Difference between revisions of "Z80"

Revision as of 00:07, 24 September 2024

Zilog Z80A

The Z80 is an 8-bit microprocessor designed by Zilog founder and CEO Federico Faggin, first released in July 1976. It is the CPU used in the Amstrad CPC / Plus / PCW computers.

The Z80/Z80A was a very popular microprocessor, used in a wide range of applications, from gaming consoles like the ColecoVision or the Sega Master System to handhelds like the Sega GameGear or some TI calculators to personal computers like the ZX Spectrum and the MSX.

It was even used in the Sega MegaDrive as the sound CPU and in the Commodore C128 as a secondary processor in order to achieve CP/M compatibility. Similarly, the Acorn Z80 Second Processor expansion for the BBC Micro enables CP/M compatibility.

Description

The Z80 microprocessor is an 8-bit CPU with a 4-bit ALU and a 16-bit address bus capable of direct access to 64KB of memory space. The Z80 is a little-endian CPU, meaning it stores 16-bit values with the least significant byte first, followed by the most significant byte. It has a language of 252 root instructions and with the reserved 4 bytes as prefixes, access to an additional 308 instructions.

The Zilog Z80 is an upgraded version of the Intel 8080 and is fully compatible with it at the software level. It contains the seventy-eight 8080 opcodes as a subset to its language. The Z80 adds more registers, better instructions, faster performance, and improved interrupt handling, making it more powerful and efficient than the 8080.

While not in the same league as the Intel 80x86 or the Motorola 68000 series, the Z80 is extremely useful for low cost control applications. One of the more useful features of the Z80 is the built-in refresh circuitry for ease of design with DRAMs.

The Z80 has about 8500 transistors. It comes in a 40-pin DIP package. It has been manufactured in A, B, and C models, differing only in maximum clock speed. It also has been manufactured as a stand-alone microcontroller with various configurations of on-chip RAM and EPROM.

Part numbers used in the Amstrad CPC during its lifetime

The Z80 CPU has been manufactured by others, and various Z80s have been used in the construction of the CPC during its lifetime:

• Mostek MK3880N-4 Source
• NEC D780C Source
• SGS Z8400AB1 Source
• ST Z8400AB1 Source
• ZILOG Z8400APS Source
• ZILOG Z0840004PSC Source

All the Z80 CPUs that have been used on CPC and Plus machines are NMOS. Source

Zilog ended the production of the Z80 in April 2024. This chip is still available in ample quantities through NOS chip suppliers. And Zilog continues to produce the eZ80 which is a modernized Z80 CPU.

Modern incarnations

Apart from surplus/new Z80-clones that are quite easy to find, many emulations depend on software implementations of the Z80:

• The T80 is a VHDL implementation of the Z80 and Z80A, finished in 2002 on OpenCores
• arnold uses InkZ80, written in C++ (apart from the author-designed C simulation)
• On OpenCores, there is also a Verilog implementation of the Z80.

Registers

Internal state

 On Zilog NMOS Z80, when the instruction doesn't compute new flags, this register is cleared instead. But not on NEC NMOS Z80. And CMOS Z80 behave in a different way too.
 Normally, you never see the content of this register. But it leaks through F5 and F3 in the SCF/CCF instructions. Source
 Emulating Q is not strictly necessary. A 1-bit flag, indicating whether the previous instruction computed flags, is enough to emulate the behaviour of SCF/CCF. Source
 Also note that while POP AF and EX AF,AF' modify F, they do not compute new flag values.

Note: EIP and IMP can be fusioned into a 3-bit internal state as there are only 7 possible values for the prefixes (none, ed, dd, fd, cb, ddcb, fdcb). Probably not a win though as it makes everything more confusing.

Z80 Instructions

Legend

Flags

• - = no change
• + = change by definition (if noted, by the operation marked with '=> flags', otherwise by the only non-single-bit operation):

* S = sign, bit 7 of the result byte (accumulator or high byte for 16-bit operations)
* Z = zero, set if the result is zero (8 or 16-bit value)
* 5 = undocumented, bit 5 of the result byte
* H = half-carry, the carry (theoretical bit 4) of the low nibble of the result byte
* 3 = undocumented, bit 3 of the result byte
* P = parity (set if the result byte has an even number of bits set) or overflow (set when crossing the boundary of the signed range); always specified
* N = negative, set if the previous operation was a subtraction; always specified
* C = carry, the theoretical bit 8 of the result byte

• 0 = always reset
• 1 = always set
• X = change described under Effect
• P = parity (only for the parity flag)
• V = overflow (only for the parity flag)
• A = OR with the respective bit of the accumulator
• C = set if the counter (bc) is nonzero after decrementing

Miscellaneous

• () = indirection
• (()) = I/O port
• [] = operator precedence (to avoid confusion with indirection)
• E.B = the Bth bit of the value of expression E
• * = any bit value (0 or 1)
• wz = an internal 16-bit register connected to 16-bit operations
• tmp, tmp2 = temporary storage whose value is thrown away after each instruction

Letter A

Letter B

Letter C

Letter D

if hf or [a AND 0x0f > 9] then tmp -= 0x06
if cf or [a > 0x99] then tmp -= 0x60

if hf or [a AND 0x0f > 9] then tmp += 0x06
if cf or [a > 0x99] then tmp += 0x60

Letter E

Letter H

Letter I

Letter J

Letter L

Letter N

Letter O

Letter P

Letter R

Letter S

Letter X

Timings

On CPC, bus arbitration is done on every CPU bus access. On MSX, bus arbitration only applies to M1 machine cycles but access to VRAM has other limitations. On ZX Spectrum, bus arbitration is done not by using the /WAIT pin but by disabling the CPU clock when needed.

The NOPs column corresponds to CPC timings, which account for the bus arbitration managed by the Gate Array. The NOP instruction takes 4 cycles. This is the minimum amount of cycles an instruction can take.

Every M-cycle that involves a memory or I/O access will be stretched due to bus arbitration. But beware, some M-cycles are purely internal and don't involve a memory or I/O access.

Nevertheless, a few CPC timings can appear surprising at first glance:

• Instructions LD (IX+d),r and LD (IX+d),n take 5 and 6 NOPs respectively, even though they are both listed as 19 (4,4,3,5,3) cycles in the datasheet. This happens because LD (IX+d),r has one less memory access operation to do compared to LD (IX+d),n as it does not have to fetch its operand from memory.

• Instructions IN r,(C) and OUT (C),r take 4 NOPs with CPC timings, even though they are listed as 12 (4,4,4) cycles in the datasheet. This happens because I/O access is not aligned with memory access. On Zilog manual, it is precised that one wait-state TW is automatically inserted after T2 on I/O access.

Opcodes

The Z80 follows a 2-3-3 opcode bit pattern.

All CB-prefixed opcodes and half of the standard opcodes (from &40 to &BF) follow a strict uniform layout. The sole exception is the HALT instruction (opcode &76), which replaces the expected LD (HL),(HL) instruction.

The rest of the opcode table is also neatly organised but in an horizontal way instead of vertical.

Any instruction in bold is undocumented by Zilog.

Standard opcodes

CB-prefixed opcodes

ED-prefixed opcodes

The opcodes that are not mentioned in the following table are EDNOP (ED-prefixed NOP instruction). Thay have no effect but take 8 cycles and increment the register R two times. EDED, EDDD, EDFD and EDCB are also EDNOP instructions.

Notes:

• The opcode ED70 reads the port indicated by the register C without keeping the result but modifies the register F
• The opcode ED71 corresponds to the instruction OUT (C),255 on a CMOS Z80

DD or FD-prefixed opcodes

If an opcode is prefixed by DD, the instruction is changed as follows:

• HL is replaced by IX
• H is replaced by IXH
• L is replaced by IXL
• (HL) is replaced by (IX+d)

Same for the FD prefix but with IY instead of IX.

There are 3 exceptions:

• In the instruction EX DE,HL, HL will not be replaced with IX or IY. The EXX instruction is not affected either.
• If (HL) and L or H are used in the same instruction, L and H are not replaced with IXL or IXH. For instance LD L,(IX+d) stores the content of (IX+d) into L, not IXL.
• If the next byte is a DD, ED or FD prefix, the current DD or FD prefix is ignored (it's equivalent to a NONI) and processing continues with the next byte. ED-prefixed opcodes cannot be altered by DD or FD prefixes.

DDCB or FDCB-prefixed opcodes

When a DD or FD prefix is followed by a CB byte, the CB acts as a second prefix. A mandatory displacement byte comes next, and then the actual opcode.

If the instruction produces output other than in the flags (i.e. all except BIT), then the result gets placed both into (IX+d) or (IY+d) and into the register one would normally expect to be altered.

DDCB and FDCB-prefixed instructions only increment the R register twice. This has been confirmed on Stack Overflow

Oddities

• RETI and RETN are identical instructions Source. The only reason for RETI is so that some other hardware can detect the specific case of returning from the interrupt, by detecting the RETI opcode on the data bus.
• EI has a 1-instruction delay. It is necessary for doing EI/RETI without any danger of nested interrupt routines.
• RST instructions are just a CALL instruction to a fixed address baked in the instruction itself.
• Despite what the syntax of the instructions JP (HL/IX/IY) suggests, PC will be loaded with the contents of the register itself, not the indexed value. Those instructions should be understood as JP HL/IX/IY.
• IN r,(C) and OUT (C),r instructions syntax is misleading as these instructions actually use the full 16-bit port address contained in BC.
• While the syntax of ADD, ADC and SBC instructions all explicitely mention the A register, the SUB instruction does not mention it.
• The 16-bit commands ADD HL,ss, ADC HL,ss and SBC HL,ss exist but not the command SUB HL,ss.
• When an LDxR / CPxR / INxR / OTxR instruction is interrupted, the interrupt handler sees some flags in a different state. Source
• NMOS Z80 suffers a problem whereby LD A,I and LD A,R record the state of IFF2 after it has been reset if an interrupt is delivered during that instruction. Source

Block Diagram

CPU Pinout

Note: A reset disables the maskable interrupt, selects interrupt mode 0, zeroes registers I & R and zeroes the program counter (PC).

Chip Variants

The GBZ80 (Sharp SM83) that powers the original Nintendo GameBoy is an in-between the Intel 8080 and Z80. Source

The ASCII R800 that powers the MSX TurboR is a seriously beefed up version of the Z80:

• The ALU of the R800 is 16-bit instead of 4-bit for the Z80. This change allows instructions that were being executed in 4 clocks to be done in 1 clock.

• The instruction set of the R800 is almost identical to the Z80. Only 2 instructions have been added: MULUB and MULUW. And many of the undocumented instructions of the Z80 were made official.

Zilog itself offers the eZ80 processor, a binary-compatible upgrade of the Z80, which runs at up to 50MHz but performs like a 150MHz Z80 due to being 3 times faster at the same clock speed.

Manuals

• Official Zilog Z80 CPU user manual (2016)
• Media:Z80 CPU Technical Manual 1977.pdf
• Media:Mostek Z80 Programming Manual.pdf
• Media:Z80-Mostek-Technical-Manual.pdf - provides a detailed breakdown of the machine cycles
• Media:Mostek Z80 Micro-Reference Manual Feb78.pdf
• Media:Z80 CPU Instant Reference Card (Color).pdf
• Media:Z80 CPC Timings cheat sheet.20230709.pdf
• MEMPTR, esoteric register of the Z80 CPU
• The Undocumented Z80 Documented
• Z80 - undocumented opcodes

Weblinks

• Zilog [1]
• Computer Systems based on Z80 Family
• The Z80 processor on Wikipedia
• Z80 article on Sinclair Wiki
• Z80 documentation from Grimware
• Decoding Z80 opcodes
• Interrupt behaviour of the Z80 CPU
• Behaviour of the undocumented flags
• Complete list of Z80 instructions and their bus responses and cycles dumped from real hardware
• Detailed look at Z80 instruction timings with the help of a Z80 netlist simulation
• Cycle-stepped Z80 emulation how-to
• Tom Harte's SingleStepTests