bndcu

Check Upper Bound

BNDCU b, r/m

Checks if address is within upper bound.

Details

Checks if an address or value is less than or equal to the upper bound stored in the bounds register; if not, a bounds exception (#BR) is signaled. The source operand (register or memory) contains the address to be checked against bndN.upper. No flags are modified; an out-of-bounds condition triggers exception delivery. This instruction is part of deprecated Memory Protection Extensions (MPX).

Pseudocode Operation

address ← (src is memory) ? load_from_memory(src) : src;
IF (address > bndN.upper) THEN
  #BR; // Bounds Range Exceeded exception
END;
// No flags modified; execution continues on success

Example

BNDCU b, rbx

Encoding

Binary Layout

Format Legacy

Opcode F2 0F 1A

Extension MPX

Operands

dest
MPX bounds register (bnd0–bnd3)
src
Register or memory operand

Reference (Intel® SDM)

Instruction Forms

Opcode	Instruction	Op/En	64/32-bit Mode	CPUID	Description
F2 0F 1A /r	BNDCU bnd, r/m32	RM	N.E./V	MPX	Generate a #BR if the address in r/m32 is higher than the upper bound in bnd.UB (bnb.UB in 1's complement form).
F2 0F 1A /r	BNDCU bnd, r/m64	RM	V/N.E.	MPX	Generate a #BR if the address in r/m64 is higher than the upper bound in bnd.UB (bnb.UB in 1's complement form).
F2 0F 1B /r	BNDCN bnd, r/m32	RM	N.E./V	MPX	Generate a #BR if the address in r/m32 is higher than the upper bound in bnd.UB (bnb.UB not in 1's complement form).
F2 0F 1B /r	BNDCN bnd, r/m64	RM	V/N.E.	MPX	Generate a #BR if the address in r/m64 is higher than the upper bound in bnd.UB (bnb.UB not in 1's complement form).

Description

Compare the address in the second operand with the upper bound in bnd. The second operand can be either a register or a memory operand. If the address is higher than the upper bound in bnd.UB, it will set BNDSTATUS to 01H and signal a #BR exception. BNDCU perform 1’s complement operation on the upper bound of bnd first before proceeding with address comparison. BNDCN perform address comparison directly using the upper bound in bnd that is already reverted out of 1’s complement form. This instruction does not cause any memory access, and does not read or write any flags. Effective address computation of m32/64 has identical behavior to LEA

Operation

BNDCU BND, reg
IF reg > NOT(BND.UB) Then
BNDSTATUS := 01H;
#BR;
FI;

BNDCU BND, mem
TEMP := LEA(mem);
IF TEMP > NOT(BND.UB) Then
BNDSTATUS := 01H;
#BR;
FI;

BNDCN BND, reg
IF reg > BND.UB Then
BNDSTATUS := 01H;
#BR;
FI;





BNDCU/BNDCN—Check Upper Bound                                                                                                               Vol. 2A 3-92
BNDCN BND, mem
TEMP := LEA(mem);
IF TEMP > BND.UB Then
BNDSTATUS := 01H;
#BR;
FI;

Intel C/C++ Compiler Intrinsic Equivalent

BNDCU .void  _bnd_chk_ptr_ubounds(const void *q)

Flags Affected

None

Exceptions

Protected Mode Exceptions

#BR If upper bound check fails. #UD If the LOCK prefix is used. If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. If 67H prefix is not used and CS.D=0. If 67H prefix is used and CS.D=1.

Real-Address Mode Exceptions

#BR If upper bound check fails. #UD If the LOCK prefix is used. If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. If 16-bit addressing is used.

Virtual-8086 Mode Exceptions

#BR If upper bound check fails. #UD If the LOCK prefix is used. If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. If 16-bit addressing is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#UD If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled. Same exceptions as in protected mode. BNDCU/BNDCN—Check Upper Bound Vol. 2A 3-93