The hand-written parts of the manual still described how the retired xenia-rs interpreter behaved: its snapshots, Rust casts and helpers. Each of those 490 statements is now either restated as what Canary's emitters and x64 backend actually do (at the pinned canary_experimental commit), or dropped where it only made sense for xenia-rs. Checking them turned up claims that were wrong, not just outdated: - VSCR[SAT] is never modelled in Canary (DID_SATURATE is a stub and mfvscr cannot see it); the pages said saturating ops set it stickily. - Canary does not implement lswi/lswx/stswi/stswx, dcbi, mtfsb0/mtfsb1, vmsum*, vmhaddshs, vupkhpx/vupklpx, and most SPRs; pages described them as working. - Traps evaluate TO in Canary; stvebx/stvehx/stvewx store one element, not 16 bytes; mtmsrd writes only EE; fres/frsqrte/vrsqrtefp precision claims and the stfs "rounds under RN / sets FPSCR" claim contradicted the spec. - Reservations are a 64 KiB block bitmap plus a value compare, not per-address tracking. Claims that neither Canary's source nor a public spec settles are marked unverified (NI at boot, vmaddcfp128 operand order, estimate bit-exactness). Generated regions are untouched; re-running the generator changes nothing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
7.1 KiB
td — Trap Doubleword
Category: Branch & System · Form: X · Opcode:
0x7c000088
Assembler Mnemonics
| Mnemonic | XML entry | Flags | Description |
|---|---|---|---|
td |
td |
— | Trap Doubleword |
Syntax
td [TO], [RA], [RB]
Encoding
td — form X
- Opcode word:
0x7c000088 - Primary opcode (bits 0–5):
31 - Extended opcode:
68 - Synchronising: no
| Bits | Field | Meaning |
|---|---|---|
| 0–5 | OPCD |
primary opcode |
| 6–10 | RT/FRT/VRT |
destination |
| 11–15 | RA/FRA/VRA |
source A |
| 16–20 | RB/FRB/VRB |
source B |
| 21–30 | XO |
extended opcode (10 bits) |
| 31 | Rc |
record-form flag |
Operands
| Field | Role | Description |
|---|---|---|
TO |
td: read | Trap-on condition mask (5 bits) — LT, GT, EQ, LGT, LLT bits. |
RA |
td: read | Source GPR (r0–r31). |
RB |
td: read | Source GPR. |
Register Effects
td
- Reads (always):
TO,RA,RB - Reads (conditional): none
- Writes (always): none
- Writes (conditional): none
Status-Register Effects
No condition-register or status-register effects.
Operation (pseudocode)
; No hand-written pseudocode for this instruction yet.
; The authoritative semantics are the Canary emitter snapshot under
; Implementation References; about half of Canary's emitters open
; with the PPC-style definition as a comment (`RD <- (RA) + (RB)`).
; Every side effect is also enumerated in the Register Effects and
; Status-Register Effects tables above.
C Translation Example
/* No hand-written C yet. Translate the Canary emitter snapshot */
/* under Implementation References; its HIR maps directly: */
/* f.LoadGPR(n) / f.StoreGPR(n, v) -> r[n] / r[n] = v */
/* f.LoadFPR / StoreFPR, f.LoadVR / StoreVR -> f[n], v[n] */
/* f.Load(ea, T), f.Store(ea, v) -> raw read / write; emitters */
/* wrap them in f.ByteSwap for the big-endian guest value */
/* f.UpdateCR(n, v) -> CR field n from v's LOW 32 BITS vs 0 */
/* f.LoadCA / f.StoreCA -> xer.CA; f.StoreSAT -> vscr.SAT */
/* i.XO.RA, i.D.DS, ... -> the bit-fields listed under Operands */
/* The Register Effects and Status-Register Effects tables above */
/* enumerate every side effect a faithful translation must emit. */
Implementation References
td
- Canary XML:
tools/ppc-instructions.xml— search formnem="td" - Canary emitter:
src/xenia/cpu/ppc/ppc_emit_control.cc:554 - Sylpheed opcode:
crates/sylpheed-ppc/src/opcode.rs:290 - Sylpheed decoder:
crates/sylpheed-ppc/src/decoder.rs:884
Canary emitter (frozen snapshot @ f21ebd49e9)
int InstrEmit_td(PPCHIRBuilder& f, const InstrData& i) {
if (cvars::ignore_trap_instructions) {
return 0;
}
// a <- (RA)
// b <- (RB)
// if (a < b) & TO[0] then TRAP
// if (a > b) & TO[1] then TRAP
// if (a = b) & TO[2] then TRAP
// if (a <u b) & TO[3] then TRAP
// if (a >u b) & TO[4] then TRAP
Value* ra = f.LoadGPR(i.X.RA);
Value* rb = f.LoadGPR(i.X.RB);
return InstrEmit_trap(f, i, ra, rb, i.X.RT);
}
Special Cases & Edge Conditions
-
TOmask encoding (5 bits, MSB-first). Each bit selects one comparison; the trap fires if any selected condition is true. Both operands are treated as 64-bit doublewords:Bit Mnemonic Triggered when TO[0](16)LT (int64) RA < (int64) RBTO[1](8)GT (int64) RA > (int64) RBTO[2](4)EQ RA == RBTO[3](2)LGT (uint64) RA < (uint64) RB(logical less)TO[4](1)LLT (uint64) RA > (uint64) RB(logical greater — historical naming) -
TO = 31is unconditional trap. All five bits set ⇒ the trap fires regardless of operand values; the simplified mnemonictrapistw 31, 0, 0for words andtd 31, 0, 0for doublewords. The PowerISA also usestdi 31, 0, 0(ortwi) as a debugger break. -
64-bit comparison. Unlike
tw,tdalways compares the full 64-bit GPRs. On the Xenon (64-bit) this is meaningful; PPC32 implementations don't havetd. -
No register effects. Only the side effect is the trap. No CR/LR/CTR/XER updates.
-
Hardware behaviour. When the trap fires, hardware raises a Program interrupt with
SRR1[TRAP]set and vectors to0x700. The Xbox 360 hypervisor / kernel handles it (assertion failure, debugger trap, etc.). -
Canary evaluates the condition. Canary evaluates
TOproperly: it compares the operands for each set bit and emits a conditional trap (TrapTrue), andTO = 0emits nothing. Theignore_trap_instructionscvar suppresses traps entirely. -
Distinguishing assert vs. break. Compilers commonly emit
tdne r3, r3(impossible) ortdi 0, r0, 0patterns that cannot trap as inert markers. Canary evaluatesTO, so these stay inert.
Related Instructions
tdi— same condition test against a 16-bit signed immediate (D-form).tw/twi— 32-bit (word) variants for comparing low halves of GPRs.sc— synchronous kernel entry via system-call exception (different vector, different intent).mtmsr— kernel returns from the trap handler viarfid-family instructions.
Simplified Mnemonics
| Simplified | Expansion | Triggered when |
|---|---|---|
td RA, RB (=tdu) |
td 31, RA, RB |
unconditional trap |
tdeq RA, RB |
td 4, RA, RB |
RA == RB |
tdne RA, RB |
td 24, RA, RB |
RA != RB |
tdlt RA, RB |
td 16, RA, RB |
signed less than |
tdle RA, RB |
td 20, RA, RB |
signed less or equal |
tdgt RA, RB |
td 8, RA, RB |
signed greater than |
tdge RA, RB |
td 12, RA, RB |
signed greater or equal |
tdllt RA, RB |
td 2, RA, RB |
unsigned less than |
tdlge RA, RB |
td 5, RA, RB |
unsigned greater or equal |
tdlgt RA, RB |
td 1, RA, RB |
unsigned greater than |
tdlle RA, RB |
td 6, RA, RB |
unsigned less or equal |
IBM Reference
- AIX 7.3 —
td(Trap Doubleword) - AIX 7.3 — Trap simplified mnemonics
- PowerISA v2.07B, Book I §3.3.11 — fixed-point trap instructions (
TOsemantics).