LZCNT

LZCNT counts the zero bits above the highest set bit of its source: for the 32-bit value 0x28 it gives 26. A zero source returns the operand size, 16, 32 or 64, and sets CF, so every input has a defined result, and ZF is set when the count is 0, that is, when the top bit is set. It is the counterpart of TZCNT, which counts from the bottom.

Availability#

AMD’s manual files LZCNT under ABM, its advanced bit manipulation, and both vendors report it with the same bit, CPUID.80000001H:ECX[5]; it belongs to x86-64-v3. Its encoding, F3 0F BD, is BSR with an F3 prefix, and a processor without LZCNT runs it as BSR, which returns the index of the highest set bit instead of the number of zeros above it: 5 instead of 26 for 0x28. AMD’s manual therefore tells software to check the CPUID bit before using it. For the same reason, GCC 14 and Clang 23 at -O2 do not emit LZCNT for the baseline: __builtin_clz(x) becomes BSR and an XOR with 31.

With -mlzcnt#

Allowed LZCNT, both compilers turn __builtin_clz(x) into an LZCNT, and so, since the zero case is now defined, x ? __builtin_clz(x) : 32 and __builtin_clzg(x, 32). GCC puts an xor eax, eax before the LZCNT of __builtin_clz, Clang does not. The bit width of x, 32 - __builtin_clz(x), becomes mov eax, 32, LZCNT and SUB, and the leading ones of x are the leading zeros of ~x, a NOT and an LZCNT.

Other forms#

AVX-512CD counts per element: VPLZCNTD and VPLZCNTQ; Intel’s optimization manual builds permute controls with them in its conflict-detection examples. APX adds an EVEX form of LZCNT and one that leaves the flags unchanged (NF). The instruction table of AMD’s Zen 5 guide lists LZCNT as one macro-op with a latency of one cycle.

In the optimization guide

What the optimization guide says about LZCNT, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Out of order

• Zeroing and dependency-breaking idioms: Some instructions that overwrite their whole destination still wait for its old value, a flaw of particular cores: LLVM’s tunings mark popcnt from Sandy Bridge to the Skylake family and lzcnt and tzcnt on Haswell, AMD names tzcnt and three BMI1 instructions on some versions of Zen 5, and Intel several AVX-512 permutations and multiplications on Golden Cove (Skylake, Zen 5, Golden Cove).

Bulldozer to Excavator

• Integer execution: POPCNT and LZCNT, new with Family 15h, beat any sequence that does their work: POPCNT takes 4 cycles, 6 with 64-bit operands, and starts every 2 or 4 cycles, and LZCNT is a double instruction of 2 cycles. sources differ

Haswell and Broadwell

• Integer execution and bypass: LLVM’s tuning marks POPCNT, LZCNT and TZCNT on both cores as waiting for whatever last wrote the register they overwrite, though they never use its value, as on Skylake.

Jaguar and Puma

• Integer execution: LZCNT and POPCNT take one cycle on either ALU and TZCNT two, while BSF and BSR are microcoded, of seven and eight macro-ops and 4 and 5 cycles, so the newer instructions are the better choice where the zero case allows.

Skylake to Cooper Lake

• Integer execution: Port 1 alone runs integer multiplication, PDEP and PEXT, popcnt, lzcnt, tzcnt, bsf, bsr and the double shifts, with a latency of three cycles and one a cycle in LLVM’s models, as on Golden Cove.

Zen and Zen+

• Integer execution: BSF and BSR are six macro-ops with a latency of three and four cycles, while LZCNT and POPCNT are one macro-op of one cycle and TZCNT two of two cycles. sources differ

Zen 2

• Integer execution: BSF and BSR are six macro-ops with a latency of three and four cycles, while LZCNT and POPCNT are one macro-op of one cycle and TZCNT two; LLVM’s model agrees.

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

s = src.read()
n = 0
for i in range(OSIZE):
    if s >> (OSIZE - 1 - i) & 1:
        break
    n += 1                       # the 0 bits above the highest 1 bit
if not nf:                       # NF=1 (APX) leaves the flags as they were
    cf = s == 0                  # and then n is OSIZE
    zf = n == 0
    of = sf = af = pf = UNDEFINED
dest.write(n)                    # a 32-bit register: bits 63:32 cleared
# without LZCNT (AMD's ABM), a processor runs the legacy encoding
# (F3 0F BD) as BSR

Operands

Flags

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

Legacy forms

none in XED

EVEX forms

APX-EVEX-INT

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More APX instructions

• CMOVcc
• CMPccXADD
• CRC32
• CTESTscc
• DEC
• DIV
• ENQCMD
• ENQCMDS
• IDIV
• IMUL
• INC
• INVEPT
• INVPCID
• INVVPID
• JMPABS
• KMOVB
• KMOVD
• KMOVQ
• KMOVW
• LDTILECFG
• MOVBE
• MOVDIR64B
• MOVDIRI
• MOVRS
• MUL
• MULX
• NEG
• NOT
• OR
• PDEP
• PEXT
• POP2
• POP2P
• POPCNT
• POPP
• PUSH2
• PUSH2P
• PUSHP
• RCL
• RCR

All 88 APX instructions