Some Assembly Required » Uncategorized

Square Roots in vivo: normalizing vectors

Elan — Tue, 20 Oct 2009 15:55:59 +0000

Following my earlier article on timing various square-root functions on the x86, commenter LeeN suggested that it would be useful to also test their impact on a more realistic scenario than square-rooting long arrays of independent numbers. In real gameplay code the most common use for sqrts is in finding the length of a vector or normalizing it, like when you need to perform a distance check between two characters to determine whether they can see/shoot/etc each other. So, I wrote up a group of normalize functions, each using a different sqrt technique, and timed them.

The testbed was, as last time, an array of 2048 single-precision floating point numbers, this time interpreted as a packed list of 682 three-dimensional vectors. This number was chosen so that both it and the output array were sure to fit in the L1 cache; however, because three floats add up to twelve bytes, this means that three out of four vectors were not aligned to a 16-byte boundary, which is significant for the SIMD test case as I had to use the movups unaligned load op. Each timing case consisted of looping over this array of vectors 2048 times, normalizing each and writing the result to memory.

Each normalize function computed the length of the vector 1/√(x² + y² + z²), multiplied each component by the reciprocal, and then wrote it back through an output pointer. The main difference was in how the reciprocal square root was computed:

via the x87 FPU, by simply compiling 1.0f/sqrt( x*x + y*y + z*z )
via the SSE scalar unit, by compiling 1.0f/sqrt( x*x + y*y + z*z ) with the /arch:SSE2 option set; this causes the compiler to issue a sqrtss followed by an fdiv — ie, it computes the square root and then divides one by it
via the SSE scalar unit, by using the estimated reciprocal square root intrinsic and then performing one step of Newton-Raphson iteration
via the SSE SIMD unit, working on the whole vector at once

In all cases the results were accurate to 22 bits of precision. The results for 1,396,736 vector normalizations were:

Method	Total time	Time per vector
Compiler `1.0/sqrt(x)` x87 FPU `FSQRT`	52.469ms	37.6ns
Compiler `1.0/sqrt(x)` SSE scalar `sqrtss`	27.233ms	19.5ns
SSE scalar ops `rsqrtss` with one NR step	21.631ms	15.5ns
SSE SIMD ops `rsqrtss` with one NR step	20.034ms	14.3ns

Two things jump out here. First, even when the square root op is surrounded by lots of other math — multiplies, adds, loads, stores — optimizations such as this can make a huge difference. It’s not just the cost of the sqrt itself, but also that it’s unpipelined, which means it ties up an execution unit and prevents any other work from being done until it’s entirely completed.

Second, in this case, SIMD is only a very modest benefit. That’s because the input vectors are unaligned, and the two key steps of this operation, the dot product and the square root, are scalar in nature. (This is what’s meant by “horizontal” SIMD computation — operations between the components of one vector, rather than between the corresponding words of two vectors. Given a vector V ∋ , the sum x + y + z is horizontal, but with two vectors V₁ and V₂, V₃ = 1+x₂, y₁+y₂, z₁+z₂> is vertical.) So it really doesn’t play to SIMD’s strengths at all.

On the other hand, if I were to normalize four vectors at a time, so that four dot products and four rsqrts could be performed in parallel in the four words of a vector register, then the speed advantage of SIMD would be much greater. But, again, my goal wasn’t to test performance in tight loops over packed data — it was to figure out the best way to do something like an angle check in the middle of a character’s AI, where you usually deal with one vector at a time.

Source code for my testing functions below the jump. Note that each function writes the normalized vector through an out pointer, but also returns the original vector’s length. The hand-written intrinsic versions probably aren’t totally optimal, but they ought to be good enough to make the point.

Source

// Normalizes an assumed 3-element vector starting
// at pointer V, and returns the length of the original
// vector.
inline float NaiveTestNormalize( float * RESTRICT vOut, const float * RESTRICT vIn )
{
        const float l = vIn[0]*vIn[0] + vIn[1]*vIn[1] + vIn[2]*vIn[2];
        const float rsqt = 1.0f / sqrt(l);
        vOut[0] = vIn[0] * rsqt;
        vOut[1] = vIn[1] * rsqt;
        vOut[2] = vIn[2] * rsqt;
        return rsqt * l;
}

Assembly (x87 FPU)

_TEXT   SEGMENT
_vOut$ = 8                                              ; size = 4
_vIn$ = 12                                              ; size = 4
?TestNormalize@@YAMPIAMPIBM@Z PROC                      ; TestNormalize, COMDAT
 
; 396  :        const float l = vIn[0]*vIn[0] + vIn[1]*vIn[1] + vIn[2]*vIn[2];
 
        mov     eax, DWORD PTR _vIn$[esp-4]
        fld     DWORD PTR [eax+8]
 
; 397  :        const float rsqt = 1.0f / sqrt(l);
; 398  :        vOut[0] = vIn[0] * rsqt;
 
        mov     ecx, DWORD PTR _vOut$[esp-4]
        fld     DWORD PTR [eax+4]
        fld     DWORD PTR [eax]
        fmul    ST(0), ST(0)
        fld     ST(1)
        fmulp   ST(2), ST(0)
        faddp   ST(1), ST(0)
        fld     ST(1)
        fmulp   ST(2), ST(0)
        faddp   ST(1), ST(0)
        fld     ST(0)
        fsqrt
        fld1
        fdivrp  ST(1), ST(0)
        fld     DWORD PTR [eax]
        fmul    ST(0), ST(1)
        fstp    DWORD PTR [ecx]
 
; 399  :        vOut[1] = vIn[1] * rsqt;
 
        fld     ST(0)
        fmul    DWORD PTR [eax+4]
        fstp    DWORD PTR [ecx+4]
 
; 400  :        vOut[2] = vIn[2] * rsqt;
 
        fld     ST(0)
        fmul    DWORD PTR [eax+8]
        fstp    DWORD PTR [ecx+8]
 
; 401  :        return rsqt * l;
 
        fmulp   ST(1), ST(0)
 
; 402  : }
 
        ret     0
?TestNormalize@@YAMPIAMPIBM@Z ENDP                      ; TestNormalize
_TEXT   ENDS

Assembly (compiler-issued SSE scalar)

_TEXT   SEGMENT
_l$ = -4                                                ; size = 4
_vOut$ = 8                                              ; size = 4
_rsqt$ = 12                                             ; size = 4
_vIn$ = 12                                              ; size = 4
?TestNormalize@@YAMPIAMPIBM@Z PROC                      ; TestNormalize, COMDAT
 
; 392  : {
 
        push    ecx
 
; 393  :        const float l = vIn[0]*vIn[0] + vIn[1]*vIn[1] + vIn[2]*vIn[2];
 
        mov     eax, DWORD PTR _vIn$[esp]
        movss   xmm1, DWORD PTR [eax+4]
        movss   xmm2, DWORD PTR [eax]
        movss   xmm0, DWORD PTR [eax+8]
 
; 394  :        const float rsqt = 1.0f / sqrt(l);
; 395  :        vOut[0] = vIn[0] * rsqt;
 
        mov     eax, DWORD PTR _vOut$[esp]
        movaps  xmm3, xmm2
        mulss   xmm3, xmm2
        movaps  xmm4, xmm1
        mulss   xmm4, xmm1
        addss   xmm3, xmm4
        movaps  xmm4, xmm0
        mulss   xmm4, xmm0
        addss   xmm3, xmm4
        movss   DWORD PTR _l$[esp+4], xmm3
        sqrtss  xmm4, xmm3   ;; slow full-precision square root gets stored in xmm4
        movss   xmm3, DWORD PTR __real@3f800000  ;; store 1.0 in xmm3
        divss   xmm3, xmm4  ;; divide 1.0 / xmm4 to get the reciprocal square root !?!
        movss   DWORD PTR _rsqt$[esp], xmm3
 
; 396  :        vOut[1] = vIn[1] * rsqt;
; 397  :        vOut[2] = vIn[2] * rsqt;
; 398  :        return rsqt * l;
 
        fld     DWORD PTR _rsqt$[esp]
        mulss   xmm2, xmm3
        fmul    DWORD PTR _l$[esp+4]
        mulss   xmm1, xmm3
        mulss   xmm0, xmm3
        movss   DWORD PTR [eax], xmm2
        movss   DWORD PTR [eax+4], xmm1
        movss   DWORD PTR [eax+8], xmm0
 
; 399  : }
 
        pop     ecx
        ret     0
?TestNormalize@@YAMPIAMPIBM@Z ENDP                      ; TestNormalize
_TEXT   ENDS

Source

// SSE scalar reciprocal sqrt using rsqrt op, plus one Newton-Rhaphson iteration
inline __m128 SSERSqrtNR( const __m128 x )
{
	__m128 recip = _mm_rsqrt_ss( x );  // "estimate" opcode
	const static __m128 three = { 3, 3, 3, 3 }; // aligned consts for fast load
	const static __m128 half = { 0.5,0.5,0.5,0.5 };
	__m128 halfrecip = _mm_mul_ss( half, recip );
	__m128 threeminus_xrr = _mm_sub_ss( three, _mm_mul_ss( x, _mm_mul_ss ( recip, recip ) ) );
	return _mm_mul_ss( halfrecip, threeminus_xrr );
}
 
 
inline __m128 SSE_ScalarTestNormalizeFast(  float * RESTRICT vOut, float * RESTRICT vIn )
{
        __m128 x = _mm_load_ss(&vIn[0]);
        __m128 y = _mm_load_ss(&vIn[1]);
        __m128 z = _mm_load_ss(&vIn[2]);
 
        const __m128 l =  // compute x*x + y*y + z*z
                _mm_add_ss(
                 _mm_add_ss( _mm_mul_ss(x,x),
                             _mm_mul_ss(y,y)
                            ),
                 _mm_mul_ss( z, z )
                );
 
 
        const __m128 rsqt = SSERSqrtNR( l );
        _mm_store_ss( &vOut[0] , _mm_mul_ss( rsqt, x ) );
        _mm_store_ss( &vOut[1] , _mm_mul_ss( rsqt, y ) );
        _mm_store_ss( &vOut[2] , _mm_mul_ss( rsqt, z ) );
 
        return _mm_mul_ss( l , rsqt );
}

Assembly

_TEXT   SEGMENT
_vOut$ = 8                                              ; size = 4
_vIn$ = 12                                              ; size = 4
?SSE_ScalarTestNormalizeFast@@YA?AT__m128@@PIAM0@Z PROC ; SSE_ScalarTestNormalizeFast, COMDAT
 
    push    ebp
    mov     ebp, esp
    and     esp, -16                                ; fffffff0H
 
    mov     eax, DWORD PTR _vIn$[ebp]
    movss   xmm0, DWORD PTR [eax]
 
    movss   xmm3, DWORD PTR [eax+4]
 
    movaps  xmm7, XMMWORD PTR ?three@?1??SSERSqrtNR@@YA?AT__m128@@T2@@Z@4T2@B
    movaps  xmm2, xmm0
    movss   xmm0, DWORD PTR [eax+8]
 
    mov     eax, DWORD PTR _vOut$[ebp]
    movaps  xmm4, xmm0
    movaps  xmm0, xmm2
    mulss   xmm0, xmm2
    movaps  xmm1, xmm3
    mulss   xmm1, xmm3
    addss   xmm0, xmm1
    movaps  xmm1, xmm4
    mulss   xmm1, xmm4
    addss   xmm0, xmm1
    movaps  xmm1, xmm0
    rsqrtss xmm1, xmm1
    movaps  xmm5, xmm1
    mulss   xmm1, xmm5
    movaps  xmm6, xmm0
    mulss   xmm6, xmm1
    movaps  xmm1, XMMWORD PTR ?half@?1??SSERSqrtNR@@YA?AT__m128@@T2@@Z@4T2@B
    mulss   xmm1, xmm5
    subss   xmm7, xmm6
    mulss   xmm1, xmm7
    movaps  xmm5, xmm1
    mulss   xmm5, xmm2
    movss   XMMWORD PTR [eax], xmm5
    movaps  xmm2, xmm1
    mulss   xmm2, xmm3
 
    movss   XMMWORD PTR [eax+4], xmm2
    movaps  xmm2, xmm1
    mulss   xmm2, xmm4
 
    movss   XMMWORD PTR [eax+8], xmm2
 
    mulss   xmm0, xmm1
 
    mov     esp, ebp
    pop     ebp
    ret     0
?SSE_ScalarTestNormalizeFast@@YA?AT__m128@@PIAM0@Z ENDP ; SSE_ScalarTestNormalizeFast
_TEXT   ENDS

Source

inline __m128 SSE_SIMDTestNormalizeFast( float * RESTRICT vOut, float * RESTRICT vIn  )
{
        // load as a SIMD vector
        const __m128 vec = _mm_loadu_ps(vIn);
        // compute a dot product by computing the square, and
        // then rotating the vector and adding, so that the
        // dot ends up in the low term (used by the scalar ops)
        __m128 dot = _mm_mul_ps( vec, vec );
        // rotate x under y and add together   
        __m128 rotated = _mm_shuffle_ps( dot, dot, _MM_SHUFFLE( 0,3,2,1 ) ); // YZWX ( shuffle macro is high to low word )
        dot = _mm_add_ss( dot, rotated ); // x^2 + y^2 in the low word
        rotated = _mm_shuffle_ps( rotated, rotated, _MM_SHUFFLE( 0,3,2,1 ) ); // ZWXY
        dot = _mm_add_ss( dot, rotated ); // x^2 + y^2 + z^2 in the low word
 
        __m128 recipsqrt = SSERSqrtNR( dot ); // contains reciprocal square root in low term
        recipsqrt = _mm_shuffle_ps( recipsqrt, recipsqrt, _MM_SHUFFLE( 0, 0, 0, 0 ) ); // broadcast low term to all words
 
        // multiply 1/sqrt(dotproduct) against all vector components, and write back
        const __m128 normalized = _mm_mul_ps( vec, recipsqrt );
        _mm_storeu_ps(vOut, normalized);
        return _mm_mul_ss( dot , recipsqrt );
}

Assembly

_TEXT   SEGMENT
_vOut$ = 8                                              ; size = 4
_vIn$ = 12                                              ; size = 4
?SSE_SIMDTestNormalizeFast@@YA?AT__m128@@PIAM0@Z PROC   ; SSE_SIMDTestNormalizeFast, COMDAT
 
 
    push    ebp
    mov     ebp, esp
    and     esp, -16                                ; fffffff0H
 
    mov     eax, DWORD PTR _vIn$[ebp]
    movups  xmm2, XMMWORD PTR [eax] ;; load the input vector
    movaps  xmm5, XMMWORD PTR ?three@?1??SSERSqrtNR@@YA?AT__m128@@T2@@Z@4T2@B ;; load the constant "3"
    mov     ecx, DWORD PTR _vOut$[ebp]
    movaps  xmm0, xmm2
    mulps   xmm0, xmm2
    movaps  xmm1, xmm0
    shufps  xmm1, xmm0, 57	; shuffle to YZWX
    addss   xmm0, xmm1      ; add Y to low word of xmm0
    shufps  xmm1, xmm1, 57	; shuffle to ZWXY
    addss   xmm0, xmm1      ; add Z to low word of xmm0
 
    movaps  xmm1, xmm0        
    rsqrtss xmm1, xmm1      ; reciprocal square root estimate
    movaps  xmm3, xmm1
    mulss   xmm1, xmm3
    movaps  xmm4, xmm0
    mulss   xmm4, xmm1
    movaps  xmm1, XMMWORD PTR ?half@?1??SSERSqrtNR@@YA?AT__m128@@T2@@Z@4T2@B
    mulss   xmm1, xmm3
    subss   xmm5, xmm4
    mulss   xmm1, xmm5      ; Newton-Raphson finishes here; 1/sqrt(dot) is in xmm1's low word
 
    shufps  xmm1, xmm1, 0   ; broadcast so that xmm1 has 1/sqrt(dot) in all words
    movaps  xmm3, xmm1
    mulps   xmm3, xmm2      ; multiply all words of original vector by 1/sqrt(dot)
    movups  XMMWORD PTR [ecx], xmm3   ; unaligned save to memory
 
	; return dot * 1 / sqrt(dot) == sqrt(dot) == length of vector
    mulss   xmm0, xmm1
 
    mov     esp, ebp
    pop     ebp
    ret     0
?SSE_SIMDTestNormalizeFast@@YA?AT__m128@@PIAM0@Z ENDP   ; SSE_SIMDTestNormalizeFast
_TEXT   ENDS

Happy Holidays! (no post today)

Elan — Mon, 29 Dec 2008 17:00:43 +0000

This is the week when all of Santa’s Elves who work in game-making-places all over the world take a hopefully well deserved break, so no game development post today. Instead, here’s some nice audio books and podcasts that I’ve enjoyed on my commutes in the past year. Happy Holidays!

Escape Pod’s short-fiction podcast has not one but two Christmas specials.
X Minus One, The Lifeboat Mutiny. 50s-era science fiction radio play: two prospectors find themselves in possession of a lifeboat that’s more than it seems. Worth listening to for the Drone National Anthem alone!
G.K. Chesterton’s The Wisdom Of Father Brown is available as a public-domain audio book from LibriVox, read by Martin Clifton. I found this collection of short stories about the eponymous priest-turned-private-detective to be fine treadmill listening.
WNYC’s science documentary special Radio Lab is always a singular pleasure.
And Subterranean Press was kind enough to produce a free audio book of Charlie Stross’ Trunk and Disorderly, a humorous adventure in a style that defies description (the closest anyone’s come is “Heinlein meets Wodehouse in space with a woolly mammoth”).

I’ll be back next week with some thoughts on replacing floating-point conditionals with branchless math.

A really specific Facebook phishing virus?

Elan — Sun, 27 Jul 2008 10:33:15 +0000

I just received a message through Facebook that points at how malware authors can be really, really specific with their attack vectors, and how they exploit social networks to make their messages appear to come from a legitimate, trusted source.

We’ve all received links to malware websites in email, of course, and usually we can reject them out of hand because the sender is obviously fake. If the sender’s name is someone you actually know and trust, you’re more likely to open the email, but knowing how easily email headers can be forged you might still be a little suspicious. But Facebook messages require someone to have logged in and authenticated — if I get a message from my friend Tim, it means that Tim has actually gone to facebook.com and opened up his little message thingy and typed something out to me.

Or, at least, Tim’s browser has.

I got this Wall post on Facebook earlier today from an old friend I’ve had in my list since forever.

At first I was a little confused, because I couldn’t see how a phisher could forge a Facebook message, but it was still suspicious enough that I accessed the linked website with kid gloves — and indeed, it’s a webpage that hosts the Javascript malware enclosed below the jump (posted as an image for your safety). I didn’t bother to decode exactly what it does, but it clearly decrypts some kind of encrypted exploit into the browser and executes it.

There’s a couple of interesting things about this: first, the incredible specificity of this virus to maximize the chances that it would appear to come to me from a trusted source. Unless the virus author has hacked into Facebook’s back end, the only way this could work is if the virus snagged my friend Tim’s Facebook password, then logged into his account on its own, accessed his friends list, then mechanically transmitted that message to all those friends. This is a lot of specific code to write, stuff that reads out of Facebook’s HTML and knows how to find the friends list there, and then and knows how to navigate the website to send out messages. It’s a lot of work to take advantage of one social networking site, which goes to show how valuable it is to take advantage of our own assumptions of trust in our friends (or how little virus writers value their time).

Second: even though the actual malware is hosted on the Google-owned Blogspot service, Google’s own malware-detecting tools don’t list it as malicious. In fact, when I tested the site with Google Safe Browsing, it told me “This site is not listed as suspicious” and “Google has not visited this site within the past 90 days”, which is to say that Google can’t even patrol its own webhosting service for exploits. Maybe that explains why Google hosts 2% of the world’s malware.

Here’s the source code for the exploiting Blogspot page that the URL goes to, in case you feel like figuring out what it does. I’m posting it as an image to prevent any chance of that Javascript from actually being parsed on your browser.