tzcnt

Count Trailing Zeros

TZCNT r32, r/m32

Counts the number of trailing zeros.

Details

Counts the number of trailing zero bits in src, storing the count in dest. If src is zero, dest is set to the operand size (32 for r/m32); ZF is set if src is zero; CF is cleared; other flags undefined. Available in 32-bit and 64-bit operand sizes; BMI1 extension provides faster behavior than BSF.

Pseudocode Operation

if src == 0:
  dest ← 32
  ZF ← 1
else:
  count ← 0
  while (src & 1) == 0:
    count ← count + 1
    src ← src >> 1
  dest ← count
  ZF ← 0
CF ← 0

Example

TZCNT eax, ebx

Encoding

Binary Layout

Format Legacy

Opcode F3 0F BC

Extension BMI1

Operands

dest
32-bit general-purpose register (e.g. EAX)
src
32-bit register or memory

Reference (Intel® SDM)

Instruction Forms

Opcode	Instruction	Op/En	64/32-bit Mode	CPUID	Description
F3 0F BC /r	TZCNT r16, r/m16	A	V/V	BMI1	Count the number of trailing zero bits in r/m16, return result in r16.
F3 0F BC /r	TZCNT r32, r/m32	A	V/V	BMI1	Count the number of trailing zero bits in r/m32, return result in r32.
F3 REX.W 0F BC /r	TZCNT r64, r/m64	A	V/N.E.	BMI1	Count the number of trailing zero bits in r/m64, return result in r64.

Instruction Operand Encoding

Op/En	Operand 1	Operand 2	Operand 3	Operand 4
A	ModRM:reg (w)	ModRM:r/m (r)	N/A	N/A

Description

TZCNT counts the number of trailing least significant zero bits in source operand (second operand) and returns the result in the destination operand (first operand). TZCNT is an extension of the BSF instruction. The key difference between the TZCNT and BSF instructions is that when the source operand is zero, TZCNT outputs the operand size to the destination operand, whereas BSF leaves the destination operand unmodified. On processors that do not support TZCNT, the instruction byte encoding is executed as BSF.

Operation

temp := 0
DEST := 0
DO WHILE ( (temp < OperandSize) and (SRC[ temp] = 0) )

temp := temp +1
DEST := DEST+ 1
OD

IF DEST = OperandSize
CF := 1
ELSE
CF := 0
FI

IF DEST = 0
ZF := 1
ELSE
ZF := 0
FI

Intel C/C++ Compiler Intrinsic Equivalent

TZCNT unsigned __int32 _tzcnt_u32(unsigned __int32 src);
TZCNT unsigned __int64 _tzcnt_u64(unsigned __int64 src);
TZCNT—Count the Number of Trailing Zero Bits                                                                                                 Vol. 2B 4-730

Flags Affected

ZF is set to 1 in case of zero output (least significant bit of the source is set), and to 0 otherwise, CF is set to 1 if the input was zero and cleared otherwise. OF, SF, PF, and AF flags are undefined.

Exceptions

Protected Mode Exceptions

#GP(0) For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. If the DS, ES, FS, or GS register is used to access memory and it contains a null segment selector. #SS(0) For an illegal address in the SS segment. #PF (fault-code) For a page fault. #AC(0) If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3. #UD If LOCK prefix is used.

Real-Address Mode Exceptions

#GP(0) If any part of the operand lies outside of the effective address space from 0 to 0FFFFH. #SS(0) For an illegal address in the SS segment. #UD If LOCK prefix is used. Virtual 8086 Mode Exceptions #GP(0) If any part of the operand lies outside of the effective address space from 0 to 0FFFFH. #SS(0) For an illegal address in the SS segment. #PF (fault-code) For a page fault. #AC(0) If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3. #UD If LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in Protected Mode.

64-Bit Mode Exceptions

#GP(0) If the memory address is in a non-canonical form. #SS(0) If a memory address referencing the SS segment is in a non-canonical form. #PF (fault-code) For a page fault. #AC(0) If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3. #UD If LOCK prefix is used. TZCNT—Count the Number of Trailing Zero Bits Vol. 2B 4-731