Completed texi manual

	* Also removed unused constants in erc32.c

10 files changed, 664 insertions, 744 deletions

diff --git a/README b/README
new file mode 100644
index 0000000..5bfad59
--- /dev/null
+++ b/README
@@ -0,0 +1,16 @@
+
+SIS - Simple Instruction Simulator README file
+----------------------------------------------
+
+SIS uses the GNU autoconf system, and can simply be build using:
+
+	./configure 
+
+followed by 
+
+	make
+
+To build a PDF version of the manual, do
+
+	make sis.pdf.
+
diff --git a/README.erc32 b/README.erc32
deleted file mode 100644
index 831434f..0000000
--- a/README.erc32
+++ /dev/null
@@ -1,176 +0,0 @@
-
-1. MEC and ERC32 emulation
-
-The file 'erc32.c' contains a model of the MEC, 512 K rom and 4 M ram.
-
-The following paragraphs outline the implemented MEC functions.
-
-1.1 UARTs
-
-The UARTs are connected to two pseudo-devices, /dev/ttypc and /dev/ttypd.
-The following registers are implemented:
-
-- UART A RX and TX register	(0x01f800e0)
-- UART B RX and TX register	(0x01f800e4)
-- UART status register		(0x01f800e8)
-
-To speed up simulation, the UARTs operate at approximately 115200 baud.
-The UARTs generate interrupt 4 and 5 after each received or transmitted
-character.  The error interrupt is generated if overflow occurs - other
-errors cannot occur.
-
-1.2 Real-time clock and general purpose timer A
-
-The following registers are implemented:
-
-- Real-time clock timer				(0x01f80080, read-only)
-- Real-time clock scaler program register 	(0x01f80084, write-only)
-- Real-time clock counter program register 	(0x01f80080, write-only)
-
-- General purpose timer 				(0x01f80088, read-only)
-- Real-time clock scaler program register 	(0x01f8008c, write-only)
-- General purpose timer counter prog. register 	(0x01f80088, write-only)
-
-- Timer control register			(0x01f80098, write-only)
-
-1.3 Interrupt controller
-
-The interrupt controller is implemented as in the MEC specification with
-the exception of the interrupt shape register. Since external interrupts
-are not possible, the interrupt shape register is not implemented. The
-only internal interrupts that are generated are the real-time clock, 
-the general purpose timer and UARTs. However, all 15 interrupts
-can be tested via the interrupt force register.
-
-The following registers are implemented:
-
-- Interrupt pending register		       (0x01f80048, read-only)
-- Interrupt mask register		       (0x01f8004c, read-write)
-- Interrupt clear register		       (0x01f80050, write-only)
-- Interrupt force register		       (0x01f80054, read-write)
-
-1.4 Breakpoint and watchpoint register
-
-The breakpoint and watchpoint functions are implemented as in the MEC
-specification. Traps are correctly generated, and the system fault status
-register is updated accordingly. Implemented registers are:
-
-- Debug control register			(0x01f800c0, read-write)
-- Breakpoint register				(0x01f800c4, write-only)
-- Watchpoint register				(0x01f800c8, write-only)
-- System fault status register			(0x01f800a0, read-write)
-- First failing address register		(0x01f800a4, read-write)
-
-
-1.5 Memory interface
-
-The following memory areas are valid for the ERC32 simulator:
-
-0x00000000 - 0x00080000		ROM (512 Kbyte, loaded at start-up)
-0x02000000 - 0x02400000		RAM (4 Mbyte, initialized to 0x0)
-0x01f80000 - 0x01f800ff		MEC registers
-
-Access to unimplemented MEC registers or non-existing memory will result
-in a memory exception trap. However, access to unimplemented MEC registers
-in the area 0x01f80000 - 0x01f80100 will not cause a memory exception trap.
-The written value will be stored in a register and can be read back. It
-does however not affect the function in any way.
-
-The memory configuration register is used to define available memory
-in the system. The fields RSIZ and PSIZ are used to set RAM and ROM
-size, the remaining fields are not used.  NOTE: after reset, the MEC
-is set to decode 4 Kbyte of ROM and 256 Kbyte of RAM. The memory
-configuration register has to be updated to reflect the available memory.
-
-The waitstate configuration register is used to generate waitstates.
-This register must also be updated with the correct configuration after
-reset.
-
-The memory protection scheme is implemented - it is enabled through bit 3
-in the MEC control register.
-
-The following registers are implemented:
-
-- MEC control register (bit 3 only)		(0x01f80000, read-write)
-- Memory control register			(0x01f80010, read-write)
-- Waitstate configuration register		(0x01f80018, read-write)
-- Memory access register 0			(0x01f80020, read-write)
-- Memory access register 1			(0x01f80024, read-write)
-
-1.6 Watchdog
-
-The watchdog is implemented as in the specification. The input clock is
-always the system clock regardless of WDCS bit in mec configuration
-register.
-
-The following registers are implemented:
- 
-- Watchdog program and acknowledge register	(0x01f80060, write-only)
-- Watchdog trap door set register		(0x01f80064, write-only)
-
-1.7 Software reset register
-
-Implemented as in the specification (0x01f800004, write-only).
-
-1.8 Power-down mode
-
-The power-down register (0x01f800008) is implemented as in the specification.
-However, if the simulator event queue is empty, power-down mode is not
-entered since no interrupt would be generated to exit from the mode. A
-Ctrl-C in the simulator window will exit the power-down mode.
-
-1.9 MEC control register
-
-The following bits are implemented in the MEC control register:
-
-Bit	Name	Function
-0	PRD	Power-down mode enable
-1	SWR	Soft reset enable
-3	APR	Access protection enable
-
-1.10 IU and FPU instruction timing.
-
-The simulator provides cycle true simulation for ERC32. The following table
-shows the emulated instruction timing for 90C601E & 90C602E:
-
-Instructions	      Cycles
-
-jmpl, rett		2
-load			2
-store			3
-load double		3
-store double		4
-other integer ops	1
-fabs			2
-fadds			4
-faddd			4
-fcmps			4
-fcmpd			4
-fdivs			20
-fdivd			35
-fmovs			2
-fmuls			5
-fmuld			9
-fnegs			2
-fsqrts			37
-fsqrtd			65
-fsubs			4
-fsubd			4
-fdtoi			7
-fdots			3
-fitos			6
-fitod			6
-fstoi			6
-fstod			2
-
-The parallel operation between the IU and FPU is modelled. This means
-that a FPU instruction will execute in parallel with other instructions as
-long as no data or resource dependency is detected. See the 90C602E data
-sheet for the various types of dependencies. Tracing using the 'trace'
-command will display the current simulator time in the left column. This
-time indicates when the instruction is fetched. If a dependency is detected,
-the following fetch will be delayed until the conflict is resolved.
-
-The load dependency in the 90C601E is also modelled - if the destination
-register of a load instruction is used by the following instruction, an
-idle cycle is inserted.
diff --git a/README.leon2 b/README.leon2
deleted file mode 100644
index c79a4e3..0000000
--- a/README.leon2
+++ /dev/null
@@ -1,53 +0,0 @@
-
-1. LEON2 emulation
-
-The file 'leon2.c' contains a model of simple LEON2 sub-system. It
-contains 16 Mbyte ROM and 16 Mbyte RAM. Standard peripherals
-such as interrupt controller, UART and timer are provided.
-The model can execute leon2 binaries that do not require an
-MMU.
-
-To start sis in Leon2 mode, add the -leon2 switch. In gdb,
-use 'target sim -leon2' .
-
-1.1 UART
-
-One LEON2 UART is emulated, and is located at address 0x80000070.
-The following registers are implemented:
-
-- UART RX and TX register	(0x80000070)
-- UART status register		(0x80000074)
-
-The UART generates interrupt 3.
-
-1.2 Timer unit
-
-The LEON2 timer unit is emulated and located at address 0x80000040.
-It is configured with two timers and separate interrupts (8 and 9).
-The scaler is configured to 16 bits, while the counters are 32 bits.
-
-1.3 Interrupt controller
-
-The interrupt controller is implemented as described in the
-LEON2 IP manual, with the exception of the interrupt level register.
-Secondary interrupts are not supported. The registers are located
-at address 0x80000090.
-
-1.5 Memory interface
-
-The following memory areas are valid for the Leon3 simulator:
-
-0x00000000 - 0x01000000		ROM (16 Mbyte, loaded at start-up)
-0x40000000 - 0x41000000		RAM (16 Mbyte, loaded at start-up)
-0x80000000 - 0x81000000		APB bus, including plug&play
-0xFFFFF000 - 0xFFFFFFFF		AHB plug&play area
-
-Access to non-existing memory will result in a memory exception trap.
-
-1.8 Power-down mode
-
-The Leon2 power-down register (0x80000018) is supported. When power-down is
-entered, time is skipped forward until the next event in the event queue.
-However, if the simulator event queue is empty, power-down mode is not
-entered since no interrupt would be generated to exit from the mode. A
-Ctrl-C in the simulator window will exit the power-down mode.
diff --git a/README.leon3 b/README.leon3
deleted file mode 100644
index 80fff5f..0000000
--- a/README.leon3
+++ /dev/null
@@ -1,59 +0,0 @@
-
-1. LEON3 emulation
-
-The file 'leon3.c' contains a model of simple LEON3 sub-system. It
-contains 16 Mbyte ROM and 16 Mbyte RAM. Standard peripherals
-such as interrupt controller, UART and timer are provided.
-The model can execute leon3 binaries that do not require an
-MMU.
-
-To start sis in Leon3 mode, add the -leon3 switch. In gdb,
-use 'target sim -leon3' .
-
-1.1 Multiprocessing
-
-It is possible to emulate an SMP leon3 system with up to 4 cores.
-Add the switch -m <n> when starting the simulator, where n can be 
-2 - 4. The cores are simulated in a round-robin fashion with a time-
-slice of 50 clocks. Shorter or longer time-slices can be selected
-using -d <clocks>/
-
-1.2 UART
-
-The UART emulates an APBUART and is located at address 0x80000100.
-The following registers are implemented:
-
-- UART RX and TX register	(0x80000100)
-- UART status register		(0x80000104)
-
-The UART generates interrupt 3.
-
-1.3 Timer unit (GPTIMER)
-
-The GPTIMER programmable counter is emulated and located at
-address 0x80000300. It is configured with two timers and separate
-interrupts (8 and 9).
-
-1.4 Interrupt controller
-
-The IRQMP interrupt controller is implemented as described in the
-GRLIB IP manual, with the exception of the interrupt level register.
-Extended interrupts are not supported. The registers are located
-at address 0x80000200.
-
-1.5 Memory interface
-
-The following memory areas are valid for the Leon3 simulator:
-
-0x00000000 - 0x01000000		ROM (16 Mbyte, loaded at start-up)
-0x40000000 - 0x41000000		RAM (16 Mbyte, loaded at start-up)
-0x80000000 - 0x81000000		APB bus, including plug&play
-0xFFFFF000 - 0xFFFFFFFF		AHB plug&play area
-
-Access to non-existing memory will result in a memory exception trap.
-
-1.6 Power-down mode
-
-The Leon3 power-down feature (%asr19) is supported. When power-down is
-entered, time is skipped forward until the next event in the event queue.
-Ctrl-C in the simulator window will exit the power-down mode.
diff --git a/README.riscv b/README.riscv
deleted file mode 100644
index 49af929..0000000
--- a/README.riscv
+++ /dev/null
@@ -1,71 +0,0 @@
-
-1. RISC-V emulation
-
-The file 'riscv.h' contains a model of RISC-V RV32IMACFD cpu. It
-uses the same GRLIB peripherals as the leon3 cpu, including
-the interrupt controller, UART and timers. Single- and double-precision floats
-are supported as defined in the F/D extension with the exeption that the
-rounding mode is fixed to round-to-nearest.
-
-
-1.1 Multiprocessing
-
-It is possible to emulate an SMP RISC-V system with up to 4 cores.
-Add the switch -m <n> when starting the simulator, where n can be 
-2 - 4. The cores are simulated in a round-robin fashion with a time-
-slice of 50 clocks. Shorter or longer time-slices can be selected
-using -d <clocks>/
-
-1.2 UART
-
-The UART emulates an APBUART and is located at address 0x80000100.
-The following registers are implemented:
-
-- UART RX and TX register	(0x80000100)
-- UART status register		(0x80000104)
-
-The UART generates interrupt 3.
-
-1.3 Timer unit (GPTIMER)
-
-The GPTIMER programmable counter is emulated and located at
-address 0x80000300. It is configured with two timers and using IRQMP
-interrupts 8 and 9.
-
-1.4 Interrupt controller
-
-The IRQMP interrupt controller is implemented as described in the
-GRLIB IP manual, with the exception of the interrupt level register.
-Extended interrupts are not supported. The registers are located
-at address 0x80000200.
-
-The IRQMP interrupts (1 - 15) are mapped in RISC-V external interrupts 17 - 31.
-
-1.5 Memory interface
-
-The following memory areas are valid for the Leon3 simulator:
-
-0x00000000 - 0x01000000		ROM (16 Mbyte, loaded at start-up)
-0x40000000 - 0x41000000		RAM (16 Mbyte, loaded at start-up)
-0x80000000 - 0x81000000		APB bus, including plug&play
-0xFFFFF000 - 0xFFFFFFFF		AHB plug&play area
-
-Access to non-existing memory will result in a memory exception trap.
-
-1.6 Power-down mode
-
-The RISC-V power-down feature (WFI) is supported. When power-down is
-entered, time is skipped forward until the next event in the event queue.
-Ctrl-C in the simulator window will exit the power-down mode.
-
- 1.7 Code coverage
-
-Code coverage is currently only supported for 32-bit instructions, i.e.
-the C-extension can not be used when code coverage is measured.
-
-1.8 RISC-V 64-bit timer
-
-The standard RISC-V 64-bit timer is provided and can be read through the time and
-timeh CSR. The timer does not generare any interrupt and the timecmp register is not
-implemented.
-
diff --git a/README.sis b/README.sis
deleted file mode 100644
index ffcc591..0000000
--- a/README.sis
+++ /dev/null
@@ -1,348 +0,0 @@
-
-SIS - Sparc Instruction Simulator README file  (v2.9, 16-01-2019)
--------------------------------------------------------------------
-
-1. Introduction
-
-The SIS is a SPARC V7/V8 architecture simulator. It consist of two parts,
-the simulator core and a user defined memory module. The simulator
-core executes the instructions while the memory module emulates memory
-and peripherals. As of version 2.9, sis can also emulate a RISC-V 
-RV32IMACF processor.
-
-2. Usage
-
-The simulator is started as follows:
-
-sis [-leon2] [-leon3] [-uart1 uart_device1] [-uart2 uart_device2]
-    [-m cores] [-d clocks] [-nfp] [-freq freq] [-c batch_file] [-v]
-    [-r] [-tlim time] [-cov] [-gdb] [-port n] [files]
-
-By default, SIS emulates an ERC32 system. The -leon2 switch enables
-LEON2 emulation, while the -leon3 switch enables emulation of a
-LEON3 SOC system. When compiled for RISC-V (--target=riscv-rtems5),
-the simulator emulates a RISC-V RV32IMACF cpu connected to GRLIB
-IP cores.
-
-The emulated console uart is connected to stdin/stdout. The -uart[1,2]
-switch can be used to connect the uarts to other devices.
-
-The '-nfp' will disable the simulated FPU, so each FPU instruction will
-generate a FPU disabled trap. The '-freq' switch can be used to define
-which "frequency" the simulator runs at. This is used by the 'perf'
-command to calculated the MIPS figure for a particular configuration.
-The frequency must be an integer indicating the frequency in MHz.
-
-The -c option indicates that sis commands should be read from 'batch_file'
-at startup.
-
--v sets the debug level to 1, to provide some diagnostic messages.
-
--r starts execution immediately without an interactive shell. This is useful
-for automated testing of large number of binaries.
-
--tlim can be used together with -r to limit the amount of simulated time that
-the simulator runs for before exiting. The following units are recognized:
-us, ms and s. To limit simulated time to 100 seconds, it should thus be
-started with -r -tlim 100 s .
-
--m sets the number of cores (2 - 4) in a leon3 or RISC-V multi-processor system.
-
--d set the the number of clocks in each time-slice for multi-processor
-simulation. Default is 50, set lower for higher accuracy.
-
--gdb will start a gdb server, listening on port 1234. An alternative port can
-be specified with -port <nn>.
-
-Files to be loaded must be in one of the formats supported by the BFD library.
-This inlude elf, a.out, srec and binary. On start-up, the files will be
-loaded into the simulated memory.
-
-3. Internal commands
-
-Below is the description of commands that are recognized by the simulator.
-The command-line is parsed using GNU readline. A command
-history of 64 commands is maintained. Use the up/down arrows to recall
-previous commands. For more details, see the readline documentation.
-
-* List of commands:
-
-batch <file>
-
-Execute a batch file of SIS commands.
-
-+bp <address>
-break <address>
-
-Adds an breakpoint at address <address>.
-
-bp
-
-Prints all breakpoints
-
--bp <num>
-delete
-
-Deletes breakpoint <num>. Use 'bp' or break to see which number is assigned
-to the breakpoints.
-
-csr
-
-Show RISC-V CSR registers
-
-cont [inst_count]
-
-Continue execution at present position, optionally for [inst_count] 
-instructions.
-
-dis [addr] [count]
-
-Disassemble [count] instructions at address [addr]. Default values for
-count is 16 and addr is the present address.
-
-echo <string>
-
-Print <string> to the simulator window.
-
-float
-
-Prints the FPU registers
-
-gdb [port]
-
-Starts the gdb server interface. Default port is 1234, but can be overriden using
-the [port] argument. gdb should be started with 'tar extended-remote localhost:1234'.
-
-go <address> [inst_count]
-
-The go command will set pc to <address> and npc to <address> + 4, and start
-execution. If inst_count is given, execution will stop after the specified
-number of instructions.
-
-help
-
-Print a small help menu for the SIS commands.
-
-hist [trace_length]
-
-Enable the instruction trace buffer. The 'trace_length' last executed 
-instructions will be placed in the trace buffer. A 'hist' command without 
-a trace_length will display the trace buffer. Specifying a zero trace 
-length will disable the trace buffer.
-
-load  <file_name>
-
-Loads a file into simulator memory. 
-
-mem [addr] [count]
-
-Display memory at [addr] for [count] bytes. Same default values as above.
-
-quit
-
-Exits the simulator.
-
-perf [reset]
-
-The 'perf' command will display various execution statistics. A 'perf reset' 
-command will reset the statistics. This can be used if statistics shall 
-be calculated only over a part of the program. The 'run' and 'reset' 
-command also resets the statistic information.
-
-reg [reg_name] [value]
-
-Prints and sets the IU registers. 'reg' without parameters prints the IU
-registers. 'reg [reg_name] [value]' sets the corresponding register to
-[value]. Valid register names are psr, tbr, wim, y, g1-g7, o0-o7 and
-l0-l7.
-
-reset
-
-Performs a power-on reset. This command is equal to 'run 0'.
-
-run [inst_count]
-
-Resets the simulator and starts execution from address 0. If an instruction
-count is given (inst_count), the simulator will stop after the specified
-number of instructions. The event queue is emptied but any set breakpoints
-remain.
-
-step
-
-Equal to 'trace 1'
-
-sym
-
-List symbols and corresponding addresses in the loaded program.
-
-tra [inst_count]
-
-Starts the simulator at the present position and prints each instruction
-it executes. If an instruction count is given (inst_count), the simulator
-will stop after the specified number of instructions.
-
-wmem [addr] [data]
-
-Writes [data] to memory at [addr]. Data is written as a 32-bit word.
-
-wp
-
-Prints all watchpoints
-
-+wpr <address>
-
-Adds an read watchpoint at address <address>.
-
--wpr <num>
-
-Deletes read watchpoint <num>. Use 'wp' to see which number is assigned to
-the watchpoints.
-
-+wpw <address>
-watch <address>
-
-Adds an write watchpoint at address <address>.
-
--wpw <num>
-
-Deletes write watchpoint <num>. Use 'wp' to see which number is assigned to
-the watchpoints.
-
-Typing a 'Ctrl-C' will interrupt a running simulator.
-
-Short forms of the commands are allowed, e.g 'c' 'co' or 'con' are all
-interpreted as 'cont'.
-
-4. Using SIS with GDB
-
-To start the simulator inside gdb, use:
-
-target sim [options]
-
-The following options are supported:
-
- -leon2         Emulate a LEON2 system
-
- -leon3         Emulate a LEON3 system
-
- -nfp           Disable FPU. FPops will cause an FPU disabled trap.
-
- -freq <f>      Set the simulated "system clock" to <f> MHz.
-
- -v             Verbose mode.
-
- -nogdb         Disable GDB breakpoint handling (see below)
-
-To start debugging a program type 'load <program>' and debug as
-usual.
-
-The native simulator commands can be reached using the GDB 'sim'
-command:
-
-sim <sis_command>
-
-Direct simulator commands during a GDB session must be issued
-with care not to disturb GDB's operation ...
-
-A program can be restarted in GDB by first issuing the load command,
-followed by run.
-
-sis can also be connected to gdb when started standalone, using the gdb remote
-insterface. Either start sis with -gdb, or issue the 'gdb' command inside sis,
-and connect gdb with 'target extended-remote localhost:1234'. sis will operate
-identical with built-in or remote interfaces.
-
-4.1 GDB breakpoint handling
-
-GDB inserts breakpoint in the form of the 'ta 1' instruction. The
-GDB-integrated simulator will therefore recognize the breakpoint
-instruction and return control to GDB. If the application uses
-'ta 1', the breakpoint detection can be disabled with the -nogdb
-switch. In this case however, GDB breakpoints will not work.
-
-
-5. Simulator core
-
-In ERC32 mode, SIS emulates the behavior of the 90C601E and 90C602E
-sparc IU and FPU from Matra MHS. These are roughly equivalent to the
-Cypress C601 and C602. The simulator is reasonably cycle accurate, a simulator
-time is maintained and incremented according the IU and FPU instruction timing.
-The parallel execution between the IU and FPU is modelled, as well as
-stalls due to operand dependencies (FPU).
-
-In Leon2/3 mode, the core emulates the Leon2/3 SPARC V8 core from
-Gaisler Research. All SPARC V8 instructions are supported but
-emulation is not fully cycle-true as the cache is not emulated.
-
-In RISC-V mode, a RV32IMACF profile is emulated. No cache or MMU
-are modelled.
-
-6. Memory module
-
-The ERC32 memory module (erc32.c) emulates the functions of memory and
-the MEC asic developed for the 90C601/2. It includes the following functions:
-
-* UART A & B
-* Real-time clock
-* General purpose timer
-* Interrupt controller
-* Breakpoint register
-* Watchpoint register
-* 16 Mbyte ROM
-* 16 Mbyte RAM
-
-See README.erc32 on how the MEC functions are emulated.
-
-The Leon2 memory module (leon2.c) emulates on-chip peripherals and
-external memory for a simple Leon2 system. The modules includes the
-following functions:
-
-* AHB and APB buses
-* One UART
-* Interrupt controller
-* Timer unit with two timers
-* PROM/SRAM memory controller
-* 16 Mbyte PROM, 16 Mbyte SRAM
-
-See README.leon2 for further details on Leon2 emulation.
-
-The Leon3 memory module (leon3.c) emulates on-chip peripherals and
-external memory for a simple Leon3 system. The modules includes the
-following functions:
-
-* AHB and APB buses with plug&play
-* UART (APBUART)
-* Interrupt controller (IRQMP)
-* Timer unit with two timers (GPTIMER)
-* PROM/SRAM memory controller (SRCTRL)
-* 16 Mbyte PROM, 16 Mbyte SRAM
-
-The RISC-V cpu uses the same peripherals as Leon3, but implements the
-RISC-V instructions set instead of SPARC. See README.riscv for further
-details.
-
-7. FPU implementation
-
-The simulator maps floating-point operations on the hosts floating point
-capabilities. This means that accuracy and generation of IEEE exceptions is
-host dependent.
-
-8. Code coverage
-
-Code coverage data will be produce if sis is started with the -cov switch.
-The coverage data will be stored in a file name same as the file used with 
-the load command, appended with .cov. For instance, if sis is run with
-hello.exe, the coverage data will be stored in hello.exe.cov. The coverage
-file is created when the simulator is exited.
-
-The coverage file data consists of a starting address, and a number of
-coverage points indicating incremental 32-bit word addresses:
-
-0x40000000  0 0 0 19 9 1 1 1 1 0 .....
-
-The coverage points are in hexadecimal format. Bit 0 (lsb) indicates an
-executed instruction. Bit 3 indicates taken branch and bit 4 indicates
-an untaken branch. Bits 2 and 3 are currently not used.
-
-For RISC-V, code coverage is only supported for 32-bit instructions, i.e.
-the C-extension can not be used when code coverage is measured.
diff --git a/erc32.c b/erc32.c
index 3cabafd..ff95dc6 100644
--- a/erc32.c
+++ b/erc32.c
@@ -59,9 +59,6 @@
 #define MEC_IOCR	0x014
 #define MEC_WCR		0x018
 
-#define MEC_MAR0  	0x020
-#define MEC_MAR1  	0x024
-
 #define MEC_SSA1 	0x020
 #define MEC_SEA1 	0x024
 #define MEC_SSA2 	0x028
@@ -83,12 +80,8 @@
 #define MEC_SFSR	0x0A0
 #define MEC_FFAR	0x0A4
 #define MEC_ERSR	0x0B0
-#define MEC_DBG		0x0C0
 #define MEC_TCR		0x0D0
 
-#define MEC_BRK		0x0C4
-#define MEC_WPR		0x0C8
-
 #define MEC_UARTA	0x0E0
 #define MEC_UARTB	0x0E4
 #define MEC_UART_CTRL	0x0E8
diff --git a/sis.info b/sis.info
index 10f23dc..a192d76 100644
--- a/sis.info
+++ b/sis.info
@@ -1,6 +1,6 @@
 This is sis.info, produced by makeinfo version 6.5 from sis.texi.
 
-This manual is for SIS (version 2.14, 9 April 2019).
+This manual is for SIS (version 2.14, 21 May 2019).
 
    Copyright (C) 2019 Free Software Foundation, Inc.
 
@@ -21,7 +21,7 @@ File: sis.info,  Node: Top,  Next: Introduction,  Up: (dir)
 SIS
 ***
 
-This manual is for SIS (version 2.14, 9 April 2019).
+This manual is for SIS (version 2.14, 21 May 2019).
 
 * Menu:
 
@@ -29,6 +29,10 @@ This manual is for SIS (version 2.14, 9 April 2019).
 * Invoking sis::
 * Commands ::
 * Emulated Systems ::
+* Multi-processing ::
+* Interfacing to GDB ::
+* Code coverage ::
+* Building SIS ::
 * GNU Free Documentation License::
 * Index::
 
@@ -38,10 +42,27 @@ File: sis.info,  Node: Introduction,  Next: Invoking sis,  Prev: Top,  Up: Top
 1 Introduction
 **************
 
-SIS is a SPARC V7/V8 and RISC-V RV32IMACF architecture simulator.  It
-consist of two parts, the simulator core and a user defined memory
-module.  The simulator core executes the instructions while the memory
-module emulates memory and peripherals.
+SIS is a SPARC V7/V8 and RISC-V RV32IMACFD architecture simulator.  It
+consist of three main parts: an event-based simulator core, a cpu
+(SPARC/RISCV) emulation module and system-specific memory and peripheral
+modules.
+
+   SIS can emulate four specific systems:
+
+'ERC32'
+     ERC32 SPARC V7 processor
+
+'LEON2'
+     LEON2 SPARC V8 processor
+
+'LEON3'
+     LEON3 SPARC V8 processor
+
+'RISC-V'
+     RISC-V (RV32IMACFD) processor
+
+   The LEON3 and RISC-V emulation also supports SMP with up to four
+processor cores.
 
 
 File: sis.info,  Node: Invoking sis,  Next: Commands,  Prev: Introduction,  Up: Top
@@ -98,7 +119,7 @@ The simulator is started as follows:
      useful for automated testing.
 
 '-riscv'
-     Emulate a RISC-V RV32IMACF processor
+     Emulate a RISC-V RV32IMACFD processor
 
 '-tlim DELAY'
      Used together with -R to limit the amount of simulated time that
@@ -259,7 +280,7 @@ previous commands.  For more details, see the readline documentation.
 all interpreted as 'cont'.
 
 
-File: sis.info,  Node: Emulated Systems,  Next: GNU Free Documentation License,  Prev: Commands,  Up: Top
+File: sis.info,  Node: Emulated Systems,  Next: Multi-processing,  Prev: Commands,  Up: Top
 
 4 Emulated Systems
 ******************
@@ -369,18 +390,314 @@ UART A is by default connected to the console, while UART B is disabled.
 Both UARTs can be connected to any file/device using the -uart1 and
 -uart2 options at start-up.  The following registers are implemented:
 
-Register                    Address
---------------------------------------
-UART A RX and TX register   0x01f800e0
-UART B RX and TX register   0x01f800e4
-UART status register        0x01f800e8
+Register                                    Address
+------------------------------------------------------
+UART A RX and TX register                   0x01f800e0
+UART B RX and TX register                   0x01f800e4
+UART status register                        0x01f800e8
 
    The UARTs generate interrupt 4 and 5 after each received or
 transmitted character.  The error interrupt is generated if overflow
 occurs - other errors cannot occur.
 
+4.1.3 Real-time clock and general purpose timer A
+-------------------------------------------------
+
+The following registers are implemented:
+
+Register                                    Address
+------------------------------------------------------
+Real-time clock timer                       0x01f80080
+Real-time clock scaler program register     0x01f80084
+Real-time clock counter program register    0x01f80080
+General purpose timer                       0x01f80088
+Real-time clock scaler program register     0x01f8008c
+General purpose timer counter register      0x01f80088
+Timer control register                      0x01f80098
+
+4.1.4 Interrupt controller
+--------------------------
+
+The interrupt controller is implemented as in the MEC specification with
+the exception of the interrupt shape register.  Since external
+interrupts are not possible, the interrupt shape register is not
+implemented.  The only internal interrupts that are generated are the
+real-time clock, the general purpose timer and UARTs.  However, all 15
+interrupts can be tested via the interrupt force register.
+
+   The following registers are implemented:
+
+Register                                    Address
+------------------------------------------------------
+Interrupt pending register                  0x01f80048
+Interrupt mask register                     0x01f8004c
+Interrupt clear register                    0x01f80050
+Interrupt force register                    0x01f80054
+
+4.1.5 System fault status registers
+-----------------------------------
+
+The system fault status register and fist failing address register are
+implemented and updated accordingly.  Implemented registers are:
+
+Register                                    Address
+------------------------------------------------------
+System fault status register                0x01f800a0
+First failing address register              0x01f800a4
+
+4.1.6 Memory interface
+----------------------
+
+The following memory areas are valid for the ERC32 simulator:
+
+Register                                    Address
+------------------------------------------------------------------
+0x00000000 - 0x01000000                     ROM (16 Mbyte)
+0x02000000 - 0x03000000                     RAM (16 Mbyte)
+0x01f80000 - 0x01f800ff                     MEC registers
+
+   Access to unimplemented MEC registers or non-existing memory will
+result in a memory exception trap.
+
+   The memory configuration register is used to define available memory
+in the system.  The fields RSIZ and PSIZ are used to set RAM and ROM
+size, the remaining fields are not used.  NOTE: after reset, the MEC is
+set to decode 4 Kbyte of ROM and 256 Kbyte of RAM. The memory
+configuration register has to be updated to reflect the available
+memory.
+
+   The waitstate configuration register is used to generate waitstates.
+This register must also be updated with the correct configuration after
+reset.
+
+   The memory protection scheme is implemented - it is enabled through
+bit 3 in the MEC control register.
+
+   The following registers are implemented:
+
+Register                                    Address
+-------------------------------------------------------------
+MEC control register                        0x01f80000
+Memory control register                     0x01f80010
+Waitstate configuration register            0x01f80018
+Memory access register 0                    0x01f80020
+Memory access register 1                    0x01f80024
+
+4.1.7 Watchdog
+--------------
+
+The watchdog is implemented as in the specification.  The input clock is
+always the system clock regardless of WDCS bit in MEC configuration
+register.
+
+   The following registers are implemented:
+
+Register                                    Address
+-------------------------------------------------------------
+Watchdog program/acknowledge register       0x01f80060
+Watchdog trap door set register             0x01f80064
+
+4.1.8 Software reset register
+-----------------------------
+
+Implemented as in the specification (0x01f800004, write-only).
+
+4.1.9 Power-down mode
+---------------------
+
+The power-down register (0x01f800008) is implemented as in the
+specification.  During power-down, the simulator skips time until next
+event in the event queue.  Ctrl-C in the simulator window will exit the
+power-down mode.
+
+4.1.10 MEC control register
+---------------------------
+
+The following bits are implemented in the MEC control register:
+
+Bit     Name   Function
+-----------------------------------------------
+0       PRD    Power-down mode enable
+1       SWR    Soft reset enable
+2       APR    Access protection enable
+
+4.2 LEON2 emulation
+===================
+
+In LEON2 mode, SIS emulates a LEON2 system as defined in the LEON2 IP
+manual.  The emulated system includes the LEON2 standard peripherals, 16
+Mbyte ROM and 16 Mbyte RAM. The SPARC emulation supports an FPU but not
+the LEON2 MMU.
+
+   To start sis in LEON2 mode, use the -leon2 switch.
+
+4.2.1 LEON2 peripherals
+-----------------------
+
+SIS emulates one LEON2 UART, the interrupt controller and the timer
+unit.  The interrupt controller is implemented as described in the LEON2
+IP manual, with the exception of the interrupt level register.
+Secondary interrupts are not supported.  The timer unit is configured
+with two timers and separate interrupts (8 and 9).  The scaler is
+configured to 16 bits, while the counters are 32 bits.  The UART
+generates interrupt 3.
+
+4.2.2 Memory interface
+----------------------
+
+The following memory areas are valid for LEON2:
+
+Address                                     Type
+------------------------------------------------------------------
+0x00000000 - 0x01000000                     ROM (16 Mbyte)
+0x40000000 - 0x41000000                     RAM (16 Mbyte)
+0x80000000 - 0x80000100                     APB bus
+
+   Access to non-existing memory will result in a memory exception trap.
+
+4.2.3 Power-down mode
+---------------------
+
+The LEON2 power-down register (0x80000018) is supported.  When
+power-down is entered, time is skipped forward until the next event in
+the event queue.  A Ctrl-C in the simulator window will exit the
+power-down mode.
+
+4.3 LEON3 emulation
+===================
+
+In LEON3 mode, SIS emulates a LEON3 system as defined in the GRLIP IP
+manual.  The emulated system includes the standard peripherals such as
+APBUART, GPTIMER, IRQMP and SRCTRL. The emulated system includes 16
+Mbyte ROM and 16 Mbyte RAM. The SPARC emulation supports an FPU but not
+the LEON3 MMU.
+
+   To start sis in LEON3 mode, use the -leon3 switch.
+
+4.3.1 LEON3 peripherals
+-----------------------
+
+The following IP cores from GRLIB are emulated in LEON3 mode:
+
+IP Core                     Address        Interrupt
+-------------------------------------------------------
+APBMAST                     0x80000000     -
+APBUART                     0x80000100     3
+IRQMP                       0x80000200     -
+GPTIMER                     0x80000300     8, 9
+
+4.3.2 Memory interface
+----------------------
+
+The following memory areas are valid for LEON3:
+
+Address                                     Type
+------------------------------------------------------------------
+0x00000000 - 0x01000000                     ROM (16 Mbyte)
+0x40000000 - 0x41000000                     RAM (16 Mbyte)
+0x80000000 - 0x81000000                     APB bus
+0xFFFFF000 - 0xFFFFFFFF                     AHB plug&play
+
+   Access to non-existing memory will result in a memory exception trap.
+
+4.3.3 Power-down mode
+---------------------
+
+The LEON3 power-down register (%ars19) is supported.  When power-down is
+entered, time is skipped forward until the next event in the event
+queue.  A Ctrl-C in the simulator window will exit the power-down mode.
+
+4.4 RISC-V emulation
+====================
+
+In RISC-V mode, SIS emulates a RV32IMACFD processor as defined in the
+RISC-V specification 1.9.  The RISC-V procssor is attached to an
+identical GRLIB sub-system as when LEON3 is emulated.
+
+   To start sis in RISC-V mode, use the -riscv switch.
+
+4.4.1 Power-down mode
+---------------------
+
+The RISC-V power-down feature (WFI) is supported.  When power-down is
+entered, time is skipped forward until the next event in the event
+queue.  Ctrl-C in the simulator window will exit the power-down mode.
+
+4.4.2 Code coverage
+-------------------
+
+Code coverage is currently only supported for 32-bit instructions, i.e.
+the C-extension can not be used when code coverage is measured.
+
+4.4.3 RISC-V 64-bit timer
+-------------------------
+
+The standard RISC-V 64-bit timer is provided and can be read through the
+time and timeh CSR. The timer does not generare any interrupt and the
+timecmp register is not implemented.
+
+
+File: sis.info,  Node: Multi-processing,  Next: Interfacing to GDB,  Prev: Emulated Systems,  Up: Top
+
+5 Multi-processing
+******************
+
+When emulating a LEON3 or RISC-V processor, SIS can emulate up to four
+cores in the target system (SMP). The cores are simulated in a
+round-robin fashion with a time-slice of 50 clocks.  Shorter or longer
+time-slices can be selected using -d <clocks>.
+
+   To start SIS with SMP, use the switch -m <n> when starting the
+simulator where n can be 2 - 4.
+
+
+File: sis.info,  Node: Interfacing to GDB,  Next: Code coverage,  Prev: Multi-processing,  Up: Top
+
+6 Interfacing to GDB
+********************
+
+SIS can be connected to gdb through a network socket using the gdb
+remote interface.  Either start SIS with -gdb, or issue the 'gdb'
+command inside SIS, and connect gdb with 'target extended-remote
+localhost:1234'.  The port can be changed using the -port option.
+
+
+File: sis.info,  Node: Code coverage,  Next: Building SIS,  Prev: Interfacing to GDB,  Up: Top
+
+7 Code coverage
+***************
+
+Code coverage data will be produce if sis is started with the -cov
+switch.  The coverage data will be stored in a file name same as the
+file used with the load command, appended with .cov.  For instance, if
+sis is run with hello.exe, the coverage data will be stored in
+hello.exe.cov.  The coverage file is created when the simulator is
+exited.
+
+   The coverage file data consists of a starting address, and a number
+of coverage points indicating incremental 32-bit word addresses:
+
+   0x40000000 0 0 0 19 9 1 1 1 1 0 .....
+
+   The coverage points are in hexadecimal format.  Bit 0 (lsb) indicates
+an executed instruction.  Bit 3 indicates taken branch and bit 4
+indicates an untaken branch.  Bits 2 and 3 are currently not used.
+
+   For RISC-V, code coverage is only supported for 32-bit instructions,
+i.e.  the C-extension can not be used when code coverage is measured.
+
+
+File: sis.info,  Node: Building SIS,  Next: GNU Free Documentation License,  Prev: Code coverage,  Up: Top
+
+8 Building SIS
+**************
+
+SIS uses the GNU autoconf system, and can simply be build using
+'./configure' followed by 'make'.  To build a PDF version of the manual,
+do 'make sis.pdf'.
+
 
-File: sis.info,  Node: GNU Free Documentation License,  Next: Index,  Prev: Emulated Systems,  Up: Top
+File: sis.info,  Node: GNU Free Documentation License,  Next: Index,  Prev: Building SIS,  Up: Top
 
 Appendix A GNU Free Documentation License
 *****************************************
@@ -870,21 +1187,29 @@ Index
 
 * Menu:
 
+* Building SIS:                          Building SIS.          (line 6)
+* Code coverage:                         Code coverage.         (line 6)
 * Commands:                              Commands.              (line 6)
 * Emulated Systems:                      Emulated Systems.      (line 6)
+* Interfacing to GDB:                    Interfacing to GDB.    (line 6)
 * Introduction:                          Introduction.          (line 6)
 * invoking sis:                          Invoking sis.          (line 6)
+* Multi-processing:                      Multi-processing.      (line 6)
 * sis:                                   Invoking sis.          (line 6)
 
 
 
 Tag Table:
-Node: Top697
-Node: Introduction948
-Node: Invoking sis1310
-Node: Commands3362
-Node: Emulated Systems7466
-Node: GNU Free Documentation License11416
-Node: Index36564
+Node: Top696
+Node: Introduction1029
+Node: Invoking sis1653
+Node: Commands3706
+Node: Emulated Systems7810
+Node: Multi-processing20477
+Node: Interfacing to GDB20973
+Node: Code coverage21383
+Node: Building SIS22388
+Node: GNU Free Documentation License22686
+Node: Index47830
 
 End Tag Table
diff --git a/sis.texi b/sis.texi
index 26c78ff..bbf6f4e 100644
--- a/sis.texi
+++ b/sis.texi
@@ -49,6 +49,10 @@ This manual is for SIS (version @value{VERSION}, @value{UPDATED}).
 * Invoking sis::
 * Commands ::
 * Emulated Systems ::
+* Multi-processing ::
+* Interfacing to GDB ::
+* Code coverage ::
+* Building SIS ::
 * GNU Free Documentation License::
 * Index::
 @end menu
@@ -57,11 +61,30 @@ This manual is for SIS (version @value{VERSION}, @value{UPDATED}).
 @chapter Introduction
 @cindex Introduction
 
-SIS is a SPARC V7/V8 and RISC-V RV32IMACF architecture simulator.
-It consist of two parts,
-the simulator core and a user defined memory module. The simulator
-core executes the instructions while the memory module emulates memory
-and peripherals.
+SIS is a SPARC V7/V8 and RISC-V RV32IMACFD architecture simulator.
+It consist of three main parts: an event-based simulator core,
+a cpu (SPARC/RISCV) emulation module and system-specific memory and
+peripheral modules.
+
+SIS can emulate four specific systems:
+
+
+@table @code
+@item ERC32
+ERC32 SPARC V7 processor
+
+@item LEON2
+LEON2 SPARC V8 processor
+
+@item LEON3
+LEON3 SPARC V8 processor
+
+@item RISC-V
+RISC-V (RV32IMACFD) processor
+
+@end table
+
+The LEON3 and RISC-V emulation also supports SMP with up to four processor cores.
 
 @node Invoking sis
 @chapter Invoking sis
@@ -120,7 +143,7 @@ Start execution immediately without an interactive shell. This is useful
 for automated testing.
 
 @item -riscv
-Emulate a RISC-V RV32IMACF processor
+Emulate a RISC-V RV32IMACFD processor
 
 @item -tlim @var{delay}
 Used together with @var{-r} to limit the amount of simulated time that
@@ -384,7 +407,7 @@ idle cycle is inserted.
 @subsection UART A and B
 UART A is by default connected to the console, while UART B is disabled. Both UARTs can be connected to any file/device using the -uart1 and -uart2 options at start-up. The following registers are implemented:
 
-@multitable {UART A RX and TX register} {Address}
+@multitable {Very long text so that we avoid wrapping } {Address}
 @headitem Register @tab Address
 @item UART A RX and TX register	@tab 0x01f800e0
 @item UART B RX and TX register	@tab 0x01f800e4
@@ -395,6 +418,276 @@ The UARTs generate interrupt 4 and 5 after each received or transmitted
 character.  The error interrupt is generated if overflow occurs - other
 errors cannot occur.
 
+@subsection Real-time clock and general purpose timer A
+
+The following registers are implemented:
+
+@multitable {Very long text so that we avoid wrapping } {Address}
+@headitem Register @tab Address
+@item Real-time clock timer @tab 0x01f80080
+@item Real-time clock scaler program register @tab 0x01f80084
+@item Real-time clock counter program register @tab 0x01f80080
+@item General purpose timer @tab 0x01f80088
+@item Real-time clock scaler program register @tab 0x01f8008c
+@item General purpose timer counter register @tab 0x01f80088
+@item Timer control register @tab 0x01f80098
+@end multitable
+
+@subsection Interrupt controller
+
+The interrupt controller is implemented as in the MEC specification with
+the exception of the interrupt shape register. Since external interrupts
+are not possible, the interrupt shape register is not implemented. The
+only internal interrupts that are generated are the real-time clock, 
+the general purpose timer and UARTs. However, all 15 interrupts
+can be tested via the interrupt force register.
+
+The following registers are implemented:
+
+@multitable {Very long text so that we avoid wrapping } {Address}
+@headitem Register @tab Address
+@item Interrupt pending register @tab 0x01f80048
+@item Interrupt mask register @tab 0x01f8004c
+@item Interrupt clear register @tab 0x01f80050
+@item Interrupt force register @tab 0x01f80054
+@end multitable
+
+@subsection System fault status registers
+
+The system fault status register and fist failing address register are implemented and updated accordingly. Implemented registers are:
+
+@multitable {Very long text so that we avoid wrapping } {Address}
+@headitem Register @tab Address
+@item System fault status register @tab 0x01f800a0
+@item First failing address register @tab 0x01f800a4
+@end multitable
+
+@subsection Memory interface
+
+The following memory areas are valid for the ERC32 simulator:
+
+@multitable {Very long text so that we avoid wrapping } {A long long Address}
+@headitem Register @tab Address
+@item 0x00000000 - 0x01000000 @tab ROM (16 Mbyte)
+@item 0x02000000 - 0x03000000 @tab RAM (16 Mbyte)
+@item 0x01f80000 - 0x01f800ff @tab MEC registers
+@end multitable
+
+Access to unimplemented MEC registers or non-existing memory will result
+in a memory exception trap. 
+
+The memory configuration register is used to define available memory
+in the system. The fields RSIZ and PSIZ are used to set RAM and ROM
+size, the remaining fields are not used.  NOTE: after reset, the MEC
+is set to decode 4 Kbyte of ROM and 256 Kbyte of RAM. The memory
+configuration register has to be updated to reflect the available memory.
+
+The waitstate configuration register is used to generate waitstates.
+This register must also be updated with the correct configuration after
+reset.
+
+The memory protection scheme is implemented - it is enabled through bit 3
+in the MEC control register.
+
+The following registers are implemented:
+
+@multitable {Very long text so that we avoid wrapping } {A long Address}
+@headitem Register @tab Address
+@item MEC control register @tab 0x01f80000
+@item Memory control register @tab 0x01f80010
+@item Waitstate configuration register @tab 0x01f80018
+@item Memory access register 0 @tab 0x01f80020
+@item Memory access register 1 @tab 0x01f80024
+@end multitable
+
+@subsection Watchdog
+
+The watchdog is implemented as in the specification. The input clock is
+always the system clock regardless of WDCS bit in MEC configuration
+register.
+
+The following registers are implemented:
+ 
+@multitable {Very long text so that we avoid wrapping } {A long Address}
+@headitem Register @tab Address
+@item Watchdog program/acknowledge register	@tab 0x01f80060
+@item Watchdog trap door set register		@tab 0x01f80064
+@end multitable
+
+@subsection Software reset register
+
+Implemented as in the specification (0x01f800004, write-only).
+
+@subsection Power-down mode
+
+The power-down register (0x01f800008) is implemented as in the specification.
+During power-down, the simulator skips time until next event in the event queue.
+Ctrl-C in the simulator window will exit the power-down mode.
+
+@subsection MEC control register
+
+The following bits are implemented in the MEC control register:
+
+@multitable {Bits } {name} {The long name of the function}
+@headitem Bit  @tab Name @tab Function
+@item  0 @tab PRD @tab Power-down mode enable
+@item  1 @tab SWR @tab Soft reset enable
+@item  2 @tab APR @tab Access protection enable
+@end multitable
+
+@section LEON2 emulation
+
+In LEON2 mode, SIS emulates a LEON2 system as defined in the LEON2 IP manual.
+The emulated system includes the LEON2 standard peripherals, 16 Mbyte ROM
+and 16 Mbyte RAM. The SPARC emulation supports an FPU but not the LEON2 MMU.
+
+To start sis in LEON2 mode, use the -leon2 switch.
+
+@subsection LEON2 peripherals
+
+SIS emulates one LEON2 UART, the interrupt controller and the timer unit.
+The interrupt controller is implemented as described in the
+LEON2 IP manual, with the exception of the interrupt level register.
+Secondary interrupts are not supported.
+The timer unit is configured with two timers and separate interrupts (8 and 9).
+The scaler is configured to 16 bits, while the counters are 32 bits.
+The UART generates interrupt 3.
+
+
+@subsection Memory interface
+
+The following memory areas are valid for LEON2:
+
+@multitable {Very long text so that we avoid wrapping } {A long long Address}
+@headitem Address  @tab Type
+@item 0x00000000 - 0x01000000 @tab ROM (16 Mbyte)
+@item 0x40000000 - 0x41000000 @tab RAM (16 Mbyte)
+@item 0x80000000 - 0x80000100 @tab APB bus
+@end multitable
+
+Access to non-existing memory will result in a memory exception trap.
+
+@subsection Power-down mode
+
+The LEON2 power-down register (0x80000018) is supported. When power-down is
+entered, time is skipped forward until the next event in the event queue.
+A Ctrl-C in the simulator window will exit the power-down mode.
+
+@section LEON3 emulation
+
+In LEON3 mode, SIS emulates a LEON3 system as defined in the GRLIP IP manual.
+The emulated system includes the standard peripherals such as APBUART, GPTIMER, IRQMP and SRCTRL. The emulated system includes 16 Mbyte ROM
+and 16 Mbyte RAM. The SPARC emulation supports an FPU but not the LEON3 MMU.
+
+To start sis in LEON3 mode, use the -leon3 switch.
+
+@subsection LEON3 peripherals
+
+The following IP cores from GRLIB are emulated in LEON3 mode:
+
+@multitable {The long name of the core} {Address_long} {Interrupt}
+@headitem IP Core  @tab Address @tab Interrupt
+@item  APBMAST @tab 0x80000000 @tab -
+@item  APBUART @tab 0x80000100 @tab 3
+@item  IRQMP @tab 0x80000200 @tab -
+@item  GPTIMER @tab 0x80000300 @tab 8, 9
+@end multitable
+
+@subsection Memory interface
+
+The following memory areas are valid for LEON3:
+
+@multitable {Very long text so that we avoid wrapping } {A long long Address}
+@headitem Address  @tab Type
+@item 0x00000000 - 0x01000000 @tab ROM (16 Mbyte)
+@item 0x40000000 - 0x41000000 @tab RAM (16 Mbyte)
+@item 0x80000000 - 0x81000000 @tab APB bus
+@item 0xFFFFF000 - 0xFFFFFFFF @tab AHB plug&play
+@end multitable
+
+Access to non-existing memory will result in a memory exception trap.
+
+@subsection Power-down mode
+
+The LEON3 power-down register (%ars19) is supported. When power-down is
+entered, time is skipped forward until the next event in the event queue.
+A Ctrl-C in the simulator window will exit the power-down mode.
+
+@section RISC-V emulation
+
+In RISC-V mode, SIS emulates a RV32IMACFD processor as defined in the 
+RISC-V specification 1.9. The RISC-V procssor is attached to an identical GRLIB
+sub-system as when LEON3 is emulated.
+
+To start sis in RISC-V mode, use the -riscv switch.
+
+@subsection Power-down mode
+
+The RISC-V power-down feature (WFI) is supported. When power-down is
+entered, time is skipped forward until the next event in the event queue.
+Ctrl-C in the simulator window will exit the power-down mode.
+
+@subsection Code coverage
+
+Code coverage is currently only supported for 32-bit instructions, i.e.
+the C-extension can not be used when code coverage is measured.
+
+@subsection RISC-V 64-bit timer
+
+The standard RISC-V 64-bit timer is provided and can be read through the 
+time and timeh CSR. The timer does not generare any interrupt and the
+timecmp register is not implemented.
+
+@node Multi-processing
+@chapter Multi-processing 
+@cindex Multi-processing 
+
+When emulating a LEON3 or RISC-V processor, SIS can emulate up to four cores
+in the target system (SMP). The cores are simulated in a round-robin fashion
+with a time-slice of 50 clocks. Shorter or longer time-slices can be selected
+using -d <clocks>.
+
+To start SIS with SMP, use the switch -m <n> when starting the simulator
+where n can be 2 - 4.
+
+@node Interfacing to GDB
+@chapter Interfacing to GDB 
+@cindex Interfacing to GDB 
+
+SIS can be connected to gdb through a network socket using the gdb remote
+interface. Either start SIS with -gdb, or issue the 'gdb' command inside SIS,
+and connect gdb with 'target extended-remote localhost:1234'. The port can be changed using the -port option.
+
+@node Code coverage
+@chapter Code coverage 
+@cindex Code coverage 
+
+Code coverage data will be produce if sis is started with the -cov switch.
+The coverage data will be stored in a file name same as the file used with 
+the load command, appended with .cov. For instance, if sis is run with
+hello.exe, the coverage data will be stored in hello.exe.cov. The coverage
+file is created when the simulator is exited.
+
+The coverage file data consists of a starting address, and a number of
+coverage points indicating incremental 32-bit word addresses:
+
+0x40000000  0 0 0 19 9 1 1 1 1 0 .....
+
+The coverage points are in hexadecimal format. Bit 0 (lsb) indicates an
+executed instruction. Bit 3 indicates taken branch and bit 4 indicates
+an untaken branch. Bits 2 and 3 are currently not used.
+
+For RISC-V, code coverage is only supported for 32-bit instructions, i.e.
+the C-extension can not be used when code coverage is measured.
+
+@node Building SIS
+@chapter Building SIS 
+@cindex Building SIS 
+
+SIS uses the GNU autoconf system, and can simply be build using
+@code{./configure} followed by @code{make}. To build a PDF version of the
+manual, do @code{make sis.pdf}.
+
 @node GNU Free Documentation License
 @appendix GNU Free Documentation License
 
diff --git a/version.texi b/version.texi
index e3c6c70..cf69af6 100644
--- a/version.texi
+++ b/version.texi
@@ -1,4 +1,4 @@
-@set UPDATED 9 April 2019
-@set UPDATED-MONTH April 2019
+@set UPDATED 21 May 2019
+@set UPDATED-MONTH May 2019
 @set EDITION 2.14
 @set VERSION 2.14