There are three classes of undocumented Z80 instructions, corresponding
to 'holes' in the opcodes.  These are:

- undocumented index operations
- undocumented shift operations
- undocumented EDxx operations

1) Undocumented index operations
================================

[In this section, IX operations will be described.  IY operations,
obtained by replacing DDs with FDs, behave identically.]

A DD preceding an instruction causes, in general, the following
('main') instruction to be processed as normal, except that:

- any access to (HL) gets treated as an access to (IX+d), where d is
the (signed) displacement byte after the main instruction opcode
- any access to HL gets treated as an access to IX
- any access to H gets treated as an access to IXh
- any access to L gets treated as an access to IXl

If the main instruction does not access any of (HL), HL, H and L, then
the DD effectively acts as a NOP.  (In addition, a series of DDs and
FDs acts as a series of NOPs with the DD/FD actually obeyed being the
last one in the series.)

There are exceptions to the general rule, however.  These are:

Main instruction                Effect of preceding DD
----------------                ----------------------
LD H,(HL)                       Causes LD H,(IX+d)
LD (HL),H                       Causes LD (IX+d),H
LD L,(HL)                       Causes LD L,(IX+d)
LD (HL),L                       Causes LD (IX+d),L
EX DE,HL                        None (left as EX DE,HL)
EXX                             None (left as EXX)
EDxx                            None (left as EDxx)
CBxx                            See below

DDCB sequences always cause the byte following the CB to be taken
as a displacement, and always cause an access to (IX+d).  If
the sequence produces output other than in the flags (i.e. all
except BIT), then the result gets placed both into (IX+d) and the
register one would normally expect to be altered.

For example, DDCB0100 causes RLC (IX+1) and copies the result into B.
DDCB02FF causes SET 7,(IX+2) and copies the result into A.
DDCB0373 causes BIT 6,(IX+3).

2) Undocumented shift operations
================================

Instructions in the range CB30 to CB37 cause the operand to
be shifted left, setting b0.  The effect is therefore like SLA
except b0 is set instead of being reset.

3) Undocumented EDxx operations
===============================

Instructions in the range ED00 to ED3F have no effect.

Instructions in the range ED80 to EDBF, except those documented as
block loads, compares, ins or outs, have no effect.

Instructions in the range EDC0 to EDFF have no effect.  !CPC uses
some of these for interaction with the host.

The holes in the range ED40 to ED7F typically duplicate documented
instructions:

- NEG at ED4C, ED54, ED5C, ED64, ED6C, ED74, ED7C
- NOP at ED77, ED7F
- RETN at ED55, ED65, ED75
- RETI at ED5D, ED6D, ED7D
- IM ? at ED4E, ED6E
- IM 0 at ED66
- IM 1 at ED76
- IM 2 at ED7E
- IN F,(C)  at ED70
- OUT (C),0 at ED71

IM ? sets the interrupt mode flip-flops to an undefined state, which
seems to act like IM 0 or IM 1.  These states are indistinguishable
on the CPC (!CPC chooses IM 0 to indicate an abnormal state).

IN F,(C) performs the input operation, setting the flags as normal,
but throws the input value away.  OUT (C),0 outputs zero to the port.
(Note it would output 255 if the Z80 used in the CPC were the CMOS
variant rather than the NMOS variant.)

1996-02-28