2.

10 MIPS Addressing for 32-bit Immediates and Addresses 111

Elaboration: MIPS software tries to keep the stack aligned to word addresses,
allowing the program to always use lw and sw (which must be aligned) to access the
stack. This convention means that a char variable allocated on the stack occupies 4
bytes, even though it needs less. However, a C string variable or an array of bytes will
pack 4 bytes per word, and a Java string variable or array of shorts packs 2 halfwords
per word.

Elaboration: Reflecting the international nature of the web, most web pages today
use Unicode instead of ASCII.

I. Which of the following statements about characters and strings in C and Check
Java are true? Yourself
1. A string in C takes about half the memory as the same string in Java.
2. Strings are just an informal name for single-dimension arrays of
characters in C and Java.
3. Strings in C and Java use null (0) to mark the end of a string.
4. Operations on strings, like length, are faster in C than in Java.
II. Which type of variable that can contain 1,000,000,000ten takes the most
memory space?
1. int in C
2. string in C
3. string in Java

MIPS Addressing for 32-bit Immediates

2.10
and Addresses
Although keeping all MIPS instructions 32 bits long simplifies the hardware, there
are times where it would be convenient to have a 32-bit constant or 32-bit address.
This section starts with the general solution for large constants, and then shows the
optimizations for instruction addresses used in branches and jumps.
112 Chapter 2 Instructions: Language of the Computer

32-Bit Immediate Operands

Although constants are frequently short and fit into the 16-bit field, sometimes they
are bigger. The MIPS instruction set includes the instruction load upper immediate
(lui) specifically to set the upper 16 bits of a constant in a register, allowing a
subsequent instruction to specify the lower 16 bits of the constant. Figure 2.17
shows the operation of lui.

Loading a 32-Bit Constant

EXAMPLE
What is the MIPS assembly code to load this 32-bit constant into register $s0?

0000 0000 0011 1101 0000 1001 0000 0000

First, we would load the upper 16 bits, which is 61 in decimal, using lui:
ANSWER
lui $s0, 61 # 61 decimal = 0000 0000 0011 1101 binary
The value of register $s0 afterward is

0000 0000 0011 1101 0000 0000 0000 0000

The next step is to insert the lower 16 bits, whose decimal value is 2304:

ori $s0, $s0, 2304 # 2304 decimal = 0000 1001 0000 0000
The final value in register $s0 is the desired value:

0000 0000 0011 1101 0000 1001 0000 0000

The machine language version of lui $t0, 255 # $t0 is register 8:

001111 00000 01000 0000 0000 1111 1111

Contents of register $t0 after executing lui $t0, 255:

0000 0000 1111 1111 0000 0000 0000 0000

FIGURE 2.17 The effect of the lui instruction. The instruction lui transfers the 16-bit immediate constant field value into the
leftmost 16 bits of the register, filling the lower 16 bits with 0s.
 2.10 MIPS Addressing for 32-bit Immediates and Addresses 113

Either the compiler or the assembler must break large constants into pieces and Hardware/
then reassemble them into a register. As you might expect, the immediate field’s
size restriction may be a problem for memory addresses in loads and stores as
Software
well as for constants in immediate instructions. If this job falls to the assembler, Interface
as it does for MIPS software, then the assembler must have a temporary register
available in which to create the long values. This need is a reason for the register
$at (assembler temporary), which is reserved for the assembler.
Hence, the symbolic representation of the MIPS machine language is no longer
limited by the hardware, but by whatever the creator of an assembler chooses to
include (see Section 2.12). We stick close to the hardware to explain the architecture
of the computer, noting when we use the enhanced language of the assembler that
is not found in the processor.

Elaboration: Creating 32-bit constants needs care. The instruction addi copies the
left-most bit of the 16-bit immediate field of the instruction into the upper 16 bits of a
word. Logical or immediate from Section 2.6 loads 0s into the upper 16 bits and hence
is used by the assembler in conjunction with lui to create 32-bit constants.

Addressing in Branches and Jumps

The MIPS jump instructions have the simplest addressing. They use the final MIPS
instruction format, called the J-type, which consists of 6 bits for the operation field
and the rest of the bits for the address field. Thus,
j 10000 # go to location 10000
could be assembled into this format (it’s actually a bit more complicated, as we will
see):

2 10000

6 bits 26 bits

where the value of the jump opcode is 2 and the jump address is 10000.
Unlike the jump instruction, the conditional branch instruction must specify
two operands in addition to the branch address. Thus,
bne $s0,$s1,Exit # go to Exit if $s0 ≠ $s1
is assembled into this instruction, leaving only 16 bits for the branch address:

5 16 17 Exit

6 bits 5 bits 5 bits 16 bits

114 Chapter 2 Instructions: Language of the Computer

If addresses of the program had to fit in this 16-bit field, it would mean that no
program could be bigger than 216, which is far too small to be a realistic option
today. An alternative would be to specify a register that would always be added
to the branch address, so that a branch instruction would calculate the following:

Program counter Register Branch address

This sum allows the program to be as large as 232 and still be able to use
conditional branches, solving the branch address size problem. Then the question
is, which register?
The answer comes from seeing how conditional branches are used. Conditional
branches are found in loops and in if statements, so they tend to branch to a
nearby instruction. For example, about half of all conditional branches in SPEC
benchmarks go to locations less than 16 instructions away. Since the program
counter (PC) contains the address of the current instruction, we can branch within
215 words of the current instruction if we use the PC as the register to be added
to the address. Almost all loops and if statements are much smaller than 216 words,
so the PC is the ideal choice.
PC-relative This form of branch addressing is called PC-relative addressing. As we shall see
addressing An in Chapter 4, it is convenient for the hardware to increment the PC early to point
addressing regime to the next instruction. Hence, the MIPS address is actually relative to the address
in which the address
of the following instruction (PC  4) as opposed to the current instruction (PC).
is the sum of the
program counter (PC) It is yet another example of making the common case fast, which in this case is
and a constant in the addressing nearby instructions.
instruction. Like most recent computers, MIPS uses PC-relative addressing for all conditional
branches, because the destination of these instructions is likely to be close to the
branch. On the other hand, jump-and-link instructions invoke procedures that
have no reason to be near the call, so they normally use other forms of addressing.
Hence, the MIPS architecture offers long addresses for procedure calls by using the
J-type format for both jump and jump-and-link instructions.
Since all MIPS instructions are 4 bytes long, MIPS stretches the distance of the
branch by having PC-relative addressing refer to the number of words to the next
instruction instead of the number of bytes. Thus, the 16-bit field can branch four
times as far by interpreting the field as a relative word address rather than as a
relative byte address. Similarly, the 26-bit field in jump instructions is also a word
address, meaning that it represents a 28-bit byte address.

Elaboration: Since the PC is 32 bits, 4 bits must come from somewhere else for
jumps. The MIPS jump instruction replaces only the lower 28 bits of the PC, leaving
the upper 4 bits of the PC unchanged. The loader and linker (Section 2.12) must be
careful to avoid placing a program across an address boundary of 256 MB (64 million
instructions); otherwise, a jump must be replaced by a jump register instruction preceded
by other instructions to load the full 32-bit address into a register.
 2.10 MIPS Addressing for 32-bit Immediates and Addresses 115

Showing Branch Offset in Machine Language

EXAMPLE
The while loop on pages 92–93 was compiled into this MIPS assembler code:

Loop:sll $t1,$s3,2 # Temp reg $t1 = 4 * i

add $t1,$t1,$s6 # $t1 = address of save[i]
lw $t0,0($t1) # Temp reg $t0 = save[i]
bne $t0,$s5, Exit # go to Exit if save[i] ≠ k
addi $s3,$s3,1 # i = i + 1
j Loop # go to Loop
Exit:
If we assume we place the loop starting at location 80000 in memory, what is
the MIPS machine code for this loop?

The assembled instructions and their addresses are:

ANSWER
80000 0 0 19 9 2 0
80004 0 9 22 9 0 32
80008 35 9 8 0
80012 5 8 21 2
80016 8 19 19 1
80020 2 20000
80024 ...

Remember that MIPS instructions have byte addresses, so addresses of

sequential words differ by 4, the number of bytes in a word. The bne instruction
on the fourth line adds 2 words or 8 bytes to the address of the following
instruction (80016), specifying the branch destination relative to that following
instruction (8  80016) instead of relative to the branch instruction (12 
80012) or using the full destination address (80024). The jump instruction on
the last line does use the full address (20000  4  80000), corresponding to
the label Loop.
116 Chapter 2 Instructions: Language of the Computer

Hardware/ Most conditional branches are to a nearby location, but occasionally they branch
far away, farther than can be represented in the 16 bits of the conditional branch
Software instruction. The assembler comes to the rescue just as it did with large addresses
Interface or constants: it inserts an unconditional jump to the branch target, and inverts the
condition so that the branch decides whether to skip the jump.

Branching Far Away

EXAMPLE
Given a branch on register $s0 being equal to register $s1,

beq $s0, $s1, L1

replace it by a pair of instructions that offers a much greater branching distance.

These instructions replace the short-address conditional branch:

ANSWER
bne $s0, $s1, L2
j L1
L2:

MIPS Addressing Mode Summary

addressing mode One Multiple forms of addressing are generically called addressing modes. Figure 2.18
of several addressing shows how operands are identified for each addressing mode. The MIPS addressing
regimes delimited by their modes are the following:
varied use of operands
and/or addresses. 1. Immediate addressing, where the operand is a constant within the instruction
itself
2. Register addressing, where the operand is a register
3. Base or displacement addressing, where the operand is at the memory location
whose address is the sum of a register and a constant in the instruction
4. PC-relative addressing, where the branch address is the sum of the PC and a
constant in the instruction
5. Pseudodirect addressing, where the jump address is the 26 bits of the
instruction concatenated with the upper bits of the PC
 2.10 MIPS Addressing for 32-bit Immediates and Addresses 117

1. Immediate addressing
op rs rt Immediate

2. Register addressing
op rs rt rd . . . funct Registers
Register

3. Base addressing
op rs rt Address Memory

Register + Byte Halfword Word

4. PC-relative addressing
op rs rt Address Memory

PC + Word

5. Pseudodirect addressing
op Address Memory

PC Word

FIGURE 2.18 Illustration of the five MIPS addressing modes. The operands are shaded in color.
The operand of mode 3 is in memory, whereas the operand for mode 2 is a register. Note that versions of
load and store access bytes, halfwords, or words. For mode 1, the operand is 16 bits of the instruction itself.
Modes 4 and 5 address instructions in memory, with mode 4 adding a 16-bit address shifted left 2 bits to the
PC and mode 5 concatenating a 26-bit address shifted left 2 bits with the 4 upper bits of the PC. Note that a
single operation can use more than one addressing mode. Add, for example, uses both immediate (addi)
and register (add) addressing.

Although we show MIPS as having 32-bit addresses, nearly all microprocessors Hardware/
(including MIPS) have 64-bit address extensions (see Appendix E and Section
2.18). These extensions were in response to the needs of software for larger
Software
programs. The process of instruction set extension allows architectures to expand in Interface
such a way that is able to move software compatibly upward to the next generation
of architecture.
118 Chapter 2 Instructions: Language of the Computer

Decoding Machine Language

Sometimes you are forced to reverse-engineer machine language to create the
original assembly language. One example is when looking at “core dump.” Figure
2.19 shows the MIPS encoding of the fields for the MIPS machine language. This
figure helps when translating by hand between assembly language and machine
language.

Decoding Machine Code

EXAMPLE
What is the assembly language statement corresponding to this machine
instruction?
00af8020hex

The first step in converting hexadecimal to binary is to find the op fields:

ANSWER
(Bits: 31 28 26 5 2 0)
0000 0000 1010 1111 1000 0000 0010 0000
We look at the op field to determine the operation. Referring to Figure 2.19,
when bits 31–29 are 000 and bits 28–26 are 000, it is an R-format instruction.
Let’s reformat the binary instruction into R-format fields, listed in Figure 2.20:
op rs rt rd shamt funct
000000 00101 01111 10000 00000 100000
The bottom portion of Figure 2.19 determines the operation of an R-format
instruction. In this case, bits 5–3 are 100 and bits 2–0 are 000, which means
this binary pattern represents an add instruction.
We decode the rest of the instruction by looking at the field values. The
decimal values are 5 for the rs field, 15 for rt, and 16 for rd (shamt is unused).
Figure 2.14 shows that these numbers represent registers $a1, $t7, and $s0.
Now we can reveal the assembly instruction:
add $s0,$a1,$t7
 2.10 MIPS Addressing for 32-bit Immediates and Addresses 119

op(31:26)
28–26 0(000) 1(001) 2(010) 3(011) 4(100) 5(101) 6(110) 7(111)

31–29
0(000) R-format Bltz/gez jump jump & link branch eq branch blez bgtz
ne
1(001) add addiu set less set less andi ori xori load upper
immediate than imm. than imm. immediate
unsigned
2(010) TLB FlPt
3(011)
4(100) load byte load half lwl load word load byte load lwr
unsigned half
unsigned
5(101) store byte store half swl store word swr
6(110) load linked lwc1
word
7(111) store cond. swc1
word

op(31:26)=010000 (TLB), rs(25:21)

23–21 0(000) 1(001) 2(010) 3(011) 4(100) 5(101) 6(110) 7(111)

25–24
0(00) mfc0 cfc0 mtc0 ctc0
1(01)
2(10)
3(11)

op(31:26)=000000 (R-format), funct(5:0)

2–0 0(000) 1(001) 2(010) 3(011) 4(100) 5(101) 6(110) 7(111)
5–3
0(000) shift left shift right sra sllv srlv srav
logical logical
1(001) jump register jalr syscall break
2(010) mfhi mthi mflo mtlo
3(011) mult multu div divu
4(100) add addu subtract subu and or xor not or (nor)
5(101) set l.t. set l.t.
unsigned
6(110)
7(111)

FIGURE 2.19 MIPS instruction encoding. This notation gives the value of a field by row and by column. For example, the top portion
of the figure shows load word in row number 4 (100two for bits 31–29 of the instruction) and column number 3 (011two for bits 28–26 of the
instruction), so the corresponding value of the op field (bits 31–26) is 100011two. Underscore means the field is used elsewhere. For example,
R-format in row 0 and column 0 (op  000000two) is defined in the bottom part of the figure. Hence, subtract in row 4 and column
2 of the bottom section means that the funct field (bits 5–0) of the instruction is 100010two and the op field (bits 31–26) is 000000two. The
floating point value in row 2, column 1 is defined in Figure 3.18 in Chapter 3. Bltz/gez is the opcode for four instructions found
in Appendix A: bltz, bgez, bltzal, and bgezal. This chapter describes instructions given in full name using color, while Chapter 3
describes instructions given in mnemonics using color. Appendix A covers all instructions.
120 Chapter 2 Instructions: Language of the Computer

Name Fields Comments

Field size 6 bits 5 bits 5 bits 5 bits 5 bits 6 bits All MIPS instructions are 32 bits long
R-format op rs rt rd shamt funct Arithmetic instruction format
I-format op rs rt address/immediate Transfer, branch,imm. format
J-format op target address Jump instruction format

FIGURE 2.20 MIPS instruction formats.

Figure 2.20 shows all the MIPS instruction formats. Figure 2.1 on page 64 shows
the MIPS assembly language revealed in this chapter. The remaining hidden portion
of MIPS instructions deals mainly with arithmetic and real numbers, which are
covered in the next chapter.

Check I. What is the range of addresses for conditional branches in MIPS (K  1024)?
Yourself 1. Addresses between 0 and 64K  1
2. Addresses between 0 and 256K  1
3. Addresses up to about 32K before the branch to about 32K after
4. Addresses up to about 128K before the branch to about 128K after
II. What is the range of addresses for jump and jump and link in MIPS
(M  1024K)?
1. Addresses between 0 and 64M  1
2. Addresses between 0 and 256M  1
3. Addresses up to about 32M before the branch to about 32M after
4. Addresses up to about 128M before the branch to about 128M after
5. Anywhere within a block of 64M addresses where the PC supplies the
upper 6 bits
6. Anywhere within a block of 256M addresses where the PC supplies the
upper 4 bits
III. What is the MIPS assembly language instruction corresponding to the
machine instruction with the value 0000 0000hex?
1. j
2. R-format
3. addi
4. sll
5. mfc0
6. Undefined opcode: there is no legal instruction that corresponds to 0