Merge tag 'dump-pr-v1' of https://gitlab.com/marcandre.lureau/qemu into staging

Dump patches for 2026-06-30

To: qemu-devel@nongnu.org
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmpD3PsACgkQ2ujhCXWW
# nOUW8g//W75y5yaaujNXQ/tqRmIGpVKuB1rC5QXJgRYQlpEIh21tPeHHUUFpOSgU
# llgo2NZM4fqX450vBDU2L6J+qtGc7Q6tm3EKlAe+dZeIlqCcrvHDTGHLq83pCGZQ
# LbABgwnxRcK+BOmSH/LdsP33dFYWBMMwSNZ0P/C986pAs5m/Ji6oz7OI1hRvv5E/
# /HjwJLaXbCyOesWicKpFmN2wiwi3GRiiwI5mBBrue3mmkTvHzb52Pas/B+jT/q/G
# WzIKMYUAwlvYIg2NiWcr1r5UAaXohq4Z4O8jWSpXFoZbg24B5GfmPzg2/mWKtFs1
# UN5J5soqHA/7DV+hDK6v3dPWFnjAMe5PtxjtFdxlt7z5B0LS2hnwHW3tbZtWIhbV
# cFUheXb+ySVw6h0ieK/Ym5k76tExvWHMDfacBHD6oo+ikiOxifCdSSvADYYvnpIU
# ySfjfnEwXg2F/TrsL1o4uotcHeyONJEjy/V6l+pgOATyTGfUvUk0PCRwGNNBhshx
# fZVbP8TSFw3NmS5j86dPUa8hyX1AZPRwSnxPzN/iOnCGigyPjJ3clcGQZ1YGwnip
# KvDXQjmoirJutwEWVd1HZmGnWUqAfrJuselSvER5dWFEKnukbn7wmkIQx3aixZT4
# 1/AUNqPsMNREDTMHN6KCAK7mj7024Gq2Gmupu7aYpdZZtPHUXPA=
# =NMTJ
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 30 Jun 2026 17:12:59 CEST
# gpg:                using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5
# gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [full]
# gpg:                 aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [full]
# Primary key fingerprint: 87A9 BD93 3F87 C606 D276  F62D DAE8 E109 7596 9CE5

* tag 'dump-pr-v1' of https://gitlab.com/marcandre.lureau/qemu:
  dump: fix misleading VMCOREINFO phys_base parse error
  tests/qtest/dump: cover win-dmp availability via vmcoreinfo
  tests/qtest/dump: reject win-dmp without vmcoreinfo
  tests/qtest: add dump-guest-memory test
  dump: make win_dump_available() check vmcoreinfo for a Windows dump header
  system/cpus: refuse memsave/pmemsave while guest RAM is being migrated
  dump: refuse dump-guest-memory while guest RAM is being migrated
  migration: add migration_guest_ram_loading() helper

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

8 files changed, 402 insertions, 8 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index f0695d3d2a..97dcc78ded 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3339,6 +3339,7 @@ F: scripts/dump-guest-memory.py
 F: stubs/dump.c
 F: docs/specs/vmcoreinfo.rst
 F: tests/qtest/vmcoreinfo-test.c
+F: tests/qtest/dump-test.c
 
 Error reporting
 M: Markus Armbruster <armbru@redhat.com>
diff --git a/dump/dump.c b/dump/dump.c
index eb2ee1c10d..52be7258a5 100644
--- a/dump/dump.c
+++ b/dump/dump.c
@@ -30,6 +30,7 @@
 #include "qemu/main-loop.h"
 #include "hw/misc/vmcoreinfo.h"
 #include "migration/blocker.h"
+#include "migration/misc.h"
 #include "hw/core/cpu.h"
 #include "win_dump.h"
 #include "qemu/range.h"
@@ -1771,7 +1772,8 @@ static void vmcoreinfo_update_phys_base(DumpState *s)
         if (prefix && g_str_has_prefix(lines[i], prefix)) {
             if (qemu_strtou64(lines[i] + strlen(prefix), NULL, 16,
                               &phys_base) < 0) {
-                warn_report("Failed to read %s", prefix);
+                warn_report("failed to parse %s in VMCOREINFO: '%s'",
+                            prefix, lines[i] + strlen(prefix));
             } else {
                 s->dump_info.phys_base = phys_base;
             }
@@ -2080,8 +2082,8 @@ void qmp_dump_guest_memory(bool paging, const char *protocol,
     bool detach_p = false;
     bool kdump_raw = false;
 
-    if (runstate_check(RUN_STATE_INMIGRATE)) {
-        error_setg(errp, "Dump not allowed during incoming migration.");
+    if (migration_guest_ram_loading()) {
+        error_setg(errp, "Dump not allowed during migration.");
         return;
     }
 
diff --git a/dump/win_dump-x86.c b/dump/win_dump-x86.c
index 8848c8bfca..0dd0c503c5 100644
--- a/dump/win_dump-x86.c
+++ b/dump/win_dump-x86.c
@@ -18,11 +18,10 @@
 #include "qemu/win_dump_defs.h"
 #include "win_dump.h"
 #include "cpu.h"
-
-bool win_dump_available(Error **errp)
-{
-    return true;
-}
+#include "qemu/bswap.h"
+#include "hw/misc/vmcoreinfo.h"
+#include "migration/misc.h"
+#include "standard-headers/linux/qemu_fw_cfg.h"
 
 static size_t win_dump_ptr_size(bool x64)
 {
@@ -404,6 +403,46 @@ static void restore_context(WinDumpHeader *h, bool x64,
     }
 }
 
+bool win_dump_available(Error **errp)
+{
+    VMCoreInfoState *vmci = vmcoreinfo_find();
+    g_autofree uint8_t *note = NULL;
+    Error *local_err = NULL;
+    WinDumpHeader *h;
+    uint32_t size;
+    bool x64 = true;
+
+    if (migration_guest_ram_loading()) {
+        error_setg(errp, "win-dump: not available during migration");
+        return false;
+    }
+
+    if (!vmci || !vmci->has_vmcoreinfo ||
+        le16_to_cpu(vmci->vmcoreinfo.guest_format) !=
+            FW_CFG_VMCOREINFO_FORMAT_ELF) {
+        error_setg(errp, "win-dump: no vmcoreinfo note from the guest");
+        return false;
+    }
+
+    size = le32_to_cpu(vmci->vmcoreinfo.size);
+    if (size != VMCOREINFO_WIN_DUMP_NOTE_SIZE32 &&
+        size != VMCOREINFO_WIN_DUMP_NOTE_SIZE64) {
+        error_setg(errp, "win-dump: invalid vmcoreinfo note size");
+        return false;
+    }
+
+    note = g_malloc(size);
+    physical_memory_read(le64_to_cpu(vmci->vmcoreinfo.paddr), note, size);
+
+    h = (void *)(note + VMCOREINFO_ELF_NOTE_HDR_SIZE);
+    if (!check_header(h, &x64, &local_err)) {
+        error_propagate(errp, local_err);
+        return false;
+    }
+
+    return true;
+}
+
 void create_win_dump(DumpState *s, Error **errp)
 {
     WinDumpHeader *h = (void *)(s->guest_note + VMCOREINFO_ELF_NOTE_HDR_SIZE);
diff --git a/include/migration/misc.h b/include/migration/misc.h
index 3159a5e53c..d3d6e1f50d 100644
--- a/include/migration/misc.h
+++ b/include/migration/misc.h
@@ -117,6 +117,9 @@ void migration_file_set_error(int ret, Error *err);
 /* True if incoming migration entered POSTCOPY_INCOMING_DISCARD */
 bool migration_in_incoming_postcopy(void);
 
+/* True while the destination still receives guest RAM (precopy or postcopy) */
+bool migration_guest_ram_loading(void);
+
 /* True if incoming migration entered POSTCOPY_INCOMING_ADVISE */
 bool migration_incoming_postcopy_advised(void);
 
diff --git a/migration/migration.c b/migration/migration.c
index 278cad502a..0f56432d90 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -1643,6 +1643,12 @@ bool migration_in_incoming_postcopy(void)
     return ps >= POSTCOPY_INCOMING_DISCARD && ps < POSTCOPY_INCOMING_END;
 }
 
+bool migration_guest_ram_loading(void)
+{
+    return runstate_check(RUN_STATE_INMIGRATE) ||
+           migration_in_incoming_postcopy();
+}
+
 bool migration_incoming_postcopy_advised(void)
 {
     PostcopyState ps = postcopy_state_get();
diff --git a/system/cpus.c b/system/cpus.c
index 49f6daec3c..b31c825b46 100644
--- a/system/cpus.c
+++ b/system/cpus.c
@@ -43,6 +43,7 @@
 #include "system/physmem.h"
 #include "system/replay.h"
 #include "system/runstate.h"
+#include "migration/misc.h"
 #include "system/cpu-timers.h"
 #include "system/whpx.h"
 #include "hw/core/boards.h"
@@ -843,6 +844,11 @@ void qmp_memsave(uint64_t addr, uint64_t size, const char *filename,
     uint8_t buf[1024];
     uint64_t orig_addr = addr, orig_size = size;
 
+    if (migration_guest_ram_loading()) {
+        error_setg(errp, "Guest memory access not allowed during migration");
+        return;
+    }
+
     if (!has_cpu) {
         cpu_index = 0;
     }
@@ -889,6 +895,11 @@ void qmp_pmemsave(uint64_t addr, uint64_t size, const char *filename,
     uint64_t l;
     uint8_t buf[1024];
 
+    if (migration_guest_ram_loading()) {
+        error_setg(errp, "Guest memory access not allowed during migration");
+        return;
+    }
+
     f = fopen(filename, "wb");
     if (!f) {
         error_setg_file_open(errp, errno, filename);
diff --git a/tests/qtest/dump-test.c b/tests/qtest/dump-test.c
new file mode 100644
index 0000000000..30c95a3528
--- /dev/null
+++ b/tests/qtest/dump-test.c
@@ -0,0 +1,331 @@
+/*
+ * QTest testcase for dump-guest-memory
+ *
+ * Generic coverage for the dump-guest-memory QMP command and the
+ * query-dump-guest-memory-capability reporting, exercised on a bare
+ * machine (no guest OS required).
+ *
+ * Copyright (c) 2026 Virtuozzo International GmbH
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest.h"
+#include "libqos/libqos-pc.h"
+#include "libqos/fw_cfg.h"
+#include "qobject/qdict.h"
+#include "qobject/qlist.h"
+#include "qobject/qstring.h"
+#include "qemu/bswap.h"
+#include "qemu/win_dump_defs.h"
+#include "standard-headers/linux/qemu_fw_cfg.h"
+#include "hw/misc/vmcoreinfo.h"
+#include "elf.h"
+
+#define KDUMP_RAW_MAGIC     "KDUMP   "
+#define KDUMP_FLAT_MAGIC    "makedumpfile"
+
+static QTestState *dump_test_start(void)
+{
+    return qtest_initf("-machine q35 -accel qtest -m 16");
+}
+
+static void assert_file_magic(const char *path, const char *magic, size_t len)
+{
+    g_autofree char *buf = g_malloc0(len);
+    FILE *f = fopen(path, "rb");
+
+    g_assert_nonnull(f);
+    g_assert_cmpint(fread(buf, 1, len, f), ==, len);
+    fclose(f);
+    g_assert_cmpint(memcmp(buf, magic, len), ==, 0);
+}
+
+/* validate that the file is a sane x86 ELF core, not just the leading magic */
+static void assert_valid_elf_core(const char *path)
+{
+    unsigned char e[64];
+    FILE *f = fopen(path, "rb");
+    uint16_t e_type, e_machine, e_phnum;
+
+    g_assert_nonnull(f);
+    g_assert_cmpint(fread(e, 1, sizeof(e), f), ==, sizeof(e));
+    fclose(f);
+
+    g_assert_cmpint(memcmp(e, ELFMAG, SELFMAG), ==, 0);
+
+    /* e_type and e_machine sit at the same offset for ELF32 and ELF64 */
+    e_type = lduw_le_p(e + 16);
+    e_machine = lduw_le_p(e + 18);
+    g_assert_cmpint(e_type, ==, ET_CORE);
+    g_assert(e_machine == EM_386 || e_machine == EM_X86_64);
+
+    /* e_phnum lives at a class-dependent offset */
+    if (e[EI_CLASS] == ELFCLASS64) {
+        e_phnum = lduw_le_p(e + 56);
+    } else {
+        e_phnum = lduw_le_p(e + 44);
+    }
+    g_assert_cmpint(e_phnum, >, 0);
+}
+
+/* dump-guest-memory to a fresh temp file; returns the path (caller frees) */
+static char *do_dump(QTestState *qts, const char *format)
+{
+    g_autofree char *tmp = NULL;
+    g_autofree char *proto = NULL;
+    GError *err = NULL;
+    int fd;
+
+    fd = g_file_open_tmp("dump-test-XXXXXX", &tmp, &err);
+    g_assert_no_error(err);
+    close(fd);
+    proto = g_strdup_printf("file:%s", tmp);
+
+    if (format) {
+        qtest_qmp_assert_success(qts,
+            "{ 'execute': 'dump-guest-memory',"
+            "  'arguments': { 'paging': false, 'protocol': %s,"
+            "                 'format': %s } }", proto, format);
+    } else {
+        qtest_qmp_assert_success(qts,
+            "{ 'execute': 'dump-guest-memory',"
+            "  'arguments': { 'paging': false, 'protocol': %s } }", proto);
+    }
+
+    return g_steal_pointer(&tmp);
+}
+
+/* query-dump-guest-memory-capability must always advertise at least 'elf' */
+static void test_query_capability(void)
+{
+    QTestState *qts = dump_test_start();
+    QDict *resp, *ret;
+    QList *formats;
+    QListEntry *e;
+    bool has_elf = false;
+
+    resp = qtest_qmp(qts,
+        "{ 'execute': 'query-dump-guest-memory-capability' }");
+    g_assert(qdict_haskey(resp, "return"));
+    ret = qdict_get_qdict(resp, "return");
+    formats = qdict_get_qlist(ret, "formats");
+    g_assert_nonnull(formats);
+
+    QLIST_FOREACH_ENTRY(formats, e) {
+        QString *qs = qobject_to(QString, qlist_entry_obj(e));
+
+        if (g_str_equal(qstring_get_str(qs), "elf")) {
+            has_elf = true;
+        }
+    }
+    g_assert_true(has_elf);
+
+    qobject_unref(resp);
+    qtest_quit(qts);
+}
+
+static void test_dump_elf(void)
+{
+    QTestState *qts = dump_test_start();
+    g_autofree char *path = do_dump(qts, NULL);
+
+    assert_valid_elf_core(path);
+    unlink(path);
+    qtest_quit(qts);
+}
+
+/* non-raw kdump is emitted in makedumpfile flattened format */
+static void test_dump_kdump_zlib(void)
+{
+    QTestState *qts = dump_test_start();
+    g_autofree char *path = do_dump(qts, "kdump-zlib");
+
+    assert_file_magic(path, KDUMP_FLAT_MAGIC, strlen(KDUMP_FLAT_MAGIC));
+    unlink(path);
+    qtest_quit(qts);
+}
+
+/* raw kdump starts with the on-disk KDUMP header */
+static void test_dump_kdump_raw_zlib(void)
+{
+    QTestState *qts = dump_test_start();
+    g_autofree char *path = do_dump(qts, "kdump-raw-zlib");
+
+    assert_file_magic(path, KDUMP_RAW_MAGIC, strlen(KDUMP_RAW_MAGIC));
+    unlink(path);
+    qtest_quit(qts);
+}
+
+/* an unknown protocol must be rejected, not crash the VM */
+static void test_dump_invalid_protocol(void)
+{
+    QTestState *qts = dump_test_start();
+    g_autofree char *path = NULL;
+    QDict *resp;
+
+    resp = qtest_qmp(qts,
+        "{ 'execute': 'dump-guest-memory',"
+        "  'arguments': { 'paging': false, 'protocol': 'bogus:/x' } }");
+    g_assert(qdict_haskey(resp, "error"));
+    qobject_unref(resp);
+
+    /* VM is still alive and dumping still works afterwards */
+    path = do_dump(qts, NULL);
+    assert_valid_elf_core(path);
+    unlink(path);
+
+    qtest_quit(qts);
+}
+
+/*
+ * Requesting win-dmp without a Windows dump header in vmcoreinfo must be
+ * rejected with a clear error -- and must leave the VM usable, rather than
+ * produce a bogus dump.
+ */
+static void test_dump_win_dmp_unavailable(void)
+{
+    QTestState *qts = dump_test_start();
+    g_autofree char *tmp = NULL;
+    g_autofree char *proto = NULL;
+    g_autofree char *path = NULL;
+    GError *err = NULL;
+    QDict *resp, *error;
+    const char *desc;
+    int fd;
+
+    fd = g_file_open_tmp("dump-test-XXXXXX", &tmp, &err);
+    g_assert_no_error(err);
+    close(fd);
+    proto = g_strdup_printf("file:%s", tmp);
+
+    resp = qtest_qmp(qts,
+        "{ 'execute': 'dump-guest-memory',"
+        "  'arguments': { 'paging': false, 'protocol': %s,"
+        "                 'format': 'win-dmp' } }", proto);
+    error = qdict_get_qdict(resp, "error");
+    g_assert_nonnull(error);
+    desc = qdict_get_try_str(error, "desc");
+    g_assert_nonnull(desc);
+    g_assert_nonnull(strstr(desc, "vmcoreinfo"));
+    qobject_unref(resp);
+    unlink(tmp);
+
+    /* the failed request must not wedge the VM: a plain dump still works */
+    path = do_dump(qts, NULL);
+    assert_valid_elf_core(path);
+    unlink(path);
+
+    qtest_quit(qts);
+}
+
+static bool capability_has_format(QTestState *qts, const char *want)
+{
+    QDict *resp, *ret;
+    QList *formats;
+    QListEntry *e;
+    bool found = false;
+
+    resp = qtest_qmp(qts,
+        "{ 'execute': 'query-dump-guest-memory-capability' }");
+    g_assert(qdict_haskey(resp, "return"));
+    ret = qdict_get_qdict(resp, "return");
+    formats = qdict_get_qlist(ret, "formats");
+    g_assert_nonnull(formats);
+
+    QLIST_FOREACH_ENTRY(formats, e) {
+        QString *qs = qobject_to(QString, qlist_entry_obj(e));
+
+        if (g_str_equal(qstring_get_str(qs), want)) {
+            found = true;
+        }
+    }
+    qobject_unref(resp);
+    return found;
+}
+
+/*
+ * win-dmp becomes available only once the guest exposes a Windows dump
+ * header through vmcoreinfo. Forge exactly such a note -- the layout a
+ * Windows guest with the QEMU vmcoreinfo writer produces: a fixed-size ELF
+ * note header followed by a WinDumpHeader64 carrying the PAGE/DU64
+ * signatures -- place it in guest RAM, point the vmcoreinfo device at it
+ * via fw_cfg, and check that win-dmp flips from unavailable to available.
+ *
+ * This only covers availability *reporting*; the actual win-dmp generation
+ * (create_win_dump()) needs real Windows kernel structures and is not
+ * exercised here.
+ */
+static void test_dump_win_dmp_available(void)
+{
+    const uint64_t paddr = 0x800000; /* 8 MiB, inside guest RAM */
+    size_t notesz = VMCOREINFO_WIN_DUMP_NOTE_SIZE64;
+    g_autofree uint8_t *note = g_malloc0(notesz);
+    Elf64_Nhdr *nhdr = (Elf64_Nhdr *)note;
+    WinDumpHeader64 *hdr;
+    FWCfgVMCoreInfo info;
+    QFWCFG *fw_cfg;
+    QOSState *qs;
+
+    /* the WinDumpHeader64 must sit right after the fixed ELF note header */
+    g_assert_cmpint(sizeof(WinDumpHeader64) % 4, ==, 0);
+
+    nhdr->n_namesz = cpu_to_le32(sizeof("VMCOREINFO")); /* 11 -> padded 12 */
+    nhdr->n_descsz = cpu_to_le32(sizeof(WinDumpHeader64));
+    nhdr->n_type = 0;
+    memcpy(note + sizeof(Elf64_Nhdr), "VMCOREINFO", sizeof("VMCOREINFO") - 1);
+
+    hdr = (WinDumpHeader64 *)(note + VMCOREINFO_ELF_NOTE_HDR_SIZE);
+    memcpy(hdr->Signature, "PAGE", sizeof(hdr->Signature));
+    memcpy(hdr->ValidDump, "DU64", sizeof(hdr->ValidDump));
+
+    qs = qtest_pc_boot("-device vmcoreinfo -m 16");
+    fw_cfg = pc_fw_cfg_init(qs->qts);
+
+    /* with no guest note yet, win-dmp must not be advertised */
+    g_assert_false(capability_has_format(qs->qts, "win-dmp"));
+
+    /* place the forged note in guest RAM and point vmcoreinfo at it */
+    qtest_memwrite(qs->qts, paddr, note, notesz);
+
+    memset(&info, 0, sizeof(info));
+    info.host_format = cpu_to_le16(FW_CFG_VMCOREINFO_FORMAT_ELF);
+    info.guest_format = cpu_to_le16(FW_CFG_VMCOREINFO_FORMAT_ELF);
+    info.size = cpu_to_le32(notesz);
+    info.paddr = cpu_to_le64(paddr);
+    qfw_cfg_write_file(fw_cfg, qs, FW_CFG_VMCOREINFO_FILENAME,
+                       &info, sizeof(info));
+
+    /* now win-dmp must be reported as available */
+    g_assert_true(capability_has_format(qs->qts, "win-dmp"));
+
+    pc_fw_cfg_uninit(fw_cfg);
+    qtest_shutdown(qs);
+}
+
+int main(int argc, char **argv)
+{
+    const char *arch = qtest_get_arch();
+
+    g_test_init(&argc, &argv, NULL);
+
+    qtest_add_func("/dump/query-capability", test_query_capability);
+    qtest_add_func("/dump/elf", test_dump_elf);
+    qtest_add_func("/dump/kdump-zlib", test_dump_kdump_zlib);
+    qtest_add_func("/dump/kdump-raw-zlib", test_dump_kdump_raw_zlib);
+    qtest_add_func("/dump/invalid-protocol", test_dump_invalid_protocol);
+
+    /* win-dmp is an x86_64-only format */
+    if (g_str_equal(arch, "x86_64")) {
+        qtest_add_func("/dump/win-dmp-unavailable",
+                       test_dump_win_dmp_unavailable);
+
+        if (qtest_has_device("vmcoreinfo")) {
+            qtest_add_func("/dump/win-dmp-available",
+                           test_dump_win_dmp_available);
+        }
+    }
+
+    return g_test_run();
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 088e64aca5..5e18b947c7 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -59,6 +59,7 @@ qtests_i386 = \
   (config_all_devices.has_key('CONFIG_FDC_ISA') ? ['fdc-test'] : []) +                      \
   (config_all_devices.has_key('CONFIG_I440FX') ? ['fw_cfg-test'] : []) +                    \
   (config_all_devices.has_key('CONFIG_FW_CFG_DMA') ? ['vmcoreinfo-test'] : []) +            \
+  (config_all_devices.has_key('CONFIG_Q35') ? ['dump-test'] : []) +                         \
   (config_all_devices.has_key('CONFIG_I440FX') ? ['i440fx-test'] : []) +                    \
   (config_all_devices.has_key('CONFIG_I440FX') ? ['ide-test'] : []) +                       \
   (config_all_devices.has_key('CONFIG_I440FX') ? ['numa-test'] : []) +                      \