Re: [Bug] QEMU TCG warnings after commit c6bd2dd63420 - HTT / CMP_LEG bits

[Xiaoyao Li <xiaoyao.li@intel.com>]

On 4/29/2025 11:02 AM, Ewan Hai wrote:
> Hi Community,
> 
> This email contains 3 bugs appear to share the same root cause.
> 
> [1] We ran into the following warnings when running QEMU v10.0.0 in TCG 
> mode:
> 
> qemu-system-x86_64 \
>    -machine q35 \
>    -m 4G -smp 4 \
>    -kernel ./arch/x86/boot/bzImage \
>    -bios /usr/share/ovmf/OVMF.fd \
>    -drive file=~/kernel/rootfs.ext4,index=0,format=raw,media=disk \
>    -drive file=~/kernel/swap.img,index=1,format=raw,media=disk \
>    -nographic \
>    -append 'root=/dev/sda rw resume=/dev/sdb console=ttyS0 nokaslr'
> 
> qemu-system-x86_64: warning: TCG doesn't support requested feature: 
> CPUID.01H:EDX.ht [bit 28]
> qemu-system-x86_64: warning: TCG doesn't support requested feature: 
> CPUID.80000001H:ECX.cmp-legacy [bit 1]
> (repeats 4 times, once per vCPU)
> 
> Tracing the history shows that commit c6bd2dd63420 "i386/cpu: Set up 
> CPUID_HT in x86_cpu_expand_features() instead of cpu_x86_cpuid()" is 
> what introduced the warnings.
> 
> Since that commit, TCG unconditionally advertises HTT (CPUID 1 EDX[28]) 
> and CMP_LEG (CPUID 8000_0001 ECX[1]). Because TCG itself has no SMT 
> support, these bits trigger the warnings above.
> 
> [2] Also, Zhao pointed me to a similar report on GitLab:
> https://gitlab.com/qemu-project/qemu/-/issues/2894
> The symptoms there look identical to what we're seeing.
> 
> By convention we file one issue per email, but these two appear to share 
> the same root cause, so I'm describing them together here.

It was caused by my two patches. I think the fix can be as follow.
If no objection from the community, I can submit the formal patch.

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 1f970aa4daa6..fb95aadd6161 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -776,11 +776,12 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t 
vendor1,
            CPUID_PAE | CPUID_MCE | CPUID_CX8 | CPUID_APIC | CPUID_SEP | \
            CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV | CPUID_PAT | \
            CPUID_PSE36 | CPUID_CLFLUSH | CPUID_ACPI | CPUID_MMX | \
-          CPUID_FXSR | CPUID_SSE | CPUID_SSE2 | CPUID_SS | CPUID_DE)
+          CPUID_FXSR | CPUID_SSE | CPUID_SSE2 | CPUID_SS | CPUID_DE | \
+          CPUID_HT)
            /* partly implemented:
            CPUID_MTRR, CPUID_MCA, CPUID_CLFLUSH (needed for Win64) */
            /* missing:
-          CPUID_VME, CPUID_DTS, CPUID_SS, CPUID_HT, CPUID_TM, CPUID_PBE */
+          CPUID_VME, CPUID_DTS, CPUID_SS, CPUID_TM, CPUID_PBE */

  /*
   * Kernel-only features that can be shown to usermode programs even if
@@ -848,7 +849,8 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t 
vendor1,

  #define TCG_EXT3_FEATURES (CPUID_EXT3_LAHF_LM | CPUID_EXT3_SVM | \
            CPUID_EXT3_CR8LEG | CPUID_EXT3_ABM | CPUID_EXT3_SSE4A | \
-          CPUID_EXT3_3DNOWPREFETCH | CPUID_EXT3_KERNEL_FEATURES)
+          CPUID_EXT3_3DNOWPREFETCH | CPUID_EXT3_KERNEL_FEATURES | \
+          CPUID_EXT3_CMP_LEG)

  #define TCG_EXT4_FEATURES 0

> [3] My colleague Alan noticed what appears to be a related problem: if 
> we launch a guest with '-cpu <model>,-ht --enable-kvm', which means 
> explicitly removing the ht flag, but the guest still reports HT(cat / 
> proc/cpuinfo in linux guest) enabled. In other words, under KVM the ht 
> bit seems to be forced on even when the user tries to disable it.

This has been the behavior of QEMU for many years, not some regression 
introduced by my patches. We can discuss how to address it separately.

> Best regards,
> Ewan