lzcnt
Count Leading Zeros
LZCNT r, r/m
Counts number of leading zeros.
Details
Counts the number of leading zero bits in the source operand and stores the result in the destination register. This is an ABM (Advanced Bit Manipulation) instruction that sets the zero flag if the source is zero (result is operand width) and clears it otherwise. Unlike BSR, this always produces a result without undefined behavior, making it safer for leading zero counting.
Pseudocode Operation
count ← 0;
for i ← (width - 1) down to 0:
if (src >> i) & 1 == 1:
break;
count ← count + 1;
if src == 0:
dest ← width;
ZF ← 1;
else:
dest ← count;
ZF ← 0;
Example
LZCNT rax, rbx
Encoding
Binary Layout
F3
+0
0F
+1
BD
+2
Operands
-
dest
General-purpose register -
src
Register or memory operand
Reference (Intel® SDM)
Instruction Forms
| Opcode | Instruction | Op/En | 64/32-bit Mode | CPUID | Description |
|---|---|---|---|---|---|
| F3 0F BD /r | LZCNT | RM | V/V | Count the number of leading zero bits in r/m16, return result in r16. LZCNT r16, r/m16 | |
| F3 0F BD /r | LZCNT | RM | V/V | Count the number of leading zero bits in r/m32, return result in r32. LZCNT r32, r/m32 | |
| F3 REX.W 0F BD /r | LZCNT | RM | V/N.E. | Count the number of leading zero bits in r/m64, return result in r64. LZCNT r64, r/m64 |
Description
LZCNT counts the number of leading most significant zero bits in a source operand (second operand) and returns the result in the destination (first operand). LZCNT is an extension of the BSR instruction. The key difference between the LZCNT and BSR instructions is that when the source operand is zero, LZCNT outputs the operand size to the destination operand, whereas BSR leaves the destination operand unmodified.
On processors that do not support LZCNT, the instruction byte encoding is executed as BSR.
Operation
temp := OperandSize - 1 DEST := 0 WHILE (temp >= 0) AND (Bit(SRC, temp) = 0) DO temp := temp - 1 DEST := DEST+ 1 OD IF DEST = OperandSize CF := 1 ELSE CF := 0 FI IF DEST = 0 ZF := 1 ELSE ZF := 0 FI
Intel C/C++ Compiler Intrinsic Equivalent
LZCNT unsigned __int32 _lzcnt_u32(unsigned __int32 src); LZCNT unsigned __int64 _lzcnt_u64(unsigned __int64 src); LZCNT—Count the Number of Leading Zero Bits Vol. 2A 3-578
Flags Affected
ZF flag is set to 1 in case of zero output (most significant bit of the source is set), and to 0 otherwise, CF flag is set to 1 if input was zero and cleared otherwise. OF, SF, PF, and AF flags are undefined.
Exceptions
Protected Mode Exceptions
#GP(0) For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments.
If the DS, ES, FS, or GS register is used to access memory and it contains a null segment
selector.
#SS(0) For an illegal address in the SS segment.
#PF (fault-code) For a page fault.
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD If LOCK prefix is used.
Real-Address Mode Exceptions
#GP(0) If any part of the operand lies outside of the effective address space from 0 to 0FFFFH.
#SS(0) For an illegal address in the SS segment.
#UD If LOCK prefix is used.
Virtual 8086 Mode Exceptions
#GP(0) If any part of the operand lies outside of the effective address space from 0 to 0FFFFH.
#SS(0) For an illegal address in the SS segment.
#PF (fault-code) For a page fault.
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD If LOCK prefix is used.
Compatibility Mode Exceptions
Same exceptions as in Protected Mode.
64-Bit Mode Exceptions
#GP(0) If the memory address is in a non-canonical form.
#SS(0) If a memory address referencing the SS segment is in a non-canonical form.
#PF (fault-code) For a page fault.
#AC(0) If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD If LOCK prefix is used.
LZCNT—Count the Number of Leading Zero Bits Vol. 2A 3-579
CHAPTER 4
4.1 IMM8 CONTROL BYTE OPERATION FOR PCMPESTRI / PCMPESTRM /
PCMPISTRI / PCMPISTRM
The notations introduced in this section are referenced in the reference pages of PCMPESTRI, PCMPESTRM, PCMP-
ISTRI, PCMPISTRM. The operation of the immediate control byte is common to these four string text processing
instructions of SSE4.2. This section describes the common operations.
4.1.1 General Description
The operation of PCMPESTRI, PCMPESTRM, PCMPISTRI, PCMPISTRM is defined by the combination of the respec-
tive opcode and the interpretation of an immediate control byte that is part of the instruction encoding.
The opcode controls the relationship of input bytes/words to each other (determines whether the inputs terminated
strings or whether lengths are expressed explicitly) as well as the desired output (index or mask).
The imm8 control byte for PCMPESTRM/PCMPESTRI/PCMPISTRM/PCMPISTRI encodes a significant amount of
programmable control over the functionality of those instructions. Some functionality is unique to each instruction
while some is common across some or all of the four instructions. This section describes functionality which is
common across the four instructions.
The arithmetic flags (ZF, CF, SF, OF, AF, PF) are set as a result of these instructions. However, the meanings of the
flags have been overloaded from their typical meanings in order to provide additional information regarding the
relationships of the two inputs.
PCMPxSTRx instructions perform arithmetic comparisons between all possible pairs of bytes or words, one from
each packed input source operand. The boolean results of those comparisons are then aggregated in order to
produce meaningful results. The imm8 control byte is used to affect the interpretation of individual input elements
as well as control the arithmetic comparisons used and the specific aggregation scheme.
Specifically, the imm8 Control Byte consists of bit fields that control the following attributes:
• Source data format — Byte/word data element granularity, signed or unsigned elements.
• Aggregation operation — Encodes the mode of per-element comparison operation and the aggregation of
per-element comparisons into an intermediate result.
• Polarity — Specifies intermediate processing to be performed on the intermediate result.
• Output selection — Specifies final operation to produce the output (depending on index or mask) from the
intermediate result.
4.1.2 Source Data Format
Table 4-1. Source Data Format
Imm8[1:0] Meaning Description
00b Unsigned bytes Both 128-bit sources are treated as packed, unsigned bytes.
01b Unsigned words Both 128-bit sources are treated as packed, unsigned words.
10b Signed bytes Both 128-bit sources are treated as packed, signed bytes.
11b Signed words Both 128-bit sources are treated as packed, signed words.
If the imm8 control byte has bit[0] cleared, each source contains 16 packed bytes. If the bit is set each source
contains 8 packed words. If the imm8 control byte has bit[1] cleared, each input contains unsigned data. If the bit
is set each source contains signed data.
4.1.3 Aggregation Operation
Table 4-2. Aggregation Operation
Imm8[3:2] Mode Comparison
00b Equal any The arithmetic comparison is “equal.”
01b Ranges Arithmetic comparison is “greater than or equal” between even indexed bytes/words of reg and
each byte/word of reg/mem.
Arithmetic comparison is “less than or equal” between odd indexed bytes/words of reg and each
byte/word of reg/mem.
(reg/mem[m] >= reg[n] for n = even, reg/mem[m] <= reg[n] for n = odd)
10b Equal each The arithmetic comparison is “equal.”
11b Equal ordered The arithmetic comparison is “equal.”
All 256 (64) possible comparisons are always performed. The individual Boolean results of those comparisons are
referred by “BoolRes[Reg/Mem element index, Reg element index].” Comparisons evaluating to “True” are repre-
sented with a 1, False with a 0 (positive logic). The initial results are then aggregated into a 16-bit (8-bit) interme-
diate result (IntRes1) using one of the modes described in the table below, as determined by imm8 control byte
bits[3:2].
See Section 4.1.6 for a description of the overrideIfDataInvalid() function used in Table 4-3.
Table 4-3. Aggregation Operation
Mode Pseudocode
Equal any UpperBound = imm8[0] ? 7 : 15;
(find characters from a set) IntRes1 = 0;
For j = 0 to UpperBound, j++
For i = 0 to UpperBound, i++
IntRes1[j] OR= overrideIfDataInvalid(BoolRes[j,i])
Ranges UpperBound = imm8[0] ? 7 : 15;
(find characters from ranges) IntRes1 = 0;
For j = 0 to UpperBound, j++
For i = 0 to UpperBound, i+=2
IntRes1[j] OR= (overrideIfDataInvalid(BoolRes[j,i]) AND
overrideIfDataInvalid(BoolRes[j,i+1]))
Equal each UpperBound = imm8[0] ? 7 : 15;
(string compare) IntRes1 = 0;
For i = 0 to UpperBound, i++
IntRes1[i] = overrideIfDataInvalid(BoolRes[i,i])
Equal ordered UpperBound = imm8[0] ? 7 :15;
(substring search) IntRes1 = imm8[0] ? FFH : FFFFH
For j = 0 to UpperBound, j++
For i = 0 to UpperBound-j, k=j to UpperBound, k++, i++
IntRes1[j] AND= overrideIfDataInvalid(BoolRes[k,i])
4.1.4 Polarity
IntRes1 may then be further modified by performing a 1’s complement, according to the value of the imm8 control
byte bit[4]. Optionally, a mask may be used such that only those IntRes1 bits which correspond to “valid” reg/mem
input elements are complemented (note that the definition of a valid input element is dependent on the specific
opcode and is defined in each opcode’s description). The result of the possible negation is referred to as IntRes2.
Table 4-4. Polarity
Imm8[5:4] Operation Description
00b Positive Polarity (+) IntRes2 = IntRes1
01b Negative Polarity (-) IntRes2 = -1 XOR IntRes1
10b Masked (+) IntRes2 = IntRes1
11b Masked (-) IntRes2[i] = IntRes1[i] if reg/mem[i] invalid, else = ~IntRes1[i]
4.1.5 Output Selection
Table 4-5. Output Selection
Imm8[6] Operation Description
0b Least significant index The index returned to ECX is of the least significant set bit in IntRes2.
1b Most significant index The index returned to ECX is of the most significant set bit in IntRes2.
For PCMPESTRI/PCMPISTRI, the imm8 control byte bit[6] is used to determine if the index is of the least significant
or most significant bit of IntRes2.
Table 4-6. Output Selection
Imm8[6] Operation Description
0b Bit mask IntRes2 is returned as the mask to the least significant bits of XMM0 with zero extension to 128
bits.
1b Byte/word mask IntRes2 is expanded into a byte/word mask (based on imm8[1]) and placed in XMM0. The expansion
is performed by replicating each bit into all of the bits of the byte/word of the same index.
Specifically for PCMPESTRM/PCMPISTRM, the imm8 control byte bit[6] is used to determine if the mask is a 16 (8)
bit mask or a 128 bit byte/word mask.
4.1.6 Valid/Invalid Override of Comparisons
PCMPxSTRx instructions allow for the possibility that an end-of-string (EOS) situation may occur within the 128-bit
packed data value (see the instruction descriptions below for details). Any data elements on either source that are
determined to be past the EOS are considered to be invalid, and the treatment of invalid data within a comparison
pair varies depending on the aggregation function being performed.
In general, the individual comparison result for each element pair BoolRes[i.j] can be forced true or false if one or
more elements in the pair are invalid. See Table 4-7.
Table 4-7. Comparison Result for Each Element Pair BoolRes[i.j]
xmm1 xmm2/ m128 Imm8[3:2] = 00b Imm8[3:2] = 01b Imm8[3:2] = 10b Imm8[3:2] = 11b
byte/ word byte/word (equal any) (ranges) (equal each) (equal ordered)
Invalid Invalid Force false Force false Force true Force true
Invalid Valid Force false Force false Force false Force true
Valid Invalid Force false Force false Force false Force false
Valid Valid Do not force Do not force Do not force Do not force
4.1.7 Summary of Im8 Control byte
Table 4-8. Summary of Imm8 Control Byte
Imm8 Description
-------0b 128-bit sources treated as 16 packed bytes.
-------1b 128-bit sources treated as 8 packed words.
------0-b Packed bytes/words are unsigned.
------1-b Packed bytes/words are signed.
----00--b Mode is equal any.
----01--b Mode is ranges.
----10--b Mode is equal each.
----11--b Mode is equal ordered.
---0----b IntRes1 is unmodified.
---1----b IntRes1 is negated (1’s complement).
--0-----b Negation of IntRes1 is for all 16 (8) bits.
--1-----b Negation of IntRes1 is masked by reg/mem validity.
-0------b Index of the least significant, set, bit is used (regardless of corresponding input element validity).
IntRes2 is returned in least significant bits of XMM0.
-1------b Index of the most significant, set, bit is used (regardless of corresponding input element validity).
Each bit of IntRes2 is expanded to byte/word.
0-------b This bit currently has no defined effect, should be 0.
1-------b This bit currently has no defined effect, should be 0.
4.1.8 Diagram Comparison and Aggregation Process
Figure 4-1. Operation of PCMPSTRx and PCMPESTRx
4.2 COMMON TRANSFORMATION AND PRIMITIVE FUNCTIONS FOR SHA1XXX
AND SHA256XXX
The following primitive functions and transformations are used in the algorithmic descriptions of SHA1 and SHA256
instruction extensions SHA1NEXTE, SHA1RNDS4, SHA1MSG1, SHA1MSG2, SHA256RNDS4, SHA256MSG1, and
SHA256MSG2. The operands of these primitives and transformation are generally 32-bit DWORD integers.
• f0(): A bit oriented logical operation that derives a new dword from three SHA1 state variables (dword). This
function is used in SHA1 round 1 to 20 processing.
f0(B,C,D) := (B AND C) XOR ((NOT(B) AND D)
• f1(): A bit oriented logical operation that derives a new dword from three SHA1 state variables (dword). This
function is used in SHA1 round 21 to 40 processing.
f1(B,C,D) := B XOR C XOR D
• f2(): A bit oriented logical operation that derives a new dword from three SHA1 state variables (dword). This
function is used in SHA1 round 41 to 60 processing.
f2(B,C,D) := (B AND C) XOR (B AND D) XOR (C AND D)
• f3(): A bit oriented logical operation that derives a new dword from three SHA1 state variables (dword). This
function is used in SHA1 round 61 to 80 processing. It is the same as f1().
f3(B,C,D) := B XOR C XOR D
• Ch(): A bit oriented logical operation that derives a new dword from three SHA256 state variables (dword).
Ch(E,F,G) := (E AND F) XOR ((NOT E) AND G)
• Maj(): A bit oriented logical operation that derives a new dword from three SHA256 state variables (dword).
Maj(A,B,C) := (A AND B) XOR (A AND C) XOR (B AND C)
ROR is rotate right operation
(A ROR N) := A[N-1:0] || A[Width-1:N]
ROL is rotate left operation
(A ROL N) := A ROR (Width-N)
SHR is the right shift operation
(A SHR N) := ZEROES[N-1:0] || A[Width-1:N]
• Σ0( ): A bit oriented logical and rotational transformation performed on a dword SHA256 state variable.
Σ0(A) := (A ROR 2) XOR (A ROR 13) XOR (A ROR 22)
• Σ1( ): A bit oriented logical and rotational transformation performed on a dword SHA256 state variable.
Σ1(E) := (E ROR 6) XOR (E ROR 11) XOR (E ROR 25)
• σ0( ): A bit oriented logical and rotational transformation performed on a SHA256 message dword used in the
message scheduling.
σ0(W) := (W ROR 7) XOR (W ROR 18) XOR (W SHR 3)
• σ1( ): A bit oriented logical and rotational transformation performed on a SHA256 message dword used in the
message scheduling.
σ1(W) := (W ROR 17) XOR (W ROR 19) XOR (W SHR 10)
• Ki: SHA1 Constants dependent on immediate i.
K0 = 0x5A827999
K1 = 0x6ED9EBA1
K2 = 0X8F1BBCDC
K3 = 0xCA62C1D6
4.3 INSTRUCTIONS (M-U)
Chapter 4 continues an alphabetical discussion of Intel® 64 and IA-32 instructions (M-U). See also: Chapter 3,
“Instruction Set Reference, A-L,” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume
2A; Chapter 4, “Instruction Set Reference, M-U‚” in the Intel® 64 and IA-32 Architectures Software Developer’s
Manual, Volume 2C; and Chapter 4, “Instruction Set Reference, M-U‚” in the Intel® 64 and IA-32 Architectures
Software Developer’s Manual, Volume 2D.