MIPS: loading word in register $31

Question

this is my code:

jal next

next: lw $t0, 0x20($31)
         .
         .
         .
      sw $t0, 0x20($31)

I don't understand how this is loading word from register 31, if register 31 is the return address linked to next when jal was called.

What exactly is being loaded or saved onto register $t0?

Answer 1

$t0 is loaded with the word from memory that is 0x20 bytes after the instruction word following the jal instruction. If the jal was at address 0x80004000, $t0 would be loaded with the contents of address 0x80004000 + 0x4 + 0x20 = 0x80004024.

This is not a useful coding technique, and it may crash your program on some MIPS implementations that implement execute-only .text segments, which cannot be read or written.

Answer 2

Register $31 can be used in a lw instruction just as any other general purpose register. In this case, $31 will hold the address of the next instruction after the issued jal .

Therefore lw $t0, 0x20($31) will load in $t0 the contents of the word located 32 bytes after the address of the next instruction which issued the jal .

Usually the loaded value can be interpreted as an instruction, ie it will be stored in the text segment and may be used to perform self-modifying code if you modify the contents of $t0 and then sw it again to the same address.