Sylpheed/tools/ppc-manual/control/mfspr.md

mfspr — Move from Special-Purpose Register

Category: Control / CR / SPR · Form: XFX · Opcode: 0x7c0002a6

Assembler Mnemonics

Mnemonic	XML entry	Flags	Description
mfspr	mfspr	—	Move from Special-Purpose Register

Syntax

mfspr [RD], [SPR]

Encoding

mfspr — form XFX

• Opcode word: 0x7c0002a6
• Primary opcode (bits 0–5): 31
• Extended opcode: 339
• Synchronising: no

Bits	Field	Meaning
0–5	OPCD	primary opcode (31)
6–10	RT	destination / source GPR
11–20	spr/tbr/FXM	SPR/TBR number (byte-swapped halves) or CR field mask
21–30	XO	extended opcode
31	—	reserved

Operands

Field	Role	Description
SPR	mfspr: read	Special-Purpose-Register number. Encoded with the two 5-bit halves swapped (bits 11-15 become the high half, bits 16-20 the low half).
RD	mfspr: write	Destination GPR.

Register Effects

mfspr

• Reads (always): SPR
• Reads (conditional): none
• Writes (always): RD
• Writes (conditional): none

Status-Register Effects

No condition-register or status-register effects.

Operation (pseudocode)

n <- spr_number(SPR)             ; SPR field has its two 5-bit halves swapped
RT <- SPR(n)

C Translation Example

/* mfspr RT, SPR  — SPR field has swapped halves                    */
uint32_t n = ((insn.SPR & 0x1F) << 5) | ((insn.SPR >> 5) & 0x1F);
switch (n) {
    case 1:   r[insn.RT] = xer_pack();   break;   /* XER   */
    case 8:   r[insn.RT] = lr;           break;   /* LR    */
    case 9:   r[insn.RT] = ctr;          break;   /* CTR   */
    case 256: r[insn.RT] = vrsave;       break;   /* VRSAVE*/
    case 268: r[insn.RT] = tb & 0xFFFFFFFFu; break; /* TBL */
    case 269: r[insn.RT] = tb >> 32;     break;   /* TBU   */
    default:  r[insn.RT] = 0;            break;
}

Implementation References

mfspr

• Canary XML: tools/ppc-instructions.xml — search for mnem="mfspr"
• Canary emitter: src/xenia/cpu/ppc/ppc_emit_control.cc:668
• Sylpheed opcode: crates/sylpheed-ppc/src/opcode.rs:174
• Sylpheed decoder: crates/sylpheed-ppc/src/decoder.rs:914

Canary emitter (frozen snapshot @ f21ebd49e9)

int InstrEmit_mfspr(PPCHIRBuilder& f, const InstrData& i) {
  // n <- spr[5:9] || spr[0:4]
  // if length(SPR(n)) = 64 then
  //   RT <- SPR(n)
  // else
  //   RT <- i32.0 || SPR(n)
  Value* v;
  const uint32_t n = ((i.XFX.spr & 0x1F) << 5) | ((i.XFX.spr >> 5) & 0x1F);
  switch (n) {
    case 1:
      // XER
      v = f.LoadXER();
      break;
    case 8:
      // LR
      v = f.LoadLR();
      break;
    case 9:
      // CTR
      v = f.LoadCTR();
      break;
    case 256:
      // VRSAVE

      v = f.ZeroExtend(f.LoadContext(offsetof(PPCContext, vrsave), INT32_TYPE),
                       INT64_TYPE);
      break;
    case 268:
      // TB
      v = f.LoadClock();
      break;
    case 269:
      // TBU
      v = f.Shr(f.LoadClock(), 32);
      break;
    case 287:
      // [ Processor Version Register (PVR) ]
      // PVR is a 32 bit, read-only register within the supervisor level.
      // Bits 0 to 15 are the version number.
      // Bits 16 to 31 are the revision number.
      // Known Values: 0x710600?, 0x710700, 0x710800 (Corona?);
      // Note: Some XEXs (such as mfgbootlauncher.xex) may check for a value
      // that's less than 0x710700.
      v = f.LoadConstantUint64(cvars::pvr);
      break;
    default:
      XEINSTRNOTIMPLEMENTED();
      return 1;
  }
  f.StoreGPR(i.XFX.RT, v);
  return 0;
}

SPR Number Encoding — the "halves swap"

The 10-bit spr field in the XFX form is stored in a transposed order: the bits that software names the high half (bits 5..9 of the SPR number) occupy instruction bits 16..20, and the low half (bits 0..4) occupies instruction bits 11..15. Software (and this manual) always refers to the logical, unswapped SPR number.

decoded_spr = ((field & 0x1F) << 5) | ((field >> 5) & 0x1F)

So a programmer writing mfspr RT, 8 (read LR) encodes spr-field = 0x100 — not 8. Assemblers handle this transparently; disassemblers reverse it. When writing a translator that parses raw instruction words, swap the halves explicitly.

SPR Map (Xenon subset modelled by xenia)

Decoded #	Name	Meaning	xenia-rs behaviour
1	XER	Fixed-point exception register (CA / OV / SO + length field)	packed with ctx.xer()
8	LR	Link register	ctx.lr
9	CTR	Count register	ctx.ctr
18	DSISR	Data-storage interrupt syndrome	returns 0 (stubbed)
19	DAR	Data-access register	returns 0 (stubbed)
256	VRSAVE	Vector-register save mask	ctx.vrsave
268	TBL	Time-base lower 32 bits	ctx.timebase & 0xFFFFFFFF
269	TBU	Time-base upper 32 bits	ctx.timebase >> 32
272–275	SPRG0..3	Software scratch registers (kernel)	returns 0 (stubbed)
287	PVR	Processor-version register	0x00710800 (Xenon signature)
1008–1009	HID0/1	Hardware implementation registers	returns 0 (stubbed)
1023	PIR	Processor-ID register	returns 0 (stubbed)

Unrecognised SPRs return 0 and log a warning. Games rarely read unmodelled SPRs; when they do it's usually clock-skew or sanity checks.

Special Cases & Edge Conditions

• Privilege. Some SPRs are privileged on real hardware (MSR, HID0/1, SPRG0..3, DSISR, DAR, PIR). Xbox 360 titles run in a mixed privilege model under the hypervisor; xenia exposes all SPRs without a privilege check because the captured title binaries never contain a real privileged read that should trap.
• LR and CTR have dedicated simplified mnemonics. Assemblers recognise mflr RT ≡ mfspr RT, 8 and mfctr RT ≡ mfspr RT, 9. Similarly mfxer RT ≡ mfspr RT, 1. Disassemblers emit the simplified forms; the translation agent should map both forms to the same abstract operation.
• mftb vs. mfspr TBL/TBU. Reading the time-base has a dedicated X-form variant mftb that uses a separate opcode. Post-Xbox-360 PowerISA deprecated mfspr TBL/TBU, but xenia accepts both. Prefer mftb in new translations.
• Side-effect-free. mfspr has no effect on any register beyond RT. It can be freely reordered with non-SPR-touching instructions.
• No Rc / OE. This is an XFX-form instruction; bit 31 is reserved (0).

Related Instructions

• mtspr — the inverse; write a GPR to an SPR.
• mftb — read time-base (preferred over mfspr TBL/TBU).
• mflr, mfctr, mfxer — simplified mnemonics of this instruction.
• mcrxr — move XER[SO..CA] to a CR field and clear them.

Simplified Mnemonics

Simplified	Expansion
mfxer RT	mfspr RT, 1
mflr RT	mfspr RT, 8
mfctr RT	mfspr RT, 9

IBM Reference

• AIX 7.3 — mfspr (Move from Special Purpose Register)
• PowerISA v2.07B — SPR number table and privilege rules