bndmov

Move Bounds

BNDMOV b, b/m

Moves MPX bounds data.

Details

Moves a 128-bit bounds pair from source (bounds register or memory) to destination (bounds register). The bounds pair consists of two 64-bit values (lower and upper bounds). No flags are set or modified. This instruction is part of deprecated Memory Protection Extensions (MPX) and is one of the few instructions that operate directly on bounds data.

Pseudocode Operation

// Source can be bounds register or 16 bytes of memory
IF (src is bounds register) THEN
  bndN.lower ← src.lower;
  bndN.upper ← src.upper;
ELSE
  bndN.lower ← [src];
  bndN.upper ← [src + 8];
END;
// No flags modified

Example

BNDMOV b, b/m

Encoding

Binary Layout
66
+0
0F
+1
1A
+2
 
Format Legacy
Opcode 66 0F 1A
Extension MPX

Operands

  • dest
    MPX bounds register (bnd0–bnd3)
  • src
    Memory operand

Reference (Intel® SDM)

Instruction Forms

Opcode Instruction Op/En 64/32-bit Mode CPUID Description
66 0F 1A /r BNDMOV bnd1, bnd2/m64 RM N.E./V MPX Move lower and upper bound from bnd2/m64 to bound register bnd1.
66 0F 1A /r BNDMOV bnd1, bnd2/m128 RM V/N.E. MPX Move lower and upper bound from bnd2/m128 to bound register bnd1.
66 0F 1B /r BNDMOV bnd1/m64, bnd2 MR N.E./V MPX Move lower and upper bound from bnd2 to bnd1/m64.
66 0F 1B /r BNDMOV bnd1/m128, bnd2 MR V/N.E. MPX Move lower and upper bound from bnd2 to bound register bnd1/m128.

Description

BNDMOV moves a pair of lower and upper bound values from the source operand (the second operand) to the destination (the first operand). Each operation is 128-bit move. The exceptions are same as the MOV instruction. The memory format for loading/store bounds in 64-bit mode is shown in Figure 3-5. BNDMOV to memory in 64-bit mode Upper Bound (UB) Lower Bound (LB) 16 8 0 Byte offset BNDMOV to memory in 32-bit mode Upper Bound (UB) Lower Bound (LB) 16 8 4 0 Byte offset Figure 3-5. Memory Layout of BNDMOV to/from Memory This instruction does not change flags.

Operation

BNDMOV register to register
DEST.LB := SRC.LB;
DEST.UB := SRC.UB;





BNDMOV—Move Bounds                                                                                                                            Vol. 2A 3-99
BNDMOV from memory
IF 64-bit mode THEN
DEST.LB := LOAD_QWORD(SRC);
DEST.UB := LOAD_QWORD(SRC+8);
ELSE
DEST.LB := LOAD_DWORD_ZERO_EXT(SRC);
DEST.UB := LOAD_DWORD_ZERO_EXT(SRC+4);
FI;

BNDMOV to memory
IF 64-bit mode THEN
DEST[63:0] := SRC.LB;
DEST[127:64] := SRC.UB;
ELSE
DEST[31:0] := SRC.LB;
DEST[63:32] := SRC.UB;
FI;

Intel C/C++ Compiler Intrinsic Equivalent

BNDMOV void * _bnd_copy_ptr_bounds(const void *q, const void *r)

Flags Affected

None.

Exceptions

Protected Mode Exceptions

#UD If the LOCK prefix is used but the destination is not a memory operand. If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. If 67H prefix is not used and CS.D=0. If 67H prefix is used and CS.D=1. #SS(0) If the memory operand effective address is outside the SS segment limit. #GP(0) If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If the destination operand points to a non-writable segment If the DS, ES, FS, or GS segment register contains a NULL segment selector. #AC(0) If alignment checking is enabled and an unaligned memory reference is made while CPL is 3. #PF(fault code) If a page fault occurs.

Real-Address Mode Exceptions

#UD If the LOCK prefix is used but the destination is not a memory operand. If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. If 16-bit addressing is used. #GP(0) If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. #SS If the memory operand effective address is outside the SS segment limit. BNDMOV—Move Bounds Vol. 2A 3-100

Virtual-8086 Mode Exceptions

#UD If the LOCK prefix is used but the destination is not a memory operand. If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. If 16-bit addressing is used. #GP(0) If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. #SS(0) If the memory operand effective address is outside the SS segment limit. #AC(0) If alignment checking is enabled and an unaligned memory reference is made while CPL is 3. #PF(fault code) If a page fault occurs.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#UD If the LOCK prefix is used but the destination is not a memory operand. If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled. #SS(0) If the memory address referencing the SS segment is in a non-canonical form. #GP(0) If the memory address is in a non-canonical form. #AC(0) If alignment checking is enabled and an unaligned memory reference is made while CPL is 3. #PF(fault code) If a page fault occurs. BNDMOV—Move Bounds Vol. 2A 3-101