Full 6502 Opcode List Including Undocumented Opcodes ==================================================== File: Docs.Comp.6502.OpList - Update: 0.11 Author: J.G.Harston - Date: 15-03-2002 This is a complete list of what all the opcodes on the 6502, 65c12 and R65c02 actually do. The 6502 is used in the BBC series computers. The 65c12 is used in the Master series, and the Rockwell R65c02 is used in the 6502 co-processor. nn 6502 65C12 R65C02 65Tube 6502Em ---------------------------------------------------------------------------- 00 BRK BRK BRK 01 ORA (zp,X) ORA (zp,X) ORA (zp,X) 02 * HALT - - 03 * ASL-ORA (zp,X) - - MOS_CLI WSS_EMT 04 * NOP zp TSB zp TSB zp 05 ORA zp ORA zp ORA zp 06 ASL zp ASL zp ASL zp 07 * ASL-ORA zp - - MOS_SWI 08 PHP PHP PHP 09 ORA #n ORA #n ORA #n 0A ASL A ASL A ASL A 0B * AND #n/MOV b7->Cy - - 0C * NOP abs TSB abs TSB abs 0D ORA abs ORA abs ORA abs 0E ASL abs ASL abs ASL abs 0F * ASL-ORA abs - BBR 0,zp,rel 10 BPL rel BPL rel BPL rel 11 ORA (zp),Y ORA (zp),Y ORA (zp),Y 12 * HALT ORA (zp) ORA (zp) 13 * ASL-ORA (zp),Y - - MOS_BYTE 14 * NOP zp TRB zp TRB zp 15 ORA zp,X ORA zp,X ORA zp,X 16 ASL zp,X ASL zp,X ASL zp,X 17 * ASL-ORA zp,X - - 18 CLC CLC CLC 19 ORA abs,Y ORA abs,Y ORA abs,Y 1A * NOP INC A INC A 1B * ASL-ORA abs,Y - - 1C * NOP abs TRB abs TRB abs 1D ORA abs,X ORA abs,X ORA abs,X 1E ASL abs,X ASL abs,X ASL abs,X 1F * ASL-ORA abs,X - BBR 1,zp,rel 20 JSR abs JSR abs JSR abs 21 AND (zp,X) AND (zp,X) AND (zp,X) 22 * HALT - - 23 * ROL-AND (zp,X) - - MOS_WORD WSS_RDCH 24 BIT zp BIT zp BIT zp 25 AND zp AND zp AND zp 26 ROL zp ROL zp ROL zp 27 * ROL-AND zp - - 28 PLP PLP PLP 29 AND #n AND #n AND #n 2A ROL A ROL A ROL A 2B * AND #n-MOV b7->Cy - - 2C BIT abs BIT abs BIT abs 2D AND abs AND abs AND abs 2E ROL abs ROL abs ROL abs 2F * ROL-AND abs - BBR 0,zp,rel 30 BMI rel BMI rel BMI rel 31 AND (zp),Y AND (zp),Y AND (zp),Y 32 * HALT AND (zp) AND (zp) 33 * ROL-AND (zp),Y - - MOS_WRCH 34 * NOP zp BIT zp,X BIT zp,X 35 AND zp,X AND zp,X AND zp,X 36 ROL zp,X ROL zp,X ROL zp,X 37 * ROL-AND zp,X - - 38 SEC SEC SEC 39 AND abs,Y AND abs,Y AND abs,Y 3A * NOP DEC A DEC A 3B * ROL-AND abs,Y - - 3C * NOP abs BIT abs,X BIT abs,X 3D ORA abs,X ORA abs,X ORA abs,X 3E ASL abs,X ASL abs,X ASL abs,X 3F * ROL-AND abs,X - BBR 1,zp,rel 40 RTI RTI RTI 41 EOR (zp,X) EOR (zp,X) EOR (zp,X) 42 * HALT - - 43 * LSR-EOR (zp,X) - - MOS_RDCH 44 * NOP zp - - 45 EOR zp EOR zp EOR zp 46 LSR zp LSR zp LSR zp 47 * LSR-EOR zp - - 48 PHA PHA PHA 49 EOR #n EOR #n EOR #n 4A LSR A LSR A LSR A 4B * AND #n-LSR A - - 4C JMP abs JMP abs JMP abs 4D EOR abs EOR abs EOR abs 4E LSR abs LSR abs LSR abs 4F * LSR-EOR abs - BBR 0,zp,rel 50 BVC rel BVC rel BVC rel 51 EOR (zp),Y EOR (zp),Y EOR (zp),Y 52 * HALT EOR (zp) EOR (zp) 53 * LSR-EOR (zp),Y - - MOS_FILE 54 * NOP zp - - 55 EOR zp,X EOR zp,X EOR zp,X 56 LSR zp,X LSR zp,X LSR zp,X 57 * LSR-EOR abs,X - - 58 CLI CLI CLI 59 EOR abs,Y EOR abs,Y EOR abs,Y 5A * NOP PHY PHY 5B * LSR-EOR abs,Y - - 5C * NOP abs - - 5D EOR abs,X EOR abs,X EOR abs,X 5E LSR abs,X LSR abs,X LSR abs,X 5F * LSR-EOR abs,X - BBR 1,zp,rel 60 RTS RTS RTS 61 ADC (zp,X) ADC (zp,X) ADC (zp,X) 62 * HALT - - 63 * ROR-ADC (zp,X) - - MOS_ARGS 64 * NOP zp STZ zp STZ zp 65 ADC zp ADC zp ADC zp 66 ROR zp ROR zp ROR zp 67 * ROR-ADC zp - - 68 PLA PLA PLA 69 ADC #n ADC #n ADC #n 6A ROR A ROR A ROR A 6B * AND #n-ROR A - - 6C JMP (abs) JMP (abs) JMP (abs) 6D ADC abs ABC abs ADC abs 6E ROR abs ROR abs ROR abs 6F * ROR-ADC abs - BBR 0,zp,rel 70 BVS rel BVS rel BVS rel 71 ADC (zp),Y ADC (zp),Y ADC (zp),Y 72 * HALT ADC (zp) ADC (zp) 73 * ROR-ADC (zp),Y - - MOS_BGET 74 * NOP zp STZ zp,X STZ zp,X 75 ADC zp,X ADC zp,X ADC zp,X 76 ROR zp,X ROR zp,X ROR zp,X 77 * ROR-ADC abs,X - - 78 SEI SEI SEI 79 ADC abs,Y ADC abs,Y ADC abs,Y 7A * NOP PLY PLY 7B * ROR-ADC abs,Y - - 7C * NOP abs JMP (abs,X) JMP (abs,X) 7D ADC abs,X ADC abs,X ADC abs,X 7E ROR abs,X ROR abs,X ROR abs,X 7F * ROR-ADC abs,X - BBR 1,zp,rel 80 * NOP zp BRA rel BRA rel 81 STA (zp,X) STA (zp,X) STA (zp,X) 82 * HALT - - 83 * STAX (zp,X) - - MOS_BPUT 84 STY zp STY zp STY zp 85 STA zp STA zp STA zp 86 STX zp STX zp STX zp 87 * STAX zp - - 88 DEY DEY DEY 89 * NOP zp BIT #n BIT #n 8A TXA TXA TXA 8B * TXA-AND #n - - 8C STY abs STY abs STY abs 8D STA abs STA abs STA abs 8E STX abs STX abs STX abs 8F * STA-STX abs - BBR 0,zp,rel 90 BCC rel BCC rel BCC rel 91 STA (zp),Y STA (zp),Y STA (zp),Y 92 * HALT STA (zp) STA (zp) 93 * STAX (zp),Y - - MOS_GBPB 94 STY zp STY zp STY zp 95 STA zp,X STA zp,X STA zp,X 96 STX zp,Y STX zp,Y STX zp,Y 97 * STA-STX zp,Y - - 98 TYA TYA TYA 99 STA abs,Y STA abs,Y STA abs,Y 9A TXS TXS TXS 9B * STA-STX abs,Y - - 9C * STA-STX abs,X STZ abs - 9D STA abs,X STA abs,X STA abs,X 9E * STA-STX abs,X STZ abs,X STZ abs,X 9F * STA-STX abs,X - BBR 1,zp,rel A0 LDY #n LDY #n LDY #n A1 LDA (zp,X) LDA (zp,X) LDA (zp,X) A2 LDX #n LDX #n LDX #n A3 * LDA-LDX (zp,X) - - MOS_FIND A4 LDY zp LDY zp LDY zp A5 LDA zp LDA zp LDA zp A6 LDX zp LDX zp LDX zp A7 * LDA-LDX zp - - A8 TAY TAY TAY A9 LDA #n LDA #n LDA #n AA TAX TAX TAX AB * LDA-LDX - - AC LDY abs LDY abs LDY abs AD LDA abs LDA abs LDA abs AE LDX abs LDX abs LDX abs AF * LDA-LDX abs - BBR 0,zp,rel B0 BCS rel BCS rel BCS rel B1 LDA (zp),Y LDA (zp),Y LDA (zp),Y B2 * HALT LDA (zp) LDA (zp) B3 * LDA-LDX (zp),Y - - MOS_QUIT B4 LDY zp LDY zp LDY zp B5 LDA zp,X LDA zp,X LDA zp,X B6 LDX zp,Y LDX zp,Y LDX zp,Y B7 * LDA-LDX zp,Y - - B8 CLV CLV CLV B9 LDA abs,Y LDA abs,Y LDA abs,Y BA TSX TSX TSX BB * ANDAXS abs,Y - - BC LDY abs,X LDY abs,X LDY abs,X BD LDA abs,X LDA abs,X LDA abs,X BE LDX abs,Y LDX abs,Y LDX abs,Y BF * LDA-LDX abs,Y - BBR 1,zp,rel C0 CPY #n CPY #n CPY #n C1 CMP (zp,X) CMP (zp,X) CMP (zp,X) C2 * HALT - - C3 * DEC-CMP (zp,X) - - MOS_LANG C4 CPY zp CPY zp CPY zp C5 CMP zp CMP zp CMP zp C6 DEC zp DEC zp DEC zp C7 * DEC-CMP zp - - C8 INY INY INY C9 CMP #n CMP #n CMP #n CA DEX DEX DEX CB * SBX #n - - CC CPY abs CPY abs CPY abs CD CMP abs CMP abs CMP abs CE DEC abs DEC abs DEC abs CF * DEC-CMP abs - BBR 0,zp,rel D0 BNE rel BNE rel BNE rel D1 CMP (zp),Y CMP (zp),Y CMP (zp),Y D2 * HALT CMP (zp) CMP (zp) D3 * DEC-CMP (zp),Y - - D4 * NOP zp - - D5 CMP zp,X CMP zp,X CMP zp,X D6 DEC zp,X DEC zp,X DEC zp,X D7 * DEC-CMP zp,X - - D8 CLD CLD CLD D9 CMP abs,Y CMP abs,Y CMP abs,Y DA * NOP PHX PHX DB * DEC-CMP abs,Y - - DC * NOP abs - - DD CMP abs,X CMP abs,X CMP abs,X DE DEC abs,X DEC abs,X DEC abs,X DF * DEC-CMP abs,X - BBR 1,zp,rel E0 CPX #n CPX #n CPX #n E1 SBC (zp,X) SBC (zp,X) SBC (zp,X) E2 * HALT - - E3 * INC-SBC (zp,X) - - E4 CPX zp CPX zp CPX zp E5 SBC zp SBC zp SBC zp E6 INC zp INC zp INC zp E7 * INC-SBC zp - - E8 INX INX INX E9 SBC #n SBC #n SBC #n EA NOP NOP NOP EB - - - EC CPX abs CPX abs CPX abs ED SBC abs SBC abs SBC abs EE INC abs INC abs INC abs EF * INC-SBC abs - BBR 0,zp,rel F0 BEQ rel BEQ rel BEQ rel F1 SBC (zp),Y SBC (zp),Y SBC (zp),Y F2 * HALT SBC (zp) SBC (zp) F3 * INC-SBC (zp),Y - - F4 * NOP zp - - F5 SBC zp,X SBC zp,X SBC zp,X F6 INC zp,X INC zp,X INC zp,X F7 * INC-SBC zp,X - - F8 SED SED SED F9 SBC abs,Y SBC abs,Y SBC abs,Y FA * NOP PLX PLX FB * INC-SBC abs,Y - - FC * NOP abs - - FD SBC abs,X SBC abs,X SBC abs,X FE INC abs,X INC abs,X INC abs,X FF * INC-SBC abs,X - BBR 1,zp,rel Notes on extra opcodes ---------------------- Opcodes with a * by them in the above list are 'illegal'. Ones listed as - are defined as NOPs on the 65C12 and R65C02. The effects of the opcodes are probably due to the way the instruction logic is decoded within the 65x02. Most instructions do not have full sets of bits turned on, and are of the form xx01 or xx10. This suggests that the bits are used to select the internal function, and so if a bit pattern of xx11 appears, both functions are selected, and both functions get performed. Some instructions do not follow this exactly, as data contention occurs. I have yet to fully find out what, for instance, STA-STX does, as it cannot store both bytes into one byte of memory. As more information comes to light about the exact actions of some opcodes, and as I compile fuller data on the 65c12 and r65c02 I will update this document. Effects of the extra opcodes ---------------------------- HALT - Halts the processor, only a RESET will restart. NOP - Does nothing, may apparently take an address, and so can effectively skips more than just one byte. The addressing modes shown are extrapolated from the other instructions the NOPs appear within. ASL-ORA - Performs an ASL on the data, and then ORAs the result into the A register. AND #n-MOV b7->Cy - ANDs A with the data, and copies bit 7 of A to the Carry flag ANDAXS - A, X and S are set to (S AND data) ROL-AND - Performs a ROL on the data, and then ANDs the result into the A register. LSR-EOR - Performs a LSR on the data, and then EORs the result into the A register ROR-ADC - Performs a ROR on the data, and then ADCs the result into the A register STAX - Stores A AND X into memory STA-STX - Stores the A register and the X register into memory. I need to test this myself, to find out exactly which or what is stored, as obviously, both cannot be stored TXA-AND #n - Transfers the X register into the A register, and then ANDs it with #n LDA-LDX - Loads the data into both the A register and the X register DEC-CMP - Decrements the data, and then compares the A register with the result INC-SBC - Increments the data, and then subtracts the result from the A register 6502 Emulators -------------- Most 6502 emulators seem to have chosen &x3 as the opcodes to communicate with the host system, ie the extra (zp,X) addressing mode instructions. Acorn emulators use the 16 seperate &x3 opcodes. The &x3 opcode makes the listed OS call, passing the parameters as per the usual 6502 MOS call. The emulated 6502 continues after the one-byte &x3 opcode. Warm Silence emulators use a single-byte &23 opcode to call MOS_RDCH, and a two-byte &03 Emulator Trap opcode with the immediate value being the emulator call to make. After the call is made the emulated 6502 continues as though a RTS has been executed. Both emulators implement &07 to issue a SWI call to the RISC OS host. If the emaultor is emulating the host BBC system, the emulator trap opcodes only execute as emulator traps if they are executed at &8000-&BFFF, ie in a sideways ROM. The WSS emulator traps are as follows: &03 &00 EMT &00 FSC &03 &01 EMT &01 OSFIND &03 &02 EMT &02 OSGBPB (* see note) &03 &03 EMT &03 OSBPUT &03 &04 EMT &04 OSBGET &03 &05 EMT &05 OSARGS &03 &06 EMT &06 OSFILE &03 &40 EMT &40 OSWORD service call &03 &41 EMT &41 OSBYTE service call &03 &80 EMT &80 Read CMOS low level location X, return in Y and A &03 &81 EMT &81 Write Y to CMOS low level location X &03 &82 EMT &82 Read EPROM low level location X, return in Y and A &03 &83 EMT &83 Write Y to EPROM low level location X &03 &D0 EMT &D0 *SRLOAD, (&F2)=>command line &03 &D1 EMT &D1 *SRWRITE, (&F2)=>command line &03 &D2 EMT &D2 *DRIVE, (&F2)=>command line &03 &D3 EMT &D3 Load/Run/Exec !BOOT &03 &D4 EMT &D4 Does nothing &03 &D5 EMT &D5 *BACK &03 &D6 EMT &D6 *MOUNT, (&F2)=>command line &03 &FF EMT &FF Quit &23 EQUB &23 OSRDCH To work out which emulator traps are available, the following code can be used: Acorn effect WSS effect .WhatTraps LDA #130 LDX #nullstr AND 255 LDY #nullstr DIV 256 DEFB &03 ; OSCLI "" EMT DEFW &0041 ; EOR (&00,X) OSBYTE 130 and RTS LDA #0 RTS .nullstr EQUB 13 With Acorn emulator traps a null OSCLI call is made, and A returns holding 0. With Warm Silence emulator traps OSBYTE 130 reads the bottom of user memory and returns with A still holding 130. Note: the WSS OSGBPB 9 call has the contents of the control block the wrong way around: On entry: On exit: XY?0 = count XY?0 = count returned XY!1 = address XY!1 = address not updated XY!5 = buffer length at address XY!5 = bufflen not updated XY!9 = offset XY!9 = updated offset Document History ---------------- 25-Nov-1998 v0.10 Initial full version, after months tracking down various sources. 15-Mar-2002 v0.11 Added details of emulator calls. 12-Feb-2006 v0.12 Found original Acorn User article. References ---------- Undocumented 6502 opcodes: "Extra Instructions Of The 65XX Series CPU" Adam Vardy (abe0084@infonet.st-johns.nf.ca) "6502 And All That", Eight Bits feature, Acorn User, June 1991. 65c12 and R65c02 opcodes: "The New Advanced User Guide", Dickens & Holmes, Adder, 1987. Undocumented 65c12 and R65c02 opcodes: Investigative research by JGH, 1998.