WO2010121770A2

WO2010121770A2 - Execution process for a programme by a virtual machine, virtual machine code and associated device

Info

Publication number: WO2010121770A2
Application number: PCT/EP2010/002381
Authority: WO
Inventors: Cedric Mesnil; Dominique Bouveron
Original assignee: Trusted Logic
Priority date: 2009-04-20
Filing date: 2010-04-19
Publication date: 2010-10-28
Also published as: WO2010121770A3

Abstract

The invention concerns an execution process for a program comprising virtual instructions, executable by a virtual machine, each virtual instruction representing an action. The process comprises: for at least one virtual instruction of the program, called a corrected virtual instruction, beginning to execute a loop of instructions of virtual machine code (112) called an interpretation loop. Complete execution of the interpretation loop enables: determination of the action represented by the current virtual instruction; selection and execution of a translation of the action, comprising at least one real instruction of virtual machine code (112), and being associated with the determined action; selection of a subsequent virtual instruction on which the interpretation loop is intended to be executed; during execution of the interpretation loop for the corrected instruction, before restarting execution of the interpretation loop for a new instruction, searching in a lookup table for a patch associated with the corrected instruction, and commanding execution of the patch.

Description

Execution process for a programme by a virtual machine, virtual machine code and associated device

This invention concerns an execution process for a programme by a virtual machine, as well as an associated computer device. The invention applies particularly in the field of smart cards such as Java Cards.

In general, a processor is designed to carry out a certain number of operations: for example, addition, reading in memory, writing in memory, etc.

All these operations are usually called native language, or machine language, or machine code. Thus the processor is designed to execute a set of instructions (ie. a program), each instruction representing an action, that is an operation and, if necessary, the operands to which the operation is applied (for example, numbers to be added for an addition operation, the memory address to be read for an instruction to read in memory). An instruction is represented by a set of bits containing a binary code defining the operation, called opcode or operation code, and the binary representation of the operands expected for this operation.

For example, the action: "add registers 1 and 2 and put the result in register 6" is represented by the instruction (in decimal, for MIPS architecture): 0 1 2 6 0 32 with 0 being the operation code and 1, 2, 6, 0, 32 the operands.

A virtual machine is a program that, when executed by a first processor ("real" processor), emulates a second processor ("virtual" processor), usually of a different type to the first, that is having a different machine language.

The virtual machine is thus intended to execute instructions written in the machine language of the second processor, by translating these instructions written in the machine language of the first processor on the fly, to that the second can execute them. Such translation on the fly is called interpretation. In contrast to compilation, the result of interpretation is not intended to be stored for later execution, but is executed on the fly as soon as interpretation has been carried out. In what follows, instructions intended to be executed by the virtual machine will be called virtual instructions, while instructions intended to be executed by the real processor will be called real instructions. The virtual machine is therefore a program made up of real instructions, the task of which is to interpret virtual instructions. In addition, saying that the virtual machine executes virtual instructions will be equivalent to saying that the processor is executing the code (real) of the virtual machine in order to translate virtual instructions into real instructions.

Thus, we know in the state of the art an execution process for a program comprising so-called virtual instructions, executable by a virtual machine, each virtual instruction of the program representing an action, of type comprising:

- for at least one virtual instruction of the program, called a corrected virtual instruction, to begin executing a loop of instructions of virtual machine code, called an interpretation loop, the interpretation loop being designed to be executed in turn on the virtual instructions, the virtual instruction interpreted by the interpretation loop being called a current virtual instruction, complete execution of the loop enabling:

+ determination of the action represented by the current virtual instruction; + selection and execution of the translation of an action, this translation comprising at least one so-called real instruction of virtual machine code, and being associated with the determined action;

+ selection of a subsequent virtual instruction on which the interpretation loop is intended to be executed. In a smart card, the program and virtual machine code are generally saved in a read-only memory, often called dead memory, because this type of memory is cheap.

After saving the program, modifications are made to the program, for example to correct errors or to add new functionalities to the product. Such modifications can be made by saving patches in rewritable memory. To call patches, you can introduce at least one set of virtual instructions, generally called "patch point", into the program's virtual instructions; when all of them are executed by the virtual machine this has the effect of searching a lookup table for the presence of a patch in rewritable memory and of commanding its execution by the virtual machine. During execution of the program by the virtual machine, these update call virtual instructions are executed by the virtual machine just as any other virtual instruction in the program. Thus, the virtual machine loop is executed once for each update call virtual instruction.

In particular the purpose of the invention is to reduce the execution time for an update call, as well as the size (number of bits making up the set of virtual instructions) of the update call instructions.

To this end, the subject of the invention is a process of the type mentioned above, characterised by:

- during execution of the interpretation loop for the corrected instruction, before restarting execution of the interpretation loop for a new current instruction, searching in a lookup table for a patch associated with the corrected instruction, and commanding execution of the patch.

Using this invention, update instructions (the "patch point") are integrated into the interpretation loop, and so test for the presence of an update, which improves search speed for an update.

In addition, a patch point is not represented in the program code by a set of virtual instructions, which reduces program size.

Depending on specific implementation methods, the execution process for a program comprises one or several of the following characteristics: - the patch may comprise virtual instructions and the command to execute the patch leads to execution of the interpretation loop on the patch;

- the patch may comprise real instructions; - for each current instruction, on which the interpretation loop is executed, it comprises searching the lookup table for a patch associated with the current instruction;

- the search and command to execute the patch are carried out before the interpretation loop enables the translation associated with the determined action to be selected and executed;

- the search for a patch is or is not carried out depending on the determined action;

- the search and command to execute the patch are carried out during execution of the translation associated with the determined action;

- execution of the translation consists only of the search and execution command for the patch.

The invention also comprises a virtual machine code comprising real instructions, which when executed by a processor leads the processor to execute a process of the type mentioned above.

The invention also comprises a type of computer device comprising:

- a processor;

- a first memory in which are stored:

+ a program comprising so-called virtual instructions, executable by a virtual machine, each virtual instruction of the program representing an action;

+ a virtual machine code comprising a loop of instructions, called an interpretation loop, intended to be executed by the processor in turn on each virtual instruction of the program, the virtual instruction interpreted by the interpretation loop being called a current virtual instruction, the interpretation loop comprising, in order of execution:

* instructions to determine the action of the current virtual instruction;

* instructions to select and command execution of a translation of the action, this translation comprising at least one real instruction of virtual machine code, and being associated with the determined action; ^* instructions to select a subsequent virtual instruction on which the interpretation loop is intended to be executed;

- a second memory in which are stored:

+ at least one patch; + a lookup table associating at least one virtual instruction for the program, so-called corrected virtual instruction, with each patch;

- the virtual machine code comprises instructions, called update instructions, intended to be executed by the processor for the corrected virtual instructions, before restarting execution of the interpretation loop for a new current instruction, searching in the lookup table for a patch associated with the corrected program instruction, and commanding execution of the patch.

Depending on specific implementation methods, the computer device comprises one or several of the following characteristics:

- the first memory is a non-rewritable memory; - the second memory is a rewritable memory;

- the update instructions are located, in the sequence of the interpretation loop, before instructions to select and command execution of the translation associated with the determined action;

- the update instructions are located, in the sequence of the interpretation loop, after instructions to determine the action represented by the current virtual instruction;

- translation comprises update instructions to search for and call the patch;

- translation comprises only update instructions to search for and call the patch. These characteristics and advantages of the invention, as well as others, will appear in the following description of implementation methods for the invention, given only as non-limiting examples. The description refers to appended diagrams, among which:

- figure 1 represents a computer device according to the invention, including a virtual machine; - figure 2 represents a first implementation method of a code for the virtual computer machine in figure 1 ;

- figure 3 is a block-diagram illustrating an execution process for a program by the virtual machine having the code in figure 2; - figure 4 represents a second implementation method of a code for the virtual machine of the computer device in figure 1 ;

- figure 5 is a block-diagram illustrating an execution process for a program by the virtual machine having the code in figure 4;

- figure 6 represents a third implementation method of a code for the virtual machine of the computer device in figure 1 ;

- figure 7 is a block-diagram illustrating an execution process for a program by the virtual machine having the code in figure 6.

A computer device, designated by the general reference 100, is represented in figure 1. In the example shown computer device 100 is Java Card type smart card.

Computer device 100 comprises a support 102, for example having the format of a normal bank card.

Device 100 also comprises a processor 104 mounted on support 102. In the example shown processor 104 is a microprocessor. Device 100 also has a volatile memory 106, for example RAM meaning

"Random Access Memory", to which processor 104 has access.

Device 100 also comprises a non-rewritable permanent memory 108. For example this is ROM meaning "Read-Only Memory". Permanent memory is a memory in which data are not erased when device 100 is not supplied with power. The processor also has access to non-rewritable memory 108.

Device 100 also has a permanent rewritable memory 110, to which processor 104 has access. For example this is an EEPROM memory, meaning "Electrically-Erasable Programmable Read-Only Memory". Rewritable memory 110 is more expensive than non-rewritable memory 108, in such a way that non- rewritable memory 108 is used in priority. Non-rewritable memory 108 comprises a virtual machine code 112 as well as a program 114. Virtual machine code 112 and processor 104 form a virtual machine 113 intended to execute program 114.

Program 114 comprises a set of virtual instructions, each virtual instruction of program 114 representing an action intended to be executed by the virtual processor emulated by virtual machine 113. Thus, each virtual instruction of program 114 comprises an operation code representing an elementary operation of the virtual machine language, followed as . appropriate by one or several operations. These virtual instructions are written in a format comprehensible by virtual machine 112 but not by processor 104, in such a way that processor 104 cannot directly execute the virtual instructions of programme 114.

Virtual machine 113 is intended to interpret the virtual instructions of program 114 into real instructions. Virtual machine 113 is, for example, the Java Card virtual machine (JCVM).

Code 112 for virtual machine 113 comprises real instructions, directly executable by processor 104, and in particular an interpretation loop. Different implementation methods of the interpretation loop for code 112 for virtual machine

113 enabling this interpretation will be detailed below, by reference to figures 2 to 7.

At least one patch 116 is saved in rewritable memory 110. Patch 116 comprises a set of virtual instructions executable by virtual machine 113 and is intended to be called during execution of program 114 by virtual machine 113.

Rewritable memory 110 also comprises a lookup table 118, associating at least one respective virtual instruction of program 114 with each patch 116.

In preference, virtual instructions of program 114 each have an identifier, enabling them to be distinguished from one another, for example their address in non-rewritable memory 108. In addition, patches 116 also have an identifier, for example the address of their first instruction in rewritable memory 110. Lookup table 118 preferably associates the identifier for each patch 116 with one or several identifiers for virtual instructions of program 114.

Volatile memory 106 comprises registers 120. One of the registers 120 is called code marker 122. When computer device 100 is operating, code marker

122 stores the address for the current virtual instruction, that is, at any given moment, the current virtual instruction being interpreted by the interpretation loop of virtual machine 113.

Processor 104 is intended to execute real instructions in the sequence in which they are written. This means that after executing a real instruction, processor 104 executes the real instruction written immediately afterwards, unless the real instruction executed indicates another subsequent real instruction.

By reference to figure 2, in a first implementation method for the invention, code 112 of virtual machine 113 first of all comprises real instructions 202 to initialise code marker 122 to the address of the first virtual instruction for program 114.

Code 112 is then followed by an interpretation loop 200, intended to be executed once only by processor 104 for each current virtual instruction, program

114 or patch 116, defined by the value of code marker 122 (in the case where no other virtual instruction of program 114 or patch 116 changes code marker 122 in order to reread this current virtual instruction).

Interpretation loop 200 first of all comprises real instructions 204 in order to read and check syntax of the current virtual instruction.

Interpretation loop 200 also comprises real instructions 206 in order to determine the action of the current virtual instruction. This is done by extracting the operation code from the current virtual instruction and, if appropriate, the associated operands.

Interpretation loop 200 also comprises real instructions, called update instructions 208, in order to search in the lookup table 118 for a patch 116 associated with the current instruction, and in order to command execution of this patch 116. By modifying lookup table 118, it is possible to choose at what points in program 114, that is at the level of which virtual instructions in program 114, patch 116 is applied. In addition, it will be commented that the same patch can be called for several virtual instructions of program 114. Interpretation loop 200 then comprises several series of real instructions

212-1 , ...212-n, ...212-N. Each of these series of real instructions is associated with a respective operation code for the language of the virtual processor, and is intended to be executed by processor 104 when this operation code is encountered in the current virtual instruction. In what follows, each of these series of real instructions will be called "translation".

Each translation 212-1...212-N comprises real instructions, called translated real instructions 213-1 , ...213-n, ...213-N, intended, when they are executed by processor 104, to carry out the same action as that represented by the current virtual instruction. Interpretation loop 200 also comprises real instructions 210 to select translation 212-n associated with the operation code for the current instruction, and therefore with the operation for the current instruction.

Interpretation loop 200 then comprises real instructions 214 to select a subsequent virtual instruction intended to be executed by virtual machine 113 during the next cycle, that is during the next execution of the loop. For example, code marker 122 is incremented by one, in order to read the next virtual instruction in the memory.

Interpretation loop 200 then comprises real instructions 216 in order to return to the beginning of interpretation loop 200. By reference to figures 2 and 3, we will now describe a process 300 for executing program 114 by virtual machine 113.

During a step 302, processor 104 executes instructions 202 to initialise code marker 122 to the first line of program 114.

Process 300 then comprises repeated execution of interpretation loop 200 by processor 104, each time to translate a virtual instruction. During a step 303, processor 104 begins to execute loop 200 of real instructions of code for virtual machine 112, for the current instruction of program 114.

During a step 304, processor 104 executes instructions 204 to read and check syntax of the current instruction.

During a step 306, processor 104 executes instructions 206 to determine the action represented by the current instruction. For this purpose, virtual machine

113 extracts the operation code and, if appropriate, operands for the current virtual instruction, in order to store them, for example, in registers 120 of volatile memory 106.

The process also comprises a step 308, during which instructions 208 are executed by processor 104, in order to search in lookup table 118 for a patch 116 associated with the current instruction, and in order to call and execute this patch 116 if necessary. Preferably, during this step 308, virtual machine 113 searches for the address of the current instruction in lookup table 118 and, if it finds this address, infers from it the address of associated patch 116.

If the current instruction of program 114 is associated with a patch 116 stored in rewritable memory 110, virtual machine 113 calls, during a step 309, the identified patch 116 - for example, by modifying code marker 122 so that it points to the address for the first virtual instruction of patch 116. Thus, during the subsequent execution of interpretation loop 200, patch 116 located will start to be executed. In this case, where there is a patch, the instruction read at step 304 is not executed after all. If no patch is found, during a step 310, processor 104 executes instructions

210 to select the translation associated with the operation code for the current instruction, and commands its execution.

The process also comprises a step 312 during which the processor executes the selected translation. In the first implementation method step 312 comprises a step 313 to execute translated instructions 213-1...213-N, and so carries out the action coded in the current virtual instruction. During a step 314, processor 104 executes instructions 214 to select a subsequent virtual instruction intended to be executed by virtual machine 113 during the next execution of interpretation loop 200. For example, code marker 122 is incremented by one. During a step 316, the processor executes instructions 216 bringing it back to the beginning of interpretation loop 200, in order to perform a new starting step 202 for interpretation loop 200, this time for the new current virtual instruction.

If a patch 116 is called, steps 304, 306, 308, 310, 312 and 314 are reiterated for the virtual instructions of called patch 116. In a first variant, when a patch 116 is found at step 308, once update instructions 116 are completed, virtual machine 113 resumes execution of the instruction from program 114 read at step 304.

In a second variant compatible with the first, execution of patch 116 leads to modification of the instruction read at step 304 before its examination at step 310 and subsequent execution at step 312, either the operation code is replaced by another operation code, or at least one of the operands is modified, or the operation code and one or several operands are modified.

In a third variant compatible with the previous ones, execution of the patch modifies the value of code marker 122 resulting in a jump of one or several lines of virtual instructions during reading of program 114 by virtual machine 113.

In this implementation method, update instructions 208 are systematically executed after decoding step 306 for the current virtual instruction, but before selection and execution (steps 310 and 312) of its translation. This, virtual machine 113 tests for the presence of a patch 116 in rewritable memory 110 for each virtual instruction of program 114. If the contents of rewritable memory 110 indicate that a patch 116 is present, the virtual instructions of this patch 116 are executed by virtual machine 113. If not, execution of the program's current virtual instruction proceeds normally. In a second implementation method of the invention, represented on figure

4, the interpretation loop, now referenced 400, is identical to that in the first implementation method, if this is only real update instructions, from now on referenced 402, are placed in one or several pre-determined translations, chosen when writing code 112 for virtual machine 113, in addition to the translated instructions. In the example shown in figure 4, the first translation 212-1 comprises update instructions 402.

As a non-limiting example, when the virtual machine is a Java Card virtual machine (JCVM), the translations chosen to receive real update instructions 402 can comprise certain or all of the method invocation instructions, for example

"invokeinterface", "invokespecial", "invokestatic", "invokevirtual", or raising an exception, for example "athrow".

Update instructions 402 are similar to those in the first implementation method and so are intended to search in lookup table 118 for a patch 116 associated with the current instruction, and to command execution of this patch

116.

By reference to figure 5, we will now describe a process 500 for executing program 114. Steps similar to those of process 300 in figure 3 carry the same references and will not be described again. Process 500 comprises steps 302, 303, 304, 306 and 310 described above.

It will be particularly noted that patch search step 308 is not carried out in process

500.

Execution step 312 for the translation associated with the operation code for the current virtual instruction this time comprises a step 502, similar to previous step 308, during which processor 104 executes update instructions 402 to confirm the presence of a patch 116 in rewritable memory 110. If a patch 116 is found, step 502 is followed by a step 504 similar to step 309, commanding execution of located patch 116. It will be noted that these steps 502 and 504 are executed before possible execution of step 313. This second implementation method sacrifices a little flexibility for the sake of performance gains. In fact, it reduces execution time for program 114, because update instructions 402 are no longer executed for each virtual instruction in program 114.

By reference to figure 6, in a third implementation method of the invention, the code for virtual machine 112 comprises an interpretation loop 600, identical to that in figure 4, except that there is an operation code for which the associated translation consists only of update instructions, now referenced 602. The example illustrated in figure 6 shows the case where the first translation 212-1 comprises only update instructions 602, meaning that translated instructions are formed by update instructions 602. In this way, the language of virtual machine 113 comprises an operation dedicated to searching for and executing a patch, which can be placed at the desired points in program 114 when it is written. A patch point then only needs a single virtual instruction in program 114.

By reference to figure 7, we will now describe a process 700 for executing program 114 by virtual machine 113 having the code in figure 6.

Process 700 is identical to process 300 in figure 3, except that the patch search and execution steps 308 and 309 are not present.

In addition, in the case where the current virtual instruction comprises the operation code for the operation dedicated to searching for the patch, step 313 is replaced by an execution step 702 for real update instructions 602 to search for a patch, followed, if a patch is found, by a step 704 to call and execute the patch. The contents of these steps 702 and 704 are identical to those of steps 308 and 309.

This third implementation method enables the frequency of patch call executions to be reduced, for the purposes of efficiency, without restricting the positions of these calls.

In a fourth implementation method, patch 116 comprises a set of real instructions directly executable by processor 104 and is intended to be called during execution of program 114 by virtual machine 113. In this case, the execution step for the patch is performed directly by processor 104, meaning that processor 104 executes the real instruction in the patch in turn. Patch 116 is terminated by a real instruction notifying processor 104 either to resume execution of the virtual instruction following step 302, or, following the first variant mentioned above, to continue execution of the virtual instruction previously read at step 304 from operation selection step 310. It is noted that according to the second and third variants described above, real instructions in patch 116 can check and modify code marker 122 in virtual machine 112 as well as the operation code and operands determined at step 306. As has been shown in the previous description, the integration of update instructions, intended to look for and if necessary call a patch in rewritable memory 110, directly in native code of virtual machine 113 makes execution of program 114 by processor 104 faster, compared to including virtual update instructions in program 114. Although the previous description relates to application of the invention in the context of reprogrammable microprocessor cards such as Java Card type, this invention is applicable to any system in which it is difficult or impossible to make direct modifications to the initial content of the memory in which the program is located. In addition, the four previous implementation methods for update instructions can of course be combined into a single virtual machine code.

Claims

1. Execution process for a program (114) comprising so-called virtual instructions, executable by a virtual machine (113), each virtual instruction of the program (114) representing an action, of the type comprising: - for at least one virtual instruction of the program (114), called a corrected virtual instruction, to begin (304) executing a loop of instructions (300; 500; 700) of virtual machine code (112), called an interpretation loop, the interpretation loop (300; 500; 700) being designed to be executed in turn on the virtual instructions, the virtual instruction interpreted by the interpretation loop being called a current virtual instruction, complete execution of the interpretation loop enabling:

+ determination (306) of the action represented by the current virtual instruction;

+ selection (310) and execution (312) of a translation of the action, this translation comprising at least one so-called real instruction of virtual machine code (112), and being associated with the determined action;

+ selection of a subsequent virtual instruction on which the interpretation loop is intended to be executed; the process being characterised by:

- during execution of the interpretation loop for the corrected instruction, before restarting execution of the interpretation loop (300; 500; 700) for a new current instruction, searching (308; 502; 702) in a lookup table (118) for a patch

(116) associated with the corrected instruction, and commanding (309; 504; 704) execution of the patch (116).

2. - Process according to claim 1 , also characterised in that the patch (116) comprises virtual instructions and in that the command to execute the patch leads to execution of the interpretation loop on the patch (116).

3.- Process according to claim 1, also characterised in that the patch (116) comprises real instructions.

4.- Process according to any one of claims 1 to 3, also characterised in that for each current instruction, on which the interpretation loop is executed, it comprises searching (308) the lookup table (118) for a patch (116) associated with the current instruction.

5.- Process according to claim 4, also characterised in that the search (308) and command (309) to execute the patch (116) are carried out before the interpretation loop enables the translation associated with the determined action to be selected (310) and executed (312).

6.- Process according to any one of claims 1 to 3, also characterised in that the search (308) for a patch (116) is or is not performed depending on the determined action.

7.- Process according to claim 6, also characterised in that the search (502) and command (504) to execute the patch are carried out during execution (312) of the translation associated with the determined action.

8.- Process according to claim 7, also characterised in that execution (312) of the translation consists only of searching (702) and commanding (704) execution of the patch (116).

9. Virtual machine code comprising real instructions, which when executed by a processor (104) leads the processor (104) to execute a process according to one of the previous claims.

10.- Computer device of a type comprising: - a processor (104);

- a first memory (108) in which are stored:

+ a program (114) comprising so-called virtual instructions, executable by a virtual machine (113), each virtual instruction of the program representing an action; + a virtual machine code (112) comprising a loop of instructions (200;

400; 600), called an interpretation loop, intended to be executed by the processor (104) in turn on each virtual instruction of the program (114), the virtual instruction interpreted by the interpretation loop being called a current virtual instruction, the interpretation loop (200; 400; 600) comprising, in order of execution: * instructions (206) to determine the action of the current virtual instruction; ^* instructions (210) to select and command execution of a translation of the action, this translation comprising at least one real instruction (212-1...212-N) of virtual machine code (112), and being associated with the determined action; * instructions (214) to select a subsequent virtual instruction on which the interpretation loop is intended to be executed;

- a second memory (110) in which are stored:

+ at least one patch (116);

+ a lookup table (118) associating at least one virtual instruction for the program (114), so-called corrected virtual instruction, with each patch (116); this computer device being characterised in that:

- the virtual machine code (112) comprises instructions (208; 402; 602), called update instructions, intended to be executed by the processor (104) for the corrected virtual instructions, before restarting execution of the interpretation loop for a new current instruction, searching in the lookup table (118) for a patch (116) associated with the corrected program instruction, and commanding execution of the patch (116).

11.- Device according to claim 10, also characterised in that the first memory (108) comprises a non-rewritable memory.

12.- Device according to claim 11 , also characterised in that the second memory (110) is a rewritable memory.

13.- Device according to any one of the claims to 12, characterised in that the update instructions (208) are located, in the sequence of the interpretation loop (200), before instructions (210) to select and command execution of the translation associated with the determined action.

14.- Device according to any one of the claims to 12, characterised in that the update instructions (208) are located, in the sequence of the interpretation loop (200), after instructions (206) to determine the action represented by the current virtual instruction.

15.- Device according to claim 14, characterised in that the translation (212- 1) comprises update instructions (402; 602) to search for and call the patch.

16.- Device according to claim 15, characterised in that the translation (212- 1) consists only of update instructions (602) to search for and call the patch (116).