View
4
Download
0
Category
Preview:
Citation preview
1
SWA.1
Advanced Microprocessors
Notes #2 Software Architecture &
Instruction Set Architecture Part 1
EE 467/567 Winter 2012
by
Avinash Kodi
SWA.2
Background Materials • Textbook:
– 2.1, 2.2, 3.1 • Other:
– “IA-32 Intel® Architecture Software Developer‟s Manual Volume 1: Basic Architecture”
• Sections 3.4.1, 3.4.2, 3.4.3, 3.5
– “IA-32 Intel® Architecture Software Developer‟s Manual Volume 3A: System Programming Guide”
• Sections 3.1, 3.2, 3.3, 3.4,
2
SWA.3
Computer Architecture
Control Unit
Datapath
Micro Processor Unit (MPU)
Input/Output (I/O)
Input Output
Memory Program Storage
Data Storage
Software
Hardware
Application Operating System
Compiler & Assembler
SWA.4
Software Architecture
• Registers,
• Instruction Set Architecture,
• Addressing Modes,
• …
Basic Hardware Knowledge the User (Programmer) Needs to Program Assembly
3
SWA.5
AH AL
BH BL
CH CL
DH DL
SP
BP
DI
SI
Intel 8086
ALU
Temporary Registers
Flags
EU
Control
System
1 2 3 4 5 6
CS
DS
SS
ES
IP
Internal
Communications
Registers
Bus
Control
Logic
ALU Data Bus
16
Q Bus
8
16
20
Data Bus
Address Bus
8086 Bus
General
Registers
Execution Unit
(EU)
Bus Interface Unit
(BIU)
Registers
Datapath
Control Unit
SWA.6
Intel Evolution Internal Data Bus
8080 8085 8086 8088 80286 80386 80486 Pentium P Pro P II P III
Year
Introduced 1974 1976 1978 1979 1982 1985 1989 1992 1995 1997 1999
Clock rate
(Hz) 2-3 3-8 5–10 5-8 6-16 16-33 25-50 60-166
150- 200
200-300 450-
1.13G
# Transistors 4.5k 6.5k 29k 29k 130k 275k 1.2M 3.1M 5.5M 7.5M 8.2M
Physical
Memory 64k 64k 1M 1M 16M 4G 4G 4G 64G 64G 64G
Internal
Data Bus 8 8 16 16 16 32 32 32 32 32 32
External
Data Bus 8 8 16 8 16 32 32 64 64 64 64
Address Bus 16 16 20 20 24 32 32 32 36 36 64
Data type
(bits) 8 8 8,16 8,16 8,16 8,16,32 8,16,32 8,16,32 8,16,32 8,16,32 8,16,32
4
SWA.7
Software Architecture Register Width IA-16 & IA-32
AH AL
BH BL
CH CL
DH DL
SP
BP
DI
SI
16-bits
CS
DS
SS
ES
IP
AH AL
BH BL
CH CL
DH DL
SP
BP
DI
SI
32-bits
CS
DS
SS
ES
AX
BX
CX
DX
16-bit Architectures 32-bit Architectures
EAX
EBX
ECX
EDX
ESP
EBP
EDI
ESI
FLAGS
General Purpose Registers
(GP)
Segment Registers
FS
GS
EIP
EFLAGS
8086 8088 80286
80386 80486 Pentium Pentium Pro Pentium II Pentium III Pentium 4 Pentium 4 HT Pentium M Pentium D Core Core 2
code segment data segment stack segment extra segment
SWA.8
5
SWA.9
Software Architecture Register Width IA-64 (EMT*)
ESI
64-bits
RAX
RBX
RCX
RDX
RSP
RBP
RDI
RSI
General Purpose Registers
(GP)
Xeon Extreme Edition Pentium 4 Core 2
*EMT = Extended memory 64 Technology
EDI
EBP
ESP
EDX
ECX
EBX
EAX
R8
R9
R15
R14
RIP
EFLAGS
SWA.10
Software Architecture Register Width IA-64 (Itanium)
64-bits
General Registers
Itanium
GR0
GR1
GR127
GR126
GR2
GR3
GR4
GR5
GR6
GR7
Instruction Bundle
128-bits
6
SWA.11
Software Architecture Register Width AMD64
ESI
64-bits
RAX
RBX
RCX
RDX
RSP
RBP
RDI
RSI
General Purpose Registers
AMD64
EDI
EBP
ESP
EDX
ECX
EBX
EAX
R8
R9
R15
R14
RIP
EFLAGS
SWA.12
Instruction Pointer
• Contains the address of the next word/byte of instruction code to be fetched from the current code segment of memory,
7
SWA.13
Intel Evolution Internal Data Bus
8080 8085 8086 8088 80286 80386 80486 Pentium P Pro P II P III
Year
Introduced 1974 1976 1978 1979 1982 1985 1989 1992 1995 1997 1999
Clock rate
(Hz) 2-3 3-8 5–10 5-8 6-16 16-33 25-50 60-166
150- 200
200-300 450-
1.13G
# Transistors 4.5k 6.5k 29k 29k 130k 275k 1.2M 3.1M 5.5M 7.5M 8.2M
Physical
Memory 64k 64k 1M 1M 16M 4G 4G 4G 64G 64G 64G
Internal
Data Bus 8 8 16 16 16 32 32 32 32 32 32
External
Data Bus 8 8 16 8 16 32 32 64 64 64 64
Address Bus 16 16 20 20 24 32 32 32 36 36 64
Data type
(bits) 8 8 8,16 8,16 8,16 8,16,32 8,16,32 8,16,32 8,16,32 8,16,32 8,16,32
SWA.14
Software Architecture Address Space
CPU
Address Bus
For example: 80x86 – 20 bit wide address bus 220 = 1MBytes
For example: Pentium II – 36 bit wide address bus 236 = 64GBytes
The physical address space is defined as the range of addresses
that the processor can generate on its address bus.
8
SWA.15
Software Architecture Example - 8086
AX
BX
CX
DX
SP
BP
SI
DI
CS
DS
SS
ES
FLAGS
IP
AH AL
BH BL
CH CL
DH DL
SP = Stack Pointer
BP = Base Pointer
SI = Source Index
DI = Data Index
SR = Status Register
IP = Instruction Pointer External memory
Address space
Data segment
(64 k)
Code segment
(64 k)
Stack segment
(64 k)
Input / Output address space Extra segment
(64 k)
FFFFF16
0000016 000016
FFFF16
Memory Address Space:
0000016 - FFFFF16
0 - 220 -1
220 = 1,048,576 bytes (1 Mbyte)
SWA.16
Data Storage
Nibble – 4 bits
Byte – 8 bits
Word – 16 bits (2 bytes)
Double word – 32 bits (4 bytes)
0101 0101
0001 1001
0100 0111
Address Memory
(Binary)
0062A16
0062916
0062816
55
19
47
Memory
(Hexadecimal)
55
19
47
3F
{ Word
{ Word Word: two consecutive bytes
Least significant byte
Most significant byte
Least significant byte
Most significant byte
Decreasing addresses
} Word:
551916
} Word:
473F16
Memory
(Hexadecimal)
(same for double words)
9
SWA.17
Data Storage Endians
• Big Endian: – Least Significant Byte @ higher address – Most Significant Byte @ lower address
• Little Endian: – Least Significant Byte @ lower address – Most Significant Byte @ higher address
• Little Endian processors: Intel 80x86, Pentium II/III/IV, VAX, Alpha • Big Endian processors: 680x0, Sun SPARC
• PowerPC: Alter the Endian-ness using instructions
SWA.18
Aligned and Misaligned Data
Byte 8
Byte 7
Byte 6
0063216
0063116
0063016
Byte 5
Byte 4
Byte 3
Byte 2
Byte 1
0062F16
0062E16
0062D1
6 0062C16
0062B16
Aligned
Words
Word 6
Word 4
Word 2
Byte 0 0062A1
6
Word 0
Word 5
Word 3
Word 1
Misaligned
Words
Data words:
Byte 8
Byte 7
Byte 6
0063016
0062F16
0062E16
Byte 5
Byte 4
Byte 3
Byte 2
Byte 1
0062D1
6 0062C16
0062B16
0062A1
6 0062916
Aligned
Double
Words
Double
Word 4
Byte 0 0062816
Misaligned
Double
Words
Data double words:
Double
Word 0
Double
Word 5
Double
Word 1
Double
Word 2
Double
Word 3
Aligned byte: Least Significant Byte at an even address
Misaligned byte: Least Significant Byte at an odd address
10
SWA.19
Examples
Address
0062A1
6 0062916
0062816
15
1A
A7
Memory
(Hexadecimal)
C5
10
4E
0062716
0062616
0062516
88
2D
0062416
0062316
Instruction 1: read a word @ address 0062716
Instruction 2: read a double word @ address 0062416
Instruction 3: read a word @ address 0062616
SWA.20
Memory Management Addressing Methodologies – Real Mode
Segment register Offset (4 nibbles)
Logical Address Physical Address
Space
Physical Address
Segment
Segment Base Address
+
0
Segment Register : Offset
“0”nibble
11
SWA.21
Real Mode Addresses Example: The Old 8086
Physical address: 20-bit value (remember: 20-bit address bus) Logical address: 16-bit base pointer (CS,SS,DS,ES) + an offset (IP, SP, BP, SI, DI)
How do we obtain a physical address from the logical address:
20-bit Physical memory Address
Adder
0 19
Segment Register 0 0 0 0
0 15
Offset value*
0 15 Notation: segment register : offset Example: DS = 123A16= 123AH BX = 223416 = 2234H Logical Address: DS:BX Physical address: DS:BX = 123AH:2234H = 123A0H + 02234H = 145D4H
*a.k.a. displacement
SWA.22
0000016 1000016 2000016 3000016
Physical memory
Segment A Segment B
Segment C
Segment D
Segment E
Disjoint
Fully
Overlapped Partially
Overlapped
Contiguous Logical segments
Memory Management Segments
• 8086/8088 – Segments are 216 = 64kbytes – Note that segment can be contiguous, adjacent, disjointed, and
overlapping.
12
SWA.23
Memory Management Segmentation – IA-32
Segment
Selector Offset (8 nibbles)
Logical Address Linear Address
Space
Linear Address
Segment
Segment Base Address
Segment Table
(Global or Local Descriptor Table)
(located in memory)
+
SWA.24
Memory Management Protected-Mode
• Protected-Mode operation allows memory above the first 1Mbytes to be accessed by the 80286 through the latest Pentium,
• Protected-mode introduces protection: – 8088/86 is unable to block general functions
from accessing the kernel of the operating system (a program can go from any code segment to any other code segment). In protected mode the OS is given a mechanism to prevent the user from accidentally taking over the core of the OS and thus crashing your computer.
13
SWA.25
Memory Management Paging
Directory Table Offset
Linear Address
Page
Directory
Entry
Page Tables
Entry
Physical Address
Space
Phys. Address
Page
Page Directory
Base Address
(from CR3)
+
SWA.26
Memory Management Segmentation & Paging – IA-32
Directory Table Offset
Linear Address
Page
Directory
Entry
Page Tables
Entry
Physical Address Space
Phys. Address
Page
Page Directory
Base Address
(from CR3)
+
Selector Offset
Logical Address
Segment Table
(Global or Local Descriptor Table)
(located in memory)
+
Paging Segmentation
14
SWA.27
Instruction Set Architecture
SWA.28
Programming Languages
High-level Language (C, C++, Pascal, BASIC,FORTRAN)
Compile & Link
Machine Code (Bytes stored in memory)
Assembly Language
Assemble
Machine Code (Bytes stored in memory)
Tool: Compiler & Linker Tool: Assembler
A mix of assembly and a high-level language can be used: inline-assembly
Source Code:
15
SWA.29
Assembly Language Assembly Statements
START: MOV AX,34EH ; Move 34EH into the AX register
MOV DX,[1234H] ; Move the contents of the DS memory location
; with offset 1234H into the DX register
ADD DX,AX ; Add AX to DX and store the result into DX
END
Label
Mnemonic
Argument Comments
MOV AX , 34EH
Destination
Source
SWA.30
Register Transfer Language (RTL) Intro
• RTL is machine independent !!!!
( • ) = “Contents of • ” = “Move operand on right-hand-side source to the left-hand-side destination” „&‟ = “AND ” „|‟ = “OR” „^‟ = “Exclusive-OR” „+‟ = “Addition” „-‟ = “Subtraction” „*‟ = “Multiplication” „/‟ = “Division”
VHDL and Verilog are also machine independent description languages but they differ from RTL
16
SWA.31
Assembly Language Assembly Statements - RTL
START: MOV AX, 34EH
MOV DX, [1234H]
ADD DX, AX
AX 34Eh
DX (1234h)
DX (DX) + (AX)
Effective Address 1234h
SWA.32
Machine Code Listing
00C00 B8 4E 03 START: MOV AX,34EH
00C03 8B 16 34 12 MOV DX,[1234H]
00C07 01 C2 ADD DX,AX
END
Address Program bytes in memory
Byte located at memory location (ML) 00C0516
Generated automatically by the Assembler or manually using the instruction information sheets as can be found in Volumes 2a and 2b.
17
SWA.33
Machine Code In Memory
Assembly will be converted to machine code for machine interpretation. As a result the program consists of a bunch of bytes in memory!
1216
8D16
1E16
0063316
0063416
0063516
5616
0416
4016
4B16
0116
0063616
0063716
0063816
0063916
0063A1
6 D816 0063B16
A116
3416
2516
OF16
0063216
0063116
0063C16
0063D1
6 OF16 0063E16
mov ax,[1234] ax (123416)
mov bx,[0456] bx (045616)
inc ax ax (ax) + 1
dec bx bx (bx) - 1 add ax,bx ax (ax) + (bx)
and ax,0F0F ax (ax) & 0F0F16
x86 Assembly RTL
SWA.34
Instruction Set Architecture IA-32
• General purpose – Arithmetic, Logic, Shift – Control and Branch, – Data movement.
• FPU • MMX • SSE extensions • SSE2 extensions • SSE3 extensions • SSE4 extensions • System instructions
“IA-32 Intel® Architecture Software Developer‟s Manual”
Volumes 2a & 2b
18
SWA.35
The Elements of an Instruction
• Operation code (opcode): – Binary code that specifies the operation to be
performed.
• Operands – Source operand reference:
• Operand that is the input for the operation
– Result (destination) operand reference: • Operand that is the result for the operation
• Next instruction reference: – Tells the CPU where to fetch the next instruction
SWA.36
The Elements of an Instruction
MOV CX, [013AH]
Mnemonic
Destination
Source
RTL: CX (0123A) or
Text: Move the contents of address DS:013A to register CX
19
SWA.37 “IA-32 Intel® Architecture Software Developer‟s Manual”, Volume 2a, pp. 3.38
SWA.38
The Operand
• The operands can be: – Addresses – Register contents – Numbers
• Integer or fixed-point • Floating point • Decimal
– Characters • ASCII etc.
– Logical data
20
SWA.39
Operands
“IA-32 Intel® Architecture Software Developer‟s Manual”, Volume 2a, pp. 3.37
SWA.40
Addressing Modes Memory Addressing Modes
• Immediate • Register • Direct • Register Indirect • Based • Indexed • Based-Indexed • Scaled Based-Indexed
21
SWA.41
Instructions Immediate & Register Addressing
The source or destination field is the operand
Examples: MOV AX,88 AX 88
Immediate Addressing
The source or destination field is a register
Examples: MOV AX,88 (Intel) AX 88
Register* Addressing
*Also ‘register direct’ addressing
Note: CS cannot be used as the destination
SWA.42
Instructions Register Indirect & Direct Addressing
The source or destination address is stored in a register.
Examples: MOV [BX],CL (Intel) DS:(BX) (CL)
Register Indirect Addressing
The source or destination address is explicitly given
Examples: MOV [124A],CL (Intel) DS:124A (CL)
Direct* Addressing
*Also ‘displacement’ addressing
22
SWA.43
Instructions Based & Indexed Addressing*
The source or destination address is determined by the contents of a base register plus an absolute displacement
Examples: MOV [BX]+0123H,CL DS:(BX)+0123H (CL)
Based Addressing
The source or destination address is determined by the contents of a index register plus an absolute displacement
Indexed Addressing
*these are forms of so-called relative addressing
Examples: MOV [DI]+0123H,CL DS:(DI)+0123H (CL)
SWA.44
Instructions Based - Indexed Addressing*
The source or destination address is determined by the contents of a base register plus the contents of
an index register plus an absolute displacement
Examples: MOV [BX][SI]+0123H,CL DS:(BX)+(SI)+0123H (CL)
Based Indexed Addressing
*these are forms of so-called relative addressing
23
SWA.45
Addressing Effective Address
Effective Address: Offset within a segment
Example 1: MOV AX, [BX]+123H -> (BX)+123H is the effective address or offset
within the data segment (DS).
Example 2: ADD CX, [BP][SI]+12H -> (BP+SI)+12H is the effective address or offset
within the stack segment (SS).
One can override the default segment by explicitly indicating the segment within
which the data can be found.
Example 3: MOV AX, ES:[BX]+123H -> (BX)+123H is the effective address or offset
within the extra segment (ES).
SWA.46
Addressing Effective Address/Offset
bits32
bits16
bits8
none
8
4
2
1
*
)(
)(
)(
)(
)(
)(
)(
)(
)(
)(
)(
)(
)(
)(
)(
:
DIE
SIE
BPE
BXE
DXE
CXE
AXE
DIE
SIE
BPE
SPE
BXE
DXE
CXE
AXE
GS
FS
ES
SS
DS
CS
Segment Base Displacement
(a) 32-bit x86 Architectures
bits-16
bits-8
none
:DI
SI
BX
BP
ES
SS
DS
CS
Segment Base Index Displacement
(a) 16-bit x86 Architectures
( Index * Scale) Note 1:
Right-hand side of
the colon is referred
to as the effective address
Note 2:
Each component can
be positive or negative
(2s complement).
24
SWA.47
Constructing Addresses Default combinations
Segment Offset Special Purpose
CS IP Instruction address
SS SP and BP Stack address
DS BX, DI, SI, 8-bit number, 16-bit number Data address
ES DI String destination address
16-bit segment and offsets (Table 2-3 in textbook)
Segment Offset Special Purpose
CS EIP Instruction address
SS ESP and EBP Stack address
DS EAX, EBX, ECX, EDX, ESI, EDI,
8-bit number, 32-bit number Data address
ES EDI String destination address
FS No default General address
GS No default General address
32-bit segment and offsets (Table 2-4 in textbook)
SWA.48
Instruction Format Machine Code
25
SWA.49
Operands – Volumes 2a & 2b
“IA-32 Intel® Architecture Software Developer‟s Manual”, Volume 2a, pp. 3.640
SWA.50
Operands
26
SWA.51
Operands
SWA.52
Operands
27
SWA.53
SWA.54
28
SWA.55
SWA.56
Example 1
Ex 1 (286): MOV AX, [BP] + 1988H
r16 m16 MOV r16, m16
Volume 2a pp. 3-582(631)
29
SWA.57
SWA.58
Example 1
Ex 1 MOV AX, [BP] + 1988H
8B 86 88 19 Displacement: low-byte first
30
SWA.59
Example 2
Ex 2 (286): ADD [BP][DI]+1234H , CX
01 8B 34 12 Machine Code:
SWA.60
31
SWA.61
Example 3
Ex 5 (Pentium/Core): MOV EAX,[EBX+4*ECX]
Result: 8B 04 8B H
SWA.62
32
SWA.63
SWA.64
Others
Ex 4 : SUB BX , 03EFH
Result: 81 EB EF 03 H
Ex 5 : MOV [1234H], DS
Result: 8C 1E 34 12 H
33
SWA.65
Operand Table Examples
MOV r/m32, r32 Destination Source MOV [12345678H], EAX Memory direct Register direct MOV EDX, EAX Register direct Register direct MOV [EBP],ECX Based Register direct
MOV r/m16, imm16 Destination Source MOV [12345678H], A432H Memory direct Immediate MOV DX, A432H Register direct Immediate MOV [EBP], A432H Based Immediate
SWA.66
Utilization of registers or displacements
Type Base Index Scale Displacement
Register Operand No memory address required
Immediate Operand No memory address required
Direct2 - - - X
Register indirect X or X - -
Based X - - X
Index X - X
Based-Index X X - X
Scaled-Index1 - X X X
Based Scaled-Index1 X X X X
Addressing Modes IA-16 & IA32
1Only available in the 80386 through Pentium 2Or displacement addressing
34
SWA.67
Type Instruction
Register Operand MOV AX,BX
Immediate Operand MOV CH, 3AH
Direct MOV [1234H],AX
Register indirect MOV [BX],CL
Based MOV [BX]+10ABH,AL
Indexed MOV CH, [SI]+88H
Based-Indexed MOV AX, [BP][DP]+2001H
Scaled-Indexed MOV [SI]*2+234H,AX
Based Scaled-Indexed MOV [BX][SI]*4,AH
Addressing Modes Notation
SWA.68
C3
XX
00A8BH
00A8CH
00A8DH
8B 00A8AH
AX
BX
CX
DX
00A0
008A
XX XX
AB CD
CS
DS
SS
ES
IP
SP
BP
SI
DI
(a) Before execution of instruction
Register Operand Addressing Mode
C3
XX
00A8BH
00A8CH
00A8DH
8B 00A8AH
AX
BX
CX
DX
00A0
008C
AB CD
AB CD
CS
DS
SS
ES
IP
SP
BP
SI
DI
(b) After execution of instruction
MOV AX,BX
35
SWA.69
2A
XX
00A8BH
00A8CH
00A8DH
B0 00A8AH
AX
BX
CX
DX
00A0
008A
XX
CS
DS
SS
ES
IP
SP
BP
SI
DI
(a) Before execution of instruction
Immediate Operand Addressing Mode
2A
XX
00A8BH
00A8CH
00A8DH
B0 00A8AH
AX
BX
CX
DX
00A0
008C
2A
CS
DS
SS
ES
IP
SP
BP
SI
DI
(b) After execution of instruction
MOV AL,2AH
SWA.70
Direct Addressing Mode MOV CX,[10ABH]
0E
AB
10
00A8BH
00A8CH
00A8DH
8B 00A8AH
AX
BX
CX
DX
00A0
01C0
008A
CS
DS
SS
ES
IP
SP
BP
SI
DI
(a) Before execution of instruction
23
DA
02CABH
02CACH
(b) After execution of instruction
0E
AB
10
00A8BH
00A8CH
00A8DH
8B 00A8AH
AX
BX
CX
DX
00A0
01C0
008E
DA 23
CS
DS
SS
ES
IP
SP
BP
SI
DI
23
DA
02CABH
02CACH
XX 00A8EH
36
SWA.71
Register Indirect Addressing Mode MOV AX,[SI]
04
XX
XX
00A8BH
00A8CH
00A8DH
8B 00A8AH
AX
BX
CX
DX
10AB
00A0
01C0
008A
XX XX
CS
DS
SS
ES
IP
SP
BP
SI
DI
(a) Before execution of instruction
23
DA
02CABH
02CACH
(b) After execution of instruction
04
XX
00A8BH
00A8CH
00A8DH
8B 00A8AH
AX
BX
CX
DX
10AB
00A0
01C0
008C
DA 23
CS
DS
SS
ES
IP
SP
BP
SI
DI
23
DA
02CABH
02CACH
XX
SWA.72
Based Addressing Mode MOV [BX]+00ACH, AL
87
AC
00
00A8BH
00A8CH
00A8DH
88 00A8AH
AX
BX
CX
DX
00A0
01C0
008A
10 A8
10 00
CS
DS
SS
ES
IP
SP
BP
SI
DI
(a) Before fetch and execution of instruction
XX
XX
02CABH
02CACH
XX 00A8EH
(b) After execution of instruction
AX
BX
CX
DX
00A0
01C0
008E
10 A8
10 00
CS
DS
SS
ES
IP
SP
BP
SI
DI
XX
A8
02CABH
02CACH
87
AC
00
00A8BH
00A8CH
00A8DH
88 00A8AH
XX 00A8EH
37
SWA.73
Indexed Addressing Mode MOV AL,[SI]+1000H
84
00
10
00A8BH
00A8CH
00A8DH
8A 00A8AH
AX
BX
CX
DX
00AB
00A0
01C0
008A
XX XX
CS
DS
SS
ES
IP
SP
BP
SI
DI
(a) Before fetch and execution of instruction
88
19
02CABH
02CACH
XX 00A8EH
(b) After execution of instruction
AX
BX
CX
DX
00AB
00A0
01C0
008E
XX 88
CS
DS
SS
ES
IP
SP
BP
SI
DI
88
19
02CABH
02CACH
84
00
10
00A8BH
00A8CH
00A8DH
8A 00A8AH
XX 00A8EH
SWA.74
Other Examples
XOR EAX, [ECX+8*ESI]+1234H
PUSH [1426H]
ADD BP,[1234H]
SUB EAX,[BP]
INC [BP]+68H
Recommended