UD0

UD0, 0F FF, is one of the opcodes that Intel and AMD keep undefined on purpose. Like UD2, it raises #UD and does nothing else, and the saved RIP points at its first byte. The two manuals disagree on its length. Intel’s entry gives it a ModRM byte, UD0 r32, r/m32, so that a SIB byte and a displacement belong to it too, and a footnote warns that some processors decode it without one. AMD’s entry and opcode map list plain 0F FF, and so does the instruction-format table in Appendix B of Intel’s Volume 2 (Table B-13).

When the length shows#

Nothing is read through the operand, so the length matters only when the bytes after 0F FF cannot be fetched: when the ModRM byte, or a displacement that it calls for, lies on an unmapped page or past a segment limit. A processor that counts those bytes takes the fetch fault, #PF or #GP; one that does not raises #UD. It also matters to a disassembler, which resumes decoding after one length or the other. UD1 always has its ModRM byte, and UD2 never has one.

Which processors#

The processor lists below come from XED’s chip model, not from a statement by Intel or AMD. It gives the two-byte form to the Pentium Pro, to the Atom cores from Bonnell to Clearwater Forest and to the hybrid Alder Lake to Nova Lake, and the longer one to the big cores from NetBurst to Emerald Rapids and to AMD’s K10 to Zen 2, though AMD’s manual lists no ModRM byte. Granite Rapids and Diamond Rapids are under both. Zen 5 raised #UD in all 12 recorded cases, with and without a ModRM byte; every byte was mapped, so the cases do not tell which length Zen 5 decodes.

In our builds#

GNU as 2.44 accepts ud0 only with two operands and always emits the ModRM form; GNU objdump 2.44 decodes 0F FF C0 as ud0 eax, eax, three bytes, also with -M amd64. Clang 23’s assembler does not know the mnemonic. Neither compiler emitted UD0 for a trap: GCC 14 uses UD2, and Clang 23 UD2 or UD1.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

fault(UD)                    # 0F FF, two bytes, as AMD's manual
                             # has it

fault(UD)                    # 0F FF /r, as Intel's manual has it:
                             # ModRM, SIB and displacement are
                             # part of it; nothing is read

Operands

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms

may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More General-purpose instructions

• NEG
• NOP
• NOT
• OR
• OUT
• OUTS
• PAUSE
• POP
• POPA
• POPF
• PUSH
• PUSHA
• PUSHF
• RCL
• RCR
• RET
• ROL
• ROR
• SALC
• SAR
• SBB
• SCAS
• SETcc
• SHL
• SHLD
• SHR
• SHRD
• STC
• STD
• STI
• STOS
• SUB
• TEST
• UD1
• UD2
• UDB
• XADD
• XCHG
• XLAT
• XOR

All 109 General-purpose instructions