The generator had not been able to run correctly since the manual moved into
`tools/ppc-manual/`: it computed the repository root as `HERE.parent.parent`,
which now names `tools/`, so the XML, Canary's emitters and xenia-rs all stopped
resolving — silently, because both scrapers skipped what they could not find.
Every page's references had been pointing at paths that exist nowhere.
What each source contributed, measured on the 350 pages before this change:
Operation (pseudocode) 251 pages: fixed boilerplate "derives from the xenia-rs
interpreter"; 99 carry real hand-written seeds
C translation 337 pages: the same kind of boilerplate
xenia-rs snapshot 336 pages: the interpreter arm, pasted in — the only
per-instruction semantics on unseeded pages
links xenia-rs opcode/decoder/interpreter + Canary emitter
Now:
* semantics come from **Xenia Canary**, the reference emulator, read through
`git show` at a pinned upstream commit (`origin/canary_experimental`,
f21ebd49e9). Not our checkout: it carries instrumentation and lacked
upstream's `mcrf` fix, so it would have published probes and a wrong `mcrf`.
Each page embeds the emitter (`InstrEmit_<mnem>`), and for the 128 pure
one-line delegations also the helper that holds the semantics.
* decode references point at `crates/sylpheed-ppc` — the decoder that
produces `sylpheed.db` — as in-repo relative links.
* the boilerplate now says what is true, and the C translation guide maps
Canary's actual HIR calls, checked against `ppc_hir_builder.h` (including
that `UpdateCR(n, v)` truncates to 32 bits).
* `rust_scraper.py` -> `decoder_scraper.py` (interpreter half dropped);
missing sources are now errors, not empty results.
Verified:
consistency checks 455 XML entries, 350 families, 598 index keys
hand-written tails 386/386 byte-identical after regeneration
xenia-rs in generated 0
pages with a snapshot 349/350 (was 336) — `dcbi` has no Canary emitter at all
in-repo decoder links 910/910 resolve to a line holding the identifier
emitter boundaries brace counter == column-0 `}` rule on 521/521;
preprocessor model unit-tested (#if 0/#else/#elif)
idempotency re-run: 0 pages updated, 0 working-tree changes
Hand-written notes (outside the generated regions) are not rewritten here:
* 110 links into `../../xenia-rs/...` were dead; they now point at the file in
the archived repository (git.mc02.dev/fabi/xenia-rs @ 8401d4d). Line anchors
were dropped because the notes predate that commit — 0 of 441 old line
ranges match it — and a precise-looking wrong anchor is worse than none. The
link text, which carries the author's line numbers, is unchanged.
* 140 prose claims about xenia-rs's behaviour remain. 23 are verified to hold
for Canary too (the 32-bit CR0 truncation, OE left unimplemented); the other
114 need checking one by one, and some invert — e.g. `divdx` notes a correct
64-bit CR0 update in xenia-rs where Canary's `UpdateCR` truncates. Left for
a deliberate pass rather than a blind substitution.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
7.4 KiB
td — Trap Doubleword
Category: Branch & System · Form: X · Opcode:
0x7c000088
Assembler Mnemonics
| Mnemonic | XML entry | Flags | Description |
|---|---|---|---|
td |
td |
— | Trap Doubleword |
Syntax
td [TO], [RA], [RB]
Encoding
td — form X
- Opcode word:
0x7c000088 - Primary opcode (bits 0–5):
31 - Extended opcode:
68 - Synchronising: no
| Bits | Field | Meaning |
|---|---|---|
| 0–5 | OPCD |
primary opcode |
| 6–10 | RT/FRT/VRT |
destination |
| 11–15 | RA/FRA/VRA |
source A |
| 16–20 | RB/FRB/VRB |
source B |
| 21–30 | XO |
extended opcode (10 bits) |
| 31 | Rc |
record-form flag |
Operands
| Field | Role | Description |
|---|---|---|
TO |
td: read | Trap-on condition mask (5 bits) — LT, GT, EQ, LGT, LLT bits. |
RA |
td: read | Source GPR (r0–r31). |
RB |
td: read | Source GPR. |
Register Effects
td
- Reads (always):
TO,RA,RB - Reads (conditional): none
- Writes (always): none
- Writes (conditional): none
Status-Register Effects
No condition-register or status-register effects.
Operation (pseudocode)
; No hand-written pseudocode for this instruction yet.
; The authoritative semantics are the Canary emitter snapshot under
; Implementation References; about half of Canary's emitters open
; with the PPC-style definition as a comment (`RD <- (RA) + (RB)`).
; Every side effect is also enumerated in the Register Effects and
; Status-Register Effects tables above.
C Translation Example
/* No hand-written C yet. Translate the Canary emitter snapshot */
/* under Implementation References; its HIR maps directly: */
/* f.LoadGPR(n) / f.StoreGPR(n, v) -> r[n] / r[n] = v */
/* f.LoadFPR / StoreFPR, f.LoadVR / StoreVR -> f[n], v[n] */
/* f.Load(ea, T), f.Store(ea, v) -> raw read / write; emitters */
/* wrap them in f.ByteSwap for the big-endian guest value */
/* f.UpdateCR(n, v) -> CR field n from v's LOW 32 BITS vs 0 */
/* f.LoadCA / f.StoreCA -> xer.CA; f.StoreSAT -> vscr.SAT */
/* i.XO.RA, i.D.DS, ... -> the bit-fields listed under Operands */
/* The Register Effects and Status-Register Effects tables above */
/* enumerate every side effect a faithful translation must emit. */
Implementation References
td
- Canary XML:
tools/ppc-instructions.xml— search formnem="td" - Canary emitter:
src/xenia/cpu/ppc/ppc_emit_control.cc:554 - Sylpheed opcode:
crates/sylpheed-ppc/src/opcode.rs:290 - Sylpheed decoder:
crates/sylpheed-ppc/src/decoder.rs:884
Canary emitter (frozen snapshot @ f21ebd49e9)
int InstrEmit_td(PPCHIRBuilder& f, const InstrData& i) {
if (cvars::ignore_trap_instructions) {
return 0;
}
// a <- (RA)
// b <- (RB)
// if (a < b) & TO[0] then TRAP
// if (a > b) & TO[1] then TRAP
// if (a = b) & TO[2] then TRAP
// if (a <u b) & TO[3] then TRAP
// if (a >u b) & TO[4] then TRAP
Value* ra = f.LoadGPR(i.X.RA);
Value* rb = f.LoadGPR(i.X.RB);
return InstrEmit_trap(f, i, ra, rb, i.X.RT);
}
Special Cases & Edge Conditions
-
TOmask encoding (5 bits, MSB-first). Each bit selects one comparison; the trap fires if any selected condition is true. Both operands are treated as 64-bit doublewords:Bit Mnemonic Triggered when TO[0](16)LT (int64) RA < (int64) RBTO[1](8)GT (int64) RA > (int64) RBTO[2](4)EQ RA == RBTO[3](2)LGT (uint64) RA < (uint64) RB(logical less)TO[4](1)LLT (uint64) RA > (uint64) RB(logical greater — historical naming) -
TO = 31is unconditional trap. All five bits set ⇒ the trap fires regardless of operand values; the simplified mnemonictrapistw 31, 0, 0for words andtd 31, 0, 0for doublewords. The PowerISA also usestdi 31, 0, 0(ortwi) as a debugger break. -
64-bit comparison. Unlike
tw,tdalways compares the full 64-bit GPRs. On the Xenon (64-bit) this is meaningful; PPC32 implementations don't havetd. -
No register effects. Only the side effect is the trap. No CR/LR/CTR/XER updates.
-
Hardware behaviour. When the trap fires, hardware raises a Program interrupt with
SRR1[TRAP]set and vectors to0x700. The Xbox 360 hypervisor / kernel handles it (assertion failure, debugger trap, etc.). -
xenia simplification. xenia-rs collapses all four trap variants (
td,tdi,tw,twi) into one match arm that unconditionally logs and returnsStepResult::Trap— it does not evaluateTOagainst the operands. This is a material divergence from the spec: in xenia every trap fires even if the condition is false. Real Xenon code rarely uses non-trivialTOmasks (typical use is the unconditionaltrapfor__assert/ debugger break), so the divergence is normally invisible. -
Distinguishing assert vs. break. Compilers commonly emit
tdne r3, r3(impossible) ortdi 0, r0, 0patterns that cannot trap as inert markers. Xenia's blanket trap would mis-fire on these — a small known bug; track it if you see spurious traps.
Related Instructions
tdi— same condition test against a 16-bit signed immediate (D-form).tw/twi— 32-bit (word) variants for comparing low halves of GPRs.sc— synchronous kernel entry via system-call exception (different vector, different intent).mtmsr— kernel returns from the trap handler viarfid-family instructions.
Simplified Mnemonics
| Simplified | Expansion | Triggered when |
|---|---|---|
td RA, RB (=tdu) |
td 31, RA, RB |
unconditional trap |
tdeq RA, RB |
td 4, RA, RB |
RA == RB |
tdne RA, RB |
td 24, RA, RB |
RA != RB |
tdlt RA, RB |
td 16, RA, RB |
signed less than |
tdle RA, RB |
td 20, RA, RB |
signed less or equal |
tdgt RA, RB |
td 8, RA, RB |
signed greater than |
tdge RA, RB |
td 12, RA, RB |
signed greater or equal |
tdllt RA, RB |
td 2, RA, RB |
unsigned less than |
tdlge RA, RB |
td 5, RA, RB |
unsigned greater or equal |
tdlgt RA, RB |
td 1, RA, RB |
unsigned greater than |
tdlle RA, RB |
td 6, RA, RB |
unsigned less or equal |
IBM Reference
- AIX 7.3 —
td(Trap Doubleword) - AIX 7.3 — Trap simplified mnemonics
- PowerISA v2.07B, Book I §3.3.11 — fixed-point trap instructions (
TOsemantics).