MIPS stack frame (and “addiu” instruction confusio

Question

I'm new to MIPS and am trying to understand the disassembly of a function.
(EDIT: it is dynamically linked to /lib/ld-uClib.so.0 and uses some usual libc functions, so I assume it was written in C using the uClibc toolchain, and should therefore have that calling procedure and stack frame, etc.).

At the start of the function it does

00400824 <practice_crackme>:
  400824:   3c1c0fc0    lui gp,0xfc0        ; ???
  400828:   279c673c    addiu   gp,gp,26428 ; ???
  40082c:   0399e021    addu    gp,gp,t9    ; ???

  400830:   27bd8020    addiu   sp,sp,-32736  ; sp -= 0x7fe0 (-32736=0xffff8020)
  400834:   34038670    li  v1,0x8670
  400838:   afbf7fdc    sw  ra,32732(sp)
  40083c:   afbe7fd8    sw  s8,32728(sp)
  400840:   afb77fd4    sw  s7,32724(sp)
  400844:   afb67fd0    sw  s6,32720(sp)
  400848:   afb57fcc    sw  s5,32716(sp)
  40084c:   afb47fc8    sw  s4,32712(sp)
  400850:   afb37fc4    sw  s3,32708(sp)
  400854:   afb27fc0    sw  s2,32704(sp)
  400858:   afb17fbc    sw  s1,32700(sp)
  40085c:   afb07fb8    sw  s0,32696(sp)
  400860:   03a3e823    subu    sp,sp,v1  ; sp-=0x8670 (local space=0x8670 bytes)
  400864:   afbc0018    sw  gp,24(sp)

Then at the end of the function it does:

  4009e0:   8fbc0018    lw  gp,24(sp)
  4009e4:   34088670    li  t0,0x8670
  4009e8:   03a8e821    addu    sp,sp,t0    ; sp+=0x8670; //remove local space
  4009ec:   8fbf7fdc    lw  ra,32732(sp)
  4009f0:   8fbe7fd8    lw  s8,32728(sp)
  4009f4:   8fb77fd4    lw  s7,32724(sp)
  4009f8:   8fb67fd0    lw  s6,32720(sp)
  4009fc:   8fb57fcc    lw  s5,32716(sp)
  400a00:   8fb47fc8    lw  s4,32712(sp)
  400a04:   8fb37fc4    lw  s3,32708(sp)
  400a08:   8fb27fc0    lw  s2,32704(sp)
  400a0c:   8fb17fbc    lw  s1,32700(sp)
  400a10:   8fb07fb8    lw  s0,32696(sp)
  400a14:   03e00008    jr  ra
  400a18:   27bd7fe0    addiu   sp,sp,32736 ; sp += 0x7fe0

Question #1:
Despite searching around for awhile on the internet, I still don't really understand how gp is supposed to be used in the stackframe.

In particular, the documents I read say the call procedure standard is a0-a3 are used as function input, v0-v3 as function output, s0-s8 are preserved across calls, and t0-t9 are not preserved across any call. So the pushing and popping of s0-s8 make sense. But why in the world is it setting gp according to the value in t9!?

Question #2:
I don't understand why it moves the stack pointer twice. It seems to reserve local space twice.

And on top of that, the addiu instruction is being disassembled with a negative number which doesn't make sense since the 'u' means unsigned, however the code doesn't make sense unless I actually consider it a negative number. I double checked the opcode by looking it up at en.wikipedia.org/wiki/MIPS_architecture. And it is indeed "addiu" and not "addi". I'm so confused here.

Answer 1

The first three instructions are for supporting Position Independent Code. See this linux-mips page for an excellent explanation of PIC on MIPS. t9 holds the address of the function, which can change every time you load a library supporting PIC, and that value is added to a constant already in gp. Similar to x86's:

call __i686.get_pc_thunk.bx
add $0x1b88, %ebx

Where __i686.get_pc_thunk.bx loads %ebx with the address of the next instruction, and the subsequent add converts %ebx into a point of reference that will be used to access global symbols.

ADDIU: The only difference between signed and unsigned addition on MIPS is that signed addition can raise an overflow exception, so ADDIU is used instead to avoid that.

Several stack adjustments: These probably relate to the fact that MIPS uses 16-bit immediates, so cannot always adjust the stack in one ADDIU.