SmackerNews

Why is the x86 undefined instruction called ud2? Why 2?

devblogs.microsoft.com/oldnewthing/20260910-00/?p=112689

265 points · 66 comments · 8 days ago · ibobev

devblogs.microsoft.com/oldnewthing

boramalper7 days ago
Better to stick with ud2. Its behavior is consistent and architecturally guaranteed.
Ah, finally an undefined instruction whose behaviour is consistent and architecturally guaranteed!
hacker_homie8 days ago
Thus finally the 0F FF believers were rewarded by being give the honor of op code UD0 making it the one and true original invalid opcode permanently disgracing the 0F B9 adherents with the shame of UD1.
349ru3h4f038 days ago
Nowadays UD0 UD1 UD2 are in the SDM and APM.
We also got UDB (D6), the one-byte variant that arrived with x86-64 for 64-bit mode.
And we have always had UDW (FF FF), aka group #5 (1st FF) with a modrm byte of mod=11b r/m=111b (/7) reg=111b (2nd FF) -- that one matters for memory with all bits set to 1, or for buses terminated to all 1 when no device claims an access.
tombert7 days ago
Tangential, but I almost never read assembly [1], but I do read Java bytecode pretty frequently, primarily because doing that can sometimes be a good substitute for benchmarking [2], which I do not enjoy.
The thing that never seems to stop tripping me up is the different “dup” codes that compile. At some point I really need to properly learn the difference between dup_x2 and dup2_x1 and dup2_x2.
[1] not out of like an ethical objection, just my career has involved almost no reverse engineering and it’s also never been a path I have been super interested in to pursue on my own.
[2] e.g. if two competing chunks of code emit the same bytecode, you don’t need to pull out JMH. My go to example for this is using if statements vs switches, which will usually emit the same code so performance arguments are moot.
userbinator7 days ago
Though, for whatever reason, the instruction internally decoded as if it took two parameters, a register destination and a register-or-memory source.
Because the rest of the 0F Fx line also has a ModRM. Ditto for 0F Bx.
So if your 0F FF is at the end of a page, and the next page is not present, you sometimes got an invalid opcode exception and you sometimes got an access violation.
This reminds me of some related information on instruction length and decoding of "undefined" instructions I have filed away from a long time ago; sadly this stuff is disappearing from the Internet, but both the Archive and I still remember:
https://web.archive.org/web/20160721202526/http://pferrie.ho...
Such information is very important for emulation accuracy and some security contexts.
JdeBP5 days ago
It's sad that this is probably going to become canon, now, Raymon Chen being as influential as xe is, when what actually happened was that in 1998 H. Peter Anvin saw UD2 in Intel's doco, and that there was a second opcode that was just described by Intel as merely undefined, so gave it the mnemonic UD1 in the 0.98p3-hpa version of NASM because 'calling it UD1 seemed to make sense'.
* https://groups.google.com/g/comp.lang.asm.x86/c/ErG5TJEDjiw/...
* https://github.com/netwide-assembler/nasm/blob/nasm-0.98.x/C...
Neywiny8 days ago
I'm not much of an x86 person but on other architectures you can raise software interrupts/exceptions. Does x86 not have this or did those facilities not cover enough use cases?
arkj7 days ago
Hyrum’s Law reaching all the way down to the instruction decoder. And for those who care the ud2 opcode is 0F 0B
gtirloni8 days ago
I recently had to debug builds that failed randomly and a ud2 from V8 was there waiting for me.
dataflow8 days ago
Is this just his speculation? Or is there evidence for it?
qbane8 days ago
It's like why the first (hard) drive letter is C.
ordu8 days ago
> It’s called ud2 because the 0F FF variant was retroactively named ud0, and the 0F B9 variant was retroactively named ud1, leaving ud2 as the recommended undefined opcode.
It was a surprise for me as a reader. When I came to this sentence I assumed that 0f ff would become #1 and 0fb9 -- #2. But no, Intel counts from zero, so there is a third ud.

news.ycombinator.com/item?id=49683262

SmackerNews

A placeholder title for loading skeleton

example.com/path/to/article

000 points · username · 0 hours ago

example.com

SmackerNews

Why is the x86 undefined instruction called ud2? Why 2?

devblogs.microsoft.com/oldnewthing/20260910-00/?p=112689

265 points · 66 comments · 8 days ago · ibobev

devblogs.microsoft.com/oldnewthing

boramalper7 days ago
Better to stick with ud2. Its behavior is consistent and architecturally guaranteed.
Ah, finally an undefined instruction whose behaviour is consistent and architecturally guaranteed!
hacker_homie8 days ago
Thus finally the 0F FF believers were rewarded by being give the honor of op code UD0 making it the one and true original invalid opcode permanently disgracing the 0F B9 adherents with the shame of UD1.
349ru3h4f038 days ago
Nowadays UD0 UD1 UD2 are in the SDM and APM.
We also got UDB (D6), the one-byte variant that arrived with x86-64 for 64-bit mode.
And we have always had UDW (FF FF), aka group #5 (1st FF) with a modrm byte of mod=11b r/m=111b (/7) reg=111b (2nd FF) -- that one matters for memory with all bits set to 1, or for buses terminated to all 1 when no device claims an access.
tombert7 days ago
Tangential, but I almost never read assembly [1], but I do read Java bytecode pretty frequently, primarily because doing that can sometimes be a good substitute for benchmarking [2], which I do not enjoy.
The thing that never seems to stop tripping me up is the different “dup” codes that compile. At some point I really need to properly learn the difference between dup_x2 and dup2_x1 and dup2_x2.
[1] not out of like an ethical objection, just my career has involved almost no reverse engineering and it’s also never been a path I have been super interested in to pursue on my own.
[2] e.g. if two competing chunks of code emit the same bytecode, you don’t need to pull out JMH. My go to example for this is using if statements vs switches, which will usually emit the same code so performance arguments are moot.
userbinator7 days ago
Though, for whatever reason, the instruction internally decoded as if it took two parameters, a register destination and a register-or-memory source.
Because the rest of the 0F Fx line also has a ModRM. Ditto for 0F Bx.
So if your 0F FF is at the end of a page, and the next page is not present, you sometimes got an invalid opcode exception and you sometimes got an access violation.
This reminds me of some related information on instruction length and decoding of "undefined" instructions I have filed away from a long time ago; sadly this stuff is disappearing from the Internet, but both the Archive and I still remember:
https://web.archive.org/web/20160721202526/http://pferrie.ho...
Such information is very important for emulation accuracy and some security contexts.
JdeBP5 days ago
It's sad that this is probably going to become canon, now, Raymon Chen being as influential as xe is, when what actually happened was that in 1998 H. Peter Anvin saw UD2 in Intel's doco, and that there was a second opcode that was just described by Intel as merely undefined, so gave it the mnemonic UD1 in the 0.98p3-hpa version of NASM because 'calling it UD1 seemed to make sense'.
* https://groups.google.com/g/comp.lang.asm.x86/c/ErG5TJEDjiw/...
* https://github.com/netwide-assembler/nasm/blob/nasm-0.98.x/C...
Neywiny8 days ago
I'm not much of an x86 person but on other architectures you can raise software interrupts/exceptions. Does x86 not have this or did those facilities not cover enough use cases?
arkj7 days ago
Hyrum’s Law reaching all the way down to the instruction decoder. And for those who care the ud2 opcode is 0F 0B
gtirloni8 days ago
I recently had to debug builds that failed randomly and a ud2 from V8 was there waiting for me.
dataflow8 days ago
Is this just his speculation? Or is there evidence for it?
qbane8 days ago
It's like why the first (hard) drive letter is C.
ordu8 days ago
> It’s called ud2 because the 0F FF variant was retroactively named ud0, and the 0F B9 variant was retroactively named ud1, leaving ud2 as the recommended undefined opcode.
It was a surprise for me as a reader. When I came to this sentence I assumed that 0f ff would become #1 and 0fb9 -- #2. But no, Intel counts from zero, so there is a third ud.

news.ycombinator.com/item?id=49683262