qemu: Upgrade 11.1.1 -> 11.1.2

Changes:
 - Update version for 11.1.2 release
 - target/sh4: Replace TB_FLAG_GUSA_EXCLUSIVE with CF_STEP_ATOMIC
 - accel/tcg: Set CF_NOIRQ during cpu_exec_step_atomic
 - linux-user/sh4: align the vdso sigreturn trampolines
 - linux-user/sh4: fix vdso CFA for rt_sigreturn frames
 - linux-user/sh4: use the kernel's sigreturn trampoline sequence in the vdso
 - target/i386: Mark MOVNTI as not valid with prefixes 0x66, 0xF2, 0xF3
 - target/i386: Update FPU tag word for FXCH
 - target/i386: Update FPU tag word for FSTP
 - target/i386: Update FPU tag word for FXTRACT's old ST(0)
 - target/i386: Fix FXCH to unconditionally clear C1
 - target/ppc: Stop vCPU thread before calling parent_unrealize
 - tests/qtest/usb-hcd-xhci: test isoch endpoint type mismatch
 - tests/qtest/usb-hcd-xhci: test isoch pacing with MFINDEX above 2^32
 - hw/usb/hcd-xhci: don't assert on NAK when retrying an isoch transfer
 - hw/usb/hcd-xhci: fix interval alignment after MFINDEX passes 2^32
 - hw/usb/hcd-xhci: Set reentrancy guard in timer functions (CVE-2026-17588)
 - tcg/riscv64: Set vtype before whole-register vector loads
 - tests/tcg/s390x: Add regression test for #4449
 - tcg/optimize: Fix expansion/simplification of deposit
 - tests/tcg/arm: Add regression test for #4448
 - tcg/optimize: Fix fold_multiply2 vs 1
 - accel/tcg: Fix TLB_MMIO check in tlb_plugin_lookup()
 - accel/tcg: Use TLB_FORCE_SLOW not TLB_MMIO for system plugins
 - hw/9pfs: mutate FID path from main thread only (CVE-2026-93834)
 - s390x/pci: fix DMA slot leak on I/O TLB entry replacement
 - hw/s390x/ipl: Fix incorrect PCI IPL block lengths
 - linux-user/loongarch64: Detect vector stores in host_signal_write()
 - linux-user: implement mlock2(2) syscall
 - linux-user/riscv: honor zicntr=false for base counterCSRs
 - system/ram-discard-manager: fix offset_within_address_space in replay_by_populated_state()
 - igvm: mark qigvm_find_param_entry as static
 - igvm: validate and honor byte_offset in parameter directives
 - hw/uefi: add missing uefi_str_is_valid check to uefi_vars_mm_lock_variable
 - target/loongarch: Fix data race in CSR_ESTAT
 - hw/riscv/virt.c: fix aclint soc/mtimer nodename
 - target/arm/hvf: implement MDCCSR_EL0 as RAZ
 - target/arm/whpx: fix whpx-arm post-reset CPU state
 - target/arm/whpx: incorrect ENCODE_AA64_CP_REG parameter order
 - target/arm/whpx: Don't try to sync ARM_CP_CONST registers
 - hw/intc/bcm2835_ic: reject out-of-range FIQ source values
 - qga: Change effective user/group ID in guest-ssh-* commands
 - vhost-user-gpu: validate command buffer size in submit_3d
 - ui/cursor: make the cursor refcount atomic
 - hw/display/qxl: hold ssd.lock while replacing ssd.cursor
 - hw/cxl: fix the CDAT DOE overlapping the Flex Bus DVSEC when sn= is set
 - virtio-scsi: set dataplane_started to false upon failure
 - virtio-balloon: fix free-page BH teardown on unrealize
 - hw/virtio: reject inverted virtio-iommu IOVA ranges
 - hw/net/virtio-net: strip trailing padding when caching RSC segment
 - hw/net/virtio-net: check packet size before VLAN tag access in receive_filter()
 - qapi/misc: Fix missed query-iothreads items
 - hw/cxl: Fix guest-triggerable QEMU exit on reserved interleave ways
 - virtio-gpu: clear res->blob on mapping cleanup
 - tests/unit: cover blocked IO during the websock handshake
 - io/channel-websock: do not lose QIO_CHANNEL_ERR_BLOCK while reading
 - tests/unit: add websock handshake test
 - io/channel-websock: handle a blocked write during the handshake
 - io/channel-websock: send an HTTP 400 when the greeting has no space
 - io/channel-socket: do not treat a zero length write as an error
 - target/loongarch: Fix SWI interrupt delivery via CSR_ESTAT
 - hw/cxl: fix timer leak in cxl_destroy_cci()
 - hw/sd/sdcard: Register device ops in drives without media
 - hw/sd: sdhci: Accept version 4 enable without UHS-I
 - target/arm: Make Thumb T1 hint space UNDEF before v6T2
 - target/arm: Make IT insn undef when not present
 - target/arm: Make CBZ/CBNZ UNDEF before v6T2
 - target/arm: Correct reset value of SCTLR for arm926, arm1026
 - target/arm: fix TTA instruction S bit for IDAU-exempt addresses
 - ppc/xive: Trigger the pending interrupt for a guest after migration
 - i386/vapic: unref MemoryRegion if vapic_map_rom_writable fails
 - vapic: confine the VAPIC region to 0xc0000..0xe0000
 - scsi: hide MODE SELECT block size change behind a quirk
 - scsi-disk: fix out-of-bound read in WRITE SAME
 - target/riscv/kvm: Preserve MP state across migration
 - target/riscv/kvm: Synchronize privilege mode
 - hw/ide: report the default CHS translation in IDENTIFY DEVICE
 - tests/qtest/ide-test: cover a CHS translation with zero sectors
 - hw/ide: reject an unsupported CHS translation
 - s390x/sclp: pv: only copy the original SCCB buffer
 - dirty-bitmap: fix integer overflow in serialization coverage
 - block/monitor: allow dropping a bitmap never stored on disk
 - migration/block-dirty-bitmap: reject bitmap load onto ro node
 - block/monitor: reject persistent bitmap add on a read-only node
 - tests/unit/test-blockjob: cover keeping a job paused while a pause is pending
 - job: keep job paused across overlapping pause requests
 - hw/input/ps2: answer unknown mouse commands with a resend
 - hw/display/vga: fix text-mode OOB write after a graphics surface switch
 - chardev: Don't unregister yank upon async path connection failure
 - crypto: fix build against nettle >= 4
 - virtio-gpu: use g_try_malloc to avoid guest-triggered abort
 - hw/display/qxl: validate primary surface stride against width

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
 .../qemu/{qemu-native_11.1.1.bb => qemu-native_11.1.2.bb}       | 0
 ...emu-system-native_11.1.1.bb => qemu-system-native_11.1.2.bb} | 0
 meta/recipes-devtools/qemu/qemu.inc                             | 2 +-
 meta/recipes-devtools/qemu/{qemu_11.1.1.bb => qemu_11.1.2.bb}   | 0
 4 files changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/qemu/{qemu-native_11.1.1.bb => qemu-native_11.1.2.bb} (100%)
 rename meta/recipes-devtools/qemu/{qemu-system-native_11.1.1.bb => qemu-system-native_11.1.2.bb} (100%)
 rename meta/recipes-devtools/qemu/{qemu_11.1.1.bb => qemu_11.1.2.bb} (100%)