The following changes since commit 94826ec1370328375c3b6d1e80fdc94c8f46c348:

  Merge tag 'accel-20260706' of https://github.com/philmd/qemu into staging (2026-07-06 18:38:14 +0200)

are available in the Git repository at:

  https://github.com/legoater/qemu/ tags/pull-vfio-20260707

for you to fetch changes up to 9daa7347ff2551038e0de055d309b420324b5a25:

  vfio/pci: Reject invalid MSI-X Table and PBA BIR values (2026-07-07 07:12:46 +0200)

----------------------------------------------------------------
vfio queue:

* Fixes ROM read issues in vfio/pci: information leak, error
  propagation, and uninitialized state
* Validates VERSION replies in vfio-user and updates the spec
  for DMA access mode bits
* Merges .dma_map_file() into .dma_map() in the iommufd backend
* Reworks switchover-ack to be re-usable and implements the
  VFIO_PRECOPY_INFO_REINIT feature for additional pre-copy
  iterations before switchover
* Adds ATS support for passthrough devices via iommufd
* Fixes translated_addr for non-identity-mapped RAM sections in
  the VFIO listener
* Reject invalid MSI-X Table and PBA BIR values

----------------------------------------------------------------
Avihai Horon (16):
      migration: Propagate errors in migration_completion_precopy()
      migration/ram: Use migration_bitmap_sync_precopy() for postcopy discard
      migration: Run final save_query_pending at switchover
      migration: Log the approver in qemu_loadvm_approve_switchover()
      migration: Replace switchover_ack_needed SaveVMHandler
      migration: Rename switchover-ack code to legacy
      migration: Make switchover-ack re-usable
      migration: Fail migration if switchover-ack is requested after switchover decision
      vfio/migration: Extract VFIO_MIG_FLAG_DEV_INIT_DATA_SENT sending to helper
      vfio/migration: Add Error ** parameter to vfio_migration_init()
      vfio/migration: Add new switchover-ack mechanism
      vfio/migration: Implement VFIO_PRECOPY_INFO_REINIT feature
      vfio/migration: Check VFIO_PRECOPY_INFO_REINIT during switchover
      migration: Enable new switchover-ack
      migration: Refactor migration_completion_precopy() to return bool
      migration: Fix "switchover" used as a verb in comments and docs

Cédric Le Goater (4):
      vfio/pci: Fix information leak in vfio_rom_read()
      vfio/iommufd: Merge .dma_map_file() into .dma_map()
      vfio/listener: Fix translated_addr for non-identity-mapped RAM sections
      vfio/pci: Reject invalid MSI-X Table and PBA BIR values

GuoHan Zhao (1):
      vfio-user: validate VERSION replies

Mario Casquero (2):
      vfio/pci: Initialize rom_read_failed in vfio_pci_load_rom()
      vfio/pci: Propagate errors in vfio_pci_load_rom() using Error API

Mattias Nissler (1):
      docs: Update vfio-user spec to describe DMA access mode bits

Nathan Chen (2):
      iommufd: Introduce handler for device ATS support
      vfio/pci: Add ats property

Shameer Kolothum (1):
      backends/iommufd: Fix dev_id and type order in viommu trace

 docs/devel/migration/vfio.rst      |  17 +++-
 docs/interop/vfio-user.rst         |  82 +++++++++------
 qapi/migration.json                |  16 ++-
 hw/vfio/pci.h                      |   1 +
 hw/vfio/vfio-migration-internal.h  |   2 +
 include/hw/vfio/vfio-container.h   |  15 ---
 include/migration/client-options.h |   1 +
 include/migration/misc.h           |   2 +
 include/migration/register.h       |  56 +++++-----
 include/system/host_iommu_device.h |   9 ++
 migration/migration.h              |  34 ++++++-
 migration/savevm.h                 |  11 +-
 backends/iommufd.c                 |   8 ++
 hw/core/machine.c                  |   1 +
 hw/s390x/s390-stattrib.c           |   2 +-
 hw/vfio-user/proxy.c               |  21 ++--
 hw/vfio/container.c                |  38 -------
 hw/vfio/iommufd.c                  |  50 ++++++---
 hw/vfio/listener.c                 |   5 +-
 hw/vfio/migration.c                | 204 +++++++++++++++++++++++++++++--------
 hw/vfio/pci.c                      | 137 +++++++++++++++++++++----
 migration/block-dirty-bitmap.c     |  11 +-
 migration/colo.c                   |  14 +++
 migration/migration.c              |  98 ++++++++++++------
 migration/options.c                |   9 ++
 migration/ram.c                    |  40 ++++----
 migration/savevm.c                 | 195 ++++++++++++++++++++++-------------
 backends/trace-events              |   2 +-
 hw/vfio/trace-events               |   7 +-
 migration/trace-events             |   9 +-
 30 files changed, 753 insertions(+), 344 deletions(-)

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.