Kernel tracing in a protected kernel environment

A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:

• scanning at least a portion of a kernel to locate one or more instructions;
• storing at least one location corresponding to the one or more instructions;
• replacing the one or more instructions at the at least one location with one or more other instructions;
• providing the at least one location and one or more authorized code variants to a hypervisor;
• after replacing the one or more instructions, activating a kernel protection feature;
• after activating the kernel protection feature, detecting an attempted modification of the kernel;
• determining, by the hypervisor, that the attempted modification corresponds to a location of the at least one location provided to the hypervisor and that the attempted modification corresponds to an authorized code variant of the one or more authorized code variants;
• and
• modifying, by the hypervisor, the kernel to include the authorized code variant at the location.

A system comprising:

• a processor that executes a hypervisor to provide a kernel;
• the kernel to:
• scan at least a portion of the kernel to locate one or more instructions;
• store a location corresponding to the one or more instructions;
• replace the one or more instructions at the location with one or more other instructions;
• provide the location and an authorized code variant to the hypervisor;
• and
• activate a kernel protection feature;
• the hypervisor to:
• detect an attempted modification of the kernel;
• determine that the attempted modification corresponds to the location provided to the hypervisor and that the attempted modification corresponds to the authorized code variant;
• and
• modify the kernel to include the authorized code variant at the location.