Merge ~paelzer/ubuntu/+source/qemu:fix-1832622-ppc-spectre-cosmic into ubuntu/+source/qemu:ubuntu/cosmic-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

Related test PPA at [1].
This started with the provided backports for 2.11 and then one by one taking away changes no more needed on the backports. The commits that "undo some backports" are intentionally not squashed so one can see what changes in between the versions and what is the same.

[1]: https://launchpad.net/~paelzer/+archive/ubuntu/bug-1832622-qemu-spectre-ppc

[Paride Legovini (paride)]

Looks good from a formal point view; the packages in the PPA seem to be working as expected, however I don't think I can test the specific fix.

[Rafael David Tinoco (rafaeldtinoco)]

I did a full bionic review into eoan merge request:

https://code.launchpad.net/~paelzer/ubuntu/+source/qemu/+git/qemu/+merge/368748/comments/964720

All others are a subset of that, I did a quick look and compilation tests only.

+1 from me.

review: Approve

[Christian Ehrhardt  (paelzer)]

This migrated, closing forgotten MP

diff --git a/debian/changelog b/debian/changelog
index bb56b49..0f5786c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+qemu (1:2.12+dfsg-3ubuntu8.10) cosmic; urgency=medium
+
+  * d/p/ubuntu/lp-1832622-*: count cache flush Spectre v2 mitigation for ppc64
+    (LP: #1832622)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 13 Jun 2019 08:20:29 +0200
+
 qemu (1:2.12+dfsg-3ubuntu8.9) cosmic; urgency=medium
 
   * d/p/ubuntu/define-ubuntu-machine-types.patch: fix wily machine type being
diff --git a/debian/patches/series b/debian/patches/series
index 7100e00..57f2a9e 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -63,3 +63,6 @@ CVE-2018-20815.patch
 CVE-2019-5008.patch
 CVE-2019-9824.patch
 ubuntu/lp-1830704-s390x-cpumodel-ignore-csske-for-expansion.patch
+ubuntu/lp-1832622-0001-target-ppc-Factor-out-the-parsing-in-kvmppc_get_cpu_.patch
+ubuntu/lp-1832622-0002-target-ppc-spapr-Add-workaround-option-to-SPAPR_CAP_.patch
+ubuntu/lp-1832622-0004-target-ppc-spapr-Add-SPAPR_CAP_CCF_ASSIST.patch
diff --git a/debian/patches/ubuntu/lp-1832622-0001-target-ppc-Factor-out-the-parsing-in-kvmppc_get_cpu_.patch b/debian/patches/ubuntu/lp-1832622-0001-target-ppc-Factor-out-the-parsing-in-kvmppc_get_cpu_.patch
new file mode 100644
index 0000000..44412f5
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1832622-0001-target-ppc-Factor-out-the-parsing-in-kvmppc_get_cpu_.patch
@@ -0,0 +1,101 @@
+From 8fea70440eb0d095442de7e80d586a285cf96be5 Mon Sep 17 00:00:00 2001
+From: Suraj Jitindar Singh <[e-mail]>
+Date: Fri, 11 May 2018 16:25:07 +1000
+Subject: [PATCH] target/ppc: Factor out the parsing in
+ kvmppc_get_cpu_characteristics()
+
+Factor out the parsing of struct kvm_ppc_cpu_char in
+kvmppc_get_cpu_characteristics() into a separate function for each cap
+for simplicity.
+
+Signed-off-by: Suraj Jitindar Singh <[e-mail]>
+Signed-off-by: David Gibson <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=8fea70440eb0d095442de7e80d586a285cf96be5
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1832622
+Last-Update: 2019-06-13
+
+---
+ target/ppc/kvm.c | 59 ++++++++++++++++++++++++++++++++----------------
+ 1 file changed, 39 insertions(+), 20 deletions(-)
+
+diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
+index cbe13b18d1..2c0c34e125 100644
+--- a/target/ppc/kvm.c
++++ b/target/ppc/kvm.c
+@@ -2412,6 +2412,41 @@ bool kvmppc_has_cap_mmu_hash_v3(void)
+     return cap_mmu_hash_v3;
+ }
+ 
++static int parse_cap_ppc_safe_cache(struct kvm_ppc_cpu_char c)
++{
++    if (~c.behaviour & c.behaviour_mask & H_CPU_BEHAV_L1D_FLUSH_PR) {
++        return 2;
++    } else if ((c.character & c.character_mask & H_CPU_CHAR_L1D_THREAD_PRIV) &&
++               (c.character & c.character_mask
++                & (H_CPU_CHAR_L1D_FLUSH_ORI30 | H_CPU_CHAR_L1D_FLUSH_TRIG2))) {
++        return 1;
++    }
++
++    return 0;
++}
++
++static int parse_cap_ppc_safe_bounds_check(struct kvm_ppc_cpu_char c)
++{
++    if (~c.behaviour & c.behaviour_mask & H_CPU_BEHAV_BNDS_CHK_SPEC_BAR) {
++        return 2;
++    } else if (c.character & c.character_mask & H_CPU_CHAR_SPEC_BAR_ORI31) {
++        return 1;
++    }
++
++    return 0;
++}
++
++static int parse_cap_ppc_safe_indirect_branch(struct kvm_ppc_cpu_char c)
++{
++    if (c.character & c.character_mask & H_CPU_CHAR_CACHE_COUNT_DIS) {
++        return  SPAPR_CAP_FIXED_CCD;
++    } else if (c.character & c.character_mask & H_CPU_CHAR_BCCTRL_SERIALISED) {
++        return SPAPR_CAP_FIXED_IBS;
++    }
++
++    return 0;
++}
++
+ static void kvmppc_get_cpu_characteristics(KVMState *s)
+ {
+     struct kvm_ppc_cpu_char c;
+@@ -2430,26 +2465,10 @@ static void kvmppc_get_cpu_characteristics(KVMState *s)
+     if (ret < 0) {
+         return;
+     }
+-    /* Parse and set cap_ppc_safe_cache */
+-    if (~c.behaviour & c.behaviour_mask & H_CPU_BEHAV_L1D_FLUSH_PR) {
+-        cap_ppc_safe_cache = 2;
+-    } else if ((c.character & c.character_mask & H_CPU_CHAR_L1D_THREAD_PRIV) &&
+-               (c.character & c.character_mask
+-                & (H_CPU_CHAR_L1D_FLUSH_ORI30 | H_CPU_CHAR_L1D_FLUSH_TRIG2))) {
+-        cap_ppc_safe_cache = 1;
+-    }
+-    /* Parse and set cap_ppc_safe_bounds_check */
+-    if (~c.behaviour & c.behaviour_mask & H_CPU_BEHAV_BNDS_CHK_SPEC_BAR) {
+-        cap_ppc_safe_bounds_check = 2;
+-    } else if (c.character & c.character_mask & H_CPU_CHAR_SPEC_BAR_ORI31) {
+-        cap_ppc_safe_bounds_check = 1;
+-    }
+-    /* Parse and set cap_ppc_safe_indirect_branch */
+-    if (c.character & c.character_mask & H_CPU_CHAR_CACHE_COUNT_DIS) {
+-        cap_ppc_safe_indirect_branch = SPAPR_CAP_FIXED_CCD;
+-    } else if (c.character & c.character_mask & H_CPU_CHAR_BCCTRL_SERIALISED) {
+-        cap_ppc_safe_indirect_branch = SPAPR_CAP_FIXED_IBS;
+-    }
++
++    cap_ppc_safe_cache = parse_cap_ppc_safe_cache(c);
++    cap_ppc_safe_bounds_check = parse_cap_ppc_safe_bounds_check(c);
++    cap_ppc_safe_indirect_branch = parse_cap_ppc_safe_indirect_branch(c);
+ }
+ 
+ int kvmppc_get_cap_safe_cache(void)
+-- 
+2.21.0
+
diff --git a/debian/patches/ubuntu/lp-1832622-0002-target-ppc-spapr-Add-workaround-option-to-SPAPR_CAP_.patch b/debian/patches/ubuntu/lp-1832622-0002-target-ppc-spapr-Add-workaround-option-to-SPAPR_CAP_.patch
new file mode 100644
index 0000000..58b3e88
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1832622-0002-target-ppc-spapr-Add-workaround-option-to-SPAPR_CAP_.patch
@@ -0,0 +1,159 @@
+From 399b2896d4948a1ec0278d896ea3a561df768d64 Mon Sep 17 00:00:00 2001
+From: Suraj Jitindar Singh <[e-mail]>
+Date: Fri, 1 Mar 2019 14:19:11 +1100
+Subject: [PATCH 1/2] target/ppc/spapr: Add workaround option to SPAPR_CAP_IBS
+
+The spapr_cap SPAPR_CAP_IBS is used to indicate the level of capability
+for mitigations for indirect branch speculation. Currently the available
+values are broken (default), fixed-ibs (fixed by serialising indirect
+branches) and fixed-ccd (fixed by diabling the count cache).
+
+Introduce a new value for this capability denoted workaround, meaning that
+software can work around the issue by flushing the count cache on
+context switch. This option is available if the hypervisor sets the
+H_CPU_BEHAV_FLUSH_COUNT_CACHE flag in the cpu behaviours returned from
+the KVM_PPC_GET_CPU_CHAR ioctl.
+
+Signed-off-by: Suraj Jitindar Singh <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: David Gibson <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=399b2896d4948a1ec0278d896ea3a561df768d64
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1832622
+Last-Update: 2019-06-13
+
+---
+ hw/ppc/spapr_caps.c    | 21 ++++++++++-----------
+ hw/ppc/spapr_hcall.c   |  5 +++++
+ include/hw/ppc/spapr.h |  7 +++++++
+ target/ppc/kvm.c       |  8 +++++++-
+ 4 files changed, 29 insertions(+), 12 deletions(-)
+
+diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
+index faab472d06..ca35b5153d 100644
+--- a/hw/ppc/spapr_caps.c
++++ b/hw/ppc/spapr_caps.c
+@@ -276,11 +276,13 @@ static void cap_safe_bounds_check_apply(sPAPRMachineState *spapr, uint8_t val,
+ }
+ 
+ sPAPRCapPossible cap_ibs_possible = {
+-    .num = 4,
++    .num = 5,
+     /* Note workaround only maintained for compatibility */
+-    .vals = {"broken", "workaround", "fixed-ibs", "fixed-ccd"},
+-    .help = "broken - no protection, fixed-ibs - indirect branch serialisation,"
+-            " fixed-ccd - cache count disabled",
++    .vals = {"broken", "workaround", "fixed-ibs", "fixed-ccd", "fixed-na"},
++    .help = "broken - no protection, workaround - count cache flush"
++            ", fixed-ibs - indirect branch serialisation,"
++            " fixed-ccd - cache count disabled,"
++            " fixed-na - fixed in hardware (no longer applicable)",
+ };
+ 
+ static void cap_safe_indirect_branch_apply(sPAPRMachineState *spapr,
+@@ -288,15 +290,11 @@ static void cap_safe_indirect_branch_apply(sPAPRMachineState *spapr,
+ {
+     uint8_t kvm_val = kvmppc_get_cap_safe_indirect_branch();
+ 
+-    if (val == SPAPR_CAP_WORKAROUND) { /* Can only be Broken or Fixed */
+-        error_setg(errp,
+-"Requested safe indirect branch capability level \"workaround\" not valid, try cap-ibs=%s",
+-                   cap_ibs_possible.vals[kvm_val]);
+-    } else if (tcg_enabled() && val) {
++    if (tcg_enabled() && val) {
+         /* TODO - for now only allow broken for TCG */
+         error_setg(errp,
+ "Requested safe indirect branch capability level not supported by tcg, try a different value for cap-ibs");
+-    } else if (kvm_enabled() && val && (val != kvm_val)) {
++    } else if (kvm_enabled() && (val > kvm_val)) {
+         error_setg(errp,
+ "Requested safe indirect branch capability level not supported by kvm, try cap-ibs=%s",
+                    cap_ibs_possible.vals[kvm_val]);
+@@ -494,7 +492,8 @@ sPAPRCapabilityInfo capability_table[SPAPR_CAP_NUM] = {
+     [SPAPR_CAP_IBS] = {
+         .name = "ibs",
+         .description =
+-            "Indirect Branch Speculation (broken, fixed-ibs, fixed-ccd)",
++            "Indirect Branch Speculation (broken, workaround, fixed-ibs,"
++            "fixed-ccd, fixed-na)",
+         .index = SPAPR_CAP_IBS,
+         .get = spapr_cap_get_string,
+         .set = spapr_cap_set_string,
+diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
+index 476bad6271..4aa8036fc0 100644
+--- a/hw/ppc/spapr_hcall.c
++++ b/hw/ppc/spapr_hcall.c
+@@ -1723,12 +1723,17 @@ static target_ulong h_get_cpu_characteristics(PowerPCCPU *cpu,
+     }
+ 
+     switch (safe_indirect_branch) {
++    case SPAPR_CAP_FIXED_NA:
++        break;
+     case SPAPR_CAP_FIXED_CCD:
+         characteristics |= H_CPU_CHAR_CACHE_COUNT_DIS;
+         break;
+     case SPAPR_CAP_FIXED_IBS:
+         characteristics |= H_CPU_CHAR_BCCTRL_SERIALISED;
+         break;
++    case SPAPR_CAP_WORKAROUND:
++        behaviour |= H_CPU_BEHAV_FLUSH_COUNT_CACHE;
++        break;
+     default: /* broken */
+         assert(safe_indirect_branch == SPAPR_CAP_BROKEN);
+         break;
+diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
+index 8efc5e0779..a7f3b1bfdd 100644
+--- a/include/hw/ppc/spapr.h
++++ b/include/hw/ppc/spapr.h
+@@ -85,12 +85,17 @@ typedef enum {
+ /* Bool Caps */
+ #define SPAPR_CAP_OFF                   0x00
+ #define SPAPR_CAP_ON                    0x01
++
+ /* Custom Caps */
++
++/* Generic */
+ #define SPAPR_CAP_BROKEN                0x00
+ #define SPAPR_CAP_WORKAROUND            0x01
+ #define SPAPR_CAP_FIXED                 0x02
++/* SPAPR_CAP_IBS (cap-ibs) */
+ #define SPAPR_CAP_FIXED_IBS             0x02
+ #define SPAPR_CAP_FIXED_CCD             0x03
++#define SPAPR_CAP_FIXED_NA              0x10 /* Lets leave a bit of a gap... */
+ 
+ typedef struct sPAPRCapabilities sPAPRCapabilities;
+ struct sPAPRCapabilities {
+@@ -339,9 +344,11 @@ struct sPAPRMachineState {
+ #define H_CPU_CHAR_HON_BRANCH_HINTS             PPC_BIT(5)
+ #define H_CPU_CHAR_THR_RECONF_TRIG              PPC_BIT(6)
+ #define H_CPU_CHAR_CACHE_COUNT_DIS              PPC_BIT(7)
++#define H_CPU_CHAR_BCCTR_FLUSH_ASSIST           PPC_BIT(9)
+ #define H_CPU_BEHAV_FAVOUR_SECURITY             PPC_BIT(0)
+ #define H_CPU_BEHAV_L1D_FLUSH_PR                PPC_BIT(1)
+ #define H_CPU_BEHAV_BNDS_CHK_SPEC_BAR           PPC_BIT(2)
++#define H_CPU_BEHAV_FLUSH_COUNT_CACHE           PPC_BIT(5)
+ 
+ /* Each control block has to be on a 4K boundary */
+ #define H_CB_ALIGNMENT     4096
+diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
+index f0f5bf9391..4d46314276 100644
+--- a/target/ppc/kvm.c
++++ b/target/ppc/kvm.c
+@@ -2392,7 +2392,13 @@ static int parse_cap_ppc_safe_bounds_check(struct kvm_ppc_cpu_char c)
+ 
+ static int parse_cap_ppc_safe_indirect_branch(struct kvm_ppc_cpu_char c)
+ {
+-    if (c.character & c.character_mask & H_CPU_CHAR_CACHE_COUNT_DIS) {
++    if ((~c.behaviour & c.behaviour_mask & H_CPU_BEHAV_FLUSH_COUNT_CACHE) &&
++        (~c.character & c.character_mask & H_CPU_CHAR_CACHE_COUNT_DIS) &&
++        (~c.character & c.character_mask & H_CPU_CHAR_BCCTRL_SERIALISED)) {
++        return SPAPR_CAP_FIXED_NA;
++    } else if (c.behaviour & c.behaviour_mask & H_CPU_BEHAV_FLUSH_COUNT_CACHE) {
++        return SPAPR_CAP_WORKAROUND;
++    } else if (c.character & c.character_mask & H_CPU_CHAR_CACHE_COUNT_DIS) {
+         return  SPAPR_CAP_FIXED_CCD;
+     } else if (c.character & c.character_mask & H_CPU_CHAR_BCCTRL_SERIALISED) {
+         return SPAPR_CAP_FIXED_IBS;
+-- 
+2.21.0
+
diff --git a/debian/patches/ubuntu/lp-1832622-0004-target-ppc-spapr-Add-SPAPR_CAP_CCF_ASSIST.patch b/debian/patches/ubuntu/lp-1832622-0004-target-ppc-spapr-Add-SPAPR_CAP_CCF_ASSIST.patch
new file mode 100644
index 0000000..e76d1fd
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1832622-0004-target-ppc-spapr-Add-SPAPR_CAP_CCF_ASSIST.patch
@@ -0,0 +1,224 @@
+From 77012c6029ae15328f04ddcb713f459cdacffef9 Mon Sep 17 00:00:00 2001
+From: Suraj Jitindar Singh <[e-mail]>
+Date: Fri, 1 Mar 2019 14:19:12 +1100
+Subject: [PATCH] target/ppc/spapr: Add SPAPR_CAP_CCF_ASSIST
+
+Introduce a new spapr_cap SPAPR_CAP_CCF_ASSIST to be used to indicate
+the requirement for a hw-assisted version of the count cache flush
+workaround.
+
+The count cache flush workaround is a software workaround which can be
+used to flush the count cache on context switch. Some revisions of
+hardware may have a hardware accelerated flush, in which case the
+software flush can be shortened. This cap is used to set the
+availability of such hardware acceleration for the count cache flush
+routine.
+
+The availability of such hardware acceleration is indicated by the
+H_CPU_CHAR_BCCTR_FLUSH_ASSIST flag being set in the characteristics
+returned from the KVM_PPC_GET_CPU_CHAR ioctl.
+
+Signed-off-by: Suraj Jitindar Singh <[e-mail]>
+Message-Id: <[e-mail]>
+[dwg: Small style fixes]
+Signed-off-by: David Gibson <[e-mail]>
+(cherry picked from commit 8ff43ee404d3e295839d1fd4e9e6571ca7a62a66)
+* remove context dependencies on post-2.11 capabilities and migration
+  state
+* adjust SPAPR_CAP_CCF_ASSIST to be next avail index (SPAPR_CAP_IBS + 1)
+Signed-off-by: Michael Roth <[e-mail]>
+(cherry picked from commit 2cdaf75db8ac825cb4b8b6a00b7bb114941cc51d)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Author: Michael Roth <[e-mail]>
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=8ff43ee404d3e295839d1fd4e9e6571ca7a62a66
+Origin: backport, https://github.com/mdroth/qemu/commit/77012c6029ae15328f04ddcb713f459cdacffef9
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1832622
+Last-Update: 2019-06-13
+
+---
+ hw/ppc/spapr.c         |  2 ++
+ hw/ppc/spapr_caps.c    | 25 +++++++++++++++++++++++++
+ hw/ppc/spapr_hcall.c   |  5 +++++
+ include/hw/ppc/spapr.h |  5 ++++-
+ target/ppc/kvm.c       | 16 ++++++++++++++++
+ target/ppc/kvm_ppc.h   |  6 ++++++
+ 6 files changed, 58 insertions(+), 1 deletion(-)
+
+--- a/hw/ppc/spapr.c
++++ b/hw/ppc/spapr.c
+@@ -1805,6 +1805,7 @@ static const VMStateDescription vmstate_
+         &vmstate_spapr_cap_cfpc,
+         &vmstate_spapr_cap_sbbc,
+         &vmstate_spapr_cap_ibs,
++        &vmstate_spapr_cap_ccf_assist,
+         NULL
+     }
+ };
+@@ -3938,6 +3939,7 @@ static void spapr_machine_class_init(Obj
+     smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_BROKEN;
+     smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_BROKEN;
+     smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_BROKEN;
++    smc->default_caps.caps[SPAPR_CAP_CCF_ASSIST] = SPAPR_CAP_OFF;
+     spapr_caps_add_properties(smc, &error_abort);
+ }
+ 
+--- a/hw/ppc/spapr_caps.c
++++ b/hw/ppc/spapr_caps.c
+@@ -263,6 +263,21 @@ static void cap_safe_indirect_branch_app
+ 
+ #define VALUE_DESC_TRISTATE     " (broken, workaround, fixed)"
+ 
++static void cap_ccf_assist_apply(sPAPRMachineState *spapr, uint8_t val,
++                                 Error **errp)
++{
++    uint8_t kvm_val = kvmppc_get_cap_count_cache_flush_assist();
++
++    if (tcg_enabled() && val) {
++        /* TODO - for now only allow broken for TCG */
++        error_setg(errp,
++"Requested count cache flush assist capability level not supported by tcg, try cap-ccf-assist=off");
++    } else if (kvm_enabled() && (val > kvm_val)) {
++        error_setg(errp,
++"Requested count cache flush assist capability level not supported by kvm, try cap-ccf-assist=off");
++    }
++}
++
+ sPAPRCapabilityInfo capability_table[SPAPR_CAP_NUM] = {
+     [SPAPR_CAP_HTM] = {
+         .name = "htm",
+@@ -323,6 +338,15 @@ sPAPRCapabilityInfo capability_table[SPA
+         .possible = &cap_ibs_possible,
+         .apply = cap_safe_indirect_branch_apply,
+     },
++    [SPAPR_CAP_CCF_ASSIST] = {
++        .name = "ccf-assist",
++        .description = "Count Cache Flush Assist via HW Instruction",
++        .index = SPAPR_CAP_CCF_ASSIST,
++        .get = spapr_cap_get_bool,
++        .set = spapr_cap_set_bool,
++        .type = "bool",
++        .apply = cap_ccf_assist_apply,
++    },
+ };
+ 
+ static sPAPRCapabilities default_caps_with_cpu(sPAPRMachineState *spapr,
+@@ -442,6 +466,7 @@ SPAPR_CAP_MIG_STATE(dfp, SPAPR_CAP_DFP);
+ SPAPR_CAP_MIG_STATE(cfpc, SPAPR_CAP_CFPC);
+ SPAPR_CAP_MIG_STATE(sbbc, SPAPR_CAP_SBBC);
+ SPAPR_CAP_MIG_STATE(ibs, SPAPR_CAP_IBS);
++SPAPR_CAP_MIG_STATE(ccf_assist, SPAPR_CAP_CCF_ASSIST);
+ 
+ void spapr_caps_reset(sPAPRMachineState *spapr)
+ {
+--- a/hw/ppc/spapr_hcall.c
++++ b/hw/ppc/spapr_hcall.c
+@@ -1675,6 +1675,8 @@ static target_ulong h_get_cpu_characteri
+     uint8_t safe_cache = spapr_get_cap(spapr, SPAPR_CAP_CFPC);
+     uint8_t safe_bounds_check = spapr_get_cap(spapr, SPAPR_CAP_SBBC);
+     uint8_t safe_indirect_branch = spapr_get_cap(spapr, SPAPR_CAP_IBS);
++    uint8_t count_cache_flush_assist = spapr_get_cap(spapr,
++                                                     SPAPR_CAP_CCF_ASSIST);
+ 
+     switch (safe_cache) {
+     case SPAPR_CAP_WORKAROUND:
+@@ -1715,6 +1717,9 @@ static target_ulong h_get_cpu_characteri
+         break;
+     case SPAPR_CAP_WORKAROUND:
+         behaviour |= H_CPU_BEHAV_FLUSH_COUNT_CACHE;
++        if (count_cache_flush_assist) {
++            characteristics |= H_CPU_CHAR_BCCTR_FLUSH_ASSIST;
++        }
+         break;
+     default: /* broken */
+         assert(safe_indirect_branch == SPAPR_CAP_BROKEN);
+--- a/include/hw/ppc/spapr.h
++++ b/include/hw/ppc/spapr.h
+@@ -66,8 +66,10 @@ typedef enum {
+ #define SPAPR_CAP_SBBC                  0x04
+ /* Indirect Branch Serialisation */
+ #define SPAPR_CAP_IBS                   0x05
++/* Count Cache Flush Assist HW Instruction */
++#define SPAPR_CAP_CCF_ASSIST            0x06
+ /* Num Caps */
+-#define SPAPR_CAP_NUM                   (SPAPR_CAP_IBS + 1)
++#define SPAPR_CAP_NUM                   (SPAPR_CAP_CCF_ASSIST + 1)
+ 
+ /*
+  * Capability Values
+@@ -800,6 +802,7 @@ extern const VMStateDescription vmstate_
+ extern const VMStateDescription vmstate_spapr_cap_cfpc;
+ extern const VMStateDescription vmstate_spapr_cap_sbbc;
+ extern const VMStateDescription vmstate_spapr_cap_ibs;
++extern const VMStateDescription vmstate_spapr_cap_ccf_assist;
+ 
+ static inline uint8_t spapr_get_cap(sPAPRMachineState *spapr, int cap)
+ {
+--- a/target/ppc/kvm.c
++++ b/target/ppc/kvm.c
+@@ -92,6 +92,7 @@ static int cap_ppc_pvr_compat;
+ static int cap_ppc_safe_cache;
+ static int cap_ppc_safe_bounds_check;
+ static int cap_ppc_safe_indirect_branch;
++static int cap_ppc_count_cache_flush_assist;
+ 
+ static uint32_t debug_inst_opcode;
+ 
+@@ -2502,6 +2503,14 @@ static int parse_cap_ppc_safe_indirect_b
+     return 0;
+ }
+ 
++static int parse_cap_ppc_count_cache_flush_assist(struct kvm_ppc_cpu_char c)
++{
++    if (c.character & c.character_mask & H_CPU_CHAR_BCCTR_FLUSH_ASSIST) {
++        return 1;
++    }
++    return 0;
++}
++
+ static void kvmppc_get_cpu_characteristics(KVMState *s)
+ {
+     struct kvm_ppc_cpu_char c;
+@@ -2524,6 +2533,8 @@ static void kvmppc_get_cpu_characteristi
+     cap_ppc_safe_cache = parse_cap_ppc_safe_cache(c);
+     cap_ppc_safe_bounds_check = parse_cap_ppc_safe_bounds_check(c);
+     cap_ppc_safe_indirect_branch = parse_cap_ppc_safe_indirect_branch(c);
++    cap_ppc_count_cache_flush_assist =
++        parse_cap_ppc_count_cache_flush_assist(c);
+ }
+ 
+ int kvmppc_get_cap_safe_cache(void)
+@@ -2546,6 +2557,11 @@ bool kvmppc_has_cap_spapr_vfio(void)
+     return cap_spapr_vfio;
+ }
+ 
++int kvmppc_get_cap_count_cache_flush_assist(void)
++{
++    return cap_ppc_count_cache_flush_assist;
++}
++
+ PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void)
+ {
+     uint32_t host_pvr = mfpvr();
+--- a/target/ppc/kvm_ppc.h
++++ b/target/ppc/kvm_ppc.h
+@@ -63,6 +63,7 @@ bool kvmppc_has_cap_mmu_hash_v3(void);
+ int kvmppc_get_cap_safe_cache(void);
+ int kvmppc_get_cap_safe_bounds_check(void);
+ int kvmppc_get_cap_safe_indirect_branch(void);
++int kvmppc_get_cap_count_cache_flush_assist(void);
+ int kvmppc_enable_hwrng(void);
+ int kvmppc_put_books_sregs(PowerPCCPU *cpu);
+ PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void);
+@@ -313,6 +314,11 @@ static inline int kvmppc_get_cap_safe_in
+ {
+     return 0;
+ }
++
++static inline int kvmppc_get_cap_count_cache_flush_assist(void)
++{
++    return 0;
++}
+ 
+ static inline int kvmppc_enable_hwrng(void)
+ {