WO2021130420A1

WO2021130420A1 - Method and device implementing said method for generating and installing an executable code in the memory of a core of a virtual machine from a hypervisor

Info

Publication number: WO2021130420A1
Application number: PCT/FR2020/052346
Authority: WO
Inventors: Yacine HEBBAL
Original assignee: Orange
Priority date: 2019-12-23
Filing date: 2020-12-08
Publication date: 2021-07-01
Also published as: FR3105507B1; FR3105507A1

Abstract

This method for generating and installing an executable code (CX1) of at least a first function (f1) in the memory of a core (K) of a virtual machine (MV) is implemented by a hypervisor (H), and comprises the steps of: - obtaining (E001) a source code (CS1) comprising at least the first function (f1); - obtaining (E010) configuration data (CFG_MV) of the virtual machine, the configuration data including at least one address (@F, @D) in a memory of the core of the virtual machine (MV) of a function or of data referenced by the source code (CS1); - obtaining (E020) a code that can be executed by compiling (CS1) the source code (CS1) using the configuration data (CFG_MV); - calling (E030) a memory allocation function (malloc_MV) of the virtual machine, in order to reserve a space (EM1) in the memory of the core of the virtual machine (MV) for an executable code (CX1) corresponding to said object code; - obtaining the executable code (CX1) by assembling the object code using the configuration data (CFG_MV) and a result (@EM1) of the call (E030) to the memory allocation function; and - recording (E040) the executable code (CX1) in the memory space (EM).

Description

Method and device implementing this method to generate and install executable code in the memory of a kernel of a virtual machine from a hypervisor

The invention relates to the general field of computer software. It relates more particularly to the management of functions executed by a virtual machine.

In the current context, the use of virtual machines is very widespread to pool and optimize the use of physical resources of a server, to isolate software and increase the security of their use, and to abstract from the characteristics of the machines. on which the virtual machines run.

It is known to use a hypervisor to instantiate and manage one or more virtual machines on the same physical machine.

But the current state of the art does not provide a satisfactory solution for monitoring the functions that run in the kernel memory of a virtual machine. Indeed, the current existing techniques are exclusively "in-VM": the probing technique or "probing" requires injecting code into a virtual machine from it; this requires administrator access to the virtual machine. Another existing observation technique is to position observation points in a virtual machine. However, during observation, the virtual machine is stopped, which impacts the performance of the virtual machine.

Disclosure of the invention

The invention relates to a method for generating and installing an executable code of at least a first function in the memory of a kernel of a virtual machine, this method being implemented by a hypervisor and comprising steps from:

- obtaining a source code comprising at least the first function;

- Obtaining virtual machine configuration data, this configuration data comprising at least one address in a memory of the kernel of the virtual machine, a function or data referenced by the source code;

- obtaining an object code by compiling the source code using the configuration data;

calling a memory allocation function of the virtual machine, to reserve a space in the memory of the kernel of the virtual machine for an executable code corresponding to the object code; - Obtaining an executable code by assembling and editing links of the object code using the configuration data and a result of the call of the memory allocation function; and

- recording of the executable code in said memory space.

Correspondingly, the invention is aimed at a device for generating and installing an executable code of at least a first function in a memory of a kernel of a virtual machine, this device comprising the virtual machine and a hypervisor, said device. hypervisor comprising a module capable of implementing a generation and installation method according to the invention.

The executable code thus obtained will sometimes be called “first executable code”.

The characteristics and advantages of the installation method according to the invention presented below apply in the same way to the installation device according to the invention, and vice versa.

In the description, when we say that an instruction A is followed by an instruction B, or that an instruction B is consecutive to an instruction A, this means either that the instruction A is followed directly by the instruction B, or that the instructions A and B are separated by empty instructions of the NOP type (for "No OPeration" in English).

Thus, and in general, the invention first of all provides a solution for generating and installing from a hypervisor executable code in the memory of the kernel of a virtual machine.

Since the invention is implemented by the hypervisor, the hypervisor can monitor the functions running in the virtual machine and install the new executable code into kernel memory without shutting down the virtual machine.

By taking into account the configuration data, the executable code obtained is specific to the virtual machine. When the hypervisor instantiates multiple virtual machines, it can generate and install for each of these virtual machines a specific executable code, generated from the same source code. Thus the poll or “probing” of a virtual machine becomes an on-demand (“on-demand”) and on-the-fly (“on-the-fly”) mechanism, independent of what exists in the virtual machine initially, that is to say at the time of its development or / and its initial instantiation. The survey is done from the hypervisor, and no longer from the virtual machine using an administrator account.

According to the invention, the hypervisor can be of the native type (installed directly on a physical machine), or of the host type (installed on a given operating system, which is itself installed on a physical machine). The mechanism of the invention can be used on any operating system and on any type of virtual machine: "classic" virtual machine or virtual machine containing a container or a uni kernel. For the record, a uni kernel is a small kernel in which a single application is integrated. Such a probing mechanism on a unikernel thus makes it possible to probe minimalist functions, such as network functions.

In one embodiment of the invention, the method of generating and installing an executable code of at least a first function further comprises the steps of:

- obtaining the address of a last return instruction of the first executable code;

- moving to this address at least one instruction of a second executable code installed in the memory of the kernel of the virtual machine;

- recording in an address of this memory, after the moved instruction, a branch instruction at a consecutive address to the address of these instructions moved in the second code before their movement; and

- replacement in the second code, of the instruction moved by a branch instruction to the memory space of the first executable code.

The invention thus makes it possible to enrich the second executable code with the first executable code. When the processor of the installation device according to the invention executes the second code, it is redirected to execute the first code, and then executes the end of the second code.

Since the method is implemented by the hypervisor, the latter can check that the function to be enriched is not executed to modify its executable code as mentioned above to allow its enrichment. The invention thus makes it possible to enrich a function running in the kernel of a virtual machine without interrupting this virtual machine.

For example, the first code can implement a survey to perform statistics on the use of the second code.

Alternatively, the first code can correspond to an authorization management function to increase the security of the use of the second code.

By choosing the moved instruction, it is possible to change the timing of the redirection from the execution of the second code to the execution of the first code.

Note that the moving and recording steps can be performed simultaneously, or one after the other, without constraint on the order of their implementation.

We recall that a branch instruction, also called a return instruction, or a jump instruction is an instruction which allows when it is executed, a return without return, to a memory address comprising an instruction to be executed.

In another embodiment, the method according to the invention further comprises steps of:

- displacement, to an address preceding the memory space of the first executable code, of at least one instruction of a second executable code installed in the memory of the kernel of the virtual machine;

- recording at an address of a last return instruction of the first executable code, of a branch instruction at a consecutive address to the address of the instructions in the second executable code before their movement; and

- replacement, in the second executable code, of the moved instruction, by a branch instruction at said address preceding the memory space of the first code.

In another embodiment of the invention, an aggregation space is used to install the first executable code. In this mode, the method further comprises steps of:

- displacement in a memory space called aggregation, of an instruction of a second executable code installed in a memory of the kernel of the virtual machine, this instruction being followed by a branch instruction to an address which followed these instructions in the second code before their displacement;

- recording in the aggregation memory space before the instruction moved, of a first instruction for branching to said memory space of the first executable code, the instruction of the second executable code being moved to the end or the start of the space aggregation so as to leave space for recording the first branching instruction in the memory space of the first code, and to reserve space for other branching instructions in additional executable code memory spaces, to enrich the second code with these additional codes;

- replacement of a last return instruction of the first code by a second branch instruction at an address in the aggregation memory space, consecutive to that of the first branch instruction; and

- replacement in the second code, of the instruction moved by a branch instruction to the aggregation memory space.

The order of the recording and replacement steps is not exhaustive.

This embodiment makes it possible to organize the memory of the kernel of the virtual machine so as to be able to make, from the second code, one or more references to one or more other executable codes, by inserting branching instructions in space. aggregation memory. In accordance with this embodiment, the instruction of the second code is moved into the aggregation space, preferably towards its end so as to leave space for recording the first branch instruction in the memory space of the first. code, and possibly record other branching instructions to additional executable code memory spaces, to further enrich the second code with these additional codes.

In one embodiment, the method according to the invention further comprises steps of:

- displacement in a memory space called aggregation, of at least one instruction of a second executable code installed in a kernel memory of said virtual machine;

- recording in the aggregation memory space, of a first instruction for branching into the memory space of the first code, followed by a branching instruction at an address which followed said instructions in the second code before their displacement, the instruction of the second executable code being moved to the end or the beginning of the aggregation space so as to leave space to record the first branch instruction to the memory space of the first code, and to reserve some space for other branching instructions to additional executable code memory spaces, to enrich the second code with these additional codes;

- replacement of a last return instruction of the first code by a second branch instruction at an address in the aggregation memory space, immediately following that of said first branch instruction; and

- replacement in the second code, of said at least one instruction moved by a branch instruction to the address of the instruction moved in the aggregation space.

In accordance with this embodiment, the instruction of the second code is moved in the aggregation space, preferably at its start so as to leave space for recording the first branch instruction in the memory space of the first. code, and possibly record other branching instructions to additional executable code memory spaces, to further enrich the second code with these additional codes.

In one embodiment of the invention, the step of calling the memory allocation function takes into consideration the size of a said branch instruction in addition to the size of the first code. Thus, a margin is provided for this instruction in the memory space of the first executable code. In one embodiment in which said at least one moved instruction comprises at least one original branch or call instruction with an address shift towards a target address, said method according to the invention comprising steps of:

- recording, in an area reachable by an instruction of the type of the original instruction (short branch, long branch, short call, long call, unconditional or conditional branch, ...) in the kernel memory of the virtual machine , an unconditional long branch instruction at the target address; and

- modification of the original instruction by a modified instruction of the same type pointing to this unconditional long branch instruction.

Thus, the pointing to the target address is maintained even by implementing the step of moving the instruction (s) of the second code. This embodiment makes it possible to set up an optimized probing mechanism.

In a particular embodiment, the method according to the invention allows the installation of at least one additional executable code in the memory of the kernel of the virtual machine. It includes stages of:

- recording in the aggregation memory space, after the instruction to branch to the memory space of the first executable code, of a third instruction to branch to a memory space of the additional executable code; and

- replacement of an additional code return instruction by a branch instruction at an address in the aggregation memory space, consecutive to that of said third branch instruction.

The second code can thus be enriched by the first executable code, and by the additional executable code. The invention makes it possible to enrich a code with as many other executable codes.

The invention also relates to a computer program on a recording medium, this program being capable of being implemented in a computer or in a generation and installation device in accordance with the invention, this program comprising instructions adapted to the implementation of a generation and installation method as described above.

This program can use any programming language, and be in the form of machine code, source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in n ' any other desirable shape.

In particular, this program can be in Java language, supported by the hypervisor according to the invention. In particular, this program can be executed by a microcontroller pC (“microcontroller” in English).

The invention also relates to information or recording media readable by a computer, and comprising instructions of the computer program as mentioned above.

Information or recording media can be any entity or device capable of storing programs. For example, the media can include a storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or else a magnetic recording means, for example a floppy disk or a disk. hard, or flash memory.

On the other hand, the information or recording media can be transmissible media such as an electrical or optical signal, which can be routed via an electrical or optical cable, by radio link, by wireless optical link or by other ways.

The program according to the invention can in particular be downloaded from an Internet type network.

Alternatively, each information or recording medium can be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the generation and installation method according to the invention.

Brief description of the drawings

Other characteristics and advantages of the present invention will emerge from the description given below, with reference to the appended drawings which illustrate an exemplary embodiment thereof without any limiting nature. In the figures: FIG. 1 illustrates a functional architecture of a device for generating and installing an executable code in accordance with the invention, according to one embodiment of the invention; FIG. 2 is a flowchart representing steps of a method for generating and installing an executable code in accordance with the invention, implemented according to one embodiment; FIG. 3 is a flowchart representing additional steps of a method for generating and installing an executable code in accordance with the invention, implemented according to a first embodiment of the invention; FIG. 4A illustrates an architecture of the organization of the memory of a virtual machine before the implementation of the method for generating and installing an executable code in accordance with the invention, according to the embodiment of the figure 3; FIG. 4B illustrates an architecture of the organization of the memory of a virtual machine following the implementation of the method for generating and installing an executable code in accordance with the invention, according to the embodiment of the figure 3; FIG. 4C illustrates an architecture of the organization of the memory of a virtual machine following the implementation of the method for generating and installing an executable code in accordance with the invention, according to a variant of the embodiment of Figure 3; FIG. 5 is a flowchart representing additional steps of a method for generating and installing an executable code in accordance with the invention, implemented according to a second embodiment of the invention; FIG. 6 A illustrates an architecture of the organization of the memory of a virtual machine following the implementation of the method for generating and installing an executable code in accordance with the invention, according to the embodiment of figure 5; FIG. 6B illustrates an architecture of the organization of the memory of a virtual machine following the implementation of the method for generating and installing an executable code in accordance with the invention, according to a variant of the embodiment of Figure 5; FIG. 7 is a flowchart representing steps of a method for generating and installing an additional code in accordance with the invention, implemented according to an embodiment of the invention; FIG. 8 illustrates an architecture of the organization of the memory of a virtual machine following the implementation of the generation and installation method according to the invention, according to the embodiment of FIG. 7; FIG. 9 illustrates a particular embodiment of the invention in which the displaced instructions comprise branch or call instructions with address offset; and FIG. 10 illustrates the hardware architecture of a generation and installation device according to one embodiment of the invention.

Detailed description of the embodiments of the invention

Figure 1 illustrates a functional architecture of a CMP generation and installation device according to one embodiment of the invention. This device is configured to implement a method in accordance with the invention.

The installation device CMP comprises a physical machine PHY, such as a computer, on which a hypervisor H is installed. The H hypervisor is suitable for managing the allocation of the physical resources of the server between different instances of machines virtual machines and to be able to create, instantiate, release and place virtual machines MV, MV 'and MV ”.

Virtual machines can use different operating systems. Each of the virtual machine operating systems has at least one kernel. For example, we denote by K, the kernel of the virtual machine MV, more precisely of the operating system of the virtual machine MV.

Several virtual machines can be instantiated by the H hypervisor. The H hypervisor can install executable codes in one or more of these virtual machines, in a personalized way for each of these virtual machines. In this description, and for reasons of simplicity, we describe embodiments in which the hypervisor H installs one or more executable codes in a single virtual machine MV.

FIG. 2 is a flowchart representing the different steps of a method for generating and installing an executable code CX1, usually called a “probe”, of at least one function f1 in the kernel of a virtual machine, in accordance with to one embodiment of the invention. This process is implemented by the hypervisor H in figure 1.

During a step E001, the hypervisor H obtains the source code CS1 from a probe comprising at least the source code of a function fl. This CS1 code can include several functions and data internal to the probe, and reference other functions, and / or data external to the probe, which therefore belong to the virtual machine.

The H hypervisor is configured to install the CX1 executable code of the probe, obtained from this CS1 source code, in the K kernel of the VM virtual machine, this CX1 code being specific to this virtual machine.

To this end, during a step E010, the hypervisor H obtains configuration data CFG_MV of the virtual machine MV, these configuration data comprising at least one @F address of a function F called by the source code CS1 in the memory of the virtual machine MV, or an @D address of a data item D referenced by the source code CS1 in the memory of the virtual machine MV.

By way of example, when the CMP device uses an operating system of the Finux type, the configuration data CFG_MV can be included in a file of the “system.map” type, comprising an exhaustive list of the functions of the operating system. of the virtual machine MV as well as, for each of these functions (F), the memory address (@F) of the memory space in which this function is recorded.

The CFG_MV configuration data can include information on the structure of the data recorded in the VM virtual machine, for example on how a process descriptor is structured: process identifier, next process, previous process, etc.

During a step E020, the hypervisor H compiles the source code CS1 using the configuration data CFG_MV to obtain an object code.

During a step E030, the hypervisor H calls a malloc_MV function of the virtual machine MV to allocate a memory space EM1 in the memory of the kernel of the virtual machine MV at least sufficient to accommodate the executable code CX1. We denote @ EM1 the start address of this memory space EM1 in the virtual machine VM.

The hypervisor H then edits the links (in English "link") and assembles the object code to obtain the executable code CX1 using the configuration data CFG_MV and a result of the call (E030) to the malloc_MV function, in particular l '@ EM1 address of the EM1 space. Thus, the executable code CX1 is specific to the virtual machine MV; in effect, linking relies on the configuration of the VM virtual machine.

During a step E040, the hypervisor H records the executable code CX1 in the virtual machine MV, in the memory space EM1 allocated in step E030.

FIG. 3 is a flowchart showing additional steps of the generation and installation method according to the invention, these steps being implemented by the hypervisor H, in accordance with a particular embodiment of the invention.

These additional steps aim to allow the call of the executable code CX1 of the function fl, that is to say the call of the probe, by an executable code CX0 of another function fO, this executable code CX0 being installed in a space EM0 of the memory of the kernel the virtual machine MV, in accordance with the description given in relation to FIG. 2.

The executable code CX0 of the probed function fO can be a pre-existing function in the kernel of the virtual machine MV. For example, this CX0 code can be the code for a disk file reading fO function. This process is implemented by the hypervisor H in figure 1.

Figure 4A shows the memory of the virtual machine VM before performing the steps in Figure 3:

- the CX0 code starts at address @ EM0 at the start of the EM0 memory space;

- the code CX0 comprises consecutive INS0 instructions in the function fO;

- the virtual memory address following these INS0 instructions is noted @ EM0 +;

- the code CX1 starts at the address @ EM1;

- code CX1 ends with a return instruction RET, the address of this instruction being noted @ RET1. During a step E045, the hypervisor H locates in the memory of the kernel of the virtual machine MV the address @ RET1 of the last return instruction (of the RET or return type) of the code CX1 of the function fl. The term “last return instruction” is understood to mean the return instruction with the largest address.

During a step E050, the hypervisor H moves one or more consecutive instructions INS0 located at address @ EM0 from code CX0 to address @ RET1, thus overwriting the return instruction of function fl. The INS0 instructions of the CX0 code are intended to be executed in place of the RET return instruction of the CX1 code. The INS0 instruction or moved instructions can be stored exactly at the @ RET1 address. As a variant, one or more NOP type instructions are recorded at the address @ RET1 and the displaced INS0 instructions are recorded after these NOP instructions. Remember that the NOP (in English No Operation) instructions are thousand instructions which dictate to the processor not to take any action.

During a step E060, the hypervisor H records in the memory of the kernel of the virtual machine MV, just after the displaced INS0 instructions, a branch instruction JMP @ EM0 + at the address @ EM0 + which followed the address @ EM0 of the INS0 instructions in the CX0 code before they are moved.

During a step E070, the hypervisor H replaces, in the code CX0, the instruction (s) INS0 by a JMP @ EM1 instruction for branching to the address @ EM1 at the start of the memory space EM1 where the code is recorded CX1. Thus the CX1 code of the fl function, installed by the hypervisor, is executed before the execution of the CX0 code of the fO function.

FIG. 4B illustrates the content of the memory of the virtual machine MV following the implementation by the hypervisor H of the installation method described with reference to FIGS. 1 to 4A.

Following the implementation of the method of the invention, when the virtual machine MV begins to execute the executable code CX0 of the function fO (phase 1 of FIG. 4B), the processor of the device CMP executes the instruction JMP @ EM1 and connects to the start of the executable code of the function fl (phase 2).

The processor executes, during phase 3, the CX1 code of the fl function except the return instruction RET, overwritten, then the displaced INS0 instructions, then it connects to the address @ EM0 + (phase 5); it executes the end of the CX0 code (phase 6). The invention thus makes it possible to enrich the code CX0 by the code CX1 of the function fl.

In this embodiment, during step E030 for calling the malloc_MV memory allocation function, the hypervisor H reserves space not only for the executable code CX1, but also for the branch instruction JMP @ EM0 +. In another example of this embodiment shown in FIG. 4C, the hypervisor H moves one or more consecutive instructions INS0 located at the address @ EM0 of the code CX0 before the code CX1, in other words at an address @ EM1- preceding the memory space EM1.

In the example of figure 4C, the hypervisor registers, at the address @ RET1 of the last return instruction of the code CX1, a branch instruction JMP @ EM0 + at the address @ EM0 + which followed the address @ EM0 INS0 instructions in the CX0 code before they are moved. The hypervisor then replaces in the code CX0, the instruction (s) moved INS0 by a branch instruction at the address @ EM1- preceding the memory space EM1 of the first code CX1, in other words at the address where the instructions were displaced.

This example is particularly interesting when we want to probe the return of a function from a calling function.

Alternatively, one or more NOP-type instructions are stored at the @ RET1 address, and the H hypervisor stores the JMP @ EM0 + instruction in the kernel memory of the VM virtual machine, just after the CX1 code.

FIG. 5 is a flowchart showing additional steps of the generation and installation method according to the invention, implemented by the hypervisor H according to another embodiment of the invention. The additional steps are intended to enable the CX1 executable code to be called by CX0 executable code installed in the kernel memory of the virtual machine, using additional AGR memory space, known as aggregation.

The memory of the virtual machine MV before the execution of the steps of Figure 5 is identical to that of Figure 4A already described.

During a step E0500, the hypervisor H initializes the aggregation memory AGR, for example by allocating a memory page to it and filling it with null instructions of the NOP type.

During a step E052, the hypervisor H moves, at the end of the aggregation space

AGR:

- one or more INS0 instructions of code CX0;

- followed by a JMP @ EM0 + branch instruction at address @ EM0 + which followed the INS0 instructions in the CX0 code before they were moved.

During a step E064, the hypervisor H records at the start of the aggregation space AGR, a branch instruction JMP @ EM1 to the address of the memory space EM1 of the code CX1. During a step E066, the hypervisor H replaces at the address @ RET1 a last return instruction of the code CX1 by a branch instruction JMP @ AGR + at an address @ AGR + in the consecutive AGR aggregation memory space to that of the JMP @ EM1 branch instruction.

During a step E072, the hypervisor H replaces in the code CX0, the displaced instruction (s) INS0 by a JMP @AGR instruction for branching to the address of the aggregation memory AGR.

FIG. 6A illustrates the memory of the virtual machine MV following the implementation by the hypervisor H of the installation method according to the mode described with reference to FIG. 5.

Figure 6A shows memory spaces in which the CX0 code, CX1 code, and AGR aggregation space are stored. In the memory space of code CX0, the displaced INS0 instructions are replaced by the JMP @AGR instruction for branching to the AGR aggregation space.

In the memory space EM1 corresponding to the code CX1, is the private code CX1 of the return instruction RET, followed directly or after instructions of the NOP type, by the JMP @ AGR + instruction for connection to an NOP instruction of the AGR aggregation space.

In the AGR aggregation space, there is the JMP @ EM1 instruction for branching to the EM1 memory space of the CX1 code, followed by NOP instructions, followed by the displaced instruction (s) INS0, then by the JMP instruction @ EM0 + connection to the @ EM0 + address which followed the INS0 instructions in the CX0 code before they were moved.

Following the implementation of the embodiment of FIG. 6A, when the virtual machine MV starts to execute the code CX0 (phase 1), the processor connects to the start of the aggregation memory AGR, and executes the first instructions of the AGR aggregation space. This connection is illustrated by phase 2 of FIG. 6A.

The processor then plugs in at the start of the CX1 code (phase 3) and begins executing this CX1 code (phase 4).

The processor then connects to the @ AGR + address of the aggregation memory (phase 5).

The processor then executes NOP instructions (phase 6) then the displaced instructions INS0.

Then, the processor connects to the address @ EM0 + of the CX0 code (phase 7) and then ends the execution of the CX0 code of the fO function (phase 8).

The function fO is thus enriched by the function fl. In another example of this embodiment shown in FIG. 6B, the hypervisor H moves to the start of (or before) the aggregation memory space AGR one or more INS0 instructions of the CX0 code. Then it records, after the INS0 instruction of the aggregation memory space, a first JMP @ EM1 instruction for branching into the memory space of the CX1 function, and records at the end of the aggregation memory space AGR a JMP @ EM0 + instruction for branching at the address @ EM0 + which followed the INS0 instructions in the CX0 code before they were moved. The hypervisor H replaces the last return instruction of code CX1 by a branch instruction at an @ AGR + address immediately following that of the first branch instruction. The hypervisor H replaces, in the code CX0, the displaced instruction (s) INS0 by a JMP @ INS0 instruction for branching to the displaced instruction (s) INS0, after their displacement. This exemplary embodiment is particularly interesting when we want to probe the return of a function from a calling function.

In this example, the JMP @ EM0 + branch instruction is placed at the end of the AGR aggregation space, separated from the first JMP @ EM1 instruction by empty NOP-type instructions. In this way, these intermediate NOP instructions can be replaced by instructions for branching into other additional codes to enrich the CX0 code by these additional codes in addition to the CX1 code, as described below with reference to FIG. 7. Alternatively, when there are no additional codes, the JMP @ EM0 + branch instruction can follow the first JMP @ EM1 instruction directly.

FIG. 7 is a flowchart showing the different steps of a method for generating and installing, in the kernel K of a virtual machine MV, at least one additional executable code CX2, in accordance with an embodiment of the 'invention. This process is implemented by the H.

In this embodiment, we assume that a CX0 code is installed in the memory of the virtual machine MV and that a CX1 code has also been installed in the kernel K of the virtual machine MV according to the mode described with reference to the figures 5 and 6 A (or 6B).

The following steps are intended to install another CX2 executable code into the K kernel memory and be able to run it from the CX0 code, after executing the CX1 code, using AGR aggregation memory.

During a step E067, the hypervisor H records, in the aggregation memory AGR, after the JMP @ EM1 instruction for branching to the memory space occupied by the code CX1, a JMP @ EM2 instruction for branching to the memory space EM2 occupied by the code CX2. During a step E068, the hypervisor H replaces a code return instruction CX2 by a branch instruction JMP @ AGR ++ at an address of the aggregation memory AGR consecutive to that of the branch instruction JMP @ EM2 to the EM2 memory space.

The invention thus makes it possible to enrich the code CX0 with the executable codes CX1 and CX2.

Other additional CXi executable codes can be installed and enrich the CX0 function using the AGR aggregation space, according to the embodiment described with reference to Figure 7.

FIG. 8 illustrates an architecture for organizing the memory in the virtual machine MV following the implementation by the hypervisor H of the installation method according to the mode described with reference to FIG. 7.

In an exemplary embodiment described with reference to FIG. 9, the displaced instructions INS0 comprise one or more branch instructions, for example JMP, CALL, etc. Such instructions include a memory displacement ("offset") to reference the destination of the branch. In the example of Figure 9, the INS0 instructions, stored at address 0100, are 50 bytes long, have a branch instruction with an 80-byte offset (JMP OFF 80) pointing to address 0180.

When the INS0 instructions which include such branches are moved, the destination of the branches is no longer the same as that initially intended. Indeed, due to the movement of the INS0 instructions, the destination of the branches changes, since it is calculated according to the address of the branch instruction.

It is assumed here that the INS0 instructions are moved to address 0300.

In order to overcome this drawback, it is planned to add before or after the displaced INS0 instructions as many unconditional long-branch ILI instructions as there are branch instructions or calls in the displaced INS0 instructions. Each of the added unconditional long branch instructions points to a target destination @CIB pointed to by an original INSOR branch instruction included in the displaced INS0 instructions, before they are moved.

In the example described here, we record at address 0350, corresponding to the end of the displaced instructions, an unconditional long branch instruction JMP OFF -170 pointing to the target address 0180.

A branch instruction included in the moved INS0 instructions is changed to point to the added branch instruction ILI, which points to the initial @CIB (0180) intended for before the INS0 instructions were moved. In the example described here, the JMP OFF 80 branch instruction moved to address 300 is modified by an instruction of the same JMP OFF 50 type pointing to address 0350 where the ILI unconditional branch instruction is recorded.

In a first case corresponding to the example of figure 9, the unconditional branching instructions (JMP OFF -170) are added after the JMP branching instruction EM0 + when the displaced instructions INS0 are found after the executable code CX1 or after l AGR aggregator memory space. In this way, even if the INSOR instruction is of the conditional branch instruction type and if the corresponding conditions are not verified, the rest of the execution remains valid because the branch indicated in the INSOR instruction will not be carried out and l The JMP EM0 + branch instruction allows the virtual machine MV to execute the rest of the first CX0 code.

In a second case, the branching instructions are added before the displaced INS0 instructions when the latter are located before the CX1 executable code or before the AGR aggregator memory space.

The methods of the present invention have been experienced by implementation on VM virtual machines which use the operating system Linux, Debian version 7, and / or Windows, version 7 (registered trademarks). Other versions of these systems are possible. In addition, other operating systems are possible, such as FreeBSD, NetBSD, and OpenBSD (registered trademarks).

In the embodiments described here, the installation device CMP has the architecture of a computer, as illustrated in FIG. 10. It comprises in particular a processor 7, a random access memory 8, a read only memory 9, a non-volatile flash memory 10 in a particular embodiment of the invention, as well as communication means 11. Such means are known per se and are not described in more detail here.

The read-only memory 9 of the CMP device according to the invention constitutes a recording medium according to the invention, readable by the processor 7 and on which the hypervisor H according to the invention is recorded.

The CMP device memory 10 is used to store variables used for performing the steps of the methods of the invention, such as CFG_MV configuration data, CS source code, etc.

The hypervisor H defines functional and software modules, configured to install an executable code in a kernel K of a virtual machine MV. These functional modules are based on and / or control the hardware elements 7-11 of the CMP device mentioned above. In the embodiments described, the hypervisor H implements the invention. In another exemplary embodiment, certain steps of the invention can be implemented in external software, ie external to the hypervisor, and others implemented by the hypervisor. For example, the generation of the executable code from the source code and configuration data can be implemented by the external software and the installation of the executable code in the memory of the virtual machine can be implemented by the hypervisor. .

Claims

1. A method of generating and installing an executable code (CX1, CX2) of at least a first function (fl) in the memory of a kernel (K) of a virtual machine (MV), said method being implemented by a hypervisor (H), and comprising steps of:

- obtaining (E001) a source code (CS1) comprising at least the first function

(fl);

- obtaining (E010) configuration data (CFG_MV) of said virtual machine, said configuration data comprising at least one address (@F, @D) in a memory of the kernel of the virtual machine (MV) of a function or data referenced by said source code (CS1);

- obtaining (E020) an object code by compiling said source code (CS1) using said configuration data (CFG_MV);

- call (E030) of a memory allocation function (malloc_MV) of said virtual machine, to reserve a space (EM1) in the kernel memory of the virtual machine

(MV) for an executable code (CX1) corresponding to said object code;

- obtaining said executable code (CX1) by assembling said object code using said configuration data (CFG_MV) and a result (@ EM1) of said call (E030) to the memory allocation function; and - recording (E040) of said executable code (CX1) in said memory space (EM1).

2. A method of generating and installing an executable code (CX1) according to claim 1, this method further comprising the steps of:

- obtaining (E045) the address (@ RET1) of a last return instruction of said executable code (CX1);

- displacement (E050) to said address (@ RET1), of at least one instruction (INS0) of a second executable code (CX0) installed in the kernel memory of said virtual machine;

- recording (E060) in an address of said memory, after said at least one moved instruction (INS0), of a branch instruction to an address (@ EM0 +) consecutive to the address (@ EM0) of the instructions (INS0) in said second code (CX0) before their displacement; and

- replacement (E070) in said second code (CX0), of said at least one displaced instruction (INS0) by a branch instruction to said memory space (EM1) of said executable code (CX1).

3. A method of generating and installing an executable code (CX1) according to claim 1, this method further comprising the steps of:

- displacement, to an address (@ EM1-) preceding the memory space (EM1) of said executable code (CX1), of at least one instruction (INS0) of a second executable code (CX0) installed in the memory of the kernel of said virtual machine;

- recording at an address (@ RET1) of a last return instruction of said executable code (CX1), of a branch instruction at an address (@ EM0 +) which followed the address (@ EM0) of the instructions (INS0) in the second code (CX0) before their displacement; and

- replacement in said second code (CX0), of said at least one displaced instruction (INSO) by a branch instruction at said address (@ EM1-) preceding the memory space (EM1).

4. A method of generating and installing an executable code (CX1) according to claim 1 further comprising steps of:

- displacement (E052) in a memory space called aggregation (AGR), of at least one instruction (INS0) of a second executable code (CX0) installed in a memory of the kernel said virtual machine, these instructions being followed by a branch instruction at an address (@ EM0 +) which followed said instructions (INS0) in said second code (CX0) before their displacement;

- recording (E064) in said aggregation memory space (AGR), before said at least one displaced instruction (INS0), of a first connection instruction to said memory space (EM1) of said executable code (CX1), the instruction of the second executable code being moved to the end or the start of the aggregation space so as to leave space for recording the first branching instruction to the memory space of the first code, and to reserve space for other branching instructions to additional executable code memory spaces, to enrich the second code with these additional codes; - replacement (E066) of a last return instruction of said code (CX1) by a second branch instruction at an address (@ AGR +) in said aggregation memory space, consecutive to that of said first branch instruction; and

- replacement (E072) in said second code (CX0), of said at least one displaced instruction (INS0) by a branch instruction to said aggregation memory space (AGR).

5. A method of generating and installing an executable code (CX1) according to claim 1 further comprising steps of:

- displacement in a memory space called aggregation (AGR), of at least one instruction (INS0) of a second executable code (CX0) installed in a kernel memory of said virtual machine;

- recording, in said aggregation memory space (AGR), of a first connection instruction to said memory space (EM1) of said code (CX1) followed by a connection instruction to an address (@ EM0 +) which followed said instructions ( INS0) in said second code (CX0) before their displacement, the instruction of the second executable code being moved towards the end or the beginning of the aggregation space so as to leave space to record the first branch instruction in the memory space of the first code, and in reserving space for other branching instructions to memory spaces of additional executable codes, in order to enrich the second code with these additional codes;

- Replacement of a last return instruction of said code (CX1) by a second branch instruction at an address (@ AGR +) in said aggregation memory space, immediately following that of said first branch instruction; and - replacement in said second code (CX0) of said at least one displaced instruction (INSO) by a branch instruction to the address of said at least one displaced instruction (INS0) in said aggregation space (AGR).

6. A method of generating and installing an executable code (CX1) according to one of claims 2 to 5 wherein said step (E030) of calling the memory allocation function takes into consideration the size d. 'a said branch instruction in addition to the size of said executable code (CX1).

7. A method of generating and installing an executable code (CX1) according to any one of claims 4 to 6, to install at least one additional executable code (CX2) in the memory of the kernel (K) of said machine. virtual (MV), said method comprising steps of:

- recording (E067) in said aggregation memory space (AGR), after said instruction for branching into the memory space of the executable code (CX1), of a third instruction for branching into a memory space (EM2) of the executable code additional (CX2); and - replacement (E068) of a return instruction of said additional code (CX2) by a branch instruction at an address (@ AGR ++) of said aggregation memory space, consecutive to that of said third branch instruction.

8. A method of generating and installing an executable code (CX1) according to any one of claims 2 to 7 wherein said at least one displaced instruction (INS0) comprises at least one original branch or d instruction. 'call with an address offset to a target address, said method comprising the steps of:

- recording, in an area (Z) reachable by an instruction of the type of said original instruction in the memory of the kernel of the virtual machine, of an unconditional long branch instruction at G target address; and

- modification of said original instruction by a modified instruction of the same type pointing to said unconditional long branch instruction.

9. Device for generating and installing an executable code (CX1) of at least a first function in a memory of a kernel (K) of a virtual machine (MV), said device comprising the virtual machine and a hypervisor (H), said hypervisor comprising a module (MOD) capable of implementing a method for generating and installing an executable code (CX1) according to one of claims 1 to 8.

10. Computer program (Prog) comprising instructions for the execution of a method for generating and installing an executable code (CX1) according to one of claims 1 to 8 when said program is executed by a computer.

11. A recording medium readable by a computer on which the computer program (Prog) according to claim 10 is recorded