Inside Out: A Paradigm Shift in VM Introspection
Talkat 20th USENIX Symposium on Operating Systems Design and Implementation (OSDI '26) · 2026-07-13..07-15·
summary
GOODKIT runs observation agents as side VMs colocated with the VMM (built on Firecracker KVM), giving native-speed access to target memory while preserving isolation. It implements lock‑aware reads (spinlocks, rwlocks, mutexes) plus a mutualizer that centralizes locking for multiple observers. Across 21 real-world use cases it outperforms LibVMI: 17× faster on an idle probe and LibVMI shows up to 110× slowdown in a worst-case netfilter benchmark. Microbenchmarks and Phoronix tests report single‑observer overheads near native and much lower multi‑observer impact.
AI-written summary · about
chapters (10)
- 0:00Virtual machine introspection intro
- 1:20Live VMI challenges and solutions
- 3:06LibVMI and agent approaches
- 5:11Framework design and key idea
- 6:37Observer deployment and memory access
- 9:27Memory access consistency
- 10:08Performance optimization
- 11:10Handling multiple observers
- 11:51Prototype evaluation and use cases
- 13:40Summary and future
related talks
32mSeeing Through The Same Lens...
25mHigh Performance VM Introspection
23mHardening Hypervisors with Ombro
33mMemory Forensics Using Virtual Machine Introspection for Cloud Computing
27mVMs in a container-centric world
37mHypervisor-less virtio for Real-time and Safety
50mWhat the Fuzz
53mXenpwn: Breaking Paravirtualized Devices