From: mgr11@cus.cam.ac.uk (M.G. Rison) Subject: Z80 F effects Date: 19 Feb 1996 20:07:21 GMT Organization: University of Cambridge, England There are three classes of undocumented Z80 instructions, corresponding to 'holes' in the opcodes. These are: - undocumented index operations - undocumented shift operations - undocumented EDxx operations 1) Undocumented index operations ================================ [In this section, IX operations will be described. IY operations, obtained by replacing DDs with FDs, behave identically.] A DD preceding an instruction causes, in general, the following ('main') instruction to be processed as normal, except that: - any access to (HL) gets treated as an access to (IX+d), where d is the (signed) displacement byte after the main instruction opcode - any access to HL gets treated as an access to IX - any access to H gets treated as an access to IXh - any access to L gets treated as an access to IXl If the main instruction does not access any of (HL), HL, H and L, then the DD effectively acts as a NOP. (In addition, a series of DDs and FDs acts as a series of NOPs with the DD/FD actually obeyed being the last one in the series.) There are exceptions to the general rule, however. These are: Main instruction Effect of preceding DD ---------------- ---------------------- LD H,(HL) Causes LD H,(IX+d) LD (HL),H Causes LD (IX+d),H LD L,(HL) Causes LD L,(IX+d) LD (HL),L Causes LD (IX+d),L EX DE,HL None (left as EX DE,HL) EXX None (left as EXX) EDxx None (left as EDxx) CBxx See below DDCB sequences always cause the byte following the CB to be taken as a displacement, and always cause an access to (IX+d). If the sequence produces output other than in the flags (i.e. all except BIT), then the result gets placed both into (IX+d) and the register one would normally expect to be altered. For example, DDCB0100 causes RLC (IX+1) and copies the result into B. DDCB02FF causes SET 7,(IX+2) and copies the result into A. DDCB0373 causes BIT 6,(IX+3). 2) Undocumented shift operations ================================ Instructions in the range CB30 to CB37 cause the operand to be shifted left, setting b0. The effect is therefore like SLA except b0 is set instead of being reset. 3) Undocumented EDxx operations =============================== Instructions in the range ED00 to ED3F have no effect. Instructions in the range ED80 to EDBF, except those documented as block loads, compares, ins or outs, have no effect. Instructions in the range EDC0 to EDFF have no effect. !CPC uses some of these for interaction with the host. The holes in the range ED40 to ED7F typically duplicate documented instructions: - NEG at ED4C, ED54, ED5C, ED64, ED6C, ED74, ED7C - NOP at ED77, ED7F - RETN at ED55, ED65, ED75 - RETI at ED5D, ED6D, ED7D - IM ? at ED4E, ED6E - IM 0 at ED66 - IM 1 at ED76 - IM 2 at ED7E - IN F,(C) at ED70 - OUT (C),0 at ED71 IM ? sets the interrupt mode flip-flops to an undefined state, which seems to act like IM 0 or IM 1. These states are indistinguishable on the CPC (!CPC chooses IM 0 to indicate an abnormal state). IN F,(C) performs the input operation, setting the flags as normal, but throws the input value away. OUT (C),0 outputs zero to the port. (Note it would output 255 if the Z80 used in the CPC were the CMOS variant rather than the NMOS variant.) 1996-02-28