Transparent code patching using a hypervisor

1. A method of managing guest code in a virtualized computing instance of a virtualized computing system, the method comprising:

receiving, at a hypervisor that manages the virtualized computing instance, identifiers for a first guest-physical memory page, which stores a patched version of the guest code, and a second guest-physical memory page, which stores an original version of the guest code;

configuring a nested page table (NPT) to include a first entry that points to the first guest-physical memory page and a second entry that points to the second guest-physical page, wherein the first entry in a nested page table (NPT), which is associated with the first guest-physical memory page, is modified to cause an exception to the hypervisor in response to a first read operation, performed by first software in the virtualized computing instance, which targets the first guest-physical memory page while using the first entry to present the patched version of the guest code in an execution stream of the virtual computing instance;

receiving a read operation directed to the first guest-physical memory page causing an exception that exits the virtualized computing instance to the hypervisor; and

executing, at the hypervisor in response to the exception, a second read operation that emulates the first read operation, but targets the second entry that points to the second guest-physical memory page storing the original version of the guest code.

2. The method of claim 1 , wherein the guest code is part of a kernel of a guest operating system (OS), and wherein the first software is kernel patch protection (KPP) software of the guest OS.

3. The method of claim 1 , wherein the step of modifying the entry in the NPT comprises:

setting permissions in the entry to execute-only.

4. The method of claim 1 , wherein the step of modifying the entry in the NPT comprises:

setting a not-present flag in the entry.

5. The method of claim 1 , wherein the virtualized computing instance includes second software installed therein, and wherein the hypervisor receives the identifiers for the first and second guest-physical memory pages from the second software.

6. The method of claim 5 , further comprising:

identifying, by the second software, the first guest-physical memory page, which initially stores the guest code;

allocating, by the second software, the second guest-physical memory page;

copying, by the second software, the guest code to the second guest-physical memory page as the original version of the guest code; and

patching, by the second software, the guest code stored on the first guest-physical memory page to generate the patched version of the guest code.

7. The method of claim 1 , further comprising:

returning from the exception to an instruction of the first software after the first read operation.

8. A non-transitory computer readable medium having instructions stored thereon that when executed by a processor cause the processor to perform a method of managing guest code in a virtualized computing instance of a virtualized computing system, the method comprising:

receiving, at a hypervisor that manages the virtualized computing instance, identifiers for a first guest-physical memory page, which stores a patched version of the guest code, and a second guest-physical memory page, which stores an original version of the guest code;

configuring a nested page table (NPT) to include a first entry that points to the first guest-physical memory page and a second entry that points to the second guest-physical page, wherein the first entry in a nested page table (NPT), which is associated with the first guest-physical memory page, is modified to cause an exception to the hypervisor in response to a first read operation, performed by first software in the virtualized computing instance, which targets the first guest-physical memory page while using the first entry to present the patched version of the guest code in an execution stream of the virtual computing instance;

receiving a read operation directed to the first guest-physical memory page causing an exception that exits the virtualized computing instance to the hypervisor; and

executing, at the hypervisor in response to the exception, a second read operation that emulates the first read operation, but targets the second entry that points to the second guest-physical memory page storing the original version of the guest code.

9. The non-transitory computer readable medium of claim 8 , wherein the guest code is part of a kernel of a guest operating system (OS), and wherein the first software is kernel patch protection (KPP) software of the guest OS.

10. The non-transitory computer readable medium of claim 8 , wherein the step of modifying the entry in the NPT comprises:

setting permissions in the entry to execute-only.

11. The non-transitory computer readable medium of claim 8 , wherein the step of modifying the entry in the NPT comprises:

setting a not-present flag in the entry.

12. The non-transitory computer readable medium of claim 8 , wherein the virtualized computing instance includes second software installed therein, and wherein the hypervisor receives the identifiers for the first and second guest-physical memory pages from the second software.

13. The non-transitory computer readable medium of claim 12 , further comprising:

identifying, by the second software, the first guest-physical memory page, which initially stores the guest code;

allocating, by the second software, the second guest-physical memory page;

copying, by the second software, the guest code to the second guest-physical memory page as the original version of the guest code; and

patching, by the second software, the guest code stored on the first guest-physical memory page to generate the patched version of the guest code.

14. The non-transitory computer readable medium of claim 8 , further comprising:

returning from the exception to an instruction of the first software after the first read operation.

15. A virtualized computer system, comprising:

a hardware platform including a processor and a memory; and

a software platform comprising code stored in the memory and executing on the processor of the hardware platform, the software platform including a hypervisor supporting a virtualized computing instance, the virtualized computing instance including guest code and first software, the hypervisor configured to:

receive identifiers for a first guest-physical memory page, which stores a patched version of the guest code, and a second guest-physical memory page, which stores an original version of the guest code;

configuring a nested page table (NPT) to include a first entry that points to the first guest-physical memory page and a second entry that points to the second guest-physical page, wherein the first entry in a nested page table (NPT), which is associated with the first guest-physical memory page, is modified to cause an exception to the hypervisor in response to a first read operation, performed by the first software, which targets the first guest-physical memory page while using the first entry to present the patched version of the guest code in an execution stream of the virtual computing instance;

receive a read operation directed to the first guest-physical memory page causing an exception that exits the virtualized computing instance to the hypervisor; and

execute a second read operation that emulates the first read operation, but targets the second entry that points to the second guest-physical memory page storing the original version of the guest code.

16. The virtualized computer system of claim 15 , wherein the guest code is part of a kernel of a guest operating system (OS), and wherein the first software is kernel patch protection (KPP) software of the guest OS.

17. The virtualized computer system of claim 15 , wherein the hypervisor is configured to modify the entry in the NPT by setting permissions in the entry to execute-only.

18. The virtualized computer system of claim 15 , wherein the hypervisor is configured to modify the entry in the NPT by setting a not-present flag in the entry.

19. The virtualized computer system of claim 15 , wherein the virtualized computing instance includes second software installed therein, and wherein the hypervisor is configured to receive the identifiers for the first and second guest-physical memory pages from the second software.

20. The virtualized computer system of claim 19 , wherein the second software is executable by the processor to:

identify the first guest-physical memory page, which initially stores the guest code;

allocate the second guest-physical memory page;

copy the guest code to the second guest-physical memory page as the original version of the guest code; and

patch the guest code stored on the first guest-physical memory page to generate the patched version of the guest code.