TZCNT

TZCNT counts the zero bits below the lowest set bit, which is that bit’s index: for 0x28 it gives 3. For a zero source it returns the operand size, 16, 32 or 64, and sets CF, so every input has a defined result. Code walks the set bits of a mask with it: TZCNT for the index of the lowest one, BLSR to clear that bit, and again until the mask is 0.

TZCNT and BSF#

TZCNT is encoded as BSF with an F3 prefix, and a processor without BMI1 ignores the prefix and runs BSF. Both give the same index for a nonzero source; they part for zero and in the flags:

Both vendors’ manuals now say that BSF leaves the destination unchanged; Intel’s adds that some older processors clear bits 63:32 of a 64-bit register for a 32-bit BSF.

Compilers use the shared encoding. Without -mbmi, GCC 14 and Clang 23 at -O2 compile __builtin_ctz(x), which C leaves undefined for 0, to rep bsf: TZCNT on processors with BMI1, BSF on the others, and the same result for every nonzero x. For x ? __builtin_ctz(x) : 32, Clang loads 32 into the destination first, which TZCNT returns and BSF keeps; GCC adds a TEST and a CMOVE. With -mbmi both emit one TZCNT. Code that tests ZF after rep bsf to catch a zero source, however, gets different answers on the two kinds of processors.

LZCNT is different#

The trick does not carry over to LZCNT and BSR. BSR returns the index of the highest set bit, LZCNT the number of zeros above it, which for 32 bits is 31 minus that index; a processor without LZCNT runs its encoding as BSR and returns the other number. Without -mlzcnt, both compilers therefore compile __builtin_clz to BSR and an XOR with 31, not to rep bsr.

TZCNT belongs to BMI1, part of x86-64-v3; APX adds an EVEX form and one that leaves the flags unchanged (NF).

In the optimization guide

What the optimization guide says about TZCNT, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Out of order

• Zeroing and dependency-breaking idioms: Some instructions that overwrite their whole destination still wait for its old value, a flaw of particular cores: LLVM’s tunings mark popcnt from Sandy Bridge to the Skylake family and lzcnt and tzcnt on Haswell, AMD names tzcnt and three BMI1 instructions on some versions of Zen 5, and Intel several AVX-512 permutations and multiplications on Golden Cove (Skylake, Zen 5, Golden Cove).

Haswell and Broadwell

• Integer execution and bypass: LLVM’s tuning marks POPCNT, LZCNT and TZCNT on both cores as waiting for whatever last wrote the register they overwrite, though they never use its value, as on Skylake.

Jaguar and Puma

• Integer execution: LZCNT and POPCNT take one cycle on either ALU and TZCNT two, while BSF and BSR are microcoded, of seven and eight macro-ops and 4 and 5 cycles, so the newer instructions are the better choice where the zero case allows.

Skylake to Cooper Lake

• Integer execution: Port 1 alone runs integer multiplication, PDEP and PEXT, popcnt, lzcnt, tzcnt, bsf, bsr and the double shifts, with a latency of three cycles and one a cycle in LLVM’s models, as on Golden Cove.

Zen and Zen+

• Integer execution: BSF and BSR are six macro-ops with a latency of three and four cycles, while LZCNT and POPCNT are one macro-op of one cycle and TZCNT two of two cycles. sources differ

Zen 2

• Integer execution: BSF and BSR are six macro-ops with a latency of three and four cycles, while LZCNT and POPCNT are one macro-op of one cycle and TZCNT two; LLVM’s model agrees.

Zen 5

• Integer execution: Some versions of Zen 5 make TZCNT, BLSI, BLSR and BLSMSK wait for the old value of their destination.

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

s = src.read()
n = 0
for i in range(OSIZE):
    if s >> i & 1:
        break
    n += 1                       # the 0 bits below the lowest 1 bit
if not nf:                       # NF=1 (APX) leaves the flags as they were
    cf = s == 0                  # and then n is OSIZE
    zf = n == 0
    of = sf = af = pf = UNDEFINED
dest.write(n)                    # a 32-bit register: bits 63:32 cleared
# without BMI1, a processor runs the legacy encoding (F3 0F BC) as BSF

Operands

Flags

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

Legacy forms

none in XED

EVEX forms

APX-EVEX-INT

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More BMI1 instructions

• ANDN
• BEXTR
• BLSI
• BLSMSK
• BLSR

More APX instructions

• PDEP
• PEXT
• POP2
• POP2P
• POPCNT
• POPP
• PUSH2
• PUSH2P
• PUSHP
• RCL
• RCR
• RDMSR
• ROL
• ROR
• RORX
• SAR
• SARX
• SBB
• SETcc
• SHL
• SHLD
• SHLX
• SHR
• SHRD
• SHRX
• STTILECFG
• SUB
• TILELOADD
• TILELOADDRS
• TILELOADDRST1
• TILELOADDT1
• TILESTORED
• URDMSR
• UWRMSR
• WRMSRNS
• WRSSD
• WRSSQ
• WRUSSD
• WRUSSQ
• XOR

All 88 APX instructions