CS213, Fall 2023
Midterm 2
Name:
NetID:
• IMPORTANT: For this exam, you should have received a reference handout
with additional information.
• The problems are of varying difficulty. The difficulty is not correlated with
the problem order. So, make a first pass and solve some easy problems.
• Record your work so we can provide partial credit!
• You can choose not to write leading zeros in binary or hex values.
So 0x1F is an equivalent answer to 0x001F or 0x000000000000001F.
• You MAY refer to two 8.5x11 inch sheets of paper with notes on both sides.
• You MAY NOT refer to any other notes, textbook, calculator, smartphone,
or computer.
• You MAY NOT communicate with any other person during the exam apart
from the instructional staff.
Page 1 of 20
This page is intentionally blank.
Feel free to use this for scratch work.
Points breakdown:
((3*4) + (2+3+3+3+4)+ (2*4+6*3+2+3)+(2*(2+5)+2*(2+6)) + (2*6))
Page 2 of 20
Struct Layouts (12 Points)
Given the following data structure in a C program, determine the requested information for a
little-endian x86-64 computer system.
Contents of memory: (in hexadecimal)
Address
0
1
2
3
4
5
6
7
0x100
0x108
0x110
0x118
0x120
0x128
0x130
43
63
B3
F3
9A
6D
3D
25
C9
92
54
AD
6D
EA
F9
D0
EE
56
8C
05
88
C5
77
EF
C2
85
73
FD
D3
2E
8B
31
36
8D
4E
88
48
F0
3E
37
7A
3A
14
2A
7D
2F
8E
84
A2
37
D4
5A
90
45
A0
B3
Data structure:
struct Test1 {
signed int
a;
signed char
b;
unsigned long c[2];
unsigned int d;
} test1_struct;
Assume the struct is created and starts in memory at address: 0x100
1.
What is the VALUE of the expression (hex):
test1_struct.b
0xD3
2.
What is the VALUE of the expression (hex):
test1_struct.c[1]
0x5A7DF08B EFEE92B3
Page 3 of 20
Struct Layouts (continued)
Given the following data structure in a C program, determine the requested information for a
little-endian x86-64 computer system.
Contents of memory: (in hexadecimal)
Address
0
1
2
3
4
5
6
7
0x200
0x208
0x210
0x218
0x220
0x228
0x230
20
18
00
08
10
28
00
02
02
02
02
02
02
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
Data structure:
struct Test2 {
struct Test2* next;
unsigned int value;
} test2_struct;
Assume the struct is created and starts in memory at address: 0x200
3.
What is the VALUE of the expression (hex):
test2_struct.value
0x00000218
4.
What is the VALUE of the expression (hex):
test2_struct.next->next->value
0x00000208
Page 4 of 20
Stacks Contents, Buffer Overflows, and Assembly (15 Points)
Consider a program running on a little-endian x86-64 system. Make no assumptions about the
layout of memory within the process (memory segments might not be at the addresses you
would expect them to be). Refer to the handout sheet to determine Stack memory contents.
In the assembly below, Gets is a function that reads characters from standard input into an
array until it reaches a newline or end-of-file: void Gets(char* array)
x86-64 assembly
00 getbuf:
01
subq
$24, %rsp
02
pushq %rdi
03
pushq %rsi
04
leaq
16(%rsp), %rdi
05
callq 401857 <Gets>
06
popq
%rsi
07
popq
%rdi
08
movzbq (%rsp, %rdi), %rax
09
cmpq
%rsi, %rax
10
sete
%al
11
movzbq %al, %rax
12
addq
$24, %rsp
13
retq
Using GDB, you pause the code at line 05 of the assembly (before the call to Gets) to discover
that the value of %rsp is 0xFE40 and print the Stack memory contents (see handout sheet).
Questions begin on the next page.
Page 5 of 20
Stack Contents, Buffer Overflow, and Assembly (continued)
See assembly code and explanation on prior page. Refer to handout for memory contents.
5.
At most, how large in bytes is the array passed
24 bytes
into Gets? (decimal)
%rsp allocates space on the stack and passes a pointer to it into Gets.
What was the value of %rsi when getbuf
0x00000000 00000039
was called? (hex)
%rsi is pushed to the stack, so you can find it there. It’s at %rsp.
6.
7.
What is the address of the instruction returned
0x00000000 100040BB
to after getbuf is complete? (hex)
That’s the return address on the stack. Up 8+8+24 bytes from %rsp.
Page 6 of 20
Stack Contents, Buffer Overflow, and Assembly (continued)
See assembly code and explanation on prior page. Refer to handout for memory contents.
Now assume that the following payload is written to array when Gets is called.
Contents written to array[]:
Offset
0
1
2
0x00
37
15
71
0x08
00
2E
00
0x10
5F
2D
94
0x18
8B
DD
21
0x20
7A
2C
53
8.
3
8E
4C
00
93
E1
4
39
2B
8B
00
95
Given the injected payload above, what is the
new address of the instruction returned to
after getbuf is complete? (hex)
5
6E
00
14
D9
73
6
98
00
00
00
63
7
00
43
9F
E4
00
0xE400D9009321DD8B
The first 24 bytes are for the array. After that it overwrites the return address.
9.
Given the injected payload above, what value
will be in %rax when getbuf returns? (hex) 0x1
%rax is set by the sete instruction, which compares array[%rdi] with %rsi. In this
case they match, so %rax is set to 1. The only other plausible answer is 0.
Page 7 of 20
Memory System (31 Points)
Consider a little-endian computer system as described below. Contents of the caches, physical
memory, and Page Table are displayed on the handout sheet.
The system has virtual and physical memory:
•
•
•
Virtual Memory: 8-bit address space.
Physical Memory: 7-bit address space.
Memory pages are always 8 bytes in size.
The system has three layers of caches:
•
•
•
•
L1: Fully-associative cache with 1 block. Uses Virtual Addresses.
L2: Direct-mapped cache with 2 blocks. Uses Virtual Addresses.
L3: Two-way set-associative cache with 4 blocks. Uses Physical Addresses.
Cache blocks are always 8 bytes in size.
A cache that uses Virtual Addresses uses the Virtual Address of a memory value to determine
the Tag, Index, and Offset. A cache that uses Physical Addresses uses the Physical Address of a
memory value to determine the Tag, Index and Offset.
Questions begin on the next page.
Page 8 of 20
Memory System (continued)
See previously described memory system details. Refer to handout for system contents.
10. For the Virtual Memory System, how many bits are each of the following?
(decimal)
Page
Offset:
3
Virtual Page
Number (VPN):
5
Physical Page
Number (PPN):
4
11. For the L1 cache, how many address bits are used for cache Tag, Set Index,
and Block Offset respectively? (decimal)
Tag:
5
Index:
0
Offset:
3
12. For the L2 cache, how many address bits are used for cache Tag, Set Index,
and Block Offset respectively? (decimal)
Tag:
4
Index:
1
Offset:
3
13. For the L3 cache, how many address bits are used for cache Tag, Set Index,
and Block Offset respectively? (decimal) Reminder: L3 is physically addressed
Tag:
3
Index:
1
Offset:
3
Page 9 of 20
Memory System (continued)
See previously described memory system details. Refer to handout for system contents.
If there is no valid Physical Address for the Virtual Address, record “Fault” for the L3 details,
Physical Address, and Data Value.
14. Two-byte read from virtual address: 0x8A
L1 Tag:
(hex)
0x11
L2 Tag:
(hex)
L1 Index:
(decimal)
N/A
L2 Index:
(decimal)
1
L3 Index:
(decimal)
0
L1 Offset:
(decimal)
2
L2 Offset:
(decimal)
2
L3 Offset:
(decimal)
2
L1 Hit or
Miss:
Miss
L2 Hit or
Miss:
Hit
L3 Hit or
Miss:
Hit
Physical Address (hex):
or “Fault”
Data Value (hex):
or “Fault”
0x8
L3 Tag:
(hex)
0x5
0x52
0x2A2E
Page 10 of 20
Memory System (continued)
See previously described memory system details. Refer to handout for system contents.
If there is no valid Physical Address for the Virtual Address, record “Fault” for the L3 details,
Physical Address, and Data Value.
15. Four-byte read from virtual address: 0x64
L1 Tag:
(hex)
0x0C
L2 Tag:
(hex)
L1 Index:
(decimal)
N/A
L2 Index:
(decimal)
0
L3 Index:
(decimal)
0
L1 Offset:
(decimal)
4
L2 Offset:
(decimal)
4
L3 Offset:
(decimal)
4
L1 Hit or
Miss:
Miss
L2 Hit or
Miss:
Miss
L3 Hit or
Miss:
Miss
Physical Address (hex):
or “Fault”
0x44
Data Value (hex):
or “Fault”
0x6
L3 Tag:
(hex)
0x4
0x00DB02BC
Page 11 of 20
Memory System (continued)
See previously described memory system details. Refer to handout for system contents.
If there is no valid Physical Address for the Virtual Address, record “Fault” for the L3 details,
Physical Address, and Data Value.
16. One-byte read from virtual address: 0x21
L1 Tag:
(hex)
0x4
L2 Tag:
(hex)
L1 Index:
(decimal)
N/A
L2 Index:
(decimal)
0
L3 Index:
(decimal)
0
L1 Offset:
(decimal)
1
L2 Offset:
(decimal)
1
L3 Offset:
(decimal)
1
L1 Hit or
Miss:
Hit
L2 Hit or
Miss:
Hit
L3 Hit or
Miss:
Hit
0x2
Physical Address (hex):
or “Fault”
0x01
Data Value (hex):
or “Fault”
0xB9
L3 Tag:
(hex)
0x0
Page 12 of 20
Memory System (continued)
See previously described memory system details. Refer to handout for system contents.
17. Write any virtual address with
an L2 cache Tag of 0x7. (hex)
0x7X (any last hexit)
18. Write any virtual address that would be a
Cache Hit in L3 but not in L2 or L1. (hex)
0xF0-7 or 0xA8-F
Physical Addresses would be: 0x58-5F and 0x28-2F
Page 13 of 20
Cache Performance (30 Points)
Determine cache performance for C code on a little-endian, x86-64 computer.
The standard assumptions:
•
•
•
•
•
•
Each code snippet is entirely independent.
All variables are held in registers except for the array accessed by the code.
The array starts at memory address zero.
The cache initially starts empty.
Only data is held in the cache, not instructions.
The cache is write-allocate (it saves values to the cache when they are written to).
Details:
•
The cache is a direct-mapped cache with 4 sets and 4-byte blocks.
To receive partial credit, be sure to show the work used to derive the access and miss counts.
You may leave your answers as an un-simplified equation. For example, if the answer is “64”,
then “4*16” would also be accepted, as would “4*(32/2)”.
Questions begin on the next page.
Page 14 of 20
Cache Performance (continued)
See previously described cache details: direct-mapped cache with 4 sets and 4-byte blocks.
00 unsigned char array[8]; // at address 0
01
02 void function1(void) {
03
for (int col=0; col<8; col++) {
04
array[col] = col*7;
05
}
06 }
19. How many times does function1 ACCESS
memory (Hit or Miss)? (decimal)
8
Accesses [0], [1], [2], [3], …
20. How many times does function1 MISS the
cache? (decimal)
2
Page 15 of 20
Cache Performance (continued)
See previously described cache details: direct-mapped cache with 4 sets and 4-byte blocks.
00 unsigned char array[3][8]; // at address 0
01
02 void function2(void) {
03
for (int col=0; col<8; col++) {
04
for (int row=0; row<3; row++) {
05
array[row][col] = col+row*7;
06
}
07
}
08 }
21. How many times does function2 ACCESS
memory (Hit or Miss)? (decimal)
24
Accesses [0][0], [1][0], [2][0], [0][1], [1][1], [2][1], [0][2], [1][2], [2][2], …
22. How many times does function2 MISS the
cache? (decimal)
0
2
0
0
2
0
0
2
0
0
2
0
1
3
1
1
3
1
1
3
1
18
1
3
1
Cache blocks labeled on the array above. Rows 0 and 2 are in conflict as both map
to cache blocks 0 and 1. Row 1 is not in conflict.
Page 16 of 20
Cache Performance (continued)
See previously described cache details: direct-mapped cache with 4 sets and 4-byte blocks.
00 unsigned char array[2][3][8]; // at address 0
01
02 void function3(void) {
03
for (int mat=0; mat<2; mat++) {
04
for (int row=0; row<3; row++) {
05
for (int col=0; col<8; col++) {
06
array[mat][row][col] = mat*row+col*7;
07
}
08
}
09
}
10 }
23. How many times does function3 ACCESS
memory (Hit or Miss)? (decimal)
48
Accesses [0][0][0], [0][0][1], [0][0][2], [0][0][3], …
24. How many times does function3 MISS the
cache? (decimal)
0
2
0
2
0
2
0
2
0
2
0
2
0
2
0
2
0
2
0
2
0
2
0
2
1
3
1
3
1
3
1
3
1
3
1
3
1
3
1
3
1
3
1
3
1
3
1
3
12
Matrix 0
Matrix 1
Cache blocks labeled on the array above. Moving horizontally means that the
conflicts don’t matter.
Page 17 of 20
Cache Performance (continued)
See previously described cache details: direct-mapped cache with 4 sets and 4-byte blocks.
00 unsigned char array[2][3][8]; // at address 0
01
02 void function4(void) {
03
for (int row=0; row<3; row++) {
04
for (int col=0; col<8; col++) {
05
for (int mat=0; mat<2; mat++) {
06
array[mat][row][col] = row*col+mat*7;
07
}
08
}
09
}
10 }
25. How many times does function4 ACCESS
memory (Hit or Miss)? (decimal)
48
Accesses [0][0][0], [1][0][0], [0][0][1], [1][0][1], …
26. How many times does function4 MISS the
cache? (decimal)
0
2
0
2
0
2
0
2
0
2
0
2
0
2
0
2
0
2
0
2
0
2
0
2
1
3
1
3
1
3
1
3
1
3
1
3
1
3
1
3
1
3
1
3
1
3
1
3
12
Matrix 0
Matrix 1
Cache blocks labeled on the array above. Matrix 0 row 0 and Matrix 1 row 0 are
NOT in conflict, so this all works out okay!
Page 18 of 20
Systems Terminology (12 Points)
For each of the following descriptions, determine which term from the list it best describes. You
will not use all terms in the list.
List of terms:
• Direct Memory Access
• Memory-Mapped I/O
• Process
• Domain Name
• Optimization
• Signal
• Fork
• Port
• System Call
• IP Address
• Port-Mapped I/O
• Thread
27. A program that is currently being run.
Process
28. Code transformation with the goal of
making a program faster.
Optimization
29. Method for a process to make a request
of the Operating System.
System Call
30. Using special assembly instructions to talk
to devices.
Port-Mapped I/O
31. Unique address for a Host on the Internet.
IP Address
32. Human-readable identifier for a Host on
the Internet.
Domain Name
Page 19 of 20
This page is intentionally blank.
Feel free to use this for scratch work.
Page 20 of 20