[PULL 0/6] ppc queue for 2026-10-28

[PULL 0/6] ppc queue for 2026-10-28

[Harsh Prateek Bora]

The following changes since commit d29412cca54899ba87d5ea5d61e8bad7643b15f0:

  Merge tag 'pull-riscv-to-apply-20261027' of https://github.com/alistair23/qemu into staging (2026-10-27 14:27:13 -0500)

are available in the Git repository at:

  https://gitlab.com/harshpb/qemu.git tags/pull-ppc-for-11.2-sf-20261028

for you to fetch changes up to 74e68729ca8ee576bef823798ffc80589b1edd63:

  spapr-vscsi: clamp adapter info DMA write length to struct size (2026-10-28 10:45:51 +0530)

----------------------------------------------------------------
ppc queue for 2026-10-28
- Misc fixes and func test improvements.

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEa4EM1tK+EPOIPSFCRUTplPnWj7sFAmrhhToACgkQRUTplPnW
j7uZnw/+OvWVsLH/lDUYqmpzZcYCqsJ9t/L407RcT5FvzTOpMiH95s7u8Hif/siz
ZV4iCP+kwwcsTFLjvLoCpCo+iY90XoeB1ThfNYmLQsJP75ze3HtAzRbk9L4NLNbK
xUdyRtAYDEb4peB5UTlwPufxS768swjYl3vybZUdz3TiGW06D/Lzz2c47ScZRUeo
TyU37T//v1bS+j5pIkosqfL8BegCUSvwdA3xIRbwX6rzyqawRZKWT9PHc7oEs+JA
7FtsYhUFkaH7rfSyYVMb/hLs/RadvU17s0WBP025pibf/xjO0BCeFelUS1JZYolU
MrSMlbJJCJRh6G3KeHnd9ZUin8Ogsrw82xI/IRNoF5WzyO946mMvRxvv1wW36Av8
SZG/F+LkeQ1spq/S0ngASunOiSLxfDpQ4Rs9Q8e3tNZljl693/Ax3mmtpJqRInDe
FxTEcx2dP+9xPVEoGCjiPSCoKg0ovhDwvRjhvaAOrbnDcXSwTalqfJ8WdhJMVb7G
Jx+GppFe/x+xR0c/+BfvG138GbqWPo/javCNiJ7ScJ6aerPN8nCE4pFs+gxXqp8b
7cfKMihRpbgYC6vC5NY3smC3lvglLo70X6okx4UTJkABm/XiXRE70kS0vvCa/93t
xGJmI/oYH8kOB2PusBtTHoqb7/cP/x3GflXyQ67qDC+bcSdxA/4=
=wHdy
-----END PGP SIGNATURE-----

----------------------------------------------------------------
Aniket Sahu (2):
      tests/functional/ppc64: extend pseries migration tests
      tests/functional/ppc64: extend ppc64 powernv net device tests

Chinmay Rath (2):
      hw/net/spapr_llan: validate RxBufPool fields on migration load
      spapr-vscsi: clamp adapter info DMA write length to struct size

Nikhil Kumar Singh (1):
      hw/pci-host/pnv_phb4: fix guest-triggerable abort on 8-byte config access

Showta Ishizaki (1):
      hw/ppc/spapr: Add the "rtas-version" property to /rtas

 include/hw/ppc/spapr.h                   |  3 +++
 hw/net/spapr_llan.c                      | 18 ++++++++++++++++++
 hw/pci-host/pnv_phb4.c                   | 18 ++++++++++++++++--
 hw/ppc/spapr.c                           |  1 +
 hw/scsi/spapr_vscsi.c                    | 18 ++++++++++++++++--
 tests/functional/ppc64/test_migration.py |  4 ++--
 tests/functional/ppc64/test_powernv.py   |  7 +++++--
 7 files changed, 61 insertions(+), 8 deletions(-)

[PULL 1/6] hw/pci-host/pnv_phb4: fix guest-triggerable abort on 8-byte config access

[Harsh Prateek Bora]

From: Nikhil Kumar Singh <nikhilks@linux.ibm.com>

A guest-triggerable assertion crash (DoS) exists in pnv_phb4_config_write()
and pnv_phb4_config_read(). When a guest performs an 8-byte access to
PHB_CONFIG_DATA (offset 0x130), QEMU aborts because the switch(size)
statement in the config accessors only handles 1, 2, and 4-byte accesses,
hitting g_assert_not_reached() in the default case.

Since guest input is untrusted, an invalid access size should not crash
the host. Fix this by adding a size > 4 guard in pnv_phb4_reg_write() and
pnv_phb4_reg_read() before the config accessor calls, and by replacing
the g_assert_not_reached() in pnv_phb4_config_write() and
pnv_phb4_config_read() with phb_error() to cover any other callers.
Invalid reads now return ~0ull, maintaining PCI conventions.

Fixes: 4f9924c4d4cf ("ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3591
Signed-off-by: Nikhil Kumar Singh <nikhilks@linux.ibm.com>
Reviewed-by: Aditya Gupta <adityag@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260805090530.1333997-1-nikhilks@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/pci-host/pnv_phb4.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/hw/pci-host/pnv_phb4.c b/hw/pci-host/pnv_phb4.c
index 9acaf4c0c2..ac09a0b034 100644
--- a/hw/pci-host/pnv_phb4.c
+++ b/hw/pci-host/pnv_phb4.c
@@ -84,7 +84,9 @@ static void pnv_phb4_config_write(PnvPHB4 *phb, unsigned off,
         val = bswap32(val);
         break;
     default:
-        g_assert_not_reached();
+        phb_error(phb, "invalid config write size %u at offset 0x%x\n",
+                  size, off);
+        return;
     }
     pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
 }
@@ -119,7 +121,9 @@ static uint64_t pnv_phb4_config_read(PnvPHB4 *phb, unsigned off,
     case 4:
         return bswap32(val);
     default:
-        g_assert_not_reached();
+        phb_error(phb, "invalid config read size %u at offset 0x%x\n",
+                  size, off);
+        return ~0ull;
     }
 }
 
@@ -507,6 +511,11 @@ static void pnv_phb4_reg_write(void *opaque, hwaddr off, uint64_t val,
 
     /* Special case outbound configuration data */
     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
+        if (size > 4) {
+            phb_error(phb, "invalid config write size %u at 0x%"PRIx64"\n",
+                      size, off);
+            return;
+        }
         pnv_phb4_config_write(phb, off & 0x3, size, val);
         return;
     }
@@ -644,6 +653,11 @@ static uint64_t pnv_phb4_reg_read(void *opaque, hwaddr off, unsigned size)
     uint64_t val;
 
     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
+        if (size > 4) {
+            phb_error(phb, "invalid config read size %u at 0x%"PRIx64"\n",
+                      size, off);
+            return ~0ull;
+        }
         return pnv_phb4_config_read(phb, off & 0x3, size);
     }
 
-- 
2.52.0

[PULL 2/6] tests/functional/ppc64: extend pseries migration tests

[Harsh Prateek Bora]

From: Aniket Sahu <asahu1x@linux.ibm.com>

The existing test_migration.py exercises all three migration transport
paths (TCP, UNIX, exec) but only against the mac99 machine type.
A regression in pseries-specific vmstate save/restore handlers would
not be caught by migrating a mac99 guest.

Switch the UNIX socket and exec (socat) migration tests from mac99 to
pseries so that these transport paths are exercised against the pseries
vmstate.  The TCP test is left on mac99 since pseries TCP migration is
already covered by test_ppc64_linux_migration in test_pseries.py.

Signed-off-by: Aniket Sahu <asahu1x@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260921081010.31778-2-asahu1x@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 tests/functional/ppc64/test_migration.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/functional/ppc64/test_migration.py b/tests/functional/ppc64/test_migration.py
index 7d49ee175b..e1d51551b8 100755
--- a/tests/functional/ppc64/test_migration.py
+++ b/tests/functional/ppc64/test_migration.py
@@ -15,11 +15,11 @@ def test_migration_with_tcp_localhost(self):
         self.migration_with_tcp_localhost()
 
     def test_migration_with_unix(self):
-        self.set_machine('mac99')
+        self.set_machine('pseries')
         self.migration_with_unix()
 
     def test_migration_with_exec(self):
-        self.set_machine('mac99')
+        self.set_machine('pseries')
         self.migration_with_exec()
 
 
-- 
2.52.0

[PULL 3/6] tests/functional/ppc64: extend ppc64 powernv net device tests

[Harsh Prateek Bora]

From: Aniket Sahu <asahu1x@linux.ibm.com>

Added console checks as the probe log lines will appear before the
S14Silence-console init scripts.

Signed-off-by: Aniket Sahu <asahu1x@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Reviewed-by: Aditya Gupta <adityag@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260921081010.31778-3-asahu1x@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 tests/functional/ppc64/test_powernv.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/tests/functional/ppc64/test_powernv.py b/tests/functional/ppc64/test_powernv.py
index f3e05e4d38..200fd2c894 100755
--- a/tests/functional/ppc64/test_powernv.py
+++ b/tests/functional/ppc64/test_powernv.py
@@ -201,9 +201,12 @@ def do_test_ppc64_powernv(self, proc):
 
         self.wait_for_console_pattern("CPU: " + proc + " generation processor")
         self.wait_for_console_pattern("INIT: Starting kernel at ")
+        # NVMe, e1000e, and xHCI are probed synchronously by the kernel
+        # during PCI enumeration, after OPAL hands off to Linux.
+        self.wait_for_console_pattern("nvme nvme0")
+        self.wait_for_console_pattern("e1000e")
+        self.wait_for_console_pattern("xhci_hcd")
         self.wait_for_console_pattern("Run /sbin/init as init process")
-        # Device detection output driven by udev probing is sometimes cut off
-        # from console output, suspect S14silence-console init script.
 
     def test_ppc64_powernv_external_dtb(self):
         self.set_machine('powernv11')
-- 
2.52.0

[PULL 4/6] hw/net/spapr_llan: validate RxBufPool fields on migration load

[Harsh Prateek Bora]

From: Chinmay Rath <rathc@linux.ibm.com>

vmstate_rx_buffer_pool restores count and bufsize as raw int32 values
with no bounds checking.  A crafted migration stream can set count to
any int32 value.  spapr_vlan_get_rx_bd_from_pool() then passes the
count > 0 guard, decrements count, and uses the result as an array
index into bds[], a 4096-entry fixed heap allocation:

    dev->rx_pool[pool]->count--;
    bd  = dev->rx_pool[pool]->bds[dev->rx_pool[pool]->count];  /* OOB read  */
    dev->rx_pool[pool]->bds[dev->rx_pool[pool]->count] = 0;    /* OOB write */

With count == INT32_MAX this lands ~17 GiB past the start of a 32 KiB
heap object.  Additionally, a negative bufsize silently compares as a
huge value when widened to size_t, defeating the bufsize >= size + 8
pool-selection guard.

The hypercall path (spapr_vlan_add_rxbuf_to_pool) already enforces
0 <= count < RX_POOL_MAX_BDS; add a post_load hook to
vmstate_rx_buffer_pool that rejects any stream violating the same
invariant, failing the incoming migration.

Closes: https://gitlab.com/qemu-project/qemu/-/work_items/4147
Reported-by: Lazymio <mio@lazym.io>
Signed-off-by: Chinmay Rath <rathc@linux.ibm.com>
Reviewed-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260917202854.288439-1-rathc@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/net/spapr_llan.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c
index 550848307d..a5b8906849 100644
--- a/hw/net/spapr_llan.c
+++ b/hw/net/spapr_llan.c
@@ -800,11 +800,29 @@ static bool spapr_vlan_rx_buffer_pools_needed(void *opaque)
     return (dev->compat_flags & SPAPRVLAN_FLAG_RX_BUF_POOLS) != 0;
 }
 
+static int spapr_vlan_rx_buffer_pool_post_load(void *opaque, int version_id)
+{
+    RxBufPool *rxp = opaque;
+
+    if (rxp->count < 0 || rxp->count > RX_POOL_MAX_BDS) {
+        return -EINVAL;
+    }
+    /*
+     * bufsize is compared against a size_t in spapr_vlan_get_rx_bd_from_pool(),
+     * so a negative value would compare as huge.
+     */
+    if (rxp->bufsize < 0) {
+        return -EINVAL;
+    }
+    return 0;
+}
+
 static const VMStateDescription vmstate_rx_buffer_pool = {
     .name = "spapr_llan/rx_buffer_pool",
     .version_id = 1,
     .minimum_version_id = 1,
     .needed = spapr_vlan_rx_buffer_pools_needed,
+    .post_load = spapr_vlan_rx_buffer_pool_post_load,
     .fields = (const VMStateField[]) {
         VMSTATE_INT32(bufsize, RxBufPool),
         VMSTATE_INT32(count, RxBufPool),
-- 
2.52.0

[PULL 5/6] hw/ppc/spapr: Add the "rtas-version" property to /rtas

[Harsh Prateek Bora]

From: Showta Ishizaki <zakinko@snowrabbit.org>

PAPR requires every property listed in its table of /rtas device tree
properties to be present before the OS is booted (R-7.2.6-3 and Table
20 in PAPR v10.60; the same requirement is in LoPAR 2.9 and LoPAPR
1.1). One of them is "rtas-version", an integer encoding of the RTAS
interface version, and PAPR says it describes version 1 of that
interface.

spapr_dt_rtas() sets "rtas-size", "rtas-error-log-max" and
"rtas-event-scan-rate" but never "rtas-version", so a client that reads
it finds no RTAS: NetBSD's RTAS driver fails to attach when the
property is absent.

Set it to 1, the version PAPR describes.

Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Tested-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Signed-off-by: Showta Ishizaki <zakinko@snowrabbit.org>
Link: https://lore.kernel.org/qemu-devel/20261005161859.3119EC92F0@bambi.snowrabbit.org
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 include/hw/ppc/spapr.h | 3 +++
 hw/ppc/spapr.c         | 1 +
 2 files changed, 4 insertions(+)

diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 9acda15d4f..98a9099b8a 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -830,6 +830,9 @@ void spapr_load_rtas(SpaprMachineState *spapr, void *fdt, hwaddr addr);
 
 #define RTAS_EVENT_SCAN_RATE    1
 
+/* RTAS interface version, as defined by PAPR v10.60 Table 20 */
+#define RTAS_VERSION            1
+
 /* This helper should be used to encode interrupt specifiers when the related
  * "interrupt-controller" node has its "#interrupt-cells" property set to 2 (ie,
  * VIO devices, RTAS event sources and PHBs).
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 6d99464486..8a1b5b37b6 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -1068,6 +1068,7 @@ static void spapr_dt_rtas(SpaprMachineState *spapr, void *fdt)
                           RTAS_ERROR_LOG_MAX));
     _FDT(fdt_setprop_cell(fdt, rtas, "rtas-event-scan-rate",
                           RTAS_EVENT_SCAN_RATE));
+    _FDT(fdt_setprop_cell(fdt, rtas, "rtas-version", RTAS_VERSION));
 
     g_assert(msi_nonbroken);
     _FDT(fdt_setprop(fdt, rtas, "ibm,change-msix-capable", NULL, 0));
-- 
2.52.0

[PULL 6/6] spapr-vscsi: clamp adapter info DMA write length to struct size

[Harsh Prateek Bora]

From: Chinmay Rath <rathc@linux.ibm.com>

vscsi_send_adapter_info() used the guest-supplied common.length
field directly as the size argument to spapr_vio_dma_write().
Since common.length is controlled by the guest, a value larger
than sizeof(struct mad_adapter_info_data) (148 bytes) caused
dma_memory_write() to read past the end of the stack-allocated info
struct, leaking arbitrary host stack contents into guest memory.

Fix this by clamping the write length to sizeof(info), then using
spapr_vio_dma_set() to zero-fill any remaining bytes the guest
requested beyond that size. This mirrors the existing pattern in
vscsi_send_capabilities().

Closes: https://gitlab.com/qemu-project/qemu/-/work_items/4626
Reported-by: Guthrie McAfee Armstrong <git@gmarmstrong.dev>
Signed-off-by: Chinmay Rath <rathc@linux.ibm.com>
Reviewed-by: Gautam Menghani <gautam@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20261007144434.374749-1-rathc@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/scsi/spapr_vscsi.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index b4c8f94d22..7ec780da79 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -966,6 +966,8 @@ static int vscsi_send_adapter_info(VSCSIState *s, vscsi_req *req)
 {
     struct viosrp_adapter_info *sinfo;
     struct mad_adapter_info_data info;
+    uint16_t len, req_len;
+    uint64_t buffer;
     int rc;
 
     sinfo = &req_iu(req)->mad.adapter_info;
@@ -985,11 +987,23 @@ static int vscsi_send_adapter_info(VSCSIState *s, vscsi_req *req)
     info.os_type = cpu_to_be32(2);
     info.port_max_txu[0] = cpu_to_be32(VSCSI_MAX_SECTORS << 9);
 
-    rc = spapr_vio_dma_write(&s->vdev, be64_to_cpu(sinfo->buffer),
-                             &info, be16_to_cpu(sinfo->common.length));
+    req_len = len = be16_to_cpu(sinfo->common.length);
+    buffer = be64_to_cpu(sinfo->buffer);
+    if (len > sizeof(info)) {
+        fprintf(stderr, "vscsi_send_adapter_info: adapter info size mismatch !\n");
+        /*
+         * Just read and populate the structure that is known.
+         * Zero rest of the structure.
+         */
+        len = sizeof(info);
+    }
+    rc = spapr_vio_dma_write(&s->vdev, buffer, &info, len);
     if (rc)  {
         fprintf(stderr, "vscsi_send_adapter_info: DMA write failure !\n");
     }
+    if (req_len > len) {
+        spapr_vio_dma_set(&s->vdev, (buffer + len), 0, (req_len - len));
+    }
 
     sinfo->common.status = rc ? cpu_to_be32(1) : 0;
 
-- 
2.52.0

Re: [PULL 0/6] ppc queue for 2026-10-28

[Richard Henderson]

On 10/28/26 00:20, Harsh Prateek Bora wrote:
> The following changes since commit d29412cca54899ba87d5ea5d61e8bad7643b15f0:
> 
>    Merge tag 'pull-riscv-to-apply-20261027' ofhttps://github.com/alistair23/qemu into staging (2026-10-27 14:27:13 -0500)
> 
> are available in the Git repository at:
> 
>    https://gitlab.com/harshpb/qemu.git tags/pull-ppc-for-11.2-sf-20261028
> 
> for you to fetch changes up to 74e68729ca8ee576bef823798ffc80589b1edd63:
> 
>    spapr-vscsi: clamp adapter info DMA write length to struct size (2026-10-28 10:45:51 +0530)
> 
> ----------------------------------------------------------------
> ppc queue for 2026-10-28
> - Misc fixes and func test improvements.

Applied, thanks.

r~