When a Windows guest crashes and QEMU generates a memory dump via
pvpanic, elf2dmp currently always sets CPU 0's context in the dump
header. This makes WinDbg default to CPU 0 when opening the dump,
even if the actual crash happened on a different CPU.

This series adds crash_occurred tracking from the runstate layer
through to the QEMUCPUState in the ELF dump, and teaches elf2dmp
to identify and use the faulting CPU's context.

Changes since v2:
   - Remove unused fault_cpu variable in fill_context()
   - Use per-CPU size check (s->size >= offsetof + sizeof) instead
     of global has_is_crash_occurred_cpu flag, fixing heterogeneous
     dumps where CPU notes have different sizes
   - Remove has_is_crash_occurred_cpu from QEMU_Elf struct and
     init_states() since per-CPU check makes it unnecessary
   - Move QEMUCPUState struct growth from patch 2 to patch 3 so
     sizeof() change and init_states() update stay together
     (bisectability)
   - Fix patch 1 commit message: soften "is never called" to
     "is not always called when crash dumping is enabled"
   - Fix patch 2 commit message: clarify compatibility description
     for both old-tools/new-dumps and new-tools/old-dumps directions
   - Clamp state->size to MIN(state->size, n_descsz) in init_states()
     to prevent reading beyond note descriptor boundary
   - Compare state_size against offsetof + sizeof(kernel_gs_base)
     instead of sizeof(*state) to avoid misclassifying valid old
     440-byte notes as lacking kernel_gs_base

Changes since v1:
   - Set header context before best-effort guest memory operations
     to avoid losing faulting CPU context on partial dump failures
   - Use LIVE_SYSTEM_DUMP when BugcheckCode is zero
   - Use PRIx32 for BugcheckCode format specifier
   - Use linux.alibaba.com identity

Zhengrong Li (3):
  runstate: set crash_occurred on guest crashloaded
  dump: add crash_occurred flag to QEMUCPUState
  elf2dmp: fill ContextBuffer with faulting CPU context

 contrib/elf2dmp/kdbg.h     |  9 +++++++
 contrib/elf2dmp/main.c     | 50 ++++++++++++++++++++++++++++++++++++--
 contrib/elf2dmp/qemu_elf.c | 10 +++++++-
 contrib/elf2dmp/qemu_elf.h |  2 ++
 system/runstate.c          |  5 ++++
 target/i386/arch_dump.c    |  6 +++++
 6 files changed, 79 insertions(+), 3 deletions(-)

-- 
2.43.0

Hi all,

Just a gentle ping on this series. Akihiko Odaki has reviewed it and
provided a Reviewed-by for the whole series:

    Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>

Please let me know if there's anything else you'd like me to address,
or if it could be picked up for QEMU master when you have a chance.

Thanks for your time.

Regards,
Zhengrong Li

Hi all,

A gentle follow-up ping on this reviewed series.
Would it be possible to queue it for QEMU master?

Thanks,
Zhengrong

On 2026/08/06 20:51, Zhengrong Li wrote:
> When a Windows guest crashes and QEMU generates a memory dump via
> pvpanic, elf2dmp currently always sets CPU 0's context in the dump
> header. This makes WinDbg default to CPU 0 when opening the dump,
> even if the actual crash happened on a different CPU.
> 
> This series adds crash_occurred tracking from the runstate layer
> through to the QEMUCPUState in the ELF dump, and teaches elf2dmp
> to identify and use the faulting CPU's context.
> 
> Changes since v2:
>     - Remove unused fault_cpu variable in fill_context()
>     - Use per-CPU size check (s->size >= offsetof + sizeof) instead
>       of global has_is_crash_occurred_cpu flag, fixing heterogeneous
>       dumps where CPU notes have different sizes
>     - Remove has_is_crash_occurred_cpu from QEMU_Elf struct and
>       init_states() since per-CPU check makes it unnecessary
>     - Move QEMUCPUState struct growth from patch 2 to patch 3 so
>       sizeof() change and init_states() update stay together
>       (bisectability)
>     - Fix patch 1 commit message: soften "is never called" to
>       "is not always called when crash dumping is enabled"
>     - Fix patch 2 commit message: clarify compatibility description
>       for both old-tools/new-dumps and new-tools/old-dumps directions
>     - Clamp state->size to MIN(state->size, n_descsz) in init_states()
>       to prevent reading beyond note descriptor boundary
>     - Compare state_size against offsetof + sizeof(kernel_gs_base)
>       instead of sizeof(*state) to avoid misclassifying valid old
>       440-byte notes as lacking kernel_gs_base
> 
> Changes since v1:
>     - Set header context before best-effort guest memory operations
>       to avoid losing faulting CPU context on partial dump failures
>     - Use LIVE_SYSTEM_DUMP when BugcheckCode is zero
>     - Use PRIx32 for BugcheckCode format specifier
>     - Use linux.alibaba.com identity
> 
> Zhengrong Li (3):
>    runstate: set crash_occurred on guest crashloaded
>    dump: add crash_occurred flag to QEMUCPUState
>    elf2dmp: fill ContextBuffer with faulting CPU context
> 
>   contrib/elf2dmp/kdbg.h     |  9 +++++++
>   contrib/elf2dmp/main.c     | 50 ++++++++++++++++++++++++++++++++++++--
>   contrib/elf2dmp/qemu_elf.c | 10 +++++++-
>   contrib/elf2dmp/qemu_elf.h |  2 ++
>   system/runstate.c          |  5 ++++
>   target/i386/arch_dump.c    |  6 +++++
>   6 files changed, 79 insertions(+), 3 deletions(-)
> 

The whole series now looks good to me:

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>

Regards,
Akihiko Odaki