diff --git a/cpu.c b/cpu.c
index 862ba67..7ae0867 100644
--- a/cpu.c
+++ b/cpu.c
@@ -27,7 +27,7 @@
 #define PUSH(b)	\
 	(memwrite(0x0100 + regs.sp--, b))
 #define PULL()	\
-	(peek(0x0100 + regs.sp++))
+	(peek(0x0100 + ++regs.sp))
 
 struct cpu_flags {
 	uint8_t carry : 1;
@@ -465,7 +465,7 @@ jmp(uint16_t arg)
 static void
 jsr(uint16_t arg)
 {
-	uint16_t tmp = regs.pc + 2;
+	uint16_t tmp = regs.pc;
 
 	/*
 	 * first push high-byte of return address then low-byte
@@ -654,7 +654,7 @@ rti(void)
 static void
 rts(void)
 {
-	regs.pc = PULL() + 1;
+	regs.pc = PULL() | (PULL() << 8);
 }
 
 static void
@@ -1164,7 +1164,7 @@ interpret(void)
 			printf("JMP");
 			break;
 		case 0x20:
-			jsr(opcode_arg(AM_ABS));
+			jsr(opcode_mem(AM_ABS));
 			cycles += 6;
 			printf("JSR");
 			break;