Introduction
PowerPC is the RISC instruction set that IBM, Motorola and Apple defined in 1991 from IBM's POWER architecture. It ran the Power Macintosh
(G3, G4 and G5), the Nintendo GameCube and Wii, the Xbox 360, the PlayStation 3 (the Cell's PPE) and many embedded controllers; today's
descendant, the Power ISA, runs IBM's POWER servers, where 64-bit little-endian code (ppc64le) is common on Linux. Every instruction is
32 bits long and there are 32 general registers. The explorer's own disassembler reads 32-bit and 64-bit PowerPC, the Power ISA up to 3.0 (and most of
2.07), AltiVec, VSX and the Gekko paired singles, as processor models you choose.
The instructions are on the pages in the side menu; each has an anchor, so a disassembled instruction in the explorer links to its entry. A PowerPC program opens in the explorer today as an ELF file: the byte order comes from the file, and the options bar picks the processor model, the register names, the simplified mnemonics, the condition register notation and how branch targets are written.
The processor models
| Model | Adds |
|---|---|
| Any PowerPC | Every instruction of every model below except the Gekko paired singles; the default for an ELF file, which does not name its processor. |
| PowerPC 32-bit (604e) | The 32-bit architecture: user and supervisor instructions, the segment registers, fsqrt, tlbia. |
| PowerPC 750 (G3) | As above, without fsqrt and fsqrts. |
| Gekko, Broadway | The 750 plus the paired singles and the locked cache. Broadway (Wii) adds no instructions. |
| PowerPC 7400 and 7450 (G4) | The 750 plus AltiVec. |
| PowerPC 64-bit, 970 (G5), POWER4 to POWER5 | The 64-bit instructions (ld, std, rldic*, mulld, divd, extsw, cntlzd), the segment lookaside buffer; AltiVec on the 970. |
| Cell PPE (PlayStation 3) | 64-bit, AltiVec and the extra vector loads and stores lvlx, lvrx, stvlx, stvrx. VMX128 (Xbox 360 Xenon) is not decoded. |
| POWER6 to POWER10 | ISA 2.05 (popcntb, cmpb, fcpsgn), 2.06 (VSX, divde), 2.07 (more VSX, vector crypto and 64-bit element instructions), 3.0 (darn, modulo, setb, cnttz*, new loads and stores). |
Status of an instruction
| Status | Meaning |
|---|---|
| Documented | An instruction of the chosen model. |
| Unpredictable | An invalid form: a reserved field is not zero, or an update-form load or store has ra of 0 (or of rt). The instruction is still shown. |
| Not in this model | An instruction of another model (for example ld on a 750). The note names what has it. |
| Reserved | No PowerPC instruction set the decoder knows defines this encoding. |
Registers
- General registers
r0tor31, 32 bits (64 on 64-bit models). In an address, anraof 0 means the value zero, notr0. - Floating-point registers
f0tof31, 64 bits, and the status registerFPSCR. - Condition register
CR: eight 4-bit fieldscr0tocr7, each with the bits LT, GT, EQ and SO; condition bit numbers run 0 to 31. Integer instructions with a dot setcr0, floating-point onescr1, vector compares with a dotcr6. - Link register
LRand count registerCTR, and the fixed-point exception registerXER(SO, OV, CA). - Vector registers
v0tov31withVSCRandVRSAVE(AltiVec), and the VSX registersvs0tovs63(the floating-point registers are the high halves ofvs0tovs31, the vector registers arevs32tovs63). - Special-purpose registers read and written with
mfsprandmtspr; the numbers the explorer names are listed on the supervisor page. The Gekko addsGQR0toGQR7,HID2,WPAR,DMA_UandDMA_L.
Bits and fields are numbered from the most significant end: bit 0 is the top bit of a word, bit 31 the bottom bit. Every table on these pages follows that.
Instruction formats
The primary opcode is bits 0 to 5. The extended opcode, where there is one, sits in the field named below.
| Form | Fields |
|---|---|
| I | LI 6-29, AA 30, LK 31 (branch) |
| B | BO 6-10, BI 11-15, BD 16-29, AA 30, LK 31 (conditional branch) |
| D | RT/RS 6-10, RA 11-15, D/SI/UI 16-31 |
| DS | RT/RS 6-10, RA 11-15, DS 16-29, XO 30-31 (64-bit loads and stores) |
| DQ | RT 6-10, RA 11-15, DQ 16-27, XO 28-31 |
| X | RT/RS 6-10, RA 11-15, RB 16-20, XO 21-30, Rc 31 |
| XL | BT/BO 6-10, BA/BI 11-15, BB 16-20, XO 21-30, LK 31 (CR logic and branch to LR, CTR) |
| XFX | RT 6-10, SPR or TBR 11-20 (the two halves swapped), XO 21-30 |
| XO | RT 6-10, RA 11-15, RB 16-20, OE 21, XO 22-30, Rc 31 |
| A | FRT 6-10, FRA 11-15, FRB 16-20, FRC 21-25, XO 26-30, Rc 31 (floating-point arithmetic) |
| M | RS 6-10, RA 11-15, SH/RB 16-20, MB 21-25, ME 26-30, Rc 31 (32-bit rotate) |
| MD, MDS | RS, RA, SH/RB, MB or ME 6 bits at 21-26, XO 27-29 (MD, with SH bit 30) or 27-30 (MDS), Rc 31 (64-bit rotate) |
| XS | X form with a 6-bit shift (bits 16-20 and 30) and XO 21-29 (sradi) |
| VA, VX, VC | AltiVec: VRT 6-10, VRA 11-15, VRB 16-20; VA adds VRC 21-25 and XO 26-31; VX has XO 21-31; VC has Rc 21 and XO 22-31 |
| XX2, XX3, XX4 | VSX: 6-bit register numbers whose top bit is a separate bit (TX 31, BX 30, AX 29, CX 28) |
Simplified mnemonics
With simplified mnemonics on (the default) an instruction that has a shorter assembler name is written with it; with them off it is shown as encoded.
| Written | Encoded as |
|---|---|
li rt, v, lis rt, v | addi rt, 0, v, addis rt, 0, v |
nop, mr ra, rs, not ra, rs | ori 0, 0, 0, or ra, rs, rs, nor ra, rs, rs |
sub rt, ra, rb | subf rt, rb, ra |
cmpwi, cmpw, cmplwi, cmpdi ... | cmpi, cmp, cmpli with the L bit |
slwi, srwi, clrlwi, clrrwi, rotlwi | rlwinm |
sldi, srdi, clrldi, rotldi, extrdi ... | rldicr, rldicl |
blr, bctr, bdnz, beq, bne, blt, bt, bf ... | bclr, bcctr, bc with BO and BI; a hint is written + or - |
mflr, mtlr, mfctr, mtctr, mfxer, mtxer | mfspr, mtspr with SPR 8, 9, 1 |
crclr, crset, crmove, crnot | crxor, creqv, cror, crnor with equal operands |
trap, tweq ... | tw 31, 0, 0, tw with a TO value |
lwsync, ptesync | sync 1, sync 2 |
Options
| Option | Choices |
|---|---|
| Processor model | One of the models above. The default is Any PowerPC. |
| Byte order | Big or little endian. ELF files say; most PowerPC code is big-endian, and the 64-bit little-endian code (ppc64le) of POWER8 and later is little-endian. |
| Register names | r3 (the default), plain numbers (3) or %r3. |
| Simplified mnemonics | On or off. |
| Condition register fields | cr1 (the default) or the number 1. |
| Branch targets | The address, or the offset relative to the branch. |
How the decoder was checked
The decoder is the explorer's own; llvm only checks it. About 1.2 million 32-bit words (every primary opcode with every 10-bit
extended opcode and several fills, register-field edges, immediate extremes, every BO and BI, every SPR number and a seeded random sample), in both byte orders,
were compared with llvm-mc --disassemble. Where llvm writes a simplified mnemonic, its text was assembled back with llvm-mc and had to give the same word.
llvm's disassembler ignores the processor model, so it cannot check which model has which instruction: that comes from the manuals, with the paired
singles checked against the opcode tables of the Dolphin emulator. Compiler output (clang and lld, 32-bit, 64-bit and little-endian 64-bit) was compared with llvm-objdump.
Not described
Known, not yet covered
- Reference and viewer: the ISA 3.1 (POWER10) instructions, including the 8-byte prefixed forms, and the ISA 3.0 and 3.1 vector and BCD instructions beyond those listed on the AltiVec page.
- Reference and viewer: decimal floating point, quad-precision floating point, transactional memory.
- Reference and viewer: Book E, the e500 SPE and VLE (16-bit) encodings, and the other embedded and hypervisor cache-inhibited instructions.
- Reference and viewer: VMX128 of the Xbox 360 Xenon.
- Viewer: the GameCube and Wii DOL and REL files, Wii WAD, PS3 SELF and PRX, Xbox 360 XEX, Mac OS PEF, which will use this decoder.
Unknown
- Reference: which instructions each shipped chip decodes beyond the architecture books (for example optional instructions of the 603 and 604); the models follow the manuals.
- Reference: the special-purpose register names beyond the ones listed on the supervisor page.
Links
Reference
- Power ISA specifications – the OpenPOWER Foundation's Power ISA books
- Dolphin emulator – its interpreter tables were used to check the paired singles
- LLVM documentation – the PowerPC target used to check the decoder