bdpayne/libvmi — pull request #95 by mzguanglin (2013-08-20 19:52:01+00:00)
Title: Minimal Snapshot API

This PR contains a new feature for LibVMI, named "Shared Memory Snapshot" (Don't mix up with VM snapshot file). The technique provides a very fast and coherent memory access for KVM guest (Xen is pending), except the creation of snapshot can take 0.2 ~ 1.4 seconds when the memory size of guest VM expands from 512MB to 3GB.

Shared Memory Snapshots offer the capability to quickly examine guest physical memory state at a single moment in time. This capability will enable or improve memory heavy introspection tasks like memory-based antivirus scanning.

This is the first in a series of pull requests designed around the concept of bringing fast, coherent memory access to LibVMI. In future PRs we plan to accelerate physical memory access speed, increase Xen memory access performance, and decrease KVM snapshot latency. In the future we would be interested in looking at how snapshotting could be combined with events to precisely trigger the snapshotting process.

The major contributions in this PR:
1. snapshot and pmemaccess patch for QEMU 1.6
2. two new API vmi_snapshot_create(vmi) and vmi_snapshot_destroy(vmi)
3. new flag of VMI_INIT_WITH_KVM_SHARED_MEMORY_SNAPSHOT for vmi_init() to make snapshot during initialization.
4. modified KVM driver with snapshot support
5. modified process-list with snapshot support
6. unit test for snapshot
7. configure option --enable-snapshot.

If you would like LibVMI to work on a "Shared Memory Snapshot", then you need to do the following:

- Ensure that your libvirt installation supports QMP commands.

- Patch QEMU-KVM with the provided shared memroy snapshot patch.
cd qemu-1.6
patch -p1 < [libvmi_dir]/tools/qemu-kvm-patch/kvm-physmem-access-physmem-snapshot_1.6.0.patch
make
make install

- ./configure --enable-snapshot

- make clean && make && make install

- make check and run process-list to verify the validity of snapshot.

- write your VMI programs to take advantage of snapshot by choosing a setup method :

1) Add VMI_INIT_WITH_KVM_SHARED_MEMORY_SNAPSHOT flag to vmi_int(), then vmi_init() will create a snapshot and enter snapshot mode automatically.
Once LibVMI enters the snapshot mode, memory access will be redirect to the shared memory snapshot, rather than your live guest VM.

2) After the vmi_init() without snapshot flag has been called, invoke vmi_snapshot_create(vmi) to snaphsot your guest VM and enter snapshot mode. If LibVMI is already in snapshot mode (no matter by vmi_init() flag or vmi_snapshot_create(vmi), a subsequent call to vmi_snapshot_create(vmi) will create a new snapshot to replace the old one.

You can turn LibVMI back to live mode by invoking vmi_snapshot_destroy(vmi).

Even if you didn't call vmi_snapshot_destroy(vmi), vmi_destroy(vmi) will teardown the shared memory snapshot if existed.