BNDCU instruction (MPX)

Forms

Every encoding of BNDCU that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`BNDCU bnd, m` BNDCU_BND_AGEN	`F2 0F 1A /r`	MPX
`BNDCU bnd, r64` 64-bit mode only BNDCU_BND_GPR64	`F2 0F 1A /r`	MPX
`BNDCU bnd, r32` not in 64-bit mode BNDCU_BND_GPR32	`F2 0F 1A /r`	MPX

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

BNDCU bnd, m

on = 0                           # CPUID: no MPX: a hint NOP
if cpuid_leaf(7, 0)[1] >> 14 & 1:
    cfg = bndcfgu if CPL == 3 else bndcfgs
    on = cr4 >> 18 & 1 and cfg & 1  # CR4.OSXSAVE, BNDCFGx.EN
if on and xcr0 >> 3 & 3 == 3:    # XCR0's BNDREGS, BNDCSR
    if bnd.number > 3:           # BND4 to BND15
        fault(UD)
    b = bnd.read()
    ub = low(~(b >> 64), 64)     # the bound: UB complemented
    if src.address > ub:         # above the upper bound
        bound_fault(1)
# src's address is computed as LEA does, and nothing is read
# from it. A check of an access of n bytes at p takes p + n - 1

Run on AMD Zen 5 (EPYC 9645): 1 case. It ran where CPUID reported no MPX.

Forms only in 64-bit mode

on = 0                           # CPUID: no MPX: a hint NOP
if cpuid_leaf(7, 0)[1] >> 14 & 1:
    cfg = bndcfgu if CPL == 3 else bndcfgs
    on = cr4 >> 18 & 1 and cfg & 1  # CR4.OSXSAVE, BNDCFGx.EN
if on and xcr0 >> 3 & 3 == 3:    # XCR0's BNDREGS, BNDCSR
    if bnd.number > 3:           # BND4 to BND15
        fault(UD)
    b = bnd.read()
    ub = low(~(b >> 64), 64)     # the bound: UB complemented
    if src.read() > ub:          # above the upper bound
        bound_fault(1)

Run on AMD Zen 5 (EPYC 9645): 1 case. It ran where CPUID reported no MPX.

Forms not in 64-bit mode

on = 0                           # CPUID: no MPX: a hint NOP
if cpuid_leaf(7, 0)[1] >> 14 & 1:
    cfg = bndcfgu if CPL == 3 else bndcfgs
    on = cr4 >> 18 & 1 and cfg & 1  # CR4.OSXSAVE, BNDCFGx.EN
if on and xcr0 >> 3 & 3 == 3:    # XCR0's BNDREGS, BNDCSR
    if bnd.number > 3:           # BND0 to BND3 only
        fault(UD)
    b = bnd.read()
    ub = low(~(b >> 64), 32)     # 32 bits, complemented
    if src.read() > ub:          # above the upper bound
        bound_fault(1)

Not run on a processor: the form does not exist in 64-bit mode, where the probe runs.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.

Operand	Kind	Action
`BNDCU bnd, m`
`bnd`	explicit	read
`m`	explicit	address only
`BNDCU bnd, r32` not in 64-bit mode `BNDCU bnd, r64` 64-bit mode only
`bnd`	explicit	read
`r32/64`	explicit	read

Flags

None: XED records no flag that the forms test or change.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set	CPUID	Processors
`MPX` MPX	MPX `CPUID.(EAX=07H,ECX=0):EBX[14]` MPX	Skylake, Comet Lake, Cannon Lake, Skylake-SP, Cascade Lake, Cooper Lake, Goldmont, Goldmont Plus, Tremont, Snow Ridge

BNDCU

Forms

Operation

Operands

Flags

CPUID and processors

More MPX instructions

Sources