System
MPX
Memory Protection Extensions added bound registers and instructions that check pointers against bounds; Intel has deprecated MPX, and its core processors since Ice Lake lack it.
- CPUID
- MPX
CPUID.(EAX=07H,ECX=0):EBX[14] - Instructions
- 7 mnemonics
- Processors
- Skylake, Comet Lake, Cannon Lake, Skylake-SP, Cascade Lake, Cooper Lake, Goldmont, Goldmont Plus, Tremont, Snow Ridge
Memory Protection Extensions tried to catch buffer overflows in hardware. Four bound registers, BND0 to BND3, hold the lower and upper bound of a pointer; BNDMK makes bounds, BNDCL, BNDCU and BNDCN check an address against them and raise a bound-range exception, and BNDLDX and BNDSTX keep bounds for pointers stored in memory in tables that the operating system allocates. The instructions use opcodes that older processors execute as NOPs, so instrumented code ran anywhere.
Intel has deprecated MPX: its manual says no future processor will have it, and XED’s chip model has it only on processors from Skylake to Cooper Lake and on the Goldmont to Tremont Atoms. The instructions are listed here for disassembly and for old binaries.
Instructions
| Mnemonic | Summary | Forms |
|---|---|---|
| BNDCL | Raises a bound-range exception (#BR) if an address is below the lower bound in an MPX bound register; MPX has been removed. | 3 |
| BNDCN | Raises #BR if an address is above the upper bound of an MPX bound register, taken as stored rather than complemented as BNDCU does; MPX has been removed. | 3 |
| BNDCU | Raises #BR if an address is above the upper bound of an MPX bound register, which keeps it in one's complement; MPX has been removed. | 3 |
| BNDLDX | Loads the MPX bounds of a pointer from the bound tables in memory, found by the address the pointer is stored at; MPX has been removed. | 2 |
| BNDMK | Makes MPX bounds from a memory operand: the lower bound from its base, the upper from its address; MPX has been removed. | 1 |
| BNDMOV | Copies MPX bounds between bound registers, or between a bound register and memory; MPX has been removed. | 5 |
| BNDSTX | Stores the MPX bounds of a pointer into the bound tables in memory, found by the address the pointer is stored at; MPX has been removed. | 2 |
CPUID and processors
XED splits MPX into 1 ISA set. Software can use a form when the processor reports every CPUID bit of one alternative of the form's ISA set.
| ISA set | CPUID | Processors |
|---|---|---|
MPX | MPX | Skylake, Comet Lake, Cannon Lake, Skylake-SP, Cascade Lake, Cooper Lake, Goldmont, Goldmont Plus, Tremont, Snow Ridge |
Sources
- Intel XED v2026.08.23 (commit
0bcb6237345c): forms, encodings, ISA sets, CPUID bits and chip model. - Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 2 (325383-093, September 2026)
- Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 1 (253665-093, September 2026)
The tables are derived from Intel XED, Copyright Intel Corporation, licensed under the Apache License 2.0; x86-64.net converted and reformatted them. The text is our own.