diff --git a/assembler/keyword.in b/assembler/keyword.in
index 7570a113905836a26c8e7ef4f70c7bcdbb70250e..ad81e1b5160dbb7ef4eebd510991db16e1028a4a 100644
--- a/assembler/keyword.in
+++ b/assembler/keyword.in
@@ -105,7 +105,7 @@ or,		KEYWORD_OR,	TOK_INSTR_BINARY, 0xe200, 0xb400
 xor,		KEYWORD_XOR,	TOK_INSTR_BINARY, OPCODE_XOR, 0xb600
 movt,		KEYWORD_MOVT,	TOK_INSTR_BINARY, 0xe400, 0
 movf,		KEYWORD_MOVF,	TOK_INSTR_BINARY, 0xe500, 0
-mullo,		KEYWORD_MULLO,	TOK_INSTR_BINARY, 0xe600, 0
+mullo,		KEYWORD_MULLO,	TOK_INSTR_BINARY, 0xe600, 0xb801
 umulhi,		KEYWORD_UMULHI,	TOK_INSTR_BINARY, 0xe700, 0
 shift,		KEYWORD_SHIFT,	TOK_INSTR_BINARY, 0xe800, 0
 injt8,		KEYWORD_INJT8,	TOK_INSTR_BINARY, 0xe900, 0
diff --git a/examples/poly1305.s b/examples/poly1305.s
index ea4190f87b6da751c55ddcd3fe6c06f7e81d75e5..83ddec754c817396d8a68951d41566e994b35577 100644
--- a/examples/poly1305.s
+++ b/examples/poly1305.s
@@ -18,11 +18,10 @@ poly1305_set_key:
 	and	r2, r3
 	and	r2, #-4
 	st	r2, [r0, #P1305_R1]
-	mov	r3, #5
-	mullo	r1, r3
+	mullo	r1, #5
 	st	r1, [r0, #P1305_S0]
 	rshift	r2, #2
-	mullo	r2, r3
+	mullo	r2, #5
 	st	r2, [r0, #P1305_S1]
 
 	;; Clear state
@@ -154,8 +153,7 @@ poly1305_digest:
 	mov	T0, H2
 	and	H2, #3
 	rshift	T0, #2
-	mov	H1, #5
-	mullo	T0, H1		; Can we have an immediate mullo instr?
+	mullo	T0, #5		; Can we have an immediate mullo instr?
 	ld	H0, [CTX, #P1305_H0]
 	ld	H1, [CTX, #P1305_H1]
 	addc	H0, T0
diff --git a/instr16.tex b/instr16.tex
index 238ee69ddc0ef0e9697c053d0ae7a87fa127a2ce..74cf90078da78007ea9d4d467206d56707800a6a 100644
--- a/instr16.tex
+++ b/instr16.tex
@@ -650,7 +650,10 @@ messy.
   $r_d \gets r_d \bitor (x \bitxor -s)$ \\
   1011 \> 011s \> cccc \> $d$ \> xor \> $r_d$, \#$(x \bitxor -s)$ \>
   $r_d \gets r_d \bitxor x \bitxor -s$ \\
-  1011 \> 1xxx \> xxxx \> xxxx \> \> \> Unassigned 0x800 \\[1em]
+  1011 \> 100s \> cccc \> $d$ \> mullo \> $r_d$, \#$(-1)^s x$\> $r_d
+  \gets (-1)^s r_d x$ \\
+  1011 \> 101x \> xxxx \> xxxx \> \> \> \\
+  1011 \> 11xx \> xxxx \> xxxx \> \> \> Unassigned 0x600 \\[1em]
   1100 \> 000s \> cccc \> $d$ \> tst \> $r_d$, \#$(x \bitxor -s)$ \>
   Set flag on $r_d \bitand (x \bitxor -s) \neq 0$ \\
   1100 \> 001s \> cccc \> $d$ \> cmpeq \> $r_d$, \#$(-1)^s x$ \>
diff --git a/simulator/cpu.c b/simulator/cpu.c
index da7da222c5025f804e382537b5bf5bdb5975f634..530953d122e60ffae93183f262fbe994d558c606 100644
--- a/simulator/cpu.c
+++ b/simulator/cpu.c
@@ -600,6 +600,9 @@ i_imm_binary (struct cpu *cpu, uint16_t instr)
     case 11: /* xor imm */
       CPUW (d, cpu->reg[d] ^ imm);
       break;
+    case 12: /* mullo imm */
+      CPUW (d, cpu->reg[d] * imm);
+      break;
     case 0: /* tst imm */
       CPUWCC ((cpu->reg[d] & imm) != 0);
       break;