TOY Machine: Understanding Two's Complement and Memory Operations, Slides of Data Representation and Algorithm Design

Download TOY Machine: Understanding Two's Complement and Memory Operations and more Slides Data Representation and Algorithm Design in PDF only on Docsity! TOY II 7 What We've Learned About TOY Data representation. Binary and hex. TOY.   Box with switches and lights.   16-bit memory locations, 16-bit registers, 8-bit pc.   4,328 bits = (255 × 16) + (15 × 16) + (8) = 541 bytes!   von Neumann architecture. TOY instruction set architecture. 16 instruction types. TOY machine language programs. Variables, arithmetic, loops. 8 What We Do Today Data representation. Negative numbers. Input and output. Standard input, standard output. Manipulate addresses. References (pointers) and arrays. TOY simulator in Java. 9 Negative Numbers docsity.com 10 How to add and subtract binary numbers Binary addition facts:   0 + 0 = 0   0 + 1 = 1 + 0 = 1   1 + 1 = 10   1 + 1 + 1 = 11 (needed for carries) Bigger numbers example: 1 1 1 013 0 0 0 0 1 1 0 1 + 092 + 0 1 0 1 1 1 0 0 105 0 1 1 0 1 0 0 1 OK, but: subtract?   Subtract by adding a negative integer (e.g., 6 - 4 = 6 + (-4))   OK, but: negative integers? carries 11 Representing Negative Integers TOY words are 16 bits each.   We could use 16 bits to represent 0 to 216 - 1.   We want negative integers too.   Reserving half the possible bit-patterns for negative seems fair. Highly desirable property. If x is an integer, then the representation of -x, when added to x, is zero. x 0 0 1 1 0 1 0 0 +(-x) + ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 x 0 0 1 1 0 1 0 0 + 1 1 0 0 1 0 1 1 +(-x) 1 1 1 1 1 1 1 1 + 1 0 0 0 0 0 0 0 0 0 flip bits and add 1 12 “Two's Complement” Integers Properties:   Leading bit (bit 15) signifies sign.   Negative integer -N represented by 216 - N.   Trick to compute -N: 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 1 0 +4 13 12 11 10 15 14 7 6 9 8 6 4 1 0 3 2 5 1. Start with N. 1 1 1 1 1 1 1 ? 1 1 1 1 1 1 1 0 1 2. Flip bits. 1 1 1 1 1 1 1 ? 1 1 1 1 0 0 1 1 1 -4 3. Add 1. 13 Two's Complement Integers 1 1 1 1 0 1 1 ? 1 1 1 1 1 1 1 1 1 13 12 11 10 15 14 7 9 8 6 4 1 0 3 2 5 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 ? 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 ? 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 ? 1 1 1 1 1 0 1 1 1 1 1 1 1 1 1 1 ? 1 1 1 1 0 1 1 1 1 1 1 1 1 1 1 1 ? 1 1 1 1 0 0 1 1 1 0 0 0 0 1 0 0 ? 0 0 0 0 0 0 0 0 0 7FFF 0004 0003 0002 0001 0000 FFFF FFFE FFFD FFFC 8000 +32767 +4 +3 +2 +1 +0 -1 -2 -3 -4 -32768 hex dec binary docsity.com 24 Pointers 25 addr Load Address (a.k.a. Load Constant) Load address. [opcode 7]   Loads an 8-bit integer into a register.   7A30 means load the value 30 into register A. Applications.   Load a small constant into a register.   Load a 8-bit memory address into a register. 1 13 1 12 1 11 0 10 0 15 1 14 0 7 ? 6 1 9 0 8 0 6 1 4 0 1 0 0 0 3 0 2 1 5 716 A16 316 016 opcode dest d a = 0x30; Java code register stores "pointer" to a memory cell 26 Arrays in TOY TOY main memory is a giant array.   Can access memory cell 30 using load and store.   8C30 means load mem[30] into register C.   Goal: access memory cell i where i is a variable. Load indirect. [opcode A]   AC06 means load mem[R6] into register C. Store indirect. [opcode B]   BC06 means store contents of register C into mem[R6]. for (int i = 0; i < N; i++) a[i] = StdIn.readInt(); for (int i = 0; i < N; i++) StdOut.println(a[N-i-1]); a variable index a variable index 30 31 32 33 34 35 36 37 … … 0000 0001 0001 0002 0003 0005 0008 000D … … TOY memory 27 TOY Implementation of Reverse TOY implementation of reverse.   Read in a sequence of integers and store in memory 30, 31, 32, …   Stop reading if 0000.   Print sequence in reverse order. 10: 7101 R1 ← 0001 constant 1 11: 7A30 RA ← 0030 a[] 12: 7B00 RB ← 0000 n while(true) { 13: 8CFF read RC c = StdIn.readInt(); 14: CC19 if (RC == 0) goto 19 if (c == 0) break; 15: 16AB R6 ← RA + RB memory address of a[n] 16: BC06 mem[R6] ← RC a[n] = c; 17: 1BB1 RB ← RB + R1 n++; 18: C013 goto 13 } read in the data docsity.com 28 TOY Implementation of Reverse TOY implementation of reverse.   Read in a sequence of integers and store in memory 30, 31, 32, …   Stop reading if 0000.   Print sequence in reverse order. 19: CB20 if (RB == 0) goto 20 while (n > 0) { 1A: 16AB R6 ← RA + RB address of a[n] 1B: 2661 R6 ← R6 – R1 address of a[n-1] 1C: AC06 RC ← mem[R6] c = a[n-1]; 1D: 9CFF write RC StdOut.println(c); 1E: 2BB1 RB ← RB – R1 n--; 1F: C019 goto 19 } 20: 0000 halt print in reverse order 29 Unsafe Code at Any Speed Q. What happens if we make array start at 00 instead of 30? A. Self modifying program; can overflow buffer and run arbitrary code! 10: 7101 R1 ← 0001 constant 1 11: 7A00 RA ← 0000 a[] 12: 7B00 RB ← 0000 n while(true) { 13: 8CFF read RC c = StdIn.readInt(); 14: CC19 if (RC == 0) goto 19 if (c == 0) break; 15: 16AB R6 ← RA + RB address of a[n] 16: BC06 mem[R6] ← RC a[n] = c; 17: 1BB1 RB ← RB + R1 n++; 18: C013 goto 13 } % more crazy8.txt 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 8888 8810 98FF C011 30 Buffer overrun.   Array buffer[] has size 100.   User might enter 200 characters.   Might lose control of machine behavior. Consequences. Viruses and worms. Java enforces security.   Type safety.   Array bounds checking.   Not foolproof. What Can Happen When We Lose Control (in C or C++)? #include <stdio.h> int main(void) { char buffer[100]; scanf("%s", buffer); printf("%s\n", buffer); return 0; } unsafe C program shine 50W bulb at DRAM [Appel-Govindavajhala '03] 31 Buffer Overrun Example: JPEG of Death Microsoft Windows JPEG bug. [September, 2004]   Step 1. User views malicious JPEG in IE or Outlook.   Step 2. Machine is 0wned.   Data becomes code by exploiting buffer overrun in GDI+ library. Fix. Update old library with patched one. Moral.   Not easy to write error-free software.   Embrace Java security features.   Don't try to maintain several copies of the same file.   Keep your OS patched. but many applications install independent copies of GDI library docsity.com 32 Q. Work all day to develop operating system. How to save it? A. Write short program dump.toy and run it to dump contents of memory onto tape. Dumping 00: 7101 R1 ← 0001 01: 7210 R2 ← 0010 i = 10 02: 73FF R3 ← 00FF do { 03: AA02 RA ← mem[R2] a = mem[i] 04: 9AFF write RA print a 05: 1221 R2 ← R2 + R1 i++ 06: 2432 R4 ← R3 - R2 07: D403 if (R4 > 0) goto 03 } while (i < 255) 08: 0000 halt dump.toy 33 Q. How do you get it back? A. Write short program boot.toy and run it to read contents of memory from tape. Booting 00: 7101 R1 ← 0001 01: 7210 R2 ← 0010 i = 10 02: 73FF R3 ← 00FF do { 03: 8AFF read RA read a 04: BA02 mem[R2] ← RA mem[i] = a 05: 1221 R2 ← R2 + R1 i++ 06: 2432 R4 ← R3 - R2 07: D403 if (R4 > 0) goto 03 } while (i < 255) 08: 0000 halt boot.toy 34 TOY Simulator 35 TOY Simulator Goal. Write a program to "simulate" the behavior of the TOY machine.   TOY simulator in Java. public class TOY { public static void main(String[] args) { int pc = 0x10; // program counter int[] R = new int[16]; // registers int[] mem = new int[256]; // main memory // READ IN .toy FILE while (true) { // FETCH INSTRUCTION and DECODE ... // EXECUTE ... } } } % java TOY add-stdin.toy A012 002B A03D docsity.com