Multiply Two Bytes into a Word on NES

A small machine still needs products larger than one byte: an area, a score multiplier or a scaled distance.

Use it in a project

LEFT and RIGHT are unsigned 0–255. Return their exact product in PRODUCT_LO/PRODUCT_HI, low byte first. Both inputs are preserved. There is no overflow for this input domain: 255×255 is 65,025.

Include component.inc once (MOS callers include the shared 6502 implementation through it). Reserve the public fields in this exact order: PRODUCT_LO, PRODUCT_HI, LEFT, RIGHT. They occupy 4 contiguous bytes. Also reserve the private workspace: T0, T1, T4, T5, T6, T7, T8, T9 (8 bytes). Array names in the explanation refer to the numbered consecutive bindings, such as C0, C1 and so on.

Call byte_product_init once at the intended reset boundary. It clears inputs as well as outputs and workspace. Set your starting state and configuration afterwards, then call byte_product_step whenever the described event occurs. The helper reads no device, waits for no frame and installs no interrupt handler.

The multiplier is inspected one bit at a time. Each set bit adds a shifted multiplicand into a two-byte result. Carry is handled explicitly, so the same byte interface works on the three CPU families.

Reusable initialisation and service

; SPDX-License-Identifier: MIT
; Multiply Two Bytes into a Word. See README.md for the byte interface and ownership.
; init clears the public fields and private workspace; set inputs afterwards.
byte_product_init:
    lda #0
    sta PRODUCT_LO
    sta PRODUCT_HI
    sta LEFT
    sta RIGHT
    sta T0
    sta T1
    sta T4
    sta T5
    sta T6
    sta T7
    sta T8
    sta T9
    rts
byte_product_step:
; T4 = LEFT
    lda LEFT
    sta T4
; T5 = 0
    lda #0
    sta T5
; T1 = RIGHT
    lda RIGHT
    sta T1
; T6 = 0
    lda #0
    sta T6
; T7 = 0
    lda #0
    sta T7
; T0 = 8
    lda #8
    sta T0
; while T0 != 0:
byte_product_L1:
    lda T0
    cmp #0
    bne byte_product_L4
byte_product_L5:
    jmp byte_product_L3
byte_product_L4:
    jmp byte_product_L2
byte_product_L2:
; T9 = T1 & 1
    lda T1
    and #1
    sta T9
; if T9 != 0:
    lda T9
    cmp #0
    bne byte_product_L9
byte_product_L10:
    jmp byte_product_L7
byte_product_L9:
    jmp byte_product_L6
byte_product_L6:
; T8 = T6
    lda T6
    sta T8
; T6 = T6 + T4
    lda T6
    clc
    adc T4
    sta T6
; T9 = 0
    lda #0
    sta T9
; if T6 < T8:
    lda T6
    cmp T8
    bcc byte_product_L14
byte_product_L15:
    jmp byte_product_L12
byte_product_L14:
    jmp byte_product_L11
byte_product_L11:
; T9 = 1
    lda #1
    sta T9
    jmp byte_product_L13
byte_product_L12:
byte_product_L13:
; T7 = T7 + T5
    lda T7
    clc
    adc T5
    sta T7
; T7 = T7 + T9
    lda T7
    clc
    adc T9
    sta T7
    jmp byte_product_L8
byte_product_L7:
byte_product_L8:
; T9 = T4 >> 7
    lda T4
    lsr
    lsr
    lsr
    lsr
    lsr
    lsr
    lsr
    sta T9
; T4 = T4 << 1
    lda T4
    asl
    sta T4
; T5 = T5 << 1
    lda T5
    asl
    sta T5
; T5 = T5 | T9
    lda T5
    ora T9
    sta T5
; T1 = T1 >> 1
    lda T1
    lsr
    sta T1
; T0 = T0 - 1
    lda T0
    sec
    sbc #1
    sta T0
    jmp byte_product_L1
byte_product_L3:
; PRODUCT_LO = T6
    lda T6
    sta PRODUCT_LO
; PRODUCT_HI = T7
    lda T7
    sta PRODUCT_HI
    rts
component_end:

Machine contract

A/X/status may change; Y is preserved. The 2A03 has no decimal arithmetic mode. A direct JSR needs two return-address stack bytes. The helper makes no nested calls and adds no other stack use. Its named scratch is private workspace, not a pointer, a ROM variable or shared zero-page space that the game may borrow concurrently. The samples use fixed symbol bindings. Scope or rename every label and binding, including the component_end measurement marker, and allocate a separate block for each independent instance. Different helpers can also use common field names, so combining them needs separate namespaces or explicitly renamed bindings. Give each block one mutation owner.

The NROM caller owns PPU setup and background display, with NMI and DMC disabled. Table and packet sizes are bounded to fit the cartridge caller and internal RAM; the helper owns no PPU registers.

Adapt the caller

demo.asm supplies the bindings and include order. exercise.inc first runs table cases, then a separate client retaining state between calls. A game can call the public step entry directly and remove the diagnostic packet and display. Do not copy the diagnostic’s hardware takeover into an existing game loop.

Build with make ASM198X=/path/to/asm198x. The Makefile produces normal, custom, deliberately wrong and repaired programs. Tools must already be installed; the sample downloads nothing.

Bindings and include order

.segment "HEADER"
.byte "NES",$1a,2,1,0,0,0,0,0,0,0,0,0,0
PRODUCT_LO=$80
PRODUCT_HI=$81
LEFT=$82
RIGHT=$83
T0=$84
T1=$85
T4=$86
T5=$87
T6=$88
T7=$89
T8=$8a
T9=$8b
STATE=$80
input_ptr=$70
cases_left=$72
ptr=$74
saved_y=$76
OUTPUT=$0200
preview=OUTPUT+1400
ready=OUTPUT+1408
CUSTOM=0
BROKEN=0
COYOTE_STEPS=4
BUFFER_STEPS=4
TEXT_CAP=8
PROPERTY_COUNT=16
STREAM_BYTES=13
CRC_POLY=7
.include "caller.inc"
.include "exercise.inc"
component_start:
.include "component.inc"
.include "data.inc"
.include "cases.inc"
code_end:
.segment "VECTORS"
.word nmi,reset,irq
.segment "CHARS"
.include "../../input/controller-reading/edges-font.inc"
.res 8192-272,0

A client retaining state between calls

preview_rules:
.if CUSTOM
; LEFT = 255
    lda #255
    sta LEFT
; RIGHT = 255
    lda #255
    sta RIGHT
.if BROKEN
; RIGHT = 1
    lda #1
    sta RIGHT
.endif
    jsr checked_step
    jsr emit_state
    rts
.else
; LEFT = 200
    lda #200
    sta LEFT
; RIGHT = 3
    lda #3
    sta RIGHT
.if BROKEN
; RIGHT = 1
    lda #1
    sta RIGHT
.endif
    jsr checked_step
    jsr emit_state
.endif
    rts

Customise it

Use the maximum two-byte result instead of a small factor. The maintained custom caller changes its inputs or client sequence rather than hiding a different implementation behind the same label. Compare every state of the two clients, not only their final display.

Custom client selection

.segment "HEADER"
.byte "NES",$1a,2,1,0,0,0,0,0,0,0,0,0,0
PRODUCT_LO=$80
PRODUCT_HI=$81
LEFT=$82
RIGHT=$83
T0=$84
T1=$85
T4=$86
T5=$87
T6=$88
T7=$89
T8=$8a
T9=$8b
STATE=$80
input_ptr=$70
cases_left=$72
ptr=$74
saved_y=$76
OUTPUT=$0200
preview=OUTPUT+1400
ready=OUTPUT+1408
CUSTOM=1
BROKEN=0
COYOTE_STEPS=2
BUFFER_STEPS=2
TEXT_CAP=4
PROPERTY_COUNT=16
STREAM_BYTES=13
CRC_POLY=49
.include "caller.inc"
.include "exercise.inc"
component_start:
.include "component.inc"
.include "data.inc"
.include "cases.inc"
code_end:
.segment "VECTORS"
.word nmi,reset,irq
.segment "CHARS"
.include "../../input/controller-reading/edges-font.inc"
.res 8192-272,0

The custom diagnostic row is 01 FE FF FF 00 00 00 00. The full client trace in the source explains how it gets there.

Mistake and repair

The wrong caller substitutes a factor of one, often mistaken for a default scale. The result is the original value rather than the requested product. Pass both actual factors; keep the high result byte.

The BROKEN branch lives in the sequential client, not the reusable helper. wrong.asm selects it; repaired.asm restores the normal call sequence. The repaired executable matches the normal program (for Spectrum, compare loaded CODE rather than the tape filename).

Select the deliberately wrong client

.segment "HEADER"
.byte "NES",$1a,2,1,0,0,0,0,0,0,0,0,0,0
PRODUCT_LO=$80
PRODUCT_HI=$81
LEFT=$82
RIGHT=$83
T0=$84
T1=$85
T4=$86
T5=$87
T6=$88
T7=$89
T8=$8a
T9=$8b
STATE=$80
input_ptr=$70
cases_left=$72
ptr=$74
saved_y=$76
OUTPUT=$0200
preview=OUTPUT+1400
ready=OUTPUT+1408
CUSTOM=0
BROKEN=1
COYOTE_STEPS=4
BUFFER_STEPS=4
TEXT_CAP=8
PROPERTY_COUNT=16
STREAM_BYTES=13
CRC_POLY=7
.include "caller.inc"
.include "exercise.inc"
component_start:
.include "component.inc"
.include "data.inc"
.include "cases.inc"
code_end:
.segment "VECTORS"
.word nmi,reset,irq
.segment "CHARS"
.include "../../input/controller-reading/edges-font.inc"
.res 8192-272,0

Cost and alternatives

The measured helper extent is 183 code bytes; public state is 4 bytes and private scratch is 8 bytes. There are no immutable helper tables. Caller data, the test cases, return-address stack, alignment and display buffers cost additional space. These are assembled sizes, not cycle measurements.

Eight bit stages, with additions only for set multiplier bits. The 68000 has hardware multiplication; a word-oriented MULU implementation is a useful faster alternative. This common byte routine makes the representation visible rather than claiming to be the fastest native implementation.

This is unsigned integer multiplication. Signed values, fixed-point scaling and saturation require explicit conversions; discarding PRODUCT_HI changes the result to multiplication modulo 256.

Execution evidence

Four variants run on NTSC NROM, background only, DMC/NMI disabled, using Asm198x 0.0.72, Emu198x 0.44.2. Each executes 64 boundary/varied/error table cases, dirty initialisation and the separate retained-state client. An independent mathematical/container model checks every public byte after every call. This is bounded example coverage, not exhaustive correctness for every possible state.

The records retain loaded immutable code, completion, register sentinels, full packets, source/tool/firmware hashes and captures. The public gate validates these retained observations and rejects altered evidence; it does not run restricted firmware. No firmware is distributed. The eight displayed bytes are the first eight public fields, zero-padded when shorter; the packet includes every field.

Where it fits

Fractional positions: A fixed-point product needs an explicit decision about which result bits represent the chosen unit.

The Craft · Maths for Games · Source and native evidence.