Fixing some leaks and performance.

Uses some glib defines toSupport older glib versions.
Merge pull request #93 from awsaba/more_leak_fixes

Fixing some leaks and performance.
Minimal API for KVM shm-snapshot

This PR contains a new feature for LibVMI, named "shm-snapshot" (Don't mix up with VM snapshot file). The technique provides a very fast and coherent memory access for KVM guest (Xen is pending), except the creation of shm-snapshot can take 0.2 ~ 1.4 seconds when the memory size of guest VM expands from 512MB to 3GB.

shm-snapshots offer the capability to quickly examine guest physical memory state at a single moment in time. This capability will enable or improve memory heavy introspection tasks like memory-based antivirus scanning.

This is the first in a series of pull requests designed around the concept of bringing fast, coherent memory access to LibVMI. In future PRs we plan to accelerate physical memory access speed, increase Xen memory access performance, and decrease KVM snapshot latency. In the future we would be interested in looking at how snapshotting could be combined with events to precisely trigger the snapshotting process.

The major contributions in this PR:
1. shm-snapshot and pmemaccess patch for QEMU 1.6
2. two new API vmi_shm_snapshot_create(vmi) and vmi_shm_snapshot_destroy(vmi)
3. new flag of VMI_INIT_SHM_SNAPSHOT for vmi_init() to make shm-snapshot during initialization.
4. modified KVM driver with shm-snapshot support
5. an example program "shm-snapshot-process-list"
6. unit test for shm-snapshot
7. configure option --enable-shm-snapshot.

If you would like LibVMI to work on a "shm-snapshot", then you need to do the following:

Ensure that your libvirt installation supports QMP commands.

Patch QEMU-KVM with the provided shm-snapshot patch.

cd qemu-1.6
patch -p1 < [libvmi_dir]/tools/qemu-kvm-patch/kvm-physmem-access-physmem-snapshot_1.6.0.patch
make
make install

./configure --enable-shm-snapshot

make clean && make && make install

make check and run shm-snapshot-process-list to verify the validity of shm-snapshot.

write your VMI programs to take advantage of snapshot by choosing a setup method :

1) Add VMI_INIT_SHM_SNAPSHOT flag to vmi_int(), then vmi_init() will create a shm-snapshot and enter shm-snapshot mode automatically.
Once LibVMI enters the shm-snapshot mode, memory access will be redirect to the shm-snapshot, rather than your live guest VM.

2) After the vmi_init() without shm-snapshot flag has been called, invoke vmi_shm_snapshot_create(vmi) to snaphsot your guest VM and enter shm-snapshot mode. If LibVMI is already in shm-snapshot mode (no matter by vmi_init() flag or vmi_shm_snapshot_create(vmi), a subsequent call to vmi_shm_snapshot_create(vmi) will create a new shm-snapshot to replace the old one.

You can turn LibVMI back to live mode by invoking vmi_shm_snapshot_destroy(vmi).

Even if you didn't call vmi_shm_snapshot_destroy(vmi), vmi_destroy(vmi) will teardown the shm-snapshot if existed.
Merge pull request #95 from mzguanglin/minimal-snapshot-api

Minimal Shm-snapshot API
minimal-shm-snapshot-api-xen

Now we can use shm-snapshot feature even in Xen!
However, note that this is actually not a real shm-snapshot, because we create the snapshot in LibVMI, which should be created by Xen hypervisor.
Merge pull request #97 from mzguanglin/minimal-snapshot-api-xen

minimal-shm-snapshot-api-xen
Direct Guest Physical Memory Access (DGPMA) of shm-snapshot

Users now can get a read only pointer to the shm-snapshot by the vmi_get_dgpma(vmi) function, and then read the shm-snapshot content in a non-copy manner (ideally  at a native speed like reading the local memory) , bypassing the vmi_read_pa(vmi) function.

Example:

1. without DGPMA:
    vmi_init(&vmi, VMI_AUTO | VMI_INIT_COMPLETE, vm);
    void* pmem = malloc(ANY_SIZE);
    vmi_read_pa(vmi,  A_PHY_ADDR, pmem, ANY_SIZE); // with memcpy() inside
    any_vmi_processing(pmem, ANY_SIZE);
    free(pmem);
    vmi_shm_snapshot_destroy(vmi);
    vmi_destroy(vmi);

2. with DGPMA:
    vmi_init(&vmi, VMI_AUTO | VMI_INIT_COMPLETE, vm);
    vmi_shm_snapshot_create(vmi);
    const void* pmem = vmi_get_dgpma(vmi);
    if (NULL == pmem) {
        printf("fail to get dpgma\n");
        return 1;
    }
    any_vmi_processing(pmem + A_PHY_ADDR, ANY_SIZE);
    vmi_shm_snapshot_destroy(vmi);
    vmi_destroy(vmi);
Interrupt events: generalized boilerplate supporting drivers that might provide interrupt events. Provides an extension to the Xen driver supporting its only interrupt event, INT3.
initialize xen_event related function pointers to NULL when xen_events is disabled

Signed-off-by: Guanglin Xu <mzguanglin@gmail.com>
Fixed broken cache compilation due to incompatible stubs
fix function signitures

1. cache.c : prevent compilation error when #define ENABLE_ADDRESS_CACHE 0
2. shm-snapshot-process-list.c : remove compiler warnings
Merge pull request #96 from adrianlshaw/cachefix

Fixed broken cache compilation due to incompatible stubs
Merge pull request #98 from mzguanglin/direct-guest-physical-memory-access

Direct Guest Physical Memory Access (DGPMA) of shm-snapshot
Merge pull request #99 from Zentific/events_int3

Interrupt events
Merge pull request #100 from mzguanglin/fix-noncached-function-sign

fix function signitures
Merge pull request #101 from mzguanglin/fix-xen-init-of-function-pointer

initialize xen_event related function pointers to NULL when xen_events i...
quiet some compiler warnings on 32-bit builds related to format strings
Whitespace cleanup (Hard tabs ^I --> 4 space tabs)
Whitespace cleanup (prune all trailing spaces at line endings)
Remedy compiler warnings on 32-bit builds related to integer width (invisible when building on 64-bit).
    a pointer to vmi_instance_t->size (which is a uint64_t) was passed to
    driver_get_memsize in core.c:

        driver_get_memsize(*vmi, &(*vmi)->size);

    the following results for 32-bit builds (where of course
    sizeof(long unsigned int) != sizeof(uint64_t), causing the warning):

        core.c: In function 'vmi_init_private':
        core.c:553:9: warning: passing argument 2 of 'driver_get_memsize' from
          incompatible pointer type [enabled by default]
        driver/interface.h:59:10: note: expected 'long unsigned int *' but argument
          is of type 'uint64_t *'
        core.c:597:9: warning: passing argument 2 of 'driver_get_memsize' from
          incompatible pointer type [enabled by default]
        driver/interface.h:59:10: note: expected 'long unsigned int *' but argument
          is of type 'uint64_t *'