NES CPU: 6502

Registers

Abbrevations	A	X	Y	S	P	PC
Names	Accumulator	X Register	Y Register	Stack Pointer	Status Register	Program Counter
Size	8-bit	8-bit	8-bit	8-bit	8-bit	16-bit
Comments	general purpose, ALU	general purpose, index register	general purpose, index register	used to push to/ pull from tde stack	contains several flags; see below	address of the current instruction

Flags

Bit	7	6	5	4	3	2	1	0
Abbrevation	N	V	-	B	D	I	Z	C
Name	Negative	Overflow	Unused	Unused	Decimal	Interrupt Disable	Zero	Carry
Set/Reset		CLV			SED, CLD	SEI, CLI		SEC, CLC
Comment	bit `7` of the result of an operation (sign bit)	set by ADC and SBC if signed result would have overflown	unused; always `1`	technically unused; but when P is pushed to the stack, this bit may be either `0` or `1`, depending on the instruction: PHP and BRK: `1` IRQ and NMI: `0` Note: when P is pushed, the I flag is set as well (unless the operation was PHP)	no effect on the NES	when set, all interrupts except NMI are inhibited; automatically set when an IRQ occurs, and restored by the interrupt handler's RTI clearing this flag when an IRQ is pending causes the interrupt to trigger immediately	set if the result of an operation is equal to `0`	set to the carry of the addition by ADC; set if no borrow was the result ("greater than or equal to") by SBC and CMP; set to the bit shifted out by ASL, LSR, ROL, and ROR

Download as JSON Download as CSV

no operand: Implicit (IMP)
#v: Immediate (IMM)
(a): Indirect (IND)
label: Relative (REL)
a: Absolute (ABS)
a,X: Absolute indexed (ABX)
a,Y: Absolute indexed (ABY)
d: Zero Page (ZPG)
d,X: Zero Page indexed (ZPX)
d,Y: Zero Page indexed (ZPY)
(d,X): Indexed indirect (IZX)
(d),Y: Indirect indexed (IZY)
Left number: Cycle count
Right number: Size (bytes)
!: unstable instruction
!!: highly unstable instruction
Generic operation
Read operation
Read/Modify/Write operation
Write operation

Addressing Modes + Cycle timings

Download as JSON

Registers:

A, X, Y, S, P: registers as listed above
PC (Program Counter): pointer to the current instruction, divided into the following parts:
- PCL: lower byte (8 least significant bit)
- PCH: upper byte (8 most significant bit)
PC = (PCH << 8) | PCL
EA (effective address): used as a temporary 16-bit "register", divided into the following parts:
- EAL: lower byte (8 least significant bit)
- EAH: upper byte (8 most significant bit)
EA = (EAH << 8) | EAL
BA (base address): used as a temporary 16-bit "register", divided into the following parts:
- BAL: lower byte (8 least significant bit)
- BAH: upper byte (8 most significant bit)
BA = (BAH << 8) | BAL
data: used as a temporary 8-bit "register"
offset: used as a temporary signed 8-bit "register"
opcode: the ID of the instruction

The table is divided up into 4 columns:

Cycle: The number of the cycle.
Note: The 0th cycle is the 1st cycle of the next instruction!
Value: The value (address) used for memory read/write operations
- REGISTER++: first use the value of the REGISTER, then increment it afterwards (post-increment)
- REGISTER--: first use the value of the REGISTER, then decrement it afterwards (post-decrement)
- DESTINATION < SOURCE: write SOURCE into memory at the specified DESTINATION (in combination with WRITE bus only)
Bus: The destination (= register) of a memory read operation. If the bus is WRITE, the operation is a memory write instruction.
Comment Description of the steps in a cycle:
- Fetch DESTINATION: Read memory at the address declared in the Value column and store it in DESTINATION.
  (Fetch next = fetch opcode of next instruction)
- Increment REGISTER: Increment the specified REGISTER (usually the last step in the cycle)
- Decrement REGISTER: Decrement the specified REGISTER (usually the last step in the cycle)
- Execute: Execute the actual instruction and operate on the data provided

Operation pseudo-code (C-like):

[address]: Read memory at a given address
arg: The additional data of an instruction (8-bit or 16-bit, if present)
++S: increment the stack pointer, then use it (pre-increment)
S--: first use the stack pointer, then decrement it afterwards (post-decrement)

If there is additional information for a certain steps, it is marked with one or more asterisks* and explained below the table.

Implicit (IMP)

Instructions:
(BRK, RTI, RTS, PHA, PHP, PHA, and PHP have an implicit addressing mode, but work differently)
Example: PHP or ASL A
Operation: data = A (depending on the operation; not actually stored in the data register)

Immediate (IMM)

Instructions:
Example: ORA #$69
Operation: data = arg (8-bit)

Indirect (IND)

Instructions:
Example: JMP ($CAFE)
Operation: PC = [arg] (16-bit)

Relative (REL)

Instructions:
Example: BEQ label (label is converted into a signed offset by the compiler)
Operation: PC = PC + arg (8-bit, signed)

Absolute (ABS)

(JMP and JSR have an absolute addressing mode, but work differently)
Example: ADC $4269
Operation: data = [arg] (16-bit)

Read

Instructions:

Read-Modify-Write

Instructions:

Write

Instructions:

Absolute indexed X/Y (ABX, ABY)

Note: I represents either the X or Y register, depending on the mode.
Example: LDX $1234,X or EOR $5566,Y
Operation: data = [arg + I] (16-bit)

Read

Instructions:

Read-Modify-Write

Instructions:
Note: This mode does not exist for ABY (for official opcodes)

Write

Instructions:

Zero Page (ZPG)

Example: CMP $7F
Operation: data = [arg] (8-bit)

Read

Instructions:

Read-Modify-Write

Instructions:

Write

Instructions:

Zero Page indexed X/Y (ZPX, ZPY)

Note: I represents either the X or Y register, depending on the mode.
Example: STY $EE,X or LAX $DD,Y
Operation: data = [(arg + I) & $FF] (8-bit)

Read

Instructions:

Read-Modify-Write

Instructions:
Note: This mode does not exist for ZPY (for official opcodes)

Write

Instructions:

Indexed Indirect X (IZX)

Example: LDA ($AB,X)
Operation: data = [[(arg + X) & $FF] + ([(arg + X + 1) & $FF] << 8)] (8-bit)

Read

Instructions:

Read-Modify-Write

Instructions:

Write

Instructions:

Indirect Indexed Y (IZY)

Example: SBC ($EF),X
Operation: data = [[arg] + ([(arg + 1) & $FF] << 8) + Y] (8-bit)

Read

Instructions:

Read-Modify-Write

Instructions:

Write

Instructions:

Uncategorized

These instructions don't follow the rules of the addressing modes above, despite some of them being labeled as such (e.g. JMP abs)

Instructions

Operation pseudo-code (C-like):

[address]: Read memory at a given address
arg: The additional data of an instruction (8-bit or 16-bit, if present)
++S: increment the stack pointer, then use it (pre-increment)
S--: first use the stack pointer, then decrement it afterwards (post-decrement)
#: the fetched value (depending on the Addressing mode)

Mnemonic	Operation	NV-BDIZC

Unofficial Instructions

Mnemonic	Operation	NV-BDIZC	Stability

Some of the illegal opcodes are just combinations of two operations:

SLO := ASL + ORA
RLA := ROL + AND
SRE := LSR + EOR
RRA := ROR + ADC
LAX := LDA + LDX
DCP := DEC + CMP
ISC := INC + SBC
ANC := AND + ASL
ANC := AND + ROL
ALR := AND + LSR
ARR := AND + ROR
XAA := TXA + AND
LAX := LDA + TAX
SBC := SBC + NOP

Quirks with other operations:

The SAX operation (A&X) is performed by putting the A and X register onto the bus at the same time.
The ANC operation (A&#) technically performs an AND operation, but puts bit 7 into the carry (like an ASL/ROL operation would).
The ANC operation ((A&#)>>1) perform a step between the AND and the ROR: V is set according to (A&#)+#; bit 0 does not go into the carry, but bit 7 is exchanged with the carry.
The AXS operation (A&X-#) performs a CMP and DEX at the same time. The minus therefore sets the flags like a CMP (not SBC) would
The KIL operation halts the CPU. In order to work again, it has to be reset.
The AHX, SHX and SHY operations all contain an &H operation, with H begin the high byte of the provided address + 1. Sometimes this part of the operation is not executed, therefore they are considered unstable. Also page boundary crossing does not work as expected.
The various NOPs all fetch the data according to their addressing mode, but have no effect otherwise.
Both the XAA and the LAX (immediate) instruction are considered highly unstable. This is because they operate with a magic constant (which depends on CPU model and possibly other factors; typically $00, $FF, $EE etc.). This adds a (A|magic)& term to the equation and effectively results in the following operations:
- XAA: A=(A|magic)&X&#
- LAX: A=X=(A|magic)&#

Interrupts

Work in progress!

Sources

These are the sources I used to gather all this information: