about summary refs log tree commit diff stats
path: root/src/miasm/arch/mips32/arch.py
diff options
context:
space:
mode:
Diffstat (limited to 'src/miasm/arch/mips32/arch.py')
-rw-r--r--src/miasm/arch/mips32/arch.py838
1 files changed, 838 insertions, 0 deletions
diff --git a/src/miasm/arch/mips32/arch.py b/src/miasm/arch/mips32/arch.py
new file mode 100644
index 00000000..76ebe730
--- /dev/null
+++ b/src/miasm/arch/mips32/arch.py
@@ -0,0 +1,838 @@
+#-*- coding:utf-8 -*-
+
+import logging
+from collections import defaultdict
+
+from pyparsing import Literal, Optional
+
+from miasm.expression.expression import ExprMem, ExprInt, ExprId, ExprOp, ExprLoc
+from miasm.core.bin_stream import bin_stream
+import miasm.arch.mips32.regs as regs
+import miasm.core.cpu as cpu
+from miasm.ir.ir import color_expr_html
+
+from miasm.core.asm_ast import AstInt, AstId, AstMem, AstOp
+
+log = logging.getLogger("mips32dis")
+console_handler = logging.StreamHandler()
+console_handler.setFormatter(logging.Formatter("[%(levelname)-8s]: %(message)s"))
+log.addHandler(console_handler)
+log.setLevel(logging.DEBUG)
+
+
+gpregs = cpu.reg_info(regs.regs32_str, regs.regs32_expr)
+
+
+LPARENTHESIS = Literal("(")
+RPARENTHESIS = Literal(")")
+
+def cb_deref(tokens):
+    if len(tokens) != 4:
+        raise NotImplementedError("TODO")
+    return AstMem(tokens[2] + tokens[0], 32)
+
+def cb_deref_nooff(tokens):
+    if len(tokens) != 3:
+        raise NotImplementedError("TODO")
+    return AstMem(tokens[1], 32)
+
+base_expr = cpu.base_expr
+
+deref_off = (Optional(base_expr) + LPARENTHESIS + gpregs.parser + RPARENTHESIS).setParseAction(cb_deref)
+deref_nooff = (LPARENTHESIS + gpregs.parser + RPARENTHESIS).setParseAction(cb_deref_nooff)
+deref = deref_off | deref_nooff
+
+
+class additional_info(object):
+    def __init__(self):
+        self.except_on_instr = False
+
+br_0 = ['B', 'J', 'JR', 'BAL', 'JAL', 'JALR']
+br_1 = ['BGEZ', 'BLTZ', 'BGTZ', 'BGTZL', 'BLEZ', 'BLEZL', 'BC1T', 'BC1TL', 'BC1F', 'BC1FL']
+br_2 = ['BEQ', 'BEQL', 'BNE', 'BNEL']
+
+
+class instruction_mips32(cpu.instruction):
+    __slots__ = []
+
+    def __init__(self, *args, **kargs):
+        super(instruction_mips32, self).__init__(*args, **kargs)
+        self.delayslot = 1
+
+
+    @staticmethod
+    def arg2str(expr, index=None, loc_db=None):
+        if expr.is_id() or expr.is_int():
+            return str(expr)
+        elif expr.is_loc():
+            if loc_db is not None:
+                return loc_db.pretty_str(expr.loc_key)
+            else:
+                return str(expr)
+        assert(isinstance(expr, ExprMem))
+        arg = expr.ptr
+        if isinstance(arg, ExprId):
+            return "(%s)"%arg
+        assert(len(arg.args) == 2 and arg.op == '+')
+        return "%s(%s)"%(arg.args[1], arg.args[0])
+
+    @staticmethod
+    def arg2html(expr, index=None, loc_db=None):
+        if expr.is_id() or expr.is_int() or expr.is_loc():
+            return color_expr_html(expr, loc_db)
+        assert(isinstance(expr, ExprMem))
+        arg = expr.ptr
+        if isinstance(arg, ExprId):
+            return "(%s)"%color_expr_html(arg, loc_db)
+        assert(len(arg.args) == 2 and arg.op == '+')
+        return "%s(%s)"%(
+            color_expr_html(arg.args[1], loc_db),
+            color_expr_html(arg.args[0], loc_db)
+        )
+
+    def dstflow(self):
+        if self.name == 'BREAK':
+            return False
+        if self.name in br_0 + br_1 + br_2:
+            return True
+        return False
+
+    def get_dst_num(self):
+        if self.name in br_0:
+            i = 0
+        elif self.name in br_1:
+            i = 1
+        elif self.name in br_2:
+            i = 2
+        else:
+            raise NotImplementedError("TODO %s"%self)
+        return i
+
+    def dstflow2label(self, loc_db):
+        if self.name in ["J", 'JAL']:
+            expr = self.args[0]
+            offset = int(expr)
+            addr = ((self.offset & (0xFFFFFFFF ^ ((1<< 28)-1))) + offset) & int(expr.mask)
+            loc_key = loc_db.get_or_create_offset_location(addr)
+            self.args[0] = ExprLoc(loc_key, expr.size)
+            return
+
+        ndx = self.get_dst_num()
+        expr = self.args[ndx]
+
+        if not isinstance(expr, ExprInt):
+            return
+        addr = (int(expr) + self.offset) & int(expr.mask)
+        loc_key = loc_db.get_or_create_offset_location(addr)
+        self.args[ndx] = ExprLoc(loc_key, expr.size)
+
+    def breakflow(self):
+        if self.name == 'BREAK':
+            return False
+        if self.name in br_0 + br_1 + br_2:
+            return True
+        return False
+
+    def is_subcall(self):
+        if self.name in ['JAL', 'JALR', 'BAL']:
+            return True
+        return False
+
+    def getdstflow(self, loc_db):
+        if self.name in br_0:
+            return [self.args[0]]
+        elif self.name in br_1:
+            return [self.args[1]]
+        elif self.name in br_2:
+            return [self.args[2]]
+        elif self.name in ['JAL', 'JALR', 'JR', 'J']:
+            return [self.args[0]]
+        else:
+            raise NotImplementedError("fix mnemo %s"%self.name)
+
+    def splitflow(self):
+        if self.name in ["B", 'JR', 'J']:
+            return False
+        if self.name in br_0:
+            return True
+        if self.name in br_1:
+            return True
+        if self.name in br_2:
+            return True
+        if self.name in ['JAL', 'JALR']:
+            return True
+        return False
+
+    def get_symbol_size(self, symbol, loc_db):
+        return 32
+
+    def fixDstOffset(self):
+        ndx = self.get_dst_num()
+        e = self.args[ndx]
+        if self.offset is None:
+            raise ValueError('symbol not resolved %s' % self.l)
+        if not isinstance(e, ExprInt):
+            return
+        off = (int(e) - self.offset) & int(e.mask)
+        if int(off % 4):
+            raise ValueError('strange offset! %r' % off)
+        self.args[ndx] = ExprInt(off, 32)
+
+    def get_args_expr(self):
+        args = [a for a in self.args]
+        return args
+
+
+class mn_mips32(cpu.cls_mn):
+    delayslot = 1
+    name = "mips32"
+    regs = regs
+    bintree = {}
+    num = 0
+    all_mn = []
+    all_mn_mode = defaultdict(list)
+    all_mn_name = defaultdict(list)
+    all_mn_inst = defaultdict(list)
+    pc = {'l':regs.PC, 'b':regs.PC}
+    sp = {'l':regs.SP, 'b':regs.SP}
+    instruction = instruction_mips32
+    max_instruction_len = 4
+
+    @classmethod
+    def getpc(cls, attrib = None):
+        return regs.PC
+
+    @classmethod
+    def getsp(cls, attrib = None):
+        return regs.SP
+
+    def additional_info(self):
+        info = additional_info()
+        return info
+
+    @classmethod
+    def getbits(cls, bitstream, attrib, start, n):
+        if not n:
+            return 0
+        o = 0
+        while n:
+            offset = start // 8
+            n_offset = cls.endian_offset(attrib, offset)
+            c = cls.getbytes(bitstream, n_offset, 1)
+            if not c:
+                raise IOError
+            c = ord(c)
+            r = 8 - start % 8
+            c &= (1 << r) - 1
+            l = min(r, n)
+            c >>= (r - l)
+            o <<= l
+            o |= c
+            n -= l
+            start += l
+        return o
+
+    @classmethod
+    def endian_offset(cls, attrib, offset):
+        if attrib == "l":
+            return (offset & ~3) + 3 - offset % 4
+        elif attrib == "b":
+            return offset
+        else:
+            raise NotImplementedError('bad attrib')
+
+    @classmethod
+    def check_mnemo(cls, fields):
+        l = sum([x.l for x in fields])
+        assert l == 32, "len %r" % l
+
+    @classmethod
+    def getmn(cls, name):
+        return name.upper()
+
+    @classmethod
+    def gen_modes(cls, subcls, name, bases, dct, fields):
+        dct['mode'] = None
+        return [(subcls, name, bases, dct, fields)]
+
+    def value(self, mode):
+        v = super(mn_mips32, self).value(mode)
+        if mode == 'l':
+            return [x[::-1] for x in v]
+        elif mode == 'b':
+            return [x for x in v]
+        else:
+            raise NotImplementedError('bad attrib')
+
+
+
+def mips32op(name, fields, args=None, alias=False):
+    dct = {"fields": fields}
+    dct["alias"] = alias
+    if args is not None:
+        dct['args'] = args
+    type(name, (mn_mips32,), dct)
+    #type(name, (mn_mips32b,), dct)
+
+class mips32_arg(cpu.m_arg):
+    def asm_ast_to_expr(self, arg, loc_db):
+        if isinstance(arg, AstId):
+            if isinstance(arg.name, ExprId):
+                return arg.name
+            if arg.name in gpregs.str:
+                return None
+            loc_key = loc_db.get_or_create_name_location(arg.name)
+            return ExprLoc(loc_key, 32)
+        if isinstance(arg, AstOp):
+            args = [self.asm_ast_to_expr(tmp, loc_db) for tmp in arg.args]
+            if None in args:
+                return None
+            return ExprOp(arg.op, *args)
+        if isinstance(arg, AstInt):
+            return ExprInt(arg.value, 32)
+        if isinstance(arg, AstMem):
+            ptr = self.asm_ast_to_expr(arg.ptr, loc_db)
+            if ptr is None:
+                return None
+            return ExprMem(ptr, arg.size)
+        return None
+
+
+class mips32_reg(cpu.reg_noarg, mips32_arg):
+    pass
+
+class mips32_gpreg(mips32_reg):
+    reg_info = gpregs
+    parser = reg_info.parser
+
+class mips32_fltpreg(mips32_reg):
+    reg_info = regs.fltregs
+    parser = reg_info.parser
+
+
+class mips32_fccreg(mips32_reg):
+    reg_info = regs.fccregs
+    parser = reg_info.parser
+
+class mips32_imm(cpu.imm_noarg):
+    parser = base_expr
+
+
+class mips32_s16imm_noarg(mips32_imm):
+    def decode(self, v):
+        v = v & self.lmask
+        v = cpu.sign_ext(v, 16, 32)
+        self.expr = ExprInt(v, 32)
+        return True
+
+    def encode(self):
+        if not isinstance(self.expr, ExprInt):
+            return False
+        v = int(self.expr)
+        if v & 0x80000000:
+            nv = v & ((1 << 16) - 1)
+            assert( v == cpu.sign_ext(nv, 16, 32))
+            v = nv
+        self.value = v
+        return True
+
+
+class mips32_s09imm_noarg(mips32_imm):
+    def decode(self, v):
+        v = v & self.lmask
+        v = cpu.sign_ext(v, 9, 32)
+        self.expr = ExprInt(v, 32)
+        return True
+
+    def encode(self):
+        if not isinstance(self.expr, ExprInt):
+            return False
+        v = int(self.expr)
+        if v & 0x80000000:
+            nv = v & ((1 << 9) - 1)
+            assert( v == cpu.sign_ext(nv, 9, 32))
+            v = nv
+        self.value = v
+        return True
+
+
+class mips32_soff_noarg(mips32_imm):
+    def decode(self, v):
+        v = v & self.lmask
+        v <<= 2
+        v = cpu.sign_ext(v, 16+2, 32)
+        # Add pipeline offset
+        self.expr = ExprInt(v + 4, 32)
+        return True
+
+    def encode(self):
+        if not isinstance(self.expr, ExprInt):
+            return False
+        # Remove pipeline offset
+        v = (int(self.expr) - 4) & 0xFFFFFFFF
+        if v & 0x80000000:
+            nv = v & ((1 << 16+2) - 1)
+            assert( v == cpu.sign_ext(nv, 16+2, 32))
+            v = nv
+        self.value = v>>2
+        return True
+
+
+class mips32_s16imm(mips32_s16imm_noarg, mips32_arg):
+    pass
+
+class mips32_s09imm(mips32_s09imm_noarg, mips32_arg):
+    pass
+
+class mips32_soff(mips32_soff_noarg, mips32_arg):
+    pass
+
+
+class mips32_instr_index(mips32_imm, mips32_arg):
+    def decode(self, v):
+        v = v & self.lmask
+        self.expr = ExprInt(v<<2, 32)
+        return True
+
+    def encode(self):
+        if not isinstance(self.expr, ExprInt):
+            return False
+        v = int(self.expr)
+        if v & 3:
+            return False
+        v>>=2
+        if v > (1<<self.l):
+            return False
+        self.value = v
+        return True
+
+
+class mips32_u16imm(mips32_imm, mips32_arg):
+    def decode(self, v):
+        v = v & self.lmask
+        self.expr = ExprInt(v, 32)
+        return True
+
+    def encode(self):
+        if not isinstance(self.expr, ExprInt):
+            return False
+        v = int(self.expr)
+        assert(v < (1<<16))
+        self.value = v
+        return True
+
+class mips32_dreg_imm(mips32_arg):
+    parser = deref
+    def decode(self, v):
+        imm = self.parent.imm.expr
+        r = gpregs.expr[v]
+        self.expr = ExprMem(r+imm, 32)
+        return True
+
+    def encode(self):
+        e = self.expr
+        if not isinstance(e, ExprMem):
+            return False
+        ptr = e.ptr
+        if isinstance(ptr, ExprId):
+            self.parent.imm.expr = ExprInt(0, 32)
+            r = ptr
+        elif len(ptr.args) == 2 and ptr.op == "+":
+            self.parent.imm.expr = ptr.args[1]
+            r = ptr.args[0]
+        else:
+            return False
+        self.value = gpregs.expr.index(r)
+        return True
+
+    @staticmethod
+    def arg2str(expr, index=None):
+        assert(isinstance(expr, ExprMem))
+        ptr = expr.ptr
+        if isinstance(ptr, ExprId):
+            return "(%s)"%ptr
+        assert(len(ptr.args) == 2 and ptr.op == '+')
+        return "%s(%s)"%(ptr.args[1], ptr.args[0])
+
+class mips32_esize(mips32_imm, mips32_arg):
+    def decode(self, v):
+        v = v & self.lmask
+        self.expr = ExprInt(v+1, 32)
+        return True
+
+    def encode(self):
+        if not isinstance(self.expr, ExprInt):
+            return False
+        v = int(self.expr) -1
+        assert(v < (1<<16))
+        self.value = v
+        return True
+
+class mips32_eposh(mips32_imm, mips32_arg):
+    def decode(self, v):
+        self.expr = ExprInt(v-int(self.parent.epos.expr)+1, 32)
+        return True
+
+    def encode(self):
+        if not isinstance(self.expr, ExprInt):
+            return False
+        v = int(self.expr) + int(self.parent.epos.expr) -1
+        self.value = v
+        return True
+
+
+
+
+class mips32_cpr(mips32_arg):
+    parser = regs.regs_cpr0_info.parser
+    def decode(self, v):
+        index = int(self.parent.cpr0.expr) << 3
+        index += v
+        self.expr = regs.regs_cpr0_expr[index]
+        return True
+    def encode(self):
+        e = self.expr
+        if not e in regs.regs_cpr0_expr:
+            return False
+        index = regs.regs_cpr0_expr.index(e)
+        self.value = index & 7
+        index >>=2
+        self.parent.cpr0.value = index
+        return True
+
+rs = cpu.bs(l=5, cls=(mips32_gpreg,))
+rt = cpu.bs(l=5, cls=(mips32_gpreg,))
+rd = cpu.bs(l=5, cls=(mips32_gpreg,))
+ft = cpu.bs(l=5, cls=(mips32_fltpreg,))
+fs = cpu.bs(l=5, cls=(mips32_fltpreg,))
+fd = cpu.bs(l=5, cls=(mips32_fltpreg,))
+
+s16imm = cpu.bs(l=16, cls=(mips32_s16imm,))
+u16imm = cpu.bs(l=16, cls=(mips32_u16imm,))
+s09imm = cpu.bs(l=9, cls=(mips32_s09imm,))
+sa = cpu.bs(l=5, cls=(mips32_u16imm,))
+base = cpu.bs(l=5, cls=(mips32_dreg_imm,))
+soff = cpu.bs(l=16, cls=(mips32_soff,))
+oper = cpu.bs(l=5, cls=(mips32_u16imm,))
+
+cpr0 = cpu.bs(l=5, cls=(mips32_imm,), fname="cpr0")
+cpr =  cpu.bs(l=3, cls=(mips32_cpr,))
+
+stype = cpu.bs(l=5, cls=(mips32_u16imm,))
+hint_pref = cpu.bs(l=5, cls=(mips32_u16imm,))
+
+s16imm_noarg = cpu.bs(l=16, cls=(mips32_s16imm_noarg,), fname="imm",
+                  order=-1)
+s09imm_noarg = cpu.bs(l=9, cls=(mips32_s09imm_noarg,), fname="imm",
+                  order=-1)
+
+hint = cpu.bs(l=5, default_val="00000")
+fcc = cpu.bs(l=3, cls=(mips32_fccreg,))
+
+sel = cpu.bs(l=3, cls=(mips32_u16imm,))
+
+code = cpu.bs(l=20, cls=(mips32_u16imm,))
+
+esize = cpu.bs(l=5, cls=(mips32_esize,))
+epos = cpu.bs(l=5, cls=(mips32_u16imm,), fname="epos",
+          order=-1)
+
+eposh = cpu.bs(l=5, cls=(mips32_eposh,))
+
+instr_index = cpu.bs(l=26, cls=(mips32_instr_index,))
+bs_fmt = cpu.bs_mod_name(l=5, fname='fmt', mn_mod={0x10: '.S', 0x11: '.D',
+                                                   0x14: '.W', 0x15: '.L',
+                                                   0x16: '.PS'})
+class bs_cond(cpu.bs_mod_name):
+    mn_mod = ['.F', '.UN', '.EQ', '.UEQ',
+              '.OLT', '.ULT', '.OLE', '.ULE',
+              '.SF', '.NGLE', '.SEQ', '.NGL',
+              '.LT', '.NGE', '.LE', '.NGT'
+              ]
+
+    def modname(self, name, f_i):
+        raise NotImplementedError("Not implemented")
+
+
+class bs_cond_name(cpu.bs_divert):
+    prio = 2
+    mn_mod = [['.F', '.UN', '.EQ', '.UEQ',
+               '.OLT', '.ULT', '.OLE', '.ULE'],
+              ['.SF', '.NGLE', '.SEQ', '.NGL',
+               '.LT', '.NGE', '.LE', '.NGT']
+              ]
+
+    def divert(self, index, candidates):
+        out = []
+        for candidate in candidates:
+            cls, name, bases, dct, fields = candidate
+            cond1 = [f for f in fields if f.fname == "cond1"]
+            assert(len(cond1) == 1)
+            cond1 = cond1.pop()
+            mm = self.mn_mod[cond1.value]
+            for value, new_name in enumerate(mm):
+                nfields = fields[:]
+                s = cpu.int2bin(value, self.args['l'])
+                args = dict(self.args)
+                args.update({'strbits': s})
+                f = cpu.bs(**args)
+                nfields[index] = f
+                ndct = dict(dct)
+                ndct['name'] = name + new_name
+                out.append((cls, new_name, bases, ndct, nfields))
+        return out
+
+
+
+class bs_cond_mod(cpu.bs_mod_name):
+    prio = 1
+
+bs_cond = bs_cond_mod(l=4,
+                      mn_mod = ['.F', '.UN', '.EQ', '.UEQ',
+                                '.OLT', '.ULT', '.OLE', '.ULE',
+                                '.SF', '.NGLE', '.SEQ', '.NGL',
+                                '.LT', '.NGE', '.LE', '.NGT'])
+
+
+
+bs_arith = cpu.bs_name(l=6, name={'ADDU':0b100001,
+                                  'SUBU':0b100011,
+                                  'OR':0b100101,
+                                  'AND':0b100100,
+                                  'SLTU':0b101011,
+                                  'XOR':0b100110,
+                                  'SLT':0b101010,
+                                  'SUBU':0b100011,
+                                  'NOR':0b100111,
+                                  'MOVN':0b001011,
+                                  'MOVZ':0b001010,
+                                  })
+
+bs_shift = cpu.bs_name(l=6, name={'SLL':0b000000,
+                                  'SRL':0b000010,
+                                  'SRA':0b000011,
+                                  })
+
+bs_shift1 = cpu.bs_name(l=6, name={'SLLV':0b000100,
+                                   'SRLV':0b000110,
+                                   'SRAV':0b000111,
+                                   })
+
+
+bs_arithfmt = cpu.bs_name(l=6, name={'ADD':0b000000,
+                                     'SUB':0b000001,
+                                     'MUL':0b000010,
+                                     'DIV':0b000011,
+                                     })
+
+bs_s_l = cpu.bs_name(l=6, name = {"SW":    0b101011,
+                                  "SH":    0b101001,
+                                  "SB":    0b101000,
+                                  "LW":    0b100011,
+                                  "LH":    0b100001,
+                                  "LB":    0b100000,
+                                  "LHU":   0b100101,
+                                  "LBU":   0b100100,
+                                  "LWL":   0b100010,
+                                  "LWR":   0b100110,
+
+                                  "SWL":   0b101010,
+                                  "SWR":   0b101110,
+                                  })
+
+
+bs_oax = cpu.bs_name(l=6, name = {"ORI":    0b001101,
+                                  "ANDI":   0b001100,
+                                  "XORI":   0b001110,
+                                  })
+
+bs_bcc = cpu.bs_name(l=5, name = {"BGEZ":    0b00001,
+                                  "BGEZL":   0b00011,
+                                  "BGEZAL":  0b10001,
+                                  "BGEZALL": 0b10011,
+                                  "BLTZ":    0b00000,
+                                  "BLTZL":   0b00010,
+                                  "BLTZAL":  0b10000,
+                                  "BLTZALL": 0b10010,
+                                  })
+
+
+bs_code = cpu.bs(l=10)
+
+
+mips32op("addi",    [cpu.bs('001000'), rs, rt, s16imm], [rt, rs, s16imm])
+mips32op("addiu",   [cpu.bs('001001'), rs, rt, s16imm], [rt, rs, s16imm])
+mips32op("nop",     [cpu.bs('0'*32)], alias = True)
+mips32op("lui",     [cpu.bs('001111'), cpu.bs('00000'), rt, u16imm])
+mips32op("oax",     [bs_oax, rs, rt, u16imm], [rt, rs, u16imm])
+
+mips32op("arith",   [cpu.bs('000000'), rs, rt, rd, cpu.bs('00000'), bs_arith],
+         [rd, rs, rt])
+mips32op("shift1",  [cpu.bs('000000'), rs, rt, rd, cpu.bs('00000'), bs_shift1],
+         [rd, rt, rs])
+
+mips32op("shift",   [cpu.bs('000000'), cpu.bs('00000'), rt, rd, sa, bs_shift],
+         [rd, rt, sa])
+
+mips32op("rotr",    [cpu.bs('000000'), cpu.bs('00001'), rt, rd, sa,
+                     cpu.bs('000010')], [rd, rt, sa])
+
+mips32op("mul",     [cpu.bs('011100'), rs, rt, rd, cpu.bs('00000'),
+                     cpu.bs('000010')], [rd, rs, rt])
+mips32op("div",     [cpu.bs('000000'), rs, rt, cpu.bs('0000000000'),
+                     cpu.bs('011010')])
+
+mips32op("s_l",     [bs_s_l, base, rt, s16imm_noarg], [rt, base])
+
+#mips32op("mfc0",    [bs('010000'), bs('00000'), rt, rd, bs('00000000'), sel])
+mips32op("mfc0",    [cpu.bs('010000'), cpu.bs('00000'), rt, cpr0,
+                     cpu.bs('00000000'), cpr])
+mips32op("mfc1",    [cpu.bs('010001'), cpu.bs('00000'), rt, fs,
+                     cpu.bs('00000000000')])
+
+mips32op("ldc1",    [cpu.bs('110101'), base, ft, s16imm_noarg], [ft, base])
+
+mips32op("mov",     [cpu.bs('010001'), bs_fmt, cpu.bs('00000'), fs, fd,
+                     cpu.bs('000110')], [fd, fs])
+
+mips32op("add",     [cpu.bs('010001'), bs_fmt, ft, fs, fd, bs_arithfmt],
+         [fd, fs, ft])
+
+mips32op("divu",    [cpu.bs('000000'), rs, rt, cpu.bs('0000000000'),
+                     cpu.bs('011011')])
+mips32op("mult",    [cpu.bs('000000'), rs, rt, cpu.bs('0000000000'),
+                     cpu.bs('011000')])
+mips32op("multu",   [cpu.bs('000000'), rs, rt, cpu.bs('0000000000'),
+                     cpu.bs('011001')])
+mips32op("mflo",    [cpu.bs('000000'), cpu.bs('0000000000'), rd,
+                     cpu.bs('00000'), cpu.bs('010010')])
+mips32op("mfhi",    [cpu.bs('000000'), cpu.bs('0000000000'), rd,
+                     cpu.bs('00000'), cpu.bs('010000')])
+
+
+mips32op("b",       [cpu.bs('000100'), cpu.bs('00000'), cpu.bs('00000'), soff],
+         alias = True)
+mips32op("bne",     [cpu.bs('000101'), rs, rt, soff])
+mips32op("bnel",    [cpu.bs('010101'), rs, rt, soff])
+
+mips32op("beq",     [cpu.bs('000100'), rs, rt, soff])
+mips32op("beql",    [cpu.bs('010100'), rs, rt, soff])
+
+mips32op("blez",    [cpu.bs('000110'), rs, cpu.bs('00000'), soff])
+mips32op("blezl",   [cpu.bs('010110'), rs, cpu.bs('00000'), soff])
+
+mips32op("bcc",     [cpu.bs('000001'), rs, bs_bcc, soff])
+
+mips32op("bgtz",    [cpu.bs('000111'), rs, cpu.bs('00000'), soff])
+mips32op("bgtzl",   [cpu.bs('010111'), rs, cpu.bs('00000'), soff])
+mips32op("bal",     [cpu.bs('000001'), cpu.bs('00000'), cpu.bs('10001'), soff],
+         alias = True)
+
+
+mips32op("slti",    [cpu.bs('001010'), rs, rt, s16imm], [rt, rs, s16imm])
+mips32op("sltiu",   [cpu.bs('001011'), rs, rt, s16imm], [rt, rs, s16imm])
+
+
+mips32op("j",       [cpu.bs('000010'), instr_index])
+mips32op("jal",     [cpu.bs('000011'), instr_index])
+mips32op("jalr",    [cpu.bs('000000'), rs, cpu.bs('00000'), rd, hint,
+                     cpu.bs('001001')])
+mips32op("jr",      [cpu.bs('000000'), rs, cpu.bs('0000000000'), hint,
+                     cpu.bs('001000')])
+
+mips32op("lwc1",    [cpu.bs('110001'), base, ft, s16imm_noarg], [ft, base])
+
+#mips32op("mtc0",    [bs('010000'), bs('00100'), rt, rd, bs('00000000'), sel])
+mips32op("mtc0",    [cpu.bs('010000'), cpu.bs('00100'), rt, cpr0,
+                     cpu.bs('00000000'), cpr])
+mips32op("mtc1",    [cpu.bs('010001'), cpu.bs('00100'), rt, fs,
+                     cpu.bs('00000000000')])
+# XXXX TODO CFC1
+mips32op("cfc1",    [cpu.bs('010001'), cpu.bs('00010'), rt, fs,
+                     cpu.bs('00000000000')])
+# XXXX TODO CTC1
+mips32op("ctc1",    [cpu.bs('010001'), cpu.bs('00110'), rt, fs,
+                     cpu.bs('00000000000')])
+
+mips32op("break",   [cpu.bs('000000'), code, cpu.bs('001101')])
+mips32op("syscall", [cpu.bs('000000'), code, cpu.bs('001100')])
+
+
+mips32op("c",       [cpu.bs('010001'), bs_fmt, ft, fs, fcc, cpu.bs('0'),
+                     cpu.bs('0'), cpu.bs('11'), bs_cond], [fcc, fs, ft])
+
+
+mips32op("bc1t",    [cpu.bs('010001'), cpu.bs('01000'), fcc, cpu.bs('0'),
+                     cpu.bs('1'), soff])
+mips32op("bc1tl",    [cpu.bs('010001'), cpu.bs('01000'), fcc, cpu.bs('1'),
+                     cpu.bs('1'), soff])
+mips32op("bc1f",    [cpu.bs('010001'), cpu.bs('01000'), fcc, cpu.bs('0'),
+                     cpu.bs('0'), soff])
+mips32op("bc1fl",    [cpu.bs('010001'), cpu.bs('01000'), fcc, cpu.bs('1'),
+                     cpu.bs('0'), soff])
+
+mips32op("swc1",    [cpu.bs('111001'), base, ft, s16imm_noarg], [ft, base])
+
+mips32op("cvt.d",   [cpu.bs('010001'), bs_fmt, cpu.bs('00000'), fs, fd,
+                     cpu.bs('100001')], [fd, fs])
+mips32op("cvt.w",   [cpu.bs('010001'), bs_fmt, cpu.bs('00000'), fs, fd,
+                     cpu.bs('100100')], [fd, fs])
+mips32op("cvt.s",   [cpu.bs('010001'), bs_fmt, cpu.bs('00000'), fs, fd,
+                     cpu.bs('100000')], [fd, fs])
+
+mips32op("ext",     [cpu.bs('011111'), rs, rt, esize, epos, cpu.bs('000000')],
+         [rt, rs, epos, esize])
+mips32op("ins",     [cpu.bs('011111'), rs, rt, eposh, epos, cpu.bs('000100')],
+         [rt, rs, epos, eposh])
+
+mips32op("seb",     [cpu.bs('011111'), cpu.bs('00000'), rt, rd, cpu.bs('10000'),
+                     cpu.bs('100000')], [rd, rt])
+mips32op("seh",     [cpu.bs('011111'), cpu.bs('00000'), rt, rd, cpu.bs('11000'),
+                     cpu.bs('100000')], [rd, rt])
+mips32op("wsbh",    [cpu.bs('011111'), cpu.bs('00000'), rt, rd, cpu.bs('00010'),
+                     cpu.bs('100000')], [rd, rt])
+
+mips32op("di",      [cpu.bs('010000'), cpu.bs('01011'), rt, cpu.bs('01100'),
+                     cpu.bs('00000'), cpu.bs('0'), cpu.bs('00'), cpu.bs('000')])
+mips32op("ei",      [cpu.bs('010000'), cpu.bs('01011'), rt, cpu.bs('01100'),
+                     cpu.bs('00000'), cpu.bs('1'), cpu.bs('00'), cpu.bs('000')])
+
+
+mips32op("tlbp",    [cpu.bs('010000'), cpu.bs('1'), cpu.bs('0'*19),
+                     cpu.bs('001000')])
+mips32op("tlbwi",   [cpu.bs('010000'), cpu.bs('1'), cpu.bs('0'*19),
+                     cpu.bs('000010')])
+
+
+mips32op("teq",     [cpu.bs('000000'), rs, rt, bs_code, cpu.bs('110100')],
+         [rs, rt])
+mips32op("tne",     [cpu.bs('000000'), rs, rt, bs_code, cpu.bs('110110')],         
+         [rs, rt])
+
+mips32op("clz",     [cpu.bs('011100'), rs, rt, rd, cpu.bs('00000'), cpu.bs('100000')],
+        [rd, rs])
+mips32op("clz",     [cpu.bs('000000'), rs, cpu.bs('00000'), rd, cpu.bs('00001010000')],
+        [rd, rs])
+
+mips32op("ll",      [cpu.bs('110000'), base, rt, s16imm_noarg], [rt, base])
+mips32op("ll",      [cpu.bs('011111'), base, rt, s09imm_noarg, cpu.bs('0110110')], [rt, base])
+
+mips32op("sc",      [cpu.bs('111000'), base, rt, s16imm_noarg], [rt, base])
+mips32op("sc",      [cpu.bs('011111'), base, rt, s09imm_noarg, cpu.bs('0'), cpu.bs('100110')], [rt, base])
+
+mips32op("sync",    [cpu.bs('000000000000000000000'), stype, cpu.bs('001111')], [stype])
+
+mips32op("pref",    [cpu.bs('110011'), base, hint_pref, s16imm_noarg], [hint_pref, base])
+mips32op("pref",    [cpu.bs('011111'), base, hint_pref, s09imm_noarg, cpu.bs('0110101')], [hint_pref, base])
+
+mips32op("tlbwr",   [cpu.bs('01000010000000000000000000000110')], [])
+mips32op("tlbr",    [cpu.bs('01000010000000000000000000000001')], [])
+
+mips32op("cache",   [cpu.bs('101111'), base, oper, s16imm_noarg], [oper, base])
+mips32op("cache",   [cpu.bs('011111'), base, oper, s09imm_noarg, cpu.bs('0100101')], [oper, base])
+
+mips32op("eret",    [cpu.bs('01000010000000000000000000011000')], [])
+
+mips32op("mtlo",    [cpu.bs('000000'), rs, cpu.bs('000000000000000'), cpu.bs('010011')], [rs])
+mips32op("mthi",    [cpu.bs('000000'), rs, cpu.bs('000000000000000'), cpu.bs('010001')], [rs])
+