MIPS Instruction Set

Introduction

MIPS is a RISC instruction set from the early 1980s that went on to power workstations, the Sony PlayStation (an LSI R3000A, MIPS I), the Nintendo 64 (an NEC VR4300, MIPS III), the PlayStation Portable (the Allegrex, a MIPS32 core), the PlayStation 2 (the R5900), routers and set-top boxes. Every instruction is 32 bits, and there are 32 general registers, with $0 always zero. The explorer's own disassembler reads the whole line from MIPS I to MIPS64 Release 6 as variants you choose, including the PlayStation's GTE and the Nintendo 64's VR4300.

The pages: registers and ABIs, instruction formats, delay slots and load delays, the instructions in groups (arithmetic, loads and stores, branches, floating point, system control, coprocessor 2), Release 6, the differences between the instruction sets and the pseudo-instructions. Every instruction has an anchor, so a disassembled instruction in the explorer links to its entry.

A MIPS program opens in the explorer today as an ELF file: the viewer picks the instruction set from the file's flags, the byte order from the file, and the register names from its ABI. The instruction set, the byte order, the register names and the pseudo-instructions are all choices in the options bar. The PlayStation (PS-X EXE) and Nintendo 64 (.z64) program formats are not read yet; the decoder takes the variant, byte order, base address and entry point as options so that they can use it.

The variants the explorer decodes

The options bar picks one. A word that is an instruction of another variant but not of the chosen one is shown as not in this ISA, with the name of the instruction set that introduced it.

Variant	Chips and machines	Notes
MIPS I	R2000, R3000	The original 32-bit set, with the load delay slot.
PlayStation CPU	LSI R3000A in the Sony PlayStation (little-endian)	MIPS I with no TLB and no floating-point unit; coprocessor 2 is the GTE. Coprocessor 0 has the debug registers instead of the TLB ones.
MIPS II	R6000	Adds branch likely, traps, LL and SC, SYNC, square root and rounding, no load delay slot.
MIPS III	R4000, R4400	The 64-bit registers and the instructions that use them.
VR4300	NEC VR4300 in the Nintendo 64 (big-endian)	MIPS III with no coprocessor 2 and none of MIPS IV.
MIPS IV	R5000, R8000, R10000	Conditional moves, PREF, the floating-point condition codes, indexed floating-point loads and stores, multiply-add.
MIPS V	(the paired-single extension)	Adds the paired-single instructions. llvm does not decode them, so they are checked against the manuals only.
MIPS32 Release 1, 2, 5	4K, 24K, 74K, M-class cores	32-bit. Release 2 adds EXT, INS, ROTR, WSBH, SEB, SEH, RDHWR, DI, EI, SYNCI, MFHC1, MTHC1; Release 5 adds TLBINV and TLBINVF.
MIPS64 Release 1, 2, 5	5K, 20Kc, 25Kf, Octeon (as far as MIPS64)	MIPS64 adds DCLZ, DCLO; Release 2 the doubleword bit-field and byte-swap instructions.
MIPS32 and MIPS64 Release 6	I6400, P6600, M6250	Re-encodes much of the set; see Release 6.

Status of an instruction

Every word has a status for the chosen variant, shown with its own highlight and the status in words:

Status	Meaning
Documented	An instruction of the chosen variant.
Unpredictable	An instruction whose should-be-zero field is not zero. The manuals call the result unpredictable. The explorer shows the instruction it would be.
Not in this ISA	An instruction of another variant: for example LD in MIPS I, or an R6 branch in MIPS32 Release 2. It would trap as a reserved instruction. The note names the instruction set that has it.
Reserved	No MIPS instruction set defines this encoding.

Notation

The disassembly writes a mnemonic in lower case, the operands as the MIPS assemblers do and numbers in decimal: addiu $sp, $sp, -32, lw $a0, 16($sp), lui $at, 4660. A branch or jump shows its target address; with the setting “offset” it shows the byte offset from the delay slot, as llvm does. Registers are $0 to $31 or by ABI name. An instruction in a delay slot is marked. With pseudo-instructions on (the default), instructions that have a shorter assembler name are written with it (nop, move, b, beqz); with them off the instruction is shown as encoded. The explorer decodes each 4-byte aligned address; MIPS has no instruction that is not 4 bytes (except in the MIPS16e and microMIPS encodings, not yet decoded), so there is nothing to overlap.

Options

Option	Choices
Instruction set	One of the variants above. In an ELF file the default is the one the architecture bits of e_flags name.
Byte order	Big or little endian. ELF files say; the PlayStation is little-endian and the Nintendo 64 big-endian.
Register names	Numbers (`$4`), o32 names (`$a0` to `$a3`, `$t0` to `$t7`) or n32/n64 names (`$a0` to `$a7`, `$t0` to `$t3`).
Pseudo-instructions	On or off.

How the decoder was checked

The decoder is the explorer's own; llvm only checks it. For each instruction set the 32-bit space was compared word by word with llvm-mc --disassemble (about two million structured and random words for each of thirteen llvm configurations: every primary opcode with every value of the rs, rt, sa and function fields, the Release 6 register-pair rules, the immediate extremes). Every disagreement was investigated; the ones that remain are llvm's own gaps and leniencies and are listed on the differences page. Compiler output (clang and lld, MIPS I to MIPS64 Release 6, both byte orders, o32, n32 and n64) was compared with llvm-objdump. The GTE command numbers and layout were checked against the nocash PSX specifications, and the PlayStation and Nintendo 64 mnemonics against the two small disassemblers in the emulators.

Not described

Known, not yet covered

Reference and viewer: the MIPS16e and microMIPS (32 and 64) compact encodings, with 16-bit instructions. An ELF file that asks for them shows its 32-bit instructions only.
Reference and viewer: the DSP (Release 1 to 3), MSA (SIMD), MT (multithreading), VZ (virtualisation), EVA, CRC and GINV extensions of MIPS32 and MIPS64 (DVP and EVP are decoded, nothing else of MT).
Reference and viewer: the Nintendo 64 RSP vector unit (the signal processor's scalar and vector instructions) and the PlayStation Portable Allegrex VFPU. These are separate instruction sets that share the MIPS integer encodings.
Reference and viewer: the PlayStation 2 R5900 multimedia instructions, the Cavium Octeon, Loongson, and other vendor extensions.
Viewer: the PS-X EXE, PlayStation BIOS and Nintendo 64 ROM formats, which will use this decoder.

Unknown

Reference: the paired-single instructions are not decoded by llvm, so the decoder follows the manuals but has no second check for them. MDMX and MIPS-3D are not decoded.
Reference: the exact set of instructions of each shipped chip (for example which VR4300 variants decode MIPS IV encodings); the pages follow the architecture manuals.