Z80 Instruction Set – Overview

Introduction

These pages describe five related processors and the disassembler the explorer uses for them (explorer/cpu/z80/, our own code). The Zilog Z80 (1976) runs the ZX Spectrum, the MSX, the Amstrad CPC, the Master System and many arcade boards. The eZ80 is Zilog’s 24-bit descendant (Agon Light, TI-84 Plus CE). The SM83 (Sharp LR35902) is the Game Boy’s processor: it is built on the same ideas but is not a Z80. The 8080 and 8085 are the Intel processors the Z80 extends, written in Intel’s different mnemonics.

Where the explorer meets this code (a Game Boy ROM), every instruction carries one of four statuses, drawn in its own colour and also written as text:

• documented: in the manufacturer’s manual for this chip;
• undocumented: not in the manual but the same on every chip of the family (the Z80’s IXH and IXL halves, SLL, the register copies of DDCB, the repeated ED opcodes, IN F,(C) and OUT (C),0, prefixes that change nothing);
• unstable: not used by these decoders (the Z80 has no opcode with a chip-dependent result that the decoder tells apart);
• jam: stops the processor until reset: the 11 unused opcodes of the SM83.

Z80 registers

Flags

The viewer lists the flags an instruction changes and the ones it reads. X and Y are listed where an instruction sets them from its result, though the manual does not mention them. The SM83 has only Z N H C, in bits 7 to 4 of F.

Prefix bytes

A prefix changes the length of what follows, so a disassembly depends on where decoding starts. The explorer therefore decodes an instruction at every byte and lays the results in columns (the same way as for x86 and 6502). A DD or FD that changes nothing is shown as an instruction of its own, one byte long, so every offset stays valid.

How the opcodes are laid out

The Z80’s opcode bits split into fields: x = bits 7–6, y = bits 5–3, z = bits 2–0, with p = y >> 1 and q = y & 1. Register fields use the order B C D E H L (HL) A, pairs BC DE HL SP (or AF for push and pop), conditions NZ Z NC C PO PE P M, and the arithmetic group ADD ADC SUB SBC AND XOR OR CP. So x=1 is LD r,r' (with LD (HL),(HL) replaced by HALT) and x=2 is the arithmetic group on a register. The decoder is written in this form; the maps list every opcode.

Timing

Times are the manual’s: T-states (clock cycles) and M-cycles (machine cycles of 3 to 6 T-states). An instruction that is conditional or repeats has two counts: the viewer gives the count when it is not taken (or on the last repetition) and the count when it is. The SM83’s T-states are four per machine cycle. eZ80 and 8085 counts are not tabulated here.

How this was checked

• Every opcode of the Z80, SM83, 8080, 8085 and the eZ80 additions is compared with an opcode grid written separately from the manuals (Zilog UM0080; Sean Young, The Undocumented Z80 Documented; Pan Docs; Intel’s 8080 manual): 11,964 comparisons.
• Every opcode is run on real emulator cores (three different Z80 cores, the Game Boy core of GameBoy-Online and the eZ80 core of the Agon Light emulator) from known states, and the instruction length, the registers, flags and memory changed, the registers and flags read, and the T-states are compared. Where the cores disagree about an undocumented opcode the viewer follows the documentation of Sean Young and says which cores differ.

Sources

• Z80 CPU User Manual (UM0080) – Zilog
• The Undocumented Z80 Documented – Sean Young
• CPU Instruction Set – Pan Docs (SM83)
• eZ80 CPU User Manual (UM0077) – Zilog

Not described

• Interrupt behaviour beyond the instructions that set it (DI, EI, IM, RETI, RETN).
• Bus timing, the undocumented MEMPTR register and the full rules for the X and Y flags of block and I/O instructions.
• The eZ80’s cycle counts and its undocumented opcodes; the 8085’s cycle counts.