Introspection API development

Stephen Pape
2016-08-04T03:25:28Z

Hello all,

For my own purposes, I've been modifying KVM to support introspection.
I have a project that uses Xen's "vm event" API, and I'm trying to get
things working with KVM as well. Our implementation needs to be able
to map guest memory directly. I have seen the qemu patch used by
libvmi, but they handle memory reads and writes through a socket,
which just won't work for us. I'm also looking to add other types of
hooks, and patching qemu seems too limited.

My approach involves modifying the kernel driver to export a
/dev/virt/ filesystem. I suppose I could do it all via /dev/kvm ioctls
as well.

My (relatively minor) patch allows processes besides the launching
process to do things like map guest memory and read VCPU states for a
VM. Soon, I'll be looking into adding support for handling events (cr3
writes, int3 traps, etc.). Eventually, an event should come in, a
program will handle it (while able to read memory/registers), and then
resume the VCPU.

My question is, is this anything the KVM group would be interested in
bringing upstream? I'd definitely be willing to change my approach if
necessary. If there's no interest, I'll just have to maintain my own
patches.

Any comments would be welcome.

Thanks!

-Stephen