core/memory.rad core/state.rad core/pages.rad core/atomic.rad core/cpu.rad

CORE_ASM := arch/atomic.ras arch/context.ras

context.rv64: context.rad check/context.ras arch/entry.ras core.rad $(MODULES) $(CORE_ASM) $(COMPILER)

	$(COMPILE) $(CORE) -pkg context -start arch/entry.ras -mod context.rad -mod check/context.ras -entry context -o $@

check: all check.rv64 context.rv64

	$(EMU) -machine -no-guard-stack -max-steps=1000000 -count-instructions -run context.rv64

	rm -f kernel.rv64 check.rv64 context.rv64

record the contracts established through step 10 of the 22-step plan.

## Architectural execution boundary

- A private Frame holds x0..x31, mepc, mcause, mtval, mstatus, and the suspended

  machine stack at offsets 0, 256, 264, 272, 280, and 288.

- mscratch names the active Frame. Trap entry does not use the user stack or

  trust user gp, tp, or ra. Restore the machine stack and callee-saved registers

  before returning to safe kernel code.

- Trap entry clears the hart's LR/SC reservation through the private Frame before

  kernel code resumes. A context cannot consume another context's reservation.

- Entry sets MPP=U, clears privileged execution flags, and disables floating-point

  state. Kernel return keeps machine interrupts disabled. A separate M-mode

  idle entry waits for an enabled interrupt.

- Direct calls use a7 for the operation and a0..a6 for inputs. Error returns in

  a0 and up to four values in a1..a4; other user registers survive. Returning

  calls advance past ecall on both success and failure.

- RAS supports RV64A word/doubleword LR, SC, and AMOs with aq/rl/aqrl ordering.

  Machine checks cover register preservation, acquire/release exchange, call

  replies, privilege faults, misalignment, inaccessible memory, and idle wakeup.

make std-test bin-test

Run the context machine scenario: full integer state, ecall replies, faults, atomics, and timer wakeup from machine idle.

Run the context reservation probe with an emulator that retains LR/SC

reservations across traps. This checks the kernel's reservation invalidation.

.export @"core::atomic::exchange";

@"core::atomic::exchange"

	amoswap.w.aqrl %a0 %a1 0(%a0);

	slli   %a0    %a0    32;

	srli   %a0    %a0    32;

	ret;

// Integer context boundary. mscratch owns the active private Frame pointer.

.text;

.export @"core::cpu::enter";

@"core::cpu::enter"

	li     %a1    0;

	j      @saveKernel;

.export @"core::cpu::idle";

@"core::cpu::idle"

	li     %a1    1;

@saveKernel

	addi   %sp    %sp    -128;

	sd     %ra    0(%sp);

	sd     %s0    8(%sp);

	sd     %s1    16(%sp);

	sd     %s2    24(%sp);

	sd     %s3    32(%sp);

	sd     %s4    40(%sp);

	sd     %s5    48(%sp);

	sd     %s6    56(%sp);

	sd     %s7    64(%sp);

	sd     %s8    72(%sp);

	sd     %s9    80(%sp);

	sd     %s10   88(%sp);

	sd     %s11   96(%sp);

	sd     %gp    104(%sp);

	sd     %tp    112(%sp);

	sd     %sp    288(%a0);

	la     %t0    @trap;

	csrw   mtvec  %t0;

	csrw   mscratch %a0;

	beqz   %a1    @enterUser;

	la     %t0    @idleLoop;

	csrw   mepc   %t0;

	li     %t0    0x1880;

	csrw   mstatus %t0;

	mret;

@idleLoop

	wfi;

	j      @idleLoop;

@enterUser

	mv     %t6    %a0;

	ld     %t0    256(%t6);

	csrw   mepc   %t0;

	li     %t0    0x80;

	csrw   mstatus %t0;

	ld     %ra    8(%t6);

	ld     %sp    16(%t6);

	ld     %gp    24(%t6);

	ld     %tp    32(%t6);

	ld     %t0    40(%t6);

	ld     %t1    48(%t6);

	ld     %t2    56(%t6);

	ld     %s0    64(%t6);

	ld     %s1    72(%t6);

	ld     %a0    80(%t6);

	ld     %a1    88(%t6);

	ld     %a2    96(%t6);

	ld     %a3    104(%t6);

	ld     %a4    112(%t6);

	ld     %a5    120(%t6);

	ld     %a6    128(%t6);

	ld     %a7    136(%t6);

	ld     %s2    144(%t6);

	ld     %s3    152(%t6);

	ld     %s4    160(%t6);

	ld     %s5    168(%t6);

	ld     %s6    176(%t6);

	ld     %s7    184(%t6);

	ld     %s8    192(%t6);

	ld     %s9    200(%t6);

	ld     %s10   208(%t6);

	ld     %s11   216(%t6);

	ld     %t3    224(%t6);

	ld     %t4    232(%t6);

	ld     %t5    240(%t6);

	ld     %t6    248(%t6);

	mret;

@trap

	csrrw  %t6    mscratch %t6;

	beqz   %t6    @fatal;

	sd     %zero  0(%t6);

	sd     %ra    8(%t6);

	sd     %sp    16(%t6);

	sd     %gp    24(%t6);

	sd     %tp    32(%t6);

	sd     %t0    40(%t6);

	// Any SC clears the hart reservation; saved x0 is safe even if it succeeds.

	sc.d   %t0    %zero  0(%t6);

	sd     %t1    48(%t6);

	sd     %t2    56(%t6);

	sd     %s0    64(%t6);

	sd     %s1    72(%t6);

	sd     %a0    80(%t6);

	sd     %a1    88(%t6);

	sd     %a2    96(%t6);

	sd     %a3    104(%t6);

	sd     %a4    112(%t6);

	sd     %a5    120(%t6);

	sd     %a6    128(%t6);

	sd     %a7    136(%t6);

	sd     %s2    144(%t6);

	sd     %s3    152(%t6);

	sd     %s4    160(%t6);

	sd     %s5    168(%t6);

	sd     %s6    176(%t6);

	sd     %s7    184(%t6);

	sd     %s8    192(%t6);

	sd     %s9    200(%t6);

	sd     %s10   208(%t6);

	sd     %s11   216(%t6);

	sd     %t3    224(%t6);

	sd     %t4    232(%t6);

	sd     %t5    240(%t6);

	csrr   %t0    mscratch;

	sd     %t0    248(%t6);

	csrr   %t0    mepc;

	sd     %t0    256(%t6);

	csrr   %t0    mcause;

	sd     %t0    264(%t6);

	csrr   %t0    mtval;

	sd     %t0    272(%t6);

	csrr   %t0    mstatus;

	sd     %t0    280(%t6);

	ld     %sp    288(%t6);

	csrw   mscratch %zero;

	ld     %ra    0(%sp);

	ld     %s0    8(%sp);

	ld     %s1    16(%sp);

	ld     %s2    24(%sp);

	ld     %s3    32(%sp);

	ld     %s4    40(%sp);

	ld     %s5    48(%sp);

	ld     %s6    56(%sp);

	ld     %s7    64(%sp);

	ld     %s8    72(%sp);

	ld     %s9    80(%sp);

	ld     %s10   88(%sp);

	ld     %s11   96(%sp);

	ld     %gp    104(%sp);

	ld     %tp    112(%sp);

	addi   %sp    %sp    128;

	ret;

@fatal

	csrw   mie    %zero;

@fatalIdle

	wfi;

	j      @fatalIdle;

// Trusted machine regression probes; these are not admitted domain images.

.text;

.export @"context::entry";

@"context::entry"

	la     %a0    @user;

	ret;

.export @"context::checkpoint";

@"context::checkpoint"

	la     %a0    @checkpoint;

	ret;

.export @"context::alarm";

@"context::alarm"

	li     %t0    0x0200bff8;

	ld     %t1    0(%t0);

	addi   %t1    %t1    200;

	li     %t0    0x02004000;

	sd     %t1    0(%t0);

	li     %t0    128;

	csrw   mie    %t0;

	ret;

.export @"context::cancel";

@"context::cancel"

	csrw   mie    %zero;

	li     %t0    0x02004000;

	li     %t1    -1;

	sd     %t1    0(%t0);

	ret;

@user

	li     %ra    1;

	li     %sp    2;

	li     %gp    3;

	li     %tp    4;

	li     %t0    5;

	li     %t1    6;

	li     %t2    7;

	li     %s0    8;

	li     %s1    9;

	li     %a0    10;

	li     %a1    11;

	li     %a2    12;

	li     %a3    13;

	li     %a4    14;

	li     %a5    15;

	li     %a6    16;

	li     %a7    17;

	li     %s2    18;

	li     %s3    19;

	li     %s4    20;

	li     %s5    21;

	li     %s6    22;

	li     %s7    23;

	li     %s8    24;

	li     %s9    25;

	li     %s10   26;

	li     %s11   27;

	li     %t3    28;

	li     %t4    29;

	li     %t5    30;

	li     %t6    31;

@checkpoint

	ecall;

	addi   %a0    %a0    100;

	ecall;

	csrr   %a0    mstatus;

	ld     %a0    1(%zero);

	li     %t0    0x40000000;

	sd     %zero  0(%t0);

	ebreak;

// Return the two user entries; Frame initialization supplies shared memory in a0.

.export @"context::reservationEntry";

@"context::reservationEntry"

	la     %a0    @reservation;

	ret;

.export @"context::reservationPeerEntry";

@"context::reservationPeerEntry"

	la     %a0    @reservationPeer;

	ret;

// Frame A observes zero, yields, then tries to overwrite frame B's store.

@reservation

	lr.d   %a1    0(%a0);

	ecall;

	li     %t0    2;

	sc.d   %a2    %t0    0(%a0);

	ecall;

// Frame B stores one and replaces A's reservation with its own before yielding.

@reservationPeer

	li     %t0    1;

	sd     %t0    0(%a0);

	lr.d   %a1    0(%a0);

	ecall;

//! Machine-mode regression for real user traps and protected kernel resumption.

use core::abi;

use core::atomic;

use core::cpu;

/// Address of the fixed user register and fault probe.

fn entry() -> u64;

/// Instruction address of the first user ecall.

fn checkpoint() -> u64;

/// Arm hart zero's machine timer for the idle-path check.

unsafe fn alarm();

/// Disable the machine timer after its interrupt.

unsafe fn cancel();

/// Address of the user probe that attempts SC after another frame runs.

fn reservationEntry() -> u64;

/// Address of the user probe that replaces the hart's LR reservation.

fn reservationPeerEntry() -> u64;

/// A resumed frame must not consume another frame's reservation on shared memory.

unsafe fn reservations() {

    let mut shared: u64 = 0;

    let mut first: cpu::Frame = undefined;

    let mut second: cpu::Frame = undefined;

    cpu::init(&mut first, reservationEntry(), 0, &mut shared as u64, 0);

    cpu::init(&mut second, reservationPeerEntry(), 0, &mut shared as u64, 0);

    cpu::enter(&mut first);

    assert first.cause == 8 and (first.status & 0x1800) == 0;

    assert first.registers[11] == 0;

    // Preserve a0's shared pointer instead of installing a syscall reply.

    set first.pc += 4;

    cpu::enter(&mut second);

    assert second.cause == 8 and (second.status & 0x1800) == 0;

    assert second.registers[11] == 1 and shared == 1;

    cpu::enter(&mut first);

    assert first.cause == 8 and (first.status & 0x1800) == 0;

    assert first.registers[12] <> 0;

    assert shared == 1;

}

/// Check saved user state even when user sp, gp, tp, and ra are unusable.

@default unsafe fn main() -> u32 {

    let mut word: u32 = 0xffffffff;

    assert atomic::exchange(&mut word, 123) == 0xffffffff;

    assert atomic::exchange(&mut word, 0) == 123;

    assert atomic::load(&word) == 0;

    let mut frame: cpu::Frame = undefined;

    cpu::init(&mut frame, entry(), 0, 0, 0);

    cpu::enter(&mut frame);

    assert frame.cause == 8 and frame.pc == checkpoint();

    assert (frame.status & 0x1800) == 0;

    for i in 0..32 { assert frame.registers[i] == i as u64; }

    cpu::reply(&mut frame, abi::Error::Denied, 11, 12, 13, 14);

    cpu::enter(&mut frame);

    assert frame.cause == 8 and frame.pc == checkpoint() + 8;

    for i in 0..32 {

        if i == 10 { assert frame.registers[i] == 102; }

        else { assert frame.registers[i] == i as u64; }

    }

    cpu::reply(&mut frame, abi::Error::Ok, 21, 22, 23, 24);

    cpu::enter(&mut frame);

    assert frame.cause == 2 and frame.pc == checkpoint() + 12;

    assert frame.registers[10] == 0 and frame.registers[11] == 21;

    assert (frame.status & 0x1800) == 0;

    set frame.pc += 4;

    cpu::enter(&mut frame);

    assert frame.cause == 4 and frame.value == 1;

    set frame.pc += 4;

    cpu::enter(&mut frame);

    assert frame.cause == 7 and frame.value == 0x40000000;

    set frame.pc += 4;

    cpu::enter(&mut frame);

    assert frame.cause == 3;

    set frame.pc = 0x40000000;

    cpu::enter(&mut frame);

    assert frame.cause == 1 and frame.value == 0x40000000;

    reservations();

    alarm();

    cpu::idle(&mut frame);

    cancel();

    assert frame.cause == 0x8000000000000007;

    assert (frame.status & 0x1800) == 0x1800;

    return 0;

}

export mod cpu;

/// Atomically exchange one naturally aligned u32 with acquire/release ordering.

export fn exchange(pointer: *mut u32, value: u32) -> u32;

//! Architectural execution frames and the direct-call register convention.

use core::abi;

/// Complete integer state saved at the machine protection boundary.

export record Frame: Copy {

    /// Architectural x0..x31; x0 remains zero.

    registers: [u64; 32],

    /// Saved user instruction address.

    pc: u64,

    /// Raw machine trap cause, including its interrupt bit.

    cause: u64,

    /// Machine trap value associated with a fault.

    value: u64,

    /// Trap-time machine status, used to distinguish privilege levels.

    status: u64,

    /// Suspended machine stack, written only by arch/context.ras.

    kernelStack: u64,

}

/// Clear registers and install a checked image entry and startup environment.

export fn init(frame: *mut Frame, entry: u64, stack: u64, environment: u64, state: u64) {

    set frame.registers = [0; 32];

    set frame.registers[2] = stack;

    set frame.registers[3] = state;

    set frame.registers[4] = environment;

    set frame.registers[10] = environment;

    set frame.pc = entry;

    set frame.cause = 0;

    set frame.value = 0;

    set frame.status = 0;

    set frame.kernelStack = 0;

}

/// Run checked U-mode state until its next trap, with machine interrupts disabled on return.

/// The caller owns the frame and has installed all executable and memory authority.

export unsafe fn enter(frame: *mut Frame);

/// Sleep in M-mode until an enabled interrupt, using a private idle frame.

/// The caller must configure a bounded interrupt source before entering idle.

export unsafe fn idle(frame: *mut Frame);

/// Return Error in a0 and up to four value words in a1..a4; advance past ecall.

export fn reply(frame: *mut Frame, error: abi::Error, first: u64, second: u64, third: u64, fourth: u64) {

    assert frame.cause == 8;

    set frame.pc += 4;

    set frame.registers[10] = error as u64;

    set frame.registers[11] = first;

    set frame.registers[12] = second;

    set frame.registers[13] = third;

    set frame.registers[14] = fourth;

}

    /// Lowest address available to Page-backed local stack frames.

    /// Exclusive upper bound of the addressable local stack.

    /// Lowest private address for SSA values and saved registers.

    privateStackBase: u64,

    /// Exclusive upper bound of the never-granted private stack.

    privateStackTop: u64,

            privateStackBase: 0, privateStackTop: 0,

        privateStackBase: 0, privateStackTop: 0,

    /// RV64A base mnemonic followed by .w/.d and optional .aq/.rl/.aqrl.

    Atomic { funct5: u32 },

export constant INSTRUCTIONS: [InstructionEntry; 99] = [

    { name: "amoadd",  encoder: InstructionEncoder::Atomic { funct5: encode::F5_AMOADD } },

    { name: "amoand",  encoder: InstructionEncoder::Atomic { funct5: encode::F5_AMOAND } },

    { name: "amomax",  encoder: InstructionEncoder::Atomic { funct5: encode::F5_AMOMAX } },

    { name: "amomaxu", encoder: InstructionEncoder::Atomic { funct5: encode::F5_AMOMAXU } },

    { name: "amomin",  encoder: InstructionEncoder::Atomic { funct5: encode::F5_AMOMIN } },

    { name: "amominu", encoder: InstructionEncoder::Atomic { funct5: encode::F5_AMOMINU } },

    { name: "amoor",   encoder: InstructionEncoder::Atomic { funct5: encode::F5_AMOOR } },

    { name: "amoswap", encoder: InstructionEncoder::Atomic { funct5: encode::F5_AMOSWAP } },

    { name: "amoxor",  encoder: InstructionEncoder::Atomic { funct5: encode::F5_AMOXOR } },

    { name: "lr",     encoder: InstructionEncoder::Atomic { funct5: encode::F5_LR } },

    { name: "sc",     encoder: InstructionEncoder::Atomic { funct5: encode::F5_SC } },

        case super::InstructionEncoder::Atomic { funct5 } => return try parseAtomic(a, tok, funct5),

/// Parse the adjacent width/order suffixes and zero-offset RV64A operands.

fn parseAtomic(a: *mut super::Assembler, tok: scanner::Token, funct5: u32) throws (super::Error) {

    let widthToken = try expectToken(a, scanner::TokenKind::Directive, "expected atomic width suffix");

    if widthToken.offset <> tok.offset + tok.source.len {

        throw failOnToken(widthToken, "atomic width must adjoin mnemonic");

    }

    let mut width: u32 = encode::F3_WORD;

    if mem::eq(widthToken.source, ".d") {

        set width = encode::F3_DWORD;

    } else if not mem::eq(widthToken.source, ".w") {

        throw failOnToken(widthToken, "expected `.w` or `.d` atomic width");

    }

    let mut ordering: u32 = 0;

    if a.scan.current.kind == scanner::TokenKind::Directive {

        let orderToken = a.scan.current;

        if orderToken.offset <> widthToken.offset + widthToken.source.len {

            throw failOnToken(orderToken, "atomic ordering must adjoin width");

        }

        if mem::eq(orderToken.source, ".aq") {

            set ordering = 2;

        } else if mem::eq(orderToken.source, ".rl") {

            set ordering = 1;

        } else if mem::eq(orderToken.source, ".aqrl") {

            set ordering = 3;

        } else {

            throw failOnToken(orderToken, "expected `.aq`, `.rl`, or `.aqrl` atomic ordering");

        }

        advance(a);

    }

    let rd = try parseRegister(a);

    // LR reserves rs2 = x0 and has no source register operand.

    let mut rs2 = rv64::ZERO;

    if funct5 <> encode::F5_LR {

        set rs2 = try parseRegister(a);

    }

    let memop = try parseMemory(a);

    if memop.offset <> 0 {

        throw fail(a, "atomic memory offset must be zero");

    }

    try expectTerminator(a, "unexpected atomic operand");

    try emit::emitText(a, encode::atomic(rd, memop.base, rs2, funct5, width, ordering));

}

@test fn testAssembleAtomicOperationsAndWidths() throws (testing::TestError) {

    let sources: [*[u8]; 22] = [

        "lr.w %t0 0(%t2);",

        "lr.d %t0 0(%t2);",

        "sc.w %t0 %t1 0(%t2);",

        "sc.d %t0 %t1 0(%t2);",

        "amoswap.w %t0 %t1 0(%t2);",

        "amoswap.d %t0 %t1 0(%t2);",

        "amoadd.w %t0 %t1 0(%t2);",

        "amoadd.d %t0 %t1 0(%t2);",

        "amoxor.w %t0 %t1 0(%t2);",

        "amoxor.d %t0 %t1 0(%t2);",

        "amoand.w %t0 %t1 0(%t2);",

        "amoand.d %t0 %t1 0(%t2);",

        "amoor.w %t0 %t1 0(%t2);",

        "amoor.d %t0 %t1 0(%t2);",

        "amomin.w %t0 %t1 0(%t2);",

        "amomin.d %t0 %t1 0(%t2);",

        "amomax.w %t0 %t1 0(%t2);",

        "amomax.d %t0 %t1 0(%t2);",

        "amominu.w %t0 %t1 0(%t2);",

        "amominu.d %t0 %t1 0(%t2);",

        "amomaxu.w %t0 %t1 0(%t2);",

        "amomaxu.d %t0 %t1 0(%t2);",

    ];

    // Fixed ISA words keep encoder bugs visible instead of sharing its formula.

    let expected: [u32; 22] = [

        0x1003a2af, 0x1003b2af,

        0x1863a2af, 0x1863b2af,

        0x0863a2af, 0x0863b2af,

        0x0063a2af, 0x0063b2af,

        0x2063a2af, 0x2063b2af,

        0x6063a2af, 0x6063b2af,

        0x4063a2af, 0x4063b2af,

        0x8063a2af, 0x8063b2af,

        0xa063a2af, 0xa063b2af,

        0xc063a2af, 0xc063b2af,

        0xe063a2af, 0xe063b2af,

    ];

    for i in 0..sources.len {

        let program = try assembleSource(sources[i]);

        try testing::expect(program.text.len == 1);

        try testing::expect(program.text[0] == expected[i]);

    }

}

@test fn testAssembleAtomicOrderingAndRegisterFields() throws (testing::TestError) {

    let sources: [*[u8]; 5] = [

        "amoswap.w.aq %t0 %t1 0(%t2);",

        "amoswap.d.rl %t0 %t1 0(%t2);",

        "amoswap.d.aqrl %t0 %t1 0(%t2);",

        "lr.w.aqrl %t6 (%ra);",

        "sc.d.aq %zero %t6 (%t5);",

    ];

    let expected: [u32; 5] = [

        0x0c63a2af, 0x0a63b2af, 0x0e63b2af, 0x1600afaf, 0x1dff302f,

    ];

    for i in 0..sources.len {

        let program = try assembleSource(sources[i]);

        try testing::expect(program.text.len == 1);

        try testing::expect(program.text[0] == expected[i]);

    }

}

@test fn testAssembleInvalidAtomicOperandsFail() throws (testing::TestError) {

    try expectAssembleFail("lr.w %t0 %t1 0(%t2);");

    try expectAssembleFail("lr.d %t0;");

    try expectAssembleFail("sc.w %t0 0(%t2);");

    try expectAssembleFail("sc.d %t0 %t1 0(%t2) %t3;");

    try expectAssembleFail("amoadd.d %t0 %t1;");

    try expectAssembleFail("amoswap.w %t0 %t1 %t2;");

    try expectAssembleFail("lr.w %t0 1(%t2);");

    try expectAssembleFail("sc.d %t0 %t1 -1(%t2);");

    try expectAssembleFail("amoadd.w %t0 %t1 4294967296(%t2);");

}

@test fn testAssembleInvalidAtomicSuffixesFail() throws (testing::TestError) {

    try expectAssembleFail("lr %t0 0(%t2);");

    try expectAssembleFail("lr.b %t0 0(%t2);");

    try expectAssembleFail("sc.q %t0 %t1 0(%t2);");

    try expectAssembleFail("amoadd.wu %t0 %t1 0(%t2);");

    try expectAssembleFail("amoswap.aq.w %t0 %t1 0(%t2);");

    try expectAssembleFail("amoswap.w.rlaq %t0 %t1 0(%t2);");

    try expectAssembleFail("amoswap.w.aq.rl %t0 %t1 0(%t2);");

    try expectAssembleFail("amoswap.w.aq.aq %t0 %t1 0(%t2);");

    try expectAssembleFail("amoswap .w %t0 %t1 0(%t2);");

    try expectAssembleFail("amoswap.w .aq %t0 %t1 0(%t2);");

    try expectAssembleFail("add.w.aq %t0 %t1 %t2;");

}

//! RISC-V RV64I+M+A instruction encoding.

/// RV64A LR, SC, and atomic read-modify-write opcode.

export constant OP_AMO:    u32 = 0x2F;

//////////////////////

// Funct5 Constants //

//////////////////////

/// Atomic addition function field.

export constant F5_AMOADD:  u32 = 0b00000;

/// Atomic swap function field.

export constant F5_AMOSWAP: u32 = 0b00001;

/// Load-reserved function field; the source register field must be zero.

export constant F5_LR:      u32 = 0b00010;

/// Store-conditional function field.

export constant F5_SC:      u32 = 0b00011;

/// Atomic XOR function field.

export constant F5_AMOXOR:  u32 = 0b00100;

/// Atomic OR function field.

export constant F5_AMOOR:   u32 = 0b01000;

/// Atomic AND function field.

export constant F5_AMOAND:  u32 = 0b01100;

/// Atomic signed minimum function field.

export constant F5_AMOMIN:  u32 = 0b10000;

/// Atomic signed maximum function field.

export constant F5_AMOMAX:  u32 = 0b10100;

/// Atomic unsigned minimum function field.

export constant F5_AMOMINU: u32 = 0b11000;

/// Atomic unsigned maximum function field.

export constant F5_AMOMAXU: u32 = 0b11100;

/// Encode an RV64A operation with a standard F5_* function and zero byte offset.

/// Width is F3_WORD or F3_DWORD; ordering holds aq in bit 1 and rl in bit 0.

/// LR requires rs2 = x0; rs1 is always the address register.

export fn atomic(rd: gen::Reg, rs1: gen::Reg, rs2: gen::Reg, funct5: u32, width: u32, ordering: u32) -> u32 {

    assert funct5 < 32;

    assert width == F3_WORD or width == F3_DWORD;

    assert ordering < 4;

    assert funct5 <> F5_LR or *rs2 == 0;

    return encodeR(OP_AMO, rd, rs1, rs2, width, (funct5 << 2) | ordering);

}