x86-64.net

Instruction

UD2

Raises an invalid-opcode exception (#UD); compilers emit it for __builtin_trap and code that must not be reached.

Extensions
Forms
1 (1 Legacy)
Data
Intel XED v2026.08.23

UD2 exists to fail. Its two bytes, 0F 0B, raise #UD in every mode on every processor since the Pentium Pro, and both vendors reserve them for that purpose, so no future extension will give them a meaning; other unused opcodes may become instructions one day. Nothing else happens: no register, flag or memory changes, and the saved RIP points at the UD2 itself, not past it.

A deliberate crash

GCC 14 and Clang 23 at -O2 compile __builtin_trap() to UD2, also when it ends a failed check, which they move out of the hot path. Zen 5 raised #UD for both cases of the Operation section. __builtin_unreachable() is different: it promises the compiler that a path is never taken, and neither compiler emitted anything for it in our builds.

With -fsanitize-trap, Clang uses UD1 instead for the sanitizers’ failed checks, and its memory operand names the check: 67 0F B9 00 for a signed overflow, with a displacement of 3 for a division by zero, 14h for a bad shift and 16h for a null pointer. GCC emits UD2 for all of them.

As a decoding fence

Intel’s optimization manual suggests a UD2 after an indirect branch that the predictor cannot handle well, so that the processor does not decode down the fall-through path, which a branch without a prediction is assumed to take (Assembly/Compiler Coding Rule 13).

Its siblings

  • UD1 (0F B9) takes a ModRM operand, so its length depends on that byte and any SIB and displacement that follow.
  • UD0 (0F FF) does too by Intel’s manual, which warns that some processors decode it without one; the same bytes can then fault as an instruction of a different length.
  • UDB (D6) is a one-byte #UD in 64-bit mode only; in the other modes, D6 is SALC.

UD2 is the only one of them with one length and one meaning in every mode.

In the optimization guide

What the optimization guide says about UD2, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Branches

  • Indirect branches: An indirect branch the predictor has no target for is assumed to fall through, so the bytes after it are fetched and may be decoded and run.

Forms

Every encoding of UD2 that Intel XED knows, one row per XED instruction form (iform). How to read the notation.
InstructionEncodingRequires
UD2 UD20F 0BBase instruction set

Latency and throughput

What the scheduling models of LLVM 23.1.2 give for each form, not measurements: latency / reciprocal throughput in cycles, the ports under them. A row is a model, or models that agree; a dash, a form that its processors lack. Memory forms: latency from the address, ports without the load and store units. Which processors each model covers.
ModelUD2
Sandy Bridge100 / 0.33p015
Haswell, Broadwell, Skylake, Skylake-SP, Ice Lake, Alder Lake, Sapphire Rapids100 / 0.25p0156
Lunar Lake100 / 0.17p012345
Bonnell100 / 0.5p01
Silvermont100 / 1FPC0
Piledriver100 / 0.5EX0 EX1
Zen, Zen 2100 / 0.25
Zen 3, Zen 4100 / 25ALU0 ALU1 ALU2 ALU3
Jaguar100 / 0.5ALU0 ALU1

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

fault(UD)                        # 0F 0B, two bytes

Run on AMD Zen 5 (EPYC 9645): 2 cases. Every one raised an exception, at CPL 3, where the probe runs.

Operands

None: XED lists no operands for this form.

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms
may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.
ISA setCPUIDProcessors
PPRO

No CPUID bit: part of the base instruction set.

Every x86-64 processor in XED’s model and Zen 3 to Zen 6

More General-purpose instructions

All 109 General-purpose instructions

Sources

  1. Intel XED v2026.08.23 (commit 0bcb6237345c): forms, encodings, operands, flags, exception classes, attributes, ISA sets, CPUID bits and chip model.
  2. The CPU data of x86-64.net: Zen 3 to Zen 6, from GCC’s -march feature sets and AMD’s Processor Programming References, which the page of each processor cites.
  3. LLVM 23.1.2's x86 scheduling models (commit 85ac56026243): the latency, reciprocal throughput and ports of each form, as llvm-mca reports them.
  4. Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 2 (325383-093, September 2026): Volume 2B, page 4-737 (UD)
  5. AMD64 Architecture Programmer's Manual, Volume 3: General-Purpose and System Instructions (24594, rev. 3.39, October 2026)
  6. Intel 64 and IA-32 Architectures Optimization Reference Manual, Volume 1 (248966-051, October 2026)

The tables are derived from Intel XED, Copyright Intel Corporation, licensed under the Apache License 2.0; x86-64.net converted and reformatted them. The timings come from LLVM's scheduling models, part of the LLVM Project, licensed under the Apache License 2.0 with LLVM Exceptions. The text is our own.