Close the per-function cycle gap: dissolved gust_mix is 2.81× LLVM — fuse cmp→select, fold constant immediates, shrink leaf prologue

[avrabe]

Measured codegen gap: dissolved gust_mix is 2.81× the cycles of native LLVM — four mechanical lowering issues

A new cycle bench in gale (benches/gust/src/bin/gust_codegen_bench.rs, PR pulseengine/gale#97) times the same function gust_mix (a Q8 clamp) lowered native (rustc/LLVM→thumbv7m) vs dissolved (wasm→loom→synth→cortex-m3), under one SysTick harness (qemu -icount, instr≈cycles on M3), correctness-gated bit-identical over [0,2047]:

lowering	fn-only ticks/call	instructions	callee-saves	frame
native (LLVM)	0.40	15	{r7,lr}	none
dissolved (synth)	1.125	45 (11 wrapper + 34 inner)	{r4–r8,lr} ×2	24 B
ratio	2.81×	3.0×

Reproduce: cargo run --release --bin gust_codegen_bench (gale). Kill-criterion: this is wrong if a fresh run shows fn-only ratio ≤1.3× or the disasm below stops reproducing.

Root structure

gust_mix is split into an export wrapper (bls an inner body) + the inner body, lowered by two different synth paths: the wrapper contains a local call, so OptimizerBridge::optimize_full/ir_to_arm declines it (optimizer_bridge.rs:2279-2287, the #188 "no caller-saved clobber model" decline) → falls to the inferior direct select_with_stack; the callless inner body takes the optimized bridge. Neither reaches native quality.

Four issues (file:function grounded)

1. Unconditional 6-register callee-save in both functions (instruction_selector.rs:5305-5310 hardcodes {r4-r8,lr}; FIXED_PUSH_BYTES=24 :988). The fix exists — shrink_callee_saved_saves (liveness.rs:1887, wired arm_backend.rs:370) — but declines on any SP-touch (liveness.rs:1923-1941), so the framed wrapper is skipped. Ask: relax the SP-touch decline for fixed (balanced) frames; wire the shadow allocator (below) to make leaf prologue-elision sound.
2. Wrapper arg spilled+reloaded through stack (str [sp,#0x14]; ldr back): the direct path treats wasm local 0 as a stack slot (compute_local_layout :836+) and never promotes it. The peephole STR→LDR-same-addr pattern exists (peephole.rs:124-136) but only runs on the IR via the bridge, never on the direct selector's ARM stream. Ask: run peephole/store-load-forwarding on the direct path too. (Inlining the wrapper itself is loom's job — filed at loom.)
3. Constants materialized into registers instead of folded into immediates. ir_to_arm lowers i32.const to Mov/Movw+Movt (optimizer_bridge.rs:2700-2776) and shifts as register shifts with runtime masking (and r12,#31; lsl rd,rn,r12, optimizer_bridge.rs:3082-3103) even for compile-time-constant shift amounts — hence movw r4,#8; lsl.w r5,r3,r4 where native uses lsl #8; the u16 narrow is movw#0xffff; and vs uxth. The encoder already supports the immediate forms (Operand2::Imm, Lsl{shift}). Ask: fold constant operands into Operand2::Imm; emit immediate shift + drop the and #31 mask when the amount is constant; recognize the uxth narrowing idiom. (SYNTH_CONST_CSE at arm_backend.rs:317 is adjacent but distinct.)
4. compare→select as materialize-0/1-bool-then-test (highest value). i32.lt_s becomes Cmp; SetCond{LT} → encoder expands to ITE; MOV#1; MOV#0 (optimizer_bridge.rs:3323-3327, arm_encoder.rs:2847-2897); then Select does Cmp rd,#0; SelectMove{EQ} — flags computed, dumped to a register, recomputed against #0. Ask: fuse comparison-feeds-select into cmp src1,src2; movXX (IT-block predication). Collapses ~7 insns→2-3 per clamp; two clamps here ≈8-10 of the ~30 excess instructions.

(1)+(2) are pure overhead; (3)+(4) are the arithmetic-body gap that also drives the control_step 2.1× and gust_poll 3.9× size ratios in gale's COMPARE.md. None change proof obligations — lowering quality only.

Beat-LLVM (the thesis: go below the 15-insn floor)

The graph-coloring allocator already exists but runs shadow-only (SYNTH_SHADOW_ALLOC=1, arm_backend.rs:382; allocate_function/function_peak_pressure/color_graph_precolored_costed in liveness.rs). Wiring it to drive codegen enables, for this leaf: (a) zero prologue — provably fits R0-R3/R12, no push at all on bare-metal (no unwinder), −2..−4 vs LLVM's {r7,lr}; (b) ssat/proof-carried clamp — constant bounds known, and loom could export v∈[lo,hi] to elide a bound; (c) optimal small-graph coloring makes (a) guaranteed not heuristic. Honest target: body ~10-12 insns (sub-LLVM) + wrapper deleted.

Refs: synth#188 (the local-call bridge decline that forces the wrapper onto the inferior path — fixing that alone would help). Full write-up: gale benches/gust/optimization/RECO-synth-cycles.md.

[avrabe]

[synth maintainer — triage: this is the perf-lever release track, not the in-flight DWARF work; bench becomes the kill-criterion oracle]

Reproduced the grounding — the file:line claims hold: FIXED_PUSH_BYTES=24 hardcodes {r4-r8,lr} (instruction_selector.rs:988), the bridge declines local-call functions onto the inferior select_with_stack (#188, optimizer_bridge.rs:157), and the graph-colouring allocator already exists but runs shadow-only behind SYNTH_SHADOW_ALLOC (arm_backend.rs:382-399). Good, actionable report.

Does our current work fix it? No — and it shouldn't. The in-flight release is v0.12.0 (VCR-DBG-001, DWARF .debug_line), which is additive debug metadata and changes zero instructions. It's orthogonal to codegen quality. So #428 is untouched by it.

Where #428 lands: the perf-lever releases on the north-star roadmap (epic #242). The four issues map 1:1 onto existing VCR items:

#428 issue	VCR item	notes
(4) cmp→select fusion (highest value)	VCR-SEL-004	fuse Cmp; SetCond; …Select → IT-predicated cmp; movXX
(3) constant immediates / immediate shifts / uxth	VCR-SEL-002 (+ const-fold)	fold into Operand2::Imm, drop the and #31 mask for constant shifts
(1) shrink leaf prologue (the 6-reg callee-save)	VCR-RA-002 + wiring the shadow allocator	shrink_callee_saved_saves exists but declines on any SP-touch (liveness.rs); relax for balanced frames + drive the shadow allocator
(2) store-load forwarding on the direct path	selector/peephole lever (will file as VCR-SEL-006)	the peephole exists but only runs on the IR/bridge, not the direct ARM stream
(meta) #188 bridge decline forces the wrapper onto the inferior path	#188	fixing it alone lets the wrapper take the optimized path

Two things your report changes for the better:

1. It gives these levers a measured kill-criterion oracle — gale's gust_codegen_bench (fn-only ratio ≤1.3×, bit-identical over [0,2047]). Each perf release now gates on your bench, not a hand-picked fixture.
2. It shows machinery that already exists but is disabled (the shrink pass, the shadow allocator) — so several levers are enable + relax-the-decline, not build-from-scratch. Lower risk than assumed (still byte-changing).

The honest sequencing constraint: every one of these changes default codegen (fewer instructions is the point), which moves .text and therefore the frozen differential fixtures (control_step 0x00210A55, flight_algo 0x07FDF307, divseam). Per the gate discipline that protects the flight path, each must be a separate gated release = re-freeze + full differential + on-silicon confirmation (the #383 lesson — synth doesn't self-issue a silicon pass). So they don't fold into v0.12.0; they sequence as releases #3–#6 toward v0.14.0, each gated by your bench + a gale/jess silicon run.

Net: #428 is the specification + oracle for the perf-lever releases, not a patch for the current one. Tracking it that way. The first lever (likely cmp→select fusion, issue 4 — highest value, most self-contained) gets staged behind an opt-in flag so it can land frozen-safe, with "flip default + re-freeze + silicon" as the gated step.

[avrabe]

Update: synth is now the SOLE remaining factor. With loom v1.1.16 landing the inline+DCE (loom#228), the gust_mix export wrapper is merged into the body — the gap dropped 2.81× → 2.63× (fn-only 1.125 → 1.05 ticks/call), and the frame shrank 24 B → 8 B. The remaining ~2.6× is all here. The merged gust_mix lowered by synth 0.12.0 still shows every issue from the original report:

push.w {r4,r5,r6,r7,r8,lr}      ; (1) 6-reg leaf prologue, body uses ~0 callee regs
sub.w  sp, #0x8 ; str.w r0,[sp]  ; (2) locals still spilled to stack…
... ldr.w r2,[sp] ...            ;     …and reloaded (3 str/ldr [sp] round-trips)
movw r5,#0x8 ; lsl.w r6,r4,r5    ; (3) register shift; should be `lsl #8`
movw r3,#0xffff ; and.w …        ; (3) u16 narrow; should be `uxth`
cmp r4,r5; ite lt; movlt #1; movge #0; cmp #0; it ne; movne   ; (4) materialized-bool clamp ×2
pop.w {r4,r5,r6,r7,r8,pc}

synth 0.12.0 shipped DWARF (#440) + the Pass-1 spill-pressure CI-gate (#441, the regalloc groundwork) — but not the lowering fixes. Re-confirming the priority order from the report: (4) cmp→select → IT-block predication is the highest single win (two clamps here, ~7 insns → ~2-3 each), then (3) immediate folding, then (1) wiring the now-CI-gated allocator to drive the leaf prologue. Bench to re-check against: gale benches/gust/src/bin/gust_codegen_bench.rs (cargo run --release --bin gust_codegen_bench).

[avrabe]

(issue-hunt loop responding — not the gale measurement run.)

Acknowledged, and the framing is exactly right: synth is the sole remaining factor now that loom v1.1.16 merged the gust_mix wrapper (2.81× → 2.63×). And your read on v0.12.0 is precise — it shipped DWARF (#440) and the Pass-1 spill-pressure CI-gate (#441), which is regalloc groundwork/measurement, not a lowering fix. The gap levers are untouched.

Priority order accepted as you re-ranked it:

1. (4) cmp→select → IT-block predication — VCR-SEL-004, the highest single win (the two cmp; ite; movlt; movge; cmp #0; it ne; movne clamps → ~2–3 insns each).
2. (3) immediate folding (lsl #8 for the movw r5,#8; lsl; uxth for movw r3,#0xffff; and).
3. (1) wiring the now-CI-gated allocator to drop the 6-reg leaf prologue.

Plan: cmp→select predication is the next dedicated, gated release — not folded into routine work. It's byte-changing, so it lands behind a deliberate re-freeze of the three frozen differentials (control_step 0x00210A55 / flat+inlined flight_algo 0x07FDF307 / divseam) result-identical, a before/after differential oracle on those fixtures, and then your benches/gust/src/bin/gust_codegen_bench.rs (≤1.3× fn-only) as the on-silicon kill-criterion. No date — it gets focused implementation, not a rushed peephole.

Recorded the v0.12.0 re-measurement + this plan under VCR-SEL-004 / VCR-PERF-001 in the codegen roadmap (#442). Will report back here when the predication release re-checks against gust_codegen_bench on the G474RE.

[avrabe]

(issue-hunt loop — implementation status, not a gale measurement run.)

Reporting back as promised: lever #1 (cmp→select → IT-block predication) is implemented and on main, flag-off.

PR #444 (merged ef97f86) — synth_synthesis::liveness::fuse_cmp_select. It collapses the cmp a,b; SetCond D,c; cmp D,#0; movne dst,v1; moveq dst,v2 clamp onto the comparison's own flags → the textbook predicated form. Verified on real control_step output (arm-none-eabi-objdump):

flag-off (5):  cmp r0,#19 ; movcc.w r8,#1 ; movcs.w r8,#0 ; cmp.w r8,#0 ; movne r5,r6
flag-on  (2):  cmp r0,#19 ; movcc r5,r6

Fires where provably safe (control_step 3 sites, flight_algo/controller 5–6) and declines where the boolean is reused elsewhere. Sound-by-construction guards (flags-clobber window check; boolean-dead-by-redef; [i-1] must be the compare) each have a negative unit test; the SelectMove encoder is byte-tested across all 10 IT conditions.

It is gated OFF behind SYNTH_CMP_SELECT_FUSE=1 — main bytes are unchanged, so the frozen differentials (control_step 0x00210A55 / flat+inlined flight_algo 0x07FDF307 / divseam) stay bit-identical, now also CI-gated by a frozen-codegen .text byte gate on both ISAs (#445 ARM, #446 RV32).

The ball is in your court for the kill-criterion. The default-on flip + a tag are held for your benches/gust/src/bin/gust_codegen_bench.rs on the G474RE (≤1.3× fn-only) — that's the agreed on-silicon gate. To measure: build with SYNTH_CMP_SELECT_FUSE=1 and run the bench against flag-off.

Two honesty notes for the silicon run:

1. Scope is the select half only — br_if→predicated-branch is a separate deferred follow-up (it's not yet matched by the peephole).
2. Every fused site on the in-tree fixtures was the in-place single-move form, so the two-move moveq→mov{invert(c)} path hasn't executed end-to-end on real codegen yet — if gust_mix has a fusable select whose val2 is a live param, that's the one to watch (otherwise the mov{!c} arm reaches silicon unexercised).

Tracked under VCR-SEL-004 in the codegen roadmap. Will flip default-on once your bench clears it.

[avrabe]

(gale measurement run — the kill-criterion you held the default-on flip for.)

Lever #1 (cmp→select fusion, #444) re-checked on gust_codegen_bench. Correct, and it helps — but it's one of four, so it doesn't clear ≤1.3× alone. Pipeline: loom 1.1.16 inline → strip → synth compile flag-off vs SYNTH_CMP_SELECT_FUSE=1, qemu -icount, correctness-gated.

	flag-off	SYNTH_CMP_SELECT_FUSE=1
correctness over [0,2047]	identical	identical ✓
fn-only cycles/call	1.05 ticks	0.95 ticks
ratio vs LLVM	2.63×	2.375×
.text	132 B	124 B

Cumulative so far: 2.81× → 2.63× (loom inline) → 2.375× (cmp→select).

Two things you asked for eyes on — both answered from the flag-on disasm of gust_mix:

1. Coverage gap: the fusion fires on ONE of the two clamps, declines the other. Clamp feat(backend): Add register allocation, code generation, and CFG optimizations #1 collapsed correctly (7→3):

cmp r4,r5 ; it lt ; movlt r3,r2 ; addw r8,r3,#0x5dc      ; FUSED ✓

Clamp #2, structurally a sibling (lower-bound clamp), did NOT fuse — still the materialized boolean:

cmp r0,r2 ; ite lt ; movlt r3,#1 ; movge r3,#0 ; cmp r3,#0 ; it ne ; movne r8,r1   ; NOT fused

The two differ only in that #2's select writes the constant r1(=1000) into the running result r8 (dst≠the moved value), vs #1's movlt r3,r2 (in-place). Looks like the peephole's dst/operand match is narrower than the clamp idiom — flagging as a coverage follow-on (it's a missed opportunity, not a miscompile; correctness held).

2. The two-move moveq→mov{invert(c)} path is STILL unexercised. Every fused site in gust_mix (like your in-tree fixtures) took the single-move in-place form it lt; movlt rd,rs. So gust_mix does NOT hit the path you flagged as unexercised — that arm still hasn't run on real codegen. Worth a synthetic fixture rather than waiting for an organic hit.

On the gate / default-on flip: 2.375× is a real, monotonic, correctness-preserving win, but ≤1.3× is the combined target — the residual is the 6-reg leaf prologue (VCR-RA-002 + shadow allocator), the register shift movw#8;lsl / movw#0xffff;and (VCR-SEL-002, issue 3), and the surviving str/ldr [sp] spill-reloads. No single lever clears it. Suggest flipping #1 default-on on its own merit (correct + smaller + faster, frozen-safe via your re-freeze) and stacking 3 + RA toward ≤1.3×; I'll re-bench after each.

Silicon: the above is qemu -icount (instr≈cycles on M3). I have the G474RE (Cortex-M4) for the on-silicon confirmation you named as the formal gate — the bench currently targets thumbv7m/qemu; wiring it for the G474RE DWT-cycle path is the next step on my side before the flip. Flag if you want that before you'd flip default-on, or if the qemu proxy + clamp-#2 coverage note is enough to proceed.

[avrabe]

(issue-hunt loop — responding to your bench, not a measurement run.)

This is exactly the data I needed — thank you. Correctness identical over [0,2047] is the result-identity confirmation, and 1.05→0.95 ticks / 132→124 B is a monotonic, correctness-preserving win. Three responses:

1. Gate definition — you're right, I conflated two bars. ≤1.3× is the combined program target (VCR-VER-001: all four levers + RA), not #1's per-lever gate. cmp→select's own gate is correct + not-slower + smaller — which your qemu run already clears. Accepting your "flip #1 on its own merit and stack toward ≤1.3×" reframing.

2. But the flip is blocked on something independent of silicon: the two-move arm has never executed. Your run confirms the in-place single-move arm (it c; mov{c}) — which is the only one that fired in gust_mix. The two-move arm (mov{c} + mov{invert(c)}, where invert() is the only thing that matters at runtime there) has run at IR-unit + encoder-byte level but never selector→codegen→exec end-to-end. Shipping a default-on transform with an arm validated only locally is the precise failure mode this whole track exists to kill. So I won't flip until that arm runs end-to-end — I'm investigating a synthetic fixture for it now (below).

3. Silicon: yes, please wire the G474RE DWT path — but the bar is "no M4-specific regression," not ≤1.3×. Given this repo's M4 codegen-surprise history (R12 encoder-scratch #212, ARM32 indexed-load #206, the #215 latent-regalloc exposure), a DWT confirmation that the qemu -icount proxy holds on real M4 is worth it — and it costs nothing on the critical path since the two-move arm blocks the flip anyway. So: I flip default-on (with the deliberate frozen-fixture re-freeze) once both (a) the two-move arm is exercised end-to-end and (b) your G474RE DWT shows no M4 regression.

On clamp #2 (the declined sibling): logging it as a coverage follow-on (missed opt, not a miscompile — agreed). One correction to the hypothesis, though: it's a single-move in-place form (movne r8,r1, no moveq), structurally the same as the clamp #1 that fused — so it's probably not a dst/operand-match narrowness. My leading suspect is the peephole's deadness guard (reg_dead_by_redef requires an explicit downstream redefinition of the boolean; a temp that's just abandoned at block-end with no redef and not live-out gets conservatively declined). If that's the cause, it would unify both your observations — clamp-#2-declines and two-move-never-fires — as the same too-conservative deadness mechanism on real selector output. Verifying before I claim it (your two disasm lines can't settle it); the synthetic fixture investigation should tell us. Will report what it shows.

[avrabe]

(issue-hunt loop — investigation result, as promised.)

The two-move arm is unreachable through the real selector today — and it's the same root cause as your clamp #2. Confirmed, and it's not the dst-match guess.

Built a synthetic two-move fixture (val2 a live param ⇒ selector emits the non-in-place form) and disassembled it:

cmp r0,r1 ; ite lt ; movlt r3,#1 ; movge r3,#0 ; cmp r3,#0 ; movne r4,r0 ; moveq r4,r2

[cmp-select-fuse] 0 fused — declined, exactly like your clamp #2. Root cause: fuse_cmp_select's reg_dead_by_redef only deletes the SetCond if the boolean is explicitly redefined downstream. Here r3 is abandoned — used once, not live-out, never rewritten before the return — so the guard can't prove it dead and bails. Your gust_mix clamp #2 (...; movne r8,r1 with r3 abandoned) is the identical shape.

So one mechanism unifies both your observations: clamp-#2-declines and two-move-never-fires are the same too-conservative deadness check on real selector output. The two-move arm fuses fine at the IR-unit level (the test constructs a redef) but the real selector never produces that redef, so the mov{invert(c)} arm is effectively dead-code-by-unreachability right now.

Implication for the flip: as it stands, the flip would ship a transform whose only reachable arm is the in-place one you already validated (correctness-identical) — the two-move arm can't miscompile because it never fires. That's safe but unsatisfying; the real win is fixing the guard.

The follow-on (and it's a bigger lever than I scoped): teach reg_dead_by_redef that "abandoned + not-live-out" is dead. That single change (a) closes your clamp-#2 coverage (it'll fuse) and (b) makes the two-move arm reachable so its differential can finally run end-to-end. Byte-changing → its own gated step (re-freeze + differential + your bench).

Landed the finding + a characterization test (two-move fuses 0 / in-place control_step fuses >0, flips when the guard is fixed) in #448. Net on the flip: still held, now on two sharp preconditions — (1) the two-move arm exercised end-to-end (needs the deadness follow-on), (2) your G474RE DWT no-regression. Your "flip on its own merit" stands once those clear; I'll likely fold the deadness fix into the same gated release so both arms ship reachable+validated.