https://patchew.org/QEMU/20260719145559.94342-1-kirill@korins.ky/

Index: target/ppc/mmu-book3s-v3.c
--- target/ppc/mmu-book3s-v3.c.orig
+++ target/ppc/mmu-book3s-v3.c
@@ -23,24 +23,37 @@
 #include "mmu-hash64.h"
 #include "mmu-book3s-v3.h"
 
+#define PPC64_V3_PATE_SIZE 16 /* two 64-bit words */
+
 bool ppc64_v3_get_pate(PowerPCCPU *cpu, target_ulong lpid, ppc_v3_pate_t *entry)
 {
     uint64_t patb = cpu->env.spr[SPR_PTCR] & PTCR_PATB;
     uint64_t pats = cpu->env.spr[SPR_PTCR] & PTCR_PATS;
+    uint64_t table_size;
+    uint64_t entries;
 
+    /*
+     * The POWER9 Processor User's Manual, section 4.9.4, specifies that
+     * POWER9 ignores PTCR[PATS] and only supports a 64 KiB partition table.
+     */
+    if (cpu->env.excp_model == POWERPC_EXCP_POWER9) {
+        pats = 4;
+    }
+    table_size = 1ULL << (pats + 12);
+
     /* Check if partition table is properly aligned */
-    if (patb & MAKE_64BIT_MASK(0, pats + 12)) {
+    if (patb & (table_size - 1)) {
         return false;
     }
 
     /* Calculate number of entries */
-    pats = 1ull << (pats + 12 - 4);
-    if (pats <= lpid) {
+    entries = table_size / PPC64_V3_PATE_SIZE;
+    if (entries <= lpid) {
         return false;
     }
 
     /* Grab entry */
-    patb += 16 * lpid;
+    patb += PPC64_V3_PATE_SIZE * lpid;
     entry->dw0 = ldq_phys(CPU(cpu)->as, patb);
     entry->dw1 = ldq_phys(CPU(cpu)->as, patb + 8);
     return true;
