Traps, Privilege Modes, and Interrupts

# Traps, Privilege Modes, and Interrupts

## CS 326 Operating Systems

L18 · November 3, 2026 · exercises `43k_traps` and `44k_interrupts` (Nov 6)

---

## Learning Objectives

- **Distinguish** exception, interrupt, and trap
- **State** what M, S, and U mode may each do
- **Explain** the six CSRs `start.rs` writes before `mret`
- **Describe** PMP and why skipping it silences the machine
- **Decode** an `scause` value and decide whether `sepc` advances
- **Derive** the timer path `mtimecmp` → `timervec` → `sip.SSIP`

---

## Three Privilege Modes

| Mode | Bits | Who runs there | May do |
|---|---|---|---|
| **M** machine | `11` | `entry.rs`, `start.rs`, `timervec` | Everything: all CSRs, all memory, PMP, the CLINT |
| **S** supervisor | `01` | the rv6 kernel | `s*` CSRs, `satp`, delegated traps, `sret`, `wfi` |
| **U** user | `00` | programs, from `48k_user_mode` | Ordinary instructions only. **No** CSR access |

The mode lives in two bits of hart state that **no instruction can read**.

---

## Three Properties That Bite Later

- **Privilege belongs to the hart, not the code.** `csrr t0, mstatus` is legal in M, illegal in S and U — checked at execution time
- **You cannot ask what mode you are in.** No readable `current_mode`; privilege is visible from below only through what fails
- **Down is a return, up is a trap.** No "enter user mode" instruction

<div class="info-box">
Privilege and address space are independent. Sv39 controls <strong>which bytes</strong> you reach; the mode controls <strong>which instructions</strong> you may execute.
</div>

---

## Moving Between Modes

The lower mode never chooses where it lands — the upper mode wrote that address into `mtvec` or `stvec` first.

---

## Three Words, Three Meanings

- **Exception** — *synchronous*. The executing instruction caused it. `ebreak`, page fault, illegal instruction, `ecall`
- **Interrupt** — *asynchronous*. Something outside the instruction stream. Timer, UART, disk
- **Trap** — the *transfer of control* either one causes

<div class="highlight-box">
Both share one vector register (<code>stvec</code>) and one cause register (<code>scause</code>). That is why they get conflated — and why bit 63 exists.
</div>

---

## Re-run, or Step Past?

- **Exception**: the instruction has **not** completed. `sepc` points *at* it
  - page fault you repaired → re-run
  - `ebreak` you counted → step past, or trap forever
- **Interrupt**: nothing failed. `sepc` already points at the next instruction → **never** advance it

<div class="info-box">
RISC-V traps are <strong>precise</strong>: everything before the trapping instruction completed, everything after had no effect. That is what lets <code>sepc</code> be one exact address.
</div>

---

## The M → S Handoff

```text
  start.rs:25  start()        in M-mode, no page table, full power
    |
    |  1. mstatus.MPP = 01        where mret goes        start.rs:28-31
    |  2. mepc = kmain            what pc mret loads     start.rs:34
    |  3. satp = 0                paging off for now     start.rs:37
    |  4. medeleg = mideleg       send traps to S        start.rs:40
    |  5. pmpaddr0 / pmpcfg0      let S touch memory     start.rs:43-44
    |     mcounteren              let S read `time`      start.rs:47
    |  6. timerinit()             arm the CLINT          start.rs:51
    v
  start.rs:54  mret  --------->  kmain, in S-mode
```

Six registers. All of them must be right.

---

## `mstatus.MPP` and `mepc`

- `mret` is a **return**: it reads its destination out of saved state
- `mstatus.MPP` (bits 12:11) = the mode it returns to — `00` U, `01` S, `11` M
- `mepc` = the address it returns to

<div class="highlight-box">
Neither was saved by a real trap. <code>start()</code> forges both, and <code>mret</code> cannot tell the difference — you enter a lower mode by <em>pretending you were already there</em>.
</div>

`mstatus` packs a dozen fields, so it is read-modify-write (`start.rs:28-31`), never a blind `csrw`.

---

## Delegation: `medeleg` and `mideleg`

- By default **every** trap is taken in M-mode
- `medeleg` = bitmask over exception causes; `mideleg` = over interrupt causes
- `start.rs:40` writes `0xffff` to both: causes 0–15 go straight to S-mode

<div class="highlight-box">
Some bits are hardwired zero: <code>medeleg</code> bit 11 (<code>ecall</code> from M), and <code>mideleg</code> bits 3, 7, 11. <strong>Machine-level interrupts cannot be delegated at all</strong> — which is why the timer needs a detour.
</div>

---

## PMP: Physical Memory Protection

- A handful of range registers checked on **every** S/U load, store, and fetch
- Sits **below** paging: survive the Sv39 walk, then survive PMP
- M-mode is exempt (unless the lock bit `L` is set)
- Purpose: let firmware fence regions off from the OS

QEMU `virt` implements **16 entries, all zero at reset** — matching nothing.

---

## PMP Fails Closed

<div class="highlight-box">
If <strong>no</strong> PMP entry matches an S/U access and at least one entry is implemented, the access <strong>fails</strong>. Not "allowed by default" — fails.
</div>

Skip it and: `mret` → S-mode at `kmain` → first fetch faults (cause 1) → delegated to `stvec`, still 0 → jump to 0 → fault → forever. **No output at all.**

```rust
asm!("li t0, 0x3fffffffffffff", "csrw pmpaddr0, t0", out("t0") _);  // start.rs:43
asm!("li t0, 0xf", "csrw pmpcfg0, t0", out("t0") _);                // start.rs:44
```

---

## Decoding `pmpcfg0`

| Bits | Field | `0xf` means |
|---|---|---|
| 0 | R | readable |
| 1 | W | writable |
| 2 | X | executable |
| 4:3 | A | `01` = TOR, top of range |
| 7 | L | unlocked, so M-mode stays exempt |

PMP addresses are byte addresses **shifted right by 2**, so
`pmpaddr0 = 0x3fffffffffffff` = 2<sup>54</sup>−1 covers up to 2<sup>56</sup>−4 — all of physical memory.

---

## Skip One Line, Get One Symptom

| Omission | Symptom |
|---|---|
| `mstatus.MPP` | Kernel runs in M-mode; `satp` is ignored |
| `mepc` | `mret` jumps to 0. Silence |
| `medeleg` / `mideleg` | Traps land in M-mode; `kerneltrap` never runs |
| `pmpcfg0` | Faults on the **first** memory access. Silence |
| `mcounteren` | `csrr t0, time` is an illegal instruction, cause 2 |

<div class="info-box">
Most of these print <strong>nothing</strong>. Attach GDB and read <code>mstatus</code>, <code>mepc</code>, <code>pmpcfg0</code> — guessing is not a strategy.
</div>

---

## What the Hardware Does on a Trap

1. cause → **`scause`** (kind in bit 63, code in the low bits)
2. address of the trapping instruction → **`sepc`**
3. faulting address → **`stval`**
4. `SIE` → `SPIE`; `SIE` = 0; previous mode → `SPP`
5. `pc` → **`stvec`**

<div class="highlight-box">
It does <strong>not</strong> save a single register, switch stacks, or switch page tables. Everything else is your software.
</div>

Step 4 is free non-reentrancy: **traps arrive with interrupts disabled**.

---

## `stvec` and Its Low Two Bits

- Low two bits are a **MODE** field, not address bits
- `00` Direct — every trap goes to BASE
- `01` Vectored — interrupt *i* goes to BASE + 4×*i*

rv6 uses Direct and dispatches in software, which is why `kerneltrap` starts by reading `scause`.

<div class="info-box">
<code>kernelvec</code> is declared <code>.align 4</code> (<code>trap.rs:89</code>) so the low bits are zero. A misaligned handler silently selects Vectored mode with a BASE three bytes off.
</div>

---

## `kernelvec`

```asm
kernelvec:
    addi sp, sp, -128      # trap.rs:91   frame on the CURRENT stack
    sd ra,   0(sp)         # trap.rs:92   save 16 caller-saved regs
    ...                    #              ra, t0-t2, a0-a7, t3-t6
    call kerneltrap        # trap.rs:109  into Rust
    ld ra,   0(sp)         # trap.rs:111  restore all sixteen
    ...
    addi sp, sp, 128       # trap.rs:127
    sret                   # trap.rs:129  resume at sepc, mode from SPP
```

Sixteen, not thirty-one: the C calling convention already preserves `s0`–`s11`. Assembly covers one half, the compiler the other.

---

## Decoding `scause`

```rust
if (scause >> 63) == 1 {          // trap.rs:55
    match scause & 0xff { ... }   // trap.rs:57  an interrupt
} else {
    if scause == 3 { ... }        // trap.rs:75  an exception
}
```

<div class="highlight-box">
Test the top bit <strong>first</strong>, always. The two cause spaces overlap completely.
</div>

---

## The Collisions

| Code | Interrupt (bit 63 = 1) | Exception (bit 63 = 0) |
|---|---|---|
| 1 | Supervisor software — rv6's timer tick | Instruction access fault |
| 3 | *(machine software)* | Breakpoint, `ebreak` |
| 5 | Supervisor timer — unused by rv6 | Load access fault |
| 8 | *(reserved)* | `ecall` from U-mode — a syscall |
| 9 | Supervisor external — a device via the PLIC | `ecall` from S-mode |

Miss the top-bit test and a page fault gets "handled" as a timer tick.

---

## Advancing `sepc`, and `sret`

```rust
if scause == 3 {
    TRAP_COUNT += 1;
    asm!("csrw sepc, {}", in(reg) sepc + 4);   // trap.rs:77
}
```

- `sepc` points **at** the `ebreak`; `sret` resumes there
- Forget the `+ 4` and the same instruction traps forever — silent, stack-neutral, infinite
- `sret`: `pc` ← `sepc`, mode ← `SPP`, `SIE` ← `SPIE`, `SPIE` ← 1, `SPP` ← 0

---

## One Trap, End to End

<div class="mermaid">
sequenceDiagram
    participant C as kernel code
    participant HW as hardware
    participant V as kernelvec
    participant K as kerneltrap
    C->>HW: ebreak (or a timer arrives)
    HW->>HW: scause, sepc, stval<br/>SPIE=SIE, SIE=0, SPP=1
    HW->>V: pc = stvec
    V->>V: sp -= 128; save ra, t*, a*
    V->>K: call kerneltrap
    K->>K: interrupt? clear sip.SSIP<br/>exception? sepc += 4
    K-->>V: return
    V->>V: restore regs; sp += 128
    V->>C: sret · pc=sepc, SIE=SPIE
</div>

---

## The CLINT

| Register | Address | Meaning |
|---|---|---|
| `mtime` | `0x0200_0000 + 0xBFF8` | Free-running 64-bit counter, 10 MHz on `virt` |
| `mtimecmp` | `0x0200_0000 + 0x4000` | Hart 0's alarm: pending while `mtime >= mtimecmp` |

- **Level-triggered**: the only way to clear it is to push `mtimecmp` forward
- `INTERVAL = 1_000_000` at 10 MHz = 0.1 s → ten ticks a second
- `start.rs:74` sets `mie.MTIE` (bit 7)

---

## Why Machine Mode Has to Arm It

- **`mtimecmp` is an M-mode device** — a physical address the kernel deliberately never maps, and `mie` is an M CSR S-mode cannot read
- **The machine timer interrupt cannot be delegated** — `mideleg` bit 7 is hardwired zero

<div class="highlight-box">
So the trap is taken in M-mode at <code>mtvec</code>, whatever the kernel wants. rv6, like xv6, installs <code>timervec</code> and forwards the tick down by hand.
</div>

---

## The Forwarding Path

<div class="mermaid">
flowchart TD
    A["mtime reaches mtimecmp"] --> B["machine timer interrupt, cause 7\ncannot be delegated"]
    B --> C["timervec · M-mode · start.rs:80"]
    C --> D["csrrw a0, mscratch, a0\nget a scratch register"]
    D --> E["mtimecmp += INTERVAL\nrearm, or it re-fires"]
    E --> F["li a1, 2 ; csrw sip, a1\nraise sip.SSIP"]
    F --> G["mret"]
    G --> H["supervisor software interrupt, cause 1\nscause = 0x8000...0001"]
    H --> I["kernelvec → kerneltrap · trap.rs:58"]
</div>

rv6's tick is a *software* interrupt carrying a *timer's* meaning — which is why `scause` reads 1, not 5.

---

## Three Gates, All Must Be Open

```rust
asm!("csrs sie, {}", in(reg) 1usize << 1);      // trap.rs:40  SSIE
asm!("csrs sstatus, {}", in(reg) 1usize << 1);  // trap.rs:41  SIE
```

An interrupt fires only when: bit set in `sie` **and** bit set in `sip` **and** `sstatus.SIE` = 1.

<div class="info-box">
Use <code>csrs</code>, not <code>csrw</code> — a blind write clears <code>sie.SEIE</code> and silently breaks the console in <code>45k_console</code>. In user mode, delegated interrupts are always enabled regardless of <code>SIE</code>.
</div>

---

## Then Clear the Pending Bit

```rust
asm!("csrr {}, sip", out(reg) sip);
asm!("csrw sip, {}", in(reg) sip & !2);   // trap.rs:63
```

<div class="highlight-box">
Skip it and you get an <strong>interrupt storm</strong>: <code>SSIP</code> still set, <code>SSIE</code> still set, <code>sret</code> restores <code>SIE</code> — so the trap re-fires on the first instruction after <code>sret</code>. One instruction of progress per trap, forever.
</div>

**No ticks** and **far too many ticks** are opposite bugs with identical silence.

---

## Preemption Needs a Timer

```text
COOPERATIVE                     PREEMPTIVE
  P1 runs ..........             P1 runs ....|tick|.... into the kernel
  P1 calls yield                 kernel: quantum expired
  kernel picks P2                kernel picks P2
  P2 loops forever               P2 loops forever
  *** machine is gone ***        kernel takes it back next tick
```

A cooperative scheduler is a **subroutine of the running program**. The only escape is an event the program does not control — an interrupt.

---

## What Preemption Would Cost

- Per-process time accounting, to tell "quantum expired" from "just arrived"
- A `swtch` from **inside** the trap handler
- A lock on every kernel structure the switch could interrupt — a switch can now happen at *any* instruction (`37k_spinlocks`)

<div class="info-box">
rv6 stays cooperative on purpose: deterministic, so a wrong <code>pick_next</code> gives a wrong <em>order</em>, not a heisenbug. Linux asks firmware for the same tick via SBI <code>TIME</code>; Sstc hardware deletes the detour entirely.
</div>

---

## Friday's Exercises (November 6)

- **`43k_traps`** — install `stvec`, catch an `ebreak`, return from it. A timeout means `sepc` never advanced
- **`44k_interrupts`** — open the gates, receive the forwarded ticks, clear `sip.SSIP`, count them

Then `45k_console` reuses the identical path for `scause = 9` (a keypress) and `48k_user_mode` for `scause = 8` (a system call).

<div class="highlight-box">
One vector, one cause register, three completely different subsystems.
</div>

---

## Summary

1. **Down is a return, up is a trap** — `mret`/`sret` restore forged state; the only way up is an event whose handler the upper mode chose
2. **Exception, interrupt, trap are three words** — bit 63 of `scause` is all that separates the overlapping cause codes
3. **Six CSRs, all must be right** — and PMP **fails closed**, so skipping it means total silence
4. **The hardware saves nothing** — `kernelvec` covers the caller-saved half, the calling convention the rest
5. **`sepc` decisions are yours** — advance past `ebreak`/`ecall`, never after an interrupt
6. **A timer is what makes a kernel a kernel** — no tick, no preemption, and one runaway loop owns the machine