2.  Description of the MIPS R2000

A MIPS processor consists of an integer processing unit (the CPU) and a collection of coprocessors that perform ancillary tasks or operate on other types of data such as floating point numbers (see Figure 2). SPIM simulates two coprocessors. Coprocessor 0 handles traps, exceptions, and the virtual memory system. SPIM simulates most of the first two and entirely omits details of the memory system. Coprocessor 1 is the floating point unit. SPIM simulates most aspects of this unit.

2.1  CPU Registers

The MIPS (and SPIM) central processing unit contains 32 general purpose registers that are numbered 0-31. Register n is designated by $n. Register $0 always contains the hardwired value 0. MIPS has established a set of conventions as to how registers should be used. These suggestions are guidelines, which are not enforced by the hardware. However a program that violates them will not work properly with other software. Table 2 lists the registers and describes their intended use.

Registers $at (1), $k0 (26), and $k1 (27) are reserved for use by the assembler and operating system.

Registers $a0-$a3 (4-7) are used to pass the first four arguments to routines (remaining arguments are passed on the stack). Registers $v0 and $v1 (2, 3) are used to return values from functions. Registers $t0-$t9 (8-15, 24, 25) are caller-saved registers used for temporary quantities that do not need to be preserved across calls. Registers $s0- $s7 (16-23) are callee-saved registers that hold long-lived values that should be preserved across calls.

Register $sp (29) is the stack pointer, which points to the first free location on the stack. Register $fp (30) is the frame pointer.⁵ Register $ra (31) is written with the return address for a call by the jal instruction.

Register $gp (28) is a global pointer that points into the middle of a 64K block of memory in the heap that holds constants and global variables. The objects in this heap can be quickly accessed with a single load or store instruction.

In addition, coprocessor 0 contains registers that are useful to handle exceptions. SPIM does not implement all of these registers, since they are not of much use in a simulator or are part of the memory system, which is not implemented. However, it does provide the following:

These registers are part of coprocessor 0's register set and are accessed by the lwc0, mfc0, mtc0, and swc0 instructions.

Figure 3 describes the bits in the Status register that are implemented by SPIM. The interrupt mask contains a bit for each of the five interrupt levels. If a bit is one, interrupts at that level are allowed. If the bit is zero, interrupts at that level are disabled. The low six bits of the Status register implement a three-level stack for the kernel/user and interrupt enable bits. The kernel/user bit is 0 if the program was running in the kernel when the interrupt occurred and 1 if it was in user mode. If the interrupt enable bit is 1, interrupts are allowed. If it is 0, they are disabled. At an interrupt, these six bits are shifted left by two bits, so the current bits become the previous bits and the previous bits become the old bits. The current bits are both set to 0 (i.e., kernel mode with interrupts disabled).

Figure 4 describes the bits in the Cause registers. The five pending interrupt bits correspond to the five interrupt levels. A bit becomes 1 when an interrupt at its level has occurred but has not been serviced. The exception code register contains a code from the following table describing the cause of an exception.

2.2  Byte Order

Processors can number the bytes within a word to make the byte with the lowest number either the leftmost or rightmost one. The convention used by a machine is its byte order . MIPS processors can operate with either big-endian byte order:

or little-endian byte order:

SPIM operates with both byte orders. SPIM's byte order is determined by the byte order of the underlying hardware running the simulator. On a DECstation 3100, SPIM is little-endian, while on a HP Bobcat, Sun 4 or PC/RT, SPIM is big-endian.

2.3  Addressing Modes

MIPS is a load/store architecture, which means that only load and store instructions access memory. Computation instructions operate only on values in registers. The bare machine provides only one memory addressing mode: c(rx), which uses the sum of the immediate (integer) c and the contents of register rx as the address. The virtual machine provides the following addressing modes for load and store instructions:

Most load and store instructions operate only on aligned data. A quantity is aligned if its memory address is a multiple of its size in bytes. Therefore, a halfword object must be stored at even addresses and a full word object must be stored at addresses that are a multiple of 4. However, MIPS provides some instructions for manipulating unaligned data.

2.4  Arithmetic and Logical Instructions

In all instructions below, Src2 can either be a register or an immediate value (a 16 bit integer). The immediate forms of the instructions are only included for reference. The assembler will translate the more general form of an instruction (e.g., add) into the immediate form (e.g., addi) if the second argument is constant.

abs Rdest, RsrcAbsolute Value Put the absolute value of the integer from register Rsrc in register Rdest.

add Rdest, Rsrc1, Src2Addition (with overflow)
addi Rdest, Rsrc1, ImmAddition Immediate (with overflow)
addu Rdest, Rsrc1, Src2Addition (without overflow)
addiu Rdest, Rsrc1, ImmAddition Immediate (without overflow) Put the sum of the integers from register Rsrc1 and Src2 (or Imm) into register Rdest.

and Rdest, Rsrc1, Src2AND
andi Rdest, Rsrc1, ImmAND Immediate Put the logical AND of the integers from register Rsrc1 and Src2 (or Imm) into register Rdest.

div Rsrc1, Rsrc2Divide (with overflow)
divu Rsrc1, Rsrc2Divide (without overflow) Divide the contents of the two registers. Leave the quotient in register lo and the remainder in register hi. Note that if an operand is negative, the remainder is unspecified by the MIPS architecture and depends on the conventions of the machine on which SPIM is run.

div Rdest, Rsrc1, Src2Divide (with overflow)
divu Rdest, Rsrc1, Src2Divide (without overflow) Put the quotient of the integers from register Rsrc1 and Src2 into register Rdest.

mul Rdest, Rsrc1, Src2Multiply (without overflow)

mulo Rdest, Rsrc1, Src2Multiply (with overflow)
mulou Rdest, Rsrc1, Src2Unsigned Multiply (with overflow) Put the product of the integers from register Rsrc1 and Src2 into register Rdest.

mult Rsrc1, Rsrc2Multiply
multu Rsrc1, Rsrc2Unsigned Multiply Multiply the contents of the two registers. Leave the low-order word of the product in register lo and the high-word in register hi.

neg Rdest, RsrcNegate Value (with overflow)
negu Rdest, RsrcNegate Value (without overflow) Put the negative of the integer from register Rsrc into register Rdest.

nor Rdest, Rsrc1, Src2NOR Put the logical NOR of the integers from register Rsrc1 and Src2 into register Rdest.

not Rdest, RsrcNOT Put the bitwise logical negation of the integer from register Rsrc into register Rdest.

or Rdest, Rsrc1, Src2OR
ori Rdest, Rsrc1, ImmOR Immediate Put the logical OR of the integers from register Rsrc1 and Src2 (or Imm) into register Rdest.

rem Rdest, Rsrc1, Src2Remainder
remu Rdest, Rsrc1, Src2Unsigned Remainder Put the remainder from dividing the integer in register Rsrc1 by the integer in Src2 into register Rdest. Note that if an operand is negative, the remainder is unspecified by the MIPS architecture and depends on the conventions of the machine on which SPIM is run.

rol Rdest, Rsrc1, Src2Rotate Left
ror Rdest, Rsrc1, Src2Rotate Right Rotate the contents of register Rsrc1 left (right) by the distance indicated by Src2 and put the result in register Rdest.

sll Rdest, Rsrc1, Src2Shift Left Logical
sllv Rdest, Rsrc1, Rsrc2Shift Left Logical Variable
sra Rdest, Rsrc1, Src2Shift Right Arithmetic
srav Rdest, Rsrc1, Rsrc2Shift Right Arithmetic Variable
srl Rdest, Rsrc1, Src2Shift Right Logical
srlv Rdest, Rsrc1, Rsrc2Shift Right Logical Variable Shift the contents of register Rsrc1 left (right) by the distance indicated by Src2 (Rsrc2) and put the result in register Rdest.

sub Rdest, Rsrc1, Src2Subtract (with overflow)
subu Rdest, Rsrc1, Src2Subtract (without overflow) Put the difference of the integers from register Rsrc1 and Src2 into register Rdest.

xor Rdest, Rsrc1, Src2XOR
xori Rdest, Rsrc1, ImmXOR Immediate Put the logical XOR of the integers from register Rsrc1 and Src2 (or Imm) into register Rdest.

2.5  Constant-Manipulating Instructions

li Rdest, immLoad Immediate Move the immediate imm into register Rdest.

lui Rdest, immLoad Upper Immediate Load the lower halfword of the immediate imm into the upper halfword of register Rdest. The lower bits of the register are set to 0.

2.6  Comparison Instructions

In all instructions below, Src2 can either be a register or an immediate value (a 16 bit integer).

seq Rdest, Rsrc1, Src2Set Equal Set register Rdest to 1 if register Rsrc1 equals Src2 and to be 0 otherwise.

sge Rdest, Rsrc1, Src2Set Greater Than Equal
sgeu Rdest, Rsrc1, Src2Set Greater Than Equal Unsigned Set register Rdest to 1 if register Rsrc1 is greater than or equal to Src2 and to 0 otherwise.

sgt Rdest, Rsrc1, Src2Set Greater Than
sgtu Rdest, Rsrc1, Src2Set Greater Than Unsigned Set register Rdest to 1 if register Rsrc1 is greater than Src2 and to 0 otherwise.

sle Rdest, Rsrc1, Src2Set Less Than Equal
sleu Rdest, Rsrc1, Src2Set Less Than Equal Unsigned Set register Rdest to 1 if register Rsrc1 is less than or equal to Src2 and to 0 otherwise.

slt Rdest, Rsrc1, Src2Set Less Than
slti Rdest, Rsrc1, ImmSet Less Than Immediate
sltu Rdest, Rsrc1, Src2Set Less Than Unsigned
sltiu Rdest, Rsrc1, ImmSet Less Than Unsigned Immediate Set register Rdest to 1 if register Rsrc1 is less than Src2 (or Imm) and to 0 otherwise.

sne Rdest, Rsrc1, Src2Set Not Equal Set register Rdest to 1 if register Rsrc1 is not equal to Src2 and to 0 otherwise.

2.7  Branch and Jump Instructions

In all instructions below, Src2 can either be a register or an immediate value (integer). Branch instructions use a signed 16-bit offset field; hence they can jump 2¹⁵-1 instructions (not bytes) forward or 2¹⁵ instructions backwards. The jump instruction contains a 26 bit address field.

b labelBranch instruction Unconditionally branch to the instruction at the label.

bczt labelBranch Coprocessor z True
bczf labelBranch Coprocessor z False Conditionally branch to the instruction at the label if coprocessor z's condition flag is true (false).

beq Rsrc1, Src2, labelBranch on Equal Conditionally branch to the instruction at the label if the contents of register Rsrc1 equals Src2.

beqz Rsrc, labelBranch on Equal Zero Conditionally branch to the instruction at the label if the contents of Rsrc equals 0.

bge Rsrc1, Src2, labelBranch on Greater Than Equal
bgeu Rsrc1, Src2, labelBranch on GTE Unsigned Conditionally branch to the instruction at the label if the contents of register Rsrc1 are greater than or equal to Src2.

bgez Rsrc, labelBranch on Greater Than Equal Zero Conditionally branch to the instruction at the label if the contents of Rsrc are greater than or equal to 0.

bgezal Rsrc, labelBranch on Greater Than Equal Zero And Link Conditionally branch to the instruction at the label if the contents of Rsrc are greater than or equal to 0. Save the address of the next instruction in register 31.

bgt Rsrc1, Src2, labelBranch on Greater Than
bgtu Rsrc1, Src2, labelBranch on Greater Than Unsigned Conditionally branch to the instruction at the label if the contents of register Rsrc1 are greater than Src2.

bgtz Rsrc, labelBranch on Greater Than Zero Conditionally branch to the instruction at the label if the contents of Rsrc are greater than 0.

ble Rsrc1, Src2, labelBranch on Less Than Equal
bleu Rsrc1, Src2, labelBranch on LTE Unsigned Conditionally branch to the instruction at the label if the contents of register Rsrc1 are less than or equal to Src2.

blez Rsrc, labelBranch on Less Than Equal Zero Conditionally branch to the instruction at the label if the contents of Rsrc are less than or equal to 0.

bgezal Rsrc, labelBranch on Greater Than Equal Zero And Link
bltzal Rsrc, labelBranch on Less Than And Link Conditionally branch to the instruction at the label if the contents of Rsrc are greater or equal to 0 or less than 0, respectively. Save the address of the next instruction in register 31.

blt Rsrc1, Src2, labelBranch on Less Than
bltu Rsrc1, Src2, labelBranch on Less Than Unsigned Conditionally branch to the instruction at the label if the contents of register Rsrc1 are less than Src2.

bltz Rsrc, labelBranch on Less Than Zero Conditionally branch to the instruction at the label if the contents of Rsrc are less than 0.

bne Rsrc1, Src2, labelBranch on Not Equal Conditionally branch to the instruction at the label if the contents of register Rsrc1 are not equal to Src2.

bnez Rsrc, labelBranch on Not Equal Zero Conditionally branch to the instruction at the label if the contents of Rsrc are not equal to 0.

j labelJump Unconditionally jump to the instruction at the label.

jal labelJump and Link
jalr RsrcJump and Link Register Unconditionally jump to the instruction at the label or whose address is in register Rsrc. Save the address of the next instruction in register 31.

jr RsrcJump Register Unconditionally jump to the instruction whose address is in register Rsrc.

2.8  Load Instructions

la Rdest, addressLoad Address Load computed address , not the contents of the location, into register Rdest.

lb Rdest, addressLoad Byte
lbu Rdest, addressLoad Unsigned Byte Load the byte at address into register Rdest. The byte is sign-extended by the lb, but not the lbu, instruction.

ld Rdest, addressLoad Double-Word Load the 64-bit quantity at address into registers Rdest and Rdest + 1.

lh Rdest, addressLoad Halfword
lhu Rdest, addressLoad Unsigned Halfword Load the 16-bit quantity (halfword) at address into register Rdest. The halfword is sign-extended by the lh, but not the lhu, instruction

lw Rdest, addressLoad Word Load the 32-bit quantity (word) at address into register Rdest.

lwcz Rdest, addressLoad Word Coprocessor Load the word at address into register Rdest of coprocessor z (0-3).

lwl Rdest, addressLoad Word Left
lwr Rdest, addressLoad Word Right Load the left (right) bytes from the word at the possibly-unaligned address into register Rdest.

ulh Rdest, addressUnaligned Load Halfword
ulhu Rdest, addressUnaligned Load Halfword Unsigned Load the 16-bit quantity (halfword) at the possibly-unaligned address into register Rdest. The halfword is sign-extended by the ulh, but not the ulhu, instruction

ulw Rdest, addressUnaligned Load Word Load the 32-bit quantity (word) at the possibly-unaligned address into register Rdest.

2.9  Store Instructions

sb Rsrc, addressStore Byte Store the low byte from register Rsrc at address .

sd Rsrc, addressStore Double-Word Store the 64-bit quantity in registers Rsrc and Rsrc + 1 at address .

sh Rsrc, addressStore Halfword Store the low halfword from register Rsrc at address .

sw Rsrc, addressStore Word Store the word from register Rsrc at address .

swcz Rsrc, addressStore Word Coprocessor Store the word from register Rsrc of coprocessor z at address .

swl Rsrc, addressStore Word Left
swr Rsrc, addressStore Word Right Store the left (right) bytes from register Rsrc at the possibly-unaligned address .

ush Rsrc, addressUnaligned Store Halfword Store the low halfword from register Rsrc at the possibly-unaligned address .

usw Rsrc, addressUnaligned Store Word Store the word from register Rsrc at the possibly-unaligned address .

2.10  Data Movement Instructions

move Rdest, RsrcMove Move the contents of Rsrc to Rdest.

The multiply and divide unit produces its result in two additional registers, hi and lo. These instructions move values to and from these registers. The multiply, divide, and remainder instructions described above are pseudoinstructions that make it appear as if this unit operates on the general registers and detect error conditions such as divide by zero or overflow.

mfhi RdestMove From hi
mflo RdestMove From lo Move the contents of the hi (lo) register to register Rdest.

mthi RdestMove To hi
mtlo RdestMove To lo Move the contents register Rdest to the hi (lo) register.

Coprocessors have their own register sets. These instructions move values between these registers and the CPU's registers.

mfcz Rdest, CPsrcMove From Coprocessor z Move the contents of coprocessor z's register CPsrc to CPU register Rdest.

mfc1.d Rdest, FRsrc1Move Double From Coprocessor 1 Move the contents of floating point registers FRsrc1 and FRsrc1 + 1 to CPU registers Rdest and Rdest + 1.

mtcz Rsrc, CPdestMove To Coprocessor z Move the contents of CPU register Rsrc to coprocessor z's register CPdest.

2.11  Floating Point Instructions

The MIPS has a floating point coprocessor (numbered 1) that operates on single precision (32-bit) and double precision (64-bit) floating point numbers. This coprocessor has its own registers, which are numbered $f0-$f31. Because these registers are only 32-bits wide, two of them are required to hold doubles. To simplify matters, floating point operations only use even-numbered registers-including instructions that operate on single floats.

Values are moved in or out of these registers a word (32-bits) at a time by lwc1, swc1, mtc1, and mfc1 instructions described above or by the l.s, l.d, s.s, and s.d pseudoinstructions described below. The flag set by floating point comparison operations is read by the CPU with its bc1t and bc1f instructions.

In all instructions below, FRdest, FRsrc1, FRsrc2, and FRsrc are floating point registers (e.g., $f2).

abs.d FRdest, FRsrcFloating Point Absolute Value Double
abs.s FRdest, FRsrcFloating Point Absolute Value Single Compute the absolute value of the floating float double (single) in register FRsrc and put it in register FRdest.

add.d FRdest, FRsrc1, FRsrc2Floating Point Addition Double
add.s FRdest, FRsrc1, FRsrc2Floating Point Addition Single Compute the sum of the floating float doubles (singles) in registers FRsrc1 and FRsrc2 and put it in register FRdest.

c.eq.d FRsrc1, FRsrc2Compare Equal Double
c.eq.s FRsrc1, FRsrc2Compare Equal Single Compare the floating point double in register FRsrc1 against the one in FRsrc2 and set the floating point condition flag true if they are equal.

c.le.d FRsrc1, FRsrc2Compare Less Than Equal Double
c.le.s FRsrc1, FRsrc2Compare Less Than Equal Single Compare the floating point double in register FRsrc1 against the one in FRsrc2 and set the floating point condition flag true if the first is less than or equal to the second.

c.lt.d FRsrc1, FRsrc2Compare Less Than Double
c.lt.s FRsrc1, FRsrc2Compare Less Than Single Compare the floating point double in register FRsrc1 against the one in FRsrc2 and set the condition flag true if the first is less than the second.

cvt.d.s FRdest, FRsrcConvert Single to Double
cvt.d.w FRdest, FRsrcConvert Integer to Double Convert the single precision floating point number or integer in register FRsrc to a double precision number and put it in register FRdest.

cvt.s.d FRdest, FRsrcConvert Double to Single
cvt.s.w FRdest, FRsrcConvert Integer to Single Convert the double precision floating point number or integer in register FRsrc to a single precision number and put it in register FRdest.

cvt.w.d FRdest, FRsrcConvert Double to Integer
cvt.w.s FRdest, FRsrcConvert Single to Integer Convert the double or single precision floating point number in register FRsrc to an integer and put it in register FRdest.

div.d FRdest, FRsrc1, FRsrc2Floating Point Divide Double
div.s FRdest, FRsrc1, FRsrc2Floating Point Divide Single Compute the quotient of the floating float doubles (singles) in registers FRsrc1 and FRsrc2 and put it in register FRdest.

l.d FRdest, addressLoad Floating Point Double
l.s FRdest, addressLoad Floating Point Single Load the floating float double (single) at address into register FRdest.

mov.d FRdest, FRsrcMove Floating Point Double
mov.s FRdest, FRsrcMove Floating Point Single Move the floating float double (single) from register FRsrc to register FRdest.

mul.d FRdest, FRsrc1, FRsrc2Floating Point Multiply Double
mul.s FRdest, FRsrc1, FRsrc2Floating Point Multiply Single Compute the product of the floating float doubles (singles) in registers FRsrc1 and FRsrc2 and put it in register FRdest.

neg.d FRdest, FRsrcNegate Double
neg.s FRdest, FRsrcNegate Single Negate the floating point double (single) in register FRsrc and put it in register FRdest.

s.d FRdest, addressStore Floating Point Double
s.s FRdest, addressStore Floating Point Single Store the floating float double (single) in register FRdest at address.

sub.d FRdest, FRsrc1, FRsrc2Floating Point Subtract Double
sub.s FRdest, FRsrc1, FRsrc2Floating Point Subtract Single Compute the difference of the floating float doubles (singles) in registers FRsrc1 and FRsrc2 and put it in register FRdest.

2.12  Exception and Trap Instructions

rfeReturn From Exception Restore the Status register.

syscallSystem Call Register $v0 contains the number of the system call (see Table 1) provided by SPIM.

break nBreak Cause exception n. Exception 1 is reserved for the debugger.

nopNo operation Do nothing.

3.  Memory Usage

The organization of memory in MIPS systems is conventional. A program's address space is composed of three parts (see Figure 5).

At the bottom of the user address space (0x400000) is the text segment, which holds the instructions for a program.

Above the text segment is the data segment (starting at 0x10000000), which is divided into two parts. The static data portion contains objects whose size and address are known to the compiler and linker. Immediately above these objects is dynamic data. As a program allocates space dynamically (i.e., by malloc), the sbrk system call moves the top of the data segment up.

The program stack resides at the top of the address space (0x7fffffff). It grows down, towards the data segment.

4.  Calling Convention

The calling convention described in this section is the one used by gcc , not the native MIPS compiler, which uses a more complex convention that is slightly faster.

Figure 6 shows a diagram of a stack frame. A frame consists of the memory between the frame pointer ($fp), which points to the word immediately after the last argument passed on the stack, and the stack pointer ($sp), which points to the first free word on the stack. As typical of Unix systems, the stack grows down from higher memory addresses, so the frame pointer is above stack pointer.

The following steps are necessary to effect a call:

1. Pass the arguments. By convention, the first four arguments are passed in registers $a0-$a3 (though simplier compilers may choose to ignore this convention and pass all arguments via the stack). The remaining arguments are pushed on the stack.

2. Save the caller-saved registers. This includes registers $t0-$t9, if they contain live values at the call site.

3. Execute a jal instruction.

Within the called routine, the following steps are necessary:

1. Establish the stack frame by subtracting the frame size from the stack pointer.

2. Save the callee-saved registers in the frame. Register $fp is always saved. Register $ra needs to be saved if the routine itself makes calls. Any of the registers $s0- $s7 that are used by the callee need to be saved.

3. Establish the frame pointer by adding the stack frame size to the address in $sp.

Finally, to return from a call, a function places the returned value into $v0 and executes the following steps:

1. Restore any callee-saved registers that were saved upon entry (including the frame pointer $fp).

2. Pop the stack frame by adding the frame size to $sp.

3. Return by jumping to the address in register $ra.