mzguanglin/libvmi — pull request #2 by mzguanglin (2013-09-05 15:11:17+00:00)
Title: Minimal API for KVM shm-snapshot

This PR contains a new feature for LibVMI, named "shm-snapshot" (Don't mix up with VM snapshot file). The technique provides a very fast and coherent memory access for KVM guest (Xen is pending), except the creation of shm-snapshot can take 0.2 ~ 1.4 seconds when the memory size of guest VM expands from 512MB to 3GB.

shm-snapshots offer the capability to quickly examine guest physical memory state at a single moment in time. This capability will enable or improve memory heavy introspection tasks like memory-based antivirus scanning.

This is the first in a series of pull requests designed around the concept of bringing fast, coherent memory access to LibVMI. In future PRs we plan to accelerate physical memory access speed, increase Xen memory access performance, and decrease KVM snapshot latency. In the future we would be interested in looking at how snapshotting could be combined with events to precisely trigger the snapshotting process.

The major contributions in this PR:
1. shm-snapshot and pmemaccess patch for QEMU 1.6
2. two new API vmi_shm_snapshot_create(vmi) and vmi_shm_snapshot_destroy(vmi)
3. new flag of VMI_INIT_SHM_SNAPSHOT for vmi_init() to make shm-snapshot during initialization.
4. modified KVM driver with shm-snapshot support
5. an example program "shm-snapshot-process-list"
6. unit test for shm-snapshot
7. configure option --enable-shm-snapshot.

If you would like LibVMI to work on a "shm-snapshot", then you need to do the following:

Ensure that your libvirt installation supports QMP commands.

Patch QEMU-KVM with the provided shm-snapshot patch.

cd qemu-1.6
patch -p1 < [libvmi_dir]/tools/qemu-kvm-patch/kvm-physmem-access-physmem-snapshot_1.6.0.patch
make
make install

./configure --enable-shm-snapshot

make clean && make && make install

make check and run shm-snapshot-process-list to verify the validity of shm-snapshot.

write your VMI programs to take advantage of snapshot by choosing a setup method :

1) Add VMI_INIT_SHM_SNAPSHOT flag to vmi_int(), then vmi_init() will create a shm-snapshot and enter shm-snapshot mode automatically.
Once LibVMI enters the shm-snapshot mode, memory access will be redirect to the shm-snapshot, rather than your live guest VM.

2) After the vmi_init() without shm-snapshot flag has been called, invoke vmi_shm_snapshot_create(vmi) to snaphsot your guest VM and enter shm-snapshot mode. If LibVMI is already in shm-snapshot mode (no matter by vmi_init() flag or vmi_shm_snapshot_create(vmi), a subsequent call to vmi_shm_snapshot_create(vmi) will create a new shm-snapshot to replace the old one.

You can turn LibVMI back to live mode by invoking vmi_shm_snapshot_destroy(vmi).

Even if you didn't call vmi_shm_snapshot_destroy(vmi), vmi_destroy(vmi) will teardown the shm-snapshot if existed.