bndmov

Move Bounds

BNDMOV b, b/m

Moves MPX bounds data.

Pseudocode Operation

// Source can be bounds register or 16 bytes of memory
IF (src is bounds register) THEN
  bndN.lower ← src.lower;
  bndN.upper ← src.upper;
ELSE
  bndN.lower ← [src];
  bndN.upper ← [src + 8];
END;
// No flags modified

Encoding

Binary Layout

Format Legacy

Opcode 66 0F 1A

Extension MPX

Operands

dest
MPX bounds register (bnd0-bnd3)
src
Memory operand

Reference

View in Intel® 64 and IA-32 Architectures SDM ↗ Intel® SDM

Instruction Forms

Opcode	Instruction	Op/En	64/32-bit Mode	CPUID	Description
66 0F 1A /r	BNDMOV bnd1, bnd2/m64	RM	N.E./V	MPX	Move lower and upper bound from bnd2/m64 to bound register bnd1.
66 0F 1A /r	BNDMOV bnd1, bnd2/m128	RM	V/N.E.	MPX	Move lower and upper bound from bnd2/m128 to bound register bnd1.
66 0F 1B /r	BNDMOV bnd1/m64, bnd2	MR	N.E./V	MPX	Move lower and upper bound from bnd2 to bnd1/m64.
66 0F 1B /r	BNDMOV bnd1/m128, bnd2	MR	V/N.E.	MPX	Move lower and upper bound from bnd2 to bound register bnd1/m128.

Description

BNDMOV moves a pair of lower and upper bound values from the source operand (the second operand) to the destination (the first operand). Each operation is 128-bit move. The exceptions are same as the MOV instruction. The memory format for loading/store bounds in 64-bit mode is shown in Figure 3-5.

BNDMOV to memory in 64-bit mode Upper Bound (UB) Lower Bound (LB)

16 8 0 Byte offset

BNDMOV to memory in 32-bit mode Upper Bound (UB) Lower Bound (LB)

16 8 4 0 Byte offset

This instruction does not change flags.

Operation

BNDMOV register to register
DEST.LB := SRC.LB;
DEST.UB := SRC.UB;

BNDMOV from memory
IF 64-bit mode THEN
DEST.LB := LOAD_QWORD(SRC);
DEST.UB := LOAD_QWORD(SRC+8);
ELSE
DEST.LB := LOAD_DWORD_ZERO_EXT(SRC);
DEST.UB := LOAD_DWORD_ZERO_EXT(SRC+4);
FI;

BNDMOV to memory
IF 64-bit mode THEN
DEST[63:0] := SRC.LB;
DEST[127:64] := SRC.UB;
ELSE
DEST[31:0] := SRC.LB;
DEST[63:32] := SRC.UB;
FI;

Intel C/C++ Compiler Intrinsic Equivalent

BNDMOV void * _bnd_copy_ptr_bounds(const void *q, const void *r)

Flags Affected

None.

Exceptions

Protected Mode Exceptions

#UD If the LOCK prefix is used but the destination is not a memory operand. If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. If 67H prefix is not used and CS.D=0. If 67H prefix is used and CS.D=1. #SS(0) If the memory operand effective address is outside the SS segment limit. #GP(0) If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If the destination operand points to a non-writable segment If the DS, ES, FS, or GS segment register contains a NULL segment selector. #AC(0) If alignment checking is enabled and an unaligned memory reference is made while CPL is 3. #PF(fault code) If a page fault occurs.

Real-Address Mode Exceptions

#UD If the LOCK prefix is used but the destination is not a memory operand. If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. If 16-bit addressing is used. #GP(0) If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. #SS If the memory operand effective address is outside the SS segment limit. BNDMOV-Move Bounds Vol. 2A 3-100

Virtual-8086 Mode Exceptions

#UD If the LOCK prefix is used but the destination is not a memory operand. If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled. If 16-bit addressing is used. #GP(0) If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. #SS(0) If the memory operand effective address is outside the SS segment limit. #AC(0) If alignment checking is enabled and an unaligned memory reference is made while CPL is 3. #PF(fault code) If a page fault occurs.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#UD If the LOCK prefix is used but the destination is not a memory operand. If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled. #SS(0) If the memory address referencing the SS segment is in a non-canonical form. #GP(0) If the memory address is in a non-canonical form. #AC(0) If alignment checking is enabled and an unaligned memory reference is made while CPL is 3. #PF(fault code) If a page fault occurs. BNDMOV-Move Bounds Vol. 2A 3-101