Raspberry Pi 4 Model B Rev 1.5 ("raspi4b"): No keyboard input after booting; "raspi3b" works
Description of problem:
I am using a `non-root` setup.

#
Steps to reproduce:
1. Install `latest` QEMU version from `Master branch`. As of writing commit hash `757a34115e7491744a63dfc3d291fd1de5297ee2`:
```bash
$ ACCEPT_KEYWORDS="**" \
USE="qemu_softmmu_targets_aarch64 qemu_softmmu_targets_x86_64 qemu_user_targets_aarch64 qemu_user_targets_x86_64 -ncurses slirp spice virtfs aio alsa bzip2 curl dock fdt filecaps gnutls jpeg oss pam pin-upstream-blobs png pulseaudio python_targets_python3_12 python_targets_python3_13 seccomp slirp spice udev usb vhost-net virtfs vnc xattr zstd" \
emerge --oneshot =app-emulation/qemu-9999
```

All `USE flags` can be found [below](#use-flags-app-emulationqemu).

2. Install `slirp4netns`, `libslirp` and `tigervnc`:
```bash
$ USE="-opengl -server" emerge --oneshot =app-containers/slirp4netns-1.2.0 =net-libs/libslirp-4.7.0 =net-misc/tigervnc-1.15.0
```

All `USE flags` can be found [below](#use-flags-net-misctigervnc).

3. Prepare directory structure in the `current working directory`:
```bash
$ mkdir "rpi3_model_b/" "rpi4_model_b_rev1.5/"
```

4. Download `DTB` and `Kernel image files` from the [`Raspberry Pi firmware Git repository`](https://github.com/raspberrypi/firmware/tree/0ea28740607daed588912930379ed6ad40cfc4be/boot):
```bash
$ wget "https://github.com/raspberrypi/firmware/raw/0ea28740607daed588912930379ed6ad40cfc4be/boot/bcm2710-rpi-3-b.dtb" \
    --output-document="./rpi3_model_b/bcm2710-rpi-3-b_from_master_branch_0ea28740607daed588912930379ed6ad40cfc4be.dtb"
$ wget "https://github.com/raspberrypi/firmware/raw/0ea28740607daed588912930379ed6ad40cfc4be/boot/bcm2711-rpi-4-b.dtb" \
    --output-document="./rpi4_model_b_rev1.5/bcm2711-rpi-4-b_from_master_branch_0ea28740607daed588912930379ed6ad40cfc4be.dtb"
$ wget "https://github.com/raspberrypi/firmware/raw/0ea28740607daed588912930379ed6ad40cfc4be/boot/kernel8.img" \
    --output-document="./kernel8_from_master_branch_0ea28740607daed588912930379ed6ad40cfc4be.img"
```

5. Download, verify and extract `Raspberry Pi OS Lite` image files:
```bash
$ wget \
    "https://downloads.raspberrypi.com/raspios_lite_arm64/images/raspios_lite_arm64-2024-11-19/2024-11-19-raspios-bookworm-arm64-lite.img.xz" \
    "https://downloads.raspberrypi.com/raspios_lite_arm64/images/raspios_lite_arm64-2024-11-19/2024-11-19-raspios-bookworm-arm64-lite.img.xz.sha256" \
    "https://downloads.raspberrypi.com/raspios_lite_arm64/images/raspios_lite_arm64-2024-11-19/2024-11-19-raspios-bookworm-arm64-lite.img.xz.sig" \
    "https://downloads.raspberrypi.com/raspios_lite_arm64/images/raspios_lite_arm64-2025-05-13/2025-05-13-raspios-bookworm-arm64-lite.img.xz" \
    "https://downloads.raspberrypi.com/raspios_lite_arm64/images/raspios_lite_arm64-2025-05-13/2025-05-13-raspios-bookworm-arm64-lite.img.xz.sha256" \
    "https://downloads.raspberrypi.com/raspios_lite_arm64/images/raspios_lite_arm64-2025-05-13/2025-05-13-raspios-bookworm-arm64-lite.img.xz.sig"
$ sha256sum --check *.sha256
2024-11-19-raspios-bookworm-arm64-lite.img.xz: OK
2025-05-13-raspios-bookworm-arm64-lite.img.xz: OK
$ for i in *.sig; do echo "${i}"; gpg --verify "${i}" "${i%\.sig}"; done
2024-11-19-raspios-bookworm-arm64-lite.img.xz.sig
gpg: Signature made Tue Nov 19 15:51:51 2024 CET
gpg:                using RSA key 54C3DD610D9D1B4AF82A37758738CD6B956F460C
gpg: Good signature from "Raspberry Pi Downloads Signing Key" [full]
2025-05-13-raspios-bookworm-arm64-lite.img.xz.sig
gpg: Signature made Tue May 13 08:52:21 2025 CEST
gpg:                using RSA key 54C3DD610D9D1B4AF82A37758738CD6B956F460C
gpg: Good signature from "Raspberry Pi Downloads Signing Key" [full]
$ for i in *.xz; do pixz -d "${i}"; done
$ LS_COLORS="" tree -FC --noreport
./
├── 2024-11-19-raspios-bookworm-arm64-lite.img.xz.sha256
├── 2024-11-19-raspios-bookworm-arm64-lite.img.xz.sig
├── 2024-11-19-raspios-bookworm-arm64-lite.img
├── 2025-05-13-raspios-bookworm-arm64-lite.img.xz.sha256
├── 2025-05-13-raspios-bookworm-arm64-lite.img.xz.sig
├── 2025-05-13-raspios-bookworm-arm64-lite.img
├── kernel8_from_master_branch_0ea28740607daed588912930379ed6ad40cfc4be.img
├── rpi3_model_b/
│   ├── bcm2710-rpi-3-b_from_master_branch_0ea28740607daed588912930379ed6ad40cfc4be.dtb
└── rpi4_model_b_rev1.5/
    └── bcm2711-rpi-4-b_from_master_branch_0ea28740607daed588912930379ed6ad40cfc4be.dtb
```

6. Grow `image size` to make it be a `power of 2`:
```bash
$ qemu-img resize -f raw "./2024-11-19-raspios-bookworm-arm64-lite.img" 4G
Image resized.
$ qemu-img resize -f raw "./2025-05-13-raspios-bookworm-arm64-lite.img" 4G
Image resized.
```

7. Get `DTB` and `Kernel images files` from the `Raspberry Pi OS image files`, prepare a `user` and `SSHD`:
```bash
$ losetup --find --partscan --show "./2024-11-19-raspios-bookworm-arm64-lite.img"
/dev/loop0
$ mount "/dev/loop0p1" "/mnt/"
$ cp "/mnt/bcm2710-rpi-3-b.dtb" "./rpi3_model_b/bcm2710-rpi-3-b_2024-11-19.dtb"
$ cp "/mnt/bcm2711-rpi-4-b.dtb" "./rpi4_model_b_rev1.5/bcm2711-rpi-4-b_2024-11-19.dtb"
$ cp "/mnt/kernel8.img" "./kernel8_2024-11-19.img"
$ touch "/mnt/ssh"
$ echo "pi:$(openssl passwd -6)" > "/mnt/userconf"
Password: 1234
Verifying - Password: 1234
$ umount "/mnt/"
$ losetup --find --partscan --show "./2025-05-13-raspios-bookworm-arm64-lite.img"
/dev/loop1
$ mount "/dev/loop1p1" "/mnt/"
$ cp "/mnt/bcm2710-rpi-3-b.dtb" "./rpi3_model_b/bcm2710-rpi-3-b_2025-05-13.dtb"
$ cp "/mnt/bcm2711-rpi-4-b.dtb" "./rpi4_model_b_rev1.5/bcm2711-rpi-4-b_2025-05-13.dtb"
$ cp "/mnt/kernel8.img" "./kernel8_2025-05-13.img"
$ touch "/mnt/ssh"
$ echo "pi:$(openssl passwd -6)" > "/mnt/userconf"
Password: 1234
Verifying - Password: 1234
$ umount "/mnt/"
$ losetup --list
NAME       SIZELIMIT OFFSET AUTOCLEAR RO BACK-FILE                                                                  DIO LOG-SEC
/dev/loop1         0      0         0  0 /home/<some_username>/qemu/2025-05-13-raspios-bookworm-arm64-lite.img   0     512
/dev/loop0         0      0         0  0 /home/<some_username>/qemu/2024-11-19-raspios-bookworm-arm64-lite.img   0     512
$ losetup --detach "/dev/loop0" "/dev/loop1"
$ losetup --list
$ LS_COLORS="" tree -FC --noreport
./
├── 2024-11-19-raspios-bookworm-arm64-lite.img
├── 2024-11-19-raspios-bookworm-arm64-lite.img.xz.sha256
├── 2024-11-19-raspios-bookworm-arm64-lite.img.xz.sig
├── 2025-05-13-raspios-bookworm-arm64-lite.img
├── 2025-05-13-raspios-bookworm-arm64-lite.img.xz.sha256
├── 2025-05-13-raspios-bookworm-arm64-lite.img.xz.sig
├── kernel8_2024-11-19.img
├── kernel8_2025-05-13.img
├── kernel8_from_master_branch_0ea28740607daed588912930379ed6ad40cfc4be.img
├── rpi3_model_b/
│   ├── bcm2710-rpi-3-b_2024-11-19.dtb
│   ├── bcm2710-rpi-3-b_2025-05-13.dtb
│   ├── bcm2710-rpi-3-b_from_master_branch_0ea28740607daed588912930379ed6ad40cfc4be.dtb
└── rpi4_model_b_rev1.5/
    ├── bcm2711-rpi-4-b_2024-11-19.dtb
    ├── bcm2711-rpi-4-b_2025-05-13.dtb
    └── bcm2711-rpi-4-b_from_master_branch_0ea28740607daed588912930379ed6ad40cfc4be.dtb
```

8. Execute the first `qemu-system-aarch64` command at `QEMU command line` [above](#host-environment):
```bash
$ qemu-system-aarch64 \
    -vnc "unix:/run/user/$(id --user)/qemu-vnc.sock"
    [...]
```

8.1. Warnings will be returned:

`raspi4b`:
```no-highlight
qemu-system-aarch64: warning: bcm2711 dtc: brcm,bcm2711-pcie has been disabled!
qemu-system-aarch64: warning: bcm2711 dtc: brcm,bcm2711-rng200 has been disabled!
qemu-system-aarch64: warning: bcm2711 dtc: brcm,bcm2711-thermal has been disabled!
qemu-system-aarch64: warning: bcm2711 dtc: brcm,bcm2711-genet-v5 has been disabled!
```

`raspi3b`:
```no-highlight
usbnet: failed control transaction: request 0x8006 value 0x600 index 0x0 length 0xa
usbnet: failed control transaction: request 0x8006 value 0x600 index 0x0 length 0xa
usbnet: failed control transaction: request 0x8006 value 0x600 index 0x0 length 0xa
```

9. Connect via `VNC` via `UNIX socket`:
```bash
$ vncviewer "/run/user/$(id --user)/qemu-vnc.sock"
```

10. Press and hold the `f key` or `right arrow` in the `tigervnc window`, even while booting. There should be **no** characters at all. For `raspi3b` there will be.

11. Open the `QEMU console` via `CTRL+ALT+2`.

11.1. Try to send a `reboot command`:
```bash
> sendkey ctrl-alt-delete
```

11.2. `Raspberry Pi OS` will **not** reboot or receive any keyboard inputs, but `raspi3b` will.

12. Try to connect via `SSH` from `another shell`:
```bash
$ ssh -p 2222 pi@127.0.0.1
```

12.1. The connection will time out:
```no-highlight
Connection timed out during banner exchange
Connection to 127.0.0.1 port 2222 timed out
```

12.2. `slirp4netns` will continuously return errors in the shell, where `qemu-system-aarch64` was executed:
```no-highlight
[...]
qemu-system-aarch64: Slirp: Failed to send packet, ret: -1
qemu-system-aarch64: Slirp: Failed to send packet, ret: -1
[...]
```

13. Go to the shell, where `qemu-system-aarch64` was executed and send a `SIGTERM (15)` signal to the process:
```no-highlight
Press CTRL+C
```

13.1. If this does not work, `terminate` the process form `another shell`:
```bash
$ ps aux | grep "qemu-system-aarch64"
<some_username>    24399  149  3.1 4265780 522276 pts/2  SNl+ 21:32   4:21 qemu-system-aarch64 -vnc unix:/run/user/[...]
$ kill -SIGTERM 24399
```

13.2. In the worst case, `kill` the process in a dirty way:
```bash
$ kill -SIGKILL 24339
```

14. Repeat step `8` to `13` with the next `qemu-system-aarch64` command at `QEMU command line` [above](#host-environment). `Keyboard inputs` will only work for `raspi3` and `SSH` only for number `4` and `6`. If keyboard inputs are possible, one can log in with the user `pi` and password `1234` or use the `QEMU console` (`CTRL+ALT+2`) to reboot: `sendkey ctrl-alt-delete`.
Additional information:
#