Reviewed the PPC disassembler against two independent oracles: xenia-canary's
authoritative encoding table, and capstone 5.0.7 (PPC64 big-endian) run over
all 1,859,397 instructions in the reference title.
Decoding was already sound — our tables reproduce all 455 entries of canary's
`ppc_opcode_table_gen.cc` exactly, and every word we render as `.long` is
genuinely not an instruction (9,332 zero padding + 388 with reserved primary
opcode 0). The defects were all in the text layer:
- `mfocrf`/`mtocrf` were printed as `mfcr`/`mtcrf`. They share XO with the
wide forms and differ only in bit 11; the one-field form also carries an FXM
operand naming which CR field is touched. 163 of 165 `mfcr` sites in this
title are really `mfocrf`, so the disassembly was dropping that operand
entirely. (Canary folds both into one handler because the wide read is a safe
superset at runtime — a disassembler cannot.)
- `rlwinm rA,rS,0,0,31` produced no simplified form: every branch in
`fmt_rlwinm` was gated on `sh > 0`, but rotate-by-zero under a full mask is
still `slwi rA,rS,0`. It is the single most common `rlwinm` encoding here —
3,720 sites.
- `vor vD,vA,vA` and `vnor vD,vA,vA` are the vector move and complement
(`vmr`/`vnot`); 1,544 sites were left in base form. The guarded arms have to
precede the catch-all VX group or they are unreachable.
- Combined CTR+condition branches emitted `bdnzne`, a mnemonic assembled by
nothing. PowerISA names these `bdnzt`/`bdnzf`/`bdzt`/`bdzf` with the CR bit
as an operand.
- Static branch-prediction hints were discarded. The `at` bits in `BO`
(`001at`, `011at`, `1a00t`, `1a01t`) are the only record of the compiler's
prediction, and are now rendered as the ISA's `+`/`-` suffix.
- `twi`/`tdi` with TO=31 had no simplified form; the register form already had
`trap`, the immediate form's counterpart is `twui`/`tdui`. Also adds the
missing TO=3 (`lne`) row.
Capstone disagreements fall from 5,596 to 135, and every survivor is ours
being right for the target or a free choice of name:
- `dcbz128` vs `dcbzl` (55) — same encoding, Xenon name vs POWER name
- `lvx128`, `vsldoi128` (70) — primary opcode 4 is the VMX128 space on
Xenon; capstone applies POWER9, which reuses it for
`vcmpequd`/`maddhd`/`maddld`
- `slwi.` vs `rotlwi.` (10) — both name rotate-0/full-mask; capstone is
itself inconsistent here, using `slwi` when Rc=0
Adds `xenia-cpu --example decode_table_check`, which replays canary's table
through our decoder (455/455), and 9 regression tests.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
8401d4d511