diff --git a/VEX/priv/guest_amd64_toIR.c b/VEX/priv/guest_amd64_toIR.c

index 40da6bf..fba7084 100644

--- a/VEX/priv/guest_amd64_toIR.c

+++ b/VEX/priv/guest_amd64_toIR.c

@@ -767,10 +767,10 @@ static Bool have66orF2orF3 ( Prefix pfx )

   return toBool( ! haveNo66noF2noF3(pfx) );

 }

-/* Return True iff pfx has 66 or F2 set */

-static Bool have66orF2 ( Prefix pfx )

+/* Return True iff pfx has 66 or F3 set */

+static Bool have66orF3 ( Prefix pfx )

 {

-   return toBool((pfx & (PFX_66|PFX_F2)) > 0);

+   return toBool((pfx & (PFX_66|PFX_F3)) > 0);

 }

 /* Clear all the segment-override bits in a prefix. */

@@ -4266,8 +4266,12 @@ ULong dis_Grp5 ( VexAbiInfo* vbi,

    modrm = getUChar(delta);

    if (epartIsReg(modrm)) {

-      /* F2/XACQ and F3/XREL are always invalid in the non-mem case. */

-      if (haveF2orF3(pfx)) goto unhandledR;

+      /* F2/XACQ and F3/XREL are always invalid in the non-mem case.

+         F2/CALL and F2/JMP may have bnd prefix. */

+     if (haveF2orF3(pfx)

+         && ! (haveF2(pfx)

+               && (gregLO3ofRM(modrm) == 2 || gregLO3ofRM(modrm) == 4)))

+        goto unhandledR;

       assign(t1, getIRegE(sz,pfx,modrm));

       switch (gregLO3ofRM(modrm)) {

          case 0: /* INC */

@@ -4287,6 +4291,7 @@ ULong dis_Grp5 ( VexAbiInfo* vbi,

          case 2: /* call Ev */

             /* Ignore any sz value and operate as if sz==8. */

             if (!(sz == 4 || sz == 8)) goto unhandledR;

+            if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */

             sz = 8;

             t3 = newTemp(Ity_I64);

             assign(t3, getIRegE(sz,pfx,modrm));

@@ -4302,6 +4307,7 @@ ULong dis_Grp5 ( VexAbiInfo* vbi,

          case 4: /* jmp Ev */

             /* Ignore any sz value and operate as if sz==8. */

             if (!(sz == 4 || sz == 8)) goto unhandledR;

+            if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */

             sz = 8;

             t3 = newTemp(Ity_I64);

             assign(t3, getIRegE(sz,pfx,modrm));

@@ -4334,11 +4340,14 @@ ULong dis_Grp5 ( VexAbiInfo* vbi,

                        showSz ? nameISize(sz) : ' ', 

                        nameIRegE(sz, pfx, modrm));

    } else {

-      /* Decide if F2/XACQ or F3/XREL might be valid. */

+      /* Decide if F2/XACQ, F3/XREL, F2/CALL or F2/JMP might be valid. */

       Bool validF2orF3 = haveF2orF3(pfx) ? False : True;

       if ((gregLO3ofRM(modrm) == 0/*INC*/ || gregLO3ofRM(modrm) == 1/*DEC*/)

           && haveF2orF3(pfx) && !haveF2andF3(pfx) && haveLOCK(pfx)) {

          validF2orF3 = True;

+      } else if ((gregLO3ofRM(modrm) == 2 || gregLO3ofRM(modrm) == 4)

+                 && (haveF2(pfx) && !haveF3(pfx))) {

+         validF2orF3 = True;

       }

       if (!validF2orF3) goto unhandledM;

       /* */

@@ -4375,6 +4384,7 @@ ULong dis_Grp5 ( VexAbiInfo* vbi,

          case 2: /* call Ev */

             /* Ignore any sz value and operate as if sz==8. */

             if (!(sz == 4 || sz == 8)) goto unhandledM;

+            if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */

             sz = 8;

             t3 = newTemp(Ity_I64);

             assign(t3, loadLE(Ity_I64,mkexpr(addr)));

@@ -4390,6 +4400,7 @@ ULong dis_Grp5 ( VexAbiInfo* vbi,

          case 4: /* JMP Ev */

             /* Ignore any sz value and operate as if sz==8. */

             if (!(sz == 4 || sz == 8)) goto unhandledM;

+            if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */

             sz = 8;

             t3 = newTemp(Ity_I64);

             assign(t3, loadLE(Ity_I64,mkexpr(addr)));

@@ -19716,7 +19727,8 @@ Long dis_ESC_NONE (

    case 0x7F: { /* JGb/JNLEb (jump greater) */

       Long   jmpDelta;

       const HChar* comment  = "";

-      if (haveF2orF3(pfx)) goto decode_failure;

+      if (haveF3(pfx)) goto decode_failure;

+      if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */

       jmpDelta = getSDisp8(delta);

       vassert(-128 <= jmpDelta && jmpDelta < 128);

       d64 = (guest_RIP_bbstart+delta+1) + jmpDelta;

@@ -20369,7 +20381,8 @@ Long dis_ESC_NONE (

    }

    case 0xC2: /* RET imm16 */

-      if (have66orF2orF3(pfx)) goto decode_failure;

+      if (have66orF3(pfx)) goto decode_failure;

+      if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */

       d64 = getUDisp16(delta); 

       delta += 2;

       dis_ret(dres, vbi, d64);

@@ -20377,8 +20390,9 @@ Long dis_ESC_NONE (

       return delta;

    case 0xC3: /* RET */

-      if (have66orF2(pfx)) goto decode_failure;

+      if (have66(pfx)) goto decode_failure;

       /* F3 is acceptable on AMD. */

+      if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */

       dis_ret(dres, vbi, 0);

       DIP(haveF3(pfx) ? "rep ; ret\n" : "ret\n");

       return delta;

@@ -20782,7 +20796,8 @@ Long dis_ESC_NONE (

    }

    case 0xE8: /* CALL J4 */

-      if (haveF2orF3(pfx)) goto decode_failure;

+      if (haveF3(pfx)) goto decode_failure;

+      if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */

       d64 = getSDisp32(delta); delta += 4;

       d64 += (guest_RIP_bbstart+delta); 

       /* (guest_RIP_bbstart+delta) == return-to addr, d64 == call-to addr */

@@ -20805,9 +20820,10 @@ Long dis_ESC_NONE (

       return delta;

    case 0xE9: /* Jv (jump, 16/32 offset) */

-      if (haveF2orF3(pfx)) goto decode_failure;

+      if (haveF3(pfx)) goto decode_failure;

       if (sz != 4) 

          goto decode_failure; /* JRS added 2004 July 11 */

+      if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */

       d64 = (guest_RIP_bbstart+delta+sz) + getSDisp(sz,delta); 

       delta += sz;

       if (resteerOkFn(callback_opaque,d64)) {

@@ -21241,7 +21257,8 @@ Long dis_ESC_0F (

    case 0x8F: { /* JGb/JNLEb (jump greater) */

       Long   jmpDelta;

       const HChar* comment  = "";

-      if (haveF2orF3(pfx)) goto decode_failure;

+      if (haveF3(pfx)) goto decode_failure;

+      if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */

       jmpDelta = getSDisp32(delta);

       d64 = (guest_RIP_bbstart+delta+4) + jmpDelta;

       delta += 4;

@@ -21332,6 +21349,66 @@ Long dis_ESC_0F (

       }

       return delta;

+   case 0x1A:

+   case 0x1B: { /* Future MPX instructions, currently NOPs.

+                   BNDMK b, m     F3 0F 1B

+                   BNDCL b, r/m   F3 0F 1A

+                   BNDCU b, r/m   F2 0F 1A

+                   BNDCN b, r/m   F2 0F 1B

+                   BNDMOV b, b/m  66 0F 1A

+                   BNDMOV b/m, b  66 0F 1B

+                   BNDLDX b, mib     0F 1A

+                   BNDSTX mib, b     0F 1B */

+

+      /* All instructions have two operands. One operand is always the

+         bnd register number (bnd0-bnd3, other register numbers are

+         ignored when MPX isn't enabled, but should generate an

+         exeception if MPX is enabled) given by gregOfRexRM. The other

+         operand is either a ModRM:reg, ModRM:r/m or a SIB encoded

+         address, all of which can be decoded by using either

+         eregOfRexRM or disAMode. */

+

+      modrm = getUChar(delta);

+      int bnd = gregOfRexRM(pfx,modrm);

+      const HChar *oper;

+      if (epartIsReg(modrm)) {

+         oper = nameIReg64 (eregOfRexRM(pfx,modrm));

+         delta += 1;

+      } else {

+         addr = disAMode ( &alen, vbi, pfx, delta, dis_buf, 0 );

+         delta += alen;

+         oper = dis_buf;

+      }

+

+      if (haveF3no66noF2 (pfx)) {

+         if (opc == 0x1B) {

+            DIP ("bndmk %s, %%bnd%d\n", oper, bnd);

+         } else /* opc == 0x1A */ {

+            DIP ("bndcl %s, %%bnd%d\n", oper, bnd);

+         }

+      } else if (haveF2no66noF3 (pfx)) {

+         if (opc == 0x1A) {

+            DIP ("bndcu %s, %%bnd%d\n", oper, bnd);

+         } else /* opc == 0x1B */ {

+            DIP ("bndcn %s, %%bnd%d\n", oper, bnd);

+         }

+      } else if (have66noF2noF3 (pfx)) {

+         if (opc == 0x1A) {

+            DIP ("bndmov %s, %%bnd%d\n", oper, bnd);

+         } else /* opc == 0x1B */ {

+            DIP ("bndmov %%bnd%d, %s\n", bnd, oper);

+         }

+      } else if (haveNo66noF2noF3 (pfx)) {

+         if (opc == 0x1A) {

+            DIP ("bndldx %s, %%bnd%d\n", oper, bnd);

+         } else /* opc == 0x1B */ {

+            DIP ("bndstx %%bnd%d, %s\n", bnd, oper);

+         }

+      } else goto decode_failure;

+

+      return delta;

+   }

+

    case 0xA2: { /* CPUID */

       /* Uses dirty helper: 

             void amd64g_dirtyhelper_CPUID ( VexGuestAMD64State* )