| 1 | /* |
| 2 | * QTest testcase for dump-guest-memory |
| 3 | * |
| 4 | * Generic coverage for the dump-guest-memory QMP command and the |
| 5 | * query-dump-guest-memory-capability reporting, exercised on a bare |
| 6 | * machine (no guest OS required). |
| 7 | * |
| 8 | * Copyright (c) 2026 Virtuozzo International GmbH |
| 9 | * |
| 10 | * SPDX-License-Identifier: GPL-2.0-or-later |
| 11 | */ |
| 12 | |
| 13 | #include "qemu/osdep.h" |
| 14 | #include "libqtest.h" |
| 15 | #include "libqos/libqos-pc.h" |
| 16 | #include "libqos/fw_cfg.h" |
| 17 | #include "qobject/qdict.h" |
| 18 | #include "qobject/qlist.h" |
| 19 | #include "qobject/qstring.h" |
| 20 | #include "qemu/bswap.h" |
| 21 | #include "qemu/win_dump_defs.h" |
| 22 | #include "standard-headers/linux/qemu_fw_cfg.h" |
| 23 | #include "hw/misc/vmcoreinfo.h" |
| 24 | #include "elf.h" |
| 25 | |
| 26 | #define KDUMP_RAW_MAGIC "KDUMP " |
| 27 | #define KDUMP_FLAT_MAGIC "makedumpfile" |
| 28 | |
| 29 | static QTestState *dump_test_start(void) |
| 30 | { |
| 31 | return qtest_initf("-machine q35 -accel qtest -m 16"); |
| 32 | } |
| 33 | |
| 34 | static void assert_file_magic(const char *path, const char *magic, size_t len) |
| 35 | { |
| 36 | g_autofree char *buf = g_malloc0(len); |
| 37 | FILE *f = fopen(path, "rb"); |
| 38 | |
| 39 | g_assert_nonnull(f); |
| 40 | g_assert_cmpint(fread(buf, 1, len, f), ==, len); |
| 41 | fclose(f); |
| 42 | g_assert_cmpint(memcmp(buf, magic, len), ==, 0); |
| 43 | } |
| 44 | |
| 45 | /* validate that the file is a sane x86 ELF core, not just the leading magic */ |
| 46 | static void assert_valid_elf_core(const char *path) |
| 47 | { |
| 48 | unsigned char e[64]; |
| 49 | FILE *f = fopen(path, "rb"); |
| 50 | uint16_t e_type, e_machine, e_phnum; |
| 51 | |
| 52 | g_assert_nonnull(f); |
| 53 | g_assert_cmpint(fread(e, 1, sizeof(e), f), ==, sizeof(e)); |
| 54 | fclose(f); |
| 55 | |
| 56 | g_assert_cmpint(memcmp(e, ELFMAG, SELFMAG), ==, 0); |
| 57 | |
| 58 | /* e_type and e_machine sit at the same offset for ELF32 and ELF64 */ |
| 59 | e_type = lduw_le_p(e + 16); |
| 60 | e_machine = lduw_le_p(e + 18); |
| 61 | g_assert_cmpint(e_type, ==, ET_CORE); |
| 62 | g_assert(e_machine == EM_386 || e_machine == EM_X86_64); |
| 63 | |
| 64 | /* e_phnum lives at a class-dependent offset */ |
| 65 | if (e[EI_CLASS] == ELFCLASS64) { |
| 66 | e_phnum = lduw_le_p(e + 56); |
| 67 | } else { |
| 68 | e_phnum = lduw_le_p(e + 44); |
| 69 | } |
| 70 | g_assert_cmpint(e_phnum, >, 0); |
| 71 | } |
| 72 | |
| 73 | /* dump-guest-memory to a fresh temp file; returns the path (caller frees) */ |
| 74 | static char *do_dump(QTestState *qts, const char *format) |
| 75 | { |
| 76 | g_autofree char *tmp = NULL; |
| 77 | g_autofree char *proto = NULL; |
| 78 | GError *err = NULL; |
| 79 | int fd; |
| 80 | |
| 81 | fd = g_file_open_tmp("dump-test-XXXXXX", &tmp, &err); |
| 82 | g_assert_no_error(err); |
| 83 | close(fd); |
| 84 | proto = g_strdup_printf("file:%s", tmp); |
| 85 | |
| 86 | if (format) { |
| 87 | qtest_qmp_assert_success(qts, |
| 88 | "{ 'execute': 'dump-guest-memory'," |
| 89 | " 'arguments': { 'paging': false, 'protocol': %s," |
| 90 | " 'format': %s } }", proto, format); |
| 91 | } else { |
| 92 | qtest_qmp_assert_success(qts, |
| 93 | "{ 'execute': 'dump-guest-memory'," |
| 94 | " 'arguments': { 'paging': false, 'protocol': %s } }", proto); |
| 95 | } |
| 96 | |
| 97 | return g_steal_pointer(&tmp); |
| 98 | } |
| 99 | |
| 100 | /* query-dump-guest-memory-capability must always advertise at least 'elf' */ |
| 101 | static void test_query_capability(void) |
| 102 | { |
| 103 | QTestState *qts = dump_test_start(); |
| 104 | QDict *resp, *ret; |
| 105 | QList *formats; |
| 106 | QListEntry *e; |
| 107 | bool has_elf = false; |
| 108 | |
| 109 | resp = qtest_qmp(qts, |
| 110 | "{ 'execute': 'query-dump-guest-memory-capability' }"); |
| 111 | g_assert(qdict_haskey(resp, "return")); |
| 112 | ret = qdict_get_qdict(resp, "return"); |
| 113 | formats = qdict_get_qlist(ret, "formats"); |
| 114 | g_assert_nonnull(formats); |
| 115 | |
| 116 | QLIST_FOREACH_ENTRY(formats, e) { |
| 117 | QString *qs = qobject_to(QString, qlist_entry_obj(e)); |
| 118 | |
| 119 | if (g_str_equal(qstring_get_str(qs), "elf")) { |
| 120 | has_elf = true; |
| 121 | } |
| 122 | } |
| 123 | g_assert_true(has_elf); |
| 124 | |
| 125 | qobject_unref(resp); |
| 126 | qtest_quit(qts); |
| 127 | } |
| 128 | |
| 129 | static void test_dump_elf(void) |
| 130 | { |
| 131 | QTestState *qts = dump_test_start(); |
| 132 | g_autofree char *path = do_dump(qts, NULL); |
| 133 | |
| 134 | assert_valid_elf_core(path); |
| 135 | unlink(path); |
| 136 | qtest_quit(qts); |
| 137 | } |
| 138 | |
| 139 | /* non-raw kdump is emitted in makedumpfile flattened format */ |
| 140 | static void test_dump_kdump_zlib(void) |
| 141 | { |
| 142 | QTestState *qts = dump_test_start(); |
| 143 | g_autofree char *path = do_dump(qts, "kdump-zlib"); |
| 144 | |
| 145 | assert_file_magic(path, KDUMP_FLAT_MAGIC, strlen(KDUMP_FLAT_MAGIC)); |
| 146 | unlink(path); |
| 147 | qtest_quit(qts); |
| 148 | } |
| 149 | |
| 150 | /* raw kdump starts with the on-disk KDUMP header */ |
| 151 | static void test_dump_kdump_raw_zlib(void) |
| 152 | { |
| 153 | QTestState *qts = dump_test_start(); |
| 154 | g_autofree char *path = do_dump(qts, "kdump-raw-zlib"); |
| 155 | |
| 156 | assert_file_magic(path, KDUMP_RAW_MAGIC, strlen(KDUMP_RAW_MAGIC)); |
| 157 | unlink(path); |
| 158 | qtest_quit(qts); |
| 159 | } |
| 160 | |
| 161 | /* an unknown protocol must be rejected, not crash the VM */ |
| 162 | static void test_dump_invalid_protocol(void) |
| 163 | { |
| 164 | QTestState *qts = dump_test_start(); |
| 165 | g_autofree char *path = NULL; |
| 166 | QDict *resp; |
| 167 | |
| 168 | resp = qtest_qmp(qts, |
| 169 | "{ 'execute': 'dump-guest-memory'," |
| 170 | " 'arguments': { 'paging': false, 'protocol': 'bogus:/x' } }"); |
| 171 | g_assert(qdict_haskey(resp, "error")); |
| 172 | qobject_unref(resp); |
| 173 | |
| 174 | /* VM is still alive and dumping still works afterwards */ |
| 175 | path = do_dump(qts, NULL); |
| 176 | assert_valid_elf_core(path); |
| 177 | unlink(path); |
| 178 | |
| 179 | qtest_quit(qts); |
| 180 | } |
| 181 | |
| 182 | /* |
| 183 | * Requesting win-dmp without a Windows dump header in vmcoreinfo must be |
| 184 | * rejected with a clear error -- and must leave the VM usable, rather than |
| 185 | * produce a bogus dump. |
| 186 | */ |
| 187 | static void test_dump_win_dmp_unavailable(void) |
| 188 | { |
| 189 | QTestState *qts = dump_test_start(); |
| 190 | g_autofree char *tmp = NULL; |
| 191 | g_autofree char *proto = NULL; |
| 192 | g_autofree char *path = NULL; |
| 193 | GError *err = NULL; |
| 194 | QDict *resp, *error; |
| 195 | const char *desc; |
| 196 | int fd; |
| 197 | |
| 198 | fd = g_file_open_tmp("dump-test-XXXXXX", &tmp, &err); |
| 199 | g_assert_no_error(err); |
| 200 | close(fd); |
| 201 | proto = g_strdup_printf("file:%s", tmp); |
| 202 | |
| 203 | resp = qtest_qmp(qts, |
| 204 | "{ 'execute': 'dump-guest-memory'," |
| 205 | " 'arguments': { 'paging': false, 'protocol': %s," |
| 206 | " 'format': 'win-dmp' } }", proto); |
| 207 | error = qdict_get_qdict(resp, "error"); |
| 208 | g_assert_nonnull(error); |
| 209 | desc = qdict_get_try_str(error, "desc"); |
| 210 | g_assert_nonnull(desc); |
| 211 | g_assert_nonnull(strstr(desc, "vmcoreinfo")); |
| 212 | qobject_unref(resp); |
| 213 | unlink(tmp); |
| 214 | |
| 215 | /* the failed request must not wedge the VM: a plain dump still works */ |
| 216 | path = do_dump(qts, NULL); |
| 217 | assert_valid_elf_core(path); |
| 218 | unlink(path); |
| 219 | |
| 220 | qtest_quit(qts); |
| 221 | } |
| 222 | |
| 223 | static bool capability_has_format(QTestState *qts, const char *want) |
| 224 | { |
| 225 | QDict *resp, *ret; |
| 226 | QList *formats; |
| 227 | QListEntry *e; |
| 228 | bool found = false; |
| 229 | |
| 230 | resp = qtest_qmp(qts, |
| 231 | "{ 'execute': 'query-dump-guest-memory-capability' }"); |
| 232 | g_assert(qdict_haskey(resp, "return")); |
| 233 | ret = qdict_get_qdict(resp, "return"); |
| 234 | formats = qdict_get_qlist(ret, "formats"); |
| 235 | g_assert_nonnull(formats); |
| 236 | |
| 237 | QLIST_FOREACH_ENTRY(formats, e) { |
| 238 | QString *qs = qobject_to(QString, qlist_entry_obj(e)); |
| 239 | |
| 240 | if (g_str_equal(qstring_get_str(qs), want)) { |
| 241 | found = true; |
| 242 | } |
| 243 | } |
| 244 | qobject_unref(resp); |
| 245 | return found; |
| 246 | } |
| 247 | |
| 248 | /* |
| 249 | * win-dmp becomes available only once the guest exposes a Windows dump |
| 250 | * header through vmcoreinfo. Forge exactly such a note -- the layout a |
| 251 | * Windows guest with the QEMU vmcoreinfo writer produces: a fixed-size ELF |
| 252 | * note header followed by a WinDumpHeader64 carrying the PAGE/DU64 |
| 253 | * signatures -- place it in guest RAM, point the vmcoreinfo device at it |
| 254 | * via fw_cfg, and check that win-dmp flips from unavailable to available. |
| 255 | * |
| 256 | * This only covers availability *reporting*; the actual win-dmp generation |
| 257 | * (create_win_dump()) needs real Windows kernel structures and is not |
| 258 | * exercised here. |
| 259 | */ |
| 260 | static void test_dump_win_dmp_available(void) |
| 261 | { |
| 262 | const uint64_t paddr = 0x800000; /* 8 MiB, inside guest RAM */ |
| 263 | size_t notesz = VMCOREINFO_WIN_DUMP_NOTE_SIZE64; |
| 264 | g_autofree uint8_t *note = g_malloc0(notesz); |
| 265 | Elf64_Nhdr *nhdr = (Elf64_Nhdr *)note; |
| 266 | WinDumpHeader64 *hdr; |
| 267 | FWCfgVMCoreInfo info; |
| 268 | QFWCFG *fw_cfg; |
| 269 | QOSState *qs; |
| 270 | |
| 271 | /* the WinDumpHeader64 must sit right after the fixed ELF note header */ |
| 272 | g_assert_cmpint(sizeof(WinDumpHeader64) % 4, ==, 0); |
| 273 | |
| 274 | nhdr->n_namesz = cpu_to_le32(sizeof("VMCOREINFO")); /* 11 -> padded 12 */ |
| 275 | nhdr->n_descsz = cpu_to_le32(sizeof(WinDumpHeader64)); |
| 276 | nhdr->n_type = 0; |
| 277 | memcpy(note + sizeof(Elf64_Nhdr), "VMCOREINFO", sizeof("VMCOREINFO") - 1); |
| 278 | |
| 279 | hdr = (WinDumpHeader64 *)(note + VMCOREINFO_ELF_NOTE_HDR_SIZE); |
| 280 | memcpy(hdr->Signature, "PAGE", sizeof(hdr->Signature)); |
| 281 | memcpy(hdr->ValidDump, "DU64", sizeof(hdr->ValidDump)); |
| 282 | |
| 283 | qs = qtest_pc_boot("-device vmcoreinfo -m 16"); |
| 284 | fw_cfg = pc_fw_cfg_init(qs->qts); |
| 285 | |
| 286 | /* with no guest note yet, win-dmp must not be advertised */ |
| 287 | g_assert_false(capability_has_format(qs->qts, "win-dmp")); |
| 288 | |
| 289 | /* place the forged note in guest RAM and point vmcoreinfo at it */ |
| 290 | qtest_memwrite(qs->qts, paddr, note, notesz); |
| 291 | |
| 292 | memset(&info, 0, sizeof(info)); |
| 293 | info.host_format = cpu_to_le16(FW_CFG_VMCOREINFO_FORMAT_ELF); |
| 294 | info.guest_format = cpu_to_le16(FW_CFG_VMCOREINFO_FORMAT_ELF); |
| 295 | info.size = cpu_to_le32(notesz); |
| 296 | info.paddr = cpu_to_le64(paddr); |
| 297 | qfw_cfg_write_file(fw_cfg, qs, FW_CFG_VMCOREINFO_FILENAME, |
| 298 | &info, sizeof(info)); |
| 299 | |
| 300 | /* now win-dmp must be reported as available */ |
| 301 | g_assert_true(capability_has_format(qs->qts, "win-dmp")); |
| 302 | |
| 303 | pc_fw_cfg_uninit(fw_cfg); |
| 304 | qtest_shutdown(qs); |
| 305 | } |
| 306 | |
| 307 | int main(int argc, char **argv) |
| 308 | { |
| 309 | const char *arch = qtest_get_arch(); |
| 310 | |
| 311 | g_test_init(&argc, &argv, NULL); |
| 312 | |
| 313 | qtest_add_func("/dump/query-capability", test_query_capability); |
| 314 | qtest_add_func("/dump/elf", test_dump_elf); |
| 315 | qtest_add_func("/dump/kdump-zlib", test_dump_kdump_zlib); |
| 316 | qtest_add_func("/dump/kdump-raw-zlib", test_dump_kdump_raw_zlib); |
| 317 | qtest_add_func("/dump/invalid-protocol", test_dump_invalid_protocol); |
| 318 | |
| 319 | /* win-dmp is an x86_64-only format */ |
| 320 | if (g_str_equal(arch, "x86_64")) { |
| 321 | qtest_add_func("/dump/win-dmp-unavailable", |
| 322 | test_dump_win_dmp_unavailable); |
| 323 | |
| 324 | if (qtest_has_device("vmcoreinfo")) { |
| 325 | qtest_add_func("/dump/win-dmp-available", |
| 326 | test_dump_win_dmp_available); |
| 327 | } |
| 328 | } |
| 329 | |
| 330 | return g_test_run(); |
| 331 | } |