Sign up ×
Stack Overflow is a community of 4.7 million programmers, just like you, helping each other. Join them; it only takes a minute:

I have found something unexpected (to me) using the Intel® Architecture Code Analyzer (IACA).

The following instruction using [base+index] addressing

addps xmm1, xmmword ptr [rsi+rax*1]

does not micro-fuse according to IACA. However, if I use [base+offset] like this

addps xmm1, xmmword ptr [rsi]

IACA reports that it does fuse.

Section 2-11 of the Intel optimization reference manual gives the following as an example "of micro-fused micro-ops that can be handled by all decoders"

FADD DOUBLE PTR [RDI + RSI*8]

and Agner Fog's optimization assembly manual also gives examples of micro-op fusion using [base+index] addressing. See, for example, Section 12.2 "Same example on Core2". So what's the correct answer?

share|improve this question
2  
Downvoter please explain yourself. Not all of us have time to test everything through experiment. – Z boson Sep 26 '14 at 7:49
2  
I have no idea why this was downvoted - I upvoted. Similarly my original IACA question has now a close vote against it. The question is good; I'll get around it this weekend. – Iwillnotexist Idonotexist Sep 26 '14 at 19:45
1  
@IwillnotexistIdonotexist, I am trying to write tests to check this. Currently I have a case where IACA says the fused version has a block throughput of 2.0 and the non-fused version 6.0 but they both take the same time in practice. I am leaning towards the side that IACA has a bug. But if you find something please let me know. – Z boson Sep 26 '14 at 20:04
2  
I genuinely don't know; I've been quite stumped on this problem the past few days although somebody dropped this useful Haswell diagram below your older question's answer. That fills my sails slightly - Micro/macrofusion happens at decode time and the ROB can't assist. – Iwillnotexist Idonotexist Oct 2 '14 at 21:04
2  
@IwillnotexistIdonotexist: the Intel manuals were probably written before SnB. . Sandybridge switched to a physical register file, made major under-the-hood changes to how uops are tracked. This came up in a discussion recently: stackoverflow.com/questions/31875464/…. Perf-counter experiments on SnB show that IACA is right. (except for rip-relative, glad you brought that up). I'm still waiting to hear if Skylake changed anything on this front. – Peter Cordes Aug 9 at 10:31
up vote 7 down vote accepted

It should be possible to check with the uop perf counter, in an artificial loop that just repeats an instruction that we want to know about. I've now done this, see below. AFAICT, 1-register modes can micro-fuse in read-modify instructions, but 2-register modes can't.

It would make sense that IACA is right that 1-register addressing modes can micro-fuse, while 2-register addressing modes can't. Normally uops can only have 2 input dependencies. (FMA is a special case). Instructions with more than 2 non-immediate input operands, other than FMA, always decode to multiple uops. (source: I think I read this in one of Agner Fog's manuals, probably the microarch one.) IDK how Intel CPUs track the 3 input deps for a single uop, without including enough silicon for the general case of 3 inputs and reducing the number of uops for many other instructions (like variable-mask shuffles and blends).

edit: also worth testing: instructions that don't read their dest. If there is no other dependency, like for a mov from memory, maybe a 2-register addressing mode can micro-fuse, and those registers would be the only 2 data dependencies for the uop. Or, multi-uop instructions can maybe micro-fuse one of their uops, and not require an extra one when one of their inputs is a register instead of a memory location. (Although pinsrw is already like this, and it doesn't count as micro-fusion. Maybe because the 'get 16bits from a reg' uop is just replaced with a 'load 16bits from mem' uop?)

I think this non-fusion for 2-reg addressing modes is accurate. Another piece of evidence is performance of LUT lookups with MMX punpckldq (which is 1 uop and can micro-fuse a memory operand), vs. pinsrw (which always takes 2 uops). I was expecting pinsrw to be slower, but it wasn't. (My memory addresses are of the (%rsi, %rax, 4) form, so punpckldq wouldn't fuse, and thus be 2 uops.)

Incidentally, on Haswell, vpgatherdd takes about 1.7x more cycles than a movd / pinsrw gather, when that's basically all you're doing in the loop. (read/PXOR/write the combined LUT lookups into a dest buffer.) Also interesting: with AVX-512, brute-force non-LUT GF16 multiplies will be faster than LUT lookups, unless future vpgather implementations get faster.

Update: confirmed by testing

Confirmed by testing with performance counters for uops and cycles.

I found a table of PMU events for Intel Sandybridge, for use with Linux's perf command. (Standard perf unfortunately doesn't have symbolic names for most hardware-specific PMU events, like uops.) I made use of it for a recent answer.

To test for uop micro-fusion, I constructed a test program that is bottlenecked on the 4-uops-per-cycle fused-domain limit of Intel CPUs. To avoid any execution-port contention, many of these uops are nops, which still sit in the uop cache and go through the pipeline the same as any other uop, except they don't get dispatched to an execution port. (An xor x, same, or an eliminated move, would be the same.)

Test program: yasm -f elf64 uop-test.s && ld uop-test.o -o uop-test

GLOBAL _start
_start:
    xor eax, eax
    xor ebx, ebx
    xor edx, edx
    xor edi, edi
    lea rsi, [rel mydata]   ; load pointer
    mov ecx, 10000000
    cmp dword [rsp], 2      ; argc >= 2
    jge .loop_2reg

ALIGN 32
.loop_1reg:
    or eax, [rsi + 0]
    or ebx, [rsi + 4]
    dec ecx
    nop
    nop
    nop
    nop
    jg .loop_1reg
;   xchg r8, r9     ; no effect on flags; decided to use NOPs instead

    jmp .out

ALIGN 32
.loop_2reg:
    or eax, [rsi + 0 + rdi]
    or ebx, [rsi + 4 + rdi]
    dec ecx
    nop
    nop
    nop
    nop
    jg .loop_2reg

.out:
    xor edi, edi
    mov eax, 231    ;  exit(0)
    syscall

SECTION .rodata
mydata:
db 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff

I also found that the uop bandwidth out of the loop buffer isn't a constant 4 per cycle, if the loop isn't a multiple of 4 uops. (i.e. it's abc, abc, ...; not abca, bcab, ...). Agner Fog's microarch doc unfortunately wasn't clear on this limitation of the loop buffer.

I wanted to keep macro-fusion (compare-and-branch) out of the picture, so I used nops between the dec and the branch. I used 4 nops, so with micro-fusion, the loop would be 8 uops, and fill the pipeline with at 2 cycles per 1 iteration.

In the other version of the loop, using 2-operand addressing modes that don't micro-fuse, the loop will be 10 fused-domain uops, and run in 3 cycles.

Results from my 3.3GHz Intel Sandybridge (i5 2500k). I didn't do anything to get the cpufreq governor to ramp up clock speed before testing, because cycles are cycles when you aren't interacting with memory. I've added annotations for the performance counter events that I had to enter in hex.

testing the 1-reg addressing mode: no cmdline arg

$ perf stat -e task-clock,cycles,instructions,r1b1,r10e,r2c2,r1c2,stalled-cycles-frontend,stalled-cycles-backend ./uop-test

Performance counter stats for './uop-test':

     11.489620      task-clock (msec)         #    0.961 CPUs utilized
    20,288,530      cycles                    #    1.766 GHz
    80,082,993      instructions              #    3.95  insns per cycle
                                              #    0.00  stalled cycles per insn
    60,190,182      r1b1  ; UOPS_DISPATCHED: (unfused-domain.  1->umask 02 -> uops sent to execution ports from this thread)
    80,203,853      r10e  ; UOPS_ISSUED: fused-domain
    80,118,315      r2c2  ; UOPS_RETIRED: retirement slots used (fused-domain)
   100,136,097      r1c2  ; UOPS_RETIRED: ALL (unfused-domain)
       220,440      stalled-cycles-frontend   #    1.09% frontend cycles idle
       193,887      stalled-cycles-backend    #    0.96% backend  cycles idle

   0.011949917 seconds time elapsed

testing the 2-reg addressing mode: with a cmdline arg

$ perf stat -e task-clock,cycles,instructions,r1b1,r10e,r2c2,r1c2,stalled-cycles-frontend,stalled-cycles-backend ./uop-test x

 Performance counter stats for './uop-test x':

         18.756134      task-clock (msec)         #    0.981 CPUs utilized
        30,377,306      cycles                    #    1.620 GHz
        80,105,553      instructions              #    2.64  insns per cycle
                                                  #    0.01  stalled cycles per insn
        60,218,693      r1b1  ; UOPS_DISPATCHED: (unfused-domain.  1->umask 02 -> uops sent to execution ports from this thread)
       100,224,654      r10e  ; UOPS_ISSUED: fused-domain
       100,148,591      r2c2  ; UOPS_RETIRED: retirement slots used (fused-domain)
       100,172,151      r1c2  ; UOPS_RETIRED: ALL (unfused-domain)
           307,712      stalled-cycles-frontend   #    1.01% frontend cycles idle
         1,100,168      stalled-cycles-backend    #    3.62% backend  cycles idle

       0.019114911 seconds time elapsed

So, both versions ran 80M instructions, and dispatched 60M uops to execution ports. (or with a memory source dispatches to an ALU for the or, and a load port for the load, regardless of whether it was micro-fused or not in the rest of the pipeline. nop doesn't dispatch to an execution port at all.) Similarly, both versions retire 100M unfused-domain uops, because the 40M nops count here.

The difference is in the counters for the fused-domain.

  1. The 1-register address version only issues and retires 80M fused-domain uops. This is the same as the number of instructions. Each insn turns into one fused-domain uop.
  2. The 2-register address version issues 100M fused-domain uops. This is the same as the number of unfused-domain uops, indicating that no micro-fusion happened.

I suspect that you'd only see a difference between UOPS_ISSUED and UOPS_RETIRED(retirement slots used) if branch mispredicts led to uops being cancelled after issue, but before retirement.

And finally, the performance impact is real. The non-fused version took 1.5x as many clock cycles. This exaggerates the performance difference compared to most real cases. The loop has to run in a whole number of cycles, and the 2 extra uops push it from 2 to 3. Often, an extra 2 fused-domain uops will make less difference. And potentially no difference, if the code is bottlecked by something other than 4-fused-domain-uops-per-cycle.

Still, code that makes a lot of memory references in a loop might be faster if implemented by incrementing pointers, instead of the using [base + offset] addressing modes.

futher stuff

cmp [rip-rel], imm8 can't micro-fuse (on SnB). So IACA is wrong about this one:

cmp dword  [abs mydata], 0x1b   ; fused counters != unfused counters
cmp dword  [rel mydata], 0x1b   ; fused counters ~= unfused counters

However, rip-rel can micro-fuse in at least this other case:

or  eax, dword  [rel mydata]    ; fused counters != unfused counters

Micro-fusion doesn't increase the latency of an instruction. The load can issue before the other input is ready.

ALIGN 32
.dep_fuse:
    or eax, [rsi + 0]
    or eax, [rsi + 0]
    or eax, [rsi + 0]
    or eax, [rsi + 0]
    or eax, [rsi + 0]
    dec ecx
    jg .dep_fuse

This loop runs at 5 cycles per iteration, because of the eax dep chain. No faster than a sequence of or eax, [rsi + 0 + rdi], or mov ebx, [rsi + 0 + rdi] / or eax, ebx. (The unfused and the mov versions both run the same number of uops.) Scheduling / dep checking happens in the unfused-domain.

Micro-fusion doesn't have a shortcut for the base and offset being the same register. A loop with or eax, [mydata + rdi+4*rdi] (where rdi is zeroed) runs as many uops and cycles as the loop with or eax, [rsi+rdi]. This addressing mode could be used for iterating over an array of odd-sized structs starting at a fixed address. This is probably never used in most programs, so it's no surprise that Intel didn't spend transistors on allowing this special-case of 2-register modes to micro-fuse.

Macro-fusion of a cmp/jcc or dec/jcc creates a uop that stays as a single uop even in the unfused-domain. dec / nop / jge can still run in a single cycle, because of branch prediction, not actually checking the flags in time.

share|improve this answer
1  
Too bad consumer Skylake processors won't have AVX512. AVX-512 is a lot less interesting now. – Z boson Jun 24 at 13:20
1  
yeah, my sentiments exactly. I'm hoping Skylake Xeons will come out around the same time as desktop. A Haswell "workstation" with a xeon CPU doesn't cost much more than quality desktop, and you can use ECC RAM without limiting yourself to an i3. – Peter Cordes Jun 24 at 13:36

Older Intel processors without a uop cache can do the fusion, so maybe this is a drawback of the uop cache. I don't have the time to test this right now, but I will add a test for uop fusion next time I update my test scripts. Have you tried with FMA instructions? They are the only instructions that allow 3 input dependencies in an unfused uop.

share|improve this answer
    
I haven't. I don't have a Haswell CPU. >.< But that's an excellent point, fusion rules might be different. – Peter Cordes Jul 13 at 9:14
    
@PeterCordes, I orginally discovered this from a question using FMA. See the part when I discuss Stephen Canon's comment. He suggested ""using the store address as the offset for the load operands." which allows the store to use port 7. However, this does not fuse so it's no better. The only solution which allowed me to have four fused microps (6 total) was Evgeny Kluev suggestion using a static array and one register mode. I asked this question because of that question. – Z boson Jul 14 at 10:35

I have now reviewed test results for Intel Sandy Bridge, Ivy Bridge, Haswell and Broadwell. I have not had access to test on a Skylake yet. The results are:

  • Instructions with two-register addressing and three input dependencies are fusing allright. They take only one entry in the micro-operation cache as long as they contain no more than 32 bits of data (or 2 * 16 bits).
  • It is possible to make instructions with four input dependencies, using fused multiply-and-add instructions on Haswell and Broadwell. These instructions still fuse into a single micro-op and take only one entry in the micro-op cache.
  • Instructions with more than 32 bits of data, for example 32 bits address and 8 bits immediate data can still fuse, but use two entries in the micro-operation cache (unless the 32 bits can be compressed into a 16-bit signed integer)
  • Instructions with rip-relative addressing and an immediate constant are not fusing, even if both the offset and the immediate constant are very small.
  • All the results are identical on the four machines tested.
  • The tests were performed with my own test programs using the performance monitoring counters on loops that were sufficiently small to fit into the micro-op cache.

Your results may be due to other factors. I have not tried to use the IACA.

share|improve this answer
    
I was using small ~8 uop loops on SnB, and looking at the perf counters for fused and unfused domain uops. Can you see anything wrong with my test code (posted in my answer)? I was using instructions like or eax, [rsi + 4 + rdi], which only has 32bits of data (the offset). Was I looking at the wrong perf counter or something? The change in observed behaviour (cycles to run the loop) matches up with fusion not happening -> loop takes more cycles per iteration because of the 4-wide pipe. And fused-domain matches unfused-domain counts. – Peter Cordes Dec 1 at 15:27
    
I was testing fused-domain uops against the 4-wide limit of the pipeline for issuing / retiring 4 fused-domain uops per clock. Is it possible that the uop cache can fuse better than the rest of the pipeline? My test was with tiny loops, which fit in the loop buffer, so the uop cache shouldn't have been directly involved. – Peter Cordes Dec 1 at 15:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.