What is the purpose of the PowerPC `bcctr` instruction?

Question

I am new to PowerPC architecture and I am looking at some disassembled code with bcctr instruction. Although the manual indicates how the bcctr instruction bcctr , it does not explain what it will usually be used for. Can you come up with examples of this use and find out in detail what the ctr recorder plays? I believe that it is used for indirect branches (for example, to make function pointers or vtables), but the goal of decrementing ctr register and then the branch in ctr is not entirely clear to me. Double use out of register as a counter and as a destination address is especially confusing.

Answer 1

bcctr (and its unconditional version, bctr ) is commonly used for branches in a function pointer.

The Power ISA instruction set has two instructions¹ that are available for branching to an address in the register: blr (branch to the link register) and bctr (branch register to the counter). Using bctr means that we can keep case references.

In this case, there is nothing special about using the ctr register - it’s just the address we are leading to. There will be an mtctr instruction in the mtctr , where we load the address into the ctr register.

You will bctrl also see bctrl : this sets the register of links to the current address + 4, and then leads the branch to the counter. This allows the call (via the function pointer) to return, returning back to the link register.

¹: in unprivileged mode, at least

Answer 2

looking at POWER ISA, I see:

bcctr = Register with a conditional name for the account

Usage: bcctr B0, BI, BH

Algorithm:

 cond_ok <- BO_0 | (CR_{BI+32} ≡ BO 1 ) if cond_ok then NIA <- {iea} CTR_{0:61} || 0b00 if LK then LR <- {iea} CIA + 4 

BI + 32 indicates the status register bit to be tested. The BO field is used to resolve the branch, as described in Figure 44. The BH field is used as described in Figure 46. The destination address of the branch is CTR 0:61 || 0b00, and the 32-bit high-order address of the destination branch address is set to 0 in 32-bit mode. If LK = 1, then the effective command address following the Branch instruction is placed in the link register. If the "decrement and CTR check" option is set (BO 2 = 0), the instruction form is invalid.

Source: Power ISA Version 2.07