Sylpheed/tools/ppc-manual/branch/sc.md

sc — System Call

Category: Branch & System · Form: SC · Opcode: 0x44000002 · sync

Assembler Mnemonics

Mnemonic	XML entry	Flags	Description
sc	sc	—	System Call

Syntax

sc [LEV]

Encoding

sc — form SC

• Opcode word: 0x44000002
• Primary opcode (bits 0–5): 17
• Extended opcode: —
• Synchronising: yes

Bits	Field	Meaning
0–5	OPCD	primary opcode (17)
6–19	—	reserved
20–26	LEV	exception level
27–29	—	reserved
30	1	fixed 1
31	—	reserved

Operands

Field	Role	Description
LEV	sc: read	System-call exception level (for sc).

Register Effects

sc

• Reads (always): LEV
• Reads (conditional): none
• Writes (always): none
• Writes (conditional): none

Status-Register Effects

No condition-register or status-register effects.

Operation (pseudocode)

system_call_exception(LEV)

C Translation Example

/* No hand-written C yet. Translate the Canary emitter snapshot   */
/* under Implementation References; its HIR maps directly:        */
/*   f.LoadGPR(n) / f.StoreGPR(n, v)  -> r[n] / r[n] = v          */
/*   f.LoadFPR / StoreFPR, f.LoadVR / StoreVR -> f[n], v[n]        */
/*   f.Load(ea, T), f.Store(ea, v) -> raw read / write; emitters   */
/*     wrap them in f.ByteSwap for the big-endian guest value      */
/*   f.UpdateCR(n, v)  -> CR field n from v's LOW 32 BITS vs 0     */
/*   f.LoadCA / f.StoreCA -> xer.CA;  f.StoreSAT -> vscr.SAT       */
/*   i.XO.RA, i.D.DS, ... -> the bit-fields listed under Operands  */
/* The Register Effects and Status-Register Effects tables above  */
/* enumerate every side effect a faithful translation must emit.  */

Implementation References

sc

• Canary XML: tools/ppc-instructions.xml — search for mnem="sc"
• Canary emitter: src/xenia/cpu/ppc/ppc_emit_control.cc:457
• Sylpheed opcode: crates/sylpheed-ppc/src/opcode.rs:214
• Sylpheed decoder: crates/sylpheed-ppc/src/decoder.rs:456

Canary emitter (frozen snapshot @ f21ebd49e9)

int InstrEmit_sc(PPCHIRBuilder& f, const InstrData& i) {
  // Game code should only ever use LEV=0.
  // LEV=2 is to signify 'call import' from Xenia.
  // TODO(gibbed): syscalls!
  if (i.SC.LEV == 0) {
    f.CallExtern(f.builtins()->syscall_handler);
    return 0;
  }
  if (i.SC.LEV == 2) {
    f.CallExtern(f.function());
    return 0;
  }
  XEINSTRNOTIMPLEMENTED();
  return 1;
}

Special Cases & Edge Conditions

• LEV field — kernel vs hypervisor. The 7-bit LEV operand selects the privilege level of the syscall:
  • LEV = 0 — supervisor (kernel) syscall. Standard application → kernel transition; targets the 0xC00 system-call vector.
  • LEV = 1 — reserved.
  • LEV = 2 — hypervisor syscall (HVcall). On the Xenon, sc 2 traps to the Xbox 360 hypervisor; this is how the kernel itself talks to the supervisor below it (e.g., for security operations, encrypted-memory accesses, page table updates).
• sc as written by titles. Almost all guest game code uses LEV = 0 to call XboxKrnl.exe. Game disassembly will show large jump tables of small thunks each ending in li r0, syscall_no; sc; blr.
• No condition or status side effects. sc updates no general-purpose register on entry — neither LR nor CR. The kernel sees the GPR/FPR snapshot as-is and reads the syscall number out of r0 (Xbox 360 ABI convention, not architectural).
• Return path. Hardware returns from sc via rfid-class instructions in the kernel handler; from the application's perspective execution resumes at CIA + 4. Canary emits sc as a host call (CallExtern of its syscall handler), after which the translated code simply continues at CIA + 4.
• Canary divergence vs hardware. Canary does not model the 0xC00 exception vector or save SRR0/SRR1. LEV=0 calls its syscall handler, LEV=2 is Canary's own marker for an import call, and any other LEV is unimplemented. This is sufficient because Xbox 360 titles don't observe SRR registers and Canary implements the kernel natively.
• Synchronisation. Marked sync in Canary's tools/ppc-instructions.xml — sc is context-synchronising (hardware completes all prior instructions before raising the exception). JITs must flush pending state before emitting the host call.
• Reserved bits. Bit 30 is fixed 1; bits 6–19 and 27–29 are reserved (must be 0). The 1-bit field at position 30 distinguishes the sc encoding from scv (later PowerISA addition, not present on the Xenon).

Related Instructions

• bx, bcx, bclrx, bcctrx — ordinary control flow alternatives.
• tw, twi, td, tdi — synchronous trap exceptions; another way to enter the kernel.
• mtmsr, mtmsrd — machine-state changes used by the kernel's sc handler on return (rfid/hrfid chain not separately documented in this manual).
• isync — context-synchronising sibling; sc itself implies an isync-like fence.

IBM Reference

• AIX 7.3 — sc (System Call)
• PowerISA v2.07B, Book III §7 — System Linkage interrupt definitions and LEV field semantics.