65816 Instruction Set

Introduction

The 65816 (WDC W65C816S, also written 65C816) is the 16-bit successor of the 65C02, designed by Bill Mensch and Western Design Center. It runs every 65C02 program, in emulation mode, and adds a native mode in which the accumulator and index registers can be 16 bits wide, the stack and the direct page can be anywhere in the first 64 KB, and the address space is 16 MB, in 256 banks of 64 KB. It is the processor of the Apple IIGS, of the Super Nintendo Entertainment System (as the core of the Ricoh 5A22, and again in the SA-1 co-processor of some cartridges) and of many embedded designs.

These pages describe the instruction set as the explorer’s own disassembler reads it: all 256 opcodes, none of them undocumented. There are 92 mnemonics: the 65C02’s (without the Rockwell bit instructions RMB, SMB, BBR and BBS, which the 65816 does not have) plus long addressing, stack-relative addressing, block moves, REP and SEP, the 16-bit stack pushes and pulls, and the transfers to and from the stack pointer and direct page register.

The pages: registers and the two modes, the M and X flags (which decide how long some instructions are), addressing modes, the instructions in four groups (data transfer, arithmetic, logic and shifts, control transfer), the flag instructions and the rest, the opcode map and the interrupt vectors. Each instruction has an anchor, so that a disassembled instruction links to its entry.

A Super Nintendo ROM opens in the explorer with this disassembler: see the .SFC page.

The length problem

The bytes of a 65816 program do not say how long they are. The immediate operand of lda #, adc # and the other accumulator instructions is one byte when the M flag is set and two when it is clear; the immediate operand of ldx #, ldy #, cpx # and cpy # follows the X flag. REP and SEP change those flags while the program runs, so the same bytes decode into different instructions depending on what ran before. Reading a file without running it can only track the flags from a known start, or ask the reader. The explorer does both: see the M and X flags.

The family

Documented and reserved

Every opcode is defined. The explorer marks one with a status of its own:

There are no undocumented, unstable or jamming opcodes; STP and WAI stop the processor on purpose and are documented.

Notation

The disassembly writes mnemonics in lower case and hexadecimal with a $: lda #$01, sta $2100, lda [$12],y, lda $7e0000,x, jsl $808000, mvn $7e,$7f (source bank, then destination bank). A direct page operand is written with two digits, an absolute one with four, a long one with six. A branch is shown with its target. On the instruction pages each form is written mode opcode, bytes, cycles, followed by tags for the cycles that depend on the state: +M, +2M, +X, +DL, +P, +T, +E, explained on the addressing modes page. Byte and cycle counts are for the native mode with M and X set.

Not described

Known, not yet covered

• Reference: the cycle-by-cycle bus activity of each instruction (the address and data on every cycle, including the dummy reads), which matters to cycle-exact emulation. The pages give total cycle counts.
• Reference: the WAI and STP behaviour with the RDY and ABORT pins, the ABORT interrupt itself and the pins of the W65C816S; the Super Nintendo does not use them.
• Viewer: the disassembler decodes every byte as code: it does not separate code from data, and does not follow jumps to carry the M and X state to their targets.
• Reference: the SA-1’s own differences in timing and the SNES’s memory speed (the 2.68 and 3.58 MHz regions) are not cycle-modelled.

Unknown

• Reference: whether some real 65816 produces a different result for an instruction the data sheet fully defines (the explorer’s checks ran against one emulator core, LakeSnes, and two opcode tables from other emulators).

Links