12/11/ The TOY Machine II. Data Representation. What We've Learned About TOY. What We Do Today. Adding and Subtracting Binary Numbers

Transcription

1 // What We've Learned About TOY. The TOY Machine II TOY machine. Box with switches and lights. 6-bit memory locations, 6-bit registers, 8-bit pc. 4,38 bits = ( 6) + ( 6) + (8) = 4 bytes! von Neumann architecture. TOY programming. TOY instruction set architecture: 6 instruction types. Variables, arithmetic, loops. Laboratory Instrument Computer (LINC) Introduction to Computer Science: An Interdisciplinary Approach Robert Sedgewick and Kevin Wayne Copyright // :9:46 What We Do Today Data representation. Negative numbers. Data Representation Input and output. Standard input, standard output. Manipulate addresses. References (pointers) and arrays. TOY simulator in Java. 3 4 Digital World Adding and Subtracting Binary Numbers Data is a sequence of bits. (interpreted in different ways) Integers, real numbers, characters, strings, Documents, pictures, sounds, movies, Java programs, Decimal and binary addition. carries Ex. As binary integer: = 7. As character: 7 th Unicode character = 'u'. As music: 7/6 position of speaker. As grayscale value: 4.7% black Subtraction. Add a negative integer. e.g., 6-4 = 6 + (-4)) Q. How to represent negative integers? 6

2 // Representing Negative Integers Two's Complement Integers TOY words are 6 bits each. We could use 6 bits to represent to 6 -. We want negative integers too. Reserving half the possible bit-patterns for negative seems fair. Highly desirable property. If x is an integer, then the representation of -x, when added to x, is zero. To compute -x from x: Start with x. leading bit +4 Flip bits.? -? x +(-x) +???????? Add one. -4? flip bits and add x + +(-x) Two's Complement Integers Properties of Two's Complement Integers Properties Leading bit (bit ) signifies sign. dec hex binary Addition and subtraction are easy FFF? represents zero. Checking for arithmetic overflow is easy ?? Negative integer -x represented by 6 - x. Not symmetric: can represent -3,768 but not 3,768. +? FFFF??? Java. Java's int data type is a 3-bit two's complement integer. Ex equals FFFE? -3 FFFD? -4 FFFC? ? 9 Representing Other Primitive Data Types in TOY Bigger integers. Use two 6-bit TOY words per 3-bit Java int. Standard Input and Output Real numbers. Use IEEE floating point (like scientific notation). Use four 6-bit TOY words per 64-bit Java double. Characters. Use one 6-bit TOY word per 6-bit Java Unicode char. M = = 4D 6 O = = 4F 6 M = = 4D 6 Note. Real microprocessors add hardware support for int and double.

3 // Standard Output Standard Input Standard output. Writing to memory location FF sends one word to TOY stdout. Ex. 9AFF writes the integer in register A to stdout. : : : 8A RA mem[] a = : 8B RB mem[] b = : 9AFF write RA to stdout print a 3: AAB RA RA + RB a = a + b 4: BAB RB RA - RB b = a - b : DA if (RA > ) goto } while (a > ) 6: halt fibonacci.toy 3 8 D E DB 63D A8 A6D AC 4F 6FF Standard input. Loading from memory address FF loads one word from TOY stdin. Ex. 8AFF reads an integer from stdin and store it in register A. Ex: read in a sequence of integers and print their sum. In Java, stop reading when EOF. In TOY, stop reading when user enters. while (!StdIn.isEmpty()) { a = StdIn.readInt(); sum = sum + a; } StdOut.println(sum); : : 8C RC <- mem[] : 8AFF read RA from stdin : CA if (RA == ) pc 3: CCA RC RC + RA 4: C pc : 9CFF write RC 6: halt AE 46 3 F7 3 4 Standard Input and Output: Implications Standard input and output enable you to: Get information out of machine. Put information from real world into machine. Process more information than fits in memory. Interact with the computer while it is running. Pointers redirected from punchcard by default: flip switch, press button by default: LED redirected to punchcard 6 Load Address (a.k.a. Load Constant) Arrays in TOY Load address. [opcode 7] Loads an 8-bit integer into a register. 7A3 means load the value 3 into register A. Applications. Load a small constant into a register. Load a 8-bit memory address into a register. register stores "pointer" to a memory cell a = x3; Java code TOY main memory is a giant array. Can access memory cell 3 using load and store. 8C3 means load mem[3] into register C. Goal: access memory cell i where i is a variable. a variable index Load indirect. [opcode A] AC6 means load mem[r6] into register C D TOY memory Store indirect. [opcode B] BC6 means store contents of register C into mem[r6]. a variable index ? for (int i = ; i < N; i++) a[i] = StdIn.readInt(); 7 6 A opcode dest d addr for (int i = ; i < N; i++) StdOut.println(a[N-i-]); 7 8 3

4 // TOY Implementation of Reverse TOY Implementation of Reverse TOY implementation of reverse. Read in a sequence of integers and store in memory 3, 3, 3, until reading. Print sequence in reverse order. TOY implementation of reverse. Read in a sequence of integers and store in memory 3, 3, 3, until reading. Print sequence in reverse order. : 7 R constant : 7A3 RA 3 a[] : 7B RB n while(true) { 3: 8CFF read RC c = StdIn.readInt(); 4: CC9 if (RC == ) goto 9 if (c == ) break; : 6AB R6 RA + RB memory address of a[n] 6: BC6 mem[r6] RC a[n] = c; 7: BB RB RB + R n++; 8: C3 goto 3 } 9: CB if (RB == ) goto while (n > ) { A: 6AB R6 RA + RB address of a[n] B: 66 R6 R6 R address of a[n-] C: AC6 RC mem[r6] c = a[n-]; D: 9CFF write RC StdOut.println(c); E: BB RB RB R n--; F: C9 goto 9 } : halt print in reverse order read in the data 9 Unsafe Code at any Speed What Can Happen When We Lose Control (in C or C++)? Q. What happens if we make array start at instead of 3? A. Self modifying program; can overflow buffer and run arbitrary code! : 7 R constant : 7A RA a[] : 7B RB n Buffer overflow. Array buffer[] has size. User might enter characters. Might lose control of machine behavior. Consequences. Viruses and worms. #include <stdio.h> int main(void) { char buffer[]; scanf("%s", buffer); printf("%s\n", buffer); return ; } unsafe C program while(true) { 3: 8CFF read RC c = StdIn.readInt(); 4: CC9 if (RC == ) goto 9 if (c == ) break; : 6AB R6 RA + RB address of a[n] 6: BC6 mem[r6] RC a[n] = c; 7: BB RB RB + R n++; 8: C3 goto 3 } % more crazy8.txt FF C Java enforces security. Type safety. Array bounds checking. Not foolproof. shine W bulb at DRAM [Appel-Govindavajhala '3] Buffer Overflow Attacks Buffer Overflow Example: JPEG of Death Stuxnet worm. [July ] Step. Natanz centrifuge fuel-refining plant employee plugs in USB flash drive. Step. Data becomes code by exploiting Window buffer overflow; machine is wned. Step 3. Uranium enrichment in Iran stalled. Microsoft Windows JPEG bug. [September, 4] Step. User views malicious JPEG in IE or Outlook. Step. Machine is wned. Data becomes code by exploiting buffer overrun in GDI+ library. More buffer overflow attacks: Morris worm, Code Red, SQL Slammer, iphone unlocking, Xbox softmod, JPEG of death, Fix. Update old library with patched one. but many applications install independent copies of GDI library Lesson. Not easy to write error-free software. Embrace Java security features. Keep your OS patched. Moral. Not easy to write error-free software. Embrace Java security features. Don't try to maintain several copies of the same file. Keep your OS patched

5 // Dumping Booting Q. Work all day to develop operating system in mem[] to mem[ff]. How to save it? A. Write short program dump.toy and run it to dump contents of memory onto tape. Q. How do you get it back? A. Write short program boot.toy and run it to read contents of mem[] to mem[ff] from tape. : 7 R : 7 R i = : 73FF R3 FF 3: AA RA mem[r] a = mem[i] 4: 9AFF write RA print a : R R + R i++ 6: 43 R4 R3 - R 7: D43 if (R4 > ) goto 3 } while (i < ) 8: halt : 7 R : 7 R i = : 73FF R3 FF 3: 8AFF read RA read a 4: BA mem[r] RA mem[i] = a : R R + R i++ 6: 43 R4 R3 - R 7: D43 if (R4 > ) goto 3 } while (i < ) 8: halt dump.toy boot.toy 6 Two's Complement Arithmetic Extra Slides Addition is carried out as if all integers were positive. It usually works. -3? + 4? =? 4 4 Two's Complement Arithmetic Java and TOY Addition is carried out as if all integers were positive. It usually works. But overflow can occur. Correspondence between Java constructs and TOY mechanisms. Java TOY carry into sign (left most) bit with no carry out or carry out out of sign bit with no carry in assignment load, store +3,767? arithmetic expressions logical expressions add, subtract xor, and, shifts + loops (for, while) jump absolute, branch branches (if-else, switch) branch if zero, positive? arrays, linked lists indirect addressing = function call recursion jump and link, jump indirect implement stack with arrays -3,767? whitespace no-op