diff --git a/20210615/Buegeln.pdf b/20210615/Buegeln.pdf new file mode 120000 index 0000000000000000000000000000000000000000..2815ea3ab388d141c6e5f73cd46739f223db8dfc --- /dev/null +++ b/20210615/Buegeln.pdf @@ -0,0 +1 @@ +../common/Buegeln.pdf \ No newline at end of file diff --git a/20210615/Trommeltrocknen.pdf b/20210615/Trommeltrocknen.pdf new file mode 120000 index 0000000000000000000000000000000000000000..93e2ad1f81820d422de2faf653a919dcdb99ca82 --- /dev/null +++ b/20210615/Trommeltrocknen.pdf @@ -0,0 +1 @@ +../common/Trommeltrocknen.pdf \ No newline at end of file diff --git a/20210615/Waschen_30.pdf b/20210615/Waschen_30.pdf new file mode 120000 index 0000000000000000000000000000000000000000..ca128204612c7f88c965b7ee5a0aae68075b9ebf --- /dev/null +++ b/20210615/Waschen_30.pdf @@ -0,0 +1 @@ +../common/Waschen_30.pdf \ No newline at end of file diff --git a/20210615/exploit-2.c b/20210615/exploit-2.c new file mode 100644 index 0000000000000000000000000000000000000000..b13098c5033a54a22cb64bee9005d78a3d860b5d --- /dev/null +++ b/20210615/exploit-2.c @@ -0,0 +1,11 @@ +#include <stdio.h> +#include <stdint.h> + +int main (int argc, char **argv) +{ + char loop[8]; + uint64_t *loop_int = (uint64_t *) loop; + *loop_int = 0x555555555185; + printf ("Prof. Dr. rer. nat. Dipl.-Phys. Peter Ge%s\n", loop); + return 0; +} diff --git a/20210615/exploit-2.txt b/20210615/exploit-2.txt new file mode 100644 index 0000000000000000000000000000000000000000..4d483e9466c1d051bb64e04d7891d3e7dfd48d49 --- /dev/null +++ b/20210615/exploit-2.txt @@ -0,0 +1 @@ +Prof. Dr. rer. nat. Dipl.-Phys. Peter Ge�QUUUU diff --git a/20210615/logo-hochschule-bochum-cvh-text-v2.pdf b/20210615/logo-hochschule-bochum-cvh-text-v2.pdf new file mode 120000 index 0000000000000000000000000000000000000000..4aa99b8f81061aca6dcaf43eed2d9efef40555f8 --- /dev/null +++ b/20210615/logo-hochschule-bochum-cvh-text-v2.pdf @@ -0,0 +1 @@ +../common/logo-hochschule-bochum-cvh-text-v2.pdf \ No newline at end of file diff --git a/20210615/logo-hochschule-bochum.pdf b/20210615/logo-hochschule-bochum.pdf new file mode 120000 index 0000000000000000000000000000000000000000..b6b9491e370e499c9276918182cdb82cb311bcd1 --- /dev/null +++ b/20210615/logo-hochschule-bochum.pdf @@ -0,0 +1 @@ +../common/logo-hochschule-bochum.pdf \ No newline at end of file diff --git a/20210615/pgslides.sty b/20210615/pgslides.sty new file mode 120000 index 0000000000000000000000000000000000000000..5be1416f4216f076aa268901f52a15d775e43f64 --- /dev/null +++ b/20210615/pgslides.sty @@ -0,0 +1 @@ +../common/pgslides.sty \ No newline at end of file diff --git a/20210615/rtech-20210615.pdf b/20210615/rtech-20210615.pdf new file mode 100644 index 0000000000000000000000000000000000000000..e0ea88793b7ffbfb872a60997af26a6248c1dd98 Binary files /dev/null and b/20210615/rtech-20210615.pdf differ diff --git a/20210615/rtech-20210615.tex b/20210615/rtech-20210615.tex new file mode 100644 index 0000000000000000000000000000000000000000..b440a160cb8c22841716f7179381431931bc41ac --- /dev/null +++ b/20210615/rtech-20210615.tex @@ -0,0 +1,593 @@ +% rtech-20210615.pdf - Lecture Slides on Computer Technology +% Copyright (C) 2012, 2013, 2014, 2021 Peter Gerwinski +% +% This document is free software: you can redistribute it and/or +% modify it either under the terms of the Creative Commons +% Attribution-ShareAlike 3.0 License, or under the terms of the +% GNU General Public License as published by the Free Software +% Foundation, either version 3 of the License, or (at your option) +% any later version. +% +% This document is distributed in the hope that it will be useful, +% but WITHOUT ANY WARRANTY; without even the implied warranty of +% MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +% GNU General Public License for more details. +% +% You should have received a copy of the GNU General Public License +% along with this document. If not, see <http://www.gnu.org/licenses/>. +% +% You should have received a copy of the Creative Commons +% Attribution-ShareAlike 3.0 Unported License along with this +% document. If not, see <http://creativecommons.org/licenses/>. + +% README: Puffer-Überläufe, Pipelining + +\documentclass[10pt,t]{beamer} + +\usepackage{pgslides} +\usepackage{rotating} + +\lstdefinestyle{asm}{basicstyle=\color{structure}, + language={}, + gobble=4} + +\title{Rechnertechnik} +\author{Prof.\ Dr.\ rer.\ nat.\ Peter Gerwinski} +\date{15.\ Juni 2021} + +\begin{document} + +\maketitleframe + +\sectionnonumber{\inserttitle} + +\begin{frame} + + \showsectionnonumber + + \begin{itemize} + \item[\textbf{1}] \textbf{Einführung} + \item[\textbf{2}] \textbf{Vom Schaltkreis zum Computer} + \item[\textbf{3}] \textbf{Architekturmerkmale von Prozessoren} + \item[\textbf{4}] \textbf{Der CPU-Stack} + \begin{itemize} + \item[4.1] Implementation + \item[4.2] Unterprogramme + \item[4.3] Register sichern + \item[4.4] Stack-Überläufe + \color{medgreen} + \item[4.5] Puffer-Überläufe + \end{itemize} +% \color{gray} +% \item[\textbf{5}] \textbf{Hardwarenahe Programmierung} + \item[\textbf{5}] \textbf{Anwender-Software} + \item[\textbf{6}] \textbf{Pipelining} + \begin{itemize} + \color{medgreen} + \item[6.1] Konzept + \item[6.2] Arithmetik-Pipelines + \color{red} + \item[6.3] Instruktions-Pipelines + \end{itemize} +% \item[\textbf{7}] \textbf{Bus-Systeme} + \item[\textbf{\dots\hspace{-0.75em}}] +% \item[\textbf{8}] \textbf{Ausblick} + \end{itemize} + +\end{frame} + +\setcounter{section}{4} + +\section{Anwender-Software} +\setcounter{subsection}{5} +\subsection{Puffer-Überläufe} + +\begin{frame}[fragile] + + \showsection + \showsubsection + + \begin{lstlisting} + #include <stdio.h> + + int main (void) + { + int ID; + char buffer[20]; + printf ("Your ID, please: "); + gets (buffer); + sscanf (buffer, "%d", &ID); + printf ("Your name, please: "); + gets (buffer); + printf ("Hello, %s!\nYour ID is %d.\n", buffer, ID); + return 0; + } + \end{lstlisting} + \begin{picture}(0,0) + \put(5,6){\makebox(0,0)[tl]{\begin{minipage}{6.7cm} + Die Funktion \lstinline{gets()} prüft nicht, ob \lstinline{buffer[]} + für den eingegebenen Namen ausreicht, und überschreibt ggf.\ die + Variable \lstinline{ID} sowie die Rücksprungadresse des Funktionsaufrufs + von \lstinline{main()}. + \end{minipage}}} + \put(6.0,2.5){\makebox(0,0)[l]{\color{red}gets() nicht verwenden!}} + \end{picture} + \vspace*{-1cm} + +\end{frame} + +\setcounter{section}{6} +\section{Pipelining} +\subsection{Konzept} + +\newcommand{\wm}{\raisebox{-0.3cm}{\includegraphics[width=1.0cm]{Waschen_30.pdf}}} +\newcommand{\wt}{\raisebox{-0.3cm}{\includegraphics[width=1.0cm]{Trommeltrocknen.pdf}}} +\newcommand{\be}{\raisebox{-0.3cm}{\includegraphics[width=1.0cm]{Buegeln.pdf}}} + +\begin{frame} + \showsection + +% \pause + \showsubsection + \begin{itemize} + \item + Aufgabe in Teilaufgaben zerlegen + \item + Teilaufgaben parallel ausführen + \end{itemize} + +% \pause + \bigskip + Beispiel: Wäsche waschen +% \pause + \begin{itemize} + \item + Teilaufgaben: \wm, \wt, \be +% \pause + \item + müssen nacheinander ausgeführt werden: Datenfluß +% \pause + \item + belegen jeweils 1 Ressource + \end{itemize} + +\end{frame} + +\begin{frame} + + 3 Ladungen Wäsche + \begin{center} + \begin{onlyenv}<1-2> + \begin{picture}(12,3.5) + \thicklines + \put(1,1){\wm} + \put(2,1){\wt} + \put(3,1){\be} + \put(4,2){\wm} + \put(5,2){\wt} + \put(6,2){\be} + \put(7,3){\wm} + \put(8,3){\wt} + \put(9,3){\be} + \put(-0.1,0.5){\vector(1,0){11.1}} + \put(11.5,0.5){\makebox(0,0){$t$}} + \put(10.5,1.0){\makebox(0,0)[r]{ineffizient}} + \end{picture}\\[\medskipamount] + \end{onlyenv} + \begin{onlyenv}<2-4> + \begin{picture}(12,3.5) + \thicklines + \put(1,1){\wm} + \put(2,1){\wt} + \put(3,1){\be} + \put(2,2){\wm} + \put(3,2){\wt} + \put(4,2){\be} + \put(3,3){\wm} + \put(4,3){\wt} + \put(5,3){\be} + \put(-0.1,0.5){\vector(1,0){11.1}} + \put(11.5,0.5){\makebox(0,0){$t$}} + \put(10.5,1.0){\makebox(0,0)[r]{effizient}} + \end{picture}\\[\medskipamount] + \end{onlyenv} + \begin{onlyenv}<3-> + \begin{picture}(12,3.5) + \thicklines + \put(1,1){\wm} + \put(2,1){\wt} + \put(3,1){\be} + \put(1,2){\wm} + \put(2,2){\wt} + \put(3,2){\be} + \put(1,3){\wm} + \put(2,3){\wt} + \put(3,3){\be} + \put(-0.1,0.5){\vector(1,0){11.1}} + \put(11.5,0.5){\makebox(0,0){$t$}} + \put(10.5,1.0){\makebox(0,0)[r]{noch effizienter}} + \color{red} + \thicklines + \put(0.5,0.8){\only<4->{\line(4,1){10}}} + \put(0.5,3.3){\only<4->{\line(4,-1){10}}} + \put(7.5,1.7){\only<4->{\mbox{\shortstack{Ressourcen-\\konflikt}}}} + \end{picture}\\[\medskipamount] + \end{onlyenv} + \begin{onlyenv}<5-> + \begin{picture}(12,3.5) + \thicklines + \put(1,1){\wm} + \put(2,1){\wt} + \put(3,1){\be} + \put(1,2){\wt} + \put(2,2){\be} + \put(3,2){\wm} + \put(1,3){\be} + \put(2,3){\wm} + \put(3,3){\wt} + \put(-0.1,0.5){\vector(1,0){11.1}} + \put(11.5,0.5){\makebox(0,0){$t$}} + \put(10.5,1.0){\makebox(0,0)[r]{noch effizienter}} + \color{red} + \thicklines + \put(0.5,0.8){\only<6->{\line(4,1){10}}} + \put(0.5,3.3){\only<6->{\line(4,-1){10}}} + \put(7.5,1.7){\only<6->{\mbox{\shortstack{Daten-\\konflikt}}}} + \end{picture}% + \end{onlyenv} + \end{center} + +\end{frame} + +\subsection{Arithmetik-Pipelines} + +\newcommand{\insns}[1]{% + \begin{picture}(0,0) + \put(0,0){\line(1,0){2}} + \put(2,0){\line(0,-1){#1}} + \put(2,-#1){\vector(-1,0){2}} + \end{picture}} + +\newcommand{\insnsup}[1]{% + \begin{picture}(0,0) + \put(0,0){\line(1,0){2}} + \put(2,0){\line(0,1){#1}} + \put(2,#1){\vector(-1,0){2}} + \end{picture}} + +\begin{frame} + + \showsubsection + "`Register-FIFO"' + + \pause + \smallskip + + Pseudo-Code: Berechnung von + \begin{displaymath} + S = \left(\begin{array}{c}a_1\\a_2\\a_3\end{array}\right) + \cdot\left(\begin{array}{c}b_1\\b_2\\b_3\end{array}\right) + = a_1 \cdot b_1 + + a_2 \cdot b_2 + + a_3 \cdot b_3 + \end{displaymath} + mit einer Pipeline der Länge 3 + + \pause + \medskip + + \begingroup + \setlength{\unitlength}{\baselineskip}% + \begin{picture}(0,0)(-5.0,-0.25) + \color{red} + \put(0,0.0){\only<4->{\insns{3}}} + \put(0.5,-1){\only<5->{\insns{2.9}}} + \put(1.0,-2){\only<6->{\insns{3}}} + \put(0.5,-4.1){\only<8->{\insns{2.8}}} + \put(0.5,-7.1){\only<11->{\insns{2.9}}} + \put(-1.5,-9.25){\only<15->{\shortstack{Daten-\\konflikt}}} + \end{picture}% + \color{structure} + push $a_1 \cdot b_1$\\ + \pause + \pause + push $a_2 \cdot b_2$\\ + \pause + push $a_3 \cdot b_3$\\ + \pause + $s_1$ = pop\\ + \pause + push $s_1 + \mbox{pop}$\\ + \pause + $s_3$ = pop\\ + \pause + nop\\ + \pause + push $s_3 + \mbox{pop}$\\ + \pause + nop\\ + \pause + nop\\ + \pause + $S$ = pop\\ + \endgroup + \pause + \pause + \begin{picture}(0,0) + \color{red} + \put(5,3.8){\makebox(0,0)[l]{$\left.\rule{0pt}{1.2cm}\right\}$ effizient: Pipeline gefüllt}} + \put(5,1.4){\makebox(0,0)[l]{$\left.\rule{0pt}{1.2cm}\right\}$ ineffizient: "`Blasen"'}} + \end{picture} + \pause + \vspace*{-1.25cm} + \begin{flushright} + \dots\ aber immer noch effizienter als\\ + 3 Schritte für jede Operation + \end{flushright} + +\end{frame} + +\subsectionnonumber{Reales Beispiel: \break Vektor-Addition auf i860} + +\begin{frame}[fragile] + + \begin{minipage}[t]{5cm} + \raggedright + \showsubsectionnonumber + \begin{lstlisting} + .align 8 + .globl _vadd + nop + _vadd: + shr 1,r19,r19 + bte r19,r0,exitadd + addu 0x000F,r16,r16 + andnot 0x000F,r16,r16 + adds -16,r16,r16 + addu 0x000F,r17,r17 + andnot 0x000F,r17,r17 + adds -16,r17,r17 + addu 0x000F,r18,r18 + andnot 0x000F,r18,r18 + adds -16,r18,r18 + mov -1,r20 + \end{lstlisting} + \end{minipage} + \begin{minipage}[t]{5cm} + \begin{lstlisting} + fld.q 16(r16)++,f16 + fld.q 16(r17)++,f20 + pfadd.dd f16,f20,f0 + bla r20,r19,loopadd + pfadd.dd f18,f22,f0 + loopadd: + d.pfadd.dd f0,f0,f0 + fld.q 16(r16)++,f16 + d.pfadd.dd f0,f0,f24 + fld.q 16(r17)++,f20 + d.pfadd.dd f16,f20,f26 + bla r20,r19,loopadd + d.pfadd.dd f18,f22,f0 + fst.q f24,16(r18)++ + nop + nop + nop + exitadd: + bri r1 + nop + \end{lstlisting} + \end{minipage} + +\end{frame} + +\lstdefinestyle{shybubble}{basicstyle=\color{lightgray}, + moredelim=**[is][\color{structure}]{¡}{¿}, + moredelim=**[is][\only<7->{\color{red}}]{°}{¿}} + +\begin{frame}[fragile] + + \begin{minipage}[t]{5cm} + \raggedright + \showsubsectionnonumber + \begin{lstlisting}[style=shybubble] + .align 8 + .globl _vadd + nop + _vadd: + shr 1,r19,r19 + bte r19,r0,exitadd + addu 0x000F,r16,r16 + andnot 0x000F,r16,r16 + adds -16,r16,r16 + addu 0x000F,r17,r17 + andnot 0x000F,r17,r17 + adds -16,r17,r17 + addu 0x000F,r18,r18 + andnot 0x000F,r18,r18 + adds -16,r18,r18 + mov -1,r20 + \end{lstlisting} + \end{minipage} + \begin{minipage}[t]{5cm} + \begin{lstlisting}[style=shybubble] + ¡fld.q 16(r16)++,f16 + fld.q 16(r17)++,f20 + pfadd.dd f16,f20,f0 + bla r20,r19,loopadd + pfadd.dd f18,f22,f0 + loopadd: + d.pfadd.dd °f0,f0,f0¿ + fld.q 16(r16)++,f16 + d.pfadd.dd °f0,f0¿,f24 + fld.q 16(r17)++,f20 + d.pfadd.dd f16,f20,f26 + bla r20,r19,loopadd + d.pfadd.dd f18,f22,°f0¿ + fst.q f24,16(r18)++¿ + nop + nop + nop + exitadd: + bri r1 + nop + \end{lstlisting} + \end{minipage} + + \pause + \begingroup + \setlength{\unitlength}{\baselineskip}% + \begin{picture}(0,0)(-21.0,-17.6) + \color{red} + \put(0,0){\only<2->{\insns{5.9}}} + \put(1.0,-2){\only<3->{\insns{6.0}}} + \put(-7,-9){\only<4->{\line(-1,0){1}}} + \put(-8,-9){\only<4->{\line(0,-1){2}}} + \put(-8,-11){\only<4->{\line(-1,0){1}}} + \put(-9,-11){\only<4->{\line(0,1){8}}} + \put(-9,-3){\only<4->{\vector(1,0){0.7}}} + \put(0.8,-7.8){\only<5->{\insnsup{1.7}}} + \put(0.8,-10){\only<6->{\insnsup{1.8}}} + \put(-0.5,-12.5){\only<7->{\mbox{6mal f0 = 2 Blasen}}} + \end{picture}% + \endgroup + + \vspace{-2cm} + \begin{flushright} + \only<8->{Immerhin: 2 Additionen in 4 Taktzyklen} + + \medskip + + \only<9->{Dies ist ein \emph{einfaches} Beispiel.} + \end{flushright} + +\end{frame} + +\subsection{Instruktions-Pipelines} + +\begin{frame}[fragile] + + \showsubsection + + Ein Prozessor benötigt Zeit, um einen Befehl zu verstehen. + + \textarrow\ Während Befehlsausführung nächste Befehle vorauslesen + + \medskip + + \begin{lstlisting}[style=shy] + ².L3: + movw r30,r20¿ + ³add r30,r18¿ + °adc r31,r19¿ + ¤mov r24,r18 + subi r24,lo8(-(1)) + st Z,r24 + subi r18,lo8(-(1)) + sbci r19,hi8(-(1)) + cp r22,r18 + cpc r23,r19¿ + ¢brge .L3¿ + æret¿ + \end{lstlisting} + + \begin{picture}(0,0) + \color{red} + \put(0.5,1.00){\only<8->{\line(-1,0){0.4}}} + \put(0.1,1.00){\only<8->{\line(0,1){4.15}}} + \put(0.1,5.15){\only<8->{\vector(1,0){0.4}}} + \put(0.5,0.90){\only<9->{\line(-1,0){0.4}}} + \put(0.1,0.90){\only<9->{\line(0,-1){0.35}}} + \put(0.1,0.55){\only<9->{\vector(1,0){0.4}}} + \put(2.5,0.825){\only<10->{\begin{minipage}[t]{8cm} + bedingter Sprung: + Welche Befehle vorauslesen?\\[\smallskipamount] + \only<11->{Kontrollflußkonflikt} + \end{minipage}}} + \end{picture} + + \begin{flushright} + \vspace*{-0.5cm} + \only<12->{Lösungsansatz: Zweigvorhersage} + \vspace*{-1cm} + \end{flushright} + +\end{frame} + +\subsubsectionnonumber{Zweigvorhersage -- Branch Prediction} + +\begin{frame}[fragile] + + \showsubsection + \showsubsubsectionnonumber + + \begin{itemize} + \setlength{\unitlength}{\baselineskip}% + \pause + \item + Sprünge nach oben sind Schleifen: "`Ja"'\\ + Sprünge nach unten sind Auswahl-Verzweigungen: "`Nein"' + \pause + \item + Delayed Branches: Sprungbefehl verspätet ausführen\\ + \textarrow\ Optimierung manuell oder durch Compiler + \pause + \medskip + \begin{lstlisting} + loopadd: + d.pfadd.dd f0,f0,f0 + fld.q 16(r16)++,f16 + d.pfadd.dd f0,f0,f24 + fld.q 16(r17)++,f20 + d.pfadd.dd f16,f20,f26 + bla r20,r19,loopadd + d.pfadd.dd f18,f22,f0 + fst.q f24,16(r18)++ + \end{lstlisting} + \begin{picture}(0,0)(-9.6,-12.2) + \color{red} + \put(-7,-9){\line(-1,0){1}} + \put(-8,-9){\line(0,-1){2}} + \put(-8,-11){\line(-1,0){1}} + \put(-9,-11){\line(0,1){8}} + \put(-9,-3){\vector(1,0){0.7}} + \end{picture} + \pause + \item + Branch History Table: Sprünge merken + \pause + \item + \dots + \end{itemize} + +\end{frame} + +\subsectionnonumber{Zusammenfassung} + +\begin{frame} + + \showsection + \showsubsectionnonumber + + \begin{itemize} + \item + Teilaufgaben parallel ausführen + \item + Arithmetik-Pipelines führen Berechnungen parallel aus,\\ + Instruktions-Pipelines lesen Befehle voraus + \item + Ressourcen-, Daten- und Kontrollflußkonflikte führen zu "`Blasen"' + \item + Zweigvorhersage reduziert Kontrollflußkonflikte in Instruktions-Pipelines + \begin{itemize} + \item + nach oben / nach unten + \item + Delayed Branches: manuell optimieren + \item + Branch History Table: Sprünge merken + \end{itemize} + \end{itemize} + +\end{frame} + +\end{document} diff --git a/20210615/server-2.c b/20210615/server-2.c new file mode 100644 index 0000000000000000000000000000000000000000..e8db2ceb19abb3e931815ba156e045458a8f65cf --- /dev/null +++ b/20210615/server-2.c @@ -0,0 +1,14 @@ +#include <stdio.h> +#include <string.h> + +int main (void) +{ + char buffer[20]; + printf ("Your name, please: "); + gets (buffer); + if (strcmp (buffer, "amerkel") == 0) + printf ("Hello, %s! Here is the secret code:\n13 23 42 137 1117\n", buffer); + else + printf ("Hello, %s! You have restricted guest access.\n", buffer); + return 0; +}