Modification of write-protected memory using code patching

A system for modifying a set of memory pages, comprising:

• a guest memory storing kernel code and patching code of a kernel, wherein the patching code is stored at a first range of memory addresses;
• a hypervisor memory storing first and second sets of hypervisor page tables;
• a guest that loads the kernel code and patching code into the guest memory, sends a message indicating that a first range of memory addresses is associated with the first set of hypervisor page tables, detects a demand to modify a set of memory pages, sends a request to transfer control to the patching code in response to detecting the demand, and executes the patching code,
• wherein the first range of memory addresses is in an executable mode in the first set of hypervisor page tables, wherein at most one of the first set of hypervisor page tables and the second set of hypervisor page tables is active at a time, and the guest is restricted by the access permissions specified in the active hypervisor page table, and wherein the first set of hypervisor page tables is active while the patching code controls a first virtual processor exposed to the guest, and the second set of hypervisor page tables is active while the kernel code controls a second virtual processor exposed to the guest;
• and
• a hypervisor that receives a message indicating that the first range of memory addresses is associated with the first set of hypervisor page tables and that in response to detecting the request to transfer control to the patching code, switches the guest from the first set of hypervisor page tables to the second set of hypervisor page tables and transfers control to the guest, wherein the set of memory pages is in a writable mode in the first set of hypervisor page tables and in a write-protected mode in the second set of hypervisor page tables.

A machine-readable medium comprising a plurality of machine-readable instructions that when executed by one or more processors is adapted to cause the one or more processors to perform a method comprising:

• loading, by a guest running on a virtual machine, kernel code and patching code of a kernel into a guest memory allocated to the guest, the patching code corresponding to a first set of hypervisor page tables, and the kernel code corresponding to a second set of hypervisor page tables;
• sending, by the guest, a message indicating that a first range of memory addresses is associated with the first set of hypervisor page tables to a hypervisor, the patching code being stored at the first range of memory addresses, and the first range of memory addresses being in an executable mode in the first set of hypervisor page tables;
• and
• executing, by the guest, the patching code, wherein execution of the patching code includes:
• modifying a set of memory pages in accordance with a request to modify the set of memory pages, the set of memory pages being in a writable mode in the first set of hypervisor page tables and in a write-protected mode in the second set of hypervisor page tables;
• and
• after modifying the set of memory pages, sending a request to the hypervisor to transfer control to the kernel code.