P A
A P E N D I X
Assemblers, Linkers, and the SPIM Simulator
James R. Larus Microsoft Research Microsoft
Fear of serious injury cannot alone justify suppression of free speech and assembly.
Louis Brandeis Whitney v. California, 1927
A.1 A.2 A.3 A.4 A.5 A.6 A.7 A.8 A.9 A.10 A.11 A.12
Introduction A-3 Assemblers A-10 Linkers A-18 Loading A-19 Memory Usage A-20 Procedure Call Convention A-22 Exceptions and Interrupts A-33 Input and Output A-38 SPIM A-40 MIPS R2000 Assembly Language A-45 Concluding Remarks A-81 Exercises A-82
A.1
Introduction
A.1
Encoding instructions as binary numbers is natural and efcient for computers. Humans, however, have a great deal of difculty understanding and manipulating these numbers. People read and write symbols (words) much better than long sequences of digits. Chapter 2 showed that we need not choose between numbers and words because computer instructions can be represented in many ways. Humans can write and read symbols, and computers can execute the equivalent binary numbers. This appendix describes the process by which a human-readable program is translated into a form that a computer can execute, provides a few hints about writing assembly programs, and explains how to run these programs on SPIM, a simulator that executes MIPS programs. UNIX, Windows, and Mac OS X versions of the SPIM simulator are available on the CD. Assembly language is the symbolic representation of a computers binary encodingmachine language. Assembly language is more readable than machine language because it uses symbols instead of bits. The symbols in assembly language name commonly occurring bit patterns, such as opcodes and register speciers, so people can read and remember them. In addition, assembly language
machine language Binary representation used for communication within a computer system.
A-4
Appendix A
Assemblers, Linkers, and the SPIM Simulator
Source file
Assembler
Object file
Source file
Assembler
Object file
Linker
Executable file
Source file
Assembler
Object file
Program library
FIGURE A.1.1 The process that produces an executable le. An assembler translates a le of assembly language into an object le, which is linked with other les and libraries into an executable le.
assembler A program that
translates a symbolic version of an instruction into the binary version.
macro A pattern-matching and
replacement facility that provides a simple mechanism to name a frequently used sequence of instructions.
unresolved reference A reference that requires more information from an outside source in order to be complete. linker Also called link editor. A
systems program that combines independently assembled machine language programs and resolves all undefined labels into an executable file.
permits programmers to use labels to identify and name particular memory words that hold instructions or data. A tool called an assembler translates assembly language into binary instructions. Assemblers provide a friendlier representation than a computers 0s and 1s that simplies writing and reading programs. Symbolic names for operations and locations are one facet of this representation. Another facet is programming facilities that increase a programs clarity. For example, macros, discussed in Section A.2, enable a programmer to extend the assembly language by dening new operations. An assembler reads a single assembly language source le and produces an object le containing machine instructions and bookkeeping information that helps combine several object les into a program. Figure A.1.1 illustrates how a program is built. Most programs consist of several lesalso called modules that are written, compiled, and assembled independently. A program may also use prewritten routines supplied in a program library. A module typically contains references to subroutines and data dened in other modules and in libraries. The code in a module cannot be executed when it contains unresolved references to labels in other object les or libraries. Another tool, called a linker, combines a collection of object and library les into an executable le, which a computer can run. To see the advantage of assembly language, consider the following sequence of gures, all of which contain a short subroutine that computes and prints the sum of the squares of integers from 0 to 100. Figure A.1.2 shows the machine language that a MIPS computer executes. With considerable effort, you could use the opcode and instruction format tables in Chapter 2 to translate the instructions into a symbolic program similar to Figure A.1.3. This form of the
A.1
Introduction
A-5
00100111101111011111111111100000 10101111101111110000000000010100 10101111101001000000000000100000 10101111101001010000000000100100 10101111101000000000000000011000 10101111101000000000000000011100 10001111101011100000000000011100 10001111101110000000000000011000 00000001110011100000000000011001 00100101110010000000000000000001 00101001000000010000000001100101 10101111101010000000000000011100 00000000000000000111100000010010 00000011000011111100100000100001 00010100001000001111111111110111 10101111101110010000000000011000 00111100000001000001000000000000 10001111101001010000000000011000 00001100000100000000000011101100 00100100100001000000010000110000 10001111101111110000000000010100 00100111101111010000000000100000 00000011111000000000000000001000 00000000000000000001000000100001 FIGURE A.1.2 MIPS machine language code for a routine to compute and print the sum of the squares of integers between 0 and 100.
routine is much easier to read because operations and operands are written with symbols, rather than with bit patterns. However, this assembly language is still difcult to follow because memory locations are named by their address, rather than by a symbolic label. Figure A.1.4 shows assembly language that labels memory addresses with mnemonic names. Most programmers prefer to read and write this form. Names that begin with a period, for example .data and .globl, are assembler directives that tell the assembler how to translate a program but do not produce machine instructions. Names followed by a colon, such as str or main, are labels that name the next memory location. This program is as readable as most assembly language programs (except for a glaring lack of comments), but it is still difcult to follow because many simple operations are required to accomplish simple tasks and because assembly languages lack of control ow constructs provides few hints about the programs operation. By contrast, the C routine in Figure A.1.5 is both shorter and clearer since variables have mnemonic names and the loop is explicit rather than constructed with branches. In fact, the C routine is the only one that we wrote. The other forms of the program were produced by a C compiler and assembler. In general, assembly language plays two roles (see Figure A.1.6). The rst role is the output language of compilers. A compiler translates a program written in a
assembler directive An operation that tells the assembler how to translate a program but does not produce machine instructions; always begins with a period.
A-6
Appendix A
Assemblers, Linkers, and the SPIM Simulator
addiu sw sw sw sw sw lw lw multu addiu slti sw mflo addu bne sw lui lw jal addiu lw addiu jr move
$29, $29, -32 $31, 20($29) $4, 32($29) $5, 36($29) $0, 24($29) $0, 28($29) $14, 28($29) $24, 24($29) $14, $14 $8, $14, 1 $1, $8, 101 $8, 28($29) $15 $25, $24, $15 $1, $0, -9 $25, 24($29) $4, 4096 $5, 24($29) 1048812 $4, $4, 1072 $31, 20($29) $29, $29, 32 $31 $2, $0
FIGURE A.1.3 The same routine written in assembly language. However, the code for the routine does not label registers or memory locations nor include comments.
source language The highlevel language in which a program is originally written.
high-level language (such as C or Pascal) into an equivalent program in machine or assembly language. The high-level language is called the source language, and the compilers output is its target language. Assembly languages other role is as a language in which to write programs. This role used to be the dominant one. Today, however, because of larger main memories and better compilers, most programmers write in a high-level language and rarely, if ever, see the instructions that a computer executes. Nevertheless, assembly language is still important to write programs in which speed or size are critical or to exploit hardware features that have no analogues in high-level languages. Although this appendix focuses on MIPS assembly language, assembly programming on most other machines is very similar. The additional instructions and address modes in CISC machines, such as the VAX, can make assembly programs shorter but do not change the process of assembling a program or provide assembly language with the advantages of high-level languages such as typechecking and structured control ow.
A.1
Introduction
A-7
.text .align .globl main: subu sw sd sw sw loop: lw mul lw addu sw addu sw ble la lw jal move lw addu jr
2 main $sp, $ra, $a0, $0, $0, $sp, 32 20($sp) 32($sp) 24($sp) 28($sp)
$t6, 28($sp) $t7, $t6, $t6 $t8, 24($sp) $t9, $t8, $t7 $t9, 24($sp) $t0, $t6, 1 $t0, 28($sp) $t0, 100, loop $a0, str $a1, 24($sp) printf $v0, $0 $ra, 20($sp) $sp, $sp, 32 $ra
.data .align str: .asciiz
0 "The sum from 0 .. 100 is %d\n"
FIGURE A.1.4 The same routine written in assembly language with labels, but no comments. The commands that start with periods are assembler directives (see pages A-47A-49). .text indicates that succeeding lines contain instructions. .data indicates that they contain data. .align n indicates that the items on the succeeding lines should be aligned on a 2n byte boundary. Hence, .align 2 means the next item should be on a word boundary. .globl main declares that main is a global symbol that should be visible to code stored in other les. Finally, .asciiz stores a null-terminated string in memory.
When to Use Assembly Language
The primary reason to program in assembly language, as opposed to an available high-level language, is that the speed or size of a program is critically important. For example, consider a computer that controls a piece of machinery, such as a cars brakes. A computer that is incorporated in another device, such as a car, is called an embedded computer. This type of computer needs to respond rapidly and predictably to events in the outside world. Because a compiler introduces uncer-
A-8
Appendix A
Assemblers, Linkers, and the SPIM Simulator
#include <stdio.h> int main (int argc, char *argv[]) { int i; int sum = 0; for (i = 0; i <= 100; i = i + 1) sum = sum + i * i; printf ("The sum from 0 .. 100 is %d\n", sum); } FIGURE A.1.5 The routine written in the C programming language.
High-level language program
Program
Compiler
Assembler
Linker
Computer
Assembly language program
FIGURE A.1.6 compiler.
Assembly language either is written by a programmer or is the output of a
tainty about the time cost of operations, programmers may nd it difcult to ensure that a high-level language program responds within a denite time intervalsay, 1 millisecond after a sensor detects that a tire is skidding. An assembly language programmer, on the other hand, has tight control over which instructions execute. In addition, in embedded applications, reducing a programs size, so that it ts in fewer memory chips, reduces the cost of the embedded computer. A hybrid approach, in which most of a program is written in a high-level language and time-critical sections are written in assembly language, builds on the strengths of both languages. Programs typically spend most of their time executing a small fraction of the programs source code. This observation is just the principle of locality that underlies caches (see Section 7.2 in Chapter 7). Program proling measures where a program spends its time and can nd the time-critical parts of a program. In many cases, this portion of the program can be made faster with better data structures or algorithms. Sometimes, however, signicant performance improvements only come from recoding a critical portion of a program in assembly language.
A.1
Introduction
A-9
This improvement is not necessarily an indication that the high-level languages compiler has failed. Compilers typically are better than programmers at producing uniformly high-quality machine code across an entire program. Programmers, however, understand a programs algorithms and behavior at a deeper level than a compiler and can expend considerable effort and ingenuity improving small sections of the program. In particular, programmers often consider several procedures simultaneously while writing their code. Compilers typically compile each procedure in isolation and must follow strict conventions governing the use of registers at procedure boundaries. By retaining commonly used values in registers, even across procedure boundaries, programmers can make a program run faster. Another major advantage of assembly language is the ability to exploit specialized instructions, for example, string copy or pattern-matching instructions. Compilers, in most cases, cannot determine that a program loop can be replaced by a single instruction. However, the programmer who wrote the loop can replace it easily with a single instruction. Currently, a programmers advantage over a compiler has become difcult to maintain as compilation techniques improve and machines pipelines increase in complexity (Chapter 6). The nal reason to use assembly language is that no high-level language is available on a particular computer. Many older or specialized computers do not have a compiler, so a programmers only alternative is assembly language.
Drawbacks of Assembly Language
Assembly language has many disadvantages that strongly argue against its widespread use. Perhaps its major disadvantage is that programs written in assembly language are inherently machine-specic and must be totally rewritten to run on another computer architecture. The rapid evolution of computers discussed in Chapter 1 means that architectures become obsolete. An assembly language program remains tightly bound to its original architecture, even after the computer is eclipsed by new, faster, and more cost-effective machines. Another disadvantage is that assembly language programs are longer than the equivalent programs written in a high-level language. For example, the C program in Figure A.1.5 is 11 lines long, while the assembly program in Figure A.1.4 is 31 lines long. In more complex programs, the ratio of assembly to high-level language (its expansion factor) can be much larger than the factor of three in this example. Unfortunately, empirical studies have shown that programmers write roughly the same number of lines of code per day in assembly as in high-level languages. This means that programmers are roughly x times more productive in a high-level language, where x is the assembly language expansion factor.
A-10
Appendix A
Assemblers, Linkers, and the SPIM Simulator
To compound the problem, longer programs are more difcult to read and understand and they contain more bugs. Assembly language exacerbates the problem because of its complete lack of structure. Common programming idioms, such as if-then statements and loops, must be built from branches and jumps. The resulting programs are hard to read because the reader must reconstruct every higherlevel construct from its pieces and each instance of a statement may be slightly different. For example, look at Figure A.1.4 and answer these questions: What type of loop is used? What are its lower and upper bounds?
Elaboration: Compilers can produce machine language directly instead of relying on an assembler. These compilers typically execute much faster than those that invoke an assembler as part of compilation. However, a compiler that generates machine language must perform many tasks that an assembler normally handles, such as resolving addresses and encoding instructions as binary numbers. The trade-off is between compilation speed and compiler simplicity.
Elaboration: Despite these considerations, some embedded applications are written in a high-level language. Many of these applications are large and complex programs that must be extremely reliable. Assembly language programs are longer and more difcult to write and read than high-level language programs. This greatly increases the cost of writing an assembly language program and makes it extremely difcult to verify the correctness of this type of program. In fact, these considerations led the Department of Defense, which pays for many complex embedded systems, to develop Ada, a new high-level language for writing embedded systems.
A.2
external label Also called global label. A label referring to an object that can be referenced from files other than the one in which it is defined. local label A label referring to
an object that can be used only within the file in which it is defined.
Assemblers
A.2
An assembler translates a le of assembly language statements into a le of binary machine instructions and binary data. The translation process has two major parts. The rst step is to nd memory locations with labels so the relationship between symbolic names and addresses is known when instructions are translated. The second step is to translate each assembly statement by combining the numeric equivalents of opcodes, register speciers, and labels into a legal instruction. As shown in Figure A.1.1, the assembler produces an output le, called an object le, which contains the machine instructions, data, and bookkeeping information. An object le typically cannot be executed because it references procedures or data in other les. A label is external (also called global) if the labeled object can
A.2
Assemblers
A-11
be referenced from les other than the one in which it is dened. A label is local if the object can be used only within the le in which it is dened. In most assemblers, labels are local by default and must be explicitly declared global. Subroutines and global variables require external labels since they are referenced from many les in a program. Local labels hide names that should not be visible to other modulesfor example, static functions in C, which can only be called by other functions in the same le. In addition, compiler-generated namesfor example, a name for the instruction at the beginning of a loopare local so the compiler need not produce unique names in every le.
Local and Global Labels
Consider the program in Figure A.1.4 on page A-7. The subroutine has an external (global) label main. It also contains two local labelsloop and strthat are only visible with this assembly language le. Finally, the routine also contains an unresolved reference to an external label printf, which is the library routine that prints values. Which labels in Figure A.1.4 could be referenced from another le?
EXAMPLE
Only global labels are visible outside of a le, so the only label that could be referenced from another le is main. Since the assembler processes each le in a program individually and in isolation, it only knows the addresses of local labels. The assembler depends on another tool, the linker, to combine a collection of object les and libraries into an executable le by resolving external labels. The assembler assists the linker by providing lists of labels and unresolved references. However, even local labels present an interesting challenge to an assembler. Unlike names in most high-level languages, assembly labels may be used before they are dened. In the example, in Figure A.1.4, the label str is used by the la instruction before it is dened. The possibility of a forward reference, like this one, forces an assembler to translate a program in two steps: rst nd all labels and then produce instructions. In the example, when the assembler sees the la instruction, it does not know where the word labeled str is located or even whether str labels an instruction or datum.
ANSWER
forward reference A label that
is used before it is defined.
A-12
Appendix A
Assemblers, Linkers, and the SPIM Simulator
An assemblers rst pass reads each line of an assembly le and breaks it into its component pieces. These pieces, which are called lexemes, are individual words, numbers, and punctuation characters. For example, the line
ble $t0, 100, loop
symbol table A table that matches names of labels to the addresses of the memory words that instructions occupy.
contains six lexemes: the opcode ble, the register specier $t0, a comma, the number 100, a comma, and the symbol loop. If a line begins with a label, the assembler records in its symbol table the name of the label and the address of the memory word that the instruction occupies. The assembler then calculates how many words of memory the instruction on the current line will occupy. By keeping track of the instructions sizes, the assembler can determine where the next instruction goes. To compute the size of a variablelength instruction, like those on the VAX, an assembler has to examine it in detail. Fixed-length instructions, like those on MIPS, on the other hand, require only a cursory examination. The assembler performs a similar calculation to compute the space required for data statements. When the assembler reaches the end of an assembly le, the symbol table records the location of each label dened in the le. The assembler uses the information in the symbol table during a second pass over the le, which actually produces machine code. The assembler again examines each line in the le. If the line contains an instruction, the assembler combines the binary representations of its opcode and operands (register speciers or memory address) into a legal instruction. The process is similar to the one used in Section 2.4 in Chapter 2. Instructions and data words that reference an external symbol dened in another le cannot be completely assembled (they are unresolved) since the symbols address is not in the symbol table. An assembler does not complain about unresolved references since the corresponding label is likely to be dened in another le
The Picture
BIG
Assembly language is a programming language. Its principal difference from high-level languages such as BASIC, Java, and C is that assembly language provides only a few, simple types of data and control ow. Assembly language programs do not specify the type of value held in a variable. Instead, a programmer must apply the appropriate operations (e.g., integer or oating-point addition) to a value. In addition, in assembly language, programs must implement all control ow with go tos. Both factors make assembly language programming for any machineMIPS or 80x86 more difcult and error-prone than writing in a high-level language.
A.2
Assemblers
A-13
Elaboration: If an assemblers speed is important, this two-step process can be done in one pass over the assembly le with a technique known as backpatching. In its pass over the le, the assembler builds a (possibly incomplete) binary representation of every instruction. If the instruction references a label that has not yet been dened, the assembler records the label and instruction in a table. When a label is dened, the assembler consults this table to nd all instructions that contain a forward reference to the label. The assembler goes back and corrects their binary representation to incorporate the address of the label. Backpatching speeds assembly because the assembler only reads its input once. However, it requires an assembler to hold the entire binary representation of a program in memory so instructions can be backpatched. This requirement can limit the size of programs that can be assembled. The process is complicated by machines with several types of branches that span different ranges of instructions. When the assembler rst sees an unresolved label in a branch instruction, it must either use the largest possible branch or risk having to go back and readjust many instructions to make room for a larger branch.
backpatching A method for
translating from assembly language to machine instructions in which the assembler builds a (possibly incomplete) binary representation of every instruction in one pass over a program and then returns to fill in previously undefined labels.
Object File Format
Assemblers produce object les. An object le on UNIX contains six distinct sections (see Figure A.2.1):
The object le header describes the size and position of the other pieces of the le. The text segment contains the machine language code for routines in the source le. These routines may be unexecutable because of unresolved references. The data segment contains a binary representation of the data in the source le. The data also may be incomplete because of unresolved references to labels in other les. The relocation information identies instructions and data words that depend on absolute addresses. These references must change if portions of the program are moved in memory. The symbol table associates addresses with external labels in the source le and lists unresolved references. The debugging information contains a concise description of the way in which the program was compiled, so a debugger can nd which instruction addresses correspond to lines in a source le and print the data structures in readable form.
text segment The segment of a
UNIX object file that contains the machine language code for routines in the source file.
data segment The segment of
a UNIX object or executable file that contains a binary representation of the initialized data used by the program.
relocation information The
segment of a UNIX object file that identifies instructions and data words that depend on absolute addresses.
absolute address A variables
or routines actual address in memory.
The assembler produces an object le that contains a binary representation of the program and data and additional information to help link pieces of a pro-
A-14
Appendix A
Assemblers, Linkers, and the SPIM Simulator
Object file header FIGURE A.2.1
Text segment
Data segment
Relocation information
Symbol table
Debugging information
Object le. A UNIX assembler produces an object le with six distinct sections.
gram. This relocation information is necessary because the assembler does not know which memory locations a procedure or piece of data will occupy after it is linked with the rest of the program. Procedures and data from a le are stored in a contiguous piece of memory, but the assembler does not know where this memory will be located. The assembler also passes some symbol table entries to the linker. In particular, the assembler must record which external symbols are dened in a le and what unresolved references occur in a le.
Elaboration: For convenience, assemblers assume each le starts at the same address (for example, location 0) with the expectation that the linker will relocate the code and data when they are assigned locations in memory. The assembler produces relocation information, which contains an entry describing each instruction or data word in the le that references an absolute address. On MIPS, only the subroutine call, load, and store instructions reference absolute addresses. Instructions that use PC-relative addressing, such as branches, need not be relocated.
Additional Facilities
Assemblers provide a variety of convenience features that help make assembler programs short and easier to write, but do not fundamentally change assembly language. For example, data layout directives allow a programmer to describe data in a more concise and natural manner than its binary representation. In Figure A.1.4, the directive
.asciiz The sum from 0 .. 100 is %d\n
stores characters from the string in memory. Contrast this line with the alternative of writing each character as its ASCII value (Figure 2.21 in Chapter 2 describes the ASCII encoding for characters):
.byte .byte .byte .byte 84, 104, 101, 32, 115, 117, 109, 32 102, 114, 111, 109, 32, 48, 32, 46 46, 32, 49, 48, 48, 32, 105, 115 32, 37, 100, 10, 0
The .asciiz directive is easier to read because it represents characters as letters, not binary numbers. An assembler can translate characters to their binary representation much faster and more accurately than a human. Data layout directives
A.2
Assemblers
A-15
specify data in a human-readable form that the assembler translates to binary. Other layout directives are described in Section A.10 on page A-45.
String Directive
Dene the sequence of bytes produced by this directive:
.asciiz The quick brown fox jumps over the lazy dog
EXAMPLE
.byte .byte .byte .byte .byte .byte
84, 107, 102, 115, 104, 100,
104, 32, 111, 32, 101, 111,
101, 98, 120, 111, 32, 103,
32, 114, 32, 118, 108, 0
113, 111, 106, 101, 97,
117, 119, 117, 114, 122,
105, 110, 109, 32, 121,
99 32 112 116 32
ANSWER
Macros are a pattern-matching and replacement facility that provide a simple mechanism to name a frequently used sequence of instructions. Instead of repeatedly typing the same instructions every time they are used, a programmer invokes the macro and the assembler replaces the macro call with the corresponding sequence of instructions. Macros, like subroutines, permit a programmer to create and name a new abstraction for a common operation. Unlike subroutines, however, macros do not cause a subroutine call and return when the program runs since a macro call is replaced by the macros body when the program is assembled. After this replacement, the resulting assembly is indistinguishable from the equivalent program written without macros.
Macros
As an example, suppose that a programmer needs to print many numbers. The library routine printf accepts a format string and one or more values to print as its arguments. A programmer could print the integer in register $7 with the following instructions:
.data int_str: .asciiz%d .text la $a0, int_str # Load string address # into first arg
EXAMPLE
A-16
Appendix A
Assemblers, Linkers, and the SPIM Simulator
mov jal
$a1, $7 # Load value into # second arg printf # Call the printf routine
The .data directive tells the assembler to store the string in the programs data segment, and the .text directive tells the assembler to store the instructions in its text segment. However, printing many numbers in this fashion is tedious and produces a verbose program that is difcult to understand. An alternative is to introduce a macro, print_int, to print an integer:
.data int_str:.asciiz %d .text .macro print_int($arg) la $a0, int_str # Load string address into # first arg mov $a1, $arg # Load macros parameter # ($arg) into second arg jal printf # Call the printf routine .end_macro print_int($7) formal parameter A variable
that is the argument to a procedure or macro; replaced by that argument once the macro is expanded.
The macro has a formal parameter, $arg, that names the argument to the macro. When the macro is expanded, the argument from a call is substituted for the formal parameter throughout the macros body. Then the assembler replaces the call with the macros newly expanded body. In the rst call on print_int, the argument is $7, so the macro expands to the code
la $a0, int_str mov $a1, $7 jal printf
In a second call on print_int, say, print_int($t0), the argument is $t0, so the macro expands to
la $a0, int_str mov $a1, $t0 jal printf
What does the call print_int($a0) expand to?
A.2
Assemblers
A-17
la $a0, int_str mov $a1, $a0 jal printf
ANSWER
This example illustrates a drawback of macros. A programmer who uses this macro must be aware that print_int uses register $a0 and so cannot correctly print the value in that register.
Some assemblers also implement pseudoinstructions, which are instructions provided by an assembler but not implemented in hardware. Chapter 2 contains many examples of how the MIPS assembler synthesizes pseudoinstructions and addressing modes from the spartan MIPS hardware instruction set. For example, Section 2.6 in Chapter 2 describes how the assembler synthesizes the blt instruction from two other instructions: slt and bne. By extending the instruction set, the MIPS assembler makes assembly language programming easier without complicating the hardware. Many pseudoinstructions could also be simulated with macros, but the MIPS assembler can generate better code for these instructions because it can use a dedicated register ($at) and is able to optimize the generated code.
Hardware Software Interface
Elaboration: Assemblers conditionally assemble pieces of code, which permits a programmer to include or exclude groups of instructions when a program is assembled. This feature is particularly useful when several versions of a program differ by a small amount. Rather than keep these programs in separate leswhich greatly complicates xing bugs in the common codeprogrammers typically merge the versions into a single le. Code particular to one version is conditionally assembled, so it can be excluded when other versions of the program are assembled. If macros and conditional assembly are useful, why do assemblers for UNIX systems rarely, if ever, provide them? One reason is that most programmers on these systems write programs in higher-level languages like C. Most of the assembly code is produced by compilers, which nd it more convenient to repeat code rather than dene macros. Another reason is that other tools on UNIXsuch as cpp, the C preprocessor, or m4, a general macro processorcan provide macros and conditional assembly for assembly language programs.
A-18
Appendix A
Assemblers, Linkers, and the SPIM Simulator
A.3
separate compilation Splitting a program across many files, each of which can be compiled without knowledge of what is in the other files.
Linkers
A.3
Separate compilation permits a program to be split into pieces that are stored in different les. Each le contains a logically related collection of subroutines and data structures that form a module in a larger program. A le can be compiled and assembled independently of other les, so changes to one module do not require recompiling the entire program. As we discussed above, separate compilation necessitates the additional step of linking to combine object les from separate modules and x their unresolved references. The tool that merges these les is the linker (see Figure A.3.1). It performs three tasks:
Searches the program libraries to nd library routines used by the program Determines the memory locations that code from each module will occupy and relocates its instructions by adjusting absolute references Resolves references among les
A linkers rst task is to ensure that a program contains no undened labels. The linker matches the external symbols and unresolved references from a programs les. An external symbol in one le resolves a reference from another le if both refer to a label with the same name. Unmatched references mean a symbol was used, but not dened anywhere in the program. Unresolved references at this stage in the linking process do not necessarily mean a programmer made a mistake. The program could have referenced a library routine whose code was not in the object les passed to the linker. After matching symbols in the program, the linker searches the systems program libraries to nd predened subroutines and data structures that the program references. The basic libraries contain routines that read and write data, allocate and deallocate memory, and perform numeric operations. Other libraries contain routines to access a database or manipulate terminal windows. A program that references an unresolved symbol that is not in any library is erroneous and cannot be linked. When the program uses a library routine, the linker extracts the routines code from the library and incorporates it into the program text segment. This new routine, in turn, may depend on other library routines, so the linker continues to fetch other library routines until no external references are unresolved or a routine cannot be found. If all external references are resolved, the linker next determines the memory locations that each module will occupy. Since the les were assembled in isolation,
A.4
Loading
A-19
Object file sub:
Object file Instructions main: jal ??? jal ??? call, sub call, printf
Executable file main: jal printf jal sub printf: sub:
Linker
Relocation records
C library print:
FIGURE A.3.1 The linker searches a collection of object les and program libraries to nd nonlocal routines used in a program, combines them into a single executable le, and resolves references between routines in different les.
the assembler could not know where a modules instructions or data will be placed relative to other modules. When the linker places a module in memory, all absolute references must be relocated to reect its true location. Since the linker has relocation information that identies all relocatable references, it can efciently nd and backpatch these references. The linker produces an executable le that can run on a computer. Typically, this le has the same format as an object le, except that it contains no unresolved references or relocation information.
A.4
Loading
A.4
A program that links without an error can be run. Before being run, the program resides in a le on secondary storage, such as a disk. On UNIX systems, the oper-
A-20
Appendix A
Assemblers, Linkers, and the SPIM Simulator
ating system kernel brings a program into memory and starts it running. To start a program, the operating system performs the following steps: 1. Reads the executable les header to determine the size of the text and data segments. 2. Creates a new address space for the program. This address space is large enough to hold the text and data segments, along with a stack segment (see Section A.5). 3. Copies instructions and data from the executable le into the new address space. 4. Copies arguments passed to the program onto the stack. 5. Initializes the machine registers. In general, most registers are cleared, but the stack pointer must be assigned the address of the rst free stack location (see Section A.5). 6. Jumps to a start-up routine that copies the programs arguments from the stack to registers and calls the programs main routine. If the main routine returns, the start-up routine terminates the program with the exit system call.
A.5
Memory Usage
A.5
static data The portion of memory that contains data whose size is known to the compiler and whose lifetime is the programs entire execution.
The next few sections elaborate the description of the MIPS architecture presented earlier in the book. Earlier chapters focused primarily on hardware and its relationship with low-level software. These sections focus primarily on how assembly language programmers use MIPS hardware. These sections describe a set of conventions followed on many MIPS systems. For the most part, the hardware does not impose these conventions. Instead, they represent an agreement among programmers to follow the same set of rules so that software written by different people can work together and make effective use of MIPS hardware. Systems based on MIPS processors typically divide memory into three parts (see Figure A.5.1). The rst part, near the bottom of the address space (starting at address 400000hex), is the text segment, which holds the programs instructions. The second part, above the text segment, is the data segment, which is further divided into two parts. Static data (starting at address 10000000hex) contains objects whose size is known to the compiler and whose lifetimethe interval during which a program can access themis the programs entire execution. For example, in C, global variables are statically allocated since they can be referenced
A.5
Memory Usage
A-21
7fff fffchex Stack segment
Dynamic data Static data 10000000hex
Data segment Text segment
400000hex
Reserved
FIGURE A.5.1
Layout of memory.
Because the data segment begins far above the program at address 10000000hex, load and store instructions cannot directly reference data objects with their 16-bit offset elds (see Section 2.4 in Chapter 2). For example, to load the word in the data segment at address 10010020hex into register $v0 requires two instructions:
lui lw $s0, 0x1001 # 0x1001 means 1001 base 16 $v0, 0x0020($s0) # 0x10010000 + 0x0020 = 0x10010020
Hardware Software Interface
(The 0x before a number means that it is a hexadecimal value. For example, 0x8000 is 8000hex or 32,768ten.) To avoid repeating the lui instruction at every load and store, MIPS systems typically dedicate a register ($gp) as a global pointer to the static data segment. This register contains address 10008000hex, so load and store instructions can use their signed 16-bit offset elds to access the rst 64 KB of the static data segment. With this global pointer, we can rewrite the example as a single instruction:
lw $v0, 0x8020($gp)
Of course, a global pointer register makes addressing locations 10000000hex 10010000hex faster than other heap locations. The MIPS compiler usually stores global variables in this area because these variables have xed locations and t better than other global data, such as arrays.
A-22
Appendix A
Assemblers, Linkers, and the SPIM Simulator
stack segment The portion of
memory used by a program to hold procedure call frames.
anytime during a programs execution. The linker both assigns static objects to locations in the data segment and resolves references to these objects. Immediately above static data is dynamic data. This data, as its name implies, is allocated by the program as it executes. In C programs, the malloc library routine nds and returns a new block of memory. Since a compiler cannot predict how much memory a program will allocate, the operating system expands the dynamic data area to meet demand. As the upward arrow in the gure indicates, malloc expands the dynamic area with the sbrk system call, which causes the operating system to add more pages to the programs virtual address space (see Section 7.4 in Chapter 7) immediately above the dynamic data segment. The third part, the program stack segment, resides at the top of the virtual address space (starting at address 7fffffffhex). Like dynamic data, the maximum size of a programs stack is not known in advance. As the program pushes values on the stack, the operating system expands the stack segment down, toward the data segment. This three-part division of memory is not the only possible one. However, it has two important characteristics: the two dynamically expandable segments are as far apart as possible, and they can grow to use a programs entire address space.
A.6
Procedure Call Convention
A.6
register-use convention Also called procedure call convention. A software protocol governing the use of registers by procedures.
Conventions governing the use of registers are necessary when procedures in a program are compiled separately. To compile a particular procedure, a compiler must know which registers it may use and which registers are reserved for other procedures. Rules for using registers are called register use or procedure call conventions. As the name implies, these rules are, for the most part, conventions followed by software rather than rules enforced by hardware. However, most compilers and programmers try very hard to follow these conventions because violating them causes insidious bugs. The calling convention described in this section is the one used by the gcc compiler. The native MIPS compiler uses a more complex convention that is slightly faster. The MIPS CPU contains 32 general-purpose registers that are numbered 031. Register $0 always contains the hardwired value 0.
Registers $at (1), $k0 (26), and $k1 (27) are reserved for the assembler and operating system and should not be used by user programs or compilers. Registers $a0$a3 (47) are used to pass the rst four arguments to routines (remaining arguments are passed on the stack). Registers $v0 and $v1 (2, 3) are used to return values from functions.
A.6
Procedure Call Convention
A-23
Registers $t0$t9 (815, 24, 25) are caller-saved registers that are used to hold temporary quantities that need not be preserved across calls (see Section 2.7 in Chapter 2). Registers $s0$s7 (1623) are callee-saved registers that hold long-lived values that should be preserved across calls. Register $gp (28) is a global pointer that points to the middle of a 64K block of memory in the static data segment. Register $sp (29) is the stack pointer, which points to the last location on the stack. Register $fp (30) is the frame pointer. The jal instruction writes register $ra (31), the return address from a procedure call. These two registers are explained in the next section.
caller-saved register A register saved by the routine being called. callee-saved register A register saved by the routine making a procedure call.
The two-letter abbreviations and names for these registersfor example, $sp for the stack pointerreect the registers intended uses in the procedure call convention. In describing this convention, we will use the names instead of register numbers. Figure A.6.1 lists the registers and describes their intended uses.
Procedure Calls
This section describes the steps that occur when one procedure (the caller) invokes another procedure (the callee). Programmers who write in a high-level language (like C or Pascal) never see the details of how one procedure calls another because the compiler takes care of this low-level bookkeeping. However, assembly language programmers must explicitly implement every procedure call and return. Most of the bookkeeping associated with a call is centered around a block of memory called a procedure call frame. This memory is used for a variety of purposes:
To hold values passed to a procedure as arguments To save registers that a procedure may modify, but which the procedures caller does not want changed To provide space for variables local to a procedure
procedure call frame A block of memory that is used to hold values passed to a procedure as arguments, to save registers that a procedure may modify but that the procedures caller does not want changed, and to provide space for variables local to a procedure.
In most programming languages, procedure calls and returns follow a strict last-in, rst-out (LIFO) order, so this memory can be allocated and deallocated on a stack, which is why these blocks of memory are sometimes called stack frames. Figure A.6.2 shows a typical stack frame. The frame consists of the memory between the frame pointer ($fp), which points to the rst word of the frame, and the stack pointer ($sp), which points to the last word of the frame. The stack grows down from higher memory addresses, so the frame pointer points above
A-24
Appendix A
Assemblers, Linkers, and the SPIM Simulator
Register name $zero $at $v0 $v1 $a0 $a1 $a2 $a3 $t0 $t1 $t2 $t3 $t4 $t5 $t6 $t7 $s0 $s1 $s2 $s3 $s4 $s5 $s6 $s7 $t8 $t9 $k0 $k1 $gp $sp $fp $ra FIGURE A.6.1
Number
00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Usage
constant 0 reserved for assembler expression evaluation and results of a function expression evaluation and results of a function argument 1 argument 2 argument 3 argument 4 temporary (not preserved across call) temporary (not preserved across call) temporary (not preserved across call) temporary (not preserved across call) temporary (not preserved across call) temporary (not preserved across call) temporary (not preserved across call) temporary (not preserved across call) saved temporary (preserved across call) saved temporary (preserved across call) saved temporary (preserved across call) saved temporary (preserved across call) saved temporary (preserved across call) saved temporary (preserved across call) saved temporary (preserved across call) saved temporary (preserved across call) temporary (not preserved across call) temporary (not preserved across call) reserved for OS kernel reserved for OS kernel pointer to global area stack pointer frame pointer return address (used by function call)
MIPS registers and usage convention.
the stack pointer. The executing procedure uses the frame pointer to quickly access values in its stack frame. For example, an argument in the stack frame can be loaded into register $v0 with the instruction
lw $v0, 0($fp)
A.6
Procedure Call Convention
A-25
Higher memory addresses Argument 6 Argument 5 $fp Saved registers
Stack grows Local variables
$sp
Lower memory addresses
FIGURE A.6.2 Layout of a stack frame. The frame pointer ($fp) points to the rst word in the currently executing procedures stack frame. The stack pointer ($sp) points to the last word of frame. The rst four arguments are passed in registers, so the fth argument is the rst one stored on the stack.
A stack frame may be built in many different ways; however, the caller and callee must agree on the sequence of steps. The steps below describe the calling convention used on most MIPS machines. This convention comes into play at three points during a procedure call: immediately before the caller invokes the callee, just as the callee starts executing, and immediately before the callee returns to the caller. In the rst part, the caller puts the procedure call arguments in standard places and invokes the callee to do the following: 1. Pass arguments. By convention, the rst four arguments are passed in registers $a0$a3. Any remaining arguments are pushed on the stack and appear at the beginning of the called procedures stack frame. 2. Save caller-saved registers. The called procedure can use these registers ($a0$a3 and $t0$t9) without rst saving their value. If the caller expects to use one of these registers after a call, it must save its value before the call. 3. Execute a jal instruction (see Section 2.7 of Chapter 2), which jumps to the callees rst instruction and saves the return address in register $ra.
A-26
Appendix A
Assemblers, Linkers, and the SPIM Simulator
Before a called routine starts running, it must take the following steps to set up its stack frame: 1. Allocate memory for the frame by subtracting the frames size from the stack pointer. 2. Save callee-saved registers in the frame. A callee must save the values in these registers ($s0$s7, $fp, and $ra) before altering them since the caller expects to nd these registers unchanged after the call. Register $fp is saved by every procedure that allocates a new stack frame. However, register $ra only needs to be saved if the callee itself makes a call. The other calleesaved registers that are used also must be saved. 3. Establish the frame pointer by adding the stack frames size minus 4 to $sp and storing the sum in register $fp.
Hardware Software Interface
The MIPS register use convention provides callee- and caller-saved registers because both types of registers are advantageous in different circumstances. Callee-saved registers are better used to hold long-lived values, such as variables from a users program. These registers are only saved during a procedure call if the callee expects to use the register. On the other hand, caller-saved registers are better used to hold short-lived quantities that do not persist across a call, such as immediate values in an address calculation. During a call, the callee can also use these registers for short-lived temporaries.
Finally, the callee returns to the caller by executing the following steps: 1. If the callee is a function that returns a value, place the returned value in register $v0. 2. Restore all callee-saved registers that were saved upon procedure entry. 3. Pop the stack frame by adding the frame size to $sp. 4. Return by jumping to the address in register $ra.
recursive procedures
Procedures that call themselves either directly or indirectly through a chain of calls.
Elaboration: A programming language that does not permit recursive procedures procedures that call themselves either directly or indirectly through a chain of callsneed not allocate frames on a stack. In a nonrecursive language, each procedures frame may be statically allocated since only one invocation of a procedure can be active at a time. Older versions of Fortran prohibited recursion because statically allocated frames produced faster code on some older machines. However, on load-store architectures like MIPS, stack frames may be just as fast because a frame pointer register points directly to
A.6
Procedure Call Convention
A-27
the active stack frame, which permits a single load or store instruction to access values in the frame. In addition, recursion is a valuable programming technique.
Procedure Call Example
As an example, consider the C routine
main () { printf ("The factorial of 10 is %d\n", fact (10)); } int fact (int n) { if (n < 1) return (1); else return (n * fact (n - 1)); }
which computes and prints 10! (the factorial of 10, 10! = 10 9 . . . 1). fact is a recursive routine that computes n! by multiplying n times (n 1)!. The assembly code for this routine illustrates how programs manipulate stack frames. Upon entry, the routine main creates its stack frame and saves the two calleesaved registers it will modify: $fp and $ra. The frame is larger than required for these two registers because the calling convention requires the minimum size of a stack frame to be 24 bytes. This minimum frame can hold four argument registers ($a0$a3) and the return address $ra, padded to a double-word boundary (24 bytes). Since main also needs to save $fp, its stack frame must be two words larger (remember: the stack pointer is kept doubleword aligned).
.text .globl main main: subu $sp,$sp,32 sw $ra,20($sp) sw $fp,16($sp) addiu $fp,$sp,28
# # # #
Stack frame is 32 bytes long Save return address Save old frame pointer Set up frame pointer
The routine main then calls the factorial routine and passes it the single argument 10. After fact returns, main calls the library routine printf and passes it both a format string and the result returned from fact:
A-28
Appendix A
Assemblers, Linkers, and the SPIM Simulator
li jal la move jal
$a0,10 fact $a0,$LC $a1,$v0 printf
# Put argument (10) in $a0 # Call factorial function # Put format string in $a0 # Move fact result to $a1 # Call the print function
Finally, after printing the factorial, main returns. But rst, it must restore the registers it saved and pop its stack frame:
lw lw addiu jr .rdata $LC: .ascii $ra,20($sp) $fp,16($sp) $sp,$sp,32 $ra # # # # Restore return address Restore frame pointer Pop stack frame Return to caller
The factorial of 10 is %d\n\000
The factorial routine is similar in structure to main. First, it creates a stack frame and saves the callee-saved registers it will use. In addition to saving $ra and $fp, fact also saves its argument ($a0), which it will use for the recursive call:
.text fact: subu sw sw addiu sw
$sp,$sp,32 $ra,20($sp) $fp,16($sp) $fp,$sp,28 $a0,0($fp)
# # # # #
Stack frame is 32 bytes long Save return address Save frame pointer Set up frame pointer Save argument (n)
The heart of the fact routine performs the computation from the C program. It tests if the argument is greater than 0. If not, the routine returns the value 1. If the argument is greater than 0, the routine recursively calls itself to compute fact(n-1) and multiplies that value times n:
lw bgtz li jr $L2: lw subu move $v0,0($fp) $v0,$L2 $v0,1 $L1 # # # # Load n Branch if n > 0 Return 1 Jump to code to return
$v1,0($fp) $v0,$v1,1 $a0,$v0
# Load n # Compute n - 1 # Move value to $a0
A.6
Procedure Call Convention
A-29
jal lw mul
fact $v1,0($fp) $v0,$v0,$v1
# Call factorial function # Load n # Compute fact(n-1) * n
Finally, the factorial routine restores the callee-saved registers and returns the value in register $v0:
$L1: lw lw addiu jr $ra, 20($sp) $fp, 16($sp) $sp, $sp, 32 $ra # # # # # Result is in $v0 Restore $ra Restore $fp Pop stack Return to caller
Stack in Recursive Procedure
Figure A.6.3 shows the stack at the call fact(7). main runs rst, so its frame is deepest on the stack. main calls fact(10), whose stack frame is next on the stack. Each invocation recursively invokes fact to compute the next-lowest factorial. The stack frames parallel the LIFO order of these calls. What does the stack look like when the call to fact(10) returns?
Stack Old $ra Old $fp
EXAMPLE
main
Old $a0 Old $ra Old $fp Old $a0 Old $ra Old $fp Old $a0 Old $ra Old $fp Old $a0 Old $ra Old $fp
fact (10)
fact (9)
fact (8)
Stack grows fact (7)
FIGURE A.6.3
Stack frames during the call of fact(7).
A-30
Appendix A
Assemblers, Linkers, and the SPIM Simulator
ANSWER
Stack Old $ra Old $fp
main
Stack grows
Elaboration: The difference between the MIPS compiler and the gcc compiler is that the MIPS compiler usually does not use a frame pointer, so this register is available as another callee-saved register, $s8. This change saves a couple of instructions in the procedure call and return sequence. However, it complicates code generation because a procedure must access its stack frame with $sp, whose value can change during a procedures execution if values are pushed on the stack.
Another Procedure Call Example
As another example, consider the following routine that computes the tak function, which is a widely used benchmark created by Ikuo Takeuchi. This function does not compute anything useful, but is a heavily recursive program that illustrates the MIPS calling convention.
int tak (int x, int y, int z) { if (y < x) return 1+ tak (tak (x - 1, y, z), tak (y - 1, z, x), tak (z - 1, x, y)); else return z; } int main () { tak(18, 12, 6); }
The assembly code for this program is below. The tak function rst saves its return address in its stack frame and its arguments in callee-saved registers, since the routine may make calls that need to use registers $a0$a2 and $ra. The function uses callee-saved registers since they hold values that persist over
A.6
Procedure Call Convention
A-31
the lifetime of the function, which includes several calls that could potentially modify registers.
.text .globl tak: subu sw sw move sw move sw move sw tak
$sp, $sp, 40 $ra, 32($sp) $s0, $s0, $s1, $s1, $s2, $s2, $s3, 16($sp) $a0 20($sp) $a1 24($sp) $a2 28($sp) #x #y #z # temporary
The routine then begins execution by testing if y < x. If not, it branches to label L1, which is below.
bge $s1, $s0, L1 # if (y < x)
If y < x, then it executes the body of the routine, which contains four recursive calls. The rst call uses almost the same arguments as its parent:
addiu move move jal move $a0, $a1, $a2, tak $s3, $s0, -1 $s1 $s2 # tak (x - 1, y, z) $v0
Note that the result from the rst recursive call is saved in register $s3, so that it can be used later. The function now prepares arguments for the second recursive call.
addiu move move jal $a0, $s1, -1 $a1, $s2 $a2, $s0 tak
# tak (y - 1, z, x)
In the instructions below, the result from this recursive call is saved in register $s0. But, rst we need to read, for the last time, the saved value of the rst argument from this register.
A-32
Appendix A
Assemblers, Linkers, and the SPIM Simulator
addiu move move move jal
$a0, $a1, $a2, $s0, tak
$s2, -1 $s0 $s1 $v0 # tak (z - 1, x, y)
After the three inner recursive calls, we are ready for the nal recursive call. After the call, the functions result is in $v0 and control jumps to the functions epilogue.
move move move jal addiu j $a0, $a1, $a2, tak $v0, L2 $s3 $s0 $v0 # tak (tak(...), tak(...), tak(...)) $v0, 1
This code at label L1 is the consequent of the if-then-else statement. It just moves the value of argument z into the return register and falls into the function epilogue.
L1: move $v0, $s2
The code below is the function epilogue, which restores the saved registers and returns the functions result to its caller.
L2: lw lw lw lw lw addiu jr $ra, $s0, $s1, $s2, $s3, $sp, $ra 32($sp) 16($sp) 20($sp) 24($sp) 28($sp) $sp, 40
The main routine calls the tak function with its initial arguments, then takes the computed result (7) and prints it using SPIMs system call for printing integers.
.globl main: subu sw li li main $sp, $sp, 24 $ra, 16($sp) $a0, 18 $a1, 12
A.7
Exceptions and Interrupts
A-33
li jal move li syscall lw addiu jr
$a2, 6 tak $a0, $v0 $v0, 1
# tak(18, 12, 6)
# print_int syscall
$ra, 16($sp) $sp, $sp, 24 $ra
A.7
Exceptions and Interrupts
A.7
Section 5.6 of Chapter 5 describes the MIPS exception facility, which responds both to exceptions caused by errors during an instructions execution and to external interrupts caused by I/O devices. This section describes exception and interrupt handling in more detail.1 In MIPS processors, a part of the CPU called coprocessor 0 records the information that software needs to handle exceptions and interrupts. The MIPS simulator SPIM does not implement all of coprocessor 0s registers, since many are not useful in a simulator or are part of the memory system, which SPIM does not model. However, SPIM does provide the following coprocessor 0 registers:
Register name
BadVAddr Count Compare Status Cause EPC Config
interrupt handler A piece of code that is run as a result of an exception or an interrupt.
Register number
8 9 11 12 13 14 16
Usage
memory address at which an offending memory reference occurred timer value compared against timer that causes interrupt when they match interrupt mask and enable bits exception type and pending interrupt bits address of instruction that caused exception configuration of machine
1. This section discusses exceptions in the MIPS32 architecture, which is what SPIM implements in Version 7.0 and later. Earlier versions of SPIM implemented the MIPS-I architecture, which handled exceptions slightly differently. Converting programs from these versions to run on MIPS32 should not be difficult, as the changes are limited to the Status and Cause register fields and the replacement of the rfe instruction by the eret instruction.
A-34
Appendix A
Assemblers, Linkers, and the SPIM Simulator
These seven registers are part of coprocessor 0s register set. They are accessed by the mfc0 and mtc0 instructions. After an exception, register EPC contains the address of the instruction that was executing when the exception occurred. If the exception was caused by an external interrupt, then the instruction will not have started executing. All other exceptions are caused by the execution of the instruction at EPC, except when the offending instruction is in the delay slot of a branch or jump. In that case, EPC points to the branch or jump instruction and the BD bit is set in the Cause register. When that bit is set, the exception handler must look at EPC + 4 for the offending instruction. However, in either case, an exception handler properly resumes the program by returning to the instruction at EPC. If the instruction that caused the exception made a memory access, register BadVAddr contains the referenced memory locations address. The Count register is a timer that increments at a xed rate (by default, every 10 milliseconds) while SPIM is running. When the value in the Count register equals the value in the Compare register, a hardware interrupt at priority level 5 occurs. Figure A.7.1 shows the subset of the Status register elds implemented by the MIPS simulator SPIM. The interrupt mask eld contains a bit for each of the six hardware and two software interrupt levels. A mask bit that is 1 allows interrupts at that level to interrupt the processor. A mask bit that is 0 disables interrupts at that level. When an interrupt arrives, it sets its interrupt pending bit in the Cause register, even if the mask bit is disabled. When an interrupt is pending, it will interrupt the processor when its mask bit is subsequently enabled. The user mode bit is 0 if the processor is running in kernel mode and 1 if it is running in user mode. On SPIM, this bit is xed at 1, since the SPIM processor does not implement kernel mode. The exception level bit is normally 0, but is set to 1 after an exception occurs. When this bit is 1, interrupts are disabled and the EPC is not updated if another exception occurs. This bit prevents an exception
15
8
4
Interrupt mask FIGURE A.7.1 The Status register.
Exception level Interrupt enable 1 0
User mode
A.7
Exceptions and Interrupts
A-35
31
15
8
6
2
Branch delay FIGURE A.7.2 The Cause register.
Pending interrupts
Exception code
handler from being disturbed by an interrupt or exception, but it should be reset when the handler nishes. If the interrupt enable bit is 1, interrupts are allowed. If it is 0, they are disabled. Figure A.7.2 shows the subset of Cause register elds that SPIM implements. The branch delay bit is 1 if the last exception occurred in an instruction executed in the delay slot of a branch. The interrupt pending bits become 1 when an interrupt is raised at a given hardware or software level. The exception code register describes the cause of an exception through the following codes:
Number
00 04 05 06 07 08 09 10 11 12 13 15
Name
Int AdEL AdES IBE DBE Sys Bp RI CpU Ov Tr FPE
Cause of exception
interrupt (hardware) address error exception (load or instruction fetch) address error exception (store) bus error on instruction fetch bus error on data load or store syscall exception breakpoint exception reserved instruction exception coprocessor unimplemented arithmetic overflow exception trap floating point
Exceptions and interrupts cause a MIPS processor to jump to a piece of code, at address 80000180hex (in the kernel, not user address space), called an exception handler. This code examines the exceptions cause and jumps to an appropriate point in the operating system. The operating system responds to an exception either by terminating the process that caused the exception or by performing some action. A process that causes an error, such as executing an unimplemented instruction, is killed by the operating system. On the other hand, other exceptions such as page faults are requests from a process to the operating system to perform a service, such as bringing in a page from disk. The operating system processes
A-36
Appendix A
Assemblers, Linkers, and the SPIM Simulator
these requests and resumes the process. The nal type of exceptions are interrupts from external devices. These generally cause the operating system to move data to or from an I/O device and resume the interrupted process. The code in the example below is a simple exception handler, which invokes a routine to print a message at each exception (but not interrupts). This code is similar to the exception handler (exceptions.s) used by the SPIM simulator.
Exception Handler
EXAMPLE
The exception handler rst saves register $at, which is used in pseudoinstructions in the handler code, then saves $a0 and $a1, which it later to uses pass arguments. The exception handler cannot store the old values from these registers on the stack, as would an ordinary routine, because the cause of the exception might have been a memory reference that used a bad value (such as 0) in the stack pointer. Instead, the exception handler stores these registers in an exception handler register ($k1, since it cant access memory without using $at) and two memory locations (save0 and save1). If the exception routine itself could be interrupted, two locations would not be enough since the second exception would overwrite values saved during the rst exception. However, this simple exception handler nishes running before it enables interrupts, so the problem does not arise.
.ktext 0x80000180 mov $k1, $at # Save $at register sw $a0, save0 # Handler is not re-entrant and cant use sw $a1, save1 # stack to save $a0, $a1 # Dont need to save $k0/$k1
The exception handler then moves the Cause and EPC registers into CPU registers. The Cause and EPC registers are not part of the CPU register set. Instead, they are registers in coprocessor 0, which is the part of the CPU that handles exceptions. The instruction mfc0 $k0, $13 moves coprocessor 0s register 13 (the Cause register) into CPU register $k0. Note that the exception handler need not save registers $k0 and $k1 because user programs are not supposed to use these registers. The exception handler uses the value from the Cause register to test if the exception was caused by an interrupt (see the preceding table). If so, the exception is ignored. If the exception was not an interrupt, the handler calls print_excp to print a message.
A.7
Exceptions and Interrupts
A-37
mfc0 srl andi bgtz
$k0, $13 $a0, $k0, 2 $a0, $a0, 0xf $a0, done
# Move Cause into $k0 # Extract ExcCode field
# Branch if ExcCode is Int (0)
mov mfc0 jal
$a0, $k0 $a1, $14 print_excp
# Move Cause into $a0 # Move EPC into $a1 # Print exception error message
Before returning, the exception handler clears the Cause register; resets the Status register to enable interrupts and clear the EXL bit, which allows subsequent exceptions to change the EPC register; and restores registers $a0, $a1, and $at. It then executes the eret (exception return) instruction, which returns to the instruction pointed to by EPC. This exception handler returns to the instruction following the one that caused the exception, so as to not reexecute the faulting instruction and cause the same exception again.
done: mfc0 addiu mtc0 mtc0 mfc0 andi ori mtc0 lw lw mov eret .kdata save0: .word 0 save1: .word 0 $k0, $14 $k0, $k0, 4 $k0, $14 $0, $13 $k0, $k0, $k0, $k0, $12 0xfffd 0x1 $12 # # # # Bump EPC Do not reexecute faulting instruction EPC
# Clear Cause register # Fix Status register # Clear EXL bit # Enable interrupts # Restore registers
$a0, save0 $a1, save1 $at, $k1
# Return to EPC
A-38
Appendix A
Assemblers, Linkers, and the SPIM Simulator
Elaboration: On real MIPS processors, the return from an exception handler is more complex. The exception handler cannot always jump to the instruction following EPC. For example, if the instruction that caused the exception was in a branch instructions delay slot (see Chapter 6), the next instruction to execute may not be the following instruction in memory.
A.8
Input and Output
A.8
SPIM simulates one I/O device: a memory-mapped console on which a program can read and write characters. When a program is running, SPIM connects its own terminal (or a separate console window in the X-window version xspim or the Windows version PCSpim) to the processor. A MIPS program running on SPIM can read the characters that you type. In addition, if the MIPS program writes characters to the terminal, they appear on SPIMs terminal or console window. One exception to this rule is control-C: this character is not passed to the program, but instead causes SPIM to stop and return to command mode. When the program stops running (for example, because you typed control-C or because the program hit a breakpoint), the terminal is reconnected to SPIM so you can type SPIM commands. To use memory-mapped I/O (see below), spim or xspim must be started with the -mapped_io ag. PCSpim can enable memory-mapped I/O through a command line ag or the "Settings" dialog. The terminal device consists of two independent units: a receiver and a transmitter. The receiver reads characters typed on the keyboard. The transmitter display characters on the console. The two units are completely independent. This means, for example, that characters typed at the keyboard are not automatically echoed on the display. Instead, a program echoes a character by reading it from the receiver and writing it to the transmitter. A program controls the terminal with four memory-mapped device registers, as shown in Figure A.8.1. Memory-mapped means that each register appears as a special memory location. The Receiver Control register is at location ffff0000hex. Only two of its bits are actually used. Bit 0 is called ready: if it is 1, it means that a character has arrived from the keyboard but has not yet been read from the Receiver Data register. The ready bit is read-only: writes to it are ignored. The ready bit changes from 0 to 1 when a character is typed at the keyboard, and it changes from 1 to 0 when the character is read from the Receiver Data register.
A.8
Input and Output
A-39
Unused Receiver control (0xffff0000) Interrupt enable Unused Receiver data (0xffff0004)
1
1
Ready
8
Received byte
Unused Transmitter control (0xffff0008) Interrupt enable Unused Transmitter data (0xffff000c)
1
1
Ready
8
Transmitted byte FIGURE A.8.1 The terminal is controlled by four device registers, each of which appears as a memory location at the given address. Only a few bits of these registers are actually used. The others always read as 0s and are ignored on writes.
Bit 1 of the Receiver Control register is the keyboard interrupt enable. This bit may be both read and written by a program. The interrupt enable is initially 0. If it is set to 1 by a program, the terminal requests an interrupt at hardware level 1 whenever a character is typed and the ready bit becomes 1. However, for the interrupt to affect the processor, interrupts must also be enabled in the Status register (see Section A.7). All other bits of the Receiver Control register are unused. The second terminal device register is the Receiver Data register (at address ffff0004hex). The low-order 8 bits of this register contain the last character typed at the keyboard. All other bits contain 0s. This register is read-only and changes only when a new character is typed at the keyboard. Reading the Receiver Data register resets the ready bit in the Receiver Control register to 0. The value in this register is undened if the Receiver Control register is 0. The third terminal device register is the Transmitter Control register (at address ffff0008hex). Only the low-order 2 bits of this register are used. They behave much like the corresponding bits of the Receiver Control register. Bit 0 is called ready
A-40
Appendix A
Assemblers, Linkers, and the SPIM Simulator
and is read-only. If this bit is 1, the transmitter is ready to accept a new character for output. If it is 0, the transmitter is still busy writing the previous character. Bit 1 is interrupt enable and is readable and writable. If this bit is set to 1, then the terminal requests an interrupt at hardware level 0 whenever the transmitter is ready for a new character and the ready bit becomes 1. The nal device register is the Transmitter Data register (at address ffff000chex). When a value is written into this location, its low-order 8 bits (i.e., an ASCII character as in Figure 2.21 in Chapter 2) are sent to the console. When the Transmitter Data register is written, the ready bit in the Transmitter Control register is reset to 0. This bit stays 0 until enough time has elapsed to transmit the character to the terminal; then the ready bit becomes 1 again. The Transmitter Data register should only be written when the ready bit of the Transmitter Control register is 1. If the transmitter is not ready, writes to the Transmitter Data register are ignored (the write appears to succeed but the character is not output). Real computers require time to send characters to a console or terminal. These time lags are simulated by SPIM. For example, after the transmitter starts to write a character, the transmitters ready bit becomes 0 for a while. SPIM measures time in instructions executed, not in real clock time. This means that the transmitter does not become ready again until the processor executes a xed number of instructions. If you stop the machine and look at the ready bit, it will not change. However, if you let the machine run, the bit eventually changes back to 1.
A.9
SPIM
A.9
SPIM is a software simulator that runs assembly language programs written for processors that implement the MIPS32 architecture, specically Release 1 of this architecture with a xed memory mapping, no caches, and only coprocessors 0 and 1.2 SPIMs name is just MIPS spelled backwards. SPIM can read and immediately execute assembly language les. SPIM is a self-contained system for running MIPS programs. It contains a debugger and provides a few operating systemlike services. SPIM is much slower than a real computer (100 or more
2. Earlier versions of SPIM (before 7.0) implemented the MIPS-I architecture used in the original MIPS R2000 processors. This architecture is almost a proper subset of the MIPS32 architecture, with the difference being the manner in which exceptions are handled. MIPS32 also introduced approximately 60 new instructions, which are supported by SPIM. Programs that ran on the earlier versions of SPIM and did not use exceptions should run unmodified on newer versions of SPIM. Programs that used exceptions will require minor changes.
A.9
SPIM
A-41
times). However, its low cost and wide availability cannot be matched by real hardware! An obvious question is, Why use a simulator when most people have PCs that contain processors that run signicantly faster than SPIM? One reason is that the processor in PCs are Intel 80x86s, whose architecture is far less regular and far more complex to understand and program than MIPS processors. The MIPS architecture may be the epitome of a simple, clean RISC machine. In addition, simulators can provide a better environment for assembly programming than an actual machine because they can detect more errors and provide a better interface than an actual computer. Finally, simulators are a useful tool in studying computers and the programs that run on them. Because they are implemented in software, not silicon, simulators can be examined and easily modied to add new instructions, build new systems such as multiprocessors, or simply to collect data.
Simulation of a Virtual Machine
The basic MIPS architecture is difcult to program directly because of delayed branches, delayed loads, and restricted address modes. This difculty is tolerable since these computers were designed to be programmed in high-level languages and present an interface designed for compilers rather than assembly language programmers. A good part of the programming complexity results from delayed instructions. A delayed branch requires two cycles to execute (see Elaborations on pages 382 and 423 of Chapter 6). In the second cycle, the instruction immediately following the branch executes. This instruction can perform useful work that normally would have been done before the branch. It can also be a nop (no operation) that does nothing. Similarly, delayed loads require 2 cycles to bring a value from memory, so the instruction immediately following a load cannot use the value (see Section 6.2 of Chapter 6). MIPS wisely chose to hide this complexity by having its assembler implement a virtual machine. This virtual computer appears to have nondelayed branches and loads and a richer instruction set than the actual hardware. The assembler reorganizes (rearranges) instructions to ll the delay slots. The virtual computer also provides pseudoinstructions, which appear as real instructions in assembly language programs. The hardware, however, knows nothing about pseudoinstructions, so the assembler translates them into equivalent sequences of actual machine instructions. For example, the MIPS hardware only provides instructions to branch when a register is equal to or not equal to 0. Other conditional branches, such as one that branches when one register is greater than another, are synthesized by comparing the two registers and branching when the result of the comparison is true (nonzero).
virtual machine A virtual computer that appears to have nondelayed branches and loads and a richer instruction set than the actual hardware.
A-42
Appendix A
Assemblers, Linkers, and the SPIM Simulator
By default, SPIM simulates the richer virtual machine, since this is the machine that most programmers will nd useful. However, SPIM can also simulate the delayed branches and loads in the actual hardware. Below, we describe the virtual machine and only mention in passing features that do not belong to the actual hardware. In doing so, we follow the convention of MIPS assembly language programmers (and compilers), who routinely use the extended machine as if it was implemented in silicon.
Getting Started with SPIM
The rest of this appendix introduces SPIM and the MIPS R2000 Assembly language. Many details should never concern you; however, the sheer volume of information can sometimes obscure the fact that SPIM is a simple, easy-to-use program. This section starts with a quick tutorial on using SPIM, which should enable you to load, debug, and run simple MIPS programs. SPIM comes in different versions for different types of computer systems. The one constant is the simplest version, called spim, which is a command-line-driven program that runs in a console window. It operates like most programs of this type: you type a line of text, hit the return key, and spim executes your command. Despite its lack of a fancy interface, spim can do everything that its fancy cousins can do. There are two fancy cousins to spim. The version that runs in the X-windows environment of a UNIX or Linux system is called xspim. xspim is an easier program to learn and use than spim because its commands are always visible on the screen and because it continually displays the machines registers and memory. The other fancy version is called PCspim and runs on Microsoft Windows. The UNIX and Windows versions of SPIM are on the CD (click on Tutorials) . Tutorials on xspim, pcSpim, spim, and spim command-line options are on the CD (click on Software). If you are going to run spim on a PC running Microsoft Windows, you should rst look at the tutorial on PCSpim on this CD. If you are going to run spim on a computer running UNIX or Linux, you should read the tutorial on xspim (click on Tutorials).
Surprising Features
Although SPIM faithfully simulates the MIPS computer, SPIM is a simulator and certain things are not identical to an actual computer. The most obvious differences are that instruction timing and the memory system are not identical. SPIM does not simulate caches or memory latency, nor does it accurately reect oating-point operation or multiply and divide instruction delays. In addition, the oating-point instructions do not detect many error conditions, which would cause exceptions on a real machine.
A.9
SPIM
A-43
Another surprise (which occurs on the real machine as well) is that a pseudoinstruction expands to several machine instructions. When you single-step or examine memory, the instructions that you see are different from the source program. The correspondence between the two sets of instructions is fairly simple since SPIM does not reorganize instructions to ll delay slots.
Byte Order
Processors can number bytes within a word so the byte with the lowest number is either the leftmost or rightmost one. The convention used by a machine is called its byte order. MIPS processors can operate with either big-endian or little-endian byte order. For example, in a big-endian machine, the directive .byte 0, 1, 2, 3 would result in a memory word containing
Byte #
0 1 2 3
while in a little-endian machine, the word would contain
Byte #
3 2 1 0
SPIM operates with both byte orders. SPIMs byte order is the same as the byte order of the underlying machine that runs the simulator. For example, on a Intel 80x86, SPIM is little-endian, while on a Macintosh or Sun SPARC, SPIM is bigendian.
System Calls
SPIM provides a small set of operating-system-like services through the system call (syscall) instruction. To request a service, a program loads the system call code (see Figure A.9.1) into register $v0 and arguments into registers $a0$a3 (or $f12 for oating-point values). System calls that return values put their results in register $v0 (or $f0 for oating-point results). For example, the following code prints the answer = 5:
.data str: .asciiz .text
"the answer = "
A-44
Appendix A
Assemblers, Linkers, and the SPIM Simulator
Service print_int print_float print_double print_string read_int read_float read_double read_string sbrk exit print_char read_char open read write close exit2 FIGURE A.9.1
System call code
01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17
Arguments $a0 = integer $f12 = float $f12 = double $a0 = string
Result
integer (in $v0) float (in $f0) double (in $f0)
$a0 = buffer, $a1 = length $a0 = amount $a0 = char
address (in $v0)
char (in $a0)
$a0 = filename (string), $a1 = flags, $a2 = mode $a0 = file descriptor, $a1 = buffer, $a2 = length $a0 = file descriptor, $a1 = buffer, $a2 = length $a0 = file descriptor $a0 = result
file descriptor (in $a0) num chars read (in
$a0)
num chars written (in
$a0)
System services.
li la syscall li li syscall
$v0, 4 # system call code for print_str $a0, str # address of string to print # print the string $v0, 1 $a0, 5 # system call code for print_int # integer to print # print it
The print_int system call is passed an integer and prints it on the console. print_float prints a single oating-point number; print_double prints a double precision number; and print_string is passed a pointer to a null-terminated string, which it writes to the console. The system calls read_int, read_float, and read_double read an entire line of input up to and including the newline. Characters following the number are ignored. read_string has the same semantics as the UNIX library routine fgets. It reads up to n 1 characters into a buffer and terminates the string with a null byte. If fewer than n 1 characters are on the current line, read_string reads up to and including the newline and again null-terminates the string.
A.10
MIPS R2000 Assembly Language
A-45
Warning: Programs that use these syscalls to read from the terminal should not use memory-mapped I/O (see Section A.8). sbrk returns a pointer to a block of memory containing n additional bytes. exit stops the program SPIM is running. exit2 terminates the SPIM program, and the argument to exit2 becomes the value returned when the SPIM simulator itself terminates. print_char and read_char write and read a single character. open, read, write, and close are the standard UNIX library calls.
A.10
MIPS R2000 Assembly Language
A.10
A MIPS processor consists of an integer processing unit (the CPU) and a collection of coprocessors that perform ancillary tasks or operate on other types of data such as oating-point numbers (see Figure A.10.1). SPIM simulates two coprocessors. Coprocessor 0 handles exceptions and interrupts. Coprocessor 1 is the oating-point unit. SPIM simulates most aspects of this unit.
Addressing Modes
MIPS is a load-store architecture, which means that only load and store instructions access memory. Computation instructions operate only on values in registers. The bare machine provides only one memory-addressing mode: c(rx), which uses the sum of the immediate c and register rx as the address. The virtual machine provides the following addressing modes for load and store instructions:
Format
(register) imm imm (register) label label imm label imm (register)
Address computation
contents of register immediate immediate + contents of register address of label address of label + or immediate address of label + or (immediate + contents of register)
Most load and store instructions operate only on aligned data. A quantity is aligned if its memory address is a multiple of its size in bytes. Therefore, a half-
A-46
Appendix A
Assemblers, Linkers, and the SPIM Simulator
Memory
CPU Registers $0
Coprocessor 1 (FPU) Registers $0
$31 Arithmetic unit Multiply divide
$31
Lo
Hi
Arithmetic unit
Coprocessor 0 (traps and memory) Registers BadVAddr Status Cause EPC
FIGURE A.10.1
MIPS R2000 CPU and FPU.
word object must be stored at even addresses and a full word object must be stored at addresses that are a multiple of four. However, MIPS provides some instructions to manipulate unaligned data (lwl, lwr, swl, and swr).
Elaboration: The MIPS assembler (and SPIM) synthesizes the more complex addressing modes by producing one or more instructions before the load or store to compute a complex address. For example, suppose that the label table referred to memory location 0x10000004 and a program contained the instruction
ld $a0, table + 4($a1) The assembler would translate this instruction into the instructions
A.10
MIPS R2000 Assembly Language
A-47
lui $at, 4096 addu $at, $at, $a1 lw $a0, 8($at)
The rst instruction loads the upper bits of the labels address into register $at, which is the register that the assembler reserves for its own use. The second instruction adds the contents of register $a1 to the labels partial address. Finally, the load instruction uses the hardware address mode to add the sum of the lower bits of the labels address and the offset from the original instruction to the value in register $at.
Assembler Syntax
Comments in assembler les begin with a sharp sign (#). Everything from the sharp sign to the end of the line is ignored. Identiers are a sequence of alphanumeric characters, underbars (_), and dots (.) that do not begin with a number. Instruction opcodes are reserved words that cannot be used as identiers. Labels are declared by putting them at the beginning of a line followed by a colon, for example:
.data item: .word 1 .text .globl main # Must be global main: lw $t0, item
Numbers are base 10 by default. If they are preceded by 0x, they are interpreted as hexadecimal. Hence, 256 and 0x100 denote the same value. Strings are enclosed in doublequotes ("). Special characters in strings follow the C convention:
newline \n tab quote
\t \"
SPIM supports a subset of the MIPS assembler directives:
.align n
Align the next datum on a 2n byte boundary. For example, .align 2 aligns the next value on a word boundary. .align 0 turns off automatic alignment of .half, .word, .float, and .double directives until the next .data or .kdata directive. Store the string str in memory, but do not nullterminate it.
.ascii str
A-48
Appendix A
Assemblers, Linkers, and the SPIM Simulator
.asciiz str .byte b1,..., bn .data <addr>
Store the string str in memory and null-terminate it. Store the n values in successive bytes of memory. Subsequent items are stored in the data segment. If the optional argument addr is present, subsequent items are stored starting at address addr. Store the n oating-point double precision numbers in successive memory locations. Declare that the datum stored at sym is size bytes large and is a global label. This directive enables the assembler to store the datum in a portion of the data segment that is efciently accessed via register $gp. Store the n oating-point single precision numbers in successive memory locations. Declare that label sym is global and can be referenced from other les. Store the n 16-bit quantities in successive memory halfwords. Subsequent data items are stored in the kernel data segment. If the optional argument addr is present, subsequent items are stored starting at address addr. Subsequent items are put in the kernel text segment. In SPIM, these items may only be instructions or words (see the .word directive below). If the optional argument addr is present, subsequent items are stored starting at address addr. The rst directive prevents SPIM from complaining about subsequent instructions that use register $at. The second directive reenables the warning. Since pseudoinstructions expand into code that uses register $at, programmers must be very careful about leaving values in this register. Allocate n bytes of space in the current segment (which must be the data segment in SPIM).
.double d1, ..., dn .extern sym size
.float f1,..., fn .globl sym .half h1, ..., hn .kdata <addr>
.ktext <addr>
.set noat and .set at
.space n
A.10
MIPS R2000 Assembly Language
A-49
.text <addr>
Subsequent items are put in the user text segment. In SPIM, these items may only be instructions or words (see the .word directive below). If the optional argument addr is present, subsequent items are stored starting at address addr. Store the n 32-bit quantities in successive memory words.
.word w1,..., wn
SPIM does not distinguish various parts of the data segment (.data, .rdata, and .sdata).
Encoding MIPS Instructions
Figure A.10.2 explains how a MIPS instruction is encoded in a binary number. Each column contains instruction encodings for a eld (a contiguous group of bits) from an instruction. The numbers at the left margin are values for a eld. For example, the j opcode has a value of 2 in the opcode eld. The text at the top of a column names a eld and species which bits it occupies in an instruction. For example, the op eld is contained in bits 2631 of an instruction. This eld encodes most instructions. However, some groups of instructions use additional elds to distinguish related instructions. For example, the different oating-point instructions are specied by bits 05. The arrows from the rst column show which opcodes use these additional elds.
Instruction Format
The rest of this appendix describes both the instructions implemented by actual MIPS hardware and the pseudoinstructions provided by the MIPS assembler. The two types of instructions are easily distinguished. Actual instructions depict the elds in their binary representation. For example, in
Addition (with overow)
0 rs
5
rt
5
rd
5
0
5
0x20
6
add rd, rs, rt
6
the add instruction consists of six elds. Each elds size in bits is the small number below the eld. This instruction begins with 6 bits of 0s. Register speciers begin with an r, so the next eld is a 5-bit register specier called rs. This is the same register that is the second argument in the symbolic assembly at the left of this line. Another common eld is imm16, which is a 16-bit immediate number.
A-50
Appendix A
Assemblers, Linkers, and the SPIM Simulator
0 1
(16:16) movf movt funct(5:0) add.f sub.f mul.f div.f sqrt.f abs.f mov.f neg.f
0 1
(16:16) movf.f movt.f funct(5:0) madd maddu mul
msub msubu
10 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63
16 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f
op(31:26)
j jal beq bne blez bgtz addi addiu slti sltiu andi ori xori lui z=0 z=1 z=2 beql bnel blezl bgtzl
lb lh lwl lw lbu lhu lwr sb sh swl sw
swr cache ll lwc1 lwc2 pref ldc1 ldc2 sc swc1 swc2
sdc1 sdc2
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
rs (25:21) mfcz
cfcz mtcz ctcz
if z = 1 or z = 2 0 1 2 3
(17:16) bczf bczt bczfl bcztl
funct (4:0)
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 tlbr tlbwi 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
rt (20:16) bltz bgez bltzl bgezl
tlbwr tlbp
tgei tgeiu tlti tltiu tegi tnei bltzal bgezal bltzall bgczall
if z = 0 copz copz if z = 1, if z = 1, f=d f=s
eret
deret
10 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63
funct(5:0) sll
srl sra sllv srlv srav jr jalr movz movn syscall break sync mfhi mthi mflo mtlo
mult multu div divu
add addu sub subu and or xor nor
slt sltu
tge tgeu tlt tltu teq tne
10 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63
round.w.f trunc.w.f cell.w.f floor.w.f
movz.f movn.f
cvt.s.f cvt.d.f
cvt.w.f
c.f.f c.un.f c.eq.f c.ueq.f c.olt.f c.ult.f c.ole.f c.ule.f c.sf.f c.ngle.f c.seq.f c.ngl.f c.lt.f c.nge.f c.le.f c.ngt.f
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63
clz clo
FIGURE A.10.2 MIPS opcode map. The values of each eld are shown to its left. The rst column shows the values in base 10 and the second shows base 16 for the op eld (bits 31 to 26) in the third column. This op eld completely species the MIPS operation except for 6 op values: 0, 1, 16, 17, 18, and 19. These operations are determined by other elds, identied by pointers. The last eld (funct) uses f to mean s if rs = 16 and op = 17 or d if rs = 17 and op = 17. The second eld (rs) uses z to mean 0, 1, 2, or 3 if op = 16, 17, 18, or 19, respectively. If rs = 16, the operation is specied elsewhere: if z = 0, the operations are specied in the fourth eld (bits 4 to 0); if z = 1, then the operations are in the last eld with f = s. If rs = 17 and z = 1, then the operations are in the last eld with f = d.
A.10
MIPS R2000 Assembly Language
A-51
Pseudoinstructions follow roughly the same conventions, but omit instruction encoding information. For example:
Multiply (without overow) mul rdest, rsrc1, src2 pseudoinstruction
In pseudoinstructions, rdest and rsrc1 are registers and src2 is either a register or an immediate value. In general, the assembler and SPIM translate a more general form of an instruction (e.g., add $v1, $a0, 0x55) to a specialized form (e.g., addi $v1, $a0, 0x55).
Arithmetic and Logical Instructions
Absolute value abs rdest, rsrc pseudoinstruction
Put the absolute value of register rsrc in register rdest.
Addition (with overow) add rd, rs, rt 0
6
rs
5
rt
5
rd
5
0
5
0x20
6
Addition (without overow) addu rd, rs, rt 0
6
rs
5
rt
5
rd
5
0
5
0x21
6
Put the sum of registers rs and rt into register rd.
Addition immediate (with overow) addi rt, rs, imm 8
6
rs
5
rt
5
imm
16
Addition immediate (without overow) addiu rt, rs, imm 9
6
rs
5
rt
5
imm
16
Put the sum of register rs and the sign-extended immediate into register rt.
A-52
Appendix A
Assemblers, Linkers, and the SPIM Simulator
AND and rd, rs, rt 0
6
rs
5
rt
5
rd
5
0
5
0x24
6
Put the logical AND of registers rs and rt into register rd.
AND immediate andi rt, rs, imm 0xc
6
rs
5
rt
5
imm
16
Put the logical AND of register rs and the zero-extended immediate into register rt.
Count leading ones clo rd, rs 0x1c
6
rs
5
0
5
rd
5
0
5
0x21
6
Count leading zeros clz rd, rs 0x1c
6
rs
5
0
5
rd
5
0
5
0x20
6
Count the number of leading ones (zeros) in the word in register rs and put the result into register rd. If a word is all ones (zeros), the result is 32.
Divide (with overow) div rs, rt 0
6
rs
5
rt
5
0
10
0x1a
6
Divide (without overow) divu rs, rt 0
6
rs
5
rt
5
0
10
0x1b
6
Divide register rs by register rt. Leave the quotient in register lo and the remainder in register hi. Note that if an operand is negative, the remainder is unspecified by the MIPS architecture and depends on the convention of the machine on which SPIM is run.
A.10
MIPS R2000 Assembly Language
A-53
Divide (with overow) div rdest, rsrc1, src2 pseudoinstruction
Divide (without overow) divu rdest, rsrc1, src2 pseudoinstruction
Put the quotient of register rsrc1 and src2 into register rdest.
Multiply mult rs, rt 0
6
rs
5
rt
5
0
10
0x18
6
Unsigned multiply multu rs, rt 0
6
rs
5
rt
5
0
10
0x19
6
Multiply registers rs and rt. Leave the low-order word of the product in register lo and the high-order word in register hi.
Multiply (without overow) mul rd, rs, rt 0x1c
6
rs
5
rt
5
rd
5
0
5
2
6
Put the low-order 32 bits of the product of rs and rt into register rd.
Multiply (with overow) mulo rdest, rsrc1, src2 pseudoinstruction
Unsigned multiply (with overow) mulou rdest, rsrc1, src2 pseudoinstruction
Put the low-order 32 bits of the product of register rsrc1 and src2 into register rdest.
A-54
Appendix A
Assemblers, Linkers, and the SPIM Simulator
Multiply add madd rs, rt 0x1c
6
rs
5
rt
5
0
10
0
6
Unsigned multiply add maddu rs, rt 0x1c
6
rs
5
rt
5
0
10
1
6
Multiply registers rs and rt and add the resulting 64-bit product to the 64-bit value in the concatenated registers lo and hi.
Multiply subtract msub rs, rt 0x1c
6
rs
5
rt
5
0
10
4
6
Unsigned multiply subtract msub rs, rt 0x1c
6
rs
5
rt
5
0
10
5
6
Multiply registers rs and rt and subtract the resulting 64-bit product from the 64-bit value in the concatenated registers lo and hi.
Negate value (with overow) neg rdest, rsrc pseudoinstruction
Negate value (without overow) negu rdest, rsrc pseudoinstruction
Put the negative of register rsrc into register rdest.
NOR nor rd, rs, rt 0
6
rs
5
rt
5
rd
5
0
5
0x27
6
Put the logical NOR of registers rs and rt into register rd.
A.10
MIPS R2000 Assembly Language
A-55
NOT not rdest, rsrc pseudoinstruction
Put the bitwise logical negation of register rsrc into register rdest.
OR or rd, rs, rt 0
6
rs
5
rt
5
rd
5
0
5
0x25
6
Put the logical OR of registers rs and rt into register rd.
OR immediate ori rt, rs, imm 0xd
6
rs
5
rt
5
imm
16
Put the logical OR of register rs and the zero-extended immediate into register rt.
Remainder rem rdest, rsrc1, rsrc2 pseudoinstruction
Unsigned remainder remu rdest, rsrc1, rsrc2 pseudoinstruction
Put the remainder of register rsrc1 divided by register rsrc2 into register rdest. Note that if an operand is negative, the remainder is unspecified by the MIPS architecture and depends on the convention of the machine on which SPIM is run.
Shift left logical sll rd, rt, shamt 0
6
rs
5
rt
5
rd
5
shamt
5
0
6
Shift left logical variable sllv rd, rt, rs 0
6
rs
5
rt
5
rd
5
0
5
4
6
A-56
Appendix A
Assemblers, Linkers, and the SPIM Simulator
Shift right arithmetic sra rd, rt, shamt 0
6
rs
5
rt
5
rd
5
shamt
5
3
6
Shift right arithmetic variable srav rd, rt, rs 0
6
rs
5
rt
5
rd
5
0
5
7
6
Shift right logical srl rd, rt, shamt 0
6
rs
5
rt
5
rd
5
shamt
5
2
6
Shift right logical variable srlv rd, rt, rs 0
6
rs
5
rt
5
rd
5
0
5
6
6
Shift register rt left (right) by the distance indicated by immediate shamt or the register rs and put the result in register rd. Note that argument rs is ignored for sll, sra, and srl.
Rotate left rol rdest, rsrc1, rsrc2 pseudoinstruction
Rotate right ror rdest, rsrc1, rsrc2 pseudoinstruction
Rotate register rsrc1 left (right) by the distance indicated by rsrc2 and put the result in register rdest.
Subtract (with overow) sub rd, rs, rt 0
6
rs
5
rt
5
rd
5
0
5
0x22
6
A.10
MIPS R2000 Assembly Language
A-57
Subtract (without overow) subu rd, rs, rt 0
6
rs
5
rt
5
rd
5
0
5
0x23
6
Put the difference of registers rs and rt into register rd.
Exclusive OR xor rd, rs, rt 0
6
rs
5
rt
5
rd
5
0
5
0x26
6
Put the logical XOR of registers rs and rt into register rd.
XOR immediate xori rt, rs, imm 0xe
6
rs
5
rt
5
Imm
16
Put the logical XOR of register rs and the zero-extended immediate into register rt.
Constant-Manipulating Instructions
Load upper immediate lui rt, imm 0xf
6
0
5
rt
5
imm
16
Load the lower halfword of the immediate imm into the upper halfword of register rt. The lower bits of the register are set to 0.
Load immediate li rdest, imm pseudoinstruction
Move the immediate imm into register rdest.
Comparison Instructions
Set less than slt rd, rs, rt 0
6
rs
5
rt
5
rd
5
0
5
0x2a
6
A-58
Appendix A
Assemblers, Linkers, and the SPIM Simulator
Set less than unsigned sltu rd, rs, rt 0
6
rs
5
rt
5
rd
5
0
5
0x2b
6
Set register rd to 1 if register rs is less than rt, and to 0 otherwise.
Set less than immediate slti rt, rs, imm 0xa
6
rs
5
rt
5
imm
16
Set less than unsigned immediate sltiu rt, rs, imm 0xb
6
rs
5
rt
5
imm
16
Set register rt to 1 if register rs is less than the sign-extended immediate, and to 0 otherwise.
Set equal seq rdest, rsrc1, rsrc2 pseudoinstruction
Set register rdest to 1 if register rsrc1 equals rsrc2, and to 0 otherwise.
Set greater than equal sge rdest, rsrc1, rsrc2 pseudoinstruction
Set greater than equal unsigned sgeu rdest, rsrc1, rsrc2 pseudoinstruction
Set register rdest to 1 if register rsrc1 is greater than or equal to rsrc2, and to 0 otherwise.
Set greater than sgt rdest, rsrc1, rsrc2 pseudoinstruction
A.10
MIPS R2000 Assembly Language
A-59
Set greater than unsigned sgtu rdest, rsrc1, rsrc2 pseudoinstruction
Set register rdest to 1 if register rsrc1 is greater than rsrc2, and to 0 otherwise.
Set less than equal sle rdest, rsrc1, rsrc2 pseudoinstruction
Set less than equal unsigned sleu rdest, rsrc1, rsrc2 pseudoinstruction
Set register rdest to 1 if register rsrc1 is less than or equal to rsrc2, and to 0 otherwise.
Set not equal sne rdest, rsrc1, rsrc2 pseudoinstruction
Set register rdest to 1 if register rsrc1 is not equal to rsrc2, and to 0 otherwise.
Branch Instructions
Branch instructions use a signed 16-bit instruction offset eld; hence they can jump 215 1 instructions (not bytes) forward or 215 instructions backwards. The jump instruction contains a 26-bit address eld. In actual MIPS processors, branch instructions are delayed branches, which do not transfer control until the instruction following the branch (its "delay slot") has executed (see Chapter 6). Delayed branches affect the offset calculation, since it must be computed relative to the address of the delay slot instruction (PC + 4), which is when the branch occurs. SPIM does not simulate this delay slot, unless the -bare or -delayed_branch ags are specied. In assembly code, offsets are not usually specied as numbers. Instead, an instructions branch to a label, and the assembler computes the distance between the branch and the target instructions. In MIPS32, all actual (not pseudo) conditional branch instructions have a "likely" variant (for example, beqs likely variant is beql), which does not execute the
A-60
Appendix A
Assemblers, Linkers, and the SPIM Simulator
instruction in the branchs delay slot if the branch is not taken. Do not use these instructions; they may be removed in subsequent versions of the architecture. SPIM implements these instructions, but they are not described further.
Branch instruction b label pseudoinstruction
Unconditionally branch to the instruction at the label.
Branch coprocessor false bc1f cc label 0x11
6
8
5
cc
3
0
2
Offset
16
Branch coprocessor true bc1t cc label 0x11
6
8
5
cc
3
1
2
Offset
16
Conditionally branch the number of instructions specified by the offset if the floating point coprocessors condition flag numbered cc is false (true). If cc is omitted from the instruction, condition code flag 0 is assumed.
Branch on equal beq rs, rt, label 4
6
rs
5
rt
5
Offset
16
Conditionally branch the number of instructions specified by the offset if register rs equals rt.
Branch on greater than equal zero bgez rs, label 1
6
rs
5
1
5
Offset
16
Conditionally branch the number of instructions specified by the offset if register rs is greater than or equal to 0.
A.10
MIPS R2000 Assembly Language
A-61
Branch on greater than equal zero a...