cpu_mmu.mac

; $Id: cpu_mmu.mac 1386 2023-03-25 18:35:46Z mueller $
; SPDX-License-Identifier: GPL-3.0-or-later
; Copyright 2022-2023 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
;
; Revision History:
; Date         Rev Version  Comment
; 2023-03-19  1382   1.1.3  C2.6: add e11 handling (w11 and e11 mmr1 difference)
;                           D2.1: BUGFIX: use mmr0 page mode for PSW PM if ico=1
;                           D2.1: add e11 handling (no PC inc on fetch abort)
; 2023-02-17  1374   1.1.2  use push2,pushm,popm
; 2023-01-28  1360   1.1.1  remove <../100> expressions for 6 bit right shift
; 2023-01-27  1358   1.1    use .mcall and mlib; use hta??? macros
; 2023-01-05  1346   1.0    Initial version
; 2022-07-24  1262   0.1    First draft
;
; Test CPU MMU: all aspects of the MMU
;   Section A: pdr,par registers
;   Section B: mmr0,mmr3 registers, mapping, instructions; MTP* and MFP*
;   Section C: mmr2+mmr1+mmr0 register, aborts
;   Section D: mmr2+mmr1+mmr0 register, abort recovery
;   Section E: traps and pdr aia and aiw bits
;   Section F: miscellaneous
;
; Overall usage of pages in kernel mode
;   page 0  main code
;   page 1  main code
;   page 2
;   page 3
;   page 4  code mapped in user/super space; test E1.4 code (page 4->5 border)
;   page 5  code for test E1.4 (page 4->5 border)
;   page 6  data test target
;   page 7  iopage
;
        .include        |lib/tcode_std_base.mac|
        .include        |lib/defs_mmu.mac|
;
        .mcall  push,pop,push2,pushm,popm
        .mcall  hcmpeq,hcmbeq,htsteq,htstge,hbiteq,hbitne
        .mcall  vecset,vecclr
        .mcall  htabuf,htaadd,htaini,htacmp
        .mcall  rtijmp
;
; some useful definitions
        uipdr0 = uipdr+ 0
        uipar0 = uipar+ 0
        udpdr0 = udpdr+ 0
        udpar0 = udpar+ 0
        udpdr1 = udpdr+ 2
        udpar1 = udpar+ 2
        udpdr2 = udpdr+ 4
        udpar2 = udpar+ 4

        sipdr0 = sipdr+ 0
        sipar0 = sipar+ 0
        sipdr1 = sipdr+ 2
        sipar1 = sipar+ 2
        sipdr2 = sipdr+ 4
        sipar2 = sipar+ 4
        sipdr3 = sipdr+ 6
        sipar3 = sipar+ 6
        sipdr6 = sipdr+14
        sipar6 = sipar+14
        sipdr7 = sipdr+16
        sipar7 = sipar+16

        kipdr0 = kipdr+ 0
        kipar0 = kipar+ 0
        kdpdr0 = kdpdr+ 0
        kdpar0 = kdpar+ 0
        kipdr1 = kipdr+ 2
        kipar1 = kipar+ 2
        kdpdr1 = kdpdr+ 2
        kdpar1 = kdpar+ 2
        kipdr5 = kipdr+12
        kipdr6 = kipdr+14
        kipar6 = kipar+14
        kdpdr6 = kdpdr+14
        kdpar6 = kdpar+14
        kipdr7 = kipdr+16
        kipar7 = kipar+16
        kdpdr7 = kdpdr+16
        kdpar7 = kdpar+16

        p0p1p2 = <1*100>+2              ; page 0, +1 click, +2
        p0p1p4 = <1*100>+4              ; page 0, +1 click, +4
        p1base = <1*20000>              ; page 1
        p1p0p2 = p1base+2               ; page 1, +2
        p1m1p0 = p1base+<127.*100>      ; page 1, 128-1 click
        p2base = <2*20000>              ; page 2
        p2m1p0 = p2base+<127.*100>      ; page 1, 128-1 click
        p2m1m4 = p2base+<127.*100>-4    ; page 1, 128-1 click, -4
        p3base = <3*20000>              ; page 3
        p4base = <4*20000>              ; page 4
        p5base = <5*20000>              ; page 5
        p6base = <6*20000>              ; page 6
        p6p1p2 = p6base+<1*100>+2       ; page 6, +1 click, +2
        p7base = <7*20000>              ; page 7
;
; Helper macro to set mmu par from an absolute address
; Just needs an 6 bit right shift. A simple #<addr/100> doesnt work for
; addr >= 100000 because of the signed number behavior of the division operator.
; The macro distingishes the positive and negative address cases.
;
        .macro    setpar,addr,par
        mov       #addr,r0
        ash       #-6.,r0
        bic       #176000,r0
        mov       r0,par
        .endm
;
; Section A: pdr,par registers ===============================================
;   A1.1    test that pdr/par are 16 bit write/readable
;   A1.2    set up MMU default configuration
;
; Test A1:  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
;
; Test A1.1 -- test that pdr/par are 16 bit write/readable +++++++++++
;   Write unique patterns to first and last pdr/par of each mode and read back
;
ta0101: mov     #000401,r5      ; pattern master
;;;     mov     #077717,r5      ; bit mask for pdr
;
; write 000401,001002,002004,004010,...   for pdr; complement for par
        mov     r5,r0           ; start pattern
        mov     #12.,r1         ; number tested regs
        mov     #9000$,r2
1000$:  mov     (r2)+,r3
        mov     r0,(r3)         ; write pdr
        add     r5,r0
        dec     r0
        mov     r0,40(r3)       ; write par
        add     r5,r0
        sob     r1,1000$
;
; read back
        mov     r5,r0           ; start pattern
        mov     #12.,r1         ; number of modes
        mov     #9000$,r2
1100$:  mov     (r2)+,r3
        hcmpeq  (r3),r0         ; check pdr
        add     r5,r0
        dec     r0
        hcmpeq  40(r3),r0       ; check par
        add     r5,r0
        sob     r1,1100$
;
; complement all pattern
        mov     #12.,r1         ; number of modes
        mov     #9000$,r2
1200$:  mov     (r2)+,r3
        mov     (r3),r4         ; complement pdr only writable bits
        com     r4
        bic     #100360,r4      ; mask non-writable (incl A and W)
        mov     r4,(r3)
        com     40(r3)          ; complement par
        sob     r1,1200$
;
; and read back again
;   pdr only plf,ed and acf fields are checked
;   par all 16 bits are write/readable
        mov     r5,r0           ; start pattern
        com     r0              ; complemented
        mov     #12.,r1         ; number of modes
        mov     #9000$,r2
1300$:  mov     (r2)+,r3
        mov     r0,r4
        bic     #100360,r4      ; mask non-writable (incl A and W)
        hcmpeq  (r3),r4         ; check pdr only writable bits
        sub     r5,r0
        inc     r0
        hcmpeq  40(r3),r0       ; check par
        sub     r5,r0
        sob     r1,1300$
;
        jmp     9999$
;
9000$:  .word   uipdr           ; usr i page dsc base  0
        .word   uipdr+16
        .word   udpdr           ; usr d page dsc base  0
        .word   udpdr+16
        .word   sipdr           ; sup i page dsc base  0
        .word   sipdr+16
        .word   sdpdr           ; sup d page dsc base  0
        .word   sdpdr+16
        .word   kipdr           ; ker i page dsc base  0
        .word   kipdr+16
        .word   kdpdr           ; ker d page dsc base  0
        .word   kdpdr+16
;
9999$:  iot                     ; end of test A1.1
;
; Test A1.2 -- set up MMU default configuration ++++++++++++++++++++++
;   Nothing is verified, just sets the MMU for all further tests
;   kernel I: 1-to-1   and seg7 to io-page
;   kernel D: unmapped but seg7 to io-page
;   supervisor and user I and D: unmapped (acf=0)
;
ta0102:
; first clear all pdr/par, that disables mapping (acf=0)
        mov     #1000$,r0
        mov     #3,r1
100$:   mov     (r0)+,r2        ; ptr to pdr+par I+D set (32 regs)
        mov     #8.,r3          ; 8 chunks of 4
200$:   clr     (r2)+
        clr     (r2)+
        clr     (r2)+
        clr     (r2)+
        sob     r3,200$
        sob     r1,100$
; set up kernel I
        mov     #kipdr,r0
        mov     #<127.*md.plf>!md.arw,r1  ; plf=127; ed=0(up); acf=6(w/r)
        mov     r1,(r0)+        ; kipdr0
        mov     r1,(r0)+        ; kipdr1
        mov     r1,(r0)+        ; kipdr2
        mov     r1,(r0)+        ; kipdr3
        mov     r1,(r0)+        ; kipdr4
        mov     r1,(r0)+        ; kipdr5
        mov     r1,(r0)+        ; kipdr6
        mov     r1,(r0)+        ; kipdr7
        mov     #kipar,r0
        mov     #000000,(r0)+   ; kipar0 000000 base
        mov     #000200,(r0)+   ; kipar1 020000 base
        mov     #000400,(r0)+   ; kipar2 040000 base
        mov     #000600,(r0)+   ; kipar3 060000 base
        mov     #001000,(r0)+   ; kipar4 100000 base
        mov     #001200,(r0)+   ; kipar5 120000 base
        mov     #001400,(r0)+   ; kipar6 140000 base
        mov     #177600,(r0)+   ; kipar7 (map I/O page)
; kernel D space is not used in tests, kernel always runs without I/D
; D space is tested, but in supervisor or user mode
;
        jmp     9999$
;
1000$:  .word   uipdr
        .word   sipdr
        .word   kipdr
;
9999$:  iot                     ; end of test A1.2
;
; Section B: mmr0,mmr3 registers, mapping, instructions ======================
;   Test whether address mapping works (traps and aborts avoided)
;
;    B1    mmr0, mmr3 write/read and clear by RESET
;    B1.1    test mmr0 write/read
;    B1.2    test mmr3 write/read
;    B2    kernel mode mapping
;    B2.1    test 1-to-1 kernel mode mapping
;    B2.2    test variable kernel mode mapping
;    B3    user and supervisor mode
;    B3.1    run code in user/supervisor mode
;    B3.2    run code in user mode with D space; MFP*, MTP*
;              part 1: run code vc1 in user mode
;              part 2: test MTPD and MFPD
;              part 3: test MTPI and MFPI
;              part 4: test MTPD,MFPD with @(sp)+
;              part 5: test MTPI,MFPI with @(sp)+
;              part 6: test MFPD,MFPI and MTPD,MTPI for sp register access
;              part 7: test MFPD,MFPI and MTPD,MTPI for register r0-r5 access
;    B3.3    test MFPI,MTPI with cm=pm=user
;    B4    invalid cpu mode 10
;    B4.1    check that cmode=10 causes abort
;    B4.2    check MFPI/MTPI SP response for pmode=10
;
; Test B1:  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
;   Test mmr0, mmr3 write/read and clear by RESET
;
;   This test verifies
;     x xxx xxx xxx xxx xxx NZVC Instruction / Remark
;     0 000 000 000 000 101 ---- RESET   (clear mmr0,mmr3)
;
; Test B1.1 -- test mmr0 write/read ++++++++++++++++++++++++++++++++++
;   Test all writable bits except m0.ena
;   Also ensure that unimplemented bits return zero
;
tb0101: mov     #mmr0,r0        ; ptr to mmr0
        mov     #m0.ico,r1      ; instruction complete flag
        mov     #1010$,r4       ; ptr to data
        mov     #1011$,r3       ; ptr to data end
100$:   mov     (r4),(r0)       ; write mmr0
        mov     (r0),r5         ; read mmr0
        bic     r1,r5           ; mask instruction complete
        hcmpeq  r5,(r4)+        ; check
        cmp     r4,r3           ; more to do ?
        blo     100$
;
        reset                   ; mmr0 has 5 bits set, check clear
        mov     (r0),r5         ; read mmr0
        bic     r1,r5           ; mask instruction complete
        htsteq  r5              ; check mmr0 cleared
;
; ensure unimplemented bits return zero
; Note: m0.mai is currently unimplemented in w11 (reads zero)
;       In SimH this bit is writable and reads back, but without function
        mov     #bit11!bit10,(r0)
        mov     (r0),r5         ; read mmr0
        bic     r1,r5           ; mask instruction complete
        htsteq  r5              ; check mmr0 cleared
;
        jmp     9999$
;
1010$:  .word   m0.anr          ; abort flags
        .word   m0.ale
        .word   m0.ard
        .word   m0.trp          ; trap flag
        .word   m0.ent          ; trap enable
        .word   m0.anr!m0.ale!m0.ard!m0.trp!m0.ent
1011$:
;
9999$:  iot                     ; end of test B1.1
;
; Test B1.2 -- test mmr3 write/read ++++++++++++++++++++++++++++++++++
;   Test all writable bits; mmu is off, and unibus map not used
;   Also ensure that unimplemented bits return zero
;
tb0102: mov     #mmr3,r0        ; ptr to mmr3
        mov     #1010$,r4       ; ptr to data
        mov     #1011$,r3       ; ptr to data end
100$:   mov     (r4),(r0)       ; write mmr3
        hcmpeq  (r0),(r4)+      ; check
        cmp     r4,r3           ; more to do ?
        blo     100$
;
        reset                   ; mmr3 has 5 bits set, check clear
        htsteq  (r0)            ; check mmr3 cleared
;
; ensure unimplemented bits return zero
        mov     #^c<m3.eub!m3.e22!m3.dkm!m3.dsm!m3.dum>,(r0)
        htsteq  (r0)            ; check mmr3 stays cleared
;
        jmp     9999$
;
1010$:  .word   m3.eub
        .word   m3.e22
        .word   m3.dkm
        .word   m3.dsm
        .word   m3.dum
        .word   m3.eub!m3.e22!m3.dkm!m3.dsm!m3.dum
1011$:
;
9999$:  iot                     ; end of test B1.2
;
; Test B2:  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
;   Test kernel mode mapping
;
; Test B2.1 -- test 1-to-1 kernel mode mapping +++++++++++++++++++++++
;   simply enable MMU, shouldnt make a difference
;   test that 18bit mode extends I/O page addressing
;   test that RESET clears mmr0 and mmr3
;
tb0201: mov     #123456,1000$
; enable mmu in 18bit mode
        clr     mmr3            ; no d dspace, no 22bit
        mov     #m0.ena,mmr0    ; enable mmu                    ;! MMU 18
        hbitne  #m0.ena,mmr0    ; test bit  
        hcmpeq  1000$,#123456   ; check marker
; verify I/O page mapping in 18bit mode (007600 must be OK)
        mov     #kipar7,r0      ; ptr to kipar7
        bic     #170000,(r0)    ; clear to 4 bits in kipar7
        hcmpeq  (r0),#007600    ; kipar7 still seen ?
        bis     #170000,(r0)    ; restore kipar7
        hcmpeq  (r0),#177600
; enable mmu in 22bit mode; check that mmr3 still seen
        mov     #m3.e22,mmr3
        hcmpeq  mmr3,#m3.e22    ; test mmr3 still seen ?        ;! MMU 22
; test RESET
        reset                   ; should clear mmr0 and mmr3    ;! MMU off
        htsteq  mmr0            ; check mmr0 cleared
        htsteq  mmr3            ; check mmr3 cleared
        jmp     9999$
;
1000$:  .word   0
;
9999$:  iot                     ; end of test B2.1
;
; Test B2.2 -- test variable kernel mode mapping +++++++++++++++++++++
;   change seg6 mapping
;   test that 18bit mode discards the 4 MSB of the par
;
tb0202: mov     #kipar6,r0      ; ptr to kipar6
        mov     #140000,r5      ; seg6 base
        mov     #140000,(r5)    ; init markers
        clr     2(r5)
        mov     #140100,100(r5) ; init markers
        clr     102(r5)
;
        clr     mmr3            ; no d dspace, no 22bit
        mov     #m0.ena,mmr0    ; enable mmu                    ;! MMU 18
; check in 1-to-1 mapping
        hcmpeq  (r5),#140000
        htsteq  2(r5)
        hcmpeq  100(r5),#140100
        htsteq  102(r5)
; move seg6 mapping up by one click
        inc     (r0)            ; move kipar6 base up
        hcmpeq  (r0),#001401
        hcmpeq  0(r5),#140100
        mov     #010000,2(r5)   ; write marker
; set MSBs in kipar6, should be discarded in 18bit mode, check markers
        bis     #170000,(r0)
        hcmpeq  (r0),#171401
        hcmpeq  (r5),#140100   ; check marker
        bic     #170000,(r0)
        hcmpeq  (r0),#001401
; move seg6 mapping down by one click
        dec     (r0)            ; move kipar6 base up
        hcmpeq  (r0),#001400
        mov     #020000,2(r5)   ; write marker
        hcmpeq  2(r5),#020000  ; check marker
        hcmpeq  102(r5),#010000  ; check marker
; disable MMU
        reset                   ; mmu off                       ;! MMU off
;
9999$:  iot                     ; end of test B2.2
;
; Test B3:  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
;   Test user and supervisor mode
;
; Test B3.1 -- run code in user/supervisor mode ++++++++++++++++++++++
;   code vc0 is executed in user and in supervisor mode
;   the code runs in seg0 with D space disabled
;
tb0301:
; set up emt handler
        vecset  v..emt,vhuemt   ; set up emt handler, pr0 kernel
        clr     mmr3            ; no d dspace, no 22bit
        mov     #m0.ena,mmr0    ; enable mmu                    ;! MMU 18
;
; run code vc0 in user mode --------------------------------
;
; set user mode pdr/par, only short page 0
        mov     #<8.*md.plf>!md.arw,uipdr0
        setpar  vc0,uipar0
; set up data for user mode run
        mov     #023456,vc0v0;
        mov     #000123,vc0v1
        mov     #077321,vc0v2
; start code in user mode
        mov     #1000$,vhustp   ; set up continuation address
        rtijmp  #<cp.cmu!cp.pmu>,#0     ; start with PS=user, PC=0
        halt
1000$:                          ; continuation point
; check psw
        ccc                     ; clear cc -> psw reflects pm setting
        hcmpeq  cp.psw,#cp.pmu  ; check pm
; check data 
        hcmpeq  vc0v0,#154321
        hcmpeq  vc0v2,#077444
; reset user mode pdr/par
        clr     uipdr0
        clr     uipar0
;
; run code vc0 in supervisor mode --------------------------
;
; set supervisor mode pdr/par, only short page 0
        mov     #<8.*md.plf>!md.arw,sipdr0
        setpar  vc0,sipar0
; set up data for user mode run
        mov     #017171,vc0v0
        mov     #000321,vc0v1
        mov     #100123,vc0v2
; start code in supervisor mode
        mov     #2000$,vhustp   ; set up continuation address
        rtijmp  #<cp.cms!cp.pms>,#0     ; start with: PS=supervisor, PC=0
        halt
2000$:                          ; continuation point
; check psw
        ccc                     ; clear cc -> psw reflects pm setting
        hcmpeq  cp.psw,#cp.pms  ; check pm
; check data
        hcmpeq  vc0v0,#160606
        hcmpeq  vc0v2,#100444
; reset supervsior mode pdr/par
        clr     sipdr0
        clr     sipar0
;
        reset                   ; mmu off                       ;! MMU off
        vecclr  v..emt          ; restore emt catcher
;
9999$:  iot                     ; end of test B3.1
;
; Test B3.2 -- run code in user mode with D space; mfp*, mtp* ++++++++
;   Code vc1 is executed in user mode, runs in page 0 with D space enabled.
;
;   This test verifies
;     x xxx xxx xxx xxx xxx NZVC Instruction / Remark
;     0 000 110 101 ddd ddd NZ0- MFPI
;     0 000 110 110 ddd ddd NZ0- MTPI
;     1 000 110 101 ddd ddd NZ0- MFPD
;     1 000 110 110 ddd ddd NZ0- MTPD
;
tb0302:
        vecset  v..emt,vhuemt   ; set up emt handler, pr0 kernel
        mov     #m3.dum,mmr3    ; user d dspace, no 22bit
        mov     #m0.ena,mmr0    ; enable mmu                    ;! MMU 18
;
; part 1: run code vc1 in user mode ----------------------------------
;
; set user mode pdr/par, only short page 0; I and D
        mov     #<8.*md.plf>!md.arw,uipdr0
        setpar  vc1,uipar0
        mov     #<8.*md.plf>!md.arw,udpdr0
        setpar  vc1dat,udpar0
; set up data for user mode run
        mov     #020305,vc1v0
        mov     #000212,vc1v1
        mov     #033121,vc1v2
; start code in user mode
        mov     #1000$,vhustp   ; set up continuation address
        rtijmp  #<cp.cmu!cp.pmu>,#0     ; start with PS=user, PC=0
        halt
;
1000$:                          ; continuation point
; check psw
        ccc                     ; clear cc -> psw reflects pm setting
        hcmpeq  cp.psw,#cp.pmu  ; check pm
; check data
        hcmpeq  vc1v0,#157472
        hcmpeq  vc1v2,#033333
;
; psw has now pm=user and cm=kernel; good setup to test MFPI and friends
;
; part 2: test MTPD and MFPD -----------------------------------------
;
; test MFPD (data access)
;
        mov     #<vc1v0-vc1dat>,r5      ; initialize data pointer
        mfpd    (r5)              ; read vc1v0
        hcmpeq  (sp)+,#157472
        mfpd    @#<vc1v2-vc1dat>  ; read vc1v2
        hcmpeq  (sp)+,#033333
;
; test MTPD and MFPD, incl cc (data access)
;
        mov     #2010$,r4       ; ptr to test data
        mov     #2011$,r3       ; ptr to test end
2000$:  push    (r4)+
        ccc                     ; C=0
        mtpd    (r5)            ; write vc1v0
        hcmpeq  cp.psw,(r4)+    ; check cc
        hcmpeq  vc1v0,-4(r4)    ; check target
        scc                     ; C=1
        mfpd    (r5)
        hcmpeq  cp.psw,(r4)+    ; check cc
        hcmpeq  (sp)+,-6(r4)    ; check data
        cmp     r4,r3           ; more to do ?
        blo     2000$
;
; part 3: test MTPI and MFPI -----------------------------------------
;
; test MFPI (data access)
;
        mov     #<vc1-vc1>,r5     ; initialize data pointer
        mfpi    (r5)              ; read 1st instruction word
        hcmpeq  (sp)+,vc1
;
; test MTPI and MFPI, incl cc  (data access)
;
        mov     #<vc1ida-vc1>,r5 ; initialize data pointer
        mov     #3010$,r4       ; ptr to test data
        mov     #3011$,r3       ; ptr to test end
3000$:  push    (r4)+
        scc                     ; C=1
        mtpi    (r5)            ; write vc1ida
        hcmpeq  cp.psw,(r4)+    ; check cc
        hcmpeq  vc1ida,-4(r4)   ; check target
        ccc                     ; C=0
        mfpi    (r5)
        hcmpeq  cp.psw,(r4)+    ; check cc
        hcmpeq  (sp)+,-6(r4)    ; check data
        cmp     r4,r3           ; more to do ?
        blo     3000$
;
; part 4: test MTPD,MFPD with @(sp)+ ---------------------------------
;   Note: (sp) or (sp)+ are not a useful address mode for MTPD
;         It will use the cm sp as address in pm, rarely what one wants
;         So @(sp)+ is the only mode with sp in src worth to be tested
;
        clr     vc1v0
        push    #<vc1v0-vc1dat> ; D addr of vc1v0
        push    #054321         ; data to mtpd
        mtpd    @(sp)+          ; reads data first, then dst addr
        hcmpeq  vc1v0,#054321   ; check at destination
        inc     vc1v0
        push    #<vc1v0-vc1dat> ; D addr of vc1v0
        mfpd    @(sp)+
        hcmpeq  (sp)+,#054322   ; check
;
; part 5: test MTPI,MFPI with @(sp)+ ---------------------------------
;
        clr     vc1ida
        push    #<vc1ida-vc1>   ; I addr of vc1ida
        push    #012321         ; data to mtpi
        mtpi    @(sp)+          ; reads data first, then dst addr
        hcmpeq  vc1ida,#012321  ; check at destination
        inc     vc1ida
        push    #<vc1ida-vc1>   ; I addr of vc1ida
        mfpi    @(sp)+
        hcmpeq  (sp)+,#012322   ; check
;
;
; part 6: test MFPD,MFPI and MTPD,MTPI for sp register access --------
;   accessing sp will access user mode stack pointer (which is != kernel stack)
;
; read sp via mfpd and mfpi
        mfpd    sp              ; read user mode sp
        hcmbeq  (sp)+,#<vc1stk-vc1dat>      ; check
        mfpi    sp              ; read user mode sp (same for I and D)
        hcmbeq  (sp)+,#<vc1stk-vc1dat>      ; check
; write sp via mtpd, readback via mfpi
        mov    sp,r4            ; remember kernel stack
        mov    #77,r5
        push   r5
        mtpd   sp               ; change user stack
        hcmpeq sp,r4            ; check kernel stack unchanged
        mfpi   sp               ; read back user stack
        hcmpeq (sp)+,r5         ; check
; write sp via mtpi, readback via mfpd
        mov    #177,r5
        push   r5
        mtpi   sp               ; change user stack
        hcmpeq sp,r4            ; check kernel stack unchanged
        mfpd   sp               ; read back user stack
        hcmpeq (sp)+,r5         ; check
;
; part 7: test MFPD,MFPI and MTPD,MTPI for register r0-r5 access -----
;   accessing r0-r5 simply acccesses common registers
;   that is usually not used, but should work
;
; write registers via mtpd,mtpi
        push    #277
        mtpd    r5              ; effective mov #277,r5
        push    #377
        mtpi    r4              ; effective mov #377,r4
        hcmpeq  r5,#277         ; check
        hcmpeq  r4,#377         ; check
; read registers via mtpd,mtpi
        mov     #477,r5
        mov     #577,r4
        mfpd    r5
        hcmpeq  (sp)+,#477     ; check
        mfpd    r4
        hcmpeq  (sp)+,#577     ; check
;
; reset user mode pdr/par
        clr     uipdr0
        clr     uipar0
        clr     udpdr0
        clr     udpar0
;
        reset                   ; mmu off                       ;! MMU off
        clr     cp.psw          ; crop pm in psw
        vecclr  v..emt          ; restore emt catcher
        jmp     9999$
;
; test data for m*pd tests (C=0 for T and C=1 for F)
2010$:  .word   000000,cp.pmu!cp0z00,cp.pmu!cp0z0c
        .word   000001,cp.pmu!cp0000,cp.pmu!cp000c
        .word   100000,cp.pmu!cpn000,cp.pmu!cpn00c
2011$:
;
; test data for m*pi tests (C=1 for T and C=0 for F)
3010$:  .word   000000,cp.pmu!cp0z0c,cp.pmu!cp0z00
        .word   000001,cp.pmu!cp000c,cp.pmu!cp0000
        .word   100000,cp.pmu!cpn00c,cp.pmu!cpn000
3011$:
;
9999$:  iot                     ; end of test B3.2
;
; Test B3.3 -- test MFPI,MTPI with cm=pm=user ++++++++++++++++++++++++
;   Verifies that MFPI acts like MFPD when cm=pm=user and that MTPI has no
;   such restriction and can modify I space when PDR ACF allows.
;   Runs code vc4 with D space enabled, code in page 0 and data in page 1.
;
tb0303:
        vecset  v..emt,vhuemt   ; set up emt handler, pr0 kernel
        mov     #m3.dum,mmr3    ; user d dspace, no 22bit
        mov     #m0.ena,mmr0    ; enable mmu                    ;! MMU 18
; set up data
        clr     vc4l1
; set user mode pdr/par, I page 0 and D page 1
        mov     #<8.*md.plf>!md.arw,uipdr0      ; I space writable
        setpar  vc4,uipar0
        mov     #<8.*md.plf>!md.arw,udpdr1
        setpar  vc4dat,udpar1
; start code in user mode
        mov     #1000$,vhustp   ; set up continuation address
        rtijmp  #<cp.cmu!cp.pmu>,#0     ; start with PS=user, PC=0
        halt
;
1000$:                          ; continuation point
        hcmpeq  #040111,r0      ; check direct D space access to vc4v1
        hcmpeq  #040222,r1      ; check MFPI access to vc4v2 (D instead of I!)
        hcmpeq  #040333,r2      ; check MFPD access to vc4v3
        hcmpeq  #040444,vc4l1   ; check modified vc4l1
;
; reset user mode pdr/par
        clr     uipdr0
        clr     uipar0
        clr     udpdr1
        clr     udpar1
;
        reset                   ; mmu off                       ;! MMU off
        clr     cp.psw          ; crop pm in psw
        vecclr  v..emt          ; restore emt catcher
;
9999$:  iot                     ; end of test B3.3
;
; Test B4:  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
;   Test invalid cpu mode 10
;
; Test B4.1 -- check that cmode=10 causes abort ++++++++++++++++++++++
;    Should abort with m0.anr and m0.ale for all adresses
;    w11 aborts with m0.anr, but sets m0.ale only when fail above 1st click
;    Test an address above the first click to have full 11/70 style response
;    Note: w11 increments PC in case of an abort
;          SimH does not increment PC in case of an abort (as 11/70 does)
;
tb0401: clr     mmr3            ; no d dspace, no 22bit
        mov     #m0.ena,mmr0    ; enable mmu                    ;! MMU 18
        vecset  v..mmu,1000$    ; set up local mmu handler
; try to run a code in mode 10
        rtijmp  #^b1010000000000000,#p6base+200 ; start with PS:cm=pm=10
        halt
; test abort PC on stack
1000$:  cmpb    systyp,#sy.sih                  ; on SimH ?
        bne     1010$
        hcmpeq  (sp)+,#p6base+200               ; SimH doesnt increment PC
        br      1020$
1010$:  hcmpeq  (sp)+,#p6base+200+2             ; w11 does increment PC
; test abort PS on stack
1020$:  hcmpeq  (sp)+,#^b1010000000000000       ; abort PS
;
        hcmpeq  mmr0,#m0.anr!m0.ale!0100!<6*m0.pno>!m0.ena ; check mmr0
        hcmpeq  mmr2,#p6base+200                      ; check mmr2
;
        reset                                                   ;! MMU off
        vecclr  v..mmu                  ; restore mmu catcher
;
9999$:  iot                     ; end of test B4.1
;
; Test B4.2 -- check MFPI/MTPI SP response for pmode=10 ++++++++++++++
;    That is unspecified for all but J11, which will read/write user SP
;    w11 return PC on read, the write is a noop
;    Test on w11 even though its unspecified behavior
;
tb0402: tstb    systyp          ; skip if not on w11
        blt     9999$
; load values in user and supervisor SP
        mov     #cp.psw,r0
        mov     #cp.pmu,(r0)
        push    #111222
        mtpi    sp              ; user SP = 111222
        mov     #cp.pms,(r0)
        push    #111444
        mtpi    sp              ; user SP = 111444
; read from pm=10 SP
        mov     #^b0010000000000000,(r0)
1000$:  mfpi    sp              ; read pm=10 sp
        hcmpeq  (sp)+,#1000$    ; happens to return PC of mfpi
; write to pm=10 SP
        push     #111666
        mtpi     sp             ; write pm=10 sp
        hcmpeq   sp,#stack      ; check kernel sp
        mov     #cp.pms,(r0)
        mfpi    sp
        hcmpeq  (sp)+,#111444   ; check supervisor sp
        mov     #cp.pmu,(r0)
        mfpi    sp
        hcmpeq  (sp)+,#111222   ; check user sp
;
        clr     cp.psw          ; sane psw again
;
9999$:  iot
;
; Section C: mmr2+mmr1+mmr0 register, aborts =================================
;   C1    MMU response in mmr1 after a write to that fakes an abort
;   C2    MMU abort response in mmr0 and mmr1
;   C2.1    test unary/binary instructions
;             part 1: unary instructions; test acf to mmr0(15:13) mapping
;             part 2: unary instructions; fail in second access
;             part 3: binary instructions; fail in src field
;             part 4: binary instructions; fail in dst field
;             part 5: multiple abort flags
;   C2.2    test MFPI,MFPD,MTPI,MFPD dst aborts
;             part 1: MFPI, MFPD
;             part 2: MTPD, MTPI
;   C2.3    test aborts in implied push/pop
;             part 1: JSR, MFPI, MFPD (push)
;             part 2: RTS, MTPI, MTPD (pop)
;   C2.4    mmu abort vs nxm abort
;             part 1: MMU allows access to NXM memory --> NXM abort
;             part 2: MMU denies access to NXM memory --> MMU abort
;   C2.5    mmu abort in vector flow - kernel mode
;   C2.6    mmu abort in vector flow - supervisor mode
;   C2.7    mmu abort in 1st instruction after vector flow
;   C2.8    mmu abort of prefetched instruction
;   C2.9    mmu aborts and memory status
;   C2.10   mmu abort plus stack limit abort
;
; Test C1:  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
;   Verify MMU response in mmr1 after a write to that fakes an abort
;
; Test C1.1 -- test mmr1 response via set abort in mmr0 trick ++++++++
;   Test method (concept seen in ekbee1)
;   - start with mmr1 cleared, mmr1 will track
;   - write one of the 3 abort bits in mmr1 (all three are tested)
;   - that will freeze mmr1
;   - the register signature of the write can be inspected
;   Note: this gives MMR1 when instruction is not(!) aborted
;         in principle, MMR1 might hold other values in the case of an abort
;
tc0101: mov     #1000$,r1       ; ptr to abort bit table
        mov     #mmr0,r2        ; ptr to mmr0
        mov     #mmr1,r3        ; ptr to mmr3
;
        reset
        mov     (r1),(r2)       ; no regs changed !
        hcmpeq  (r3),#^b0000000000000000;
;
        reset
        mov     (r1)+,(r2)      ; r1,2          00000 000 00010 001 via anr
        hcmpeq  (r3),#^b0000000000010001;
;
        reset
        mov     -(r1),(r2)      ; r1,-2         00000 000 11110 001 via anr
        hcmpeq  (r3),#^b0000000011110001;
;
        reset
        mov     (r1),(r2)+      ; r2,2          00000 000 00010 010 via anr
        hcmpeq  (r3),#^b0000000000010010;
;
        reset
        mov     (r1),-(r2)      ; r2,-2         00000 000 11110 010 via anr
        hcmpeq  (r3),#^b0000000011110010;
;
        reset
        mov     (r1)+,(r2)+     ; r1,2,r2,2     00010 010 00010 001 via anr
        hcmpeq  (r3),#^b0001001000010001;
;
        reset
        mov     -(r1),-(r2)      ; r1,-2,r2,-2  11110 010 11110 001 via anr
        hcmpeq  (r3),#^b1111001011110001;
;
        reset
        tst     (r1)+           ; bump ptr to ale
        mov     (r1)+,(r2)+     ; r1,2,r2,2     00010 010 00010 001 via ale
        hcmpeq  (r3),#^b0001001000010001;
;
; check that index reads are not accounted in mmr1
        reset
        tst     (r1)+           ; bump ptr beyond ard
        mov     -(r1),-2(r2)    ; r1,-1         00000 000 11110 001 via ard
        hcmpeq  (r3),#^b0000000011110001;
;
; check @(pc)+ behavior
;   w11  updates mmr1 in this case, as is also expected in ekbee1
;   Simh only adds 'general purpose register updates', thus not pc.
        cmpb    systyp,#sy.sih   ; skip test if on SimH
        beq     100$
        reset
        mov     -(r1),@#mmr0    ; r1,-2,pc,2    00010 111 11110 001 via ale
        hcmpeq  (r3),#^b0001011111110001;
100$:
;
        reset
        jmp     9999$
;
1000$:  .word   m0.anr
        .word   m0.ale
        .word   m0.ard
;
9999$:  iot                     ; end of test C1.1
;
; Test C2:  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
;   Verify MMU abort response in mmr0 and mmr1
;
; Test C2.1 -- test unary/binary instructions ++++++++++++++++++++++++
;   Excercise access to kernel page 6 and inspect mmr0 and mmr1
;
tc0201: vecset  v..mmu,vhmmua   ; set up mmu handler, pr0 kernel
        reset
        mov     #m0.ena,mmr0    ; enable mmu                    ;! MMU 18
;
; part 1: unary instructions; test acf to mmr0(15:13) mapping --------
; Summary:
;   1000$: tst  (r2)+        ; r   ; dst anr 1           ; pdr=  0.,0,000
;   1100$: tst  (r3)+        ; r   ; dst ale 1           ; pdr=  0.,0,arw
;   1200$: tst  -(r4)        ; r   ; dst ale 1           ; pdr=127.,1,arw
;   1300$: clrb -(r2)        ; w   ; dst ard 1           ; pdr=  0.,0,aro
;   1400$: inc  (r2)+        ; m   ; dst ard 1           ; pdr=  0.,0,aro
;   1500$: tstb (r2)+        ; r   ; dst anr 1           ; pdr=  0.,0,011
;   1600$: tstb -(r2)        ; r   ; dst anr 1           ; pdr=  0.,0,111
;
; non-resident abort (only)
1000$:  clr     kipdr6                          ; plf=  0.;ed=0;acf=nres
        mov     #1010$,vhvmmu
        mov     #140000,r2
        tst     (r2)+           ; will fail
        halt
1010$:  .word   m0.anr!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000000010010              ; mmr1 +2,2
;
; length abort, up direction; length 1 click
1100$:  mov     #<0.*md.plf>!md.arw,kipdr6      ; plf=  0.;ed=0;acf=w/r
        mov     #1110$,vhvmmu
        mov     #140102,r3
        tst     (r3)+           ; will fail
        halt
1110$:  .word   m0.ale!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000000010011              ; mmr1 +2,3
;
; length abort, down direction; length 1 click
1200$:  mov     #<127.*md.plf>!md.dwn!md.arw,kipdr6     ; plf=127.;ed=1;acf=w/r
        mov     #1210$,vhvmmu
        mov     #157700,r4
        tst     -(r4)           ; will fail
        halt
1210$:  .word   m0.ale!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000011110100              ; mmr1 -2,4
;
; write abort in mapped area (write access)
1300$:  mov     #<0.*md.plf>!md.ara,kipdr6      ; plf=  0.;ed=0;acf=r
        mov     #140002,r2
        tstb    (r2)+           ; read ok
        mov     #1310$,vhvmmu
        clrb    -(r2)           ; write will fail
        halt
1310$:  .word   m0.ard!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000011111010              ; mmr1 -1,2
;
; write abort in mapped area (wmw access)
1400$:  mov     #1410$,vhvmmu
        inc     (r2)+           ; rmw will fail
        halt
1410$:  .word   m0.ard!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000000010010              ; mmr1 +2,2
;
; acf=011: reserved, abort all -> handled as non-resident
1500$:  mov     #^b011,kipdr6                           ; plf=  0.;ed=0;acf=011
        mov     #1510$,vhvmmu
        tstb    (r2)+           ; will fail
        halt
1510$:  .word   m0.anr!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000000001010              ; mmr1 +1,2
;
; acf=111: reserved, abort all -> handled as non-resident
1600$:  mov     #^b111,kipdr6                           ; plf=  0.;ed=0;acf=111
        mov     #1610$,vhvmmu
        tstb    -(r2)           ; will fail
        halt
1610$:  .word   m0.anr!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000011111010              ; mmr1 -1,2
;
; part 2: unary instructions; fail in second access ------------------
; Summary:
;   2000$: tst  @(r2)+       ; r   ; dst ale 2           ; pdr=  0.,0,arw
;   2100$: tst  @-(r2)       ; r   ; dst ale 2           ; pdr=  0.,0,arw
;
2000$:  mov     #<0.*md.plf>!md.arw,kipdr6      ; plf=  0.;ed=0;acf=r/w
        mov     #2010$,vhvmmu
        mov     #2001$,r2
        tst     @(r2)+          ; will fail
        halt
2001$:  .word   p6p1p2          ; probed address, page 6, +1 click, +2
2010$:  .word   m0.ale!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000000010010              ; mmr1 +2,2
;
2100$:  mov     #2110$,vhvmmu
        tst     @-(r2)          ; will fail
        halt
2110$:  .word   m0.ale!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000011110010              ; mmr1 -2,2
;
; part 3: binary instructions; fail in src field ---------------------
; Summary:
;   3000$: mov  (r2)+,(r3)+  ; r w ; src ale 1           ; pdr=  0.,0,arw
;   3100$: mov  -(r2),(r3)+  ; r w ; src ale 1           ; pdr=  0.,0,arw
;   3200$: mov  @(r4)+,(r3)+ ; r w ; src ale 2           ; pdr=  0.,0,arw
;   3300$: mov  @-(r4),(r3)+ ; r w ; src ale 2           ; pdr=  0.,0,arw
;
3000$:  mov     #<0.*md.plf>!md.arw,kipdr6      ; plf=  0.;ed=0;acf=r/w
        mov     #3010$,vhvmmu
        mov     #140102,r2
        mov     #1,r3           ; not used
        mov     (r2)+,(r3)+     ; will fail
        halt
3010$:  .word   m0.ale!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000000010010              ; mmr1 +2,2
;
3100$:  mov     #3110$,vhvmmu
        mov     -(r2),(r3)+     ; will fail
        halt
3110$:  .word   m0.ale!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000011110010              ; mmr1 -2,2
;
3200$:  mov     #3210$,vhvmmu
        mov     #3201$,r4
        mov     @(r4)+,(r3)+    ; will fail
        halt
3201$:  .word   p6p1p2          ; probed address, page 6, +1 click, +2
3210$:  .word   m0.ale!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000000010100              ; mmr1 +2,4
;
3300$:  mov     #3310$,vhvmmu
        movb    @-(r4),(r3)+    ; will fail
        halt
3310$:  .word   m0.ale!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000011110100              ; mmr1 -2,4
;
; part 4: binary instructions; fail in dst field ---------------------
; Summary:
;   4000$: mov  (r2)+,-(r3)  ; r w ; dst ale 1           ; pdr=  0.,0,arw
;   4100$: mov  -(r2),(r3)+  ; r w ; dst ale 1           ; pdr=  0.,0,arw
;   4200$: cmp  (r2)+,@(r5)+ ; r r ; dst ale 2           ; pdr=  0.,0,arw
;   4300$: bis  -(r2),(r4)+  ; r m ; dst ard 1           ; pdr=  0.,0,aro
;   4400$: bis  (r2),-(r4)   ; r m ; dst ard 1           ; pdr=  0.,0,aro
;
4000$:  mov     #<0.*md.plf>!md.arw,kipdr6      ; plf=  0.;ed=0;acf=r/w
        mov     #4010$,vhvmmu
        mov     #4001$,r2
        mov     #140104,r3
        mov     (r2)+,-(r3)     ; will fail
        halt
4001$:  .word   123456
4010$:  .word   m0.ale!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b1111001100010010              ; mmr1 -2,3; +2,2
;
4100$:  mov     #4110$,vhvmmu
        mov     -(r2),(r3)+     ; will fail
        halt
4110$:  .word   m0.ale!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0001001111110010              ; mmr1 +2,3; -2,2
;
4200$:  mov     #4210$,vhvmmu
        mov     4201$,r5
        cmp     (r2)+,@(r5)+    ; will fail
        halt
4201$:  .word   p6p1p2          ; probed address, page 6, +1 click, +2
4210$:  .word   m0.ale!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0001010100010010              ; mmr1 +2,5; +2,2
;
4300$:  mov     #<0.*md.plf>!md.ara,kipdr6      ; plf=  0.;ed=0;acf=r
        mov     #4310$,vhvmmu
        mov     #140010,r4
        bis     -(r2),(r4)+     ; will fail
        halt
4310$:  .word   m0.ard!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0001010011110010              ; mmr1 +2,4; -2,2
;
; no inc/dec for src
4400$:  mov     #4410$,vhvmmu
        bis     (r2),-(r4)      ; will fail
        halt
4410$:  .word   m0.ard!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000011110100              ; mmr1 -2,4;
;
; part 5: multiple abort flags ---------------------------------------
; possible:  anr + ale    (non-resident + length)
;            ard + ale    (read-only    + length)
; Summary:
;   5000$: tst  (r2)+        ; r   ; dst anr+ale 1       ; pdr=  0.,0,000
;   5100$: clr  (r3)+        ; w   ; dst anr 1           ; pdr=  0.,0,000
;   5200$: com  (r4)+        ; m   ; dst ale+ard 1       ; pdr=  0.,0,aro
;
; non-resident + length abort
5000$:  clr     kipdr6                          ; plf=  0.;ed=0;acf=nres
        mov     #5010$,vhvmmu
        mov     #140102,r2
        tst     (r2)+           ; will fail
        halt
5010$:  .word   m0.anr!m0.ale!<6*m0.pno>!m0.ena ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000000010010              ; mmr1 +2,2
;
; non-resident abort + write --> nres only
5100$:  mov     #5110$,vhvmmu
        mov     #140002,r3
        clr     (r3)+           ; will fail
        halt
5110$:  .word   m0.anr!<6*m0.pno>!m0.ena ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000000010011              ; mmr1 +2,3
;
; length + read-only abort
5200$:  mov     #<0.*md.plf>!md.ara,kipdr6      ; plf=  0.;ed=0;acf=r
        mov     #5210$,vhvmmu
        mov     #140102,r4
        com     (r4)+           ; will fail
        halt
5210$:  .word   m0.ale!m0.ard!<6*m0.pno>!m0.ena ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000000010100              ; mmr1 +2,4
;
9000$:  reset                   ; mmu off                       ;! MMU off
        clr     cp.psw
        mov     #<127.*md.plf>!md.arw,kipdr6    ; restore kernel mapping
        vecclr  v..mmu                          ; restore mmu catcher
9999$:  iot                     ; end of test C2.1
;
; Test C2.2 -- test MFPI,MFPD,MTPI,MFPD dst aborts +++++++++++++++++++
;   Environment:    psw pm=user; mmr3 user I/D
;                   kipdr6  1 click up   acf=6 w/r
;                   uipdr0  1 click up   acf=2 read
;                   udpdr1  1 click up   acr=2 read
;                   udpdr2  1 click dn   acr=6 w/r
;
tc0202: vecset  v..mmu,vhmmua   ; set up mmu handler, pr0 kernel
        reset
        mov     #cp.pmu,cp.psw  ; pm to user
        mov     #m3.dum,mmr3    ; enable user D space
        mov     #<0.*md.plf>!md.arw,kipdr6            ;  plf=  0.;ed=0;acf=w/r
        mov     #<0.*md.plf>!md.ara,uipdr0            ;  plf=  0.;ed=0;acf=r
        mov     #<0.*md.plf>!md.ara,udpdr1            ;  plf=  0.;ed=0;acf=r
        mov     #<127.*md.plf>!md.dwn!md.arw,udpdr2   ;  plf=127.;ed=1;acf=w/r
        mov     #m0.ena,mmr0    ; enable mmu                    ;! MMU 18
;
; part 1: -- MFPI, MFPD ----------------------------------------------
; Summary:
;   1000$: mfpi (r2)+        ; r   ; dst anr 1           ; pdr=  0.,0,000
;   1100$: mfpi (r3)+        ; r   ; dst ale 1           ; pdr=  0.,0,aro
;   1200$: mfpi @(r4)+       ; r   ; dst ale 1           ; pdr=  0.,0,arw
;   1300$: mfpi @(r5)+       ; r   ; dst ale 2           ; pdr=  0.,0,aro
;   1400$: mfpd -(r3)        ; r   ; dst ale 1           ; pdr=127.,1,arw
;
; MPPI: I space page 1 non-resident
1000$:  mov     #1010$,vhvmmu
        mov     #p1base,r2
        mfpi    (r2)+           ; will fail, page 1 unmapped
        halt
1010$:  .word   m0.anr!m0.pmu!<1*m0.pno>!m0.ena ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000000010010              ; mmr1 +2,2
;
; MFPI: I space page 0 length abort
1100$:  mov     #1110$,vhvmmu
        mov     #p0p1p2,r3      ; page 0, +1 click, +2
        mfpi    (r3)+           ; will fail
        halt
1110$:  .word   m0.ale!m0.pmu!<0*m0.pno>!m0.ena ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000000010011              ; mmr1 +2,3
;
; MFPI @(R)+: 1st access fails (in kernel space)
1200$:  mov     #cp.pmu,cp.psw  ; pm to user
        mov     #1210$,vhvmmu
        mov     #p6p1p2,r4      ; page 6, +1 click, +2
        mfpi    @(r4)+          ; will fail
        halt
1210$:  .word   m0.ale!<6*m0.pno>!m0.ena        ; mmr0 -> p6 k
        ;         dddddrrrdddddrrr
        .word   ^b0000000000010100              ; mmr1 +2,4
;
; MFPI @(R)+: 2nd access fails (in user space)
1300$:  mov     #cp.pmu,cp.psw  ; pm to user
        mov     #1310$,vhvmmu
        mov     #1301$,r5
        mfpi    @(r5)+          ; will fail
        halt
1301$:  .word   p0p1p4          ; probed address
1310$:  .word   m0.ale!m0.pmu!<0*m0.pno>!m0.ena ; mmr0 -> p0 u
        ;         dddddrrrdddddrrr
        .word   ^b0000000000010101              ; mmr1 +2,5
;
; MFPD: D space page 1 length abort (has ed=1)
1400$:  mov     #cp.pmu,cp.psw  ; pm to user
        mov     #1410$,vhvmmu
        mov     #p1m1p0,r3      ; page 1, 128-1 click
        mfpd    -(r3)           ; will fail
        halt
1410$:  .word   m0.ale!m0.pmu!m0.dsp!<1*m0.pno>!m0.ena ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000011110011              ; mmr1 -2,3
;
; part 2: -- MTPD, MTPI ----------------------------------------------
; Note: mmr1 lsb has stack pop
; Summary:
;   2000$: mtpd (r2)+        ; r   ; dst anr 1           ; pdr=  0.,0,000
;   2100$: mtpd (r3)+        ; r   ; dst ard 1           ; pdr=  0.,0,aro
;   2200$: mtpd -(r4)        ; r   ; dst ale 1           ; pdr=127.,1,arw
;   2300$: mtpd @(R5)+       ; r   ; dst ale 1           ; pdr=  0.,0,arw
;   2400$: mtpd @(R3)+       ; r   ; dst ale 2           ; pdr=127.,1,arw
;   2500$: mtpi (r2)+        ; r   ; dst ard 1           ; pdr=  0.,0,aro
;
; MTPD: D space page 3 non-resident
2000$:  mov     #cp.pmu,cp.psw  ; pm to user
        mov     #2010$,vhvmmu
        mov     #p3base,r2
        push    #1234
        mtpd    (r2)+           ; will fail, page 3 unmapped
        halt
2010$:  .word   m0.anr!m0.pmu!m0.dsp!<3*m0.pno>!m0.ena ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0001001000010110              ; mmr1 +2,2; +2,6
;
; MTPD: D space page 1 read-only
2100$:  mov     #cp.pmu,cp.psw  ; pm to user
        mov     #2110$,vhvmmu
        mov     #p1p0p2,r3      ; page 1, +2
        push    #1234
        mtpd    (r3)+           ; will fail
        halt
2110$:  .word   m0.ard!m0.pmu!m0.dsp!<1*m0.pno>!m0.ena ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0001001100010110              ; mmr1 +2,3; +2,6
;
; MTPD: D space page 2 length
2200$:  mov     #2210$,vhvmmu
        mov     #p2m1p0,r4
        push    #1234
        mtpd    -(r4)           ; will fail
        halt
2210$:  .word   m0.ale!m0.pmu!m0.dsp!<2*m0.pno>!m0.ena ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b1111010000010110              ; mmr1 -2,4; +2,6
;
; MTPD @(R)+: 1st access fails (in kernel space)
2300$:  mov     #2310$,vhvmmu
        mov     #p6p1p2,r5      ; page 6, +1 click, +2
        push    #1234
        mtpd    @(r5)+          ; will fail
        halt
2310$:  .word   m0.ale!<6*m0.pno>!m0.ena        ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0001010100010110              ; mmr1 +2,5; +2,6
;
; MTPD @(R)+: 2nd access fails (in user space)
2400$:  mov     #2410$,vhvmmu
        mov     #2401$,r3
        push    #1234
        mtpd    @(r3)+          ; will fail
        halt
2401$:  .word   p2m1m4          ; probed address, page 1, 128-1 click, -4
2410$:  .word   m0.ale!m0.pmu!m0.dsp!<2*m0.pno>!m0.ena ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0001001100010110              ; mmr1 +2,3; +2,6
;
; MTPI: I space page 0 read-only
2500$:  mov     #cp.pmu,cp.psw  ; pm to user
        mov     #2510$,vhvmmu
        mov     #000020,r2
        push    #1234
        mtpi    (r2)+           ; will fail
        halt
2510$:  .word   m0.ard!m0.pmu!<0*m0.pno>!m0.ena ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0001001000010110              ; mmr1 +2,2; +2,6
;
9000$:  reset                   ; mmu off                       ;! MMU off
        clr     cp.psw
        mov     #<127.*md.plf>!md.arw,kipdr6    ; restore kernel mapping
        clr     uipdr0                          ; reset user mode pdr
        clr     udpdr1
        clr     udpdr2
        vecclr  v..mmu                          ; restore mmu catcher
9999$:  iot                     ; end of test C2.2
;
; Test C2.3 -- test aborts in implied push/pop +++++++++++++++++++++++
;   jsr,mfp* have an implied push; rts,mft* have an implied pop
;   This must be tested in supervisor mode to separate 'stack under test'
;   from the kernel stack used in MMU 250 vector handling
;   Environment:    psw cm=supervisor;pm=user
;                   si.0   as 1-to-1  (easy switch between kernel and supervisor)
;                   si.1   as 1-to-1  (easy switch between kernel and supervisor)
;                   si.7   as 1-to-1  (psw access)
;                   ui.0   as 1-to-1  (for read access)
;
tc0203: vecset  v..mmu,vhmmua   ; set up mmu handler, pr0 kernel
        reset
        mov     kipdr0,sipdr0   ; super 0: 1-to-1
        clr     sipar0
        mov     kipdr1,sipdr1   ; super 1: 1-to-1
        mov     kipar1,sipar1
        mov     kipdr7,sipdr7   ; super 7: 1-to-1
        mov     kipar7,sipar7
        mov     kipdr0,uipdr0   ; user  0: 1-to-1
        clr     uipar0
        mov     #m0.ena,mmr0    ; enable mmu                    ;! MMU 18
        mov     #cp.cms!cp.pmu,cp.psw  ; cm to supervisor, pm to user
;
; part 1: -- JSR, MFPI, MFPD (push) ----------------------------------
; Execute implicit push against a non-resident page
; Summary:
;   1000$: jsr  pc,(r2)
;   1100$: mfpi (r2)
;   1200$: mfpd (r2)
;
1000$:  mov     #p2base+40,sp    ; set SP into 1st click page 2, non-resident
        mov     #1010$,vhvmmu
        mov     #1001$,r2
        jsr     pc,(r2)         ; will fail
1001$:  halt
1010$:  .word   m0.anr!m0.pms!<2*m0.pno>!m0.ena ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000011110110              ; mmr1 -2,6
;
1100$:  mov     #1110$,vhvmmu
        mov     #swsyid,r2      ; any valid address
        mfpi    (r2)            ; will fail
        halt
1110$:  .word   m0.anr!m0.pms!<2*m0.pno>!m0.ena ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000011110110              ; mmr1 -2,6
;
1200$:  mov     #1210$,vhvmmu
        mfpd    (r2)            ; will fail
        halt
1210$:  .word   m0.anr!m0.pms!<2*m0.pno>!m0.ena ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000011110110              ; mmr1 -2,6
;
; part 2: -- RTS, MTPI, MTPD (pop) -----------------------------------
; Execute implicit pop  against a non-resident page
; Summary:
;   2000$: rts  pc
;   2100$: mtpi (r2)
;   2200$: mtpd (r2)
;
; Simh doesnt update SP and set MMR1 on implicit pops
; Modify expected mmr1 values in case SimH is detected
        cmpb    systyp,#sy.sih
        bne     1999$
        clr     2010$+2         ; expect mmr1 = 0
        clr     2110$+2         ; expect mmr1 = 0
        clr     2210$+2         ; expect mmr1 = 0
1999$:
;
2000$:  mov     #p2base+40,sp   ; set SP into 1st click page 2, non-resident
        mov     #2010$,vhvmmu
        rts     pc              ; will fail
        halt
2010$:  .word   m0.anr!m0.pms!<2*m0.pno>!m0.ena ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000000010110              ; mmr1 +2,6
;
2100$:  mov     #p2base+40,sp   ; set SP into 1st click page 2, non-resident
        mov     #2110$,vhvmmu
        mov     #1,r2           ; not used
        mtpi    (r2)            ; will fail
        halt
2110$:  .word   m0.anr!m0.pms!<2*m0.pno>!m0.ena ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000000010110              ; mmr1 +2,6
;
2200$:  mov     #p2base+40,sp   ; set SP into 1st click page 1, non-resident
        mov     #2210$,vhvmmu
        mov     #1,r2           ; not used
        mtpd    (r2)            ; will fail
        halt
2210$:  .word   m0.anr!m0.pms!<2*m0.pno>!m0.ena ; mmr0
        ;         dddddrrrdddddrrr
        .word   ^b0000000000010110              ; mmr1 +2,6
;
9000$:  clr     cp.psw
        reset                   ; mmu off                       ;! MMU off
        clr     sipdr0                          ; reset super/user pdr/par
        clr     sipar0
        clr     sipdr1
        clr     sipar1
        clr     sipdr7
        clr     sipar7
        clr     uipdr0
        clr     uipar0
        vecclr  v..mmu                          ; restore mmu catcher
9999$:  iot                     ; end of test C2.3
;
; Test C2.4 -- mmu abort vs nxm abort ++++++++++++++++++++++++++++++++
;    On a KB11-C a NXM abort has priority over an MMU abort. An access via
;    an acf=7 (reserved) page mapped to non-existing memory is aborted as an
;    NXM error (vector 4) and not as an MMU error (vector 250). On a KB11-E
;    an MMU error is taken. This behavior is checked in test 122 of ekbee1.
;    The w11, and also SimH and e11, follow the KB11-E behavior which is the
;    natural and expected behavior.
;

tc0204: mov     cp.los,kipar6           ; map begin of non-existent memory
        mov     #<127.*md.plf>!md.arw,kipdr6  ; allow access
        mov     #m3.e22,mmr3            ; enable 22-bit mode
        mov     #m0.ena,mmr0            ; enable mmu with traps  ;! MMU 22
;
; part 1: MMU allows access to NXM memory --> NXM abort --------------
;
1000$:  clr     cp.err                  ; clear CPUERR
        vecset  v..iit,1100$            ; set vector 4 handler for NXM abort
        clr     @#p6p1p2                ; access
        halt
1100$:  mov     #stack,sp               ; vector 4 taken
        hcmpeq  cp.err,#cp.nxm          ; NXM error seen
        vecclr  v..iit                  ; restore iit handler to catcher
;
; part 2: MMU denies access to NXM memory --> MMU abort --------------
;
2000$:  mov     #<127.*md.plf>!md.an7,kipdr6  ; deny access via acf=7
        clr     cp.err                  ; clear CPUERR
        vecset  v..mmu,2100$            ; set vector 250 handler for MMU abort
2010$:  clr     @#p6p1p2                ; access
        halt
2100$:  mov     #stack,sp               ; vector 250 taken
        htsteq  cp.err                  ; check CPUERR: no NXM expected
        hcmpeq  #m0.anr!<6*m0.pno>!m0.ena,mmr0   ; check mmr0
        hcmpeq  #2010$,mmr2             ; check mmr2: failed instruction
        vecclr  v..mmu                  ; restore mmu handler to catcher
;
        reset                   ; mmu off                       ;! MMU off
        mov     #001400,kipar6                  ; reset kipar6
        mov     #<127.*md.plf>!md.arw,kipdr6    ; reset kipdr6
;
9999$:  iot                                     ; end of test C2.4
;
; Test C2.5 -- mmu abort in vector flow - kernel mode ++++++++++++++++
;   Verifies the MMU abort after the 2nd and 1st push in a vector flow.
;   When the handler runs in kernel mode, the vector pushes are to kernel
;   stack, and this results in a fatal stack error with an emergency stack
;   and a vector 4 flow.
;   Tested with a TRAP instruction, page 5 made non-resident, and the
;   stack located at begin of page 6.
;   Verify that PS and PC at the beginning of the failed vector flow are saved.
;   See also cpu_details test A3.5, checks vector push abort by stklim.
;
tc0205: mov     #<127.*md.plf>,kipdr5   ; page 5 non-resident (afc=0)
        mov     #177777,p6base          ; set signatures (will be overwritten)
        mov     #177777,p6base-2        ; set signatures (will stay)
        mov     #m0.ena,mmr0            ; enable mmu            ;! MMU 18
        vecset  v..iit,200$,cp.pr1!cp000c ; iit handler, PR1+000C as signature
        vecset  v..mmu,110$,cp.pr2!cp00v0 ; mmu handler, PR2+00V0 as signature
        vecset  v..trp,120$,cp.pr3!cp0z00 ; trap handler,PR3+0Z00 as signature
;
; abort on 2nd push
        mov     #p6base+2,sp            ; 2nd push will fail
        spl     4
        ccc
        trap    100
100$:   halt                            ; label after trap
110$:   halt                            ; mmu catcher
120$:   halt                            ; trap catcher
;
200$:   htsteq  sp                      ; check emergency stack done
        hcmpeq  (sp),#100$              ; PC: return after trap
        hcmpeq  2(sp),#cp.pr4           ; PS: should be code signature
;
; abort on 1st push
        mov     #400$,v..iit            ; set up iit handler
        mov     #p6base,sp              ; 1st push will fail
        spl     5
        scc
        trap    200
300$:   halt                            ; label after trap
;
400$:   htsteq  sp                      ; check emergency stack done
        hcmpeq  (sp),#300$              ; PC: return after trap
        hcmpeq  2(sp),#cp.pr5!cpnzvc    ; PS: should be code signature
;
; check signatures, check that nothing written to page 5
        reset                           ; mmu off               ;! MMU off
        hcmpeq  #cp.pr4,p6base          ; code signature of 1st push of TRAP
        hcmpeq  #177777,p6base-2        ; must be untouched
;
; restore
        mov     #<127.*md.plf>!md.arw,kipdr5    ; reset kipdr5
        vecclr  v..iit                  ; v..iit to catcher
        vecclr  v..mmu                  ; v..mmu to catcher
        vecclr  v..trp                  ; v..trp to catcher
        mov     #stack,sp               ; SP to default
        spl     0                       ; back to PR0
;
9999$:  iot                                     ; end of test C2.5
;
; Test C2.6 -- mmu abort in vector flow - supervisor mode ++++++++++++
;   Verifies the MMU abort after the 2nd and 1st push in a vector flow.
;   When the handler is not in kernel mode a normal mmu vector 240 flow
;   is started. The mmu handler runs in kernel mode with a valid stack.
;   Tested with supervisor page 0+6+7 mapped 1-to-1, page 5 set non-resident,
;   and a PIRQ handler in supervisor space.
;   Verify that PS and PC at the beginning of the failed vector flow are saved.
;   Test inspired by ekbee1 test 124.
;   Verify also MMR0,MMR2 instruction complete response (unless on SimH)
;
tc0206: mov     kipdr0,sipdr0           ; super page 0 1-to-1
        mov     kipar0,sipar0
        mov     kipdr6,sipdr6           ; super page 6 1-to-1
        mov     kipar6,sipar6
        mov     kipdr7,sipdr7           ; super page 7 1-to-1
        mov     kipar7,sipar7
        mov     #m0.ena,mmr0            ; enable mmu            ;! MMU 18
        vecset  v..mmu,200$,cp.pr7!cp000c ; mmu handler, PR7+000C as signature
        vecset  v..pir,110$,cp.cms!cp.pr6!cp00v0 ; PIRQ handler in supervisor
;
; abort on 2nd push ------------------------------
        mov     #stack,sp               ; set kernel SP
        mov     #cp.cms!cp.pr7,cp.psw   ; switch to supervisor mode, PR7
        mov     #p6base+2,sp            ; set supervisor SP, 2nd push will fail
        movb    #bit04,cp.pir+1         ; request PIRQ 4
        ccc
        mov     #cp.cms!cp.pr1,cp.psw   ; to prio PR1 -> trigger PRIQ interrupt
100$:   halt                            ; label after mov
110$:   halt                            ; PIRQ catcher
;
200$:   hcmpeq  cp.psw,#cp.pms!cp.pr7!cp000c  ; MMU handler, in kernel mode
        clr     cp.pir                  ; cancel PIRQ
        hcmpeq  sp,#stack-4             ; check stack, 1 frame
        hcmpeq  (sp),#100$              ; PC: return after mov
        hcmpeq  2(sp),#cp.cms!cp.pr1    ; PS: should be code signature
;
; check mmr0,mmr1,mmr2 instruction complete (unless on SimH)
        cmpb    systyp,#sy.sih
        beq     290$
        hcmpeq  #m0.anr!m0.ale!m0.ico!m0.pms!<5*m0.pno>!m0.ena,mmr0 ; check mmr0
        hcmpeq  #^b1111011011110110,mmr1  ; check mmr1: two SP decrements
        hcmpeq  #v..pir,mmr2            ; check mmr2: failed vector
290$:
;
; abort on 1st push ------------------------------
        bic     #m0.anr!m0.ale!m0.ard,mmr0  ; clear mmr0 abort flags
        mov     #400$,v..mmu            ; mmu handler
        mov     #stack,sp               ; set kernel SP
        mov     #cp.cms!cp.pr7,cp.psw   ; switch to supervisor mode, PR7
        mov     #p6base,sp              ; set supervisor SP, 1st push will fail
        movb    #bit05,cp.pir+1         ; request PIRQ 5
        ccc
        mov     #cp.cms!cp.pr2,cp.psw   ; to prio PR2 -> trigger PRIQ interrupt
300$:   halt                            ; label after mov
;
400$:   hcmpeq  cp.psw,#cp.pms!cp.pr7!cp000c  ; MMU handler, in kernel mode
        clr     cp.pir                  ; cancel PIRQ
        hcmpeq  sp,#stack-4             ; check stack, 1 frame
        hcmpeq  (sp),#300$              ; PC: return after mov
        hcmpeq  2(sp),#cp.cms!cp.pr2    ; PS: should be code signature
;
; check mmr0,mmr1,mmr2 instruction complete (unless on SimH)
; Note: w11 has one SP decrement in the case, 11/70 and e11 have two.
        cmpb    systyp,#sy.sih
        beq     490$
        cmpb    systyp,#sy.e11
        bne     410$
        mov     #^b1111011011110110,420$+2  ; e11, as 11/70, has two SP decs
;
410$:   hcmpeq  #m0.anr!m0.ale!m0.ico!m0.pms!<5*m0.pno>!m0.ena,mmr0 ; check mmr0
420$:   hcmpeq  #^b0000000011110110,mmr1  ; check mmr1: one SP decrement
        hcmpeq  #v..pir,mmr2            ; check mmr2: failed vector
490$:
;
; restore ----------------------------------------
        clr     cp.psw                  ; to kernel
        reset                           ; mmu off               ;! MMU off
        clr     sipdr0
        clr     sipar0
        clr     sipdr6
        clr     sipar6
        clr     sipdr7
        clr     sipar7
        vecclr  v..mmu                  ; v..mmu to catcher
        vecclr  v..pir                  ; v..pir to catcher
        mov     #stack,sp               ; SP to default
;
9999$:  iot                                     ; end of test C2.6
;
; Test C2.7 -- mmu abort in 1st instruction after vector flow ++++++++
;   Verifies that 1st instruction after a vector flow has correct MMR0,MMR2
;   instruction complete signature, especially MMR0(ico)=0. Tested with an
;   abort of the instruction fetch of 1st instruction. The TRAP handler
;   address is set to page 6 which is made non-resident.
;
tc0207: clr     kipdr6                  ; kernel page 6 non-resident
        mov     #m0.ena,mmr0            ; enable mmu            ;! MMU 18
        vecset  v..trp,p6base+10        ; TRAP handler in page 6
        vecset  v..mmu,200$             ; mmu handler
100$:   trap    100                     ; will fail
        halt
200$:   hcmpeq  #m0.anr!<6*m0.pno>!m0.ena,mmr0 ; check mmr0: ico=0
        htsteq  mmr1                    ; check mmr1: no regs touched
        hcmpeq  v..trp,mmr2             ; check mmr2: point to 1st instruction
;
        reset                           ; mmu off               ;! MMU off
        mov     #<127.*md.plf>!md.arw,kipdr6  ; restore kipdr6
        vecclr  v..mmu                  ; v..mmu to catcher
        vecclr  v..trp                  ; v..trp to catcher
        mov     #stack,sp               ; SP to default
;
9999$:  iot                                     ; end of test C2.7
;
; Test C2.8 -- mmu abort of prefetched instruction +++++++++++++++++++
;   Verifies that MMR2 points to the correct instruction if the fetch
;   of a prefetched instruction fails. Uses the code p5ce14 initially
;   written for E1.4 located at the page 4 to page 5 border.
;
tc0208: clr     kipdr5                  ; kernel page 5 non-resident
        mov     #m0.ena,mmr0            ; enable mmu            ;! MMU 18
        vecset  v..mmu,200$             ; mmu handler
        clr     r2                      ; clear counter
        mov     #100$,r3                ; ptr to failed landing
        jmp     @#p5ce14                ; start test code
;
100$:   halt                            ; lands here if no abort
200$:   hcmpeq  #3,r2                   ; check, 3 executed inc
        hcmpeq  #m0.anr!<5*m0.pno>!m0.ena,mmr0 ; check mmr0
        htsteq  mmr1                    ; check mmr1: no regs touched
        hcmpeq  #p5base,mmr2            ; check mmr2: point failed instruction
;
        reset                           ; mmu off               ;! MMU off
        mov     #<127.*md.plf>!md.arw,kipdr5  ; restore kipdr5
        vecclr  v..mmu                  ; v..mmu to catcher
        mov     #stack,sp               ; SP to default
;
9999$:  iot                                     ; end of test C2.8
;
; Test C2.9 -- mmu aborts and memory status ++++++++++++++++++++++++++
;   Verifies, a bit late, that an aborted write didnt change memory
;
tc0209: clr     kipdr6                  ; kernel page 6 non-resident
        mov     #177777,p6base-2        ; set signatures (will be overwritten)
        mov     #177777,p6base          ; set signatures (will stay)
        mov     #m0.ena,mmr0            ; enable mmu            ;! MMU 18
        vecset  v..mmu,200$             ; mmu handler
        mov     #p6base-2,r1
        clr     (r1)+                   ; succeeds
100$:   clr     (r1)+                   ; fails
        halt
;
200$:   hcmpeq  #m0.anr!<6*m0.pno>!m0.ena,mmr0 ; check mmr0
        hcmpeq  #^b00010001,mmr1        ; check mmr1: r1 +2
        hcmpeq  #100$,mmr2              ; check mmr2: point failed instruction
;
        reset                           ; mmu off               ;! MMU off
        htsteq  p6base-2                ; check signature
        hcmpeq  #177777,p6base          ; check signature
;
        mov     #<127.*md.plf>!md.arw,kipdr6  ; restore kipdr6
        vecclr  v..mmu                  ; v..mmu to catcher
        mov     #stack,sp               ; SP to default
;
9999$:  iot                                     ; end of test C2.9
;
; Test C2.10 -- mmu abort plus stack limit abort +++++++++++++++++++++
;   Consider an instruction that is aborted due to red stack violation an the
;   destination address would cause an MMU abort. Tested in ekbee1 test 122
;   2nd part. The 11/70 and the simulators take a vector 4 and do not set MMR0
;   abort bits. The w11 also takes a vector 4 but will set MMR0 abort bits. 
;   Verify this w11 specific behavior.
;
tc0210: tstb    systyp                  ; skip if not on w11
        blt     9999$
;
        mov     #<127.*md.plf>,kipdr6   ; page 6 non-resident (afc=0)
        mov     #m0.ena,mmr0            ; enable mmu            ;! MMU 18
        vecset  v..iit,200$,cp.pr1!cp000c ; iit handler, PR1+000C as signature
        vecset  v..mmu,110$,cp.pr2!cp00v0 ; mmu handler, PR2+00V0 as signature
        mov     #p6base,cp.slr          ; red zone at 140340
        mov     #p6base+336,sp          ; in red zone
        spl     4
        ccc
 90$:   inc     (sp)                    ; fails (use inc to avoid dstw cc issue)
100$:   halt                            ; label after clr
110$:   halt                            ; mmu catcher
;
200$:   htsteq  sp                      ; check emergency stack done
        hcmpeq  (sp),#100$              ; PC: return after trap
        hcmpeq  2(sp),#cp.pr4           ; PS: should be code signature
        hcmpeq  #m0.anr!<6*m0.pno>!m0.ena,mmr0     ; check mmr0: expect abort
        htsteq  mmr1                    ; check mmr1: no regs changed
        hcmpeq  #90$,mmr2               ; check mmr2: instruction
;
        reset                           ; mmu off               ;! MMU off
        mov     #stack,sp               ; SP to default
        mov     #<127.*md.plf>!md.arw,kipdr6    ; reset kipdr6
        vecclr  v..iit                  ; v..iit to catcher
        vecclr  v..mmu                  ; v..mmu to catcher
        spl     0                       ; back to PR0        
;
9999$:  iot                                     ; end of test C2.10
;
; Section D: mmr2+mmr1+mmr0 register, abort recovery =========================
;   D1    code in user mode with D space, simulated SP extend
;   D2    vector push abort with simulated SP extend
;
; Test D1:  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
;
; Test D1.1 -- code in user mode with D space, simulated SP extend +++
;   The code is started with short stack page, stack push fails,
;   the kernel handler will to stack extension and register roll back.
;
td0101:
; set up emt handler
        vecset  v..emt,vhuemt           ; set up emt handler, pr0 kernel
        vecset  v..mmu,2000$,cp.pr7     ; set up mmu handler, pr7 kernel
; set up user mode pdr/par; short code/data page 0
; short stack page 1, base 140000, length 1 click (plf=127.) --> 157700:157776
        vc2sek = 157700            ; initial end of stack in kernel view
        vc2seu = 037700            ; initial end of stack in user view
;
        mov     #<8.*md.plf>!md.arw,uipdr0
        setpar  vc2,uipar0
        mov     #<8.*md.plf>!md.arw,udpdr0
        setpar  vc2dat,udpar0
        mov     #<127.*md.plf>!md.arw!md.dwn,udpdr1
        setpar  140000,udpar1
; enable mmu
        mov     #m3.dum,mmr3    ; user d dspace, no 22bit
        mov     #m0.ena,mmr0    ; enable mmu                    ;! MMU 18
;
; run code vc2 in user mode --------------------------------
;
; clear stack area seen by user code
        clr     vc2sek-4
        clr     vc2sek-2
        clr     vc2sek
        clr     vc2sek+2
; clear mmr0:mmr2 save area
        clr     3000$
        clr     3001$
        clr     3002$
; start code in user mode
        mov     #1000$,vhustp   ; set up continuation address
        rtijmp  #<cp.cmu!cp.pmu>,#0     ; start with PS=user, PC=0
        halt
1000$:                          ; continuation point
        hcmpeq  r5,#0           ; ran sob to end ?
        mfpd    sp              ; get user SP
        hcmpeq  (sp)+,#vc2seu-4 ; check expected value
        hcmpeq  vc2sek+2,vc2dat   ; 1st push
        hcmpeq  vc2sek+0,vc2dat+2 ; 2nd push
        hcmpeq  vc2sek-2,vc2dat+4 ; 3rd push
        hcmpeq  vc2sek-4,vc2dat+6 ; 4th push
        hcmpeq  3000$,#<m0.ale!m0.pmu!m0.dsp!<1*m0.pno>!m0.ena>
        hcmpeq  3001$,#^b1111011000010100       ; -2,sp;2,r4
        hcmpeq  3002$,#<vc2l1-vc2>
;
; reset user mode pdr/par
        clr     uipdr0
        clr     uipar0
        clr     udpdr0
        clr     udpar0
        clr     udpdr1
        clr     udpar1
;
        reset                   ; mmu off                       ;! MMU off
        vecclr  v..emt          ; restore emt catcher
        vecclr  v..mmu          ; restore mmu catcher
        jmp     9999$
;
; the MMU trap handler
;   - saves all registers (starting with PC dump)
;   - rolls back register changes seen in MMR1
;   - increases the stack by one click
;   - restore all registers
;   - restarts the aborted instruction by setting PC to MMR2
;
2000$:  mov     mmr0,3000$      ; record mmr0:mmr2
        mov     mmr1,3001$
        mov     mmr2,3002$
; save all registers
        clr     -(sp)           ; save dummy PC
        mfpd    sp              ; save pm SP
        pushm   r5,r4,r3,r2,r1,r0 ; and r5..r0
; roll back register changes
        mov     mmr1,r0         ; get mmr1
        mov     #2,r1           ; handle both halfes
2100$:  mov     r0,r2
        bic     #^c7,r2         ; mask out regnum field
        asl     r2              ; word offset
        add     sp,r2           ; address of register on stack
        movb    r0,r3           ; sign extend
        asr     r3              ; and shift 3 bits right
        asr     r3
        asr     r3              ; to get register correction
        sub     r3,(r2)         ; and correct register
        swab    r0              ; go for 2nd half
        sob     r1,2100$        ; and loop
; increase stack by one click --> decrease(!) plf
        mov     #<126.*md.plf>!md.arw!md.dwn,udpdr1
; restore all registers
        popm    r5,r4,r3,r2,r1,r0 ; restore r0..r5
        mtpd    sp              ; restore pm SP
        tst     (sp)+           ; pop dummy PC
; roll back PC to re-run aborted instruction
        mov     mmr2,(sp)       ; roll back PC
        bic     #<m0.anr!m0.ale!m0.ard>,mmr0    ; clear abort bits
        rtt                     ; return and restart instruction
                                ; MMU abort re-runs must use rtt to avoid a
                                ; spurious tbit trap in case traced instruction 
;
3000$:  .word   0               ; save mmr0
3001$:  .word   0               ; save mmr1
3002$:  .word   0               ; save mmr2
;
9999$:  iot                     ; end of test D1.1
;
; Test D2:  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
;
; Test D2.1 -- vector push abort with simulated SP extend ++++++++++++
;   This test is a full mock-up of a vector push abort recovery using the
;   MMR0,MMR2 instruction complete functionality. The test setup is
;   - the PIRQ handler is delegated to supervisor mode
;   - the supervisor stack is too short, the 2nd push of a vector flow
;     causes an MMU length abort
;   - the MMU handler sees MMR0(7) set to '1', extends the stack, builds
;     the return frame on the supervisor stack, and starts the PIRQ handler
;   - the PIRQ handler ends with a call to a simulated system service that
;     handles the RTI in kernel mode. That is necessary because an RTI from
;     supervisor mode can not return to kernel mode (escalation protection).
;   To simulate a full function MMU handler the test setup has in addition
;   - the PIRQ handler code is in an initially unmapped page. When the code
;     is started after the stack recovery, the first instruction fetch will
;     cause an MMU abort, now with MMR0(7) set to '0'. The handler will map
;     the code page and re-run the instruction.
;   - the IO page is mapped to supervisor mode with MMU traps enabled.
;     The first IO page access of the PIRQ handler will therefore cause
;     an MMU trap, the handler will just log it.
;
;   The supervisor mapping is:
;     page 0+1    1-to-1, this allows to write to trace area
;     page 2      code area, initially non-resident
;     page 3      stack area, initially too short
;     page 7      IO page, with RW traps enabled
;
td0201: cmpb    systyp,#sy.sih          ; skip on on SimH
        bne     100$
        jmp     9999$
;
; set up supervisor pdr/par
        vc3sek = 157700            ; initial end of stack in kernel view
        vc3ses = 077700            ; initial end of stack in supervisor view
;
100$:   mov     kipdr0,sipdr0           ; SM p0 1-to-1
        mov     kipar0,sipar0
        mov     kipdr1,sipdr1           ; SM p1 1-to-1
        mov     kipar1,sipar1
        mov     #<8.*md.plf>,sipdr2     ; SM p2 code, non-resident
        setpar  vc3,sipar2
        mov     #<127.*md.plf>!md.arw!md.dwn,sipdr3     ; SM p3 stack, short
        setpar  140000,sipar3
        mov     #<127.*md.plf>!md.att,sipdr7    ; SM p7 IOpage + rw-trap
        mov     kipar7,sipar7
        mov     #m0.ent!m0.ena,mmr0     ; enable mmu            ;! MMU 18
;
; set up handlers
;
        vecset  v..mmu,3000$,cp.pr7         ; MMU handler, lockout interrupts
        vecset  v..emt,4000$,cp.pr7         ; EMT handler, lockout interrupts
        vecset  v..pir,p2base,cp.cms!cp.pr7 ;PIRQ handler (on page 2 in SM,PR7)
;
; now start the game: set SM stack, set r5 and request a PIRQ 4
;
        mov     #cp.pms,cp.psw          ; SM now previous mode
        push    #vc3ses+2               ; SM stack 1 word above end
        mtpi    sp                      ; and set SM SP
        mov     #2000$,r5               ; ptr to trace area
        mov     #cp.pr1,cp.psw          ; code signature PR1
        movb    #bit04,cp.pir+1         ; request PIRQ 4
200$:
;
; and check state and trace area
;   kernel SP back to normal
;   supervisor SP back to normal
;   sipdr7 has AIA and AIW trace bits set
;
        hcmpeq  #cp.pr1,cp.psw          ; check PS
        hcmpeq  #stack,sp               ; check kernel SP
        mov     #cp.pms,cp.psw          ; SM now previous mode
        mfpi    sp                      ; get SM SP
        hcmpeq  #vc3ses+2,(sp)+         ; check supervisor SP
        clr     cp.psw                  ; PSW to default
        hcmpeq  #<127.*md.plf>!md.aia!md.aiw!md.att,sipdr7  ; check sipdr7
;
; on w11 the PC is incremented after an instruction fetch abort while on an
; 11/70 and with e11 it is not. Set up PC seen in 2nd MMU call accordingly
        mov     #p2base+2,r0            ; PC after fault (for w11)
        cmpb    systyp,#sy.e11          ; e11 ?
        bne     210$
        sub     #2,r0                   ; PC before fault (for e11)
;
210$:   htaini  2000$,5.                ; expect 5 items
        htacmp  #250,#200$              ; mmu(ico=1) after movb to cp.pir+1
        htacmp  #250,r0                 ; mmu(ico=1) PC differs for w11 and e11
        htacmp  #240,#200$              ; PIRQ, sees PC after movb to cp.pir+1
        htacmp  #250,#p2base+<vc3l1-vc3> ; mmu(trap) after clr of cp.pir
        htacmp  #032,#p2base+<vc3l2-vc3> ; EMT after emt 100
;
        jmp     9000$
;
2000$:  htabuf  5.                      ; trace area
;
; MMU handler ----------------------------------------------
;   It expects an abort with ico=1, an abort with ico=0 and a trap.
;   In these three cases, first the expected environment is checked and
;   after that the corrective action is taken.
;   Notes:
;   - the case of simultaneous MMU abort and trap (abort flags set and
;     m0.trp newly set) is not handled in this simple demonstrator.
;   - the code uses m*pd even though D-space is not enabled.
;   - the code uses RTT to return for an instruction re-execution. That avoids
;     a spurious tbit trap in case the aborted instruction was traced.
;
3000$:  htstge  (r5)                    ; r5 at fence ?
        mov     #250,(r5)+              ; trace
        mov     (sp),(r5)+
;
; dispatch call cases based on mmr0
        mov     mmr0,r0
        bit     #m0.anr!m0.ale!m0.ard,r0  ; abort seen ?
        beq     3300$                   ; if not branch to trap handling
        bit     #m0.ico,r0              ; ico seen ?
        beq     3200$                   ; if not branch to ico=0 handling
;
; handle abort with ico=1 ------------------------
;   Expect length error for supervisor mode I space page 3.
;   Actions:
;   - determine target mode from mmr0 page mode and set is as previous mode.
;   - roll-back previous mode SP.
;   - extend previous mode stack segment.
;   - move stack frame from from kernel to previous mode.
;     Note: the push abort leaves on the kernel stack a stack frame identical
;           to what would have been on supervisor mode stack without abort.
;   - start handler for aborted vector flow.
;     Note: MMR2 holds the vector address. So push PS and PC of that vector
;           to kernel stack and start handler with an RTT.
;
        ccc                             ; clear ccs before PSW check
        hcmpeq  #cp.pr7,cp.psw          ; PSW has CM=PM=kernel
        hcmpeq  #m0.ale!m0.ent!m0.ico!m0.pms!<3*m0.pno>!m0.ena,r0  ; check mmr0
        hcmpeq  #240,mmr2               ; check mmr2: PIRQ vector
;
; Use page mode from mmr0 as previous mode
;   psw(13:12) is PM, mmr0(6:5) is page mode --> shift 7 bits left
        mov     r0,r1                   ; copy mmr0
        bic     #^cm0.pmu,r1            ; get page mode bits
        ash     #7,r1                   ; shift to PM bits position
        bic     #cp.pmu,cp.psw          ; clear PM bits
        bis     r1,cp.psw               ; set PM bits from mmr0
; use MMR1 to correct SP
        mov     mmr1,r1                 ; get mmr1
        mfpd    sp                      ; get SM sp
        pop     r2
        cmp     #^b0000000011110110,r1  ; mmr1: sp -2
        bne     3100$
        add     #2,r2                   ; correct SP by 2
        br      3140$
3100$:  cmp     #^b1111011011110110,r1  ; mmr1: sp -4
        bne     3110$
        add     #4,r2                   ; correct SP by 4
        br      3140$
3110$:  halt                            ; unexpected MMR1
3140$:
;
; extend target stack frame --> decrease(!) plf
;
        mov     #<126.*md.plf>!md.arw!md.dwn,sipdr3
;
; move stack frame from kernel to target mode (SM)
;
        sub     #4,r2                   ; final SM SP
        mtpd    (r2)                    ; move SM frame PC
        mtpd    2(r2)                   ; move SM frame PS
        push    r2
        mtpd    sp                      ; update SM SP
;
; use MMR2 to start target handler (PIRQ)
;
        mov     mmr2,r2                 ; get vector address
        push2   2(r2),(r2)              ; handler PS,PC
        bic     #m0.anr!m0.ale!m0.ard,mmr0      ; clear abort flags
        rtt                             ; and start handler
;
; handle abort with ico=0 ------------------------
;   Expect non-resident error for supervisor mode I space page 2
;   Actions:
;   - no register roll-back done, MMR1 expected (and checked) to be 0.
;   - make page resident.
;   - re-run instruction, MMR2 points to its address.
;
3200$:  hcmpeq  #m0.anr!m0.ent!m0.pms!<2*m0.pno>!m0.ena,r0   ; check mmr0
        htsteq  mmr1                    ; check mmr1: zero after ifetch
        hcmpeq  #p2base,mmr2            ; check mmr2: PIRQ handler start
;
; make code page resident and re-run instruction
;
        bis     #md.arw,sipdr2          ; code page read-writable
        mov     mmr2,(sp)               ; point to failed instruction
        bic     #m0.anr!m0.ale!m0.ard,mmr0      ; clear abort flags
        rtt                             ; re-run instruction, use rtt to avoid
                                        ; a spurious tbit trap in case of a
                                        ; traced instruction
;
; handle MMU trap --------------------------------
;   Expect trap from cp.pir register access
;   Actions:
;   - just re-allow traps, even though none are expected
;
3300$:  hbitne  #m0.trp,r0              ; check mmr1
        bic     #m0.trp,mmr0            ; re-allow traps
        rti                             ; continue
;
; EMT handler ----------------------------------------------
;   The EMT handler simulates a system service that does a kernel mode RTI on
;   behalf of the supervisor mode handler. This allows supervisor mode code
;   to return to kernel mode code and bypasses the privileged escalation
;   protection of RTI/RTT in a controlled manner.
;   It simply moves the stack frame from previous mode to kernel mode and
;   does an RTI. The EMT return frame on the kernel stack is discarded.
;

4000$:  htstge  (r5)                    ; r5 at fence ?
        mov     #032,(r5)+              ; trace
        mov     (sp),(r5)+
;
; move stack frame from hander to kernel stack
;
        add     #4,sp                   ; drop return frame
        mfpd    sp                      ; get SM SP
        pop     r2
        mfpd    2(r2)                   ; move frame PS
        mfpd    (r2)                    ; move frame PC
        add     #4,r2                   ; correct SM SP
        push    r2
        mtpd    sp                      ; update SM SP
        rti                             ; finish rti from handler
;
; finally restore ------------------------------------------
9000$:  reset                                                   ;! MMU off
        mov     #sipdr0,r0
        mov     #sipar0,r1
        mov     #4,r2
9010$:  clr     (r0)+           ; reset sipdr 0-3
        clr     (r1)+           ; reset sipar 0-3
        sob     r2,9010$
        clr     sipdr7
        clr     sipar7
;
        vecclr  v..mmu          ; restore v..mmu to catcher
        vecclr  v..emt          ; restore v..emt to catcher
        vecclr  v..pir          ; restore v..pir to catcher
;
9999$:  iot                     ; end of test D2.1
;
; Section E: traps and pdr aia and aiw bits ==================================
;   E1    basic MMU trap and PDR aia/aiw logic
;   E1.1    test m0.trp, pdr aia/aiw transitions
;   E1.2    systematic abort/trap testing for all valid afc
;   E1.3    test trap request logic (trap on non-last access)
;   E1.4    test trap request after prefetched instructions
;   E2    MMU trap priority behavior
;   E2.1    mmu trap + interrupt priority
;
; Test E1:  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
;   Check basic MMU trap and PDR aia/aiw logic
;
; Test E1.1 -- test m0.trp, pdr aia/aiw transitions ++++++++++++++++++
; Summary
;   PDR   MMR0      action        aia aiw trp Trap  Comment
;   acf=6 ent=0     tst (r3)       0   0   0    no  no ai, no trap
;                   clr (r3)       0   1   0    no  clr sets aiw
;                   tst (r3)       0   1   0    no  aiw stays
;                   pdr->pdr       0   0   0    -   any pdr write clears aia,aiw
;                   clr (r3)       0   1   0    no  clr sets aiw
;                   pdr+1 write    0   0   0    -   any pdr write clears aia,aiw
;                   clr (r3)       0   1   0    no  clr sets aiw
;                   par->par       0   0   0    -   any par write clears aia,aiw
;
;   acf=6 ent=1     tst (r3)       0   0   0    no  no trap
;                   clr (r3)       0   1   0    no  no trap
;
;   acf=4 ent=0     tst (r3)       1   0   1    no  trp set, aia set
;                   clr (r3)       1   1   1    no  trp stays, aiw set
;                   trp=0;pdr      0   0   0    -   any par write clears aia,aiw
;
;   acf=4 ent=1     tst (r3)       1   0   1   yes  trap taken, trp set, aia set
;                   clr (r3)       1   1   1    no  no trap (trp=1!), aia set
;                   trp=0;pdr      0   0   0     -  any pdr write clears aia,aiw
;                   clr (r3)       1   1   1   yes  trap taken, trp,aia,aiw set
;                   tst (r3)       1   1   1    no  no trap (trp=1!), no bits
;                   trp=0;pdr      0   0   0     -  any par write clears aia,aiw
;
;   Uses page 6 with plf=1 and varying acf.
;   Checks that m0.trp must be cleared before a 2nd MMU trap is taken
;
te0101: vecset  v..mmu,vhmmut   ; setup MMU trap handler, pr0 kernel
        reset
        mov     #m0.ena,mmr0    ; enable mmu                    ;! MMU 18
        mov     #kipdr6,r4      ; keep in register
        mov     #p6base,r3      ; probed address
        clr     vhvmmu          ; dont expect traps initially
;
; acf=6 ent=0     tst (r3)       0   0   0    no  no ai, no trap
        mov     #md.plf!md.arw,(r4) ; set pdr
        tst     (r3)                ; probe read
        hbiteq  mmr0,#m0.trp        ; check trp=0
        hcmpeq  (r4),#md.plf!md.arw ; check aia,aiw=0
;
; clr (r3)       0   1   0    no  clr sets aiw
        clr     (r3)                ; probe write
        hbiteq  mmr0,#m0.trp        ; check trp=0
        hcmpeq  (r4),#md.plf!md.aiw!md.arw  ; check aiw=1
;
; tst (r3)       0   1   0    no  aiw stays
        tst     (r3)                ; probe read
        hcmpeq  (r4),#md.plf!md.aiw!md.arw  ; check aiw=1
;
; pdr->pdr       0   0   0    -   any pdr write clears aia,aiw
        mov     (r4),(r4)           ; write pdr->pdr, should clear aiw
        hcmpeq  (r4),#md.plf!md.arw ; check aiw=0
;
; clr (r3)       0   1   0    no  clr sets aiw
        clr     (r3)                 ; probe write
        hcmpeq  (r4),#md.plf!md.aiw!md.arw  ; check aiw=1
;
; pdr+1 write    0   0   0    -   any pdr write clears aia,aiw
        movb    #1,1(r4)            ; write pdr+1, should clear aiw
        hcmpeq  (r4),#md.plf!md.arw ; check aiw=0
;
; clr (r3)       0   1   0    no  clr sets aiw
        clr     (r3)                ; probe write
        hcmpeq  (r4),#md.plf!md.aiw!md.arw  ; check aiw=1
;
; par->par       0   0   0    -   any par write clears aia,aiw
        mov     kipar6,kipar6       ; write par->par, should clear aiw
        hcmpeq  (r4),#md.plf!md.arw ; check aiw=0
;
; acf=6 ent=1     tst (r3)       0   0   0    no  no trap
        mov     #m0.ent!m0.ena,mmr0 ; enable mmu with traps enabled
        tst     (r3)                ; probe read
;
; clr (r3)       0   1   0    no  no trap
        clr     (r3)                ; probe write
;
; acf=4 ent=0     tst (r3)       1   0   1    no  trp set, aia set
        mov     #md.plf!md.att,(r4) ; set pdr
        mov     #m0.ena,mmr0        ; enable mmu with traps disabled
        tst     (r3)                ; probe read
        hbitne  mmr0,#m0.trp        ; check trp=1
        hcmpeq  (r4),#md.plf!md.aia!md.att  ; check aia=1
;
; clr (r3)       1   1   1    no  trp stays, aiw set
        clr     (r3)                ; probe write
        hbitne  mmr0,#m0.trp        ; check trp=1
        hcmpeq  (r4),#md.plf!md.aia!md.aiw!md.att  ; check aia=1,aiw=1
;
; trp=0;pdr      0   0   0    -   any par write clears aia,aiw
        bic     #m0.trp,mmr0        ; clear trp
        hbiteq  mmr0,#m0.trp        ; check trp=0
        mov     (r4),(r4)           ; write pdr->pdr, should clear aia and aiw
        hcmpeq  (r4),#md.plf!md.att ; check aia=0,aiw=0
;
; acf=4 ent=1     tst (r3)       1   0   1   yes  trap taken, trp set, aia set
        mov     #m0.ent!m0.ena,mmr0 ; enable mmu with traps enabled
        mov     #1010$,vhvmmu
        tst     (r3)                ; probe read
        halt                        ; expect trap
1010$:  hbitne  mmr0,#m0.trp        ; check trp=1
        hcmpeq  (r4),#md.plf!md.aia!md.att  ; check aia=1
;
; clr (r3)       1   1   1    no  no trap (trp=1!), aia set
        clr     (r3)                ; probe write
        hbitne  mmr0,#m0.trp        ; check trp=1
        hcmpeq  (r4),#md.plf!md.aia!md.aiw!md.att  ; check aia=1,aiw=1
;
; trp=0;pdr      0   0   0     -  any pdr write clears aia,aiw
        bic     #m0.trp,mmr0        ; clear trp
        mov     (r4),(r4)           ; write pdr->pdr, should clear aia and aiw
        hcmpeq  (r4),#md.plf!md.att ; check aia=0,aiw=0
;
; clr (r3)       1   1   1   yes  trap taken, trp,aia,aiw set
        mov     #1020$,vhvmmu
        clr     (r3)                ; probe write
        halt                        ; expect trap
1020$:  hbitne  mmr0,#m0.trp        ; check trp=1
        hcmpeq  (r4),#md.plf!md.aia!md.aiw!md.att  ; check aia=1,aiw=1
;
; tst (r3)       1   1   1    no  no trap (trp=1!), no additional bits
        tst     (r3)                ; probe read
        hbitne  mmr0,#m0.trp        ; check trp=1
        hcmpeq  (r4),#md.plf!md.aia!md.aiw!md.att  ; check aia=1,aiw=1
;
; trp=0;pdr      0   0   0     -  any par write clears aia,aiw
        bic     #m0.trp,mmr0        ; clear trp
        mov     (r4),(r4)           ; write pdr->pdr, should clear aia and aiw
        hcmpeq  (r4),#md.plf!md.att ; check aia=0,aiw=0
;
9000$:  reset                   ; mmu off                       ;! MMU off
        clr     cp.psw
        mov     #<127.*md.plf>!md.arw,kipdr6    ; restore kernel mapping
        vecclr  v..mmu                          ; restore mmu catcher
9999$:  iot                     ; end of test E1.1
;
; Test E1.2 -- systematic abort/trap testing for all valid afc +++++++
; Summary
;   afc  action       handler  abort aia aiw trap  Comment
;    0   tst (r3)     r-abo      anr   0   0   no
;    0   add r0,(r3)  w-abo      anr   0   0   no
;    1   tst (r3)     r-trap       -   1   0  yes
;    1   add r0,(r3)  w-abo      ard   0   0   no
;    2   tst (r3)     r-ok         -   0   0   no
;    2   add r0,(r3)  w-abo      ard   0   0   no
;    4   tst (r3)     r-trap       -   1   0  yes
;    4   clr (r3)     w-trap       -   1   1  yes
;    5   tst (r3)     r-ok         -   0   0   no
;    5   clr (r3)     w-trap       -   1   1  yes
;    6   tst (r3)     r-ok         -   0   0   no
;    6   mov r0,(r3)  w-ok         -   0   1   no
;
te0102: vecset  v..mmu,vhmmut   ; setup MMU trap handler, pr0 kernel
        reset
        mov     #m0.ent!m0.ena,mmr0 ; enable mmu with traps     ;! MMU 18
        clr     vhvmmu          ; dont expect traps initially
;
        mov     #3000$,r5       ; ptr to data table
        mov     #kipdr6,r4      ; keep in register
        mov     #p6base,r3      ; probed address
        mov     #vhvmmu,r2      ; ptr to vhvmmu
;
1000$:  mov     (r5)+,(r4)      ; load pdr
        jmp     @(r5)+          ; execute case handler
;
; case r-ok: read, no abort, no trap
1100$:  clr     (r2)            ; no abort/trap expected
        tst     (r3)            ; probe read
        br      1900$           ; to ok-check
;
; case  r-abo: read, abort
1200$:  mov     #vhmmua,v..mmu  ; setup MMU abort handler
        mov     (r5)+,1210$
        mov     #1210$,(r2)
        tst     (r3)            ; probe read
        halt                    ; expect abort
1210$:  .word   0,0
        br      1910$           ; to abo-check
;
; case r-trap: read, trap
1300$:  mov     #vhmmut,v..mmu  ; setup MMU trap handler
        mov     #1900$,(r2)     ; to ok-check
        tst     (r3)            ; probe read
        halt                    ; expect trap
;
; case w-ok: write, no abort, no trap
1400$:  clr     (r2)            ; no abort/trap expected
        mov     r0,(r3)         ; probe write
        br      1900$           ; to ok-check
;
; case w-abo: write, abort
1500$:  mov     #vhmmua,v..mmu  ; setup MMU abort handler
        mov     (r5)+,1510$
        mov     #1510$,(r2)
        add     r0,(r3)         ; probe write
        halt                    ; expect abort
1510$:  .word   0,0
        br      1910$           ; to tr-check
;
; case w-trap: write, trap
1600$:  mov     #vhmmut,v..mmu  ; setup MMU trap handler
        mov     #1900$,(r2)
        clr     (r3)            ; probe write
        halt                    ; expect trap
;
1900$:  tst     (r5)+           ; drop unused mmr0 info
1910$:  mov     (r5)+,r0        ; get pdrexp
        hcmpeq  (r4),r0         ; check pdr
        mov     (r4),(r4)       ; clear pdr aia,aiw
        bic     #m0.trp,mmr0    ; clear mmr0 trp flag
        tst     (r5)            ; look at next case
        beq     9000$           ; if eq end sentinel found ?
        br      1000$           ; if ne go for next case
;
3000$:  .word   md.plf                          ; afc=0 + read:  - anr -------
        .word   1200$                           ; r-abo
        .word   m0.anr!m0.ent!<6*m0.pno>!m0.ena ; mmr0
        .word   md.plf                          ; pdf: no aib
;
        .word   md.plf                          ; afc=0 + write: - anr -------
        .word   1500$                           ; w-abo
        .word   m0.anr!m0.ent!<6*m0.pno>!m0.ena ; mmr0
        .word   md.plf                          ; pdf: no aib
;
        .word   md.plf!md.ata                   ; afc=1 + read:  - trp aia ---
        .word   1300$                           ; r-trap
        .word   0                               ; mmr0
        .word   md.plf!md.aia!md.ata            ; pdf: aia
;
        .word   md.plf!md.ata                   ; afc=1 + write: - ard -------
        .word   1500$                           ; w-abo
        .word   m0.ard!m0.ent!<6*m0.pno>!m0.ena ; mmr0
        .word   md.plf!md.ata                   ; pdf: no aib
;
        .word   md.plf!md.ara                   ; afc=2 + read:  -------------
        .word   1100$                           ; r-ok
        .word   0                               ; mmr0
        .word   md.plf!md.ara                   ; pdf: no aib
;
        .word   md.plf!md.ara                   ; afc=2 + write: - ard -------
        .word   1500$                           ; w-abo
        .word   m0.ard!m0.ent!<6*m0.pno>!m0.ena ; mmr0
        .word   md.plf!md.ara                   ; pdf: no aib
;
        .word   md.plf!md.att                   ; afc=4 + read:  - trp aia ---
        .word   1300$                           ; r-trap
        .word   0                               ; mmr0
        .word   md.plf!md.aia!md.att            ; pdf: aia
;
        .word   md.plf!md.att                   ; afc=4 + write  - trp aia,aiw
        .word   1600$                           ; w-trap
        .word   0                               ; mmr0
        .word   md.plf!md.aia!md.aiw!md.att     ; pdf: aia aiw
;
        .word   md.plf!md.art                   ; afc=5 + read:  -------------
        .word   1100$                           ; r-ok
        .word   0                               ; mmr0
        .word   md.plf!md.art                   ; pdf: no aib
;
        .word   md.plf!md.art                   ; afc=5 + write: - trp aia,aiw
        .word   1600$                           ; w-trap
        .word   0                               ; mmr0
        .word   md.plf!md.aia!md.aiw!md.art     ; pdf: aia aiw
;
        .word   md.plf!md.arw                   ; afc=6 + read:  -------------
        .word   1100$                           ; r-ok
        .word   0                               ; mmr0
        .word   md.plf!md.arw                   ; pdf: no aib
;
        .word   md.plf!md.arw                   ; afc=6 + write: - aiw -------
        .word   1400$                           ; w-ok
        .word   0                               ; mmr0
        .word   md.plf!md.aiw!md.arw            ; pdf: aiw
;
        .word   0               ; end sentinel  ------------------------------
;
9000$:  reset                   ; mmu off                       ;! MMU off
        clr     cp.psw
        mov     #<127.*md.plf>!md.arw,kipdr6    ; restore kernel mapping
        vecclr  v..mmu                          ; restore mmu catcher
9999$:  iot                     ; end of test E1.2
;
; Test E1.3 -- test trap request logic (trap on non-last access) +++++
;   Test cases where an instruction does multiple memory accesses and the
;   trap condition is not met on the last one. This verifies that the trap
;   request is properly recorded and handled at end of instruction execution.
;   Page 6 has traps enabled (afc=4), all others not.
;
te0103: mov     #mmr0,r2                ; ptr to mmr0
        mov     #p6base,r3              ; ptr to page6 (MMU traps enabled)
        mov     #1500$,r4               ; ptr to page0 (MMU traps disabled)
        mov     r4,(r3)                 ; p6base holds ptr to 1500$
        clr     (r4)                    ; clear target location
        clr     2(r4)
        mov     #<127.*md.plf>!md.att,kipdr6   ; enable traps (afc=4)
        mov     #m0.ent!m0.ena,mmr0     ; enable mmu with traps  ;! MMU 18
;
        vecset  v..mmu,vhmmut           ; setup MMU trap handler
        mov     #1010$,vhvmmu
        mov     (r3),r5                 ; check r(p6) - trival case
        halt
;
1010$:  mov     #1020$,vhvmmu
        bic     #m0.trp,(r2)            ; clear trp
        mov     (r3),(r4)               ; check r(p6),w(p0)
        halt
;
1020$:  mov     #1030$,vhvmmu
        bic     #m0.trp,(r2)            ; clear trp
        mov     @(r3)+,2(r4)            ; check r(p6),r(p0),r(p0),w(p0)
        halt
;
1030$:  mov     #1040$,vhvmmu
        bic     #m0.trp,(r2)            ; clear trp
        inc     @-(r3)                  ; check r(p6),rm(p0),wm(p0)
        halt
;
1040$:  hcmpeq  #1500$+1,1500$          ; check proper values in target
        hcmpeq  #1500$,1500$+2          ; as internal consistency check
        br      2000$
;
1500$:  .word   0
        .word   0
;
2000$:  reset                   ; mmu off                       ;! MMU off
        mov     #<127.*md.plf>!md.arw,kipdr6    ; reset kipdr6
        vecclr  v..mmu                          ; reset v..mmu
;
9999$:  iot                                     ; end of test E1.3
;
; Test E1.4 -- test trap request after prefetched instructions +++++++
;   The w11 starts a prefetch of the next instruction when the decode step
;   detects a register-only operate instruction (as the 11/70 does).
;   This test checks whether MMU traps are properly detected.
;   Page 5 has traps enabled (afc=4). A sequence of 'inc r2' instructions is
;   executed which start in page 4 and continue in page 5. The first in page 5
;   should cause an MMU trap.
;
te0104: mov     #<127.*md.plf>!md.att,kipdr5   ; enable traps (afc=4)
        mov     #m0.ent!m0.ena,mmr0     ; enable mmu with traps ;! MMU 18
        clr     r2                      ; clear counter
        mov     #1000$,r3               ; ptr to failed landing
        vecset  v..mmu,vhmmut           ; setup MMU trap handler
        mov     #1100$,vhvmmu
        jmp     @#p5ce14                ; start test code
;
1000$:  nop                             ; lands here if no trap
        halt
1100$:  hcmpeq  #4.,r2                  ; check counter
;
        reset                   ; mmu off                       ;! MMU off
        mov     #<127.*md.plf>!md.arw,kipdr5    ; reset kipdr5
        vecclr  v..mmu                          ; reset v..mmu
;
9999$:  iot                                     ; end of test E1.4
;
; Test E1.5 -- test trap request after IO page access ++++++++++++++++
;
te0105: mov     #<127.*md.plf>!md.att,kipdr7   ; enable traps (afc=4)
        vecset  v..mmu,vhmmut           ; setup MMU trap handler
        mov     #1000$,vhvmmu
;
; The write to mmr0 will not trigger a trap on w11 because the trap decision
; is taken during address translation and thus before MMR0 is changed.
; The read access to cp.psw will cause an MMU trap.
        mov     #m0.ent!m0.ena,mmr0     ; enable mmu with traps ;! MMU 18
        tst     cp.psw
        halt
;
1000$:  reset                   ; mmu off                       ;! MMU off
        mov     #<127.*md.plf>!md.arw,kipdr7    ; reset kipdr7
        vecclr  v..mmu                          ; reset v..mmu
;
9999$:  iot                                     ; end of test E1.5
;
; Test E2:  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
;   Check MMU trap priority behavior
;
; common handler setup for trap and interrupt priority tests
;
        vecset  v..mmu,vhtmmu,cp.pr7    ; mmu trap handler, PR7 (lockout PIRQ)
        vecset  v..pir,vhtpir,cp.pr7    ; PIRQ handler, PR7 (prevent retrigger)
        mov     #<127.*md.plf>!md.att,kipdr5   ; enable traps in page 5 (afc=4)
;
; Test E2.1 -- mmu trap + interrupt priority +++++++++++++++++++++++++
;
te0201: mov     #m0.ent!m0.ena,mmr0     ; enable mmu with traps  ;! MMU 18
        mov     #1500$,r5               ; set up data pointer
;
        spl     0                       ; ensure PR0
        call    p5ce21                  ; start probe code in page 5
1000$:  br      2000$                   ; rts will land here
;
1500$:  htabuf  3.                      ; trace area
;
2000$:  htaini  1500$,3.                ; expect 3 items
        htacmp  #250,#p5ce21+6          ; mmu for movb
        htacmp  #240,#p5ce21+6          ; PIRQ, sees PC after movb
        htacmp  #250,#1000$             ; mmu for rts, PC is return address
;
        reset                   ; mmu off                       ;! MMU off
;
9999$:  iot                                     ; end of test E2.1
;
; common restore for section E2 --------------------------------------
;
        mov     #<127.*md.plf>!md.arw,kipdr5    ; reset kipdr5
        vecclr  v..mmu                  ; restore v..mmu to catcher
        vecclr  v..pir                  ; restore v..pir to catcher
;
; Section F: miscellaneous ===================================================
;   F1    test D-to-I mapping
;   F1.1    for (PC) address modes I
;   F1.2    for (PC) address modes II
;   F2    test LOSIZE register and access to full memory
;
; Test F1:  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
;
; Test F1.1 -- test D-to-I mapping for (PC) address modes I ++++++++++
; In case of immediate (pc)+ and absolute @(pc)+ addressing the first read
; comes from I space. Same holds for (pc) specifiers. The remaining two modes
; -(pc) and @-(pc) have no practical use and cant even be tested.
; The test runs with D space disabled and the D page 0 set non-resident.
; If any access to D space will cause an MMU abort. Because kernel D page 0 is
; non-resident, the vector fetch will fail and the CPU halts with an F:vecfet.
;
; Summary
;    (pc)+ srcr:  mov #nnn,r0
;    (pc)+ dstr:  tst #nnn
;    (pc)+ dstr:  cmp r0,#nnn
;    (pc)+ dstw:  mov r0,#nnn
;   @(pc)+ srcr:  mov @#val,r0
;   @(pc)+ dstr:  tst @#val
;   @(pc)+ dstr:  cmp r0,@#val
;   @(pc)+ dstw:  mov r0,@#val
;    (pc)  srcr:  mov (pc),r0
;    (pc)  dstr:  tst (pc)
;    (pc)  dstr:  cmp r0,(pc)
;    (pc)  dstw:  mov r0,(pc)
;
tf0101: mov     #m3.dkm,mmr3    ; enable D space for kernel
        clr     kdpdr0          ; ensure D space non-resident
        mov     kipdr6,kdpdr6   ; set up page 6 D space 1-to-1
        mov     kipar6,kdpar6
;
        mov     #234,100$+2     ; restore target
        mov     #345,p6base     ; restore target
        mov     #ccc,300$       ; restore target
        clr     r2
        mov     #m0.ena,mmr0    ; enable mmu                    ;! MMU 18
;
; (pc)+
        mov     #123,r0         ; src  immediate
        tst     #123            ; dstr immediate
        cmp     r0,#123         ; dstr immediate
100$:   mov     r0,#234         ; dstw immediate (overwrites I space!)
;
; @(pc)+
        mov     @#p6base,r1     ; src  absolute
        tst     @#p6base        ; dstr absolute
        cmp     r1,@#p6base     ; dstr absolute
        mov     r0,@#p6base     ; dstw absolute (write #123 to D space)
;
; (pc)
        mov     (pc),r2         ; src  (read next instruction, a ccc)
200$:   ccc
        tst     (pc)            ; dstr (read next instruction)
        cmp     r2,(pc)         ; dstr (read next instruction)
        mov     r2,(pc)         ; dstw (overwrites I space!)
300$:   scc
;
        reset                   ; mmu off                       ;! MMU off
        hcmpeq  100$+2,#123     ; I space overwritten ?
        hcmpeq  p6base,#123     ; D space overwritten ?
        hcmpeq  r2,200$         ; read from I space ?
        hcmpeq  300$,#ccc
;
        clr     kdpdr6          ; reset kdpdr6
        clr     kdpar6          ; reset kdpar6
        vecclr  v..mmu          ; restore mmu catcher
;
9999$:  iot                     ; end of test F1.1
;
; Test F1.2 -- test D-to-I mapping for (PC) address modes II +++++++++
; In case of absolute @(pc)+ addressing the first access goes to I space
; and the second to D space. The test uses page 6 as target and runs with
; D page 6 mapped and the I page 6 set non-resident.
;
; Summary
;    @(pc)+  srcr:  mov @#val,r0
;    @(pc)+  dstr:  cmp r0,@#val
;    @(pc)+  dstw:  mov r0,@#val
;
tf0102: mov     #154345,@#p6base ; inititialize target
        mov     #m3.dkm,mmr3    ; enable D space for kernel
        mov     kipdr6,kdpdr6   ; set up page 6 D space 1-to-1
        mov     kipar6,kdpar6
        push    kipdr6          ; save I page 6
        clr     kipdr6          ; ensure I page 6 non-resident
        mov     #m0.ena,mmr0    ; enable mmu                    ;! MMU 18
;
; @(pc)+  srcr
        mov     @#p6base,r1
; @(pc)+  dstr
        cmp     r1,@#p6base
        beq     100$
        halt
100$:   mov     r1,r2
        inc     r2
; @(pc)+  dstw
        mov     r2,@#p6base
;
        reset                   ; mmu off                       ;! MMU off
        pop     kipdr6          ; restore I page 6
        clr     kdpdr6          ; reset kdpdr6
        clr     kdpar6          ; reset kdpar6
;
        hcmpeq  r1,#154345
        hcmpeq  @#p6base,#154346
;
9999$:  iot                     ; end of test F1.2
;
; Test F2:  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
;
; Test F2.1 -- test LOSIZE register and access to full memory ++++++++
;   Read memory size from LOSIZE, write one word every 64 kB and read back.
;   Quite fast: at most 60 words (4M-256k)/64k.
;   Tests runs with kernel D space enabled (an exception!)
;
tf0201: mov     kipdr0,kdpdr0           ; set up kernel D space 1-to-1 mapping
        mov     kipar0,kdpar0
        mov     kipdr1,kdpdr1
        mov     kipar1,kdpar1
        mov     kipdr6,kdpdr6
        mov     kipar6,kdpar6
        mov     kipdr7,kdpdr7
        mov     kipar7,kdpar7
        mov     #m3.e22!m3.dkm,mmr3     ; enable D space for kernel; 22 bit
        mov     #m0.ena,mmr0            ; enable mmu            ;! MMU 22
;
        htsteq  hisize                  ; HISIZE must be zero
        mov     losize,r0               ; last accessible click (64B)
        inc     r0
        ccc
        ror     r0                      ; shift right 10 bits, no sign extend
        ash     #-9.,r0                 ; memory size in 64 kB chunks
        dec     r0                      ; number of chunks to test
        ble     2000$                   ; quit if memory too small
        mov     #2000,r1                ; step size 64kB in clicks
        mov     #kdpar6,r2              ; ptr to kdpar6
        mov     #p6base,r3              ; ptr to write/read test location
; write memory
        mov     r0,r4                   ; initialize counter
        mov     r1,r5                   ; initialize current par
100$:   mov     r5,(r2)                 ; set par
        mov     r5,(r3)                 ; write data
        add     r1,r5                   ; bump pointer
        sob     r4,100$
; read memory
        mov     r0,r4                   ; initialize counter
        mov     r1,r5                   ; initialize current par
200$:   mov     r5,(r2)                 ; set par
        hcmpeq  r5,(r3)                 ; check data
        add     r1,r5                   ; bump pointer
        sob     r4,200$
;
2000$:  reset                   ; mmu off                       ;! MMU off
        clr     kdpdr0
        clr     kdpar0
        clr     kdpdr1
        clr     kdpar1
        clr     kdpdr6
        clr     kdpar6
        clr     kdpdr7
        clr     kdpar7
;
9999$:  iot                     ; end of test F2.1
;
; END OF ALL TESTS - loop closure ============================================
;
        mov     tstno,r0        ; hack, for easy monitoring ...
        hcmpeq  tstno,#33.      ; all tests done ?
        call    chkpdr          ; kernel pdr/par OK ?
;
        jmp     loop
;
; pdr/par consistency checker
;   Verify that all I-space pdr/par are in default configuration set up by A1.2.
;   Implentend as subroutine for debug purposes. Always called at end of tests.
;
chkpdr: mov     #kipdr0,r0                      ; check kernel
        mov     #kipar0,r1
        mov     #<127.*md.plf>!md.arw,r2        ; default pdr
        clr     r3                              ; current par
        mov     #200,r4                         ; par increment
        mov     #7.,r5                          ; check 0...6
100$:   mov     (r0),(r0)                       ; clear AI bits with re-write
        hcmpeq  r2,(r0)+                        ; check pdr
        hcmpeq  r3,(r1)+                        ; check par
        add     r4,r3                           ; step to next par value
        sob     r5,100$
        mov     (r0),(r0)                       ; clear AI bits with re-write
        hcmpeq  r2,(r0)+                        ; check pdr7
        hcmpeq  #177600,(r1)+                   ; check par7
;
        mov     #sipdr0,r0                      ; check supervisor + user
        mov     #sipar0,r1
        mov     #uipdr0,r2
        mov     #uipar0,r3
        mov     #8.,r4
200$:   htsteq  (r0)+                           ; check sipdr
        htsteq  (r1)+                           ; check sipar
        htsteq  (r2)+                           ; check uipdr
        htsteq  (r3)+                           ; check uipar
        sob     r4,200$
        return
;
; kernel handlers and helpers ================================================
;
; vhmmua - expected mmu abort handler ++++++++++++++++++++++++++++++++++++++++
;   used to catch expected MMU aborts
;   the pointer to expected mmr0/mmr1 values must be in vhvmmu
;   code will continue after the test value context
;   execution will clear vhvmmu
;   --> vhvmmu must be set for each execution
;   the handler uses and modifies r0,r1
;   --> tests should only use r2,...,r5
;
vhmmua: mov     vhvmmu,r1       ; get context
        beq     1000$           ; if 0 halt
        hcmpeq  mmr0,(r1)+      ; check mmr0
        hcmpeq  mmr1,(r1)+      ; check mmr1
        bic     #m0.anr!m0.ale!m0.ard,mmr0      ; reset mmr0 abort flags
        mov     r1,(sp)         ; set up kernel return address
        clr     vhvmmu          ; reset context
        rti                     ; end return to continuation address
1000$:  halt
vhvmmu: .word   0               ; context pointer
;
; vhmmut - expected mmu trap handler +++++++++++++++++++++++++++++++++++++++++
;   used to catch expected MMU traps
;   the pointer to continuation address must be in vhvmmu
;   execution will clear vhvmmu
;   --> vhvmmu must be set for each execution
;   the handler uses and modifies r0,r1
;   --> tests should only use r2,...,r5
;
vhmmut: mov     vhvmmu,r1       ; get context
        beq     1000$           ; if 0 halt
        mov     mmr0,r0
        hbiteq  r0,#m0.anr!m0.ale!m0.ard    ; check abort flags 0
        hbitne  r0,#m0.trp                  ; check trap  flag  1
        mov     r1,(sp)         ; set up kernel return address
        clr     vhvmmu          ; reset context
        rti                     ; end return to continuation address
1000$:  halt
;
; vhuemt - emt handler, drop frame, continue in kernel mode ++++++++++++++++++
;   use to end user/supervisor mode code with an emt xxx
;   the kernel continution address must be written to vhustp
;   execution will reset vhustp to a catcher value
;   --> vhustp must be set for each execution
;
vhuemt: tst     (sp)+           ; discard one word of vector push
        mov     vhustp,(sp)     ; set up kernel return address
        mov     #vhuhlt,vhustp  ; reset stop address by catcher
        rts     pc              ; end return to continuation address
vhustp: .word   vhuhlt
vhuhlt: halt
;
; vhtmmu - handler for MMU trap tracing ++++++++++++++++++++++++++++++++++++++
;   Writes signature to data area (ptr in r5).
;   Signature is vector address + return PC  (PC to test proper context).
;   Clears MMR0(trp) bit to allow further MMU traps
;
vhtmmu: htstge  (r5)            ; r5 at fence ?
        bic     #m0.trp,mmr0    ; allow further MMU traps
        htaadd  #v..mmu         ; track MMU vector, track return PC
        rti
;
; vhtpir - handler for PIRQ interrupt tracing ++++++++++++++++++++++++++++++++
;   Writes signature to data area (ptr in r5).
;   Signature is vector address + return PC  (PC to test proper context).
;   Clears all PIRQ requests to prevent interrupt loop.
;
vhtpir: htstge  (r5)            ; r5 at fence ?
        clr     cp.pir          ; clear all PIRQ interrupts
        htaadd  #v..pir         ; track PIRQ vector, track return PC
        rti
;
; Test codes that will be mapped in user or supervisor mode ==================
; They are located in page 4 at 100000 and above and are position-independent
; code. That allows to assemble and load them together with the main code.
;
        . = 100000
;
; vc0 - simple code ++ used from B3.1 ++++++++++++++++++++++++++++++++++++++++
;    uses jsr, has stack below 1000 (no problem in user/supervisor mode)
;    does operations with vc0v0, vc0v1, vc0v2
;    these location are usually set before and checked afterwards in kernel mode
;
vc0:    jmp     100$
        .blkw   14.             ; small stack space
100$:   mov     #40,sp          ; initialize stack
        call    1000$
        emt     100             ; will end user/supervisor code
;
1000$:  com     vc0v0
        call    2000$
        return
2000$:  add     vc0v1,vc0v2
        return
;
vc0v0:  .word   0
vc0v1:  .word   0
vc0v2:  .word   0
;
; vc1 - simple I/D code ++ used from B3.2 ++++++++++++++++++++++++++++++++++++
;    uses jsr, has stack below 1000 (no problem in user/supervisor mode)
;    does operations with vc1v0, vc1v1, vc1v2
;    these locations are usually set before and checked afterwards in kernel mode
;
        . = 101000              ; I space ------------------------------------
vc1:    mov     #<vc1v0-vc1dat>,sp      ; initialize stack
        mov     #<vc1v0-vc1dat>,r5      ; initialize data pointer
        call    1000$
        emt     100             ; will end user/supervisor code
;
1000$:  com     (r5)            ; will access vc1v0
        call    2000$
        return
2000$:  add     2(r5),4(r5)     ; will access vc1v1 and vc1v2
        return
;
vc1ida: .word   0               ; I space location, M*PI read/write target
;
        . = 102000              ; D space ------------------------------------
vc1dat: .blkw   16.             ; small stack space
vc1stk:
vc1v0:  .word   0
vc1v1:  .word   0
vc1v2:  .word   0
;
; vc2 - stack push I/D code ++ used from D1.1 ++++++++++++++++++++++++++++++++
;    set SP just above the stack page end; push data
;    expect kernel handler to extend the stack and re-run failed push
;
        . = 103000              ; I space ------------------------------------
vc2:    mov     #vc2seu+4,sp    ; 4 bytes above initial end
        mov     #<vc2dat-vc2dat>,r4    ; initialize data pointer to vc2dat
        mov     #4.,r5          ; set loop count
vc2l1:  push    (r4)+           ; push data
        sob     r5,vc2l1
        emt     100             ; will end code
;
        . = 104000              ; D space ------------------------------------
vc2dat: .word   010111
        .word   010222
        .word   010333
        .word   010444
;
; vc3 - PIRQ handler code ++ used from D2.1 ++++++++++++++++++++++++++++++++++
;   Simply cancels all PIRQ interrupts.
;   Will be mapped to page 2, the code must therefore be position-independent.
;
        . = 105000              ; I space ------------------------------------
vc3:    htstge  (r5)            ; r5 at fence ?
        htaadd  #v..pir         ; track PIRQ vector, track return PC
        clr     @#cp.pir        ; cancel PIRQ (use absolute mode!)
vc3l1:  emt     100             ; delegate RTI to system service
vc3l2:  halt                    ; label after emt
;
; vc4 - MFPI/MTPI user mode test code ++ used from B3.3 ++++++++++++++++++++++
;   Returns all values to be checked in registers
;     r0:  D space access to vc4v1
;     r1:  MFPI read of vc4v2; I space requested, but D space received
;     r2:  MFPD read of vc4v3
;
        . = 106000              ; I space ------------------------------------
vc4:    mov     #<vc4stk-vc4dat+p1base>,sp      ; initialize stack
        mov     @#vc4v1-vc4dat+p1base,r0        ; simple D space access
        mfpi    @#vc4v2-vc4dat+p1base           ; reads D space! I would abort!
        pop     r1                              ; save value
        mfpd    @#vc4v3-vc4dat+p1base           ; read D space
        pop     r2                              ; save value
        push    #040444
        mtpi    vc4l1                           ; write to I space allowed
        emt     100             ; will end code
;
vc4l1:  .word   0
;
        . = 107000              ; D space ------------------------------------
vc4dat: .blkw   16.             ; small stack space
vc4stk:
vc4v1:  .word   040111
vc4v2:  .word   040222
vc4v3:  .word   040333
;
; p5ce14 Test E1.4 test code +++++++++++++++++++++++++++++++++++++++++
;   located at border of page 4 and page 5 (touching both)
;
        . = p5base-6
p5ce14: inc     r2              ; @117772; r2=1
        inc     r2              ; @117774; r2=2
        inc     r2              ; @117776; r2=3
        inc     r2              ; @120000; r2=4  <-- should trap here
        inc     r2              ; @120002; r2=5
        inc     r2              ; @120004; r2=6
        inc     r2              ; @120006; r2=7
        jmp     (r3)            ; return to main code
;
; p5ce21 Test E2.1 test code +++++++++++++++++++++++++++++++++++++++++
;
p5ce21: movb    #bit01,cp.pir+1 ; request PIRQ 1
        return                  ; and return to main flow
;
        .end    start