x86-64.net

Instruction

BNDMOV

Copies MPX bounds between bound registers, or between a bound register and memory; MPX has been removed.

Extensions
Forms
5 (5 Legacy)
Data
Intel XED v2026.08.23

Forms

Every encoding of BNDMOV that Intel XED knows, one row per XED instruction form (iform). How to read the notation.
InstructionEncodingRequires
BNDMOV bnd, bnd BNDMOV_BND_BND66 0F 1A /r
66 0F 1B /r		MPX
BNDMOV bnd, m64 not in 64-bit mode BNDMOV_BND_MEMq66 0F 1A /rMPX
BNDMOV bnd, m128 64-bit mode only BNDMOV_BND_MEMdq66 0F 1A /rMPX
BNDMOV m64, bnd not in 64-bit mode BNDMOV_MEMq_BND66 0F 1B /rMPX
BNDMOV m128, bnd 64-bit mode only BNDMOV_MEMdq_BND66 0F 1B /rMPX

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

Register forms
on = 0                           # CPUID: no MPX: a hint NOP
if cpuid_leaf(7, 0)[1] >> 14 & 1:
    cfg = bndcfgu if CPL == 3 else bndcfgs
    on = cr4 >> 18 & 1 and cfg & 1  # CR4.OSXSAVE, BNDCFGx.EN
if on and xcr0 >> 3 & 3 == 3:    # XCR0's BNDREGS, BNDCSR
    n = max(dest.number, src.number)
    if n > 3:                    # BND4 to BND15
        fault(UD)
    dest.write(src.read())       # both bounds, as they are
# 66 0F 1A and 66 0F 1B both have this form, the destination in
# ModRM.reg or in ModRM.rm

Run on AMD Zen 5 (EPYC 9645): 1 case. It ran where CPUID reported no MPX.

BNDMOV bnd, m128 64-bit mode only
on = 0                           # CPUID: no MPX: a hint NOP
if cpuid_leaf(7, 0)[1] >> 14 & 1:
    cfg = bndcfgu if CPL == 3 else bndcfgs
    on = cr4 >> 18 & 1 and cfg & 1  # CR4.OSXSAVE, BNDCFGx.EN
if on and xcr0 >> 3 & 3 == 3:    # XCR0's BNDREGS, BNDCSR
    if dest.number > 3:          # BND4 to BND15
        fault(UD)
    dest.write(src.read())       # LB at m, UB at m + 8
# with MPX off nothing is read, so nothing faults

Run on AMD Zen 5 (EPYC 9645): 1 case. It ran where CPUID reported no MPX.

BNDMOV m128, bnd 64-bit mode only
on = 0                           # CPUID: no MPX: a hint NOP
if cpuid_leaf(7, 0)[1] >> 14 & 1:
    cfg = bndcfgu if CPL == 3 else bndcfgs
    on = cr4 >> 18 & 1 and cfg & 1  # CR4.OSXSAVE, BNDCFGx.EN
if on and xcr0 >> 3 & 3 == 3:    # XCR0's BNDREGS, BNDCSR
    if src.number > 3:           # BND4 to BND15
        fault(UD)
    dest.write(src.read())       # LB at m, UB at m + 8

Run on AMD Zen 5 (EPYC 9645): 1 case. It ran where CPUID reported no MPX.

BNDMOV bnd, m64 not in 64-bit mode
on = 0                           # CPUID: no MPX: a hint NOP
if cpuid_leaf(7, 0)[1] >> 14 & 1:
    cfg = bndcfgu if CPL == 3 else bndcfgs
    on = cr4 >> 18 & 1 and cfg & 1  # CR4.OSXSAVE, BNDCFGx.EN
if on and xcr0 >> 3 & 3 == 3:    # XCR0's BNDREGS, BNDCSR
    if dest.number > 3:          # BND0 to BND3 only
        fault(UD)
    v = src.read()               # LB at m, UB at m + 4,
    ub = v >> 32                 # zero-extended
    dest.write(ub << 64 | low(v, 32))

Not run on a processor: the form does not exist in 64-bit mode, where the probe runs.

BNDMOV m64, bnd not in 64-bit mode
on = 0                           # CPUID: no MPX: a hint NOP
if cpuid_leaf(7, 0)[1] >> 14 & 1:
    cfg = bndcfgu if CPL == 3 else bndcfgs
    on = cr4 >> 18 & 1 and cfg & 1  # CR4.OSXSAVE, BNDCFGx.EN
if on and xcr0 >> 3 & 3 == 3:    # XCR0's BNDREGS, BNDCSR
    if src.number > 3:           # BND0 to BND3 only
        fault(UD)
    b = src.read()               # bits 31:0 of each bound
    ub = low(b >> 64, 32)
    dest.write(ub << 32 | low(b, 32))

Not run on a processor: the form does not exist in 64-bit mode, where the probe runs.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.
OperandKindAction
BNDMOV bnd, bnd
bndexplicitwrite
bndexplicitread
BNDMOV bnd, m64 not in 64-bit mode BNDMOV bnd, m128 64-bit mode only
bndexplicitwrite
m64/128explicitread
BNDMOV m64, bnd not in 64-bit mode BNDMOV m128, bnd 64-bit mode only
m64/128explicitwrite
bndexplicitread

Flags

None: XED records no flag that the forms test or change.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.
ISA setCPUIDProcessors
MPX

MPX
CPUID.(EAX=07H,ECX=0):EBX[14] MPX

Skylake, Comet Lake, Cannon Lake, Skylake-SP, Cascade Lake, Cooper Lake, Goldmont, Goldmont Plus, Tremont, Snow Ridge

More MPX instructions

Sources

  1. Intel XED v2026.08.23 (commit 0bcb6237345c): forms, encodings, operands, flags, exception classes, attributes, ISA sets, CPUID bits and chip model.
  2. Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 2 (325383-093, September 2026): Volume 2A, page 3-99 (BNDMOV)
  3. Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 1 (253665-093, September 2026)

The tables are derived from Intel XED, Copyright Intel Corporation, licensed under the Apache License 2.0; x86-64.net converted and reformatted them. The text is our own.