Update docs with bitmanip instructions

doc/sections/csr.adoc

@@ -2,6 +2,8 @@
 
 The RISC-V privileged specification affords flexibility as to which CSRs are implemented, and how they behave. This section documents the concrete behaviour of Hazard3's standard and nonstandard M-mode CSRs, as implemented.
 
+This section does not attempt to supplant the [RISC-V Privileged Specification](https://github.com/riscv/riscv-isa-manual/releases/download/Ratified-IMFDQC-and-Priv-v1.11/riscv-privileged-20190608.pdf), which is the authoritative reference on the RISC-V CSRs.
+
 === Standard CSRs
 
 ==== mvendorid
@@ -24,11 +26,31 @@ Read-only, constant. Value is configured when the processor is instantiated. Sho
 
 ==== mstatus
 
-blah blah
+The below table lists the fields which are _not_ always hardwired to 0:
+
+[cols="10h,20h,~", options="header"]
+|===
+| Bits | Name | Description
+| 12:11 | MPP | Previous privilege level. Always `0x3`, indicating M-mode.
+| 7 | MPIE | Previous interrupt enable. Readable and writable. Is set to the value of MIE on trap entry. Is set to 1 on trap return.
+| 3 | MIE | Interrupt enable. Readable and writable. Is set to 0 on trap entry. Is set to the value of MPIE on trap return.
+|===
+
+==== mstatush
+
+This CSR is present, but it is entirely hardwired to zero.
 
 ==== misa
 
-Read-only, constant. Value depends on which ISA extensions Hazard5 is configured with.
+Read-only, constant. Value depends on which ISA extensions Hazard5 is configured with. The table below lists the fields which are _not_ always hardwired to 0:
+
+[cols="10h,20h,~", options="header"]
+|===
+| Bits | Name | Description
+| 31:30 | MXL | Always `0x1`. Indicates this is a 32-bit processor.
+| 12 | M | 1 if the M extension is present.
+| 2 | C | 1 if the C extension is present.
+|===
 
 === Custom CSRs
 

doc/sections/instruction_timings.adoc

@@ -94,3 +94,47 @@ A consequence of the C extension is that 32-bit instructions can be non-naturall
 | `ecall` | 3 | Time given is for jumping to `mtvec`
 | `ebreak` | 3 | Time given is for jumping to `mtvec`
 |===
+
+=== Bit Manipulation
+
+[%autowidth.stretch, options="header"]
+|===
+| Instruction | Cycles | Note
+3+| Zba (address generation)
+|`sh1add` | 1 |
+|`sh2add` | 1 |
+|`sh3add` | 1 |
+3+| Zbb (basic bit manipulation)
+|`andn`   | 1 |
+|`clz`    | 1 |
+|`cpop`   | 1 |
+|`ctz`    | 1 |
+|`max`    | 1 |
+|`maxu`   | 1 |
+|`min`    | 1 |
+|`minu`   | 1 |
+|`orc.b`  | 1 |
+|`orn`    | 1 |
+|`rev8`   | 1 |
+|`rol`    | 1 |
+|`ror`    | 1 |
+|`rori`   | 1 |
+|`sext.b` | 1 |
+|`sext.h` | 1 |
+|`xnor`   | 1 |
+|`zext.h` | 1 |
+|`zext.b` | 1 | `zext.b` is a pseudo-op for `andi rd, rs1, 0xff`
+3+| Zbc (carry-less multiply)
+|`clmul`  | 1 |
+|`clmulh` | 1 |
+|`clmulr` | 1 |
+3+| Zbs (single-bit manipulation)
+|`bclr`   | 1 |
+|`bclri`  | 1 |
+|`bext`   | 1 |
+|`bexti`  | 1 |
+|`binv`   | 1 |
+|`binvi`  | 1 |
+|`bset`   | 1 |
+|`bseti`  | 1 |
+|===

doc/sections/introduction.adoc

@@ -3,16 +3,22 @@
 Hazard3 is a 3-stage RISC-V processor, providing the following architectural support:
 
 * `RV32I`: 32-bit base instruction set
-* `M` extension: integer multiply/divide/modulo
-* `C` extension: compressed instructions
-* `Zicsr` extension: CSR access
+* `M`: integer multiply/divide/modulo
+* `C`: compressed instructions
+* `Zba`: address generation
+* `Zbb`: basic bit manipulation
+* `Zbc`: carry-less multiplication
+* `Zbs`: single-bit manipulation
 * M-mode privileged instructions `ECALL`, `EBREAK`, `MRET`
+* The `WFI` instruction
+* `Zicsr`: CSR access
 * The machine-mode (M-mode) privilege state, and standard M-mode CSRs
 * Debug support, fully compliant with version 0.13.2 of the RISC-V external debug specification
 
 The following are planned for future implementation:
 
-* Support for `WFI` instruction
 * `A` extension: atomic memory access
 ** `LR`/`SC` fully supported
 ** AMONone PMA on all of memory (AMOs are decoded but unconditionally trigger access fault without attempting memory access)
+* Trigger unit for debug mode
+** Likely breakpoints only