{"id":112759,"date":"2026-10-07T07:00:00","date_gmt":"2026-10-07T14:00:00","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/oldnewthing\/?p=112759"},"modified":"2026-10-07T19:45:19","modified_gmt":"2026-10-08T02:45:19","slug":"20261007-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20261007-00\/?p=112759\/","title":{"rendered":"How can undefined opcodes ud0<\/CODE> and ud1<\/CODE> have parameters? How undefined were they?"},"content":{"rendered":"

Gunnar Dalsnes wondered how ud0<\/code> and ud1<\/code> could have parameters if they were undefined<\/a>? “Does it mean they were not completely undefined, just undocumented and not completely implemented?”<\/p>\n

The opcodes ud0<\/code> and ud1<\/code> have no definition, but that’s not the same as being architecturally an “undefined instruction”. They live in a purgatory where they were not assigned a meaning, but were also not officially declared to be meaningless.<\/p>\n

Originally, these byte sequences went through the instruction decoder and happened to slip through a few cracks before somebody finally noticed, “Wait a second, I don’t know how to execute this.”<\/p>\n

You can see this when you look at the instructions that are encoded as 00001111 11111xxx<\/code>, as of the Pentium III.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
Bits<\/th>\nBytes<\/th>\nOpcode<\/th>\nOperand 1<\/th>\nOperand 2<\/th>\nMeaning<\/th>\n<\/tr>\n
00001111 11111000<\/tt><\/td>\n0F F8<\/tt><\/td>\nPSUBB<\/tt><\/td>\nmm<\/td>\nmm\/m64<\/td>\nSubtract packed bytes<\/td>\n<\/tr>\n
00001111 11111001<\/tt><\/td>\n0F F9<\/tt><\/td>\nPSUBW<\/tt><\/td>\nmm<\/td>\nmm\/m64<\/td>\nSubtract packed words<\/td>\n<\/tr>\n
00001111 11111010<\/tt><\/td>\n0F FA<\/tt><\/td>\nPSUBD<\/tt><\/td>\nmm<\/td>\nmm\/m64<\/td>\nSubtract packed dwords<\/td>\n<\/tr>\n
00001111 11111011<\/tt><\/td>\n0F FB<\/tt><\/td>\nNo meaning assigned<\/td>\n<\/tr>\n
00001111 11111100<\/tt><\/td>\n0F FC<\/tt><\/td>\nPADDB<\/tt><\/td>\nmm<\/td>\nmm\/m64<\/td>\nAdd packed bytes<\/td>\n<\/tr>\n
00001111 11111101<\/tt><\/td>\n0F FD<\/tt><\/td>\nPADDW<\/tt><\/td>\nmm<\/td>\nmm\/m64<\/td>\nAdd packed words<\/td>\n<\/tr>\n
00001111 11111110<\/tt><\/td>\n0F FE<\/tt><\/td>\nPADDD<\/tt><\/td>\nmm<\/td>\nmm\/m64<\/td>\nAdd packed dwords<\/td>\n<\/tr>\n
00001111 11111111<\/tt><\/td>\n0F FF<\/tt><\/td>\nNo meaning assigned<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The byte sequences 0F FB<\/code> and 0F FF<\/code> had yet to be assigned a meaning. You can see how the instruction decoder could take a shortcut and say, “Well, all the instructions in this range, or at least all the ones that I care about, take an mm registers and an mm\/m64 operand, so I’ll just save myself some transistors and decode all of them with two parameters (mm, mm\/m64).” And then after decoding, it would use bit 3 to decide whether to set up the arithmetic unit for an add or subtract, and it would use bits 0 and 1 to decide how to subdivide the bits into saturating units.<\/p>\n

And if you gave it a 0F FF<\/code>, it would be only in that last step that the decoder would realize “Oh dear, I don’t know what to do with a bit combination of 11<\/tt>. I’ll raise an invalid opcode instruction.”<\/p>\n

The invalid opcode instruction got raised after<\/i> the operands were parsed.<\/p>\n

You can see the trouble that 0F FF<\/code> created when those empty slots started to get filled in by the SSE instructions.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
Bits<\/th>\nBytes<\/th>\nOpcode<\/th>\nOperand 1<\/th>\nOperand 2<\/th>\nMeaning<\/th>\n<\/tr>\n
00001111 11111000<\/tt><\/td>\n0F F8<\/tt><\/td>\nPSUBB<\/tt><\/td>\nmm<\/td>\nmm\/m64<\/td>\nSubtract packed bytes<\/td>\n<\/tr>\n
00001111 11111001<\/tt><\/td>\n0F F9<\/tt><\/td>\nPSUBW<\/tt><\/td>\nmm<\/td>\nmm\/m64<\/td>\nSubtract packed words<\/td>\n<\/tr>\n
00001111 11111010<\/tt><\/td>\n0F FA<\/tt><\/td>\nPSUBD<\/tt><\/td>\nmm<\/td>\nmm\/m64<\/td>\nSubtract packed dwords<\/td>\n<\/tr>\n
00001111 11111011<\/tt><\/td>\n0F FB<\/tt><\/td>\nPSUBQ<\/tt><\/td>\nmm<\/td>\nmm\/m64<\/td>\nSubtract packed qwords<\/td>\n<\/tr>\n
00001111 11111100<\/tt><\/td>\n0F FC<\/tt><\/td>\nPADDB<\/tt><\/td>\nmm<\/td>\nmm\/m64<\/td>\nAdd packed bytes<\/td>\n<\/tr>\n
00001111 11111101<\/tt><\/td>\n0F FD<\/tt><\/td>\nPADDW<\/tt><\/td>\nmm<\/td>\nmm\/m64<\/td>\nAdd packed words<\/td>\n<\/tr>\n
00001111 11111110<\/tt><\/td>\n0F FE<\/tt><\/td>\nPADDD<\/tt><\/td>\nmm<\/td>\nmm\/m64<\/td>\nAdd packed dwords<\/td>\n<\/tr>\n
00001111 11111111<\/tt><\/td>\n0F FF<\/tt><\/td>\nI want to put PADDQ<\/tt> here but I can’t<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

the natural place to put the PADDQ<\/code> instruction is 0F FF<\/code>, but people had already been using 0F FF<\/code> with the expectation that it raises an illegal instruction exception. Making it a valid instruction would break those programs, so Intel had to move PADDQ<\/code> to the rather awkward location 0F D4<\/code>.<\/p>\n

Bonus chatter<\/b>: Undefined instructions with parameters are actually not uncommon. For example, on AArch64, there is a range of 65,536 instructions set aside as permanently undefined<\/a>, so the udf<\/code> instruction takes a 16-bit immediate to specify which invalid opcode you want. The PDP-10 reserved opcode 000 as a permanently illegal instruction, and it carries a register and a memory address as parameters. (Because all<\/i> PDP-10 instructions carry a register and a memory address as parameters.)<\/p>\n

There are also so-called “unofficial opcodes” which are instructions that are not part of the instruction set architecture, but for which people reverse-engineered a consistent behavior and began to rely on it. (The 6502 processor is well-known in nerd circles for having undergone this type of analysis<\/a>.) The 0F FF<\/code> is one of these “unofficial opcodes” that was popular enough that Intel felt pressure to maintain backward compatibility with it, even though it was never architecturally documented or supported.<\/p>\n

Bonus bonus chatter<\/b>: It appears that the mnemonic ud1<\/code> was introduced by the nasm assembler<\/a>:<\/p>\n

* Added the following new instructions: SYSENTER, SYSEXIT, FXSAVE,\r\n  FXRSTOR, UD1, UD2 (the latter two are two opcodes that Intel\r\n  guarantee will never be used; one of them is documented as UD2 in\r\n  Intel documentation, the other one just as \"Undefined Opcode\" --\r\n  calling it UD1 seemed to make sense<\/span>.)\r\n<\/pre>\n
It seems obvious that ud1<\/code> is also the name that Intel gave internally to that legacy instruction. Otherwise, there would be no need to call the new one ud2<\/code>!<\/p>\n","protected":false},"excerpt":{"rendered":"
They weren’t defined, not even as undefined.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[2],"class_list":["post-112759","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-history"],"acf":[],"blog_post_summary":"
They weren’t defined, not even as undefined.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/112759","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=112759"}],"version-history":[{"count":1,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/112759\/revisions"}],"predecessor-version":[{"id":112760,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/112759\/revisions\/112760"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=112759"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=112759"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=112759"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}