x86-64.net

Instruction

BNDCL

Raises a bound-range exception (#BR) if an address is below the lower bound in an MPX bound register; MPX has been removed.

Extensions
Forms
3 (3 Legacy)
Data
Intel XED v2026.08.23

Forms

Every encoding of BNDCL that Intel XED knows, one row per XED instruction form (iform). How to read the notation.
InstructionEncodingRequires
BNDCL bnd, m BNDCL_BND_AGENF3 0F 1A /rMPX
BNDCL bnd, r64 64-bit mode only BNDCL_BND_GPR64F3 0F 1A /rMPX
BNDCL bnd, r32 not in 64-bit mode BNDCL_BND_GPR32F3 0F 1A /rMPX

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

BNDCL bnd, m
on = 0                           # CPUID: no MPX: a hint NOP
if cpuid_leaf(7, 0)[1] >> 14 & 1:
    cfg = bndcfgu if CPL == 3 else bndcfgs
    on = cr4 >> 18 & 1 and cfg & 1  # CR4.OSXSAVE, BNDCFGx.EN
if on and xcr0 >> 3 & 3 == 3:    # XCR0's BNDREGS, BNDCSR
    if bnd.number > 3:           # BND4 to BND15
        fault(UD)
    lb = low(bnd.read(), 64)
    if src.address < lb:         # below the lower bound
        bound_fault(1)
# src's address is computed as LEA does, and nothing is read
# from it; no flag changes

Run on AMD Zen 5 (EPYC 9645): 1 case. It ran where CPUID reported no MPX.

Forms only in 64-bit mode
on = 0                           # CPUID: no MPX: a hint NOP
if cpuid_leaf(7, 0)[1] >> 14 & 1:
    cfg = bndcfgu if CPL == 3 else bndcfgs
    on = cr4 >> 18 & 1 and cfg & 1  # CR4.OSXSAVE, BNDCFGx.EN
if on and xcr0 >> 3 & 3 == 3:    # XCR0's BNDREGS, BNDCSR
    if bnd.number > 3:           # BND4 to BND15
        fault(UD)
    lb = low(bnd.read(), 64)
    if src.read() < lb:          # below the lower bound
        bound_fault(1)

Run on AMD Zen 5 (EPYC 9645): 1 case. It ran where CPUID reported no MPX.

Forms not in 64-bit mode
on = 0                           # CPUID: no MPX: a hint NOP
if cpuid_leaf(7, 0)[1] >> 14 & 1:
    cfg = bndcfgu if CPL == 3 else bndcfgs
    on = cr4 >> 18 & 1 and cfg & 1  # CR4.OSXSAVE, BNDCFGx.EN
if on and xcr0 >> 3 & 3 == 3:    # XCR0's BNDREGS, BNDCSR
    if bnd.number > 3:           # BND0 to BND3 only
        fault(UD)
    lb = low(bnd.read(), 32)     # 32-bit bounds
    if src.read() < lb:          # below the lower bound
        bound_fault(1)

Not run on a processor: the form does not exist in 64-bit mode, where the probe runs.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.
OperandKindAction
BNDCL bnd, m
bndexplicitread
mexplicitaddress only
BNDCL bnd, r32 not in 64-bit mode BNDCL bnd, r64 64-bit mode only
bndexplicitread
r32/64explicitread

Flags

None: XED records no flag that the forms test or change.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.
ISA setCPUIDProcessors
MPX

MPX
CPUID.(EAX=07H,ECX=0):EBX[14] MPX

Skylake, Comet Lake, Cannon Lake, Skylake-SP, Cascade Lake, Cooper Lake, Goldmont, Goldmont Plus, Tremont, Snow Ridge

More MPX instructions

Sources

  1. Intel XED v2026.08.23 (commit 0bcb6237345c): forms, encodings, operands, flags, exception classes, attributes, ISA sets, CPUID bits and chip model.
  2. Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 2 (325383-093, September 2026): Volume 2A, page 3-90 (BNDCL)
  3. Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 1 (253665-093, September 2026)

The tables are derived from Intel XED, Copyright Intel Corporation, licensed under the Apache License 2.0; x86-64.net converted and reformatted them. The text is our own.