TOY II LINC LINC. !1 Introduction to Computer Science Sedgewick and Wayne Copyright 2007

Transcription

1 TOY II Introduction to Computer Science Sedgewick and Wayne Copyright LINC LINC 5 6

2 What We've Learned About TOY Quick Review: Multiply Data representation. Binary and hex. TOY. Box with switches and lights. 6-bit memory locations, 6-bit registers, 8-bit pc. 4,328 bits = (255 6) + (5 6) + (8) = 54 bytes von Neumann architecture. TOY instruction set architecture. 6 instruction types. TOY machine language programs. Variables, arithmetic, loops. loop A: 3 3 B: 9 9 C: inputs output D: constants E: : 8AA RA mem[a] a : 8BB RB mem[b] b 2: 8CD RC mem[d] c = 3: 8E R mem[e] always 4: CA8 if (RA == ) pc 8 while (a = ) { 5: CCB RC RC + RB c = c + b 6: 2AA RA RA - R a = a - 7: C4 pc 4 8: 9CC mem[c] RC 9: halt multiply.toy 8 9 What We Do Today Data representation. Negative numbers. Input and output. Standard input, standard output. Manipulate addresses. References (pointers) and arrays. TOY simulator in Java and implications. Data Representation

3 Digital World Adding and Subtracting Binary Numbers Data is a sequence of bits. (interpreted in different ways) Integers, real numbers, characters, strings, Documents, pictures, sounds, movies, Java programs, Ex. As binary integer: = 7 (base ten). As character: 7 th Unicode character = 'u'. As music: 7/256 position of speaker. As grayscale value: 45.7% black. Decimal and binary addition. But what about subtraction? Just add a negative integer. carries Q. OK, but how to represent negative integers? e.g., 6-4 = 6 + (-4)) 2 3 Representing Negative Integers Two's Complement Integers TOY words are 6 bits each. We could use 6 bits to represent to We want negative integers too. Reserving half the possible bit-patterns for negative seems fair. Highly desirable property. If x is an integer, then the representation of -x, when added to x, yields zero. -x: flip bits and add x +(-x) +???????? x + +(-x) + To compute -x from x: Start with x. +4 Flip bits. -5 Add one. -4 leading bit determines sign??? 4 5

4 Two's Complement Integers Properties of Two's Complement Integers Properties Leading bit (bit 5 in Toy) signifies sign. dec hex binary Addition and subtraction are easy FFF? represents zero. Negative integer -x represented by x. +4 4? Not symmetric: can represent -32,768 but not 32, FFFF????? Java. Java's int data type is a 32-bit two's complement integer. Ex equals FFFE? -3 FFFD? -4 FFFC? ? 6 7 Properties of Two's Complement Integers Representing Other Primitive Data Types in TOY Properties. Leading bit (bit 5 in Toy) signifies sign. Addition and subtraction are easy. represents zero. Negative integer -x represented by x. Not symmetric: can represent -32,768 but not 32,768. Java. Java's int data type is a 32-bit two's complement integer. Ex equals public class OhYesItDoes { public static void main(string[] args){ int x = ; System.out.println (x + ); > java OhYesItDoes Bigger integers. Use two 6-bit words per int. Real numbers. Use "floating point" (like scientific notation). Use four 6-bit words per double. Characters. Use ASCII code (8 bits / character). Pack two characters per 6-bit word. Note. Real microprocessors add hardware support for int and double. 8 2

5 Standard Output Standard Input and Output Standard output. Writing to memory location FF sends one word to TOY stdout. Ex. 9AFF writes the integer in register A to stdout. : : : 8A RA mem[] a = : 8B RB mem[] b = do { 2: 9AFF write RA to stdout print a 3: AAB RA RA + RB a = a + b 4: 2BAB RB RA - RB b = a - b 5: DA2 if (RA > ) goto 2 while (a > ) 6: halt 2 22 Standard output. Standard Output Writing to memory location FF sends one word to TOY stdout. Ex. 9AFF writes the integer in register A to stdout. : : : 8A RA mem[] a = : 8B RB mem[] b = do { 2: 9AFF write RA to stdout print a 3: AAB RA RA + RB a = a + b 4: 2BAB RB RA - RB b = a - b 5: DA2 if (RA > ) goto 2 while (a > ) 6: halt fibonacci.toy standard output D E DB 63D A8 55 A6D 2AC2 452F 6FF 24 Standard input. Standard Input Loading from memory address FF loads one word from TOY stdin. Ex. 8AFF reads an integer from stdin and store it in register A. Ex: read in a sequence of integers and print their sum. In Java, stop reading when EOF. In TOY, stop reading when user enters. while (StdIn.isEmpty()) { a = StdIn.readInt(); sum = sum + a; StdOut.println(sum); : : 8C RC <- mem[] : 8AFF read RA from stdin 2: CA5 if (RA == ) pc 5 3: CCA RC RC + RA 4: C pc 5: 9CFF write RC 6: halt AE 46 3 F7 25

6 Standard Input and Output: Implications Standard input and output enable you to: Put information from real world into machine. Pointers Get information out of machine. Process more information than fits in memory. Interact with the computer while it is running. Information can be instructions Booting a computer. Sending programs over the Internet Sending viruses over the Internet Load Address (a.k.a. Load Constant) Arrays in TOY Load address. [opcode 7] Loads an 8-bit integer into a register. 7A3 means load the value 3 into register A. Applications. Load a small constant into a register. Load an 8-bit memory address into a register. register stores "pointer" to a memory cell a = x3; Java code (NOTE hex literal) TOY main memory is a giant array. Can access memory cell 3 using load and store. 8C3 means load mem[3] into register C. Goal: access memory cell i where i is a variable. Load indirect. [opcode A] AC6 means load mem[r6] into register C. Store indirect. [opcode B] a variable index BC6 means store contents of register C into mem[r6]. a variable index D TOY memory ? 7 6 A opcode dest d addr 28 29

7 Example: Reverse an array TOY Implementation of Reverse TOY implementation of reverse. Read in a sequence of integers and store in memory 3, 3, 32, Stop reading if. Print sequence in reverse order. Java version: int n = ; while (StdIn.isEmpty()) { a[n] = StdIn.readInt(); n++; while (n > ) { n--; StdOut.println(a[n]); TOY implementation of reverse. Read in a sequence of integers and store in memory 3, 3, 32, Stop reading if. Print sequence in reverse order. : 7 R constant : 7A3 RA 3 a[] 2: 7B RB n while(true) { 3: 8CFF read RC c = StdIn.readInt(); 4: CC9 if (RC == ) goto 9 if (c == ) 5: 6AB R6 RA + RB memory address of a[n] 6: BC6 mem[r6] RC a[n] = c; 7: BB RB RB + R n++; 8: C3 goto 3 read in the data (We ll just assume a[] is big enough) 3 3 TOY Implementation of Reverse Unsafe Code at any Speed TOY implementation of reverse. Read in a sequence of integers and store in memory 3, 3, 32, Stop reading if. Print sequence in reverse order. : 7 R constant : 7A3 RA 3 a[] 2: 7B RB n while(true) { 9: CB2 if (RB == ) goto 2 if (n == ) A: 6AB R6 RA + RB memory address of a[n] B: 266 R6 R6 - R n--; C: AC6 RC mem[r6] c = a[n]; D: 9CFF write RC StdOut.print(c); E: 2BB RB RB - R n--; F: C9 goto 9 Q. What happens if we make array start at instead of 3? : 7 R constant : 7A RA a[] 2: 7B RB n while(true) { 3: 8CFF read RC c = StdIn.readInt(); 4: CC9 if (RC == ) goto 9 if (c == ) 5: 6AB R6 RA + RB address of a[n] 6: BC6 mem[r6] RC a[n] = c; 7: BB RB RB + R n++; 8: C3 goto 3 % more crazy8.txt FF C print in reverse order 32 33

8 Unsafe Code at any Speed Unsafe Code at any Speed : 8: : 9: 2: A: 3: B: 4: C: 5: D: 6: E: 7: F: standard input FF C : 7 R constant : 7A RA a[] 2: 7B RB n while(true) { 3: 8CFF read RC c = StdIn.readInt(); 4: CC9 if (RC == ) goto 9 if (c == ) 5: 6AB R6 RA + RB address of a[n] 6: BC6 mem[r6] RC a[n] = c; 7: BB RB RB + R n++; 8: C3 goto 3 : 8: : 9: 2: A: 3: B: 4: C: 5: D: 6: E: 7: F: standard input FF C Machine is Owned : 8888 : 88 R8 mem[] while (true) { x = 8888; 2: 98FF write R8 writeln(x); 3: C goto 4: CC9 if (RC == ) goto 9 if (c == ) 5: 6AB R6 RA + RB address of a[n] 6: BC6 mem[r6] RC a[n] = c; 7: BB RB RB + R n++; 8: C3 goto What Can Happen When We Lose Control (in C or C++)? Buffer Overflow Attacks Buffer overflow. Array buffer[] has size. User might enter 2 characters. Might lose control of machine behavior. Consequences. Viruses and worms. Java enforces security. Type safety. Array bounds checking. Not foolproof. #include <stdio.h> int main(void) { char buffer[]; scanf("%s", buffer); printf("%s\n", buffer); return ; unsafe C program Stuxnet worm. [July 2] Step. Natanz centrifuge fuel-refining plant employee plugs in USB flash drive. Step 2. Data becomes code by exploiting Windows buffer overflow; machine is wned. Step 3. Uranium enrichment in Iran stalled. More buffer overflow attacks: Morris worm, Code Red, SQL Slammer, iphone unlocking, Xbox softmod, JPEG of death [24],... Lesson. Not easy to write error-free software. Embrace Java security features. shine 5W bulb at DRAM [Appel-Govindavajhala '3] 59 Keep your OS patched. 6

9 Dumping Booting Q. Work all day to develop operating system. How to save it? A. Write short program dump.toy and run it to dump contents of memory onto tape. Q. How do you get it back? A. Write short program boot.toy and run it to read contents of memory from tape. : 7 R : 72 R2 i = 2: 73FF R3 FF do { 3: AA2 RA mem[r2] a = mem[i] 4: 9AFF write RA print a 5: 22 R2 R2 + R i++ 6: 2432 R4 R3 - R2 7: D43 if (R4 > ) goto 3 while (i < 255) 8: halt : 7 R : 72 R2 i = 2: 73FF R3 FF do { 3: 8AFF read RA read a 4: BA2 mem[r2] RA mem[i] = a 5: 22 R2 R2 + R i++ 6: 2432 R4 R3 - R2 7: D43 if (R4 > ) goto 3 while (i < 255) 8: halt dump.toy boot.toy 6 62 TOY Simulator Simulating the TOY machine Goal. Write a program to "simulate" the behavior of the TOY machine. TOY simulator in Java. public class TOY { public static void main(string[] args) { int pc = x; // program counter int[] R = new int[6]; // registers int[] mem = new int[256]; // main memory // READ.toy FILE into mem[] while (true) { int inst = mem[pc++]; // fetch, increment // DECODE // EXECUTE % more add-stdin.toy : 8C TOY program : 8AFF 2: CA5 3: CCA 4: C 5: 9CFF 6: % java TOY add-stdin.toy AE standard input 46 3 F7 standard output 63 64

10 TOY Simulator: Decode TOY Simulator: Execute Ex. Extract destination register of CAB by shifting and masking. 6 C 6 A 6 B C F C 6 int inst = mem[pc++]; // fetch and increment int op = (inst >> 2) & 5; // opcode (bits 2-5) int d = (inst >> 8) & 5; // dest d (bits 8-) int s = (inst >> 4) & 5; // source s (bits 4-7) int t = (inst >> ) & 5; // source t (bits -3) int addr = (inst >> ) & 255; // addr (bits -7) inst inst >> 8 5 (inst >> 8) & 5 if (op == ) // halt switch (op) { case : R[d] = R[s] + R[t]; case 2: R[d] = R[s] - R[t]; case 3: R[d] = R[s] & R[t]; case 4: R[d] = R[s] ^ R[t]; case 5: R[d] = R[s] << R[t]; case 6: R[d] = R[s] >> R[t]; case 7: R[d] = addr; case 8: R[d] = mem[addr]; case 9: mem[addr] = R[d]; case : R[d] = mem[r[t]]; case : mem[r[t]] = R[d]; case 2: if (R[d] == ) pc = addr; case 3: if (R[d] > ) pc = addr; case 4: pc = R[d]; case 5: R[d] = pc; pc = addr; TOY Simulator: Omitted Details Simulation Omitted details. Register is always. reset R[]= after each fetch-execute step Standard input and output. if addr is FF and opcode is load (indirect) then read in data if addr is FF and opcode is store (indirect) then write out data TOY registers are 6-bit integers; program counter is 8-bit. Java int is 32-bit; Java short is 6-bit use casts and bit-whacking Complete implementation. See TOY.java on booksite. Building a new computer? Need a plan for old software. Two possible approaches Rewrite software (costly, error-prone, boring, and time-consuming). Simulate old computer on new computer. Ancient programs still running on modern computers. Payroll Power plants Air traffic control Ticketron. Games. Lode Runner Apple IIe Mac OS X Apple IIe emulator widget running Lode Runner 67 7