Minimal API for KVM shm-snapshot

This PR contains a new feature for LibVMI, named "shm-snapshot" (Don't mix up with VM snapshot file). The technique provides a very fast and coherent memory access for KVM guest (Xen is pending), except the creation of shm-snapshot can take 0.2 ~ 1.4 seconds when the memory size of guest VM expands from 512MB to 3GB.

shm-snapshots offer the capability to quickly examine guest physical memory state at a single moment in time. This capability will enable or improve memory heavy introspection tasks like memory-based antivirus scanning.

This is the first in a series of pull requests designed around the concept of bringing fast, coherent memory access to LibVMI. In future PRs we plan to accelerate physical memory access speed, increase Xen memory access performance, and decrease KVM snapshot latency. In the future we would be interested in looking at how snapshotting could be combined with events to precisely trigger the snapshotting process.

The major contributions in this PR:
1. shm-snapshot and pmemaccess patch for QEMU 1.6
2. two new API vmi_shm_snapshot_create(vmi) and vmi_shm_snapshot_destroy(vmi)
3. new flag of VMI_INIT_SHM_SNAPSHOT for vmi_init() to make shm-snapshot during initialization.
4. modified KVM driver with shm-snapshot support
5. an example program "shm-snapshot-process-list"
6. unit test for shm-snapshot
7. configure option --enable-shm-snapshot.

If you would like LibVMI to work on a "shm-snapshot", then you need to do the following:

Ensure that your libvirt installation supports QMP commands.

Patch QEMU-KVM with the provided shm-snapshot patch.

cd qemu-1.6
patch -p1 < [libvmi_dir]/tools/qemu-kvm-patch/kvm-physmem-access-physmem-snapshot_1.6.0.patch
make
make install

./configure --enable-shm-snapshot

make clean && make && make install

make check and run shm-snapshot-process-list to verify the validity of shm-snapshot.

write your VMI programs to take advantage of snapshot by choosing a setup method :

1) Add VMI_INIT_SHM_SNAPSHOT flag to vmi_int(), then vmi_init() will create a shm-snapshot and enter shm-snapshot mode automatically.
Once LibVMI enters the shm-snapshot mode, memory access will be redirect to the shm-snapshot, rather than your live guest VM.

2) After the vmi_init() without shm-snapshot flag has been called, invoke vmi_shm_snapshot_create(vmi) to snaphsot your guest VM and enter shm-snapshot mode. If LibVMI is already in shm-snapshot mode (no matter by vmi_init() flag or vmi_shm_snapshot_create(vmi), a subsequent call to vmi_shm_snapshot_create(vmi) will create a new shm-snapshot to replace the old one.

You can turn LibVMI back to live mode by invoking vmi_shm_snapshot_destroy(vmi).

Even if you didn't call vmi_shm_snapshot_destroy(vmi), vmi_destroy(vmi) will teardown the shm-snapshot if existed.
Merge pull request #95 from mzguanglin/minimal-snapshot-api

Minimal Shm-snapshot API
minimal-shm-snapshot-api-xen

Now we can use shm-snapshot feature even in Xen!
However, note that this is actually not a real shm-snapshot, because we create the snapshot in LibVMI, which should be created by Xen hypervisor.
Merge pull request #97 from mzguanglin/minimal-snapshot-api-xen

minimal-shm-snapshot-api-xen
first steps toward general interrupt events (real intention is int3 events for xen, but starting generic and building a general driver interface
add interrupts_t enum and an 'enabled' member to the interrupt_event_t struct
xen driver, events: define xen_set_intr_access, declare its prototype, and wire up xen_set_int3_access
interrupt event example code...scary that it took all of 30 seconds
events - interrupt clearing : convey that the event is to be disabled
events libvmi.h : add a 'reinject' member to the interrupt_event_t struct to help control whether interrupts are delivered to the target VM after interception
Events - interrupt example: reinject events by default
xen events - interrupt processing function implementation and invocation during xen_events_listen
int3 interrupt reinjection failure : comment elaboration. it is critical that the library and library users both, in concert, understand the implications of this particular feature: useful, but dangerous.
events - process_interrupt_event : typos can be catastrophic, from time to time.
Use correct instruction length for INT3. Improve reinjection documentation.
fix typos, improve xen_set_int3_access
forgotten break in the MEM_EVENT_REASON_INT3 section of vmi_events_listen
fix interrupt example to by removing all remaining vestiges of the MSR code
further refinement of reinjection, documentation
comment clarification