Instruction latency analysis usually focuses on performanceoptimization—making code run as fast as possible. TheAssembly Hall of Shametakes the opposite approach: searching for the absolute floor of
single-instruction performance.
Strategy: Usefxrstor64to load 512-byte FPU/MMX/XMM state from a
high-latency MMIO region in the PCIe fabric, then starve the fabric while the
load is in flight — a fleet of hammer cores pounds a different high-latency
MMIO register with tight 4-byte reads, saturating the PCIe root complex and
endpoint with non-posted transactions, so CPU 0’s 512-bytefxrstor64must
queue behind all that contending traffic.
A spec-violatingunaligned ymm0 loadthat forced
non-posted dword transactions from stalled GPU registers was used to break the
fundamental design of System Management Mode insmiiiiiiiiiiiiiiii.
Strategy:nopdoes nothing. It opens the leaderboard accordingly.
Contender: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz
Strategy: Regularnopwas too short, but how do we make nothing take
longer? Try alonnnnnng nop.
Contender: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz
Strategy: Just a reference instruction to get our bearings.
Contender: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz
Strategy: Use 128-bit dividend (rdx:rax=2:0) with small divisor to push the
quotient above the ceiling imposed by sign-extension, driving the longest path
through the divider microcode.
Contender: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz
Strategy: Use maximum nesting depth (31) to force 30 display-pointer loads
and pushes through the microcode display-walk path.
Contender: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz
Strategy: Try a small denormal to trigger an FP microcode assist.
Contender: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz
Strategy: Just ensure the cache line is dirty.
Contender: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz
Strategy: Use exponent 0x7ff to reach ‘special value’ processing in
microcode; positive/negative, NaN/inf doesn’t seem to make a difference, go with
QNaN.
Contender: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz
Strategy: Saturate all write-combining line-fill buffers withmovntistores to distinct cache lines, forcingmfenceto drain the full LFB write
path to the uncore before retiring.
Contender: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz
Strategy: Nothing for now, just check how long it takes to invalidate the
TLB.
Contender: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)
Strategy: Hit x87 FP microcode assist path by using denormal source operand.
Contender: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz
Strategy: Alignlock-prefixed operand to straddle cache-line
boundary, forcing CPU to assert the external bus lock rather than using the fast
MESI cache-coherence path.
Contender: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz
Strategy: Use subnormal divisor, hardware hands control to microcode
assist, assist normalizes operand, performs the division, then restores
architectural state.
Contender: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz
Strategy: Userakefieldto find
the highest latency CPUID leaves.
Contender: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz
Strategy: Execute in a tight loop to deplete the hardware entropy pool faster than it can be refilled, forcing subsequent calls to stall while the entropy source recovers.
Contender: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz
Strategy: Useproject:nightshyftto identify high latency MSRs. MCG_CTL on Zen look like a winner: may be a
microcode quiesce and synchronize on MCA error banks across hardware units, some
potentially off-die, requiring fabric-level communication rather than a simple
local register write.
Contender: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)
Strategy: Target an I/O port that straddles a NIC device register boundary,
triggering the device to quiesce its TX DMA engine on each write.
Contender: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)
Strategy: Useproject:nightshyftto identify high latency model-specific-registers: VIA uses an undocumented
register at 0x133 that gives wildly high response time. No idea what it does.
Contender: VIA Eden Processor 800MHz
Strategy: Fully load L1/L2/L3 caches with dirty lines to force DRAM
writeback of entire hierarchy.
Contender: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)
Strategy: Target I/O port mapped to an ACPI PM block where an unaligned
4-byte read decodes into multiple non-posted loads from wherever this port goes.
Contender: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)
Strategy: Usemmioticto identify
high-latency deadspace in PCIe fabric, hit unkown GPU register.
Contender: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)
Strategy: Search MMIO space for slowest registers in PCIe fabric, hit
unknown GPU register, use 8-byte MMIO read to get two dword register accesses,
which isn’t technically allowed but works anyway.
Contender: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)
Strategy: Search MMIO space for slowest registers in PCIe fabric, hit
unknown GPU register, use 16-byte MMIO read to get four dword register accesses,
which isn’t technically allowed but works anyway.
Contender: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)
Strategy: Search MMIO space for slowest registers in PCIe fabric, hit
unknown GPU register, use 32-byte MMIO read to get eight dword register
accesses, whichstillisn’t technically allowed but works anyway.
Contender: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)
Strategy: Search MMIO space for slowest registers in PCIe fabric, hit
unknown GPU register, use 32-byteunalignedMMIO read to get nine dword
register accesses, which is evenlessallowed than the aligned version, but
works anyway.
Contender: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)
Strategy: Usemmioticto identify
high-latency deadspace in PCIe fabric, isolate region near 0’s and offset state
to avoid MXCSR corruption (possibly VGA buffer?), use fxrstor64 to load 512-byte
FPU/MMX/XMM state from MMIO, forcing CPU to process 512 bytes of I/O
transactions through slowest available memory aperture.
Strategy: Extendfxrstor64 (baseline)by starving the fabric while the
load is in flight — a fleet of hammer cores pounds a different high-latency
MMIO register with tight 4-byte reads, saturating the PCIe root complex and
endpoint with non-posted transactions, so CPU 0’s 512-byte fxrstor64 must queue
behind all that contending traffic.
Contender: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)
Strategy: Leverage extended AVX state in Sapphire Rapids with MMIO approach
from fxrstor64:xsavestate area is 8KB vs 512 bytes, 16x size ->
1,000,000,000,000 cycles
The assembly hall-of-shame is a research effort from Christopher Domas (@xoreaxeaxeax).
Racing to the bottom of CPU performance