Privileged Execution Model

All exceptions, interrupts, NMI, and explicit synchronous traps enter supervisor execution through the architectural event mechanism. SYSCALL is the explicit SYSTEM_CALL event (0x00000003); it uses the common EPC/ECS/EDS entry and returns with ERET.

Privilege and Event State

STATUS.PM is zero in user mode and one in supervisor mode. STATUS.EA indicates active event processing. STATUS.EDEPTH in bits 9..6 is the active event depth, and STATUS.UO in bit 10 records that the outer event originated in user mode. STATUS.PM, STATUS.EA, STATUS.EDEPTH, and STATUS.UO are hardware managed; WRSTATUS must preserve them. User execution always observes STATUS.PM=STATUS.EA=STATUS.EDEPTH=STATUS.UO=0.

STATUS.IE enables maskable interrupts, STATUS.TF requests single-step tracing, STATUS.RF suppresses one trace boundary, and STATUS.NI inhibits nested NMI admission. RDCR, WRCR, translation-state changes, event-control changes, and page-table context switches require supervisor privilege unless an instruction explicitly states otherwise.

User Context Bank

The user context bank consists of UPC, USP, UCS, UDS, USS, UCTL, and UINFO. UCTL contains saved UCTL.FLAGS in bits 15..0, saved UCTL.STATUS in bits 31..16, and UCTL.V in bit 32. UINFO contains UINFO.EVENT_CODE; its upper half is zero. A saved user STATUS image has STATUS.PM, STATUS.EA, STATUS.EDEPTH, and STATUS.UO clear.

While UCTL.V is zero, WRCR to UPC, USP, UCS, UDS, USS, or UINFO atomically stages the selected 64-bit value without validating the complete bank; UINFO still requires bits 63 through 32 to be zero. Writing UCTL.V=1, or writing another bank member while the resulting UCTL.V remains one, validates the complete candidate bank before atomically replacing the selected register. Complete-bank validation includes the event-code-dependent UINFO shape, valid user segment images and pointers, an executable UPC, and the required zero saved STATUS fields.

Software stages a context by writing UPC, USP, UCS, UDS, USS, and UINFO before writing UCTL.V=1. The bank belongs to the interrupted user thread and must be saved with its supervisor context across preemption or migration.

Initial Event Stacks and Payloads

A first user-origin SYSTEM_CALL selects SSS:SSP, a maskable interrupt selects ISS:ISP, and an exception or NMI selects FSS:FSP. BASIC events, including SYSTEM_CALL, have no payload and perform no stack-memory access. ERROR events store 16 bytes; PAGE and AUXILIARY events store 32 bytes. The event code in UINFO defines the payload shape.

A supervisor-origin event and every nested event push a complete event frame on the current SS:SP. They do not promote to another configured event stack. The saved SS:SP in the frame identifies the interrupted stack.

Event Entry and Failure

User-origin entry atomically saves the user context bank, optionally stores the payload, loads EPC/ECS/EDS and the selected initial stack, sets STATUS.PM and STATUS.EA, sets STATUS.EDEPTH to one and STATUS.UO to one, and clears STATUS.IE, STATUS.TF, and STATUS.RF. Supervisor and nested entry save the prior context in the full frame and increment STATUS.EDEPTH while preserving STATUS.UO.

Delivery failure selects DSS:DSP and attempts the corresponding EVENT_DELIVERY_FAILURE leaf event. The hidden current-DFA bit is set when that entry commits. Failure while current DFA is set, or failure of that delivery attempt, enters shutdown. A full frame saves the prior DFA state in FRAME_CONTROL.SAVED_DFA.

ERET Routing and Atomicity

ERET classifies its source before any stack access. STATUS.PM=1, STATUS.EA=0, STATUS.EDEPTH=0, STATUS.UO=0, and UCTL.V=1 performs direct initial user entry from the bank. STATUS.PM=1, STATUS.EA=1, STATUS.EDEPTH=1, STATUS.UO=1, and UCTL.V=1 returns the outer user event from the bank. Other supervisor states with STATUS.EA=1 and nonzero STATUS.EDEPTH restore a full frame from the current SS:SP. Every other combination raises INVALID_CONTROL_TRANSITION.

A U-bank return validates UCTL, UINFO, the user segment images, USP, and the executable UPC before committing. It restores user execution, clears UCTL.V, STATUS.EDEPTH, STATUS.UO, STATUS.EA, and current DFA, and never reads the stack. A stacked return validates the entire frame, requires saved STATUS.EDEPTH plus one to equal the current depth and saved STATUS.UO to match the current chain, then restores FRAME_CONTROL.STATUS and FRAME_CONTROL.SAVED_DFA atomically. A failed validation or target probe leaves the current context and return source unchanged.

Normative instruction-local behavior is defined by SYSCALL and ERET.