! Binary and hex. ! Box with switches and lights. ! 4,328 bits = (255 " 16) + (15 " 16) + (8) = 541 bytes! ! von Neumann architecture.

Transcription

1 What We've Learned About TOY TOY II Data representation. Binary and hex. TOY: what's in it, how to use it. Box with switches and lights. 4,328 bits = (255 " 6) + (5 " 6) + (8) = 54 bytes von Neumann architecture. TOY instruction set architecture. 6 instruction types. Sample TOY machine language programs. Arithmetic. Loops. LINC Introduction to Computer Science Robert Sedgewick and Kevin Wayne 2 What We Do Today Standard Output Standard input, standard output. Manipulate addresses. References (pointers). Arrays. TOY simulator in Java. Standard output. Writing to memory location FF sends one word to TOY stdout. 9AFF writes the integer in register A to stdout. : : : 8A RA mem[] a = : 8B RB mem[] b = while(a > ) { 2: 9AFF print RA print a 3: AAB RA RA + RB a = a + b 4: 2BAB RB RA - RB b = a - b 5: DA2 if (RA > ) goto 2 6: halt fibonacci.toy D E DB 63D A8 55 A6D 2AC2 452F 6FF 3 4

2 Fibonacci Numbers Standard Input Fibonacci sequence:,,, 2, 3, 5, 8, 3, 2, 34,... Standard input. Loading from memory address FF loads one word from TOY stdin. 8AFF reads in an integer from stdin and store it in register A. # % Fn = $ % & if n = if n = Fn" + Fn"2 otherwise Ex: read in a sequence of integers and print their sum. In Java, stop reading when EOF. In TOY, stop reading when user enters. while(stdin.isempty()) { a = StdIn.readInt(); sum = sum + a; System.out.println(sum); Pinecone : : : 2: 3: 4: 5: 6: RC <- mem[] read RA if (RA == ) pc RC RC + RA pc write RC halt 8C 8AFF CA5 CCA C 9CFF Cauliflower 5 AE 46 3 F7 5 6 Standard Input and Output: Implications Load Address (a.k.a. Load Constant) Standard input and output enable you to: Put information from real world into machine. Get information out of machine. Process more information than fits in memory. Interact with the computer while it is running. Load address. (opcode 7) Loads an 8-bit integer into a register. 7A3 means load the value 3 into register A. Applications. Load a small constant into a register. Load a 8-bit memory address into a register. register stores "pointer" to a memory cell a = 3; Java code Information can be instructions Booting a computer. Sending programs over the Internet. Sending viruses over the Internet ? 76 A6 opcode dest d 36 6 addr 8

3 Arrays in TOY TOY Implementation of Reverse TOY main memory is a giant array. Can access memory cell 3 using load and store. 8C3 means load mem[3] into register C. Goal: access memory cell i where i is a variable. Store indirect. (opcode A) AC6 means store contents of register C into mem[r6]. Load indirect. (opcode B) a variable index BC6 means load mem[r6] into register C. for (int i = ; i < N; i++) a[i] = StdIn.readInt(); for (int i = ; i < N; i++) System.out.println(a[N-i-]); a variable index TOY implementation of reverse. Read in a sequence of integers and store in memory 3, 3, 32, Stop reading if. Print sequence in reverse order. : 7 R constant : 7A3 RA 3 a[] 2: 7B RB n while(true) { 3: 8CFF read RC c = StdIn.readInt(); 4: CC9 if (RC == ) goto 9 if (c == ) 5: 6AB R6 RA + RB address of a[n] 6: BC6 mem[r6] RC a[n] = c; 7: BB RB RB + R n++; 8: C3 goto 3 read in the data Reverse.java 9 TOY Implementation of Reverse Unsafe Code at any Speed TOY implementation of reverse. Read in a sequence of integers and store in memory 3, 3, 32, Stop reading if. Print sequence in reverse order. What happens if we make array start at instead of 3? Self modifying program. Exploit buffer overrun and run arbitrary code 9: CB2 if (RB == ) goto 2 while (n > ) { A: 6AB R6 RA + RB address of a[n] B: 266 R6 R6 R address of a[n-] C: AC6 RC mem[r6] c = a[n-]; D: 9CFF write RC System.out.println(c); E: 2BB RB RB R n--; F: C9 goto 9 2: halt print in reverse order : 7 R constant : 7A RA a[] 2: 7B RB n while(true) { 3: 8CFF read RC c = StdIn.readInt(); 4: CC9 if (RC == ) goto 9 if (c == ) 5: 6AB R6 RA + RB address of a[n] 6: BC6 mem[r6] RC a[n] = c; 7: BB RB RB + R n++; 8: C3 goto 3 Crazy 8s Input FF C 2

4 What Can Happen When We Lose Control (in C or C++)? Dumping Buffer overflow. Array buffer[] has size. User might enter 2 characters. Might lose control of machine behavior. Majority of viruses and worms caused by similar errors. #include <stdio.h> int main(void) { char buffer[]; scanf("%s", buffer); printf("%s\n", buffer); return ; unsafe C program Dumping. Work all day to develop operating system. How do you save it for tomorrow? leave computer on? write short program dump.toy run dump.toy to dump contents of memory onto tape Robert Morris Internet Worm. Cornell grad student injected worm into Internet in 988. Exploited buffer overrun in finger daemon fingerd. Java enforces security. Type safety. Array bounds checking. Not foolproof. (Appel '3: shine 5W bulb at DRAM.) : 7 R : 72 R2 i = 2: 73FF R3 FF do { 3: AA2 RA mem[r2] a = mem[i] 4: 9AFF write RA print a 5: 22 R2 R2 + R i++ 6: 2432 R4 R3 - R2 7: D43 if (R4 > ) goto 3 while (i < 255) 8: halt 3 dump.toy 5 Booting TOY Simulator Booting. How do you get it back? Turn on computer, old memory values gone. Write short program boot.toy. Read contents of memory from tape by running boot.toy. Use original program. : 7 R : 72 R2 i = 2: 73FF R3 FF do { 3: 8AFF read RA read a 4: BA2 mem[r2] RA mem[i] = a 5: 22 R2 R2 + R i++ 6: 2432 R4 R3 - R2 7: D43 if (R4 > ) goto 3 while (i < 255) 8: halt boot.toy 6 Write a program to "simulate" the behavior of the TOY machine. TOY simulator in Java. TOY simulator in TOY public class TOY { public static void main(string[] args) { int pc = x; // program counter int[] R = new int[6]; // registers int[] mem = new int[256]; // main memory // READ IN.toy FILE while(true) { // FETCH INSTRUCTION and DECODE... // EXECUTE... % java TOY add-stdin.toy A2 2B A3D 7

5 TOY Simulator: Fetch TOY Simulator: Execute Extract destination register of CAB by shifting and masking. if (op == ) // halt 6 C 6 A 6 B C F C 6 int inst = mem[pc++]; // fetch and increment int op = (inst >> 2) & 5; // opcode (bits 2-5) int d = (inst >> 8) & 5; // dest d (bits 8-) int s = (inst >> 4) & 5; // source s (bits 4-7) int t = (inst >> ) & 5; // source t (bits -3) int addr = (inst >> ) & 255; // addr (bits -7) inst inst >> 8 5 (inst >> 8) & 5 switch (op) { case : R[d] = R[s] + R[t]; case 2: R[d] = R[s] - R[t]; case 3: R[d] = R[s] & R[t]; case 4: R[d] = R[s] ^ R[t]; case 5: R[d] = R[s] << R[t]; case 6: R[d] = R[s] >> R[t]; case 7: R[d] = addr; case 8: R[d] = mem[addr]; case 9: mem[addr] = R[d]; case : R[d] = mem[r[t]]; case : mem[r[t]] = R[d]; case 2: if (R[d] == ) pc = addr; case 3: if (R[d] > ) pc = addr; case 4: pc = R[d]; case 5: R[d] = pc; pc = addr; 8 9 TOY Simulator: Missing Details Simulation See TOY.java for full details. Register is always. reset R[]= after each fetch-execute step Standard input and output. if addr is FF and opcode is load (indirect) then read in data if addr is FF and opcode is store (indirect) then write out data Consequences of simulation. Test out new machine or microprocessor using simulator. cheaper and faster than building actual machine Easy to add new functionality to simulator. trace, single-step, breakpoint debugging simulator more useful than TOY itself Reuse software from old machines. TOY registers are 6-bit integers; program counter is 8-bit. Java int is 32 bits use casts and bit-whacking Ancient programs still running on modern computers. Ticketron. Lode Runner on Apple IIe. 2 2

6 Backwards Compatibility Backwards Compatibility Q. Why is standard US rail gauge 4 feet, 8.5 inches? Q. Why is Space Shuttle SRB long and narrow? Simulation and Backwards Compatibility Napoleon's march on Russia. Progress slower than expected. Eastern European ruts didn't match Roman gauge. Stuck in the field during Russian winter instead of Moscow. Lost war. Simulation tradeoff: Simulation essential to reuse old software. Maintaining backward compatibility can lead to inelegance and inefficiency. Simulation needed to conquer world. 27