Bdtjtk

I was curious about how switch jumps perform relative to function calls so I whipped out a quick benchmark:

#!/bin/bash -eu

cat > get.c <<EOF

#include <stdint.h>

int get(int (Getter)(void))

{

    uintptr_t getter=(uintptr_t)Getter; 

    if(1){

        switch(getter){

        case 0: return $RANDOM;

        case 1: return $RANDOM;

        case 2: return $RANDOM;

        case 3: return $RANDOM;

        case 4: return $RANDOM;

        case 5: return $RANDOM;

        default: return Getter();

        }

    }else{

        if(0==getter) return $RANDOM;

        else if(1==getter) return $RANDOM;

        else if(2==getter) return $RANDOM;

        else if(3==getter) return $RANDOM;

        else if(4==getter) return $RANDOM;

        else if(5==getter) return $RANDOM;

        else return Getter();

    }

}

EOF

cat > main.c <<EOF

int get(int (Getter)(void));

int Getter(void){ return 42; }

int main(int C, char**V)

{

    if(C==1)

        for(int i=0; i<1000000000;i++)

            get((int(*)(void))4);

    else

        for(int i=0; i<1000000000;i++)

            get(Getter);



}

EOF

: ${CC:=gcc}

arg='-Os -fpic'

for c in *.c; do $CC $arg -c $c; done

$CC get.o -o libget.so -shared

$CC main.o $PWD/libget.so -o dso

$CC main.o get.o -o dso -o static

set -x

time ./dso

time ./dso 1

time ./static

time ./static 1

The timings (relatively stable) are:

+ ./dso



real    0m3.778s

user    0m3.709s

sys 0m0.056s

+ ./dso 1



real    0m3.739s

user    0m3.736s

sys 0m0.000s

+ ./static



real    0m2.478s

user    0m2.477s

sys 0m0.000s

+ ./static 1



real    0m3.425s

user    0m3.411s

sys 0m0.000s

Why do switch jumps perform quite a bit better but only when the function is linked statically?

Disassembly diff (sdiff-generated) of the dynamic and static version respectively:

000000000000111a <get>:                       | 0000000000001180 <get>:

    cmp    $0xc,%rdi                        cmp    $0xc,%rdi

    ja     1178 <get+0x5e>                    |     ja     11de <get+0x5e>

    lea    0xed9(%rip),%rdx        # 2000 <_fini+0xe80>   |     lea    0xe77(%rip),%rdx        # 2004 <_IO_stdin_used

    movslq (%rdx,%rdi,4),%rax                   movslq (%rdx,%rdi,4),%rax

    add    %rdx,%rax                        add    %rdx,%rax

    jmpq   *%rax                            jmpq   *%rax

    mov    $0x132b,%eax                     mov    $0x132b,%eax

    retq                                retq   

    mov    $0x2740,%eax                     mov    $0x2740,%eax

    retq                                retq   

    mov    $0x79b6,%eax                     mov    $0x79b6,%eax

    retq                                retq   

    mov    $0x5234,%eax                     mov    $0x5234,%eax

    retq                                retq   

    mov    $0x6389,%eax                     mov    $0x6389,%eax

    retq                                retq   

    mov    $0x37de,%eax                     mov    $0x37de,%eax

    retq                                retq   

    mov    $0x6a22,%eax                     mov    $0x6a22,%eax

    retq                                retq   

    mov    $0x1a35,%eax                     mov    $0x1a35,%eax

    retq                                retq   

    mov    $0x2ce8,%eax                     mov    $0x2ce8,%eax

    retq                                retq   

    mov    $0x4fed,%eax                     mov    $0x4fed,%eax

    retq                                retq   

    mov    $0xfe3,%eax                      mov    $0xfe3,%eax

    retq                                retq   

    mov    $0x4229,%eax                     mov    $0x4229,%eax

    retq                                retq   

    jmpq   *%rdi                            jmpq   *%rdi

    mov    $0x529e,%eax                     mov    $0x529e,%eax

    retq                                retq   

                                  <

The calls can't inline (because you put the definition in a separate file and didn't use link-time optimization).

I think you're measuring the extra overhead of calling through the PLT when calling a function in a shared library, traditional Unix style, which gcc does by default. Use -fno-plt to emit memory-indirect call instructions that use the GOT entry directly, instead of calling a memory-indirect jmp. See Sorry state of dynamic libraries on Linux for more about PLT overhead, or disassemble it yourself. (TODO: add disassembly to this answer.)

I expect -fno-plt will make both versions run almost exactly the same.

The asm for both versions of "get" is identical, modulo different random numbers and different addresses. They presumably perform the same, both slow because gcc misses the optimization of turning the switch into a table lookup. See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85585 for that and related stuff. (BTW, gcc compresses the table into offsets instead of using a classic jump table of raw pointers because it's trying to avoid absolute addresses everywhere, even as data. Some targets don't support fixups even for that, and gcc currently avoids them even on targets like x86-64/Linux where it would be fine with runtime fixups. But of course it's silly to do an indirect branch instead of just looking up the data in a table in this case.)

Also related: 32-bit absolute addresses no longer allowed in x86-64 Linux? talks some about the cost of -fpie and -fpic. In this case there's nothing to save by omitting -fpic and/or using -fno-pie -no-pie, because separate files are also keeping the function from inlining, not just possible symbol-interposition / ELF symbol visibility.