[PATCH v3 01/33] target/ppc: Fix gen_sc to use correct nip

BALATON Zoltan posted 33 patches 6 months, 3 weeks ago
Maintainers: BALATON Zoltan <balaton@eik.bme.hu>, Nicholas Piggin <npiggin@gmail.com>, Daniel Henrique Barboza <danielhb413@gmail.com>
There is a newer version of this series
[PATCH v3 01/33] target/ppc: Fix gen_sc to use correct nip
Posted by BALATON Zoltan 6 months, 3 weeks ago
Most exceptions are raised with nip pointing to the faulting
instruction but the sc instruction generating a syscall exception
leaves nip pointing to next instruction. Fix gen_sc to not use
gen_exception_err() which sets nip back but correctly set nip to
pc_next so we don't have to patch this in the exception handlers.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
---
 target/ppc/excp_helper.c | 43 ++--------------------------------------
 target/ppc/translate.c   | 15 ++++++--------
 2 files changed, 8 insertions(+), 50 deletions(-)

diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 0712098cf7..92fe535815 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -116,7 +116,7 @@ static void dump_syscall(CPUPPCState *env)
                   ppc_dump_gpr(env, 0), ppc_dump_gpr(env, 3),
                   ppc_dump_gpr(env, 4), ppc_dump_gpr(env, 5),
                   ppc_dump_gpr(env, 6), ppc_dump_gpr(env, 7),
-                  ppc_dump_gpr(env, 8), env->nip);
+                  ppc_dump_gpr(env, 8), env->nip - 4);
 }
 
 static void dump_hcall(CPUPPCState *env)
@@ -131,7 +131,7 @@ static void dump_hcall(CPUPPCState *env)
                   ppc_dump_gpr(env, 7), ppc_dump_gpr(env, 8),
                   ppc_dump_gpr(env, 9), ppc_dump_gpr(env, 10),
                   ppc_dump_gpr(env, 11), ppc_dump_gpr(env, 12),
-                  env->nip);
+                  env->nip - 4);
 }
 
 #ifdef CONFIG_TCG
@@ -516,12 +516,6 @@ static void powerpc_excp_40x(PowerPCCPU *cpu, int excp)
         break;
     case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
         dump_syscall(env);
-
-        /*
-         * We need to correct the NIP which in this case is supposed
-         * to point to the next instruction
-         */
-        env->nip += 4;
         break;
     case POWERPC_EXCP_FIT:       /* Fixed-interval timer interrupt           */
         trace_ppc_excp_print("FIT");
@@ -632,12 +626,6 @@ static void powerpc_excp_6xx(PowerPCCPU *cpu, int excp)
         break;
     case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
         dump_syscall(env);
-
-        /*
-         * We need to correct the NIP which in this case is supposed
-         * to point to the next instruction
-         */
-        env->nip += 4;
         break;
     case POWERPC_EXCP_FPU:       /* Floating-point unavailable exception     */
     case POWERPC_EXCP_DECR:      /* Decrementer exception                    */
@@ -780,13 +768,6 @@ static void powerpc_excp_7xx(PowerPCCPU *cpu, int excp)
         } else {
             dump_syscall(env);
         }
-
-        /*
-         * We need to correct the NIP which in this case is supposed
-         * to point to the next instruction
-         */
-        env->nip += 4;
-
         /*
          * The Virtual Open Firmware (VOF) relies on the 'sc 1'
          * instruction to communicate with QEMU. The pegasos2 machine
@@ -932,13 +913,6 @@ static void powerpc_excp_74xx(PowerPCCPU *cpu, int excp)
         } else {
             dump_syscall(env);
         }
-
-        /*
-         * We need to correct the NIP which in this case is supposed
-         * to point to the next instruction
-         */
-        env->nip += 4;
-
         /*
          * The Virtual Open Firmware (VOF) relies on the 'sc 1'
          * instruction to communicate with QEMU. The pegasos2 machine
@@ -1098,12 +1072,6 @@ static void powerpc_excp_booke(PowerPCCPU *cpu, int excp)
         break;
     case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
         dump_syscall(env);
-
-        /*
-         * We need to correct the NIP which in this case is supposed
-         * to point to the next instruction
-         */
-        env->nip += 4;
         break;
     case POWERPC_EXCP_FPU:       /* Floating-point unavailable exception     */
     case POWERPC_EXCP_APU:       /* Auxiliary processor unavailable          */
@@ -1428,13 +1396,6 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
         } else {
             dump_syscall(env);
         }
-
-        /*
-         * We need to correct the NIP which in this case is supposed
-         * to point to the next instruction
-         */
-        env->nip += 4;
-
         /* "PAPR mode" built-in hypercall emulation */
         if (lev == 1 && books_vhyp_handles_hcall(cpu)) {
             PPCVirtualHypervisorClass *vhc =
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index 93ffec787c..e112c44a02 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -4472,22 +4472,19 @@ static void gen_hrfid(DisasContext *ctx)
 #endif
 
 /* sc */
-#if defined(CONFIG_USER_ONLY)
-#define POWERPC_SYSCALL POWERPC_EXCP_SYSCALL_USER
-#else
-#define POWERPC_SYSCALL POWERPC_EXCP_SYSCALL
-#endif
 static void gen_sc(DisasContext *ctx)
 {
-    uint32_t lev;
-
     /*
      * LEV is a 7-bit field, but the top 6 bits are treated as a reserved
      * field (i.e., ignored). ISA v3.1 changes that to 5 bits, but that is
      * for Ultravisor which TCG does not support, so just ignore the top 6.
      */
-    lev = (ctx->opcode >> 5) & 0x1;
-    gen_exception_err(ctx, POWERPC_SYSCALL, lev);
+    uint32_t lev = (ctx->opcode >> 5) & 0x1;
+#ifdef CONFIG_USER_ONLY
+    gen_exception_err(ctx, POWERPC_EXCP_SYSCALL_USER, lev);
+#else
+    gen_exception_err_nip(ctx, POWERPC_EXCP_SYSCALL, lev, ctx->base.pc_next);
+#endif
 }
 
 #if defined(TARGET_PPC64)
-- 
2.30.9
Re: [PATCH v3 01/33] target/ppc: Fix gen_sc to use correct nip
Posted by Nicholas Piggin 6 months, 2 weeks ago
On Wed May 8, 2024 at 10:14 AM AEST, BALATON Zoltan wrote:
> Most exceptions are raised with nip pointing to the faulting
> instruction but the sc instruction generating a syscall exception
> leaves nip pointing to next instruction. Fix gen_sc to not use
> gen_exception_err() which sets nip back but correctly set nip to
> pc_next so we don't have to patch this in the exception handlers.
>
> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
> ---
>  target/ppc/excp_helper.c | 43 ++--------------------------------------
>  target/ppc/translate.c   | 15 ++++++--------
>  2 files changed, 8 insertions(+), 50 deletions(-)
>
> diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
> index 0712098cf7..92fe535815 100644
> --- a/target/ppc/excp_helper.c
> +++ b/target/ppc/excp_helper.c
> @@ -116,7 +116,7 @@ static void dump_syscall(CPUPPCState *env)
>                    ppc_dump_gpr(env, 0), ppc_dump_gpr(env, 3),
>                    ppc_dump_gpr(env, 4), ppc_dump_gpr(env, 5),
>                    ppc_dump_gpr(env, 6), ppc_dump_gpr(env, 7),
> -                  ppc_dump_gpr(env, 8), env->nip);
> +                  ppc_dump_gpr(env, 8), env->nip - 4);
>  }
>  
>  static void dump_hcall(CPUPPCState *env)
> @@ -131,7 +131,7 @@ static void dump_hcall(CPUPPCState *env)
>                    ppc_dump_gpr(env, 7), ppc_dump_gpr(env, 8),
>                    ppc_dump_gpr(env, 9), ppc_dump_gpr(env, 10),
>                    ppc_dump_gpr(env, 11), ppc_dump_gpr(env, 12),
> -                  env->nip);
> +                  env->nip - 4);
>  }
>  
>  #ifdef CONFIG_TCG
> @@ -516,12 +516,6 @@ static void powerpc_excp_40x(PowerPCCPU *cpu, int excp)
>          break;
>      case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
>          dump_syscall(env);
> -
> -        /*
> -         * We need to correct the NIP which in this case is supposed
> -         * to point to the next instruction
> -         */
> -        env->nip += 4;
>          break;
>      case POWERPC_EXCP_FIT:       /* Fixed-interval timer interrupt           */
>          trace_ppc_excp_print("FIT");
> @@ -632,12 +626,6 @@ static void powerpc_excp_6xx(PowerPCCPU *cpu, int excp)
>          break;
>      case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
>          dump_syscall(env);
> -
> -        /*
> -         * We need to correct the NIP which in this case is supposed
> -         * to point to the next instruction
> -         */
> -        env->nip += 4;
>          break;
>      case POWERPC_EXCP_FPU:       /* Floating-point unavailable exception     */
>      case POWERPC_EXCP_DECR:      /* Decrementer exception                    */
> @@ -780,13 +768,6 @@ static void powerpc_excp_7xx(PowerPCCPU *cpu, int excp)
>          } else {
>              dump_syscall(env);
>          }
> -
> -        /*
> -         * We need to correct the NIP which in this case is supposed
> -         * to point to the next instruction
> -         */
> -        env->nip += 4;
> -
>          /*
>           * The Virtual Open Firmware (VOF) relies on the 'sc 1'
>           * instruction to communicate with QEMU. The pegasos2 machine
> @@ -932,13 +913,6 @@ static void powerpc_excp_74xx(PowerPCCPU *cpu, int excp)
>          } else {
>              dump_syscall(env);
>          }
> -
> -        /*
> -         * We need to correct the NIP which in this case is supposed
> -         * to point to the next instruction
> -         */
> -        env->nip += 4;
> -
>          /*
>           * The Virtual Open Firmware (VOF) relies on the 'sc 1'
>           * instruction to communicate with QEMU. The pegasos2 machine
> @@ -1098,12 +1072,6 @@ static void powerpc_excp_booke(PowerPCCPU *cpu, int excp)
>          break;
>      case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
>          dump_syscall(env);
> -
> -        /*
> -         * We need to correct the NIP which in this case is supposed
> -         * to point to the next instruction
> -         */
> -        env->nip += 4;
>          break;
>      case POWERPC_EXCP_FPU:       /* Floating-point unavailable exception     */
>      case POWERPC_EXCP_APU:       /* Auxiliary processor unavailable          */
> @@ -1428,13 +1396,6 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
>          } else {
>              dump_syscall(env);
>          }
> -
> -        /*
> -         * We need to correct the NIP which in this case is supposed
> -         * to point to the next instruction
> -         */
> -        env->nip += 4;
> -
>          /* "PAPR mode" built-in hypercall emulation */
>          if (lev == 1 && books_vhyp_handles_hcall(cpu)) {
>              PPCVirtualHypervisorClass *vhc =
> diff --git a/target/ppc/translate.c b/target/ppc/translate.c
> index 93ffec787c..e112c44a02 100644
> --- a/target/ppc/translate.c
> +++ b/target/ppc/translate.c
> @@ -4472,22 +4472,19 @@ static void gen_hrfid(DisasContext *ctx)
>  #endif
>  
>  /* sc */
> -#if defined(CONFIG_USER_ONLY)
> -#define POWERPC_SYSCALL POWERPC_EXCP_SYSCALL_USER
> -#else
> -#define POWERPC_SYSCALL POWERPC_EXCP_SYSCALL
> -#endif
>  static void gen_sc(DisasContext *ctx)
>  {
> -    uint32_t lev;
> -
>      /*
>       * LEV is a 7-bit field, but the top 6 bits are treated as a reserved
>       * field (i.e., ignored). ISA v3.1 changes that to 5 bits, but that is
>       * for Ultravisor which TCG does not support, so just ignore the top 6.
>       */
> -    lev = (ctx->opcode >> 5) & 0x1;
> -    gen_exception_err(ctx, POWERPC_SYSCALL, lev);
> +    uint32_t lev = (ctx->opcode >> 5) & 0x1;
> +#ifdef CONFIG_USER_ONLY
> +    gen_exception_err(ctx, POWERPC_EXCP_SYSCALL_USER, lev);
> +#else
> +    gen_exception_err_nip(ctx, POWERPC_EXCP_SYSCALL, lev, ctx->base.pc_next);
> +#endif

I think this is the nail in the coffin for this one. Let's shelve it.

Thanks,
Nick
Re: [PATCH v3 01/33] target/ppc: Fix gen_sc to use correct nip
Posted by BALATON Zoltan 6 months, 2 weeks ago
On Wed, 8 May 2024, Nicholas Piggin wrote:
> On Wed May 8, 2024 at 10:14 AM AEST, BALATON Zoltan wrote:
>> Most exceptions are raised with nip pointing to the faulting
>> instruction but the sc instruction generating a syscall exception
>> leaves nip pointing to next instruction. Fix gen_sc to not use
>> gen_exception_err() which sets nip back but correctly set nip to
>> pc_next so we don't have to patch this in the exception handlers.
>>
>> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
>> ---
>>  target/ppc/excp_helper.c | 43 ++--------------------------------------
>>  target/ppc/translate.c   | 15 ++++++--------
>>  2 files changed, 8 insertions(+), 50 deletions(-)
>>
>> diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
>> index 0712098cf7..92fe535815 100644
>> --- a/target/ppc/excp_helper.c
>> +++ b/target/ppc/excp_helper.c
>> @@ -116,7 +116,7 @@ static void dump_syscall(CPUPPCState *env)
>>                    ppc_dump_gpr(env, 0), ppc_dump_gpr(env, 3),
>>                    ppc_dump_gpr(env, 4), ppc_dump_gpr(env, 5),
>>                    ppc_dump_gpr(env, 6), ppc_dump_gpr(env, 7),
>> -                  ppc_dump_gpr(env, 8), env->nip);
>> +                  ppc_dump_gpr(env, 8), env->nip - 4);
>>  }
>>
>>  static void dump_hcall(CPUPPCState *env)
>> @@ -131,7 +131,7 @@ static void dump_hcall(CPUPPCState *env)
>>                    ppc_dump_gpr(env, 7), ppc_dump_gpr(env, 8),
>>                    ppc_dump_gpr(env, 9), ppc_dump_gpr(env, 10),
>>                    ppc_dump_gpr(env, 11), ppc_dump_gpr(env, 12),
>> -                  env->nip);
>> +                  env->nip - 4);
>>  }
>>
>>  #ifdef CONFIG_TCG
>> @@ -516,12 +516,6 @@ static void powerpc_excp_40x(PowerPCCPU *cpu, int excp)
>>          break;
>>      case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
>>          dump_syscall(env);
>> -
>> -        /*
>> -         * We need to correct the NIP which in this case is supposed
>> -         * to point to the next instruction
>> -         */
>> -        env->nip += 4;
>>          break;
>>      case POWERPC_EXCP_FIT:       /* Fixed-interval timer interrupt           */
>>          trace_ppc_excp_print("FIT");
>> @@ -632,12 +626,6 @@ static void powerpc_excp_6xx(PowerPCCPU *cpu, int excp)
>>          break;
>>      case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
>>          dump_syscall(env);
>> -
>> -        /*
>> -         * We need to correct the NIP which in this case is supposed
>> -         * to point to the next instruction
>> -         */
>> -        env->nip += 4;
>>          break;
>>      case POWERPC_EXCP_FPU:       /* Floating-point unavailable exception     */
>>      case POWERPC_EXCP_DECR:      /* Decrementer exception                    */
>> @@ -780,13 +768,6 @@ static void powerpc_excp_7xx(PowerPCCPU *cpu, int excp)
>>          } else {
>>              dump_syscall(env);
>>          }
>> -
>> -        /*
>> -         * We need to correct the NIP which in this case is supposed
>> -         * to point to the next instruction
>> -         */
>> -        env->nip += 4;
>> -
>>          /*
>>           * The Virtual Open Firmware (VOF) relies on the 'sc 1'
>>           * instruction to communicate with QEMU. The pegasos2 machine
>> @@ -932,13 +913,6 @@ static void powerpc_excp_74xx(PowerPCCPU *cpu, int excp)
>>          } else {
>>              dump_syscall(env);
>>          }
>> -
>> -        /*
>> -         * We need to correct the NIP which in this case is supposed
>> -         * to point to the next instruction
>> -         */
>> -        env->nip += 4;
>> -
>>          /*
>>           * The Virtual Open Firmware (VOF) relies on the 'sc 1'
>>           * instruction to communicate with QEMU. The pegasos2 machine
>> @@ -1098,12 +1072,6 @@ static void powerpc_excp_booke(PowerPCCPU *cpu, int excp)
>>          break;
>>      case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
>>          dump_syscall(env);
>> -
>> -        /*
>> -         * We need to correct the NIP which in this case is supposed
>> -         * to point to the next instruction
>> -         */
>> -        env->nip += 4;
>>          break;
>>      case POWERPC_EXCP_FPU:       /* Floating-point unavailable exception     */
>>      case POWERPC_EXCP_APU:       /* Auxiliary processor unavailable          */
>> @@ -1428,13 +1396,6 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
>>          } else {
>>              dump_syscall(env);
>>          }
>> -
>> -        /*
>> -         * We need to correct the NIP which in this case is supposed
>> -         * to point to the next instruction
>> -         */
>> -        env->nip += 4;
>> -
>>          /* "PAPR mode" built-in hypercall emulation */
>>          if (lev == 1 && books_vhyp_handles_hcall(cpu)) {
>>              PPCVirtualHypervisorClass *vhc =
>> diff --git a/target/ppc/translate.c b/target/ppc/translate.c
>> index 93ffec787c..e112c44a02 100644
>> --- a/target/ppc/translate.c
>> +++ b/target/ppc/translate.c
>> @@ -4472,22 +4472,19 @@ static void gen_hrfid(DisasContext *ctx)
>>  #endif
>>
>>  /* sc */
>> -#if defined(CONFIG_USER_ONLY)
>> -#define POWERPC_SYSCALL POWERPC_EXCP_SYSCALL_USER
>> -#else
>> -#define POWERPC_SYSCALL POWERPC_EXCP_SYSCALL
>> -#endif
>>  static void gen_sc(DisasContext *ctx)
>>  {
>> -    uint32_t lev;
>> -
>>      /*
>>       * LEV is a 7-bit field, but the top 6 bits are treated as a reserved
>>       * field (i.e., ignored). ISA v3.1 changes that to 5 bits, but that is
>>       * for Ultravisor which TCG does not support, so just ignore the top 6.
>>       */
>> -    lev = (ctx->opcode >> 5) & 0x1;
>> -    gen_exception_err(ctx, POWERPC_SYSCALL, lev);
>> +    uint32_t lev = (ctx->opcode >> 5) & 0x1;
>> +#ifdef CONFIG_USER_ONLY
>> +    gen_exception_err(ctx, POWERPC_EXCP_SYSCALL_USER, lev);
>> +#else
>> +    gen_exception_err_nip(ctx, POWERPC_EXCP_SYSCALL, lev, ctx->base.pc_next);
>> +#endif
>
> I think this is the nail in the coffin for this one. Let's shelve it.

I really would like to get rid of all the +4s and long comments in 
excp_helper.c though so I won't let this go until we find a solution. I've 
now found that linux-user/ppc/cpu_loop.c handles this case and that also 
has a +4 that I've missed before so with that removed this should work. 
I'll try again.

Regards,
BALATON Zoltan
Re: [PATCH v3 01/33] target/ppc: Fix gen_sc to use correct nip
Posted by Nicholas Piggin 6 months, 2 weeks ago
On Thu May 9, 2024 at 1:17 AM AEST, BALATON Zoltan wrote:
> On Wed, 8 May 2024, Nicholas Piggin wrote:
> > On Wed May 8, 2024 at 10:14 AM AEST, BALATON Zoltan wrote:
> >> Most exceptions are raised with nip pointing to the faulting
> >> instruction but the sc instruction generating a syscall exception
> >> leaves nip pointing to next instruction. Fix gen_sc to not use
> >> gen_exception_err() which sets nip back but correctly set nip to
> >> pc_next so we don't have to patch this in the exception handlers.
> >>
> >> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
> >> ---
> >>  target/ppc/excp_helper.c | 43 ++--------------------------------------
> >>  target/ppc/translate.c   | 15 ++++++--------
> >>  2 files changed, 8 insertions(+), 50 deletions(-)
> >>
> >> diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
> >> index 0712098cf7..92fe535815 100644
> >> --- a/target/ppc/excp_helper.c
> >> +++ b/target/ppc/excp_helper.c
> >> @@ -116,7 +116,7 @@ static void dump_syscall(CPUPPCState *env)
> >>                    ppc_dump_gpr(env, 0), ppc_dump_gpr(env, 3),
> >>                    ppc_dump_gpr(env, 4), ppc_dump_gpr(env, 5),
> >>                    ppc_dump_gpr(env, 6), ppc_dump_gpr(env, 7),
> >> -                  ppc_dump_gpr(env, 8), env->nip);
> >> +                  ppc_dump_gpr(env, 8), env->nip - 4);
> >>  }
> >>
> >>  static void dump_hcall(CPUPPCState *env)
> >> @@ -131,7 +131,7 @@ static void dump_hcall(CPUPPCState *env)
> >>                    ppc_dump_gpr(env, 7), ppc_dump_gpr(env, 8),
> >>                    ppc_dump_gpr(env, 9), ppc_dump_gpr(env, 10),
> >>                    ppc_dump_gpr(env, 11), ppc_dump_gpr(env, 12),
> >> -                  env->nip);
> >> +                  env->nip - 4);
> >>  }
> >>
> >>  #ifdef CONFIG_TCG
> >> @@ -516,12 +516,6 @@ static void powerpc_excp_40x(PowerPCCPU *cpu, int excp)
> >>          break;
> >>      case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
> >>          dump_syscall(env);
> >> -
> >> -        /*
> >> -         * We need to correct the NIP which in this case is supposed
> >> -         * to point to the next instruction
> >> -         */
> >> -        env->nip += 4;
> >>          break;
> >>      case POWERPC_EXCP_FIT:       /* Fixed-interval timer interrupt           */
> >>          trace_ppc_excp_print("FIT");
> >> @@ -632,12 +626,6 @@ static void powerpc_excp_6xx(PowerPCCPU *cpu, int excp)
> >>          break;
> >>      case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
> >>          dump_syscall(env);
> >> -
> >> -        /*
> >> -         * We need to correct the NIP which in this case is supposed
> >> -         * to point to the next instruction
> >> -         */
> >> -        env->nip += 4;
> >>          break;
> >>      case POWERPC_EXCP_FPU:       /* Floating-point unavailable exception     */
> >>      case POWERPC_EXCP_DECR:      /* Decrementer exception                    */
> >> @@ -780,13 +768,6 @@ static void powerpc_excp_7xx(PowerPCCPU *cpu, int excp)
> >>          } else {
> >>              dump_syscall(env);
> >>          }
> >> -
> >> -        /*
> >> -         * We need to correct the NIP which in this case is supposed
> >> -         * to point to the next instruction
> >> -         */
> >> -        env->nip += 4;
> >> -
> >>          /*
> >>           * The Virtual Open Firmware (VOF) relies on the 'sc 1'
> >>           * instruction to communicate with QEMU. The pegasos2 machine
> >> @@ -932,13 +913,6 @@ static void powerpc_excp_74xx(PowerPCCPU *cpu, int excp)
> >>          } else {
> >>              dump_syscall(env);
> >>          }
> >> -
> >> -        /*
> >> -         * We need to correct the NIP which in this case is supposed
> >> -         * to point to the next instruction
> >> -         */
> >> -        env->nip += 4;
> >> -
> >>          /*
> >>           * The Virtual Open Firmware (VOF) relies on the 'sc 1'
> >>           * instruction to communicate with QEMU. The pegasos2 machine
> >> @@ -1098,12 +1072,6 @@ static void powerpc_excp_booke(PowerPCCPU *cpu, int excp)
> >>          break;
> >>      case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
> >>          dump_syscall(env);
> >> -
> >> -        /*
> >> -         * We need to correct the NIP which in this case is supposed
> >> -         * to point to the next instruction
> >> -         */
> >> -        env->nip += 4;
> >>          break;
> >>      case POWERPC_EXCP_FPU:       /* Floating-point unavailable exception     */
> >>      case POWERPC_EXCP_APU:       /* Auxiliary processor unavailable          */
> >> @@ -1428,13 +1396,6 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
> >>          } else {
> >>              dump_syscall(env);
> >>          }
> >> -
> >> -        /*
> >> -         * We need to correct the NIP which in this case is supposed
> >> -         * to point to the next instruction
> >> -         */
> >> -        env->nip += 4;
> >> -
> >>          /* "PAPR mode" built-in hypercall emulation */
> >>          if (lev == 1 && books_vhyp_handles_hcall(cpu)) {
> >>              PPCVirtualHypervisorClass *vhc =
> >> diff --git a/target/ppc/translate.c b/target/ppc/translate.c
> >> index 93ffec787c..e112c44a02 100644
> >> --- a/target/ppc/translate.c
> >> +++ b/target/ppc/translate.c
> >> @@ -4472,22 +4472,19 @@ static void gen_hrfid(DisasContext *ctx)
> >>  #endif
> >>
> >>  /* sc */
> >> -#if defined(CONFIG_USER_ONLY)
> >> -#define POWERPC_SYSCALL POWERPC_EXCP_SYSCALL_USER
> >> -#else
> >> -#define POWERPC_SYSCALL POWERPC_EXCP_SYSCALL
> >> -#endif
> >>  static void gen_sc(DisasContext *ctx)
> >>  {
> >> -    uint32_t lev;
> >> -
> >>      /*
> >>       * LEV is a 7-bit field, but the top 6 bits are treated as a reserved
> >>       * field (i.e., ignored). ISA v3.1 changes that to 5 bits, but that is
> >>       * for Ultravisor which TCG does not support, so just ignore the top 6.
> >>       */
> >> -    lev = (ctx->opcode >> 5) & 0x1;
> >> -    gen_exception_err(ctx, POWERPC_SYSCALL, lev);
> >> +    uint32_t lev = (ctx->opcode >> 5) & 0x1;
> >> +#ifdef CONFIG_USER_ONLY
> >> +    gen_exception_err(ctx, POWERPC_EXCP_SYSCALL_USER, lev);
> >> +#else
> >> +    gen_exception_err_nip(ctx, POWERPC_EXCP_SYSCALL, lev, ctx->base.pc_next);
> >> +#endif
> >
> > I think this is the nail in the coffin for this one. Let's shelve it.
>
> I really would like to get rid of all the +4s and long comments in 
> excp_helper.c though so I won't let this go until we find a solution. I've 

All the += 4 are just because the handlers are repeated so many times.
And with this you have to add the - 4 for other cases.

And you removed the comment but you didn't add one here. Comments aren't
really a problem.

> now found that linux-user/ppc/cpu_loop.c handles this case and that also 
> has a +4 that I've missed before so with that removed this should work. 
> I'll try again.

The invariant that nip always refers to the instruction that caused the
exception for synchronous exceptions is a good one, and the patch has
caused a bunch of problems, so I don't want to merge it.

Thanks,
Nick