POPCNT

POPCNT counts the bits that are set in its source, the population count or Hamming weight. It answers how many members a bitset has, and after an XOR how many bits two words differ in: Clang 23 at -O2, allowed POPCNT, compiles __builtin_popcountl(a ^ b) to xor rdi, rsi and popcnt rax, rdi. The lowest bit of the count is the parity of the whole operand, which the parity flag cannot give, since PF covers only the low byte of a result; with POPCNT available, GCC 14 and Clang 23 compile __builtin_parity to POPCNT and an AND with 1.

Availability#

POPCNT has a CPUID bit of its own, CPUID.01H:ECX[23], apart from SSE4.2’s. Among Intel’s processors Nehalem had it first, among AMD’s K10, as the list below shows, and it belongs to x86-64-v2, not to the x86-64 baseline. A compiler targeting the baseline therefore cannot emit it: for __builtin_popcount, GCC 14 calls __popcountdi2 in its support library, and Clang 23 inlines some fifteen instructions, shifts, masks, additions and a multiplication. With -mpopcnt or -march=x86-64-v2, both emit a single POPCNT.

A processor without POPCNT raises #UD for its encoding, F3 0F B8. That is unlike TZCNT and LZCNT, whose F3-prefixed encodings older processors run as BSF and BSR, giving results that may differ.

Other forms#

For counting in vectors, AVX-512 has per-element versions: VPOPCNTB and VPOPCNTW in AVX512_BITALG, VPOPCNTD and VPOPCNTQ in AVX512_VPOPCNTDQ. APX adds an EVEX form of POPCNT itself and one that leaves the flags unchanged (NF).

In the optimization guide

What the optimization guide says about POPCNT, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Out of order

• Zeroing and dependency-breaking idioms: Some instructions that overwrite their whole destination still wait for its old value, a flaw of particular cores: LLVM’s tunings mark popcnt from Sandy Bridge to the Skylake family and lzcnt and tzcnt on Haswell, AMD names tzcnt and three BMI1 instructions on some versions of Zen 5, and Intel several AVX-512 permutations and multiplications on Golden Cove (Skylake, Zen 5, Golden Cove).

Bulldozer to Excavator

• Integer execution: POPCNT and LZCNT, new with Family 15h, beat any sequence that does their work: POPCNT takes 4 cycles, 6 with 64-bit operands, and starts every 2 or 4 cycles, and LZCNT is a double instruction of 2 cycles. sources differ

Crestmont and Gracemont

• Integer execution: LLVM treats popcnt on these cores as waiting for its destination’s old value.

Golden Cove and Raptor Cove

• Integer execution: Port 1 alone runs the slower integer operations: multiplication, PDEP and PEXT, popcnt, bsr, crc32 and the double shifts with an immediate count, which LLVM’s models give a latency of three cycles and one per cycle.

Haswell and Broadwell

• Integer execution and bypass: LLVM’s tuning marks POPCNT, LZCNT and TZCNT on both cores as waiting for whatever last wrote the register they overwrite, though they never use its value, as on Skylake.

Ice Lake to Rocket Lake

• Integer execution: LLVM’s tuning for these cores, unlike its tuning for Skylake, no longer zeroes the destination of popcnt to break a dependency on its old value.

Jaguar and Puma

• Integer execution: LZCNT and POPCNT take one cycle on either ALU and TZCNT two, while BSF and BSR are microcoded, of seven and eight macro-ops and 4 and 5 cycles, so the newer instructions are the better choice where the zero case allows.

Silvermont to Goldmont Plus

• Out-of-order and in-order execution: On Silvermont shifts and rotates run on integer port 0, and jumps, multiplication, popcnt, crc32 and bit operations on port 1. sources differ
• Out-of-order and in-order execution: popcnt takes 3 cycles, one a cycle, on Silvermont and Goldmont.
• Instruction set and counters: Silvermont is the first Atom core with SSE4.2 and POPCNT; Goldmont Plus adds RDPID and PTWRITE.

Skylake to Cooper Lake

• Integer execution: Port 1 alone runs integer multiplication, PDEP and PEXT, popcnt, lzcnt, tzcnt, bsf, bsr and the double shifts, with a latency of three cycles and one a cycle in LLVM’s models, as on Golden Cove.
• Integer execution: popcnt waits for the old value of its destination register, which it overwrites; compilers tuning for these cores zero the destination first to break the chain.

Tremont

• Integer execution: Three ALU ports run simple integer operations, three a cycle; shifts go to port 00 only, and multiplication, division, popcnt, crc32 and the bit operations to port 01 only.
• Integer execution: LLVM’s tuning for Tremont, as for Goldmont Plus, does not make popcnt wait for its destination register’s old value, which its Goldmont tuning does.

Zen and Zen+

• Integer execution: BSF and BSR are six macro-ops with a latency of three and four cycles, while LZCNT and POPCNT are one macro-op of one cycle and TZCNT two of two cycles. sources differ

Zen 2

• Integer execution: BSF and BSR are six macro-ops with a latency of three and four cycles, while LZCNT and POPCNT are one macro-op of one cycle and TZCNT two; LLVM’s model agrees.

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

s = src.read()
n = 0
for i in range(OSIZE):
    n += s >> i & 1              # count the 1 bits
if not nf:                       # NF=1 (APX) leaves the flags as they were
    of = sf = af = pf = cf = 0
    zf = s == 0
dest.write(n)                    # a 32-bit register: bits 63:32 cleared

Operands

Flags

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

Legacy forms

none in XED

EVEX forms

APX-EVEX-INT

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to POPCNT, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More APX instructions

• JMPABS
• KMOVB
• KMOVD
• KMOVQ
• KMOVW
• LDTILECFG
• LZCNT
• MOVBE
• MOVDIR64B
• MOVDIRI
• MOVRS
• MUL
• MULX
• NEG
• NOT
• OR
• PDEP
• PEXT
• POP2
• POP2P
• POPP
• PUSH2
• PUSH2P
• PUSHP
• RCL
• RCR
• RDMSR
• ROL
• ROR
• RORX
• SAR
• SARX
• SBB
• SETcc
• SHL
• SHLD
• SHLX
• SHR
• SHRD
• SHRX

All 88 APX instructions