MIPS32 cheat sheet

The instruction after every branch and jump runs whether or not the branch is taken. Your core squashes it today, so GCC fills every slot with nop (-fno-delayed-branch).

jal, jalr, bgezal and bltzal write the address after the delay slot, not the next word. jr $ra therefore returns past the slot.

$ra is written before the condition is tested. bal label is bgezal $zero,label.

target = (address of the slot) + offset × 4, offset signed 16 bits: about ±128 KB. Relative to PC+4, not to the branch itself.

j and jal: target = top 4 bits of PC+4, then index × 4. A jump cannot leave its 256 MB region; jr/jalr can.

beq and bne are the only two-register branches. blez, bgtz, bltz, bgez compare with zero. a < b needs slt then bnez.

For >, >=, <= swap the operands or add xori rd,rd,1. sltiu rd,rs,1 tests rs == 0.

Reads give 0 and every write is dropped. nop is sll $zero,$zero,0; move rd,rs is or rd,rs,$zero (some assemblers: addu).

add, addi and sub trap on signed overflow; addu, addiu, subu wrap silently. GCC emits only the u forms. Your core does not implement the trap.

addi, addiu, slti, sltiu and every load/store offset sign-extend. andi, ori, xori zero-extend. lui puts the 16 bits in the upper half and zeros the rest.

lui + addiu builds a 32-bit address. If bit 15 of the low half is set, addiu subtracts, so the linker adds 1 to the upper half.

li is addiu (fits 16 signed) or ori (fits 16 unsigned) or lui + ori. la is lui + addiu with %hi/%lo. The dump shows the real words.

sll/srl/sra/rotr take the count from sa, the variable forms from the low 5 bits of rs. The value is always rt. srl and rotr share funct 2 and differ in the rs field (0/1); srlv and rotrv differ in sa.

lb and lh sign-extend, lbu and lhu zero-extend. lw needs a 4-byte aligned address and lh/sh a 2-byte one; misaligned is an address error on real hardware and silently wrong on your core.

The byte at the lowest address is bits 7..0 of the word. sb stores the low byte of rt.

Push is addiu $sp,$sp,-N then sw; $sp stays 8-byte aligned in o32. $fp is register 30, which objdump prints as s8.

Arguments in $a0–$a3 plus a 16-byte argument area the caller always reserves; results in $v0/$v1; $t* and $a* are clobbered by a call; $s*, $sp, $fp, $gp survive it.

mult/multu write the 64-bit product to HI:LO; div/divu put the quotient in LO and the remainder in HI. mul rd,rs,rt writes only the low 32 bits to rd. Divide by zero is undefined.

The old value of rd is a third source: movz rd,rs,rt means rd = (rt == 0) ? rs : rd.

ext rt,rs,pos,size encodes size−1 in the rd field and pos in sa. ins rt,rs,pos,size encodes pos+size−1 in rd and pos in sa. seb/seh keep funct 32 and differ in sa (16/24).

clz rd,rs counts leading zero bits; clo counts leading ones. Both are SPECIAL2 (opcode 28).

The default rd is $ra. rs and rd must differ. jr and jalr targets must be 4-byte aligned.

$at is the assembler’s scratch register (pseudo-instructions may use it). $k0/$k1 belong to the kernel. $gp is set by crt0 but unused with -G0.

Fixed by the architecture. crt0 is placed there by the linker script; it clears the registers, sets $gp and $sp, calls main and stores $v0 to the exit door.

Stores to 0x10003FF0 print a character, 0x10003FF4 an integer, 0x10003FF8 ends the run with an exit code. They are the top 16 bytes of the 16 KB data memory (the 4 KB scenarios use 0x10000FF0…).

objdump prints register names without $, s8 for $30, resolved branch targets with <symbol+offset>, and the aliases move, li, b, nop, beqz, bnez. Only the address and the word are in memory.