BOUND: Check Array Index Against Bounds

For information about interpreting this page, see the help page.
Opcode and MnemonicEncoding16 bit Mode32 bit Mode64 bit ModeDescription
62 /r
BOUND r16, m16&16
RMValidValidNot EncodableChecks if r16 (an array index) is within the bounds specified by m16&16.
62 /r
BOUND r32, m32&32
RMValidValidNot EncodableChecks if r32 (an array index) is within the bounds specified by m32&32.

Encoding

EncodingOperand 1Operand 2
RMModRM.reg[r]ModRM.r/m[r]

Description

The BOUND instruction determines if the first operand (an array index) is within the bounds of an array specified in the second operand. The array index is a signed integer located in a register, and the bounds are a memory location containing either two consecutive words (in 16 bit mode) or two consecutive double words (in 32 bit mode). From these two memory values, the first is the lower bound of the array and the second is the upper bound of the array.

If the index is within the bounds specified, this instruction executes with no side effects. If, however, the index is not within the bounds, a #BR exception is throw.

This instruction is not encodable in 64 bit mode, and if encountered, will be interpreted as an EVEX prefix.

Operation

This pseudo-code uses C# syntax. A list of the types used is available here.
public void BOUND_16(ushort index, IntPtr bounds)
{
  if (index < mem16[bounds] || index > mem16[bounds + 2])
    #BR;
}

public void BOUND_32(uint index, IntPtr bounds)
{
  if (index < mem32[bounds] || index > mem32[bounds + 2])
    #BR;
}

Exceptions

Protected Mode

#BR
If the bounds test fails.
#UD
If the LOCK prefix is used.
If the second operand is not a memory location.
#GP(0)
If the destination's effective address of the Bound Table entry is outside the DS segment limit.
If the DS segment contains a NULL segment selector.
#SS(0)
If a memory operand's effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3.

Real-Address Mode

#BR
If the bounds test fails.
#UD
If the LOCK prefix is used.
If the second operand is not a memory location.
#GP(0)
If the destination's effective address of the Bound Table entry is outside the DS segment limit.
If the DS segment contains a NULL segment selector.
#SS(0)
If a memory operand's effective address is outside the SS segment limit.

Virtual-8086 Mode

Same exceptions as protected mode.

Compatibility Mode

Same exceptions as protected mode.

Long Mode

#UD
If in 64 bit mode.

Manual Changes

This is a list of changes that have been made from the Intel® 64 and IA-32 Architectures Software Developer’s Manual. These changes were against version 73 (dated ).

  • The overview table lists the encodings as "invalid" in 64 bit mode, but they are actually not encodable due to the EVEX prefix.