// SPDX-FileCopyrightText: 2011-2019 pancake <pancake@nopcode.org>
// SPDX-FileCopyrightText: 2011-2019 Roc Valles <vallesroc@gmail.com>
// SPDX-FileCopyrightText: 2011-2019 condret <condr3t@protonmail.com>
// SPDX-FileCopyrightText: 2011-2019 killabyte <killabytenow@gmail.com>
// SPDX-FileCopyrightText: 2022 deroad <wargio@libero.it>
// SPDX-License-Identifier: LGPL-3.0-only

#include "avr_esil.h"
#include <rz_crypto.h>

/** \file avr_esil.c
 * Converts AVR instructions into ESIL statements
 *
 * references:
 * - http://www.atmel.com/images/atmel-0856-avr-instruction-set-manual.pdf
 * - https://en.wikipedia.org/wiki/Atmel_AVR_instruction_set
 */

typedef struct _cpu_const_tag {
	const char *const key;
	ut8 type;
	ut32 value;
	ut8 size;
} CPU_CONST;

#define CPU_CONST_NONE  0
#define CPU_CONST_PARAM 1
#define CPU_CONST_REG   2

typedef struct _cpu_model_tag {
	const char *const model;
	int pc;
	char *inherit;
	struct _cpu_model_tag *inherit_cpu_p;
	CPU_CONST *consts[10];
} CPU_MODEL;

typedef void (*inst_handler_t)(RzAnalysis *analysis, RzAnalysisOp *op, const ut8 *buf, int len, int *fail, CPU_MODEL *cpu);

typedef struct _opcodes_tag_ {
	const char *const name;
	int mask;
	int selector;
	inst_handler_t handler;
	int cycles;
	int size;
	ut64 type;
} OPCODE_DESC;

static OPCODE_DESC *avr_op_analyze(RzAnalysis *analysis, RzAnalysisOp *op, ut64 addr, const ut8 *buf, int len, CPU_MODEL *cpu);

#define CPU_MODEL_DECL(model, pc, consts) \
	{ \
		model, \
			pc, \
			consts \
	}
#define MASK(bits)       ((bits) == 32 ? 0xffffffff : (~((~((ut32)0)) << (bits))))
#define CPU_PC_MASK(cpu) MASK((cpu)->pc)
#define CPU_PC_SIZE(cpu) ((((cpu)->pc) >> 3) + ((((cpu)->pc) & 0x07) ? 1 : 0))

#define INST_HANDLER(OPCODE_NAME) static void _inst__##OPCODE_NAME(RzAnalysis *analysis, RzAnalysisOp *op, const ut8 *buf, int len, int *fail, CPU_MODEL *cpu)
#define INST_DECL(OP, M, SL, C, SZ, T) \
	{ \
		#OP, (M), (SL), _inst__##OP, (C), (SZ), RZ_ANALYSIS_OP_TYPE_##T \
	}
#define INST_LAST \
	{ "unknown", 0, 0, (void *)0, 2, 1, RZ_ANALYSIS_OP_TYPE_UNK }

#define INST_CALL(OPCODE_NAME) _inst__##OPCODE_NAME(analysis, op, buf, len, fail, cpu)
#define INST_INVALID \
	{ \
		*fail = 1; \
		return; \
	}
#define INST_ASSERT(x) \
	{ \
		if (!(x)) { \
			INST_INVALID; \
		} \
	}

#define ESIL_A(e, ...) rz_strbuf_appendf(&op->esil, e, ##__VA_ARGS__)

#define STR_BEGINS(in, s) rz_str_ncasecmp(in, s, strlen(s))

// Following IO definitions are valid for:
//	ATmega8
//	ATmega88
CPU_CONST cpu_reg_common[] = {
	{ "spl", CPU_CONST_REG, 0x3d, sizeof(ut8) },
	{ "sph", CPU_CONST_REG, 0x3e, sizeof(ut8) },
	{ "sreg", CPU_CONST_REG, 0x3f, sizeof(ut8) },
	{ "spmcsr", CPU_CONST_REG, 0x37, sizeof(ut8) },
	{ NULL, 0, 0, 0 },
};

CPU_CONST cpu_memsize_common[] = {
	{ "eeprom_size", CPU_CONST_PARAM, 512, sizeof(ut32) },
	{ "io_size", CPU_CONST_PARAM, 0x40, sizeof(ut32) },
	{ "sram_start", CPU_CONST_PARAM, 0x60, sizeof(ut32) },
	{ "sram_size", CPU_CONST_PARAM, 1024, sizeof(ut32) },
	{ NULL, 0, 0, 0 },
};

CPU_CONST cpu_memsize_m640_m1280m_m1281_m2560_m2561[] = {
	{ "eeprom_size", CPU_CONST_PARAM, 512, sizeof(ut32) },
	{ "io_size", CPU_CONST_PARAM, 0x1ff, sizeof(ut32) },
	{ "sram_start", CPU_CONST_PARAM, 0x200, sizeof(ut32) },
	{ "sram_size", CPU_CONST_PARAM, 0x2000, sizeof(ut32) },
	{ NULL, 0, 0, 0 },
};

CPU_CONST cpu_memsize_xmega128a4u[] = {
	{ "eeprom_size", CPU_CONST_PARAM, 0x800, sizeof(ut32) },
	{ "io_size", CPU_CONST_PARAM, 0x1000, sizeof(ut32) },
	{ "sram_start", CPU_CONST_PARAM, 0x800, sizeof(ut32) },
	{ "sram_size", CPU_CONST_PARAM, 0x2000, sizeof(ut32) },
	{ NULL, 0, 0, 0 },
};

CPU_CONST cpu_pagesize_5_bits[] = {
	{ "page_size", CPU_CONST_PARAM, 5, sizeof(ut8) },
	{ NULL, 0, 0, 0 },
};

CPU_CONST cpu_pagesize_7_bits[] = {
	{ "page_size", CPU_CONST_PARAM, 7, sizeof(ut8) },
	{ NULL, 0, 0, 0 },
};

CPU_MODEL cpu_models[] = {
	{
		.model = "ATmega640",
		.pc = 15,
		.consts = {
			cpu_reg_common,
			cpu_memsize_m640_m1280m_m1281_m2560_m2561,
			cpu_pagesize_7_bits,
			NULL },
	},
	{ .model = "ATxmega128a4u", .pc = 17, .consts = { cpu_reg_common, cpu_memsize_xmega128a4u, cpu_pagesize_7_bits, NULL } },
	{ .model = "ATmega1280", .pc = 16, .inherit = "ATmega640" },
	{ .model = "ATmega1281", .pc = 16, .inherit = "ATmega640" },
	{ .model = "ATmega2560", .pc = 17, .inherit = "ATmega640" },
	{ .model = "ATmega2561", .pc = 17, .inherit = "ATmega640" },
	{ .model = "ATmega88", .pc = 8, .inherit = "ATmega8" },
	//	CPU_MODEL_DECL ("ATmega168",   13, 512, 512),
	// last model is the default AVR - ATmega8 forever!
	{ .model = "ATmega8", .pc = 13, .consts = { cpu_reg_common, cpu_memsize_common, cpu_pagesize_5_bits, NULL } },
};

static CPU_MODEL *get_cpu_model(char *model);

static CPU_MODEL *__get_cpu_model_recursive(char *model) {
	if (!model) {
		return &cpu_models[0];
	}
	CPU_MODEL *cpu = NULL;

	for (cpu = cpu_models; cpu < cpu_models + ((sizeof(cpu_models) / sizeof(CPU_MODEL))) - 1; cpu++) {
		if (!rz_str_casecmp(model, cpu->model)) {
			break;
		}
	}

	// fix inheritance tree
	if (cpu->inherit && !cpu->inherit_cpu_p) {
		cpu->inherit_cpu_p = get_cpu_model(cpu->inherit);
		if (!cpu->inherit_cpu_p) {
			RZ_LOG_ERROR("Cannot inherit from unknown CPU model '%s'.\n", cpu->inherit);
		}
	}

	return cpu;
}

static CPU_MODEL *get_cpu_model(char *model) {
	if (!model) {
		return &cpu_models[0];
	}
	static CPU_MODEL *cpu = NULL;
	// cached value?
	if (cpu && !rz_str_casecmp(model, cpu->model)) {
		return cpu;
	}
	// do the real search
	cpu = __get_cpu_model_recursive(model);
	return cpu;
}

static ut32 const_get_value(CPU_CONST *c) {
	return c ? MASK(c->size * 8) & c->value : 0;
}

static CPU_CONST *const_by_name(CPU_MODEL *cpu, int type, char *c) {
	CPU_CONST **clist, *citem;

	for (clist = cpu->consts; *clist; clist++) {
		for (citem = *clist; citem->key; citem++) {
			if (!strcmp(c, citem->key) && (type == CPU_CONST_NONE || type == citem->type)) {
				return citem;
			}
		}
	}
	if (cpu->inherit_cpu_p) {
		return const_by_name(cpu->inherit_cpu_p, type, c);
	}
	RZ_LOG_ERROR("Cannot find const key[%s].\n", c);
	return NULL;
}

static int __esil_pop_argument(RzAnalysisEsil *esil, ut64 *v) {
	char *t = rz_analysis_esil_pop(esil);
	if (!t || !rz_analysis_esil_get_parm(esil, t, v)) {
		free(t);
		return false;
	}
	free(t);
	return true;
}

static CPU_CONST *const_by_value(CPU_MODEL *cpu, int type, ut32 v) {
	CPU_CONST **clist, *citem;

	for (clist = cpu->consts; *clist; clist++) {
		for (citem = *clist; citem && citem->key; citem++) {
			if (citem->value == (MASK(citem->size * 8) & v) && (type == CPU_CONST_NONE || type == citem->type)) {
				return citem;
			}
		}
	}
	if (cpu->inherit_cpu_p) {
		return const_by_value(cpu->inherit_cpu_p, type, v);
	}
	return NULL;
}

static RzStrBuf *__generic_io_dest(ut8 port, int write, CPU_MODEL *cpu) {
	RzStrBuf *r = rz_strbuf_new("");
	CPU_CONST *c = const_by_value(cpu, CPU_CONST_REG, port);
	if (c != NULL) {
		rz_strbuf_set(r, c->key);
		if (write) {
			rz_strbuf_append(r, ",=");
		}
	} else {
		rz_strbuf_setf(r, "_io,%d,+,%s[1]", port, write ? "=" : "");
	}

	return r;
}

static void __generic_ld_st(RzAnalysisOp *op, char *mem, char ireg, int use_ramp, int prepostdec, int offset, int st) {
	if (ireg) {
		// preincrement index register
		if (prepostdec < 0) {
			ESIL_A("1,%c,-,%c,=,", ireg, ireg);
		}
		// set register index address
		ESIL_A("%c,", ireg);
		// add offset
		if (offset != 0) {
			ESIL_A("%d,+,", offset);
		}
	} else {
		ESIL_A("%d,", offset);
	}
	if (use_ramp) {
		ESIL_A("16,ramp%c,<<,+,", ireg ? ireg : 'd');
	}
	// set SRAM base address
	ESIL_A("_%s,+,", mem);
	// read/write from SRAM
	ESIL_A("%s[1],", st ? "=" : "");
	// postincrement index register
	if (ireg && prepostdec > 0) {
		ESIL_A("1,%c,+,%c,=,", ireg, ireg);
	}
}

static void __generic_pop(RzAnalysisOp *op, int sz) {
	if (sz > 1) {
		ESIL_A("1,sp,+,_ram,+,"); // calc SRAM(sp+1)
		ESIL_A("[%d],", sz); // read value
		ESIL_A("%d,sp,+=,", sz); // sp += item_size
	} else {
		ESIL_A("1,sp,+=," // increment stack pointer
		       "sp,_ram,+,[1],"); // load SRAM[sp]
	}
}

static void __generic_push(RzAnalysisOp *op, int sz) {
	ESIL_A("sp,_ram,+,"); // calc pointer SRAM(sp)
	if (sz > 1) {
		ESIL_A("-%d,+,", sz - 1); // dec SP by 'sz'
	}
	ESIL_A("=[%d],", sz); // store value in stack
	ESIL_A("-%d,sp,+=,", sz); // decrement stack pointer
}

INST_HANDLER(adc) { // ADC Rd, Rr
	// ROL Rd
	if (len < 2) {
		return;
	}
	const ut32 d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 1) << 4);
	const ut32 r = (buf[0] & 0xf) | ((buf[1] & 2) << 3);
	ESIL_A("r%d,cf,+,r%d,+=,", r, d); // Rd + Rr + C
	ESIL_A("$z,zf,:=,");
	ESIL_A("3,$c,hf,:=,");
	ESIL_A("7,$c,cf,:=,");
	ESIL_A("7,$o,vf,:=,");
	ESIL_A("0x80,r%d,&,!,!,nf,:=", d);
}

INST_HANDLER(add) { // ADD Rd, Rr
	// LSL Rd
	if (len < 2) {
		return;
	}
	const ut32 d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 1) << 4);
	const ut32 r = (buf[0] & 0xf) | ((buf[1] & 2) << 3);
	ESIL_A("r%d,r%d,+=,", r, d); // Rd + Rr
	ESIL_A("$z,zf,:=,");
	ESIL_A("3,$c,hf,:=,");
	ESIL_A("7,$c,cf,:=,");
	ESIL_A("7,$o,vf,:=,");
	ESIL_A("0x80,r%d,&,!,!,nf,:=,", d);
}

INST_HANDLER(adiw) { // ADIW Rd+1:Rd, K
	if (len < 1) {
		return;
	}
	const ut32 d = ((buf[0] & 0x30) >> 3) + 24;
	const ut32 k = (buf[0] & 0x0f) | ((buf[0] >> 2) & 0x30);
	ESIL_A("7,r%d,>>,", d + 1); // remember previous highest bit
	ESIL_A("8,%d,8,r%d,<<,r%d,|,+,DUP,r%d,=,>>,r%d,=,", k, d + 1, d, d, d + 1); // Rd+1_Rd + k
										    // FLAGS:
	ESIL_A("DUP,!,7,r%d,>>,&,vf,:=,", d + 1); // V
	ESIL_A("r%d,0x80,&,!,!,nf,:=,", d + 1); // N
	ESIL_A("8,r%d,<<,r%d,|,!,zf,:=,", d + 1, d); // Z
	ESIL_A("7,r%d,>>,!,&,cf,:=,", d + 1); // C
	ESIL_A("vf,nf,^,sf,:="); // S
}

INST_HANDLER(and) { // AND Rd, Rr
	// TST Rd
	if (len < 2) {
		return;
	}
	const ut32 d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 1) << 4);
	const ut32 r = (buf[0] & 0xf) | ((buf[1] & 2) << 3);
	ESIL_A("r%d,r%d,&=,$z,zf,:=,r%d,0x80,&,!,!,nf,:=,0,vf,:=,nf,sf,:=,", r, d, d);
}

INST_HANDLER(andi) { // ANDI Rd, K
	// CBR Rd, K (= ANDI Rd, 1-K)
	if (len < 2) {
		return;
	}
	const ut32 d = ((buf[0] >> 4) & 0xf) + 16;
	const ut32 k = ((buf[1] & 0x0f) << 4) | (buf[0] & 0x0f);
	ESIL_A("%d,r%d,&=,$z,zf,:=,r%d,0x80,&,!,!,nf,:=,0,vf,:=,nf,sf,:=,", k, d, d);
}

INST_HANDLER(asr) { // ASR Rd
	if (len < 2) {
		return;
	}
	int d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 1) << 4);
	ESIL_A("r%d,0x1,&,cf,:=,0x1,r%d,>>,r%d,0x80,&,|,", d, d, d);
	// 0: R=(Rd >> 1) | Rd7
	ESIL_A("$z,zf,:=,"); // Z
	ESIL_A("r%d,0x80,&,!,!,nf,:=,", d); // N
	ESIL_A("nf,cf,^,vf,:=,"); // V
	ESIL_A("nf,vf,^,sf,:=,"); // S
}

INST_HANDLER(bclr) { // BCLR s
	// CLC
	// CLH
	// CLI
	// CLN
	// CLR
	// CLS
	// CLT
	// CLV
	// CLZ
	if (len < 1) {
		return;
	}
	int s = (buf[0] >> 4) & 0x7;
	ESIL_A("0xff,%d,1,<<,^,sreg,&=,", s);
}

INST_HANDLER(bld) { // BLD Rd, b
	if (len < 2) {
		return;
	}
	int d = ((buf[1] & 0x01) << 4) | ((buf[0] >> 4) & 0xf);
	int b = buf[0] & 0x7;
	ESIL_A("r%d,%d,1,<<,0xff,^,&,", d, b); // Rd/b = 0
	ESIL_A("%d,tf,<<,|,r%d,=,", b, d); // Rd/b |= T<<b
}

INST_HANDLER(brbx) { // BRBC s, k
	// BRBS s, k
	// BRBC/S 0:  BRCC  BRCS
	//            BRSH  BRLO
	// BRBC/S 1:  BREQ  BRNE
	// BRBC/S 2:  BRPL  BRMI
	// BRBC/S 3:  BRVC  BRVS
	// BRBC/S 4:  BRGE  BRLT
	// BRBC/S 5:  BRHC  BRHS
	// BRBC/S 6:  BRTC  BRTS
	// BRBC/S 7:  BRID  BRIE
	if (len < 2) {
		return;
	}
	int s = buf[0] & 0x7;
	ut64 jump = op->addr + ((((buf[1] & 0x03) << 6) | ((buf[0] & 0xf8) >> 2)) | (buf[1] & 0x2 ? ~((int)0x7f) : 0)) + 2;
	ESIL_A("%d,1,<<,sreg,&,", s); // SREG(s)
	ESIL_A(buf[1] & 0x4
			? "!," // BRBC => branch if cleared
			: "!,!,"); // BRBS => branch if set
	ESIL_A("?{,%" PFMT64d ",pc,=,},", jump); // ?true => jmp
}

INST_HANDLER(break) { // BREAK
	ESIL_A("BREAK");
}

INST_HANDLER(bset) { // BSET s
	// SEC
	// SEH
	// SEI
	// SEN
	// SER
	// SES
	// SET
	// SEV
	// SEZ
	if (len < 1) {
		return;
	}
	int s = (buf[0] >> 4) & 0x7;
	ESIL_A("%d,1,<<,sreg,|=,", s);
}

INST_HANDLER(bst) { // BST Rd, b
	if (len < 2) {
		return;
	}
	ESIL_A("r%d,%d,1,<<,&,!,!,tf,=,", // tf = Rd/b
		((buf[1] & 1) << 4) | ((buf[0] >> 4) & 0xf), // r
		buf[0] & 0x7); // b
}

INST_HANDLER(call) { // CALL k
	if (len < 4) {
		return;
	}
	ut64 jump = (buf[2] << 1) | (buf[3] << 9) | (buf[1] & 0x01) << 23 | (buf[0] & 0x01) << 17 | (buf[0] & 0xf0) << 14;
	ESIL_A("pc,"); // esil is already pointing to
		       // next instruction (@ret)
	__generic_push(op, CPU_PC_SIZE(cpu)); // push @ret in stack
	ESIL_A("%" PFMT64d ",pc,=,", jump); // jump!
}

INST_HANDLER(cbi) { // CBI A, b
	if (len < 1) {
		return;
	}
	int a = (buf[0] >> 3) & 0x1f;
	int b = buf[0] & 0x07;
	RzStrBuf *io_port;

	// read port a and clear bit b
	io_port = __generic_io_dest(a, 0, cpu);
	ESIL_A("0xff,%d,1,<<,^,%s,&,", b, rz_strbuf_get(io_port));
	rz_strbuf_free(io_port);

	// write result to port a
	io_port = __generic_io_dest(a, 1, cpu);
	ESIL_A("%s,", rz_strbuf_get(io_port));
	rz_strbuf_free(io_port);
}

INST_HANDLER(com) { // COM Rd
	if (len < 2) {
		return;
	}
	int r = ((buf[0] >> 4) & 0x0f) | ((buf[1] & 1) << 4);

	ESIL_A("r%d,0xff,-,r%d,=,$z,zf,:=,0,cf,:=,0,vf,:=,r%d,0x80,&,!,!,nf,:=,vf,nf,^,sf,:=", r, r, r);
	// Rd = 0xFF-Rd
}

INST_HANDLER(cp) { // CP Rd, Rr
	if (len < 2) {
		return;
	}
	const ut32 r = (buf[0] & 0x0f) | ((buf[1] << 3) & 0x10);
	const ut32 d = ((buf[0] >> 4) & 0x0f) | ((buf[1] << 4) & 0x10);
	ESIL_A("r%d,r%d,-,0x80,&,!,!,nf,:=,", r, d);
	ESIL_A("r%d,r%d,==,", r, d);
	ESIL_A("$z,zf,:=,");
	ESIL_A("3,$b,hf,:=,");
	ESIL_A("8,$b,cf,:=,");
	ESIL_A("7,$o,vf,:=,");
	ESIL_A("vf,nf,^,sf,:=");
}

INST_HANDLER(cpc) { // CPC Rd, Rr
	if (len < 2) {
		return;
	}
	const ut32 r = (buf[0] & 0x0f) | ((buf[1] << 3) & 0x10);
	const ut32 d = ((buf[0] >> 4) & 0x0f) | ((buf[1] << 4) & 0x10);

	ESIL_A("cf,r%d,+,DUP,r%d,-,0x80,&,!,!,nf,:=,", r, d); // Rd - Rr - C
	ESIL_A("r%d,==,", d);
	ESIL_A("$z,zf,:=,");
	ESIL_A("3,$b,hf,:=,");
	ESIL_A("8,$b,cf,:=,");
	ESIL_A("7,$o,vf,:=,");
	ESIL_A("vf,nf,^,sf,:=");
}

INST_HANDLER(cpi) { // CPI Rd, K
	if (len < 2) {
		return;
	}
	const ut32 d = ((buf[0] >> 4) & 0xf) + 16;
	const ut32 k = (buf[0] & 0xf) | ((buf[1] & 0xf) << 4);
	ESIL_A("%d,r%d,-,0x80,&,!,!,nf,:=,", k, d); // Rd - k
	ESIL_A("%d,r%d,==,", k, d);
	ESIL_A("$z,zf,:=,");
	ESIL_A("3,$b,hf,:=,");
	ESIL_A("8,$b,cf,:=,");
	ESIL_A("7,$o,vf,:=,");
	ESIL_A("vf,nf,^,sf,:=");
}

INST_HANDLER(cpse) { // CPSE Rd, Rr
	if (len < 2) {
		return;
	}
	int r = (buf[0] & 0xf) | ((buf[1] & 0x2) << 3);
	int d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4);
	ESIL_A("r%d,r%d,^,!,", r, d); // Rr == Rd
	ESIL_A("?{,%" PFMT64d ",pc,=,},", op->jump); // ?true => jmp
}

INST_HANDLER(dec) { // DEC Rd
	if (len < 2) {
		return;
	}
	const ut32 d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4);
	ESIL_A("0x1,r%d,-=,", d); // Rd--
				  // FLAGS:
	ESIL_A("7,$o,vf,:=,"); // V
	ESIL_A("r%d,0x80,&,!,!,nf,:=,", d); // N
	ESIL_A("$z,zf,:=,"); // Z
	ESIL_A("vf,nf,^,sf,:=,"); // S
}

INST_HANDLER(des) { // DES k
	int round = (buf[0] >> 4);
	ESIL_A("%d,des", round);
}

INST_HANDLER(eijmp) { // EIJMP
	ESIL_A("1,z,16,eind,<<,+,<<,pc,=,");
}

INST_HANDLER(eicall) { // EICALL
	// push pc in stack
	ESIL_A("pc,"); // esil is already pointing to
		       // next instruction (@ret)
	__generic_push(op, CPU_PC_SIZE(cpu)); // push @ret in stack
	// do a standard EIJMP
	INST_CALL(eijmp);
}

INST_HANDLER(elpm) { // ELPM
	// ELPM Rd
	// ELPM Rd, Z+
	if (len < 2) {
		return;
	}
	int d = ((buf[1] & 0xfe) == 0x90)
		? ((buf[1] & 1) << 4) | ((buf[0] >> 4) & 0xf) // Rd
		: 0; // R0
	ESIL_A("16,rampz,<<,z,+,_prog,+,[1],"); // read RAMPZ:Z
	ESIL_A("r%d,=,", d); // Rd = [1]
	if ((buf[1] & 0xfe) == 0x90 && (buf[0] & 0xf) == 0x7) {
		ESIL_A("16,1,z,+,DUP,z,=,>>,1,&,rampz,+=,"); // ++(rampz:z)
	}
}

INST_HANDLER(eor) { // EOR Rd, Rr
	// CLR Rd
	if (len < 2) {
		return;
	}
	const ut32 d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 1) << 4);
	const ut32 r = (buf[0] & 0xf) | ((buf[1] & 2) << 3);
	ESIL_A("r%d,r%d,^=,$z,zf,:=,0,vf,:=,r%d,0x80,&,!,!,nf,:=,nf,sf,:=", r, d, d);
	// 0: Rd ^= Rr
}

INST_HANDLER(fmul) { // FMUL Rd, Rr
	if (len < 1) {
		return;
	}
	const ut32 d = ((buf[0] >> 4) & 0x7) + 16;
	const ut32 r = (buf[0] & 0x7) + 16;

	ESIL_A("8,");
	ESIL_A("0xffff,1,r%d,r%d,*,<<,&,DUP,r0,=,>>,r1,=,", r, d); // 0: r1_r0 = (rd * rr) << 1
	ESIL_A("8,r1,<<,r0,|,DUP,0x8000,&,!,!,cf,:=,"); // C = R/15
	ESIL_A("!,zf,:="); // Z = !R
}

INST_HANDLER(fmuls) { // FMULS Rd, Rr
	if (len < 1) {
		return;
	}
	const ut32 d = ((buf[0] >> 4) & 0x7) + 16;
	const ut32 r = (buf[0] & 0x7) + 16;

	ESIL_A("8,1,");
	ESIL_A("r%d,DUP,0x80,&,?{,0xff00,|,},", d); // sign extension Rd
	ESIL_A("r%d,DUP,0x80,&,?{,0xff00,|,},", r); // sign extension Rr
	ESIL_A("*,<<,DUP,r0,=,>>,r1,=,"); // 0: (Rd*Rr)<<1

	ESIL_A("8,r1,<<,r0,|,DUP,0x8000,&,!,!,cf,:=,"); // C = R/16
	ESIL_A("!,zf,:="); // Z = !R
}

INST_HANDLER(fmulsu) { // FMULSU Rd, Rr
	if (len < 1) {
		return;
	}
	const ut32 d = ((buf[0] >> 4) & 0x7) + 16;
	const ut32 r = (buf[0] & 0x7) + 16;

	ESIL_A("8,1,");
	ESIL_A("r%d,DUP,0x80,&,?{,0xff00,|,},", d); // sign extension Rd
	ESIL_A("r%d,*,<<,DUP,r0,=,>>,r1,=,", r); // 0: (Rd*Rr)<<1

	ESIL_A("8,r1,<<,r0,|,DUP,0x8000,&,!,!,cf,:=,"); // C = R/16
	ESIL_A("!,zf,:="); // Z = !R
}

INST_HANDLER(ijmp) { // IJMP k
	// read z for calculating jump address on runtime
	ESIL_A("1,z,<<,pc,=,"); // jump!
}

INST_HANDLER(icall) { // ICALL k
	// push pc in stack
	ESIL_A("pc,"); // esil is already pointing to
		       // next instruction (@ret)
	__generic_push(op, CPU_PC_SIZE(cpu)); // push @ret in stack
	// do a standard IJMP
	INST_CALL(ijmp);
}

INST_HANDLER(in) { // IN Rd, A
	if (len < 2) {
		return;
	}
	int r = ((buf[0] >> 4) & 0x0f) | ((buf[1] & 0x01) << 4);
	int a = (buf[0] & 0x0f) | ((buf[1] & 0x6) << 3);
	RzStrBuf *io_src = __generic_io_dest(a, 0, cpu);
	ESIL_A("%s,r%d,=,", rz_strbuf_get(io_src), r);
	rz_strbuf_free(io_src);
}

INST_HANDLER(inc) { // INC Rd
	if (len < 2) {
		return;
	}
	const ut32 d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4);
	ESIL_A("1,r%d,+=,", d); // Rd++
				// FLAGS:
	ESIL_A("7,$o,vf,:=,"); // V
	ESIL_A("r%d,0x80,&,!,!,nf,:=,", d); // N
	ESIL_A("$z,zf,:=,"); // Z
	ESIL_A("vf,nf,^,sf,:=,"); // S
}

INST_HANDLER(jmp) { // JMP k
	if (len < 4) {
		return;
	}
	ut64 jump = (buf[2] << 1) | (buf[3] << 9) | (buf[1] & 0x01) << 23 | (buf[0] & 0x01) << 17 | (buf[0] & 0xf0) << 14;
	ESIL_A("%" PFMT64d ",pc,=,", jump); // jump!
}

INST_HANDLER(lac) { // LAC Z, Rd
	if (len < 2) {
		return;
	}
	int d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4);

	// read memory from RAMPZ:Z
	__generic_ld_st(op, "ram", 'z', 1, 0, 0, 0); // 0: Read (RAMPZ:Z)
	ESIL_A("r%d,0xff,^,&,", d); // 0: (Z) & ~Rd
	ESIL_A("DUP,r%d,=,", d); // Rd = [0]
	__generic_ld_st(op, "ram", 'z', 1, 0, 0, 1); // Store in RAM
}

INST_HANDLER(las) { // LAS Z, Rd
	if (len < 2) {
		return;
	}
	int d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4);

	// read memory from RAMPZ:Z
	__generic_ld_st(op, "ram", 'z', 1, 0, 0, 0); // 0: Read (RAMPZ:Z)
	ESIL_A("r%d,|,", d); // 0: (Z) | Rd
	ESIL_A("DUP,r%d,=,", d); // Rd = [0]
	__generic_ld_st(op, "ram", 'z', 1, 0, 0, 1); // Store in RAM
}

INST_HANDLER(lat) { // LAT Z, Rd
	if (len < 2) {
		return;
	}
	int d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4);

	// read memory from RAMPZ:Z
	__generic_ld_st(op, "ram", 'z', 1, 0, 0, 0); // 0: Read (RAMPZ:Z)
	ESIL_A("r%d,^,", d); // 0: (Z) ^ Rd
	ESIL_A("DUP,r%d,=,", d); // Rd = [0]
	__generic_ld_st(op, "ram", 'z', 1, 0, 0, 1); // Store in RAM
}

INST_HANDLER(ld) { // LD Rd, X
	// LD Rd, X+
	// LD Rd, -X
	if (len < 2) {
		return;
	}
	// read memory
	__generic_ld_st(
		op, "ram",
		'x', // use index register X
		0, // no use RAMP* registers
		(buf[0] & 0xf) == 0xe
			? -1 // pre decremented
			: (buf[0] & 0xf) == 0xd
			? 1 // post incremented
			: 0, // no increment
		0, // offset always 0
		0); // load operation (!st)
	// load register
	ESIL_A("r%d,=,", ((buf[1] & 1) << 4) | ((buf[0] >> 4) & 0xf));
}

INST_HANDLER(ldd) { // LD Rd, Y	LD Rd, Z
	// LD Rd, Y+	LD Rd, Z+
	// LD Rd, -Y	LD Rd, -Z
	// LD Rd, Y+q	LD Rd, Z+q
	if (len < 2) {
		return;
	}
	// calculate offset (this value only has sense in some opcodes,
	// but we are optimistic and we calculate it always)
	int offset = (buf[1] & 0x20) | ((buf[1] & 0xc) << 1) | (buf[0] & 0x7);
	// read memory
	__generic_ld_st(
		op, "ram",
		buf[0] & 0x8 ? 'y' : 'z', // index register Y/Z
		0, // no use RAMP* registers
		!(buf[1] & 0x10)
			? 0 // no increment
			: buf[0] & 0x1
			? 1 // post incremented
			: -1, // pre decremented
		!(buf[1] & 0x10) ? offset : 0, // offset or not offset
		0); // load operation (!st)
	// load register
	ESIL_A("r%d,=,", ((buf[1] & 1) << 4) | ((buf[0] >> 4) & 0xf));
}

INST_HANDLER(ldi) { // LDI Rd, K
	if (len < 2) {
		return;
	}
	int k = (buf[0] & 0xf) + ((buf[1] & 0xf) << 4);
	int d = ((buf[0] >> 4) & 0xf) + 16;
	ESIL_A("0x%x,r%d,=,", k, d);
}

INST_HANDLER(lds) { // LDS Rd, k
	if (len < 4) {
		return;
	}
	int d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4);
	int k = (buf[3] << 8) | buf[2];

	// load value from RAMPD:k
	__generic_ld_st(op, "ram", 0, 1, 0, k, 0);
	ESIL_A("r%d,=,", d);
}

INST_HANDLER(sts) { // STS k, Rr
	if (len < 4) {
		return;
	}
	int r = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4);
	int k = (buf[3] << 8) | buf[2];

	ESIL_A("r%d,", r);
	__generic_ld_st(op, "ram", 0, 1, 0, k, 1);
}

INST_HANDLER(lpm) { // LPM
	// LPM Rd, Z
	// LPM Rd, Z+
	if (len < 2) {
		return;
	}
	ut16 ins = (((ut16)buf[1]) << 8) | ((ut16)buf[0]);
	// read program memory
	__generic_ld_st(
		op, "prog",
		'z', // index register Y/Z
		1, // use RAMP* registers
		(ins & 0xfe0f) == 0x9005
			? 1 // post incremented
			: 0, // no increment
		0, // not offset
		0); // load operation (!st)
	// load register
	ESIL_A("r%d,=,",
		(ins == 0x95c8)
			? 0 // LPM (r0)
			: ((buf[0] >> 4) & 0xf) // LPM Rd
				| ((buf[1] & 0x1) << 4));
}

INST_HANDLER(lsr) { // LSR Rd
	if (len < 2) {
		return;
	}
	const ut32 d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 1) << 4);
	ESIL_A("r%d,0x1,&,cf,:=,", d); // C = Rd0
	ESIL_A("1,r%d,>>=,", d); // 0: R=(Rd >> 1)
	ESIL_A("$z,zf,:=,"); // Z
	ESIL_A("0,nf,:=,"); // N
	ESIL_A("cf,vf,:=,"); // V
	ESIL_A("cf,sf,:=,"); // S
}

INST_HANDLER(mov) { // MOV Rd, Rr
	if (len < 2) {
		return;
	}
	const ut32 d = ((buf[1] << 4) & 0x10) | ((buf[0] >> 4) & 0x0f);
	const ut32 r = ((buf[1] << 3) & 0x10) | (buf[0] & 0x0f);
	ESIL_A("r%d,r%d,=,", r, d);
}

INST_HANDLER(movw) { // MOVW Rd+1:Rd, Rr+1:Rr
	if (len < 1) {
		return;
	}
	const ut32 d = (buf[0] & 0xf0) >> 3;
	const ut32 r = (buf[0] & 0x0f) << 1;
	ESIL_A("r%d,r%d,=,r%d,r%d,=,", r, d, r + 1, d + 1);
}

INST_HANDLER(mul) { // MUL Rd, Rr
	if (len < 2) {
		return;
	}
	const ut32 d = ((buf[1] << 4) & 0x10) | ((buf[0] >> 4) & 0x0f);
	const ut32 r = ((buf[1] << 3) & 0x10) | (buf[0] & 0x0f);

	ESIL_A("8,r%d,r%d,*,DUP,r0,=,>>,r1,=,", r, d); // 0: r1_r0 = rd * rr
	ESIL_A("8,r1,<<,r0,|,DUP,0x8000,&,!,!,cf,:=,"); // C = R/15
	ESIL_A("!,zf,:="); // Z = !R
}

INST_HANDLER(muls) { // MULS Rd, Rr
	if (len < 1) {
		return;
	}
	const ut32 d = (buf[0] >> 4 & 0x0f) + 16;
	const ut32 r = (buf[0] & 0x0f) + 16;

	ESIL_A("8,");
	ESIL_A("r%d,DUP,0x80,&,?{,0xff00,|,},", d); // sign extension Rd
	ESIL_A("r%d,DUP,0x80,&,?{,0xff00,|,},", r); // sign extension Rr
	ESIL_A("*,DUP,r0,=,>>,r1,=,"); // 0: (Rd*Rr)

	ESIL_A("8,r1,<<,r0,|,DUP,0x8000,&,!,!,cf,:=,"); // C = R/16
	ESIL_A("!,zf,:="); // Z = !R
}

INST_HANDLER(mulsu) { // MULSU Rd, Rr
	if (len < 1) {
		return;
	}
	const ut32 d = (buf[0] >> 4 & 0x07) + 16;
	const ut32 r = (buf[0] & 0x07) + 16;

	ESIL_A("8,");
	ESIL_A("r%d,DUP,0x80,&,?{,0xff00,|,},", d); // sign extension Rd
	ESIL_A("r%d,*,DUP,r0,=,>>,r1,=,", r); // 0: (Rd*Rr)

	ESIL_A("8,r1,<<,r0,|,DUP,0x8000,&,!,!,cf,:=,"); // C = R/16
	ESIL_A("!,zf,:="); // Z = !R
}

INST_HANDLER(neg) { // NEG Rd
	if (len < 2) {
		return;
	}
	int d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 1) << 4);
	ESIL_A("r%d,0x00,-,0xff,&,", d); // 0: (0-Rd)
	ESIL_A("DUP,r%d,0xff,^,|,0x08,&,!,!,hf,=,", d); // H
	ESIL_A("DUP,0x80,-,!,vf,=,"); // V
	ESIL_A("DUP,0x80,&,!,!,nf,=,"); // N
	ESIL_A("DUP,!,zf,=,"); // Z
	ESIL_A("DUP,!,!,cf,=,"); // C
	ESIL_A("vf,nf,^,sf,=,"); // S
	ESIL_A("r%d,=,", d); // Rd = result
}

INST_HANDLER(nop) { // NOP
	ESIL_A(",,");
}

INST_HANDLER(or) { // OR Rd, Rr
	if (len < 2) {
		return;
	}
	int d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 1) << 4);
	int r = (buf[0] & 0xf) | ((buf[1] & 2) << 3);
	ESIL_A("r%d,r%d,|=,", r, d); // 0: (Rd | Rr)
	ESIL_A("$z,zf,:=,"); // Z
	ESIL_A("r%d,&,!,!,nf,:=,", d); // N
	ESIL_A("0,vf,:=,"); // V
	ESIL_A("nf,sf,:="); // S
}

INST_HANDLER(ori) { // ORI Rd, K
	// SBR Rd, K
	if (len < 2) {
		return;
	}
	const ut32 d = ((buf[0] >> 4) & 0xf) + 16;
	const ut32 k = (buf[0] & 0xf) | ((buf[1] & 0xf) << 4);
	ESIL_A("%d,r%d,|=,", k, d); // 0: (Rd | k)
	ESIL_A("$z,zf,:=,"); // Z
	ESIL_A("r%d,0x80,&,!,!,nf,:=,", d); // N
	ESIL_A("0,vf,:=,"); // V
	ESIL_A("nf,sf,:="); // S
}

INST_HANDLER(out) { // OUT A, Rr
	if (len < 2) {
		return;
	}
	int r = ((buf[0] >> 4) & 0x0f) | ((buf[1] & 0x01) << 4);
	int a = (buf[0] & 0x0f) | ((buf[1] & 0x6) << 3);
	RzStrBuf *io_dst = __generic_io_dest(a, 1, cpu);
	ESIL_A("r%d,%s,", r, rz_strbuf_get(io_dst));
	rz_strbuf_free(io_dst);
}

INST_HANDLER(pop) { // POP Rd
	if (len < 2) {
		return;
	}
	int d = ((buf[1] & 0x1) << 4) | ((buf[0] >> 4) & 0xf);
	__generic_pop(op, 1);
	ESIL_A("r%d,=,", d); // store in Rd
}

INST_HANDLER(push) { // PUSH Rr
	if (len < 2) {
		return;
	}
	int r = ((buf[1] & 0x1) << 4) | ((buf[0] >> 4) & 0xf);
	ESIL_A("r%d,", r); // load Rr
	__generic_push(op, 1); // push it into stack
}

INST_HANDLER(rcall) { // RCALL k
	if (len < 2) {
		return;
	}
	// target address
	ut64 jump = op->addr + ((((((buf[1] & 0xf) << 8) | buf[0]) << 1) | (((buf[1] & 0x8) ? ~((int)0x1fff) : 0))) + 2);
	// esil
	ESIL_A("pc,"); // esil already points to next
		       // instruction (@ret)
	__generic_push(op, CPU_PC_SIZE(cpu)); // push @ret addr
	ESIL_A("%" PFMT64d ",pc,=,", jump); // jump!
}

INST_HANDLER(ret) { // RET
	// esil
	__generic_pop(op, CPU_PC_SIZE(cpu));
	ESIL_A("pc,=,"); // jump!
}

INST_HANDLER(reti) { // RETI
	// first perform a standard 'ret'
	INST_CALL(ret);

	// RETI: The I-bit is cleared by hardware after an interrupt
	// has occurred, and is set by the RETI instruction to enable
	// subsequent interrupts
	ESIL_A("1,if,=,");
}

INST_HANDLER(rjmp) { // RJMP k
	st32 loc = (((((buf[1] & 0xf) << 9) | (buf[0] << 1))) | (buf[1] & 0x8 ? ~(0x1fff) : 0)) + 2;
	ut64 jump = op->addr + loc;
	ESIL_A("%" PFMT64d ",pc,=,", jump);
}

INST_HANDLER(ror) { // ROR Rd
	const ut32 d = ((buf[0] >> 4) & 0x0f) | ((buf[1] << 4) & 0x10);
	ESIL_A("cf,nf,:=,"); // N
	ESIL_A("r%d,0x1,&,", d); // C
	ESIL_A("1,r%d,>>,7,cf,<<,|,r%d,=,cf,:=,", d, d); // 0: (Rd>>1) | (cf<<7)
	ESIL_A("$z,zf,:=,"); // Z
	ESIL_A("nf,cf,^,vf,:=,"); // V
	ESIL_A("vf,nf,^,sf,:="); // S
}

INST_HANDLER(sbc) { // SBC Rd, Rr
	if (len < 2) {
		return;
	}
	const ut32 r = (buf[0] & 0x0f) | ((buf[1] & 0x2) << 3);
	const ut32 d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4);

	ESIL_A("cf,r%d,+,r%d,-=,", r, d); // 0: (Rd-Rr-C)
	ESIL_A("$z,zf,:=,");
	ESIL_A("3,$b,hf,:=,");
	ESIL_A("8,$b,cf,:=,");
	ESIL_A("7,$o,vf,:=,");
	ESIL_A("0x80,r%d,&,!,!,nf,:=,", d);
	ESIL_A("vf,nf,^,sf,:=");
}

INST_HANDLER(sbci) { // SBCI Rd, k
	if (len < 2) {
		return;
	}
	const ut32 d = ((buf[0] >> 4) & 0xf) + 16;
	const ut32 k = ((buf[1] & 0xf) << 4) | (buf[0] & 0xf);

	ESIL_A("cf,%d,+,r%d,-=,", k, d); // 0: (Rd-k-C)
	ESIL_A("$z,zf,:=,");
	ESIL_A("3,$b,hf,:=,");
	ESIL_A("8,$b,cf,:=,");
	ESIL_A("7,$o,vf,:=,");
	ESIL_A("0x80,r%d,&,!,!,nf,:=,", d);
	ESIL_A("vf,nf,^,sf,:=");
}

INST_HANDLER(sub) { // SUB Rd, Rr
	if (len < 2) {
		return;
	}
	const ut32 d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 1) << 4);
	const ut32 r = (buf[0] & 0xf) | ((buf[1] & 2) << 3);

	ESIL_A("r%d,r%d,-=,", r, d); // 0: (Rd-k)
	ESIL_A("$z,zf,:=,");
	ESIL_A("3,$b,hf,:=,");
	ESIL_A("8,$b,cf,:=,");
	ESIL_A("7,$o,vf,:=,");
	ESIL_A("0x80,r%d,&,!,!,nf,:=,", d);
	ESIL_A("vf,nf,^,sf,:=");
}

INST_HANDLER(subi) { // SUBI Rd, k
	if (len < 2) {
		return;
	}
	const ut32 d = ((buf[0] >> 4) & 0xf) + 16;
	const ut32 k = ((buf[1] & 0xf) << 4) | (buf[0] & 0xf);

	ESIL_A("%d,r%d,-=,", k, d); // 0: (Rd-k)
	ESIL_A("$z,zf,:=,");
	ESIL_A("3,$b,hf,:=,");
	ESIL_A("8,$b,cf,:=,");
	ESIL_A("7,$o,vf,:=,");
	ESIL_A("0x80,r%d,&,!,!,nf,:=,", d);
	ESIL_A("vf,nf,^,sf,:=");
}

INST_HANDLER(sbi) { // SBI A, b
	if (len < 1) {
		return;
	}
	int a = (buf[0] >> 3) & 0x1f;
	int b = buf[0] & 0x07;
	RzStrBuf *io_port;

	// read port a and clear bit b
	io_port = __generic_io_dest(a, 0, cpu);
	ESIL_A("0xff,%d,1,<<,|,%s,&,", b, rz_strbuf_get(io_port));
	rz_strbuf_free(io_port);

	// write result to port a
	io_port = __generic_io_dest(a, 1, cpu);
	ESIL_A("%s,", rz_strbuf_get(io_port));
	rz_strbuf_free(io_port);
}

INST_HANDLER(sbix) { // SBIC A, b
	// SBIS A, b
	if (len < 2) {
		return;
	}
	int a = (buf[0] >> 3) & 0x1f;
	int b = buf[0] & 0x07;
	RzStrBuf *io_port;

	// read port a and clear bit b
	io_port = __generic_io_dest(a, 0, cpu);
	ESIL_A("%d,1,<<,%s,&,", b, rz_strbuf_get(io_port)); // IO(A,b)
	ESIL_A((buf[1] & 0xe) == 0xc
			? "!," // SBIC => branch if 0
			: "!,!,"); // SBIS => branch if 1
	ESIL_A("?{,%" PFMT64d ",pc,=,},", op->jump); // ?true => jmp
	rz_strbuf_free(io_port);
}

INST_HANDLER(sbiw) { // SBIW Rd+1:Rd, K
	if (len < 1) {
		return;
	}
	int d = ((buf[0] & 0x30) >> 3) + 24;
	int k = (buf[0] & 0xf) | ((buf[0] >> 2) & 0x30);
	ESIL_A("7,r%d,>>,", d + 1); // remember previous highest bit
	ESIL_A("8,%d,8,r%d,<<,r%d,|,-,DUP,r%d,=,>>,r%d,=,", k, d + 1, d, d, d + 1); // 0(Rd+1_Rd - k)
	ESIL_A("$z,zf,:=,");
	ESIL_A("DUP,!,7,r%d,>>,&,cf,:=,", d + 1); // C
	ESIL_A("r%d,0x80,&,!,!,nf,:=,", d + 1); // N
	ESIL_A("7,r%d,>>,!,&,vf,:=,", d + 1); // V
	ESIL_A("vf,nf,^,sf,:="); // S
}

INST_HANDLER(sbrx) { // SBRC Rr, b
	// SBRS Rr, b
	if (len < 2) {
		return;
	}
	int b = buf[0] & 0x7;
	int r = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x01) << 4);
	ESIL_A("%d,1,<<,r%d,&,", b, r); // Rr(b)
	ESIL_A((buf[1] & 0xe) == 0xc
			? "!," // SBRC => branch if cleared
			: "!,!,"); // SBRS => branch if set
	ESIL_A("?{,%" PFMT64d ",pc,=,},", op->jump); // ?true => jmp
}

INST_HANDLER(sleep) { // SLEEP
	ESIL_A("BREAK");
}

INST_HANDLER(spm) { // SPM Z+
	ut64 spmcsr;

	// read SPM Control Register (SPMCR)
	rz_analysis_esil_reg_read(analysis->esil, "spmcsr", &spmcsr, NULL);

	// clear SPMCSR
	ESIL_A("0x7c,spmcsr,&=,");

	// decide action depending on the old value of SPMCSR
	switch (spmcsr & 0x7f) {
	case 0x03: // PAGE ERASE
		// invoke SPM_CLEAR_PAGE (erases target page writing
		// the 0xff value
		ESIL_A("16,rampz,<<,z,+,"); // push target address
		ESIL_A("SPM_PAGE_ERASE,"); // do magic
		break;

	case 0x01: // FILL TEMPORARY BUFFER
		ESIL_A("r1,r0,"); // push data
		ESIL_A("z,"); // push target address
		ESIL_A("SPM_PAGE_FILL,"); // do magic
		break;

	case 0x05: // WRITE PAGE
		ESIL_A("16,rampz,<<,z,+,"); // push target address
		ESIL_A("SPM_PAGE_WRITE,"); // do magic
		break;

	default:
		RZ_LOG_DEBUG("SPM: I dont know what to do with SPMCSR %02" PFMT64x ".\n", spmcsr);
		break;
	}
}

INST_HANDLER(st) { // ST X, Rr
	// ST X+, Rr
	// ST -X, Rr
	if (len < 2) {
		return;
	}
	// load register
	ESIL_A("r%d,", ((buf[1] & 1) << 4) | ((buf[0] >> 4) & 0xf));
	// write in memory
	__generic_ld_st(
		op, "ram",
		'x', // use index register X
		0, // no use RAMP* registers
		(buf[0] & 0xf) == 0xe
			? -1 // pre decremented
			: (buf[0] & 0xf) == 0xd
			? 1 // post increment
			: 0, // no increment
		0, // offset always 0
		1); // store operation (st)
}

INST_HANDLER(std) { // ST Y, Rr	ST Z, Rr
	// ST Y+, Rr	ST Z+, Rr
	// ST -Y, Rr	ST -Z, Rr
	// ST Y+q, Rr	ST Z+q, Rr
	if (len < 2) {
		return;
	}
	// load register
	ESIL_A("r%d,", ((buf[1] & 1) << 4) | ((buf[0] >> 4) & 0xf));
	// write in memory
	__generic_ld_st(
		op, "ram",
		buf[0] & 0x8 ? 'y' : 'z', // index register Y/Z
		0, // no use RAMP* registers
		!(buf[1] & 0x10)
			? 0 // no increment
			: buf[0] & 0x1
			? 1 // post incremented
			: -1, // pre decremented
		!(buf[1] & 0x10)
			? (buf[1] & 0x20) // offset
				| ((buf[1] & 0xc) << 1) | (buf[0] & 0x7)
			: 0, // no offset
		1); // load operation (!st)
}

INST_HANDLER(swap) { // SWAP Rd
	if (len < 2) {
		return;
	}
	int d = ((buf[1] & 0x1) << 4) | ((buf[0] >> 4) & 0xf);
	ESIL_A("4,r%d,>>,0x0f,&,", d); // (Rd >> 4) & 0xf
	ESIL_A("4,r%d,<<,0xf0,&,", d); // (Rd >> 4) & 0xf
	ESIL_A("|,"); // S[0] | S[1]
	ESIL_A("r%d,=,", d); // Rd = result
}

OPCODE_DESC opcodes[] = {
	//         op     mask    select  cycles  size type
	INST_DECL(break, 0xffff, 0x9698, 1, 2, TRAP), // BREAK
	INST_DECL(eicall, 0xffff, 0x9519, 0, 2, UCALL), // EICALL
	INST_DECL(eijmp, 0xffff, 0x9419, 0, 2, UJMP), // EIJMP
	INST_DECL(icall, 0xffff, 0x9509, 0, 2, UCALL), // ICALL
	INST_DECL(ijmp, 0xffff, 0x9409, 0, 2, UJMP), // IJMP
	INST_DECL(lpm, 0xffff, 0x95c8, 3, 2, LOAD), // LPM
	INST_DECL(nop, 0xffff, 0x0000, 1, 2, NOP), // NOP
	INST_DECL(ret, 0xffff, 0x9508, 4, 2, RET), // RET
	INST_DECL(reti, 0xffff, 0x9518, 4, 2, RET), // RETI
	INST_DECL(sleep, 0xffff, 0x9588, 1, 2, NOP), // SLEEP
	INST_DECL(spm, 0xffff, 0x95e8, 1, 2, TRAP), // SPM ...
	INST_DECL(bclr, 0xff8f, 0x9488, 1, 2, MOV), // BCLR s
	INST_DECL(bset, 0xff8f, 0x9408, 1, 2, MOV), // BSET s
	INST_DECL(fmul, 0xff88, 0x0308, 2, 2, MUL), // FMUL Rd, Rr
	INST_DECL(fmuls, 0xff88, 0x0380, 2, 2, MUL), // FMULS Rd, Rr
	INST_DECL(fmulsu, 0xff88, 0x0388, 2, 2, MUL), // FMULSU Rd, Rr
	INST_DECL(mulsu, 0xff88, 0x0300, 2, 2, AND), // MUL Rd, Rr
	INST_DECL(des, 0xff0f, 0x940b, 0, 2, CRYPTO), // DES k
	INST_DECL(adiw, 0xff00, 0x9600, 2, 2, ADD), // ADIW Rd+1:Rd, K
	INST_DECL(sbiw, 0xff00, 0x9700, 2, 2, SUB), // SBIW Rd+1:Rd, K
	INST_DECL(cbi, 0xff00, 0x9800, 1, 2, IO), // CBI A, K
	INST_DECL(sbi, 0xff00, 0x9a00, 1, 2, IO), // SBI A, K
	INST_DECL(movw, 0xff00, 0x0100, 1, 2, MOV), // MOVW Rd+1:Rd, Rr+1:Rr
	INST_DECL(muls, 0xff00, 0x0200, 2, 2, AND), // MUL Rd, Rr
	INST_DECL(asr, 0xfe0f, 0x9405, 1, 2, SAR), // ASR Rd
	INST_DECL(com, 0xfe0f, 0x9400, 1, 2, NOT), // COM Rd
	INST_DECL(dec, 0xfe0f, 0x940a, 1, 2, SUB), // DEC Rd
	INST_DECL(elpm, 0xfe0f, 0x9006, 0, 2, LOAD), // ELPM Rd, Z
	INST_DECL(elpm, 0xfe0f, 0x9007, 0, 2, LOAD), // ELPM Rd, Z+
	INST_DECL(inc, 0xfe0f, 0x9403, 1, 2, ADD), // INC Rd
	INST_DECL(lac, 0xfe0f, 0x9206, 2, 2, LOAD), // LAC Z, Rd
	INST_DECL(las, 0xfe0f, 0x9205, 2, 2, LOAD), // LAS Z, Rd
	INST_DECL(lat, 0xfe0f, 0x9207, 2, 2, LOAD), // LAT Z, Rd
	INST_DECL(ld, 0xfe0f, 0x900c, 0, 2, LOAD), // LD Rd, X
	INST_DECL(ld, 0xfe0f, 0x900d, 0, 2, LOAD), // LD Rd, X+
	INST_DECL(ld, 0xfe0f, 0x900e, 0, 2, LOAD), // LD Rd, -X
	INST_DECL(lds, 0xfe0f, 0x9000, 0, 4, LOAD), // LDS Rd, k
	INST_DECL(sts, 0xfe0f, 0x9200, 2, 4, STORE), // STS k, Rr
	INST_DECL(lpm, 0xfe0f, 0x9004, 3, 2, LOAD), // LPM Rd, Z
	INST_DECL(lpm, 0xfe0f, 0x9005, 3, 2, LOAD), // LPM Rd, Z+
	INST_DECL(lsr, 0xfe0f, 0x9406, 1, 2, SHR), // LSR Rd
	INST_DECL(neg, 0xfe0f, 0x9401, 2, 2, SUB), // NEG Rd
	INST_DECL(pop, 0xfe0f, 0x900f, 2, 2, POP), // POP Rd
	INST_DECL(push, 0xfe0f, 0x920f, 0, 2, PUSH), // PUSH Rr
	INST_DECL(ror, 0xfe0f, 0x9407, 1, 2, SAR), // ROR Rd
	INST_DECL(st, 0xfe0f, 0x920c, 2, 2, STORE), // ST X, Rr
	INST_DECL(st, 0xfe0f, 0x920d, 0, 2, STORE), // ST X+, Rr
	INST_DECL(st, 0xfe0f, 0x920e, 0, 2, STORE), // ST -X, Rr
	INST_DECL(swap, 0xfe0f, 0x9402, 1, 2, SAR), // SWAP Rd
	INST_DECL(call, 0xfe0e, 0x940e, 0, 4, CALL), // CALL k
	INST_DECL(jmp, 0xfe0e, 0x940c, 2, 4, JMP), // JMP k
	INST_DECL(bld, 0xfe08, 0xf800, 1, 2, MOV), // BLD Rd, b
	INST_DECL(bst, 0xfe08, 0xfa00, 1, 2, MOV), // BST Rd, b
	INST_DECL(sbix, 0xff00, 0x9900, 2, 2, CJMP), // SBIC A, b
	INST_DECL(sbix, 0xff00, 0x9b00, 2, 2, CJMP), // SBIS A, b
	INST_DECL(sbrx, 0xfe08, 0xfc00, 2, 2, CJMP), // SBRC Rr, b
	INST_DECL(sbrx, 0xfe08, 0xfe00, 2, 2, CJMP), // SBRS Rr, b
	INST_DECL(ldd, 0xfe07, 0x9001, 0, 2, LOAD), // LD Rd, Y/Z+
	INST_DECL(ldd, 0xfe07, 0x9002, 0, 2, LOAD), // LD Rd, -Y/Z
	INST_DECL(std, 0xfe07, 0x9201, 0, 2, STORE), // ST Y/Z+, Rr
	INST_DECL(std, 0xfe07, 0x9202, 0, 2, STORE), // ST -Y/Z, Rr
	INST_DECL(adc, 0xfc00, 0x1c00, 1, 2, ADD), // ADC Rd, Rr
	INST_DECL(add, 0xfc00, 0x0c00, 1, 2, ADD), // ADD Rd, Rr
	INST_DECL(and, 0xfc00, 0x2000, 1, 2, AND), // AND Rd, Rr
	INST_DECL(brbx, 0xfc00, 0xf000, 0, 2, CJMP), // BRBS s, k
	INST_DECL(brbx, 0xfc00, 0xf400, 0, 2, CJMP), // BRBC s, k
	INST_DECL(cp, 0xfc00, 0x1400, 1, 2, CMP), // CP Rd, Rr
	INST_DECL(cpc, 0xfc00, 0x0400, 1, 2, CMP), // CPC Rd, Rr
	INST_DECL(cpse, 0xfc00, 0x1000, 0, 2, CJMP), // CPSE Rd, Rr
	INST_DECL(eor, 0xfc00, 0x2400, 1, 2, XOR), // EOR Rd, Rr
	INST_DECL(mov, 0xfc00, 0x2c00, 1, 2, MOV), // MOV Rd, Rr
	INST_DECL(mul, 0xfc00, 0x9c00, 2, 2, AND), // MUL Rd, Rr
	INST_DECL(or, 0xfc00, 0x2800, 1, 2, OR), // OR Rd, Rr
	INST_DECL(sbc, 0xfc00, 0x0800, 1, 2, SUB), // SBC Rd, Rr
	INST_DECL(sub, 0xfc00, 0x1800, 1, 2, SUB), // SUB Rd, Rr
	INST_DECL(in, 0xf800, 0xb000, 1, 2, IO), // IN Rd, A
	INST_DECL(out, 0xf800, 0xb800, 1, 2, IO), // OUT A, Rr
	INST_DECL(andi, 0xf000, 0x7000, 1, 2, AND), // ANDI Rd, K
	INST_DECL(cpi, 0xf000, 0x3000, 1, 2, CMP), // CPI Rd, K
	INST_DECL(ldi, 0xf000, 0xe000, 1, 2, LOAD), // LDI Rd, K
	INST_DECL(ori, 0xf000, 0x6000, 1, 2, OR), // ORI Rd, K
	INST_DECL(rcall, 0xf000, 0xd000, 0, 2, CALL), // RCALL k
	INST_DECL(rjmp, 0xf000, 0xc000, 2, 2, JMP), // RJMP k
	INST_DECL(sbci, 0xf000, 0x4000, 1, 2, SUB), // SBC Rd, Rr
	INST_DECL(subi, 0xf000, 0x5000, 1, 2, SUB), // SUBI Rd, Rr
	INST_DECL(ldd, 0xd200, 0x8000, 0, 2, LOAD), // LD Rd, Y/Z+q
	INST_DECL(std, 0xd200, 0x8200, 0, 2, STORE), // ST Y/Z+q, Rr
	// INST_DECL(lds16,  0xf800, 0xa000, 1, 2, LOAD), // LDS Rd, k

	INST_LAST
};

static OPCODE_DESC *avr_op_analyze(RzAnalysis *analysis, RzAnalysisOp *op, ut64 addr, const ut8 *buf, int len, CPU_MODEL *cpu) {
	OPCODE_DESC *opcode_desc;
	if (len < 2) {
		return NULL;
	}
	ut16 ins = (buf[1] << 8) | buf[0];
	int fail;
	char *t;

	// process opcode
	for (opcode_desc = opcodes; opcode_desc->handler; opcode_desc++) {
		if ((ins & opcode_desc->mask) == opcode_desc->selector) {
			fail = 0;

			// start void esil expression
			rz_strbuf_set(&op->esil, "");

			// handle opcode
			opcode_desc->handler(analysis, op, buf, len, &fail, cpu);
			if (fail) {
				break;
			} else if (opcode_desc->cycles <= 0) {
				opcode_desc->cycles = 2;
			}

			// remove trailing coma (COMETE LA COMA)
			t = rz_strbuf_get(&op->esil);
			if (t && strlen(t) > 1) {
				t += strlen(t) - 1;
				if (*t == ',') {
					*t = '\0';
				}
			}

			return opcode_desc;
		}
	}

	return NULL;
}

static bool avr_custom_des(RzAnalysisEsil *esil) {
	if (!esil || !esil->analysis || !esil->analysis->reg) {
		return false;
	}
	ut64 arg;
	if (!__esil_pop_argument(esil, &arg)) {
		return false;
	}
	int round = arg;
	if (round < 0 || round > 15) {
		return false;
	}
	ut64 decrypt;
	rz_analysis_esil_reg_read(esil, "hf", &decrypt, NULL);
	if (decrypt) {
		round = 15 - round;
	}
	ut8 regs[0x10];
	static const char *reg_names[] = {
		"r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
		"r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
	};
	for (size_t i = 0; i < sizeof(regs); i++) {
		ut64 v = 0;
		rz_analysis_esil_reg_read(esil, reg_names[i], &v, NULL);
		regs[i] = v;
	}

	// Atmel's "AVR Instruction Set Manual" unfortunately is very ambiguous
	// regarding the details of this instruction and leaves the most interesting
	// questions open, especially what intermediate results are stored and how.
	// The below implementation has been developed based on observing the exact
	// results in the Simulator in Atmel/Microchip Studio emulating ATxmega128A1.
	// Things may seem very strange (especially hi/lo swapping), but it is all
	// intended to get the right behavior!
	ut32 buf_hi = rz_read_at_le32(regs, 0);
	ut32 buf_lo = rz_read_at_le32(regs, 4);
	ut32 key_orig_hi = rz_read_at_le32(regs, 8);
	ut32 key_orig_lo = rz_read_at_le32(regs, 0xc);
	ut32 key_lo = key_orig_lo;
	ut32 key_hi = key_orig_hi;
	rz_des_permute_key(&key_lo, &key_hi);
	int i = round;
	if (!decrypt) {
		rz_des_shift_key(i, false, &key_lo, &key_hi);
	}
	ut32 round_key_lo, round_key_hi;
	rz_des_pc2(&round_key_lo, &round_key_hi, key_lo, key_hi);
	if (decrypt) {
		rz_des_shift_key(i, true, &key_lo, &key_hi);
	}
	rz_des_permute_block0(&buf_lo, &buf_hi);
	rz_des_round(&buf_lo, &buf_hi, &round_key_lo, &round_key_hi);
	if (arg < 15) {
		rz_des_permute_block1(&buf_lo, &buf_hi);
	} else {
		rz_des_permute_block1(&buf_hi, &buf_lo);
		buf_lo ^= buf_hi;
		buf_hi ^= buf_lo;
		buf_lo ^= buf_hi;
	}
	rz_des_permute_key_inv(&key_lo, &key_hi); // un-permute so the rz_des_permute_key() in the next round will restore it
	key_lo |= key_orig_hi & 0x01010101; // restore the parity bits that got lost in PC-1
	key_hi |= key_orig_lo & 0x01010101;

	rz_write_at_le32(regs, buf_hi, 0);
	rz_write_at_le32(regs, buf_lo, 4);
	rz_write_at_le32(regs, key_lo, 8);
	rz_write_at_le32(regs, key_hi, 0xc);
	for (size_t i = 0; i < sizeof(regs); i++) {
		ut64 v = regs[i];
		rz_analysis_esil_reg_write(esil, reg_names[i], v);
	}
	return true;
}

// ESIL operation SPM_PAGE_ERASE
static bool avr_custom_spm_page_erase(RzAnalysisEsil *esil) {
	CPU_MODEL *cpu;
	ut8 c;
	ut64 addr, page_size_bits, i;

	// sanity check
	if (!esil || !esil->analysis || !esil->analysis->reg) {
		return false;
	}

	// get target address
	if (!__esil_pop_argument(esil, &addr)) {
		return false;
	}

	// get details about current MCU and fix input address
	cpu = get_cpu_model(esil->analysis->cpu);
	page_size_bits = const_get_value(const_by_name(cpu, CPU_CONST_PARAM, "page_size"));

	// align base address to page_size_bits
	addr &= ~(MASK(page_size_bits));

	// perform erase
	// RZ_LOG_DEBUG("SPM_PAGE_ERASE %ld bytes @ 0x%08" PFMT64x ".\n", page_size, addr);
	c = 0xff;
	for (i = 0; i < (1ULL << page_size_bits); i++) {
		rz_analysis_esil_mem_write(
			esil, (addr + i) & CPU_PC_MASK(cpu), &c, 1);
	}

	return true;
}

// ESIL operation SPM_PAGE_FILL
static bool avr_custom_spm_page_fill(RzAnalysisEsil *esil) {
	CPU_MODEL *cpu;
	ut64 addr, page_size_bits, i;
	ut8 r0, r1;

	// sanity check
	if (!esil || !esil->analysis || !esil->analysis->reg) {
		return false;
	}

	// get target address, r0, r1
	if (!__esil_pop_argument(esil, &addr)) {
		return false;
	}

	if (!__esil_pop_argument(esil, &i)) {
		return false;
	}
	r0 = i;

	if (!__esil_pop_argument(esil, &i)) {
		return false;
	}
	r1 = i;

	// get details about current MCU and fix input address
	cpu = get_cpu_model(esil->analysis->cpu);
	page_size_bits = const_get_value(const_by_name(cpu, CPU_CONST_PARAM, "page_size"));

	// align and crop base address
	addr &= (MASK(page_size_bits) ^ 1);

	// perform write to temporary page
	// RZ_LOG_DEBUG("SPM_PAGE_FILL bytes (%02x, %02x) @ 0x%08" PFMT64x ".\n", r1, r0, addr);
	rz_analysis_esil_mem_write(esil, addr++, &r0, 1);
	rz_analysis_esil_mem_write(esil, addr++, &r1, 1);

	return true;
}

// ESIL operation SPM_PAGE_WRITE
static bool avr_custom_spm_page_write(RzAnalysisEsil *esil) {
	CPU_MODEL *cpu;
	char *t = NULL;
	ut64 addr, page_size_bits, tmp_page;

	// sanity check
	if (!esil || !esil->analysis || !esil->analysis->reg) {
		return false;
	}

	// get target address
	if (!__esil_pop_argument(esil, &addr)) {
		return false;
	}

	// get details about current MCU and fix input address and base address
	// of the internal temporary page
	cpu = get_cpu_model(esil->analysis->cpu);
	page_size_bits = const_get_value(const_by_name(cpu, CPU_CONST_PARAM, "page_size"));
	rz_analysis_esil_reg_read(esil, "_page", &tmp_page, NULL);

	// align base address to page_size_bits
	addr &= (~(MASK(page_size_bits)) & CPU_PC_MASK(cpu));

	// perform writing
	// RZ_LOG_DEBUG("SPM_PAGE_WRITE %ld bytes @ 0x%08" PFMT64x ".\n", page_size, addr);
	if (!(t = malloc(1 << page_size_bits))) {
		RZ_LOG_ERROR("Cannot alloc a buffer for copying the temporary page.\n");
		return false;
	}
	rz_analysis_esil_mem_read(esil, tmp_page, (ut8 *)t, 1 << page_size_bits);
	rz_analysis_esil_mem_write(esil, addr, (ut8 *)t, 1 << page_size_bits);

	return true;
}

static int esil_avr_hook_reg_write(RzAnalysisEsil *esil, const char *name, ut64 *val) {
	CPU_MODEL *cpu;

	if (!esil || !esil->analysis) {
		return 0;
	}

	// select cpu info
	cpu = get_cpu_model(esil->analysis->cpu);

	// crop registers and force certain values
	if (!strcmp(name, "pc")) {
		*val &= CPU_PC_MASK(cpu);
	} else if (!strcmp(name, "pcl")) {
		if (cpu->pc < 8) {
			*val &= MASK(8);
		}
	} else if (!strcmp(name, "pch")) {
		*val = cpu->pc > 8
			? *val & MASK(cpu->pc - 8)
			: 0;
	}

	return 0;
}

RZ_IPI int rz_avr_esil_init(RzAnalysisEsil *esil) {
	if (!esil) {
		return false;
	}
	rz_analysis_esil_set_op(esil, "des", avr_custom_des, 0, 0, RZ_ANALYSIS_ESIL_OP_TYPE_CUSTOM); // better meta info plz
	rz_analysis_esil_set_op(esil, "SPM_PAGE_ERASE", avr_custom_spm_page_erase, 0, 0, RZ_ANALYSIS_ESIL_OP_TYPE_CUSTOM);
	rz_analysis_esil_set_op(esil, "SPM_PAGE_FILL", avr_custom_spm_page_fill, 0, 0, RZ_ANALYSIS_ESIL_OP_TYPE_CUSTOM);
	rz_analysis_esil_set_op(esil, "SPM_PAGE_WRITE", avr_custom_spm_page_write, 0, 0, RZ_ANALYSIS_ESIL_OP_TYPE_CUSTOM);
	esil->cb.hook_reg_write = esil_avr_hook_reg_write;

	return true;
}

RZ_IPI int rz_avr_esil_fini(RzAnalysisEsil *esil) {
	return true;
}

RZ_IPI void rz_avr_esil_opcode(RzAnalysis *analysis, RzAnalysisOp *op, ut64 addr, const ut8 *buf, int len) {
	// select cpu info
	CPU_MODEL *cpu = get_cpu_model(analysis->cpu);
	avr_op_analyze(analysis, op, addr, buf, len, cpu);
}
