x86-64.net

Instruction

UD1

Raises an invalid-opcode exception (#UD); its register and memory operands are decoded but not used.

Extensions
Forms
2 (2 Legacy)
Data
Intel XED v2026.08.23

UD1, 0F B9, raises #UD and changes no register, flag or memory; the saved RIP points at the UD1 itself. Both vendors reserve it, with UD2 and UD0, never to become an instruction. Unlike UD2 it takes a ModRM byte, UD1 r32, r/m32, and here the two manuals agree: any SIB byte, displacement and prefixes are part of the instruction, although nothing is read through its operands. The instruction-format table in Appendix B of Intel’s Volume 2 (Table B-13) gives UD1 the bits of 0F 0B, which is UD2; the opcode map and the entry in the same volume have 0F B9.

A trap that carries a number

Since its operands are decoded but never used, they can tell the #UD handler, which finds the instruction at the saved RIP, why it came. Clang 23 at -O2 with -fsanitize=undefined -fsanitize-trap=undefined ends each failed check with ud1 eax, dword ptr [eax+n], encoded 67 0F B9 40 n, where n names the check. In our builds n was 3 for a division, by zero or of INT_MIN by -1, 12h for an array index out of bounds, 13h for a pointer overflow, 14h for a bad shift, 16h for a null or misaligned pointer and 6 for a call through a function pointer of the wrong type; a signed overflow in an addition has n = 0 and no displacement, 67 0F B9 00. GCC 14 ends the same checks with UD2, and so does Clang’s -fsanitize=kcfi.

AMD’s caveat

AMD’s manual says that some of its processors raise #UD for UD1 even where fetching the ModRM byte would fault, as if the instruction ended after 0F B9: the same split that Intel’s manual describes for UD0. Zen 5 raised #UD in all 10 recorded cases, register and memory forms, with and without 66 and REX.W prefixes; every byte was mapped, so they do not show which way Zen 5 goes.

Forms

Every encoding of UD1 that Intel XED knows, one row per XED instruction form (iform). How to read the notation.
InstructionEncodingRequires
UD1 r32, m32 UD1_GPR32_MEMd0F B9 /rBase instruction set
UD1 r32, r32 UD1_GPR32_GPR320F B9 /rBase instruction set

Latency and throughput

What the scheduling models of LLVM 23.1.2 give for each form, not measurements: latency / reciprocal throughput in cycles, the ports under them. A row is a model, or models that agree; a dash, a form that its processors lack. Memory forms: latency from the address, ports without the load and store units. Which processors each model covers.
Modelr32, m32r32, r32
Sandy Bridge100 / 0.33p015100 / 0.33p015
Haswell, Broadwell, Skylake, Skylake-SP, Ice Lake, Alder Lake, Sapphire Rapids100 / 0.25p0156100 / 0.25p0156
Lunar Lake100 / 0.17p012345100 / 0.17p012345
Bonnell100 / 0.5p1100 / 0.5p01
Silvermont100 / 1FPC0100 / 1FPC0
Piledriver100 / 0.5EX0 EX1100 / 0.5EX0 EX1
Zen, Zen 2100 / 0.25100 / 0.25
Zen 3, Zen 4100 / 25ALU0 ALU1 ALU2 ALU3100 / 25ALU0 ALU1 ALU2 ALU3
Jaguar100 / 0.5ALU0 ALU1100 / 0.5ALU0 ALU1

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

fault(UD)                        # 0F B9 /r: ModRM, SIB and displacement
                                 # are part of it; nothing is read. AMD's
                                 # manual says some of its processors
                                 # raise #UD even where fetching the
                                 # ModRM byte would fault

Run on AMD Zen 5 (EPYC 9645): 10 cases. Every one raised an exception, at CPL 3, where the probe runs.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.
OperandKindAction
UD1 r32, r/m32
r32explicitread
r/m32explicitread

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms
may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.
ISA setCPUIDProcessors
PPRO

No CPUID bit: part of the base instruction set.

Every x86-64 processor in XED’s model and Zen 3 to Zen 6

More General-purpose instructions

All 109 General-purpose instructions

Sources

  1. Intel XED v2026.08.23 (commit 0bcb6237345c): forms, encodings, operands, flags, exception classes, attributes, ISA sets, CPUID bits and chip model.
  2. The CPU data of x86-64.net: Zen 3 to Zen 6, from GCC’s -march feature sets and AMD’s Processor Programming References, which the page of each processor cites.
  3. LLVM 23.1.2's x86 scheduling models (commit 85ac56026243): the latency, reciprocal throughput and ports of each form, as llvm-mca reports them.
  4. Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 2 (325383-093, September 2026): Volume 2B, page 4-737 (UD)
  5. AMD64 Architecture Programmer's Manual, Volume 3: General-Purpose and System Instructions (24594, rev. 3.39, October 2026)

The tables are derived from Intel XED, Copyright Intel Corporation, licensed under the Apache License 2.0; x86-64.net converted and reformatted them. The timings come from LLVM's scheduling models, part of the LLVM Project, licensed under the Apache License 2.0 with LLVM Exceptions. The text is our own.