Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging

* rust: fix nightly warnings
* target/i386: a smattering of fixes
* monitor: add "info accelerators"
* kvm: cleanups to kvm_cpu_synchronize_put()
* target/i386: Add TSA attack variants and verw-clear feature flag
* async: tsan bottom half fixes
* rust: migration state wrappers with support for BQL-free devices

# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmjuRZYUHHBib256aW5p
# QHJlZGhhdC5jb20ACgkQv/vSX3jHroPTFgf+LRXCvGJwrlJwD4cAS/TBzhzpOAMZ
# v75RZ/s2tF7nYRhT28MDtZWsXeVrjO/nrSXaThxe6WHfmKK2W+16a+BgfhbeTEGt
# wBnK3JMb84i7T2Foy91jVCc4k0igwZu6Wmnf3rOP9gpdjAK6FYLje1KWvF7FrJO1
# ackAzJJ+TiZmc5QpXLW8sjaIidmefveXsdHwMVRz67LDvlDANEhp4rixjTVmKe0Z
# UL3tzrEj/b15vvElkh3a1IrVAttexay425J94R5i3Xpz3fEBqmIdpJt4eiCt9j0L
# zL7TOXwSJWiOX+mec6aJwYh8y4ikD6Yq4f4Hc9xFBEZRcICaxx4uoOscYA==
# =FroL
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 14 Oct 2025 05:44:06 AM PDT
# gpg:                using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg:                issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [unknown]
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (28 commits)
  rust: migration: implement ToMigrationState as part of impl_vmstate_bitsized
  timer: constify some functions
  rust: qemu-macros: add ToMigrationState derive macro
  rust: migration: add high-level migration wrappers
  rust: move VMState from bql to migration
  rust: migration: extract vmstate_fields_ref
  rust: migration: validate termination of subsection arrays
  rust: migration: do not store raw pointers into VMStateSubsectionsWrapper
  rust: migration: do not pass raw pointer to VMStateDescription::fields
  rust: bql: add BqlRefCell::get_mut()
  accel/kvm: Factor kvm_cpu_synchronize_put() out
  accel/kvm: Introduce KvmPutState enum
  monitor: generalize query-mshv/"info mshv" to query-accelerators/"info accelerators"
  monitor: clarify "info accel" help message
  target/i386: user: do not set up a valid LDT on reset
  async: access bottom half flags with qatomic_read
  target/i386: fix access to the T bit of the TSS
  target/i386: fix x86_64 pushw op
  i386/tcg/smm_helper: Properly apply DR values on SMM entry / exit
  i386/cpu: Prevent delivering SIPI during SMM in TCG mode
  ...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>