Merge ~paelzer/ubuntu/+source/qemu:fix-1832622-ppc-spectre-bionic into ubuntu/+source/qemu:ubuntu/bionic-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

Related test PPA at [1].
This is based on the provided backports for 2.11

[1]: https://launchpad.net/~paelzer/+archive/ubuntu/bug-1832622-qemu-spectre-ppc

[Paride Legovini (legovini)]

Looks good from a formal point view; the packages in the PPA seem to be working as expected, however I don't think I can test the specific fix.

[Rafael David Tinoco (rafaeldtinoco)]

I did a full bionic review into eoan merge request, sorry, they are all linked so I guess it is no biggie. This was my comment there:

https://code.launchpad.net/~paelzer/ubuntu/+source/qemu/+git/qemu/+merge/368748/comments/964720

I think you missed one clarification I asked about:

"""
Your comment:

"remove context dependencies on post-2.11 capabilities and migration state"

was made due to positional changes, right ?

Cause I can see only the enum index as diff from upstream.
"""

I'm referring to a note to your cherry-pick/backport in:

commit 8ff43ee404d3e295839d1fd4e9e6571ca7a62a66 (v3.1.0-2772-g8ff43ee404)
Author: Suraj Jitindar Singh <email address hidden>
Date: Fri Mar 1 00:19:12 2019

    target/ppc/spapr: Add SPAPR_CAP_CCF_ASSIST

Cause all difference I could find from upstream was the enum + 1.

I'm more curious then pointing out something here.
----

+1 from me.

[Rafael David Tinoco (rafaeldtinoco)]

Forgot to approve =). +1.

review: Approve

[Christian Ehrhardt  (paelzer)]

Yes it was just context changes for other options being missing in 2.11

[Christian Ehrhardt  (paelzer)]

This migrated, closing forgotten MP

diff --git a/debian/changelog b/debian/changelog
index a736aad..8ea15ce 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+qemu (1:2.11+dfsg-1ubuntu7.16) bionic; urgency=medium
+
+  * d/p/ubuntu/lp-1832622-*: count cache flush Spectre v2 mitigation for ppc64
+    (LP: #1832622)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 13 Jun 2019 08:08:33 +0200
+
 qemu (1:2.11+dfsg-1ubuntu7.15) bionic; urgency=medium
 
   * d/p/ubuntu/define-ubuntu-machine-types.patch: fix wily machine type being
diff --git a/debian/patches/series b/debian/patches/series
index f42b259..86efeb1 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -87,3 +87,7 @@ ubuntu/enable-md-clear.patch
 CVE-2018-20815.patch
 CVE-2019-9824.patch
 ubuntu/lp-1830704-s390x-cpumodel-ignore-csske-for-expansion.patch
+ubuntu/lp-1832622-0001-target-ppc-Factor-out-the-parsing-in-kvmppc_get_cpu_.patch
+ubuntu/lp-1832622-0002-target-ppc-spapr-Add-workaround-option-to-SPAPR_CAP_.patch
+ubuntu/lp-1832622-0003-ppc-spapr-caps-Change-migration-macro-to-take-full-s.patch
+ubuntu/lp-1832622-0004-target-ppc-spapr-Add-SPAPR_CAP_CCF_ASSIST.patch
diff --git a/debian/patches/ubuntu/lp-1832622-0001-target-ppc-Factor-out-the-parsing-in-kvmppc_get_cpu_.patch b/debian/patches/ubuntu/lp-1832622-0001-target-ppc-Factor-out-the-parsing-in-kvmppc_get_cpu_.patch
new file mode 100644
index 0000000..44412f5
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1832622-0001-target-ppc-Factor-out-the-parsing-in-kvmppc_get_cpu_.patch
@@ -0,0 +1,101 @@
+From 8fea70440eb0d095442de7e80d586a285cf96be5 Mon Sep 17 00:00:00 2001
+From: Suraj Jitindar Singh <[e-mail]>
+Date: Fri, 11 May 2018 16:25:07 +1000
+Subject: [PATCH] target/ppc: Factor out the parsing in
+ kvmppc_get_cpu_characteristics()
+
+Factor out the parsing of struct kvm_ppc_cpu_char in
+kvmppc_get_cpu_characteristics() into a separate function for each cap
+for simplicity.
+
+Signed-off-by: Suraj Jitindar Singh <[e-mail]>
+Signed-off-by: David Gibson <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=8fea70440eb0d095442de7e80d586a285cf96be5
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1832622
+Last-Update: 2019-06-13
+
+---
+ target/ppc/kvm.c | 59 ++++++++++++++++++++++++++++++++----------------
+ 1 file changed, 39 insertions(+), 20 deletions(-)
+
+diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
+index cbe13b18d1..2c0c34e125 100644
+--- a/target/ppc/kvm.c
++++ b/target/ppc/kvm.c
+@@ -2412,6 +2412,41 @@ bool kvmppc_has_cap_mmu_hash_v3(void)
+     return cap_mmu_hash_v3;
+ }
+ 
++static int parse_cap_ppc_safe_cache(struct kvm_ppc_cpu_char c)
++{
++    if (~c.behaviour & c.behaviour_mask & H_CPU_BEHAV_L1D_FLUSH_PR) {
++        return 2;
++    } else if ((c.character & c.character_mask & H_CPU_CHAR_L1D_THREAD_PRIV) &&
++               (c.character & c.character_mask
++                & (H_CPU_CHAR_L1D_FLUSH_ORI30 | H_CPU_CHAR_L1D_FLUSH_TRIG2))) {
++        return 1;
++    }
++
++    return 0;
++}
++
++static int parse_cap_ppc_safe_bounds_check(struct kvm_ppc_cpu_char c)
++{
++    if (~c.behaviour & c.behaviour_mask & H_CPU_BEHAV_BNDS_CHK_SPEC_BAR) {
++        return 2;
++    } else if (c.character & c.character_mask & H_CPU_CHAR_SPEC_BAR_ORI31) {
++        return 1;
++    }
++
++    return 0;
++}
++
++static int parse_cap_ppc_safe_indirect_branch(struct kvm_ppc_cpu_char c)
++{
++    if (c.character & c.character_mask & H_CPU_CHAR_CACHE_COUNT_DIS) {
++        return  SPAPR_CAP_FIXED_CCD;
++    } else if (c.character & c.character_mask & H_CPU_CHAR_BCCTRL_SERIALISED) {
++        return SPAPR_CAP_FIXED_IBS;
++    }
++
++    return 0;
++}
++
+ static void kvmppc_get_cpu_characteristics(KVMState *s)
+ {
+     struct kvm_ppc_cpu_char c;
+@@ -2430,26 +2465,10 @@ static void kvmppc_get_cpu_characteristics(KVMState *s)
+     if (ret < 0) {
+         return;
+     }
+-    /* Parse and set cap_ppc_safe_cache */
+-    if (~c.behaviour & c.behaviour_mask & H_CPU_BEHAV_L1D_FLUSH_PR) {
+-        cap_ppc_safe_cache = 2;
+-    } else if ((c.character & c.character_mask & H_CPU_CHAR_L1D_THREAD_PRIV) &&
+-               (c.character & c.character_mask
+-                & (H_CPU_CHAR_L1D_FLUSH_ORI30 | H_CPU_CHAR_L1D_FLUSH_TRIG2))) {
+-        cap_ppc_safe_cache = 1;
+-    }
+-    /* Parse and set cap_ppc_safe_bounds_check */
+-    if (~c.behaviour & c.behaviour_mask & H_CPU_BEHAV_BNDS_CHK_SPEC_BAR) {
+-        cap_ppc_safe_bounds_check = 2;
+-    } else if (c.character & c.character_mask & H_CPU_CHAR_SPEC_BAR_ORI31) {
+-        cap_ppc_safe_bounds_check = 1;
+-    }
+-    /* Parse and set cap_ppc_safe_indirect_branch */
+-    if (c.character & c.character_mask & H_CPU_CHAR_CACHE_COUNT_DIS) {
+-        cap_ppc_safe_indirect_branch = SPAPR_CAP_FIXED_CCD;
+-    } else if (c.character & c.character_mask & H_CPU_CHAR_BCCTRL_SERIALISED) {
+-        cap_ppc_safe_indirect_branch = SPAPR_CAP_FIXED_IBS;
+-    }
++
++    cap_ppc_safe_cache = parse_cap_ppc_safe_cache(c);
++    cap_ppc_safe_bounds_check = parse_cap_ppc_safe_bounds_check(c);
++    cap_ppc_safe_indirect_branch = parse_cap_ppc_safe_indirect_branch(c);
+ }
+ 
+ int kvmppc_get_cap_safe_cache(void)
+-- 
+2.21.0
+
diff --git a/debian/patches/ubuntu/lp-1832622-0002-target-ppc-spapr-Add-workaround-option-to-SPAPR_CAP_.patch b/debian/patches/ubuntu/lp-1832622-0002-target-ppc-spapr-Add-workaround-option-to-SPAPR_CAP_.patch
new file mode 100644
index 0000000..58b3e88
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1832622-0002-target-ppc-spapr-Add-workaround-option-to-SPAPR_CAP_.patch
@@ -0,0 +1,159 @@
+From 399b2896d4948a1ec0278d896ea3a561df768d64 Mon Sep 17 00:00:00 2001
+From: Suraj Jitindar Singh <[e-mail]>
+Date: Fri, 1 Mar 2019 14:19:11 +1100
+Subject: [PATCH 1/2] target/ppc/spapr: Add workaround option to SPAPR_CAP_IBS
+
+The spapr_cap SPAPR_CAP_IBS is used to indicate the level of capability
+for mitigations for indirect branch speculation. Currently the available
+values are broken (default), fixed-ibs (fixed by serialising indirect
+branches) and fixed-ccd (fixed by diabling the count cache).
+
+Introduce a new value for this capability denoted workaround, meaning that
+software can work around the issue by flushing the count cache on
+context switch. This option is available if the hypervisor sets the
+H_CPU_BEHAV_FLUSH_COUNT_CACHE flag in the cpu behaviours returned from
+the KVM_PPC_GET_CPU_CHAR ioctl.
+
+Signed-off-by: Suraj Jitindar Singh <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: David Gibson <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=399b2896d4948a1ec0278d896ea3a561df768d64
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1832622
+Last-Update: 2019-06-13
+
+---
+ hw/ppc/spapr_caps.c    | 21 ++++++++++-----------
+ hw/ppc/spapr_hcall.c   |  5 +++++
+ include/hw/ppc/spapr.h |  7 +++++++
+ target/ppc/kvm.c       |  8 +++++++-
+ 4 files changed, 29 insertions(+), 12 deletions(-)
+
+diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
+index faab472d06..ca35b5153d 100644
+--- a/hw/ppc/spapr_caps.c
++++ b/hw/ppc/spapr_caps.c
+@@ -276,11 +276,13 @@ static void cap_safe_bounds_check_apply(sPAPRMachineState *spapr, uint8_t val,
+ }
+ 
+ sPAPRCapPossible cap_ibs_possible = {
+-    .num = 4,
++    .num = 5,
+     /* Note workaround only maintained for compatibility */
+-    .vals = {"broken", "workaround", "fixed-ibs", "fixed-ccd"},
+-    .help = "broken - no protection, fixed-ibs - indirect branch serialisation,"
+-            " fixed-ccd - cache count disabled",
++    .vals = {"broken", "workaround", "fixed-ibs", "fixed-ccd", "fixed-na"},
++    .help = "broken - no protection, workaround - count cache flush"
++            ", fixed-ibs - indirect branch serialisation,"
++            " fixed-ccd - cache count disabled,"
++            " fixed-na - fixed in hardware (no longer applicable)",
+ };
+ 
+ static void cap_safe_indirect_branch_apply(sPAPRMachineState *spapr,
+@@ -288,15 +290,11 @@ static void cap_safe_indirect_branch_apply(sPAPRMachineState *spapr,
+ {
+     uint8_t kvm_val = kvmppc_get_cap_safe_indirect_branch();
+ 
+-    if (val == SPAPR_CAP_WORKAROUND) { /* Can only be Broken or Fixed */
+-        error_setg(errp,
+-"Requested safe indirect branch capability level \"workaround\" not valid, try cap-ibs=%s",
+-                   cap_ibs_possible.vals[kvm_val]);
+-    } else if (tcg_enabled() && val) {
++    if (tcg_enabled() && val) {
+         /* TODO - for now only allow broken for TCG */
+         error_setg(errp,
+ "Requested safe indirect branch capability level not supported by tcg, try a different value for cap-ibs");
+-    } else if (kvm_enabled() && val && (val != kvm_val)) {
++    } else if (kvm_enabled() && (val > kvm_val)) {
+         error_setg(errp,
+ "Requested safe indirect branch capability level not supported by kvm, try cap-ibs=%s",
+                    cap_ibs_possible.vals[kvm_val]);
+@@ -494,7 +492,8 @@ sPAPRCapabilityInfo capability_table[SPAPR_CAP_NUM] = {
+     [SPAPR_CAP_IBS] = {
+         .name = "ibs",
+         .description =
+-            "Indirect Branch Speculation (broken, fixed-ibs, fixed-ccd)",
++            "Indirect Branch Speculation (broken, workaround, fixed-ibs,"
++            "fixed-ccd, fixed-na)",
+         .index = SPAPR_CAP_IBS,
+         .get = spapr_cap_get_string,
+         .set = spapr_cap_set_string,
+diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
+index 476bad6271..4aa8036fc0 100644
+--- a/hw/ppc/spapr_hcall.c
++++ b/hw/ppc/spapr_hcall.c
+@@ -1723,12 +1723,17 @@ static target_ulong h_get_cpu_characteristics(PowerPCCPU *cpu,
+     }
+ 
+     switch (safe_indirect_branch) {
++    case SPAPR_CAP_FIXED_NA:
++        break;
+     case SPAPR_CAP_FIXED_CCD:
+         characteristics |= H_CPU_CHAR_CACHE_COUNT_DIS;
+         break;
+     case SPAPR_CAP_FIXED_IBS:
+         characteristics |= H_CPU_CHAR_BCCTRL_SERIALISED;
+         break;
++    case SPAPR_CAP_WORKAROUND:
++        behaviour |= H_CPU_BEHAV_FLUSH_COUNT_CACHE;
++        break;
+     default: /* broken */
+         assert(safe_indirect_branch == SPAPR_CAP_BROKEN);
+         break;
+diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
+index 8efc5e0779..a7f3b1bfdd 100644
+--- a/include/hw/ppc/spapr.h
++++ b/include/hw/ppc/spapr.h
+@@ -85,12 +85,17 @@ typedef enum {
+ /* Bool Caps */
+ #define SPAPR_CAP_OFF                   0x00
+ #define SPAPR_CAP_ON                    0x01
++
+ /* Custom Caps */
++
++/* Generic */
+ #define SPAPR_CAP_BROKEN                0x00
+ #define SPAPR_CAP_WORKAROUND            0x01
+ #define SPAPR_CAP_FIXED                 0x02
++/* SPAPR_CAP_IBS (cap-ibs) */
+ #define SPAPR_CAP_FIXED_IBS             0x02
+ #define SPAPR_CAP_FIXED_CCD             0x03
++#define SPAPR_CAP_FIXED_NA              0x10 /* Lets leave a bit of a gap... */
+ 
+ typedef struct sPAPRCapabilities sPAPRCapabilities;
+ struct sPAPRCapabilities {
+@@ -339,9 +344,11 @@ struct sPAPRMachineState {
+ #define H_CPU_CHAR_HON_BRANCH_HINTS             PPC_BIT(5)
+ #define H_CPU_CHAR_THR_RECONF_TRIG              PPC_BIT(6)
+ #define H_CPU_CHAR_CACHE_COUNT_DIS              PPC_BIT(7)
++#define H_CPU_CHAR_BCCTR_FLUSH_ASSIST           PPC_BIT(9)
+ #define H_CPU_BEHAV_FAVOUR_SECURITY             PPC_BIT(0)
+ #define H_CPU_BEHAV_L1D_FLUSH_PR                PPC_BIT(1)
+ #define H_CPU_BEHAV_BNDS_CHK_SPEC_BAR           PPC_BIT(2)
++#define H_CPU_BEHAV_FLUSH_COUNT_CACHE           PPC_BIT(5)
+ 
+ /* Each control block has to be on a 4K boundary */
+ #define H_CB_ALIGNMENT     4096
+diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
+index f0f5bf9391..4d46314276 100644
+--- a/target/ppc/kvm.c
++++ b/target/ppc/kvm.c
+@@ -2392,7 +2392,13 @@ static int parse_cap_ppc_safe_bounds_check(struct kvm_ppc_cpu_char c)
+ 
+ static int parse_cap_ppc_safe_indirect_branch(struct kvm_ppc_cpu_char c)
+ {
+-    if (c.character & c.character_mask & H_CPU_CHAR_CACHE_COUNT_DIS) {
++    if ((~c.behaviour & c.behaviour_mask & H_CPU_BEHAV_FLUSH_COUNT_CACHE) &&
++        (~c.character & c.character_mask & H_CPU_CHAR_CACHE_COUNT_DIS) &&
++        (~c.character & c.character_mask & H_CPU_CHAR_BCCTRL_SERIALISED)) {
++        return SPAPR_CAP_FIXED_NA;
++    } else if (c.behaviour & c.behaviour_mask & H_CPU_BEHAV_FLUSH_COUNT_CACHE) {
++        return SPAPR_CAP_WORKAROUND;
++    } else if (c.character & c.character_mask & H_CPU_CHAR_CACHE_COUNT_DIS) {
+         return  SPAPR_CAP_FIXED_CCD;
+     } else if (c.character & c.character_mask & H_CPU_CHAR_BCCTRL_SERIALISED) {
+         return SPAPR_CAP_FIXED_IBS;
+-- 
+2.21.0
+
diff --git a/debian/patches/ubuntu/lp-1832622-0003-ppc-spapr-caps-Change-migration-macro-to-take-full-s.patch b/debian/patches/ubuntu/lp-1832622-0003-ppc-spapr-caps-Change-migration-macro-to-take-full-s.patch
new file mode 100644
index 0000000..edc84b7
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1832622-0003-ppc-spapr-caps-Change-migration-macro-to-take-full-s.patch
@@ -0,0 +1,79 @@
+From 8c5909c41916f25b47bfdc465059a926603c1319 Mon Sep 17 00:00:00 2001
+From: Suraj Jitindar Singh <[e-mail]>
+Date: Thu, 15 Feb 2018 11:44:41 +1100
+Subject: [PATCH] ppc/spapr-caps: Change migration macro to take full spapr-cap
+ name
+
+Change the macro that generates the vmstate migration field and the needed
+function for the spapr-caps to take the full spapr-cap name. This has
+the benefit of meaning this instance will be picked up when greping
+for the spapr-caps and making it more obvious what this macro is doing.
+
+Signed-off-by: Suraj Jitindar Singh <[e-mail]>
+Signed-off-by: David Gibson <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=8c5909c41916f25b47bfdc465059a926603c1319
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1832622
+Last-Update: 2019-06-13
+
+---
+ hw/ppc/spapr_caps.c | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
+index 62efdaee38..e69d308560 100644
+--- a/hw/ppc/spapr_caps.c
++++ b/hw/ppc/spapr_caps.c
+@@ -350,34 +350,34 @@ int spapr_caps_post_migration(sPAPRMachineState *spapr)
+ }
+ 
+ /* Used to generate the migration field and needed function for a spapr cap */
+-#define SPAPR_CAP_MIG_STATE(cap, ccap)                  \
+-static bool spapr_cap_##cap##_needed(void *opaque)      \
++#define SPAPR_CAP_MIG_STATE(sname, cap)                 \
++static bool spapr_cap_##sname##_needed(void *opaque)    \
+ {                                                       \
+     sPAPRMachineState *spapr = opaque;                  \
+                                                         \
+-    return spapr->cmd_line_caps[SPAPR_CAP_##ccap] &&    \
+-           (spapr->eff.caps[SPAPR_CAP_##ccap] !=        \
+-            spapr->def.caps[SPAPR_CAP_##ccap]);         \
++    return spapr->cmd_line_caps[cap] &&                 \
++           (spapr->eff.caps[cap] !=                     \
++            spapr->def.caps[cap]);                      \
+ }                                                       \
+                                                         \
+-const VMStateDescription vmstate_spapr_cap_##cap = {    \
+-    .name = "spapr/cap/" #cap,                          \
++const VMStateDescription vmstate_spapr_cap_##sname = {  \
++    .name = "spapr/cap/" #sname,                        \
+     .version_id = 1,                                    \
+     .minimum_version_id = 1,                            \
+-    .needed = spapr_cap_##cap##_needed,                 \
++    .needed = spapr_cap_##sname##_needed,               \
+     .fields = (VMStateField[]) {                        \
+-        VMSTATE_UINT8(mig.caps[SPAPR_CAP_##ccap],       \
++        VMSTATE_UINT8(mig.caps[cap],                    \
+                       sPAPRMachineState),               \
+         VMSTATE_END_OF_LIST()                           \
+     },                                                  \
+ }
+ 
+-SPAPR_CAP_MIG_STATE(htm, HTM);
+-SPAPR_CAP_MIG_STATE(vsx, VSX);
+-SPAPR_CAP_MIG_STATE(dfp, DFP);
+-SPAPR_CAP_MIG_STATE(cfpc, CFPC);
+-SPAPR_CAP_MIG_STATE(sbbc, SBBC);
+-SPAPR_CAP_MIG_STATE(ibs, IBS);
++SPAPR_CAP_MIG_STATE(htm, SPAPR_CAP_HTM);
++SPAPR_CAP_MIG_STATE(vsx, SPAPR_CAP_VSX);
++SPAPR_CAP_MIG_STATE(dfp, SPAPR_CAP_DFP);
++SPAPR_CAP_MIG_STATE(cfpc, SPAPR_CAP_CFPC);
++SPAPR_CAP_MIG_STATE(sbbc, SPAPR_CAP_SBBC);
++SPAPR_CAP_MIG_STATE(ibs, SPAPR_CAP_IBS);
+ 
+ void spapr_caps_reset(sPAPRMachineState *spapr)
+ {
+-- 
+2.21.0
+
diff --git a/debian/patches/ubuntu/lp-1832622-0004-target-ppc-spapr-Add-SPAPR_CAP_CCF_ASSIST.patch b/debian/patches/ubuntu/lp-1832622-0004-target-ppc-spapr-Add-SPAPR_CAP_CCF_ASSIST.patch
new file mode 100644
index 0000000..21969ec
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1832622-0004-target-ppc-spapr-Add-SPAPR_CAP_CCF_ASSIST.patch
@@ -0,0 +1,239 @@
+From 77012c6029ae15328f04ddcb713f459cdacffef9 Mon Sep 17 00:00:00 2001
+From: Suraj Jitindar Singh <[e-mail]>
+Date: Fri, 1 Mar 2019 14:19:12 +1100
+Subject: [PATCH] target/ppc/spapr: Add SPAPR_CAP_CCF_ASSIST
+
+Introduce a new spapr_cap SPAPR_CAP_CCF_ASSIST to be used to indicate
+the requirement for a hw-assisted version of the count cache flush
+workaround.
+
+The count cache flush workaround is a software workaround which can be
+used to flush the count cache on context switch. Some revisions of
+hardware may have a hardware accelerated flush, in which case the
+software flush can be shortened. This cap is used to set the
+availability of such hardware acceleration for the count cache flush
+routine.
+
+The availability of such hardware acceleration is indicated by the
+H_CPU_CHAR_BCCTR_FLUSH_ASSIST flag being set in the characteristics
+returned from the KVM_PPC_GET_CPU_CHAR ioctl.
+
+Signed-off-by: Suraj Jitindar Singh <[e-mail]>
+Message-Id: <[e-mail]>
+[dwg: Small style fixes]
+Signed-off-by: David Gibson <[e-mail]>
+(cherry picked from commit 8ff43ee404d3e295839d1fd4e9e6571ca7a62a66)
+* remove context dependencies on post-2.11 capabilities and migration
+  state
+* adjust SPAPR_CAP_CCF_ASSIST to be next avail index (SPAPR_CAP_IBS + 1)
+Signed-off-by: Michael Roth <[e-mail]>
+(cherry picked from commit 2cdaf75db8ac825cb4b8b6a00b7bb114941cc51d)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Author: Michael Roth <[e-mail]>
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=8ff43ee404d3e295839d1fd4e9e6571ca7a62a66
+Origin: backport, https://github.com/mdroth/qemu/commit/77012c6029ae15328f04ddcb713f459cdacffef9
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1832622
+Last-Update: 2019-06-13
+
+---
+ hw/ppc/spapr.c         |  2 ++
+ hw/ppc/spapr_caps.c    | 25 +++++++++++++++++++++++++
+ hw/ppc/spapr_hcall.c   |  5 +++++
+ include/hw/ppc/spapr.h |  5 ++++-
+ target/ppc/kvm.c       | 16 ++++++++++++++++
+ target/ppc/kvm_ppc.h   |  6 ++++++
+ 6 files changed, 58 insertions(+), 1 deletion(-)
+
+diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
+index 90ea7f367c..3a9ca6342e 100644
+--- a/hw/ppc/spapr.c
++++ b/hw/ppc/spapr.c
+@@ -1754,6 +1754,7 @@ static const VMStateDescription vmstate_spapr = {
+         &vmstate_spapr_cap_cfpc,
+         &vmstate_spapr_cap_sbbc,
+         &vmstate_spapr_cap_ibs,
++        &vmstate_spapr_cap_ccf_assist,
+         NULL
+     }
+ };
+@@ -3733,6 +3734,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
+     smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_BROKEN;
+     smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_BROKEN;
+     smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_BROKEN;
++    smc->default_caps.caps[SPAPR_CAP_CCF_ASSIST] = SPAPR_CAP_OFF;
+     spapr_caps_add_properties(smc, &error_abort);
+ }
+ 
+diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
+index cabbd4a0bc..0041c112ec 100644
+--- a/hw/ppc/spapr_caps.c
++++ b/hw/ppc/spapr_caps.c
+@@ -264,6 +264,21 @@ static void cap_safe_indirect_branch_apply(sPAPRMachineState *spapr,
+ 
+ #define VALUE_DESC_TRISTATE     " (broken, workaround, fixed)"
+ 
++static void cap_ccf_assist_apply(sPAPRMachineState *spapr, uint8_t val,
++                                 Error **errp)
++{
++    uint8_t kvm_val = kvmppc_get_cap_count_cache_flush_assist();
++
++    if (tcg_enabled() && val) {
++        /* TODO - for now only allow broken for TCG */
++        error_setg(errp,
++"Requested count cache flush assist capability level not supported by tcg, try cap-ccf-assist=off");
++    } else if (kvm_enabled() && (val > kvm_val)) {
++        error_setg(errp,
++"Requested count cache flush assist capability level not supported by kvm, try cap-ccf-assist=off");
++    }
++}
++
+ sPAPRCapabilityInfo capability_table[SPAPR_CAP_NUM] = {
+     [SPAPR_CAP_HTM] = {
+         .name = "htm",
+@@ -327,6 +342,15 @@ sPAPRCapabilityInfo capability_table[SPAPR_CAP_NUM] = {
+         .possible = &cap_ibs_possible,
+         .apply = cap_safe_indirect_branch_apply,
+     },
++    [SPAPR_CAP_CCF_ASSIST] = {
++        .name = "ccf-assist",
++        .description = "Count Cache Flush Assist via HW Instruction",
++        .index = SPAPR_CAP_CCF_ASSIST,
++        .get = spapr_cap_get_bool,
++        .set = spapr_cap_set_bool,
++        .type = "bool",
++        .apply = cap_ccf_assist_apply,
++    },
+ };
+ 
+ static sPAPRCapabilities default_caps_with_cpu(sPAPRMachineState *spapr,
+@@ -446,6 +470,7 @@ SPAPR_CAP_MIG_STATE(dfp, SPAPR_CAP_DFP);
+ SPAPR_CAP_MIG_STATE(cfpc, SPAPR_CAP_CFPC);
+ SPAPR_CAP_MIG_STATE(sbbc, SPAPR_CAP_SBBC);
+ SPAPR_CAP_MIG_STATE(ibs, SPAPR_CAP_IBS);
++SPAPR_CAP_MIG_STATE(ccf_assist, SPAPR_CAP_CCF_ASSIST);
+ 
+ void spapr_caps_reset(sPAPRMachineState *spapr)
+ {
+diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
+index 779d097bd7..1660ef1d63 100644
+--- a/hw/ppc/spapr_hcall.c
++++ b/hw/ppc/spapr_hcall.c
+@@ -1666,6 +1666,8 @@ static target_ulong h_get_cpu_characteristics(PowerPCCPU *cpu,
+     uint8_t safe_cache = spapr_get_cap(spapr, SPAPR_CAP_CFPC);
+     uint8_t safe_bounds_check = spapr_get_cap(spapr, SPAPR_CAP_SBBC);
+     uint8_t safe_indirect_branch = spapr_get_cap(spapr, SPAPR_CAP_IBS);
++    uint8_t count_cache_flush_assist = spapr_get_cap(spapr,
++                                                     SPAPR_CAP_CCF_ASSIST);
+ 
+     switch (safe_cache) {
+     case SPAPR_CAP_WORKAROUND:
+@@ -1706,6 +1708,9 @@ static target_ulong h_get_cpu_characteristics(PowerPCCPU *cpu,
+         break;
+     case SPAPR_CAP_WORKAROUND:
+         behaviour |= H_CPU_BEHAV_FLUSH_COUNT_CACHE;
++        if (count_cache_flush_assist) {
++            characteristics |= H_CPU_CHAR_BCCTR_FLUSH_ASSIST;
++        }
+         break;
+     default: /* broken */
+         assert(safe_indirect_branch == SPAPR_CAP_BROKEN);
+diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
+index 15cdcb3ef6..011afb62d7 100644
+--- a/include/hw/ppc/spapr.h
++++ b/include/hw/ppc/spapr.h
+@@ -66,8 +66,10 @@ typedef enum {
+ #define SPAPR_CAP_SBBC                  0x04
+ /* Indirect Branch Serialisation */
+ #define SPAPR_CAP_IBS                   0x05
++/* Count Cache Flush Assist HW Instruction */
++#define SPAPR_CAP_CCF_ASSIST            0x06
+ /* Num Caps */
+-#define SPAPR_CAP_NUM                   (SPAPR_CAP_IBS + 1)
++#define SPAPR_CAP_NUM                   (SPAPR_CAP_CCF_ASSIST + 1)
+ 
+ /*
+  * Capability Values
+@@ -781,6 +783,7 @@ extern const VMStateDescription vmstate_spapr_cap_dfp;
+ extern const VMStateDescription vmstate_spapr_cap_cfpc;
+ extern const VMStateDescription vmstate_spapr_cap_sbbc;
+ extern const VMStateDescription vmstate_spapr_cap_ibs;
++extern const VMStateDescription vmstate_spapr_cap_ccf_assist;
+ 
+ static inline uint8_t spapr_get_cap(sPAPRMachineState *spapr, int cap)
+ {
+diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
+index 89b52eb1d4..b8bb16bc59 100644
+--- a/target/ppc/kvm.c
++++ b/target/ppc/kvm.c
+@@ -95,6 +95,7 @@ static int cap_ppc_pvr_compat;
+ static int cap_ppc_safe_cache;
+ static int cap_ppc_safe_bounds_check;
+ static int cap_ppc_safe_indirect_branch;
++static int cap_ppc_count_cache_flush_assist;
+ 
+ static uint32_t debug_inst_opcode;
+ 
+@@ -2505,6 +2506,14 @@ static int parse_cap_ppc_safe_indirect_branch(struct kvm_ppc_cpu_char c)
+     return 0;
+ }
+ 
++static int parse_cap_ppc_count_cache_flush_assist(struct kvm_ppc_cpu_char c)
++{
++    if (c.character & c.character_mask & H_CPU_CHAR_BCCTR_FLUSH_ASSIST) {
++        return 1;
++    }
++    return 0;
++}
++
+ static void kvmppc_get_cpu_characteristics(KVMState *s)
+ {
+     struct kvm_ppc_cpu_char c;
+@@ -2527,6 +2536,8 @@ static void kvmppc_get_cpu_characteristics(KVMState *s)
+     cap_ppc_safe_cache = parse_cap_ppc_safe_cache(c);
+     cap_ppc_safe_bounds_check = parse_cap_ppc_safe_bounds_check(c);
+     cap_ppc_safe_indirect_branch = parse_cap_ppc_safe_indirect_branch(c);
++    cap_ppc_count_cache_flush_assist =
++        parse_cap_ppc_count_cache_flush_assist(c);
+ }
+ 
+ int kvmppc_get_cap_safe_cache(void)
+@@ -2544,6 +2555,11 @@ int kvmppc_get_cap_safe_indirect_branch(void)
+     return cap_ppc_safe_indirect_branch;
+ }
+ 
++int kvmppc_get_cap_count_cache_flush_assist(void)
++{
++    return cap_ppc_count_cache_flush_assist;
++}
++
+ PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void)
+ {
+     uint32_t host_pvr = mfpvr();
+diff --git a/target/ppc/kvm_ppc.h b/target/ppc/kvm_ppc.h
+index 39830baa77..d634b7139e 100644
+--- a/target/ppc/kvm_ppc.h
++++ b/target/ppc/kvm_ppc.h
+@@ -62,6 +62,7 @@ bool kvmppc_has_cap_mmu_hash_v3(void);
+ int kvmppc_get_cap_safe_cache(void);
+ int kvmppc_get_cap_safe_bounds_check(void);
+ int kvmppc_get_cap_safe_indirect_branch(void);
++int kvmppc_get_cap_count_cache_flush_assist(void);
+ int kvmppc_enable_hwrng(void);
+ int kvmppc_put_books_sregs(PowerPCCPU *cpu);
+ PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void);
+@@ -308,6 +309,11 @@ static inline int kvmppc_get_cap_safe_indirect_branch(void)
+     return 0;
+ }
+ 
++static inline int kvmppc_get_cap_count_cache_flush_assist(void)
++{
++    return 0;
++}
++
+ static inline int kvmppc_enable_hwrng(void)
+ {
+     return -1;
+-- 
+2.21.0
+