CPU ALL
Contents |
CPU
The NES CPU core is based on the 6502 processor and runs at approximately 1.79 MHz (1.66 MHz in a PAL NES). It is made by Ricoh and lacks the MOS6502's decimal mode. In the NTSC NES, the RP2A03 chip contains the CPU and APU; in the PAL NES, the CPU and APU are contained within the RP2A07 chip.
Sections
- CPU instructions
- CPU addressing modes
- CPU memory map
- CPU power-up state
- CPU status flag behavior
- Unofficial opcodes
- CPU pin-out and signals, and other hardware pin-outs
CPU signals and frequencies
The CPU generates its clock signal by dividing the master clock signal.
| Rate | NTSC NES/Famicom | PAL NES | PAL Famiclone |
|---|---|---|---|
| Color subcarrier frequency fsc (exact) | 39375000/11 Hz | 4433618.75 Hz | 4433618.75 Hz |
| Color subcarrier frequency fsc (approx.) | 3.579545 MHz | 4.433619 MHz | 4.433619 MHz |
| Master clock frequency 6fsc | 21.477272 MHz | 26.601712 MHz | 26.601712 MHz |
| Clock divisor d | 12 | 16 | 15 |
| CPU clock frequency 6fsc/d | 1.789773 MHz | 1.662607 MHz | 1.773448 MHz |
Notes
- Kevtris has confirmed that all illegal 6502 opcodes execute identically on the 2A03/2A07. He has even went as far as to integrate them into the CopyNES BIOS.
- A printer friendly version covering all section is available here.
Memory map
| Addr | Size | Device |
|---|---|---|
| $0000 | $0800 | 2KB internal RAM |
| $0800 | $0800 | Mirrors of $0000-$07FF |
| $1000 | $0800 | |
| $1800 | $0800 | |
| $2000 | $0008 | NES PPU registers |
| $2008 | $1FF8 | Mirrors of $2000 every 8 bytes |
| $4000 | $0018 | NES APU and I/O registers |
| $4018 | $FFFF | Cartridge PRG ROM, cartridge PRG RAM, and mapper registers |
$FFFA - NMI vector
$FFFC - Reset vector
$FFFE - IRQ/BRK vector
Pin out and signal description
Pin out
| AD1 - 01 | 40 - +5V |
| AD2 - 02 | 39 - OUT0 |
| /RST - 03 | 38 - OUT1 |
| A00 - 04 | 37 - OUT2 |
| A01 - 05 | 36 - /OE1 |
| A02 - 06 | 35 - /OE2 |
| A03 - 07 | 34 - R/W |
| A04 - 08 | 33 - NMI |
| A05 - 09 | 32 - /IRQ |
| A06 - 10 | 31 - M2 |
| A07 - 11 | 30 - TST (usually GND) |
| A08 - 12 | 29 - CLK |
| A09 - 13 | 28 - D0 |
| A10 - 14 | 27 - D1 |
| A11 - 15 | 26 - D2 |
| A12 - 16 | 25 - D3 |
| A13 - 17 | 24 - D4 |
| A14 - 18 | 23 - D5 |
| A15 - 19 | 22 - D6 |
| GND - 20 | 21 - D7 |
Signal description
Active-Low signals are indicated by a "/".
- CLK is the 21.47727 MHz (NTSC) or 26.6017 MHz (PAL) clock input. Internally, the real clock (φ0) is derived by dividing the input clock frequency by 12 (NTSC 2A03) or 16 (PAL 2A07).
- AD1 (both pulse waves) and AD2 (triangle, noise, and DPCM) are the Audio Out pins.
- Axx is the address bus and Dx the data bus.
- OUT0-OUT2 are output pins used by the controllers ($4016 output latch bits 0-2). These 3 pins are connected to the expansion port pins 43-45, and OUT0 is additionally used as the "strobe" signal (OUT) on both controller ports.
- /OE1 and /OE2 also go to the controller ports, and each enable the output of their respective controller, if present.
- R/W is the read/write signal, which is used to indicate operations of the same names. Low is write.
- /NMI and /IRQ are the two interrupt pins. See the 6502 manual for more detailed explanation.
- M2 can be considered as a "signals ready" pin. It is a modified version the 6502's φ2 that allow for slower ROMs.
- TST (tentative name) (pin 30) is special: normally it is grounded in the NES, Famicom, PC10/VS. NES and other Nintendo Arcade Boards (Popeye and Donkey Kong 3). But if it is pulled high, extra diagnostic registers to test the sound hardware are enabled from $4018 through $401A, and the joystick ports $4016 and $4017 become open bus.
Power up state
The following results are from a US (NTSC) NES, original front-loading design, RP2A03G CPU chip, NES-CPU-07 main board revision, manufactured in 1988. The memory values are probably slightly different for each individual NES console. Please note that you should NOT rely on the state of any registers after Power-UP and especially not the stack register and WRAM ($0000-$07FF).
At power-up
- P = $34 (IRQ disabled)*
- A, X, Y = 0
- S = $FD
- All internal memory ($0000-$07FF) was consistently set to $ff except for a few bytes, which probably vary from console to console:
- $0008=$F7
- $0009=$EF
- $000a=$DF
- $000f=$BF
- $4017 = $00 (frame irq enabled)
- $4015 = $00 (all channels disabled)
- $4000-$400F = $00 (not sure about $4010-$4013)
- IRQ was first asserted about 1/60 second after power-up, by APU
After reset
- A, X, Y were not affected
- S was decremented by 3 (but nothing was written to the stack)
- The I (IRQ disable) flag was set to true (status ORed with $04)
- The internal memory was unchanged
- APU mode in $4017 was unchanged
- APU was silenced ($4015 = 0)
Notes
- The golden log of nestest differs from this in the irrelevant bits 5 and 4 of P.
See also
Status flag behavior
The flags register, also called processor status or just P, is one of the six architectural registers on the 6502 family CPU. It is composed of six one-bit registers (see Status flags); instructions modify one or more bits and leave others unchanged.
Instructions that save or restore the flags map them to bits in the architectural 'P' register as follows:
7654 3210 || |||| || |||+- C: 1 if last addition or shift resulted in a carry, or if || ||| last subtraction resulted in no borrow || ||+-- Z: 1 if last operation resulted in a 0 value || |+--- I: Interrupt priority level || | (0: /IRQ and /NMI get through; 1: only /NMI gets through) || +---- D: 1 to make ADC and SBC use binary-coded decimal arithmetic || (ignored on second-source 6502 like that in the NES) |+-------- V: 1 if last ADC or SBC resulted in signed overflow, | or D6 from last BIT +--------- N: Set to bit 7 of the last operation
The B flag
There are six and only six flags in the processor status register. Despite what some 6502 references might appear to claim on a first reading, there is no "B flag" in the CPU.
Two interrupts (/IRQ and /NMI) and two instructions (PHP and BRK) push the flags to the stack. Bit 5 is always set to 1, and bit 4 is 1 if from an instruction (PHP or BRK) or 0 if from an interrupt line being pulled low (/IRQ or /NMI).
| Instruction | Bits 5 and 4 | Side effects after pushing |
|---|---|---|
| PHP | 11 | None |
| BRK | 11 | I is set to 1 |
| /IRQ | 10 | I is set to 1 |
| /NMI | 10 | I is set to 1 |
Two instructions (PLP and RTI) pull a byte from the stack and set all the flags. They ignore bits 5 and 4.
The only way for an IRQ handler to distinguish /IRQ from BRK is to read the flags from the stack and test bit 4. The slowness of this is one reason why BRK wasn't used as a syscall mechanism. Instead, it was more often used to trigger a patching mechanism that hung off the /IRQ vector: a single byte in PROM, UVEPROM, flash, etc. would be forced to 0, and the IRQ handler would pick something to do instead based on the program counter.
Unlike bits 5 and 4, bit 3 actually exists in P, even though it doesn't affect the ALU operation on the 2A03 or 2A07 CPU the way it does in MOS Technology's own chips.
