x86-64.net

Instruction

BNDCN

Raises #BR if an address is above the upper bound of an MPX bound register, taken as stored rather than complemented as BNDCU does; MPX has been removed.

Extensions
Forms
3 (3 Legacy)
Data
Intel XED v2026.08.23

Forms

Every encoding of BNDCN that Intel XED knows, one row per XED instruction form (iform). How to read the notation.
InstructionEncodingRequires
BNDCN bnd, m BNDCN_BND_AGENF2 0F 1B /rMPX
BNDCN bnd, r64 64-bit mode only BNDCN_BND_GPR64F2 0F 1B /rMPX
BNDCN bnd, r32 not in 64-bit mode BNDCN_BND_GPR32F2 0F 1B /rMPX

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

BNDCN bnd, m
on = 0                           # CPUID: no MPX: a hint NOP
if cpuid_leaf(7, 0)[1] >> 14 & 1:
    cfg = bndcfgu if CPL == 3 else bndcfgs
    on = cr4 >> 18 & 1 and cfg & 1  # CR4.OSXSAVE, BNDCFGx.EN
if on and xcr0 >> 3 & 3 == 3:    # XCR0's BNDREGS, BNDCSR
    if bnd.number > 3:           # BND4 to BND15
        fault(UD)
    ub = bnd.read() >> 64        # UB as it is: not complemented
    if src.address > ub:         # above the upper bound
        bound_fault(1)
# for an upper bound that software keeps as it is, not as BNDMK
# leaves it; src's address is computed as LEA does, not read

Run on AMD Zen 5 (EPYC 9645): 1 case. It ran where CPUID reported no MPX.

Forms only in 64-bit mode
on = 0                           # CPUID: no MPX: a hint NOP
if cpuid_leaf(7, 0)[1] >> 14 & 1:
    cfg = bndcfgu if CPL == 3 else bndcfgs
    on = cr4 >> 18 & 1 and cfg & 1  # CR4.OSXSAVE, BNDCFGx.EN
if on and xcr0 >> 3 & 3 == 3:    # XCR0's BNDREGS, BNDCSR
    if bnd.number > 3:           # BND4 to BND15
        fault(UD)
    ub = bnd.read() >> 64        # UB as it is: not complemented
    if src.read() > ub:          # above the upper bound
        bound_fault(1)

Run on AMD Zen 5 (EPYC 9645): 1 case. It ran where CPUID reported no MPX.

Forms not in 64-bit mode
on = 0                           # CPUID: no MPX: a hint NOP
if cpuid_leaf(7, 0)[1] >> 14 & 1:
    cfg = bndcfgu if CPL == 3 else bndcfgs
    on = cr4 >> 18 & 1 and cfg & 1  # CR4.OSXSAVE, BNDCFGx.EN
if on and xcr0 >> 3 & 3 == 3:    # XCR0's BNDREGS, BNDCSR
    if bnd.number > 3:           # BND0 to BND3 only
        fault(UD)
    ub = low(bnd.read() >> 64, 32)  # 32 bits, as they are
    if src.read() > ub:          # above the upper bound
        bound_fault(1)

Not run on a processor: the form does not exist in 64-bit mode, where the probe runs.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.
OperandKindAction
BNDCN bnd, m
bndexplicitread
mexplicitaddress only
BNDCN bnd, r32 not in 64-bit mode BNDCN bnd, r64 64-bit mode only
bndexplicitread
r32/64explicitread

Flags

None: XED records no flag that the forms test or change.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.
ISA setCPUIDProcessors
MPX

MPX
CPUID.(EAX=07H,ECX=0):EBX[14] MPX

Skylake, Comet Lake, Cannon Lake, Skylake-SP, Cascade Lake, Cooper Lake, Goldmont, Goldmont Plus, Tremont, Snow Ridge

More MPX instructions

Sources

  1. Intel XED v2026.08.23 (commit 0bcb6237345c): forms, encodings, operands, flags, exception classes, attributes, ISA sets, CPUID bits and chip model.
  2. Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 2 (325383-093, September 2026): Volume 2A, page 3-92 (BNDCU/BNDCN)
  3. Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 1 (253665-093, September 2026)

The tables are derived from Intel XED, Copyright Intel Corporation, licensed under the Apache License 2.0; x86-64.net converted and reformatted them. The text is our own.