1. MEC and ERC32 emulation

The file 'erc32.c' contains a model of the MEC, 512 K rom and 4 M ram.

The following paragraphs outline the implemented MEC functions.

1.1 UARTs

The UARTs are connected to two pseudo-devices, /dev/ttypc and /dev/ttypd.
The following registers are implemeted:

- UART A RX and TX register	(0x01f800e0)
- UART B RX and TX register	(0x01f800e4)
- UART status register		(0x01f800e8)

To speed up simulation, the UARTs operate at approximately 115200 baud.
The UARTs generate interrupt 4 and 5 after each received or transmitted
character.  The error interrupt is generated if overflow occurs - other
errors cannot occure.

1.2 Real-time clock and general pupose timer A

The following registers are implemeted:

- Real-time clock timer				(0x01f80080, read-only)
- Real-time clock scaler program register 	(0x01f80084, write-only)
- Real-time clock counter program register 	(0x01f80080, write-only)

- Genearl pupose timer 				(0x01f80088, read-only)
- Real-time clock scaler program register 	(0x01f8008c, write-only)
- General purpose timer counter prog. register 	(0x01f80088, write-only)

- Timer control register			(0x01f80098, write-only)

1.3 Interrupt controller

The interrupt controller is implemented as in the MEC specification with
the exception of the interrupt shape register. Since external interrupts
are not possible, the interrupt shape register is not implemented. The
only internal interrupts that are generated are the real-time clock,
the general purpose timer and UARTs. However, all 15 interrupts
can be tested via the interrupt force register.

The following registers are implemeted:

- Interrupt pending register		       (0x01f80048, read-only)
- Interrupt mask register		       (0x01f8004c, read-write)
- Interrupt clear register		       (0x01f80050, write-only)
- Interrupt force register		       (0x01f80054, read-write)

1.4 Breakpoint and watchpoint register

The breakpoint and watchpoint functions are implemented as in the MEC
specification. Traps are correctly generated, and the system fault status
register is updated accordingly. Implemeted registers are:

- Debug control register			(0x01f800c0, read-write)
- Breakpoint register				(0x01f800c4, write-only)
- Watchpoint register				(0x01f800c8, write-only)
- System fault status register			(0x01f800a0, read-write)
- Firts failing address register		(0x01f800a4, read-write)


1.5 Memory interface

The following memory areas are valid for the ERC32 simulator:

0x00000000 - 0x00080000		ROM (512 Kbyte, loaded at start-up)
0x02000000 - 0x02400000		RAM (4 Mbyte, initialised to 0x0)
0x01f80000 - 0x01f800ff		MEC registers

Access to unimplemented MEC registers or non-existing memory will result
in a memory exception trap. However, access to unimplemented MEC registers
in the area 0x01f80000 - 0x01f80100 will not cause a memory exception trap.
The written value will be stored in a register and can be read back. It
does however not affect the function in any way.

The memory configuartion register is used to define available memory
in the system. The fields RSIZ and PSIZ are used to set RAM and ROM
size, the remaining fields are not used.  NOTE: after reset, the MEC
is set to decode 4 Kbyte of ROM and 256 Kbyte of RAM. The memory
configuration register has to be updated to reflect the available memory.

The waitstate configuration register is used to generate waitstates.
This register must also be updated with the correct configuration after
reset.

The memory protection scheme is implemented - it is enabled through bit 3
in the MEC control register.

The following registers are implemeted:

- MEC control register (bit 3 only)		(0x01f80000, read-write)
- Memory control register			(0x01f80010, read-write)
- Waitstate configuration register		(0x01f80018, read-write)
- Memory access register 0			(0x01f80020, read-write)
- Memory access register 1			(0x01f80024, read-write)

1.6 Watchdog

The watchdog is implemented as in the specification. The input clock is
always the system clock regardsless of WDCS bit in mec configuration
register.

The following registers are implemeted:

- Watchdog program and acknowledge register	(0x01f80060, write-only)
- Watchdog trap door set register		(0x01f80064, write-only)

1.7 Software reset register

Implemented as in the specification (0x01f800004, write-only).

1.8 Power-down mode

The power-down register (0x01f800008) is implemented as in the specification.
However, if the simulator event queue is empty, power-down mode is not
entered since no interrupt would be generated to exit from the mode. A
Ctrl-C in the simulator window will exit the power-down mode.

1.9 MEC control register

The following bits are implemented in the MEC control register:

Bit	Name	Function
0	PRD	Power-down mode enable
1	SWR	Soft reset enable
3	APR	Access protection enable

How to use SIS with GDB
-----------------------

1. Building GDB with SIS

To build GDB with the SIS/ERC32 simulator, configure with option
'--target sparc-erc32-aout' and build as usual.

2. Attaching the simulator

To attach GDB to the simulator, use:

target sim [options] [files]

The following options are supported:

 -nfp		Disable FPU. FPops will cause an FPU disabled trap.

 -freq <f>	Set the simulated "system clock" to <f> MHz.

 -v		Verbose mode.

 -nogdb		Disable GDB breakpoint handling (see below)

The listed [files] are expected to be in aout format and will be
loaded in the simulator memory prior. This could be used to load
a boot block at address 0x0 if the application is linked to run
from RAM (0x2000000).

To start debugging a program type 'load <program>' and debug as
usual.

The native simulator commands can be reached using the GDB 'sim'
command:

sim <sis_command>

Direct simulator commands during a GDB session must be issued
with care not to disturb GDB's operation ...

For info on supported ERC32 functionality, see README.sis.


3. Loading aout files

The GDB load command loads an aout file into the simulator
memory with the data section starting directly after the text
section regardless of wich start address was specified for the data
at link time! This means that your applications either has to include
a routine that initialise the data segment at the proper address or
link with the data placed directly after the text section.

A copying routine is fairly simple, just copy all data between
_etext and _data to a memory loaction starting at _environ. This
should be done at the same time as the bss is cleared (in srt0.s).


4. GDB breakpoint handling

GDB inserts breakpoint in the form of the 'ta 1' instruction. The
GDB-integrated simulator will therefore recognize the breakpoint
instruction and return control to GDB. If the application uses
'ta 1', the breakpoint detection can be disabled with the -nogdb
switch. In this case however, GDB breakpoints will not work.


Report problems to Jiri Gaisler ESA/ESTEC (jgais@wd.estec.esa.nl)