    apt source qemu
-    (
-        cd "$(sole qemu*/)"
-        for patch in "$patch_dir"/debian-*.patch; do
-            echo "Applying $patch" 1>&2
-            patch -p1 <"$patch"
-        done
-        dpkg-buildpackage --build=source -uc -us
-    )
+    pristine-tar checkout ../qemu_9.0.2+ds.orig.tar.xz
+    debian/rules debian/control
+    dpkg-buildpackage --build=source -uc -us
 )
 
-dsc_file="$(sole "$PBUILDFOLDER/src/"qemu_*-9999+verse*.dsc)"
+dsc_file="$(sole qemu_*-9999+verse*.dsc)"
 pbuilder-dist "$dist" "$target" build "$dsc_file"

From 4ad6c5a5f5265a7f50dd59bb9dd4b85db0de369a Mon Sep 17 00:00:00 2001
From: Stuart Pernsteiner <spernsteiner@galois.com>
Date: Tue, 30 Jul 2024 09:25:35 -0700
Subject: [PATCH 4/9] pkvm_setup: remove old qemu_patches/*

---
 ...debian-disable-optional-dependencies.patch | 1114 -----------------
 .../qemu_patches/debian-version.patch         |   14 -
 2 files changed, 1128 deletions(-)
 delete mode 100644 src/pkvm_setup/qemu_patches/debian-disable-optional-dependencies.patch
 delete mode 100644 src/pkvm_setup/qemu_patches/debian-version.patch

diff --git a/src/pkvm_setup/qemu_patches/debian-disable-optional-dependencies.patch b/src/pkvm_setup/qemu_patches/debian-disable-optional-dependencies.patch
deleted file mode 100644
index b5f01b25..00000000
--- a/src/pkvm_setup/qemu_patches/debian-disable-optional-dependencies.patch
+++ /dev/null
@@ -1,1114 +0,0 @@
-Disable a bunch of optional components and dependencies that we don't use in
-the OpenSUT.  The default build of qemu-system-arm with all dependencies takes
-up about 1 GB; removing these dependencies decreases the size significantly.
-
---- qemu-7.2+dfsg-orig/debian/control	2024-02-06 09:38:06.000000000 -0800
-+++ qemu-7.2+dfsg/debian/control	2024-06-17 09:59:57.180637423 -0700
-@@ -10,107 +10,108 @@
- # on build-dependencies.
-  python3:any,
-  ninja-build, meson (>> 0.61.5~),
--# --enable-docs
-+ pkg-config,
-+ libglib2.0-dev,
-+# --disable-docs
- # for python3-sphinx:native see #995622
-- texinfo, python3-sphinx:native, python3-sphinx-rtd-theme,
-+# texinfo, python3-sphinx:native, python3-sphinx-rtd-theme,
- # iasl (from acpica-tools) is used only in a single test these days, not for building
- # acpica-tools,
- # libcapstone is in universe in ubuntu
--# --enable-capstone
-- libcapstone-dev (>> 4.0.2~),
--# --enable-linux-aio	linux-*
-- libaio-dev [linux-any],
-- libjack-dev [linux-any],
--# --audio-drv-list=pa,alsa,jack,oss,sdl	linux-*
--# --audio-drv-list=pa,oss	kfreebsd-*
-- libpulse-dev,
-- libasound2-dev [linux-any],
-+# --disable-capstone
-+# libcapstone-dev (>> 4.0.2~),
-+# --disable-linux-aio	linux-*
-+# libaio-dev [linux-any],
-+# libjack-dev [linux-any],
-+# --audio-drv-list=
-+# libpulse-dev,
-+# libasound2-dev [linux-any],
- # for virtfs (now in libc6)
- # --enable-attr
--# --enable-bpf	linux-*
-- libbpf-dev	[linux-any],
--# --enable-brlapi
-- libbrlapi-dev,
-+# --disable-bpf	linux-*
-+# libbpf-dev	[linux-any],
-+# --disable-brlapi
-+# libbrlapi-dev,
- # --enable-virtfs	linux-*
- # needed for virtfs
- # --enable-cap-ng	linux-*
-  libcap-ng-dev [linux-any],
--# --enable-curl
-- libcurl4-gnutls-dev,
-+# --disable-curl
-+# libcurl4-gnutls-dev,
- # --enable-fdt
- # libfdt #931046
-  libfdt-dev (>> 1.5.0-2~),
--# --enable-fuse
-- libfuse3-dev,
--# --enable-gnutls
-- gnutls-dev,
--# --enable-gtk --enable-vte
-- libgtk-3-dev, libvte-2.91-dev,
--# --enable-libiscsi
-- libiscsi-dev (>> 1.9.0~),
-+# --disable-fuse
-+# libfuse3-dev,
-+# --disable-gnutls
-+# gnutls-dev,
-+# --disable-gtk --disable-vte
-+# libgtk-3-dev, libvte-2.91-dev,
-+# --disable-libiscsi
-+# libiscsi-dev (>> 1.9.0~),
- # --enable-curses
-  libncurses-dev,
--# --enable-virglrenderer	linux-*
-- libvirglrenderer-dev [linux-any],
-+# --disable-virglrenderer	linux-*
-+# libvirglrenderer-dev [linux-any],
- # libvirglrenderer-dev bug #1019485: libva-dev build-dep is only a temp workaround
-- libva-dev [linux-any],
--# --enable-opengl	linux-*
-- libepoxy-dev [linux-any], libdrm-dev [linux-any], libgbm-dev [linux-any],
--# --enable-libnfs
-- libnfs-dev,
--# --enable-numa	i386|amd64|ia64|mips|mipsel|powerpc|powerpcspe|x32|ppc64|ppc64el|arm64|sparc|s390x|riscv64
-- libnuma-dev   [i386 amd64 ia64 mips mipsel mips64 mips64el powerpc powerpcspe x32 ppc64 ppc64el arm64 sparc s390x riscv64],
--# --enable-smartcard
-- libcacard-dev,
-+# libva-dev [linux-any],
-+# --disable-opengl	linux-*
-+# libepoxy-dev [linux-any], libdrm-dev [linux-any], libgbm-dev [linux-any],
-+# --disable-libnfs
-+# libnfs-dev,
-+# --disable-numa	i386|amd64|ia64|mips|mipsel|powerpc|powerpcspe|x32|ppc64|ppc64el|arm64|sparc|s390x|riscv64
-+# libnuma-dev   [i386 amd64 ia64 mips mipsel mips64 mips64el powerpc powerpcspe x32 ppc64 ppc64el arm64 sparc s390x riscv64],
-+# --disable-smartcard
-+# libcacard-dev,
-  libpixman-1-dev,
--# --enable-rbd		amd64|arm64|armel|armhf|i386|mips64el|mipsel|ppc64el|s390x|ppc64|sparc64
-- librbd-dev            [amd64 arm64 armel armhf i386 mips64el mipsel ppc64el s390x ppc64 sparc64],
-+# --disable-rbd		amd64|arm64|armel|armhf|i386|mips64el|mipsel|ppc64el|s390x|ppc64|sparc64
-+# librbd-dev            [amd64 arm64 armel armhf i386 mips64el mipsel ppc64el s390x ppc64 sparc64],
- # before buster it was glusterfs-common so keep it for now for bpo
--# --enable-glusterfs	linux-any
-- libglusterfs-dev [linux-any] | glusterfs-common [linux-any],
--# --enable-vnc-sasl
-- libsasl2-dev,
--# --enable-sdl
-- libsdl2-dev,
-+# --disable-glusterfs	linux-any
-+# libglusterfs-dev [linux-any] | glusterfs-common [linux-any],
-+# --disable-vnc-sasl
-+# libsasl2-dev,
-+# --disable-sdl
-+# libsdl2-dev,
- # --enable-seccomp	amd64|arm64|armel|armhf|i386|mips64el|mipsel|ppc64el|s390x|hppa|powerpc|ppc64|riscv64|x32
-  libseccomp-dev        [amd64 arm64 armel armhf i386 mips64el mipsel ppc64el s390x hppa powerpc ppc64 riscv64 x32],
- # --enable-slirp
-  libslirp-dev,
--# --enable-spice	 linux-amd64|linux-i386|linux-arm64|linux-armel|linux-armhf|linux-mips64el|linux-mipsel|ppc64el|sh4|x32
-- libspice-server-dev	[linux-amd64 linux-i386 linux-arm64 linux-armel linux-armhf linux-mips64el linux-mipsel ppc64el sh4 x32],
--# --enable-rdma		linux-*
-- librdmacm-dev [linux-any], libibverbs-dev [linux-any], libibumad-dev [linux-any],
-+# --disable-spice	 linux-amd64|linux-i386|linux-arm64|linux-armel|linux-armhf|linux-mips64el|linux-mipsel|ppc64el|sh4|x32
-+# libspice-server-dev	[linux-amd64 linux-i386 linux-arm64 linux-armel linux-armhf linux-mips64el linux-mipsel ppc64el sh4 x32],
-+# --disable-rdma		linux-*
-+# librdmacm-dev [linux-any], libibverbs-dev [linux-any], libibumad-dev [linux-any],
- # --enable-linux-io-uring	linux-*
-  liburing-dev [linux-any],
--# --enable-libusb	linux-*
-- libusb-1.0-0-dev [linux-any],
--# --enable-usb-redir	linux-*
-- libusbredirparser-dev [linux-any],
--# --enable-libssh
-- libssh-dev,
--# --enable-zstd
-- libzstd-dev,
-+# --disable-libusb	linux-*
-+# libusb-1.0-0-dev [linux-any],
-+# --disable-usb-redir	linux-*
-+# libusbredirparser-dev [linux-any],
-+# --disable-libssh
-+# libssh-dev,
-+# --disable-zstd
-+# libzstd-dev,
- # vde is debian-only since ubuntu/vde2 is in universe
--# --enable-vde
-- libvdeplug-dev,
-- libxen-dev [linux-amd64],
--# --enable-nettle
-- nettle-dev,
-+# --disable-vde
-+# libvdeplug-dev,
-+# libxen-dev [linux-amd64],
-+# --disable-nettle
-+# nettle-dev,
- ## always enabled: --enable-uuid
-  uuid-dev,
- # always needed
-  zlib1g-dev,
- # other optional features we enable
--# --enable-libudev
-+# --disable-libudev
- # needed for qga?
-- libudev-dev [linux-any],
--# --enable-vnc
--# --enable-vnc-jpeg
-- libjpeg-dev,
--# --enable-png
-- libpng-dev,
--# --enable-libpmem	linux-amd64|linux-arm64
-- libpmem-dev [linux-amd64 linux-arm64],
-+# libudev-dev [linux-any],
-+# --disable-vnc
-+# --disable-vnc-jpeg
-+# libjpeg-dev,
-+# --disable-png
-+# libpng-dev,
-+# --disable-libpmem	linux-amd64|linux-arm64
-+# libpmem-dev [linux-amd64 linux-arm64],
- # --enable-kvm		linux-*
- # --enable-vhost-net	linux-*	# is it really linux-specific?
- ##--enable-lzo todo, for (memory) dumps
-@@ -119,22 +120,24 @@
- ##--with-iconv (libiconv for curses wide char support)
- ## auth-pam - for auth for vnc&Co using PAM
- ## gio-2.0 - for -display=spice-app
-+# VERSE:
-+# --enable-vhost-user
- Build-Depends-Indep:
- # pc-bios/*.dts => *.dtb (PPC firmware)
-  device-tree-compiler,
-- gcc-s390x-linux-gnu,
-+# gcc-s390x-linux-gnu,
- # qemu-palcode/palcode-clipper
-- gcc-alpha-linux-gnu,
-+# gcc-alpha-linux-gnu,
- # skiboot firmware, openbios
-- gcc-powerpc64-linux-gnu,
-+# gcc-powerpc64-linux-gnu,
- # openbios
-- gcc-sparc64-linux-gnu, fcode-utils, xsltproc,
-+# gcc-sparc64-linux-gnu, fcode-utils, xsltproc,
- # hppa-firmware
-- gcc-hppa-linux-gnu,
-+# gcc-hppa-linux-gnu,
- # opensbi
-- gcc-riscv64-linux-gnu,
-+# gcc-riscv64-linux-gnu,
- # vbootrom/npcm7xx_bootrom
-- gcc-arm-none-eabi,
-+# gcc-arm-none-eabi,
- Build-Conflicts: oss4-dev
- Standards-Version: 4.6.1
- Homepage: http://www.qemu.org/
-@@ -147,11 +150,11 @@
- Multi-Arch: foreign
- Depends: ${misc:Depends},
-  qemu-system-arm,
-- qemu-system-mips,
-- qemu-system-ppc,
-- qemu-system-sparc,
-- qemu-system-x86,
-- qemu-system-misc
-+# qemu-system-mips,
-+# qemu-system-ppc,
-+# qemu-system-sparc,
-+# qemu-system-x86,
-+# qemu-system-misc
- Description: QEMU full system emulation binaries
-  QEMU is a fast processor emulator: currently the package supports
-  ARM, CRIS, i386, M68k (ColdFire), MicroBlaze, MIPS, PowerPC, SH4,
-@@ -162,28 +165,28 @@
-  targets, by depending on all per-architecture system emulation packages which
-  QEMU supports.
- 
--Package: qemu-block-extra
--Architecture: amd64 arm arm64 armel armhf hppa i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel mips64 mips64el powerpc powerpcspe ppc64 ppc64el riscv64 s390x sparc sparc64 x32
--Multi-Arch: no
--Depends: ${misc:Depends}, ${shlibs:Depends},
--         qemu-system-x86 (= ${binary:Version})
--	|qemu-system-arm (= ${binary:Version})
--	|qemu-system-mips (= ${binary:Version})
--	|qemu-system-ppc (= ${binary:Version})
--	|qemu-system-sparc (= ${binary:Version})
--	|qemu-system-misc (= ${binary:Version})
--	|qemu-utils (= ${binary:Version}),
--Enhances: qemu-utils, qemu-system-misc,
-- qemu-system-arm, qemu-system-mips, qemu-system-sparc, qemu-system-x86,
--Description: extra block backend modules for qemu-system and qemu-utils
-- QEMU is a fast processor emulator: currently the package supports
-- ARM, CRIS, i386, M68k (ColdFire), MicroBlaze, MIPS, PowerPC, SH4,
-- SPARC and x86-64 emulation. By using dynamic translation it achieves
-- reasonable speed while being easy to port on new host CPUs.
-- .
-- This package provides extra block device backend modules for qemu-system
-- emulation and qemu-img from qemu-utils package, which are rarely used and
-- has extra dependencies.
-+#Package: qemu-block-extra
-+#Architecture: amd64 arm arm64 armel armhf hppa i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel mips64 mips64el powerpc powerpcspe ppc64 ppc64el riscv64 s390x sparc sparc64 x32
-+#Multi-Arch: no
-+#Depends: ${misc:Depends}, ${shlibs:Depends},
-+#         qemu-system-x86 (= ${binary:Version})
-+#	|qemu-system-arm (= ${binary:Version})
-+#	|qemu-system-mips (= ${binary:Version})
-+#	|qemu-system-ppc (= ${binary:Version})
-+#	|qemu-system-sparc (= ${binary:Version})
-+#	|qemu-system-misc (= ${binary:Version})
-+#	|qemu-utils (= ${binary:Version}),
-+#Enhances: qemu-utils, qemu-system-misc,
-+# qemu-system-arm, qemu-system-mips, qemu-system-sparc, qemu-system-x86,
-+#Description: extra block backend modules for qemu-system and qemu-utils
-+# QEMU is a fast processor emulator: currently the package supports
-+# ARM, CRIS, i386, M68k (ColdFire), MicroBlaze, MIPS, PowerPC, SH4,
-+# SPARC and x86-64 emulation. By using dynamic translation it achieves
-+# reasonable speed while being easy to port on new host CPUs.
-+# .
-+# This package provides extra block device backend modules for qemu-system
-+# emulation and qemu-img from qemu-utils package, which are rarely used and
-+# has extra dependencies.
- 
- Package: qemu-system-data
- Architecture: all
-@@ -218,39 +221,41 @@
-  This package provides common files needed for target-specific
-  full system emulation (qemu-system-*) packages.
- 
--Package: qemu-system-gui
--Architecture: amd64 arm arm64 armel armhf i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel mips64 mips64el powerpc powerpcspe ppc64 ppc64el riscv64 s390x sparc sparc64 x32
--#XXX M-A: same does not really work for now due to /usr/lib/qemu/vhost-user-gpu
--#XXX we'll deal with this if some actual need arises,
--#XXX by moving that binary back to q-s-common or packaging it separately
--#Multi-Arch: same
--Depends: ${misc:Depends}, ${shlibs:Depends},
--         qemu-system-x86 (= ${binary:Version})
--	|qemu-system-arm (= ${binary:Version})
--	|qemu-system-mips (= ${binary:Version})
--	|qemu-system-ppc (= ${binary:Version})
--	|qemu-system-sparc (= ${binary:Version})
--	|qemu-system-misc (= ${binary:Version}),
--# libgl1 is dynamically loaded by sdl display code
--        libgl1,
--# we moved vhost-user-gpu files here from qemu-system-common at 6.1-4
--Replaces: qemu-system-common (<< 1:6.1+dfsg-4~)
--Description: QEMU full system emulation binaries (user interface and audio support)
-- This package provides local graphical user interface (currently GTK)
-- and audio backends for full system emulation (qemu-system-*) packages.
-- .
-- The default GTK based qemu-system-gui is generally better and recommended,
-- but a few corner cases still need SDL which is therefore provided as well.
-+#Package: qemu-system-gui
-+#Architecture: amd64 arm arm64 armel armhf i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel mips64 mips64el powerpc powerpcspe ppc64 ppc64el riscv64 s390x sparc sparc64 x32
-+##XXX M-A: same does not really work for now due to /usr/lib/qemu/vhost-user-gpu
-+##XXX we'll deal with this if some actual need arises,
-+##XXX by moving that binary back to q-s-common or packaging it separately
-+##Multi-Arch: same
-+#Depends: ${misc:Depends}, ${shlibs:Depends},
-+#         qemu-system-x86 (= ${binary:Version})
-+#	|qemu-system-arm (= ${binary:Version})
-+#	|qemu-system-mips (= ${binary:Version})
-+#	|qemu-system-ppc (= ${binary:Version})
-+#	|qemu-system-sparc (= ${binary:Version})
-+#	|qemu-system-misc (= ${binary:Version}),
-+## libgl1 is dynamically loaded by sdl display code
-+#        libgl1,
-+## we moved vhost-user-gpu files here from qemu-system-common at 6.1-4
-+#Replaces: qemu-system-common (<< 1:6.1+dfsg-4~)
-+#Description: QEMU full system emulation binaries (user interface and audio support)
-+# This package provides local graphical user interface (currently GTK)
-+# and audio backends for full system emulation (qemu-system-*) packages.
-+# .
-+# The default GTK based qemu-system-gui is generally better and recommended,
-+# but a few corner cases still need SDL which is therefore provided as well.
- 
- Package: qemu-system-misc
- Architecture: amd64 arm arm64 armel armhf i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel mips64 mips64el powerpc powerpcspe ppc64 ppc64el riscv64 s390x sparc sparc64 x32
- Multi-Arch: foreign
- Depends: ${shlibs:Depends}, ${misc:Depends}, qemu-system-common (= ${binary:Version}), qemu-system-data (>> ${source:Upstream-Version}~),
--Recommends: qemu-system-gui (= ${binary:Version}), qemu-utils,
-+Recommends:
-+# qemu-system-gui (= ${binary:Version}),
-+ qemu-utils,
- # alpha uses vgabios
- # alpha m68k sh4 uses bootroms
-  seabios, ipxe-qemu,
-- qemu-block-extra (= ${binary:Version}),
-+# qemu-block-extra (= ${binary:Version}),
- Suggests: samba, vde2,
- Provides: ${sysprovides:misc},
-  qemu-kvm [s390x],
-@@ -274,11 +279,13 @@
- Architecture: amd64 arm arm64 armel armhf i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel mips64 mips64el powerpc powerpcspe ppc64 ppc64el riscv64 s390x sparc sparc64 x32
- Multi-Arch: foreign
- Depends: ${shlibs:Depends}, ${misc:Depends}, qemu-system-common (= ${binary:Version}), qemu-system-data (>> ${source:Upstream-Version}~),
--Recommends: qemu-system-gui (= ${binary:Version}), qemu-utils,
-+Recommends:
-+# qemu-system-gui (= ${binary:Version}),
-+ qemu-utils,
- # aarch64 arm uses bootroms
-  ipxe-qemu,
-  qemu-efi-aarch64, qemu-efi-arm,
-- qemu-block-extra (= ${binary:Version}),
-+# qemu-block-extra (= ${binary:Version}),
- Suggests: samba, vde2,
- Provides: qemu-kvm [linux-arm64 linux-armhf linux-armel], ${sysprovides:arm}
- Breaks:   qemu-kvm [linux-arm64 linux-armhf linux-armel]
-@@ -296,186 +303,186 @@
-  code.  It can also be used to provide virtual hosting of several virtual
-  machines on a single server.
- 
--Package: qemu-system-mips
--Architecture: amd64 arm arm64 armel armhf i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel mips64 mips64el powerpc powerpcspe ppc64 ppc64el riscv64 s390x sparc sparc64 x32
--Multi-Arch: foreign
--Depends: ${shlibs:Depends}, ${misc:Depends}, qemu-system-common (= ${binary:Version}), qemu-system-data (>> ${source:Upstream-Version}~),
--Recommends: qemu-system-gui (= ${binary:Version}), qemu-utils,
--# all mips targets uses vgabios and bootroms
-- seabios, ipxe-qemu,
-- qemu-block-extra (= ${binary:Version}),
--Suggests: samba, vde2,
--Provides: ${sysprovides:mips}
--Description: QEMU full system emulation binaries (mips)
-- QEMU is a fast processor emulator: currently the package supports
-- MIPS emulation. By using dynamic translation it achieves
-- reasonable speed while being easy to port on new host CPUs.
-- .
-- This package provides the full system emulation binaries to emulate
-- the following mips hardware: ${sysarch:mips}.
-- .
-- In system emulation mode QEMU emulates a full system, including a processor
-- and various peripherals.  It enables easier testing and debugging of system
-- code.  It can also be used to provide virtual hosting of several virtual
-- machines on a single server.
--
--Package: qemu-system-ppc
--Architecture: amd64 arm arm64 armel armhf i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel mips64 mips64el powerpc powerpcspe ppc64 ppc64el riscv64 s390x sparc sparc64 x32
--Multi-Arch: foreign
--Depends: ${shlibs:Depends}, ${misc:Depends}, qemu-system-common (= ${binary:Version}), qemu-system-data (>> ${source:Upstream-Version}~),
--Recommends: qemu-system-gui (= ${binary:Version}), qemu-utils,
--# ppc targets use vgabios-stdvga and bootroms
-- seabios, ipxe-qemu,
-- qemu-block-extra (= ${binary:Version}),
--Suggests: samba, vde2,
--Provides: qemu-kvm [linux-ppc64 linux-ppc64el linux-powerpc], ${sysprovides:ppc}
--Breaks:   qemu-kvm [linux-ppc64 linux-ppc64el linux-powerpc]
--Replaces: qemu-kvm [linux-ppc64 linux-ppc64el linux-powerpc]
--Description: QEMU full system emulation binaries (ppc)
-- QEMU is a fast processor emulator: currently the package supports
-- PowerPC emulation. By using dynamic translation it achieves
-- reasonable speed while being easy to port on new host CPUs.
-- .
-- This package provides the full system emulation binaries to emulate
-- the following PowerPC hardware: ${sysarch:ppc}.
-- .
-- In system emulation mode QEMU emulates a full system, including a processor
-- and various peripherals.  It enables easier testing and debugging of system
-- code.  It can also be used to provide virtual hosting of several virtual
-- machines on a single server.
--
--Package: qemu-system-sparc
--Architecture: amd64 arm arm64 armel armhf i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel mips64 mips64el powerpc powerpcspe ppc64 ppc64el riscv64 s390x sparc sparc64 x32
--Multi-Arch: foreign
--Depends: ${shlibs:Depends}, ${misc:Depends}, qemu-system-common (= ${binary:Version}), qemu-system-data (>> ${source:Upstream-Version}~),
--Recommends: qemu-system-gui (= ${binary:Version}), qemu-utils,
--# sparc64 uses vgabios-stdvga and bootroms
-- seabios, ipxe-qemu,
-- qemu-block-extra (= ${binary:Version}),
--Suggests: samba, vde2,
--Provides: ${sysprovides:sparc}
--Description: QEMU full system emulation binaries (sparc)
-- QEMU is a fast processor emulator: currently the package supports
-- SPARC emulation. By using dynamic translation it achieves
-- reasonable speed while being easy to port on new host CPUs.
-- .
-- This package provides the full system emulation binaries to emulate
-- the following sparc hardware: ${sysarch:sparc}.
-- .
-- In system emulation mode QEMU emulates a full system, including a processor
-- and various peripherals.  It enables easier testing and debugging of system
-- code.  It can also be used to provide virtual hosting of several virtual
-- machines on a single server.
--
--Package: qemu-system-x86
--Architecture: amd64 arm arm64 armel armhf i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel mips64 mips64el powerpc powerpcspe ppc64 ppc64el riscv64 s390x sparc sparc64 x32
--Multi-Arch: foreign
--Depends: ${shlibs:Depends}, ${misc:Depends}, qemu-system-common (= ${binary:Version}), qemu-system-data (>> ${source:Upstream-Version}~),
-- seabios, ipxe-qemu,
--Recommends: qemu-system-gui (= ${binary:Version}), qemu-utils,
-- ovmf,
-- qemu-block-extra (= ${binary:Version}),
--Suggests: samba, vde2,
--Provides: qemu-kvm [linux-amd64 linux-i386], ${sysprovides:x86}
--Breaks:   qemu-kvm [linux-amd64 linux-i386]
--Replaces: qemu-kvm [linux-amd64 linux-i386]
--Description: QEMU full system emulation binaries (x86)
-- QEMU is a fast processor emulator: currently the package supports
-- i386 and x86-64 emulation. By using dynamic translation it achieves
-- reasonable speed while being easy to port on new host CPUs.
-- .
-- This package provides the full system emulation binaries to emulate
-- the following x86 hardware: ${sysarch:x86}.
-- .
-- In system emulation mode QEMU emulates a full system, including a processor
-- and various peripherals.  It enables easier testing and debugging of system
-- code.  It can also be used to provide virtual hosting of several virtual
-- machines on a single server.
-- .
-- On x86 host hardware this package also enables KVM kernel virtual machine
-- usage on systems which supports it.
--
--Package: qemu-system-xen
--Architecture: amd64
--Multi-Arch: no
--# do we really need qemu-system-data? keymaps only?
--Depends: ${shlibs:Depends}, ${misc:Depends}, qemu-system-data (>> ${source:Upstream-Version}~),
-- seabios, ipxe-qemu
--Recommends: qemu-utils,
-- ovmf,
--Description: QEMU full system emulation (Xen helper package)
-- This package provides the i386 system emulation binary to work
-- together with the Xen hypervisor for some types of DomUs.
-- This package is not useful by its own.
--
--Package: qemu-user
--Architecture: amd64 arm arm64 armel armhf i386 mips mipsel mips64 mips64el ppc64 ppc64el riscv64 s390x sparc sparc64 x32
--Multi-Arch: foreign
--Depends: ${shlibs:Depends}, ${misc:Depends}
--Recommends: qemu-user-binfmt
--Description: QEMU user mode emulation binaries
-- QEMU is a fast processor emulator: currently the package supports
-- ARM, CRIS, i386, M68k (ColdFire), MicroBlaze, MIPS, PowerPC, SH4,
-- SPARC and x86-64 emulation. By using dynamic translation it achieves
-- reasonable speed while being easy to port on new host CPUs.
-- .
-- This package provides the user mode emulation binaries. In this mode
-- QEMU can launch Linux processes compiled for one CPU on another CPU.
-- .
-- If qemu-user-binfmt package is also installed, it will register binary
-- format handlers from this qemu-user package with the kernel so it will
-- be possible to run foreign binaries directly.  However, this might not
-- be suitable for using inside foreign chroots, in which case it is
-- possible to use qemu-user-static package instead of qemu-user-binmft, --
-- qemu-user-static will register statically linked binfmt handlers instead.
--
--Package: qemu-user-static
--Architecture: amd64 arm arm64 armel armhf i386 mips mipsel mips64 mips64el ppc64 ppc64el riscv64 s390x sparc sparc64 x32
--Built-Using: ${built-using}
--Multi-Arch: foreign
--Depends: ${misc:Depends}
--Recommends: systemd | binfmt-support
--Breaks: binfmt-support (<< 2.1.7~)
--Provides: qemu-user-binfmt
--Conflicts: qemu-user-binfmt
--Description: QEMU user mode emulation binaries (static version)
-- QEMU is a fast processor emulator: currently the package supports
-- ARM, CRIS, i386, M68k (ColdFire), MicroBlaze, MIPS, PowerPC, SH4,
-- SPARC and x86-64 emulation. By using dynamic translation it achieves
-- reasonable speed while being easy to port on new host CPUs.
-- .
-- This package provides the user mode emulation binaries, built
-- statically. In this mode QEMU can launch Linux processes compiled for
-- one CPU on another CPU.
-- .
-- qemu-user-static package will register binary formats which the provided
-- emulators can handle, so that it will be possible to run foreign binaries
-- directly.
-+#Package: qemu-system-mips
-+#Architecture: amd64 arm arm64 armel armhf i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel mips64 mips64el powerpc powerpcspe ppc64 ppc64el riscv64 s390x sparc sparc64 x32
-+#Multi-Arch: foreign
-+#Depends: ${shlibs:Depends}, ${misc:Depends}, qemu-system-common (= ${binary:Version}), qemu-system-data (>> ${source:Upstream-Version}~),
-+#Recommends: qemu-system-gui (= ${binary:Version}), qemu-utils,
-+## all mips targets uses vgabios and bootroms
-+# seabios, ipxe-qemu,
-+# qemu-block-extra (= ${binary:Version}),
-+#Suggests: samba, vde2,
-+#Provides: ${sysprovides:mips}
-+#Description: QEMU full system emulation binaries (mips)
-+# QEMU is a fast processor emulator: currently the package supports
-+# MIPS emulation. By using dynamic translation it achieves
-+# reasonable speed while being easy to port on new host CPUs.
-+# .
-+# This package provides the full system emulation binaries to emulate
-+# the following mips hardware: ${sysarch:mips}.
-+# .
-+# In system emulation mode QEMU emulates a full system, including a processor
-+# and various peripherals.  It enables easier testing and debugging of system
-+# code.  It can also be used to provide virtual hosting of several virtual
-+# machines on a single server.
-+#
-+#Package: qemu-system-ppc
-+#Architecture: amd64 arm arm64 armel armhf i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel mips64 mips64el powerpc powerpcspe ppc64 ppc64el riscv64 s390x sparc sparc64 x32
-+#Multi-Arch: foreign
-+#Depends: ${shlibs:Depends}, ${misc:Depends}, qemu-system-common (= ${binary:Version}), qemu-system-data (>> ${source:Upstream-Version}~),
-+#Recommends: qemu-system-gui (= ${binary:Version}), qemu-utils,
-+## ppc targets use vgabios-stdvga and bootroms
-+# seabios, ipxe-qemu,
-+# qemu-block-extra (= ${binary:Version}),
-+#Suggests: samba, vde2,
-+#Provides: qemu-kvm [linux-ppc64 linux-ppc64el linux-powerpc], ${sysprovides:ppc}
-+#Breaks:   qemu-kvm [linux-ppc64 linux-ppc64el linux-powerpc]
-+#Replaces: qemu-kvm [linux-ppc64 linux-ppc64el linux-powerpc]
-+#Description: QEMU full system emulation binaries (ppc)
-+# QEMU is a fast processor emulator: currently the package supports
-+# PowerPC emulation. By using dynamic translation it achieves
-+# reasonable speed while being easy to port on new host CPUs.
-+# .
-+# This package provides the full system emulation binaries to emulate
-+# the following PowerPC hardware: ${sysarch:ppc}.
-+# .
-+# In system emulation mode QEMU emulates a full system, including a processor
-+# and various peripherals.  It enables easier testing and debugging of system
-+# code.  It can also be used to provide virtual hosting of several virtual
-+# machines on a single server.
-+#
-+#Package: qemu-system-sparc
-+#Architecture: amd64 arm arm64 armel armhf i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel mips64 mips64el powerpc powerpcspe ppc64 ppc64el riscv64 s390x sparc sparc64 x32
-+#Multi-Arch: foreign
-+#Depends: ${shlibs:Depends}, ${misc:Depends}, qemu-system-common (= ${binary:Version}), qemu-system-data (>> ${source:Upstream-Version}~),
-+#Recommends: qemu-system-gui (= ${binary:Version}), qemu-utils,
-+## sparc64 uses vgabios-stdvga and bootroms
-+# seabios, ipxe-qemu,
-+# qemu-block-extra (= ${binary:Version}),
-+#Suggests: samba, vde2,
-+#Provides: ${sysprovides:sparc}
-+#Description: QEMU full system emulation binaries (sparc)
-+# QEMU is a fast processor emulator: currently the package supports
-+# SPARC emulation. By using dynamic translation it achieves
-+# reasonable speed while being easy to port on new host CPUs.
-+# .
-+# This package provides the full system emulation binaries to emulate
-+# the following sparc hardware: ${sysarch:sparc}.
-+# .
-+# In system emulation mode QEMU emulates a full system, including a processor
-+# and various peripherals.  It enables easier testing and debugging of system
-+# code.  It can also be used to provide virtual hosting of several virtual
-+# machines on a single server.
-+#
-+#Package: qemu-system-x86
-+#Architecture: amd64 arm arm64 armel armhf i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel mips64 mips64el powerpc powerpcspe ppc64 ppc64el riscv64 s390x sparc sparc64 x32
-+#Multi-Arch: foreign
-+#Depends: ${shlibs:Depends}, ${misc:Depends}, qemu-system-common (= ${binary:Version}), qemu-system-data (>> ${source:Upstream-Version}~),
-+# seabios, ipxe-qemu,
-+#Recommends: qemu-system-gui (= ${binary:Version}), qemu-utils,
-+# ovmf,
-+# qemu-block-extra (= ${binary:Version}),
-+#Suggests: samba, vde2,
-+#Provides: qemu-kvm [linux-amd64 linux-i386], ${sysprovides:x86}
-+#Breaks:   qemu-kvm [linux-amd64 linux-i386]
-+#Replaces: qemu-kvm [linux-amd64 linux-i386]
-+#Description: QEMU full system emulation binaries (x86)
-+# QEMU is a fast processor emulator: currently the package supports
-+# i386 and x86-64 emulation. By using dynamic translation it achieves
-+# reasonable speed while being easy to port on new host CPUs.
-+# .
-+# This package provides the full system emulation binaries to emulate
-+# the following x86 hardware: ${sysarch:x86}.
-+# .
-+# In system emulation mode QEMU emulates a full system, including a processor
-+# and various peripherals.  It enables easier testing and debugging of system
-+# code.  It can also be used to provide virtual hosting of several virtual
-+# machines on a single server.
-+# .
-+# On x86 host hardware this package also enables KVM kernel virtual machine
-+# usage on systems which supports it.
-+#
-+#Package: qemu-system-xen
-+#Architecture: amd64
-+#Multi-Arch: no
-+## do we really need qemu-system-data? keymaps only?
-+#Depends: ${shlibs:Depends}, ${misc:Depends}, qemu-system-data (>> ${source:Upstream-Version}~),
-+# seabios, ipxe-qemu
-+#Recommends: qemu-utils,
-+# ovmf,
-+#Description: QEMU full system emulation (Xen helper package)
-+# This package provides the i386 system emulation binary to work
-+# together with the Xen hypervisor for some types of DomUs.
-+# This package is not useful by its own.
- 
--Package: qemu-user-binfmt
--Architecture: amd64 arm arm64 armel armhf i386 mips mipsel mips64 mips64el ppc64 ppc64el riscv64 s390x sparc sparc64 x32
--Multi-Arch: foreign
--Depends: ${misc:Depends}, qemu-user (= ${binary:Version}), systemd | binfmt-support
--Breaks: binfmt-support (<< 2.1.7~)
--Conflicts: qemu-user-static
--Description: QEMU user mode binfmt registration for qemu-user
-- QEMU is a fast processor emulator: currently the package supports
-- ARM, CRIS, i386, M68k (ColdFire), MicroBlaze, MIPS, PowerPC, SH4,
-- SPARC and x86-64 emulation. By using dynamic translation it achieves
-- reasonable speed while being easy to port on new host CPUs.
-- .
-- This package provides binfmt support registration for the user mode
-- emulation binaries from qemu-user.  This is an empty package, it does
-- not contain any additional files, only registration scripts which run
-- at install and remove times.
-+#Package: qemu-user
-+#Architecture: amd64 arm arm64 armel armhf i386 mips mipsel mips64 mips64el ppc64 ppc64el riscv64 s390x sparc sparc64 x32
-+#Multi-Arch: foreign
-+#Depends: ${shlibs:Depends}, ${misc:Depends}
-+#Recommends: qemu-user-binfmt
-+#Description: QEMU user mode emulation binaries
-+# QEMU is a fast processor emulator: currently the package supports
-+# ARM, CRIS, i386, M68k (ColdFire), MicroBlaze, MIPS, PowerPC, SH4,
-+# SPARC and x86-64 emulation. By using dynamic translation it achieves
-+# reasonable speed while being easy to port on new host CPUs.
-+# .
-+# This package provides the user mode emulation binaries. In this mode
-+# QEMU can launch Linux processes compiled for one CPU on another CPU.
-+# .
-+# If qemu-user-binfmt package is also installed, it will register binary
-+# format handlers from this qemu-user package with the kernel so it will
-+# be possible to run foreign binaries directly.  However, this might not
-+# be suitable for using inside foreign chroots, in which case it is
-+# possible to use qemu-user-static package instead of qemu-user-binmft, --
-+# qemu-user-static will register statically linked binfmt handlers instead.
-+#
-+#Package: qemu-user-static
-+#Architecture: amd64 arm arm64 armel armhf i386 mips mipsel mips64 mips64el ppc64 ppc64el riscv64 s390x sparc sparc64 x32
-+#Built-Using: ${built-using}
-+#Multi-Arch: foreign
-+#Depends: ${misc:Depends}
-+#Recommends: systemd | binfmt-support
-+#Breaks: binfmt-support (<< 2.1.7~)
-+#Provides: qemu-user-binfmt
-+#Conflicts: qemu-user-binfmt
-+#Description: QEMU user mode emulation binaries (static version)
-+# QEMU is a fast processor emulator: currently the package supports
-+# ARM, CRIS, i386, M68k (ColdFire), MicroBlaze, MIPS, PowerPC, SH4,
-+# SPARC and x86-64 emulation. By using dynamic translation it achieves
-+# reasonable speed while being easy to port on new host CPUs.
-+# .
-+# This package provides the user mode emulation binaries, built
-+# statically. In this mode QEMU can launch Linux processes compiled for
-+# one CPU on another CPU.
-+# .
-+# qemu-user-static package will register binary formats which the provided
-+# emulators can handle, so that it will be possible to run foreign binaries
-+# directly.
-+#
-+#Package: qemu-user-binfmt
-+#Architecture: amd64 arm arm64 armel armhf i386 mips mipsel mips64 mips64el ppc64 ppc64el riscv64 s390x sparc sparc64 x32
-+#Multi-Arch: foreign
-+#Depends: ${misc:Depends}, qemu-user (= ${binary:Version}), systemd | binfmt-support
-+#Breaks: binfmt-support (<< 2.1.7~)
-+#Conflicts: qemu-user-static
-+#Description: QEMU user mode binfmt registration for qemu-user
-+# QEMU is a fast processor emulator: currently the package supports
-+# ARM, CRIS, i386, M68k (ColdFire), MicroBlaze, MIPS, PowerPC, SH4,
-+# SPARC and x86-64 emulation. By using dynamic translation it achieves
-+# reasonable speed while being easy to port on new host CPUs.
-+# .
-+# This package provides binfmt support registration for the user mode
-+# emulation binaries from qemu-user.  This is an empty package, it does
-+# not contain any additional files, only registration scripts which run
-+# at install and remove times.
- 
- Package: qemu-utils
- Architecture: amd64 arm arm64 armel armhf hppa i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel mips64 mips64el powerpc powerpcspe ppc64 ppc64el riscv64 s390x sparc sparc64 x32
- Multi-Arch: foreign
- Breaks: qemu-system-common (<< 1:3.1+dfsg-3~)
- Depends: ${shlibs:Depends}, ${misc:Depends},
--Recommends:
-- qemu-block-extra (= ${binary:Version}),
-+#Recommends:
-+# qemu-block-extra (= ${binary:Version}),
- Description: QEMU utilities
-  QEMU is a fast processor emulator: currently the package supports
-  ARM, CRIS, i386, M68k (ColdFire), MicroBlaze, MIPS, PowerPC, SH4,
---- qemu-7.2+dfsg-orig/debian/rules	2024-02-06 09:34:37.000000000 -0800
-+++ qemu-7.2+dfsg/debian/rules	2024-06-17 09:59:57.180637423 -0700
-@@ -85,12 +85,14 @@
- 
- # list of system (softmmu) targets, from ./configure
- system_targets = \
-- i386 x86_64 alpha aarch64 arm avr cris hppa m68k loongarch64 microblaze microblazeel \
-- mips mipsel mips64 mips64el nios2 or1k ppc ppc64 riscv32 riscv64 rx \
-- sh4 sh4eb sparc sparc64 s390x tricore xtensa xtensaeb
-+ aarch64
-+# i386 x86_64 alpha aarch64 arm avr cris hppa m68k loongarch64 microblaze microblazeel \
-+# mips mipsel mips64 mips64el nios2 or1k ppc ppc64 riscv32 riscv64 rx \
-+# sh4 sh4eb sparc sparc64 s390x tricore xtensa xtensaeb
- 
- # qemu-system subpackages, from d/control
--sys_systems = arm mips ppc sparc x86 $(if $(filter ${VENDOR},UBUNTU),s390x,)
-+#sys_systems = arm mips ppc sparc x86 $(if $(filter ${VENDOR},UBUNTU),s390x,)
-+sys_systems = arm
- systems = ${sys_systems} misc
- sysarch_arm   = $(filter aarch64 arm,${system_targets})
- sysarch_mips  = $(filter mips mipsel mips64 mips64el,${system_targets})
-@@ -110,10 +112,11 @@
- 
- # list of linux-user targets, from ./configure
- user_targets = \
-- i386 x86_64 alpha aarch64 aarch64_be arm armeb cris hexagon hppa \
-- loongarch64 m68k microblaze microblazeel \
-- mips mipsel mips64 mips64el mipsn32 mipsn32el nios2 or1k \
-- ppc ppc64 ppc64le riscv32 riscv64 sh4 sh4eb sparc sparc64 sparc32plus \
-+ # (none)
-+# i386 x86_64 alpha aarch64 aarch64_be arm armeb cris hexagon hppa \
-+# loongarch64 m68k microblaze microblazeel \
-+# mips mipsel mips64 mips64el mipsn32 mipsn32el nios2 or1k \
-+# ppc ppc64 ppc64le riscv32 riscv64 sh4 sh4eb sparc sparc64 sparc32plus \
-  s390x xtensa xtensaeb
- 
- endif	# enable_linux_user
-@@ -132,6 +135,7 @@
- 	    ../../configure ${common_configure_opts} --disable-user \
- 		--${enable_system}-system \
- 		--${enable_linux_user}-linux-user \
-+		--target-list=aarch64-softmmu \
- 		--disable-xen \
- 		--enable-modules \
- 		--enable-module-upgrades \
-@@ -177,17 +181,17 @@
- 
- # save block-extra loadable modules on upgrades
- # other module types for now (5.0) can't be loaded at runtime, only at startup
--	echo 'case $$1 in (upgrade|deconfigure) [ -d /run/qemu ] || exit 0; ! findmnt --noheadings --target /run/qemu/ | grep -q noexec || exit 0; mkdir -p ${SAVEMODDIR}; cp -p ${libdir}/qemu/block-*.so ${SAVEMODDIR}/;; esac' \
--	  >> debian/qemu-block-extra.prerm.debhelper
--	echo 'case $$1 in (remove) rm -f ${SAVEMODDIR}/block-*.so;; esac' \
--	  >> debian/qemu-block-extra.postrm.debhelper
--	echo 'case $$1 in (purge) if systemctl is-active -q run-qemu.mount; then systemctl stop run-qemu.mount || true; fi; rm -rf "/run/qemu";; esac' \
--	  >> debian/qemu-block-extra.postrm.debhelper
-+	#echo 'case $$1 in (upgrade|deconfigure) [ -d /run/qemu ] || exit 0; ! findmnt --noheadings --target /run/qemu/ | grep -q noexec || exit 0; mkdir -p ${SAVEMODDIR}; cp -p ${libdir}/qemu/block-*.so ${SAVEMODDIR}/;; esac' \
-+	#  >> debian/qemu-block-extra.prerm.debhelper
-+	#echo 'case $$1 in (remove) rm -f ${SAVEMODDIR}/block-*.so;; esac' \
-+	#  >> debian/qemu-block-extra.postrm.debhelper
-+	#echo 'case $$1 in (purge) if systemctl is-active -q run-qemu.mount; then systemctl stop run-qemu.mount || true; fi; rm -rf "/run/qemu";; esac' \
-+	#  >> debian/qemu-block-extra.postrm.debhelper
- 
- ifeq (${enable_system},enable)
- 
- 	# qemu-system subpackages
--	mv debian/tmp/usr/share/man/man1/qemu.1 debian/tmp/usr/share/man/man1/qemu-system.1
-+	#mv debian/tmp/usr/share/man/man1/qemu.1 debian/tmp/usr/share/man/man1/qemu-system.1
- 	$(foreach s,${systems},$(call inst-system,$s))
- 
- # gui modules. We move these here instead of using d/qemu-system-gui.install,
-@@ -195,28 +199,28 @@
- # audio-pa.so pulls in X11 so we move it into -system-gui too
- # hw-display-virtio-gpu-gl also pulls in X11, move it to -gui
- 	mkdir -p debian/qemu-system-gui${libdir}/qemu
--	mv -t debian/qemu-system-gui${libdir}/qemu/ \
--		debian/tmp${libdir}/qemu/ui-gtk.so \
--		debian/tmp${libdir}/qemu/ui-sdl.so \
--		debian/tmp${libdir}/qemu/audio-jack.so \
--		debian/tmp${libdir}/qemu/audio-sdl.so \
--		debian/tmp${libdir}/qemu/audio-pa.so \
--		debian/tmp${libdir}/qemu/hw-display-virtio-gpu-gl.so \
-+	#mv -t debian/qemu-system-gui${libdir}/qemu/ \
-+	#	debian/tmp${libdir}/qemu/ui-gtk.so \
-+	#	debian/tmp${libdir}/qemu/ui-sdl.so \
-+	#	debian/tmp${libdir}/qemu/audio-jack.so \
-+	#	debian/tmp${libdir}/qemu/audio-sdl.so \
-+	#	debian/tmp${libdir}/qemu/audio-pa.so \
-+	#	debian/tmp${libdir}/qemu/hw-display-virtio-gpu-gl.so \
- 
- ifeq ($(DEB_HOST_ARCH_OS),linux)
- 
- # /usr/bin/kvm handy link multi-arch from old qemu-kvm package
- # on i386, should we link to qemu-system-i386? how about x32?
--ifneq ($(filter ${DEB_HOST_ARCH},amd64 i386),)
--	$(call inst-kvm-link,qemu-system-x86,x86_64)
--ifeq (${VENDOR},UBUNTU)
--# on ubuntu *-spice existed, may be used in libvirt xml and scripts - keep links for compatibility
--# The sunset for this will be when Ubuntu-Bionic goes out of support which is expected to happen in 2028
--	install -p -t debian/qemu-system-x86/usr/bin debian/kvm-spice debian/qemu-system-x86_64-spice
--	install -p -t debian/qemu-system-x86/usr/share/man/man1/ debian/kvm-spice.1
--	echo ".so man1/kvm-spice.1" > debian/qemu-system-x86/usr/share/man/man1/qemu-system-x86_64-spice.1
--endif
--endif
-+#ifneq ($(filter ${DEB_HOST_ARCH},amd64 i386),)
-+#	$(call inst-kvm-link,qemu-system-x86,x86_64)
-+#ifeq (${VENDOR},UBUNTU)
-+## on ubuntu *-spice existed, may be used in libvirt xml and scripts - keep links for compatibility
-+## The sunset for this will be when Ubuntu-Bionic goes out of support which is expected to happen in 2028
-+#	install -p -t debian/qemu-system-x86/usr/bin debian/kvm-spice debian/qemu-system-x86_64-spice
-+#	install -p -t debian/qemu-system-x86/usr/share/man/man1/ debian/kvm-spice.1
-+#	echo ".so man1/kvm-spice.1" > debian/qemu-system-x86/usr/share/man/man1/qemu-system-x86_64-spice.1
-+#endif
-+#endif
- 	$(if $(filter ${DEB_HOST_ARCH},arm64), $(call inst-kvm-link,qemu-system-arm,aarch64))
- 	$(if $(filter ${DEB_HOST_ARCH},armhf armel), $(call inst-kvm-link,qemu-system-arm,arm))
- 	$(if $(filter ${DEB_HOST_ARCH},ppc64 ppc64el), $(call inst-kvm-link,qemu-system-ppc,ppc64))
-@@ -227,18 +231,20 @@
- 		 debian/source_qemu.py
- endif
- 
--ifeq (DEBIAN-amd64,${VENDOR}-${DEB_HOST_ARCH})
--# do it for bookworm only, remove the wrapper for bookworm+
--	mkdir -p debian/qemu-system-x86/usr/libexec/
--	mv debian/qemu-system-x86/usr/bin/qemu-system-i386 \
--	   debian/qemu-system-x86/usr/libexec/qemu-system-i386
--	install -pm0755 debian/qemu-system-i386.xen-wrapper \
--	   debian/qemu-system-x86/usr/bin/qemu-system-i386
--endif
-+#ifeq (DEBIAN-amd64,${VENDOR}-${DEB_HOST_ARCH})
-+## do it for bookworm only, remove the wrapper for bookworm+
-+#	mkdir -p debian/qemu-system-x86/usr/libexec/
-+#	mv debian/qemu-system-x86/usr/bin/qemu-system-i386 \
-+#	   debian/qemu-system-x86/usr/libexec/qemu-system-i386
-+#	install -pm0755 debian/qemu-system-i386.xen-wrapper \
-+#	   debian/qemu-system-x86/usr/bin/qemu-system-i386
-+#endif
- 
- # virtfs-proxy-helper and qemu-bridge-helper are linux-specific
-+	#for f in usr/lib/qemu/virtfs-proxy-helper \
-+	#         usr/share/man/man1/virtfs-proxy-helper.1 \
-+	#	 usr/lib/qemu/qemu-bridge-helper
- 	for f in usr/lib/qemu/virtfs-proxy-helper \
--	         usr/share/man/man1/virtfs-proxy-helper.1 \
- 		 usr/lib/qemu/qemu-bridge-helper \
- 	; do \
- 	  mkdir -p debian/qemu-system-common/$${f%/*} ; \
-@@ -248,8 +254,10 @@
- ifneq (${DEB_HOST_ARCH},sparc64)
- # virtiofsd needs libseccomp which is not ported to sparc (not even the kernel part),
- # so install it only on non-sparc
-+	#for f in usr/lib/qemu/virtiofsd \
-+	#	 usr/share/man/man1/virtiofsd.1 \
-+	#	 usr/share/qemu/vhost-user/50-qemu-virtiofsd.json
- 	for f in usr/lib/qemu/virtiofsd \
--		 usr/share/man/man1/virtiofsd.1 \
- 		 usr/share/qemu/vhost-user/50-qemu-virtiofsd.json \
- 	; do \
- 	  mkdir -p debian/qemu-system-common/$${f%/*} ; \
-@@ -258,7 +266,7 @@
- endif
- 
- # for --enable-module-upgrades to work in more environments
--	install -D -m 0644 debian/run-qemu.mount debian/qemu-block-extra/lib/systemd/system/run-qemu.mount
-+	#install -D -m 0644 debian/run-qemu.mount debian/qemu-block-extra/lib/systemd/system/run-qemu.mount
- 
- endif # linux
- 
-@@ -313,7 +321,7 @@
- 	echo ".so man1/qemu-system.1" > debian/qemu-system-x86/usr/share/man/man1/qemu-system-x86_64-microvm.1
- # build microvm on amd64 only if system build is enabled
- ifeq ($(filter-out $(DEB_HOST_ARCH),amd64)${enable_system},enable)
--qemu-builds += microvm
-+#qemu-builds += microvm
- endif
- 
- ##############################################
-@@ -345,7 +353,7 @@
- 	install -D b/xen/qemu-system-i386 \
- 	  debian/qemu-system-xen${QEMU_XEN}
- ifeq (${DEB_HOST_ARCH}-${enable_system},amd64-enable)
--qemu-builds += xen
-+#qemu-builds += xen
- endif
- 
- ##############################################
-@@ -384,7 +392,7 @@
- 	done
- 	./debian/binfmt-install qemu-user-static
- ifeq ($(enable_linux_user),enable)
--qemu-builds += user-static
-+#qemu-builds += user-static
- endif
- 
- ##############################################
-@@ -400,18 +408,18 @@
- override_dh_auto_install-arch: $(addprefix install-, ${qemu-builds})
- 
- override_dh_installdocs:
--	dh_installdocs -Nqemu-user-binfmt
--	dh_installdocs -pqemu-user-binfmt --link-doc=qemu-user
-+	#dh_installdocs -Nqemu-user-binfmt
-+	#dh_installdocs -pqemu-user-binfmt --link-doc=qemu-user
- override_dh_installchangelogs:
--	dh_installchangelogs -Nqemu-user-binfmt
-+	#dh_installchangelogs -Nqemu-user-binfmt
- override_dh_installinit:
- 	dh_installinit -pqemu-guest-agent
- override_dh_installsystemd:
- 	dh_installsystemd -pqemu-guest-agent --no-enable
- # default-enable /run/qemu mount only on ubuntu,
- # on debian let it be manually controlled and off by default
--	dh_installsystemd -pqemu-block-extra --no-restart-on-upgrade --name=run-qemu.mount \
--		$(if $(filter ${VENDOR},DEBIAN),--no-start --no-enable,)
-+	#dh_installsystemd -pqemu-block-extra --no-restart-on-upgrade --name=run-qemu.mount \
-+	#	$(if $(filter ${VENDOR},DEBIAN),--no-start --no-enable,)
- execute_after_dh_shlibdeps:
- ifeq ($(enable_linux_user),enable)
- # after shlibdeps finished, grab ${shlibs:Depends} from -user package
-@@ -458,7 +466,7 @@
- 		b/openbios/obj-sparc32/QEMU,tcx.bin \
- 		b/openbios/obj-sparc32/QEMU,cgthree.bin \
- 		b/openbios/obj-sparc64/QEMU,VGA.bin
--sysdata-components += openbios
-+#sysdata-components += openbios
- 
- ### powernv firmware in roms/skiboot
- build-skiboot: b/skiboot/skiboot.lid
-@@ -474,7 +482,7 @@
- 	  CROSS_COMPILE=${PPC64_CROSSPFX} V=${V}
- install-skiboot: b/skiboot/skiboot.lid
- 	install -m 0644 -t ${sysdataidir} $<
--sysdata-components += skiboot
-+#sysdata-components += skiboot
- 
- build-vof: b/vof/vof.bin
- b/vof/vof.bin: | b
-@@ -483,7 +491,7 @@
- 	${MAKE} -C b/vof CROSS=${PPC64_CROSSPFX} SRC_DIR=../../pc-bios/vof -f../../pc-bios/vof/Makefile
- install-vof: b/vof/vof.bin
- 	install -m 0644 -t ${sysdataidir} $<
--sysdata-components += vof
-+#sysdata-components += vof
- 
- ### x86 optionrom
- build-x86-optionrom: b/optionrom/built
-@@ -493,7 +501,7 @@
- 	touch $@
- install-x86-optionrom: build-x86-optionrom | ${sysdataidir}
- 	${MAKE} -f ${CURDIR}/debian/optionrom.mak -C b/optionrom SRC_PATH="${CURDIR}" install DESTDIR="${CURDIR}/${sysdataidir}"
--sysdata-components += x86-optionrom
-+#sysdata-components += x86-optionrom
- 
- ### sgabios.
- # The Makefile is too complex and forces current date to be embedded to binary
-@@ -510,7 +518,7 @@
- 	b/sgabios/csum8 b/sgabios/sgabios.bin
- install-sgabios: b/sgabios/sgabios.bin
- 	install -m 0644 $< ${sysdataidir}/sgabios.bin
--sysdata-components += sgabios
-+#sysdata-components += sgabios
- 
- ### qboot, aka bios-microvm
- build-qboot: b/qboot/bios.bin
-@@ -522,7 +530,7 @@
- 	install -m 0644 $< ${sysdataidir}/qboot.rom
- 	# 5.0 & 5.1 compat symlink, can go for bullseye final
- 	ln -s qboot.rom ${sysdataidir}/bios-microvm.bin
--sysdata-components += qboot
-+#sysdata-components += qboot
- 
- ### alpha firmware in roms/palcode-clipper
- build-palcode-clipper: b/qemu-palcode/palcode-clipper
-@@ -534,7 +542,7 @@
- 	${ALPHAEV67_CROSSPFX}strip b/qemu-palcode/palcode-clipper
- install-palcode-clipper: b/qemu-palcode/palcode-clipper
- 	install -m 0644 $< ${sysdataidir}/palcode-clipper
--sysdata-components += palcode-clipper
-+#sysdata-components += palcode-clipper
- 
- ### SLOF
- build-slof: b/SLOF/boot_rom.bin
-@@ -543,7 +551,7 @@
- 	env -u LDFLAGS -u CFLAGS $(MAKE) -C b/SLOF qemu CROSS=${PPC64_CROSSPFX} V=${V}
- install-slof: b/SLOF/boot_rom.bin
- 	install -m 0644 $< ${sysdataidir}/slof.bin
--sysdata-components += slof
-+#sysdata-components += slof
- 
- ### s390x firmware in pc-bios/s390-ccw
- build-s390x-fw: b/s390fw/built
-@@ -553,7 +561,7 @@
- 	touch $@
- install-s390x-fw: build-s390x-fw
- 	install -m 0644 -t ${sysdataidir} b/s390fw/s390*.img
--sysdata-components += s390x-fw
-+#sysdata-components += s390x-fw
- 
- ### hppa-firmware (roms/seabios-hppa)
- build-hppa-fw: b/hppafw/hppa-firmware.img
-@@ -565,7 +573,7 @@
- 	hppa-linux-gnu-strip -R.note -R.comment $@
- install-hppa-fw: b/hppafw/hppa-firmware.img
- 	install -m 0644 $< ${sysdataidir}
--sysdata-components += hppa-fw
-+#sysdata-components += hppa-fw
- 
- ### opensbi (riscv firmware)
- # we only build v64 variants, not v32
-@@ -578,7 +586,7 @@
- install-opensbi: build-opensbi
- 	install -m 0644 b/opensbi/platform/generic/firmware/fw_dynamic.bin ${sysdataidir}/opensbi-riscv64-generic-fw_dynamic.bin
- 	install -m 0644 b/opensbi/platform/generic/firmware/fw_dynamic.elf ${sysdataidir}/opensbi-riscv64-generic-fw_dynamic.elf
--sysdata-components += opensbi
-+#sysdata-components += opensbi
- 
- ### vbootrom (npcm7xx)
- build-vbootrom: b/vbootrom/.built
-@@ -588,7 +596,7 @@
- 	touch $@
- install-vbootrom: build-vbootrom
- 	install -m 0644 b/vbootrom/npcm7xx_bootrom.bin ${sysdataidir}/
--sysdata-components += vbootrom
-+#sysdata-components += vbootrom
- 
- ### misc firmware
- build-misc: b/misc/.built
-@@ -600,7 +608,7 @@
- install-misc: build-misc
- 	install -m 0644 b/misc/bamboo.dtb b/misc/canyonlands.dtb \
- 		${sysdataidir}
--sysdata-components += misc
-+#sysdata-components += misc
- 
- ${sysdataidir}:
- 	mkdir -p -m 0755 $@
---- qemu-7.2+dfsg-orig/debian/qemu-guest-agent.install  2024-02-06 09:34:37.000000000 -0800
-+++ qemu-7.2+dfsg/debian/qemu-guest-agent.install       2024-06-13 14:18:36.246203287 -0700
-@@ -1,5 +1,5 @@
- debian/tmp/usr/bin/qemu-ga /usr/sbin
--debian/tmp/usr/share/man/man8/qemu-ga.8 /usr/share/man/man8
--debian/tmp/usr/share/man/man7/qemu-ga-ref.7 /usr/share/man/man7
-+#debian/tmp/usr/share/man/man8/qemu-ga.8 /usr/share/man/man8
-+#debian/tmp/usr/share/man/man7/qemu-ga-ref.7 /usr/share/man/man7
- qga/qapi-schema.json /usr/share/doc/qemu-guest-agent
- scripts/qemu-guest-agent/fsfreeze-hook /etc/qemu/
---- qemu-7.2+dfsg-orig/debian/qemu-system-common.install        2024-02-06 09:34:37.000000000 -0800
-+++ qemu-7.2+dfsg/debian/qemu-system-common.install     2024-06-13 14:15:02.593758280 -0700
-@@ -1,18 +1,18 @@
- debian/qemu-ifdown etc/
--debian/tmp/usr/share/man/man1/qemu-system.1
-+#debian/tmp/usr/share/man/man1/qemu-system.1
- debian/tmp/usr/share/qemu/trace-events-all
- debian/tmp/usr/bin/qemu-pr-helper
--debian/tmp/usr/share/man/man8/qemu-pr-helper.8
--debian/tmp/usr/share/man/man7/qemu-qmp-ref.7
--debian/tmp/usr/share/man/man7/qemu-block-drivers.7
--debian/tmp/usr/share/man/man7/qemu-cpu-models.7
--debian/tmp/usr/share/doc/qemu/system usr/share/doc/qemu-system-common
-+#debian/tmp/usr/share/man/man8/qemu-pr-helper.8
-+#debian/tmp/usr/share/man/man7/qemu-qmp-ref.7
-+#debian/tmp/usr/share/man/man7/qemu-block-drivers.7
-+#debian/tmp/usr/share/man/man7/qemu-cpu-models.7
-+#debian/tmp/usr/share/doc/qemu/system usr/share/doc/qemu-system-common
- debian/tmp/usr/bin/qemu-storage-daemon
--debian/tmp/usr/share/man/man1/qemu-storage-daemon.1
--debian/tmp/usr/share/man/man7/qemu-storage-daemon-qmp-ref.7
-+#debian/tmp/usr/share/man/man1/qemu-storage-daemon.1
-+#debian/tmp/usr/share/man/man7/qemu-storage-daemon-qmp-ref.7
- # common modules. gui modules has been moved into place in d/rules.
--debian/tmp/usr/lib/*/qemu/accel-tcg-*.so
-+#debian/tmp/usr/lib/*/qemu/accel-tcg-*.so
- debian/tmp/usr/lib/*/qemu/audio-*.so
--debian/tmp/usr/lib/*/qemu/chardev-*.so
-+#debian/tmp/usr/lib/*/qemu/chardev-*.so
- debian/tmp/usr/lib/*/qemu/hw-*.so
- debian/tmp/usr/lib/*/qemu/ui-*.so
---- qemu-7.2+dfsg-orig/debian/qemu-utils.install        2024-02-06 09:34:37.000000000 -0800
-+++ qemu-7.2+dfsg/debian/qemu-utils.install     2024-06-13 14:15:27.789183861 -0700
-@@ -1,5 +1,5 @@
- debian/tmp/usr/bin/qemu-img
--debian/tmp/usr/share/man/man1/qemu-img.1
-+#debian/tmp/usr/share/man/man1/qemu-img.1
- debian/tmp/usr/bin/qemu-nbd
--debian/tmp/usr/share/man/man8/qemu-nbd.8
-+#debian/tmp/usr/share/man/man8/qemu-nbd.8
- debian/tmp/usr/bin/qemu-io
diff --git a/src/pkvm_setup/qemu_patches/debian-version.patch b/src/pkvm_setup/qemu_patches/debian-version.patch
deleted file mode 100644
index e289d7ff..00000000
--- a/src/pkvm_setup/qemu_patches/debian-version.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-Add debian/changelog entries to bump the version to a VERSE-specific one.
-
---- qemu-7.2+dfsg-orig/debian/changelog	2024-02-06 09:38:06.000000000 -0800
-+++ qemu-7.2+dfsg/debian/changelog	2024-06-13 16:45:52.023386289 -0700
-@@ -1,3 +1,9 @@
-+qemu (1:7.2+dfsg-9999+verse1) bookworm; urgency=medium
-+
-+  * Initial VERSE OpenSUT build with limited featureset
-+
-+ -- Stuart Pernsteiner <spernsteiner@galois.com>  Thu, 13 Jun 2024 04:40:23 -0700
-+
- qemu (1:7.2+dfsg-7+deb12u5) bookworm; urgency=medium
- 
-   * +revert-monitor-only-run-coroutine-commands-in-qemu_aio_context.patch

From 777ca891e0e03e1e61199a6863865f74ad48675b Mon Sep 17 00:00:00 2001
From: Stuart Pernsteiner <spernsteiner@galois.com>
Date: Tue, 30 Jul 2024 10:34:16 -0700
Subject: [PATCH 5/9] pkvm_setup: update package.sh qemu defs

---
 src/pkvm_setup/package.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/pkvm_setup/package.sh b/src/pkvm_setup/package.sh
index 9909ce7d..83099b30 100644
--- a/src/pkvm_setup/package.sh
+++ b/src/pkvm_setup/package.sh
@@ -110,14 +110,14 @@ pkvm_list_outputs() {
 # qemu
 
 qemu_get_input_hashes() {
-    ( cd src/pkvm_setup/qemu_patches && git rev-parse HEAD:./ )
+    ( cd src/pkvm_setup/qemu && git rev-parse HEAD:./ )
     sha1sum src/pkvm_setup/build_qemu.sh
 }
 
 qemu_build() {
     (
         cd src/pkvm_setup
-        bash build_qemu.sh
+        bash build_qemu.sh aarch64
     )
 }
 

From a3f23059422c43f3492572f62c84e50377bb66eb Mon Sep 17 00:00:00 2001
From: Stuart Pernsteiner <spernsteiner@galois.com>
Date: Tue, 30 Jul 2024 10:42:03 -0700
Subject: [PATCH 6/9] ci: check out qemu submodule where necessary

---
 .github/workflows/main.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 62150dc9..64ff7b70 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -187,6 +187,10 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - uses: actions/checkout@v4
+    - name: Checkout submodules
+      run: |
+        git config --global url."https://podhrmic:${{ secrets.VERSE_VHOST_DEVICE_ACCESS_TOKEN }}@github.com/".insteadOf "git@github.com:"
+        git submodule update --init src/pkvm_setup/qemu
     - name: Hash inputs
       id: hash
       run: |
@@ -249,6 +253,7 @@ jobs:
         git submodule update --init src/pkvm_setup/libgpiod
         git submodule update --init src/pkvm_setup/vhost-device
         git submodule update --init src/pkvm_setup/linux-pkvm
+        git submodule update --init src/pkvm_setup/qemu
     - name: Hash inputs
       id: hash
       run: |

From cb3cb47077e67d206ba1dac6787d75db204ffed9 Mon Sep 17 00:00:00 2001
From: Stuart Pernsteiner <spernsteiner@galois.com>
Date: Mon, 15 Jul 2024 13:24:29 -0700
Subject: [PATCH 7/9] vm_runner: make qemu binary path configurable

---
 src/vm_runner/src/config.rs | 35 ++++++++++++++++++++++++++++++++++-
 src/vm_runner/src/lib.rs    | 14 +++++++-------
 2 files changed, 41 insertions(+), 8 deletions(-)

diff --git a/src/vm_runner/src/config.rs b/src/vm_runner/src/config.rs
index 6a152176..812c9ca0 100644
--- a/src/vm_runner/src/config.rs
+++ b/src/vm_runner/src/config.rs
@@ -10,6 +10,8 @@ pub struct Config {
     pub mode: Mode,
     #[serde(default)]
     pub process: Vec<Process>,
+    #[serde(default)]
+    pub paths: Paths,
 }
 
 #[derive(Clone, Copy, PartialEq, Eq, Debug, Serialize, Deserialize)]
@@ -23,6 +25,18 @@ pub enum Mode {
     Exec,
 }
 
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+pub struct Paths {
+    pub qemu_system_aarch64: Option<PathBuf>,
+}
+
+impl Paths {
+    pub fn qemu_system_aarch64(&self) -> &Path {
+        self.qemu_system_aarch64.as_ref()
+            .map_or(Path::new("qemu-system-aarch64"), |x| x)
+    }
+}
+
 #[derive(Clone, Debug, Serialize, Deserialize)]
 #[serde(tag = "type", rename_all = "snake_case")]
 pub enum Process {
@@ -176,16 +190,35 @@ fn resolve_relative_path(path: &mut PathBuf, base: &Path) {
     //*path = base.join(&*path);
 }
 
+fn resolve_relative_path_if_contains_slash(path: &mut PathBuf, base: &Path) {
+    // `Path::parent` docs say that it "returns `Some("")` for relative paths with one component".
+    if path.parent() == Some(Path::new("")) {
+        // Does not contain a slash.
+        return;
+    }
+    resolve_relative_path(path, base);
+}
+
 impl Config {
     /// Resolve any relative paths within `self` relative to `base`.
     pub fn resolve_relative_paths(&mut self, base: &Path) {
-        let Config { mode: _, ref mut process } = *self;
+        let Config { ref mut paths, mode: _, ref mut process } = *self;
+        paths.resolve_relative_paths(base);
         for p in process {
             p.resolve_relative_paths(base);
         }
     }
 }
 
+impl Paths {
+    pub fn resolve_relative_paths(&mut self, base: &Path) {
+        let Paths { ref mut qemu_system_aarch64 } = *self;
+        if let Some(ref mut path) = qemu_system_aarch64 {
+            resolve_relative_path_if_contains_slash(path, base);
+        }
+    }
+}
+
 impl Process {
     pub fn resolve_relative_paths(&mut self, base: &Path) {
         match *self {
diff --git a/src/vm_runner/src/lib.rs b/src/vm_runner/src/lib.rs
index 3ec45d08..24868dc0 100644
--- a/src/vm_runner/src/lib.rs
+++ b/src/vm_runner/src/lib.rs
@@ -19,7 +19,7 @@ use nix::sys::wait::{WaitStatus, WaitPidFlag};
 use sha2::{Sha256, Digest};
 use shlex::Shlex;
 use toml;
-use crate::config::{Config, Mode, VmSerial};
+use crate::config::{Config, Mode, Paths, VmSerial};
 
 pub mod config;
 
@@ -87,7 +87,7 @@ struct Commands {
     commands: Vec<Command>,
 }
 
-fn build_commands(processes: &[config::Process]) -> Commands {
+fn build_commands(paths: &Paths, processes: &[config::Process]) -> Commands {
     let mut cmds = Commands::default();
     for process in processes {
         match *process {
@@ -98,7 +98,7 @@ fn build_commands(processes: &[config::Process]) -> Commands {
                 cmds.commands.push(cmd);
             },
             config::Process::Vm(ref vm) => {
-                build_vm_command(vm, &mut cmds);
+                build_vm_command(paths, vm, &mut cmds);
             },
         }
     }
@@ -115,14 +115,14 @@ fn needs_escaping_for_qemu(path: impl AsRef<Path>) -> bool {
     s.contains(&[',', '=', ':'])
 }
 
-fn build_vm_command(vm: &config::VmProcess, cmds: &mut Commands) {
+fn build_vm_command(paths: &Paths, vm: &config::VmProcess, cmds: &mut Commands) {
     let config::VmProcess {
         ref kernel, ref initrd, ref append,
         ram_mb, kvm,
         ref disk, ref net, ref fs_9p, ref serial, ref gpio,
     } = *vm;
 
-    let mut vm_cmd = Command::new("qemu-system-aarch64");
+    let mut vm_cmd = Command::new(paths.qemu_system_aarch64());
 
     macro_rules! args {
         ($l:literal $($rest:tt)*) => {{
@@ -289,7 +289,7 @@ fn build_vm_command(vm: &config::VmProcess, cmds: &mut Commands) {
 pub fn run_manage(cfg: &Config) -> io::Result<()> {
     let mut children = ManagedProcesses::new();
 
-    let cmds = build_commands(&cfg.process);
+    let cmds = build_commands(&cfg.paths, &cfg.process);
 
     if cmds.early_commands.len() > 0 {
         for mut cmd in cmds.early_commands {
@@ -382,7 +382,7 @@ pub fn run_exec(cfg: &Config) -> io::Result<()> {
     assert!(cfg.process.len() == 1,
         "config error: `mode = 'exec'` requires exactly one entry in `processes`");
 
-    let mut cmds = build_commands(&cfg.process);
+    let mut cmds = build_commands(&cfg.paths, &cfg.process);
     assert!(cmds.commands.len() == 1,
         "impossible: one `Process` produced multiple main `Command`s");
     assert!(cmds.early_commands.len() == 0,

From 30e9e476310a83d42e53ce97a2975654ecdebf45 Mon Sep 17 00:00:00 2001
From: Stuart Pernsteiner <spernsteiner@galois.com>
Date: Tue, 30 Jul 2024 11:48:45 -0700
Subject: [PATCH 8/9] vm_runner: require QEMU >= 8.2 to use gpio

---
 src/vm_runner/src/config.rs | 11 +++++++++-
 src/vm_runner/src/lib.rs    | 41 ++++++++++++++++++++++++++++++++++++-
 2 files changed, 50 insertions(+), 2 deletions(-)

diff --git a/src/vm_runner/src/config.rs b/src/vm_runner/src/config.rs
index 812c9ca0..1f594750 100644
--- a/src/vm_runner/src/config.rs
+++ b/src/vm_runner/src/config.rs
@@ -28,6 +28,9 @@ pub enum Mode {
 #[derive(Clone, Debug, Default, Serialize, Deserialize)]
 pub struct Paths {
     pub qemu_system_aarch64: Option<PathBuf>,
+    /// This field is mainly for internal use, but it can be set in the config file to override
+    /// QEMU version detection.
+    pub qemu_system_aarch64_version: Option<Vec<u8>>,
 }
 
 impl Paths {
@@ -35,6 +38,12 @@ impl Paths {
         self.qemu_system_aarch64.as_ref()
             .map_or(Path::new("qemu-system-aarch64"), |x| x)
     }
+
+    pub fn qemu_system_aarch64_version(&self) -> &[u8] {
+        self.qemu_system_aarch64_version.as_ref()
+            .expect("qemu_system_aarch64_version should be auto-detected after config parsing \
+                if any `Process` might need it")
+    }
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
@@ -212,7 +221,7 @@ impl Config {
 
 impl Paths {
     pub fn resolve_relative_paths(&mut self, base: &Path) {
-        let Paths { ref mut qemu_system_aarch64 } = *self;
+        let Paths { ref mut qemu_system_aarch64, qemu_system_aarch64_version: _ } = *self;
         if let Some(ref mut path) = qemu_system_aarch64 {
             resolve_relative_path_if_contains_slash(path, base);
         }
diff --git a/src/vm_runner/src/lib.rs b/src/vm_runner/src/lib.rs
index 24868dc0..bf7c8425 100644
--- a/src/vm_runner/src/lib.rs
+++ b/src/vm_runner/src/lib.rs
@@ -9,9 +9,10 @@ use std::os::raw::c_int;
 use std::os::unix::process::CommandExt;
 use std::path::Path;
 use std::process::{Command, Child};
+use std::str;
 use std::thread;
 use std::time::Duration;
-use log::trace;
+use log::{debug, trace};
 use nix;
 use nix::mount::MsFlags;
 use nix::unistd::Pid;
@@ -273,6 +274,10 @@ fn build_vm_command(paths: &Paths, vm: &config::VmProcess, cmds: &mut Commands)
     }
 
     if gpio.len() > 0 {
+        // QEMU < 8.2 may lock up on boot due to a race condition involving vhost-device.
+        assert!(paths.qemu_system_aarch64_version() >= &[8, 2][..],
+            "{} version {:?} is too old; using GPIO requires version >= 8.2",
+            paths.qemu_system_aarch64().display(), paths.qemu_system_aarch64_version());
         args!("-object"
             (format!("memory-backend-file,id=mem,size={}M,mem_path=/dev/shm,share=on", ram_mb)));
         args!("-numa" "node,memdev=mem");
@@ -396,6 +401,33 @@ pub fn run_exec(cfg: &Config) -> io::Result<()> {
 }
 
 
+fn detect_qemu_version(paths: &Paths) -> io::Result<Vec<u8>> {
+    let output = Command::new(paths.qemu_system_aarch64())
+        .arg("-version")
+        .output()?;
+    let stdout = str::from_utf8(&output.stdout).map_err(|e| {
+        let msg = format!("failed to parse `{} -version` output: {e}",
+            paths.qemu_system_aarch64().display());
+        io::Error::new(io::ErrorKind::Other, msg)
+    })?;
+    let version = parse_qemu_version(&stdout).ok_or_else(|| {
+        let msg = format!("failed to parse `{} -version` output: {:?}",
+            paths.qemu_system_aarch64().display(), stdout);
+        io::Error::new(io::ErrorKind::Other, msg)
+    })?;
+    debug!("detected {:?} version: {:?}", paths.qemu_system_aarch64(), version);
+    Ok(version)
+}
+
+fn parse_qemu_version(stdout: &str) -> Option<Vec<u8>> {
+    if !stdout.starts_with("QEMU emulator version ") {
+        return None;
+    }
+    let word = stdout.split_whitespace().nth(3)?;
+    word.split('.').map(|part| part.parse::<u8>().ok()).collect::<Option<Vec<_>>>()
+}
+
+
 fn hash_file(path: impl AsRef<Path>) -> io::Result<[u8; 32]> {
     let path = path.as_ref();
     trace!("hash_file: opening {:?}", path);
@@ -433,6 +465,13 @@ pub fn runner_main(config_path: impl AsRef<Path>) {
 
     trace!("parsed config = {:?}", cfg);
 
+    let needs_qemu_system_aarch64 =
+        cfg.process.iter().any(|p| matches!(p, config::Process::Vm(_)));
+    if needs_qemu_system_aarch64 && cfg.paths.qemu_system_aarch64_version.is_none() {
+        let version = detect_qemu_version(&cfg.paths).unwrap();
+        cfg.paths.qemu_system_aarch64_version = Some(version);
+    }
+
     match cfg.mode {
         Mode::Manage => run_manage(&cfg).unwrap(),
         Mode::Exec => run_exec(&cfg).unwrap(),

From 217d08a986a17ca8e3b9a18a0f42424c61690aea Mon Sep 17 00:00:00 2001
From: Stuart Pernsteiner <spernsteiner@galois.com>
Date: Thu, 1 Aug 2024 10:59:09 -0700
Subject: [PATCH 9/9] ci: use galoisactions username for access tokens

---
 .github/workflows/main.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 64ff7b70..79342a66 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -119,7 +119,7 @@ jobs:
     - uses: actions/checkout@v4
     - name: Checkout submodules
       run: |
-        git config --global url."https://podhrmic:${{ secrets.VERSE_VHOST_DEVICE_ACCESS_TOKEN }}@github.com/".insteadOf "git@github.com:"
+        git config --global url."https://galoisactions:${{ secrets.VERSE_VHOST_DEVICE_ACCESS_TOKEN }}@github.com/".insteadOf "git@github.com:"
         git submodule update --init src/pkvm_setup/libgpiod
         git submodule update --init src/pkvm_setup/vhost-device
     - name: Hash inputs
@@ -189,7 +189,7 @@ jobs:
     - uses: actions/checkout@v4
     - name: Checkout submodules
       run: |
-        git config --global url."https://podhrmic:${{ secrets.VERSE_VHOST_DEVICE_ACCESS_TOKEN }}@github.com/".insteadOf "git@github.com:"
+        git config --global url."https://galoisactions:${{ secrets.VERSE_VHOST_DEVICE_ACCESS_TOKEN }}@github.com/".insteadOf "git@github.com:"
         git submodule update --init src/pkvm_setup/qemu
     - name: Hash inputs
       id: hash
@@ -249,7 +249,7 @@ jobs:
     - uses: actions/checkout@v4
     - name: Checkout submodules
       run: |
-        git config --global url."https://podhrmic:${{ secrets.VERSE_VHOST_DEVICE_ACCESS_TOKEN }}@github.com/".insteadOf "git@github.com:"
+        git config --global url."https://galoisactions:${{ secrets.VERSE_VHOST_DEVICE_ACCESS_TOKEN }}@github.com/".insteadOf "git@github.com:"
         git submodule update --init src/pkvm_setup/libgpiod
         git submodule update --init src/pkvm_setup/vhost-device
         git submodule update --init src/pkvm_setup/linux-pkvm