[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-94448":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":9,"language":10,"languages":9,"totalLinesOfCode":9,"stars":11,"forks":12,"watchers":13,"openIssues":14,"contributorsCount":15,"subscribersCount":15,"size":15,"stars1d":15,"stars7d":15,"stars30d":16,"stars90d":15,"forks30d":15,"starsTrendScore":15,"compositeScore":17,"rankGlobal":9,"rankLanguage":9,"license":18,"archived":19,"fork":19,"defaultBranch":20,"hasWiki":19,"hasPages":19,"topics":21,"createdAt":9,"pushedAt":9,"updatedAt":22,"readmeContent":23,"aiSummary":24,"trendingCount":15,"starSnapshotCount":15,"syncStatus":14,"lastSyncTime":25,"discoverSource":26},94448,"asm-hall-of-shame","xoreaxeaxeax\u002Fasm-hall-of-shame","xoreaxeaxeax","Racing to the bottom of CPU performance",null,"C",782,11,4,2,0,385,57.24,"MIT License",false,"main",[],"2026-08-24 04:01:22","# Assembly Hall of Shame\n\n![x86 Leaderboard](artifacts\u002Fx86_graph.png)\n\n## Overview\n\nInstruction latency analysis usually focuses on performance\n*optimization*—making code run as fast as possible.  The `Assembly Hall of\nShame` takes the opposite approach: searching for the absolute floor of\nsingle-instruction performance.\n\n## :trophy: Current Champions :trophy:\n\n### **x86**: [fxrstor64](#1-trophy-fxrstor64-trophy)\n\n**Strategy**: Use `fxrstor64` to load 512-byte FPU\u002FMMX\u002FXMM state from a\nhigh-latency MMIO region in the PCIe fabric, then starve the fabric while the\nload is in flight — a fleet of hammer cores pounds a different high-latency\nMMIO register with tight 4-byte reads, saturating the PCIe root complex and\nendpoint with non-posted transactions, so CPU 0's 512-byte `fxrstor64` must\nqueue behind all that contending traffic.\n\n**Contender**: AMD Ryzen 7 5800H\n\n```asm\n; CPU 0 — timed instruction\nmovl $0xfcc68830, %rsi\nfxrstor64 %rsi\n\n; CPUs 1..N — hammer loop against a different high-latency location\nmovl 0xfcc68858, %eax\n```\n\n:trophy: **Score**: 198,002,498,236 cycles\n\n:trophy: **Time**: 62 seconds\n\n## Honorable Mentions\n\nA spec-violating [unaligned ymm0 load](#3-vmovdqu-ymm-unaligned--) that forced\nnon-posted dword transactions from stalled GPU registers was used to break the\nfundamental design of System Management Mode in\n[smiiiiiiiiiiiiiiii](https:\u002F\u002Fgithub.com\u002Fxoreaxeaxeax\u002Fsmiiiiiiiiiiiiiiii).\n\n```asm\nvmovdqu 0xfcc003b1, %ymm0\n```\n\n## Rules\n\n* Instructions may use whatever setup is necessary, but only a single\n  instruction is eligible to be scored.\n* Trapped\u002Femulated\u002Fvirtualized instructions may only time the trap, not the\n  handler.\n* Instructions must not be interruptible.  `rep movs`, `pause`, etc. are\n  disqualified.\n* Times are normalized based on the CPU base clock frequency.\n* All platforms must be in their factory stock configurations - no hardware\n  modifications.\n\n## x86 Leaderboard\n\n### 27. [nop](nop\u002F)\n\n**Strategy**: `nop` does nothing. It opens the leaderboard accordingly.\n\n**Contender**: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz\n\n```\nnop\n```\n\n**Score**: 1 cycles\n\n**Time**: 0 nanoseconds\n\n### 26. [nop16](nop16\u002F)\n\n**Strategy**: Regular `nop` was too short, but how do we make nothing take\nlonger? Try a `lonnnnnng nop`.\n\n**Contender**: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz\n\n```\ndata16 data16 data16 data16 data16 data16 data16 nopl 0x00000000(%%eax,%%eax,1)\n```\n\n**Score**: 20 cycles\n\n**Time**: 7 nanoseconds\n\n### 25. [rdtsc](rdtsc\u002F)\n\n**Strategy**: Just a reference instruction to get our bearings.\n\n**Contender**: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz\n\n```asm\nrdtsc\n```\n\n**Score**: 49 cycles\n\n**Time**: 18 nanoseconds\n\n### 24. [idiv](idiv\u002F)\n\n**Strategy**: Use 128-bit dividend (rdx:rax=2:0) with small divisor to push the\nquotient above the ceiling imposed by sign-extension, driving the longest path\nthrough the divider microcode.\n\n**Contender**: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz\n\n```asm\nxorq %rax, %rax   ; rax = 0  (low 64 bits of dividend)\nmovq $2, %rdx     ; rdx = 2  (high 64 bits: full dividend = 2^65)\nmovq $5, %rbx     ; divisor → quotient = 2^65\u002F5 ≈ 7.4×10^18\nidivq %rbx\n```\n\n**Score**: 77 cycles\n\n**Time**: 28 nanoseconds\n\n### 23. [enter](enter\u002F)\n\n**Strategy**: Use maximum nesting depth (31) to force 30 display-pointer loads\nand pushes through the microcode display-walk path.\n\n**Contender**: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz\n\n```asm\nenter $0, $31       ; 0 bytes allocated, nesting depth 31 (maximum)\n```\n\n**Score**: 112 cycles\n\n**Time**: 41 nanoseconds\n\n### 22. [fldl](fldl\u002F)\n\n**Strategy**: Try a small denormal to trigger an FP microcode assist.\n\n**Contender**: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz\n\n```asm\n    movabsq $0x0000000000000001, %rax\n    movq    %rax, -8(%rsp)\n    fldl    -8(%rsp)\n```\n\n**Score**: 133 cycles\n\n**Time**: 49 nanoseconds\n\n### 21. [clflush](clflush\u002F)\n\n**Strategy**: Just ensure the cache line is dirty.\n\n**Contender**: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz\n\n```asm\nclflush (%rax)          ; rax -> dirty cache line resident in L3\n```\n\n**Score**: 165 cycles\n\n**Time**: 60 nanoseconds\n\n### 20. [fsin](fsin\u002F)\n\n**Strategy**: Use exponent 0x7ff to reach 'special value' processing in\nmicrocode; positive\u002Fnegative, NaN\u002Finf doesn't seem to make a difference, go with\nQNaN.\n\n**Contender**: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz\n\n```asm\n    movabsq $0x7fffffffffffffff, %rax\n    movq    %rax, -8(%rsp)\n    fldl    -8(%rsp)\n    fsin\n```\n\n**Score**: 257 cycles\n\n**Time**: 94 nanoseconds\n\n### 19. [mfence](mfence\u002F)\n\n**Strategy**: Saturate all write-combining line-fill buffers with `movnti`\nstores to distinct cache lines, forcing `mfence` to drain the full LFB write\npath to the uncore before retiring.\n\n**Contender**: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz\n\n```asm\nmovnti %r9,  0*64(%rdi)   ; ×16 distinct cache lines — saturate the write-combining LFBs\n; …\nmovnti %r9, 15*64(%rdi)\nmfence                     ; must drain all pending LFB writes before retiring\n```\n\n**Score**: 326 cycles\n\n**Time**: 120 nanoseconds\n\n### 18. [mov cr3](mov_cr3\u002F)\n\n**Strategy**: Nothing for now, just check how long it takes to invalidate the\nTLB.\n\n**Contender**: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)\n\n```asm\nmov %rax, %cr3\n```\n\n**Score**: 352 cycles\n\n**Time**: 110 nanoseconds\n\n### 17. [fadd](denormal\u002F)\n\n**Strategy**: Hit x87 FP microcode assist path by using denormal source operand.\n\n**Contender**: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz\n\n```asm\nfldl   subnorm    ; 1e-310: value \u003C DBL_MIN, biased exponent = 0\nfaddl  subnorm    ; source is subnormal → FP microcode assist\n```\n\n**Score**: 677 cycles\n\n**Time**: 249 nanoseconds\n\n### 16. [split lock](split_lock\u002F)\n\n**Strategy**: Align `lock`-prefixed operand to straddle cache-line\nboundary, forcing CPU to assert the external bus lock rather than using the fast\nMESI cache-coherence path.\n\n**Contender**: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz\n\n```asm\n; split_ptr % 64 == 63 — dword spans bytes 63 (line N) and 64–66 (line N+1)\nlock xaddl %r9d, (%rdi)\n```\n\n**Score**: 865 cycles\n\n**Time**: 319 nanoseconds\n\n### 15. [fdiv](fdiv\u002F) -\n\n**Strategy**: Use subnormal divisor, hardware hands control to microcode\nassist, assist normalizes operand, performs the division, then restores\narchitectural state.\n\n**Contender**: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz\n\n```asm\n    movabsq $0x3ff0000000000000, %rax   ; 1.0 (normal dividend)\n    movq    %rax, -8(%rsp)\n    fldl    -8(%rsp)                     ; ST(0) = 1.0\n\n    movabsq $0x0000002000000000, %rax   ; 6.79e-313 (subnormal divisor)\n    movq    %rax, -8(%rsp)\n    fdivl   -8(%rsp)                     ; ST(0) = 1.0 \u002F subnormal → FP assist\n```\n\n**Score**: 883 cycles\n\n**Time**: 325 nanoseconds\n\n### 14. [cpuid](cpuid\u002F)\n\n**Strategy**: Use [rakefield](https:\u002F\u002Fgithub.com\u002Fxoreaxeaxeax\u002Frakefield) to find\nthe highest latency CPUID leaves.\n\n**Contender**: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz\n\n```\nmovl $6, %eax\ncpuid\n```\n\n**Score**: 1248 cycles\n\n**Time**: 460 nanoseconds\n\n### 13. [rdrand](rdrand\u002F)\n\n**Strategy**: Execute in a tight loop to deplete the hardware entropy pool faster than it can be refilled, forcing subsequent calls to stall while the entropy source recovers.\n\n**Contender**: Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz\n\n```asm\nrdrand %rax\n```\n\n**Score**: 5,579 cycles\n\n**Time**: 2.057 microseconds\n\n### 12. [wrmsr](wrmsr\u002F)\n\n**Strategy**: Use [project:nightshyft](https:\u002F\u002Fgithub.com\u002Fxoreaxeaxeax\u002Fnightshyft)\nto identify high latency MSRs.  MCG_CTL on Zen look like a winner: may be a\nmicrocode quiesce and synchronize on MCA error banks across hardware units, some\npotentially off-die, requiring fabric-level communication rather than a simple\nlocal register write.\n\n**Contender**: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)\n\n```asm\nmovl $0x17b, %ecx       ; MCG_CTL\nwrmsr\n```\n\n**Score**: 34,304 cycles\n\n**Time**: 10.742 microseconds\n\n### 11. [out](out\u002F)\n\n**Strategy**: Target an I\u002FO port that straddles a NIC device register boundary,\ntriggering the device to quiesce its TX DMA engine on each write.\n\n**Contender**: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)\n\n```asm\nmov $0xf019, %dx\noutl %eax, %dx\n```\n\n**Score**: 49,857 cycles\n\n**Time**: 15.580 microseconds\n\n### 10. [rdmsr](rdmsr\u002F)\n\n**Strategy**: Use [project:nightshyft](https:\u002F\u002Fgithub.com\u002Fxoreaxeaxeax\u002Fnightshyft)\nto identify high latency model-specific-registers: VIA uses an undocumented\nregister at 0x133 that gives wildly high response time.  No idea what it does.\n\n**Contender**: VIA Eden Processor 800MHz\n\n```asm\nmovl $0x133, %ecx ; undocumented MSR\nrdmsr\n```\n\n**Score**: 161,602 cycles\n\n**Time**: 202.004 microseconds\n\n### 9. [wbinvd](wbinvd\u002F)\n\n**Strategy**: Fully load L1\u002FL2\u002FL3 caches with dirty lines to force DRAM\nwriteback of entire hierarchy.\n\n**Contender**: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)\n\n```asm\nwbinvd\n```\n\n**Score**: 1,616,480 cycles\n\n**Time**: 506.165 microseconds\n\n### 8. [in](in\u002F)\n\n**Strategy**: Target I\u002FO port mapped to an ACPI PM block where an unaligned\n4-byte read decodes into multiple non-posted loads from wherever this port goes.\n\n**Contender**: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)\n\n```asm\nmov $0x0413, %dx\ninl %dx, %eax\n```\n\n**Score**: 12,524,415 cycles\n\n**Time**: 3.921769 milliseconds\n\n### 7. [mov](mov\u002F)\n\n**Strategy**: Use [mmiotic](https:\u002F\u002Fgithub.com\u002Fxoreaxeaxeax\u002Fmmiotic) to identify\nhigh-latency deadspace in PCIe fabric, hit unkown GPU register.\n\n**Contender**: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)\n\n```asm\nmovl 0xfcc003b0, %esi\n```\n\n**Score**: 443,937,696 cycles\n\n**Time**: 139.010268 milliseconds\n\n### 6. [mov rax](mov_rax\u002F) -\n\n**Strategy**: Search MMIO space for slowest registers in PCIe fabric, hit\nunknown GPU register, use 8-byte MMIO read to get two dword register accesses,\nwhich isn't technically allowed but works anyway.\n\n**Contender**: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)\n\n```asm\nmovq 0xfcc003b0, %rax\n```\n\n**Score**: 887,716,864 cycles\n\n**Time**: 277.971228 milliseconds\n\n### 5. [vmovdqu xmm](vmovdqu_xmm\u002F) -\n\n**Strategy**: Search MMIO space for slowest registers in PCIe fabric, hit\nunknown GPU register, use 16-byte MMIO read to get four dword register accesses,\nwhich isn't technically allowed but works anyway.\n\n**Contender**: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)\n\n```asm\nvmovdqu 0xfcc003b0, %xmm0\n```\n\n**Score**: 1,774,555,776 cycles\n\n**Time**: 555.664133 milliseconds\n\n### 4. [vmovdqu ymm](vmovdqu_ymm\u002F) -\n\n**Strategy**: Search MMIO space for slowest registers in PCIe fabric, hit\nunknown GPU register, use 32-byte MMIO read to get eight dword register\naccesses, which *still* isn't technically allowed but works anyway.\n\n**Contender**: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)\n\n```asm\nvmovdqu 0xfcc003b0, %ymm0\n```\n\n**Score**: 3,549,079,296 cycles\n\n**Time**: 1.111345034 s\n\n### 3. [vmovdqu ymm (unaligned)](vmovdqu_ymm_unaligned\u002F) -\n\n**Strategy**: Search MMIO space for slowest registers in PCIe fabric, hit\nunknown GPU register, use 32-byte *unaligned* MMIO read to get nine dword\nregister accesses, which is even *less* allowed than the aligned version, but\nworks anyway.\n\n**Contender**: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)\n\n```asm\nvmovdqu 0xfcc003b1, %ymm0\n```\n\n**Score**: 4,453,212,256 cycles\n\n**Time**: 1.394428818 seconds\n\n### 2. [fxrstor64 (baseline)](fxrstor64\u002F) -\n\n**Strategy**: Use [mmiotic](https:\u002F\u002Fgithub.com\u002Fxoreaxeaxeax\u002Fmmiotic) to identify\nhigh-latency deadspace in PCIe fabric, isolate region near 0's and offset state\nto avoid MXCSR corruption (possibly VGA buffer?), use fxrstor64 to load 512-byte\nFPU\u002FMMX\u002FXMM state from MMIO, forcing CPU to process 512 bytes of I\u002FO\ntransactions through slowest available memory aperture.\n\n**Contender**: AMD Ryzen 7 5800H\n\n```asm\nmovl $0xfcc68830, %rsi\nfxrstor64 %rsi\n```\n\n**Score**: 74,584,168,512 cycles\n\n**Time**: 23.354502677 seconds\n\n### 1. :trophy: [fxrstor64](lock_hammer_fxrstor64\u002F) :trophy:\n\n**Strategy**: Extend [fxrstor64 (baseline)](#2-fxrstor64-baseline) by starving the fabric while the\nload is in flight — a fleet of hammer cores pounds a different high-latency\nMMIO register with tight 4-byte reads, saturating the PCIe root complex and\nendpoint with non-posted transactions, so CPU 0's 512-byte fxrstor64 must queue\nbehind all that contending traffic.\n\n**Contender**: AMD Ryzen 7 5800H with Radeon Graphics (Trigkey S5)\n\n```asm\n; CPU 0 — timed instruction\nmovl $0xfcc68830, %rsi\nfxrstor64 %rsi\n\n; CPUs 1..N — hammer loop against a different high-latency location\nmovl 0xfcc68858, %eax\n```\n\n:trophy: **Score**: 198,002,498,236 cycles\n\n:trophy: **Time**: 62 seconds\n\n### ??. xrstor64 (AMX, MMIO) :finnadie:\n\n**Strategy**: Leverage extended AVX state in Sapphire Rapids with MMIO approach\nfrom fxrstor64: `xsave` state area is 8KB vs 512 bytes, 16x size ->\n1,000,000,000,000 cycles\n\n**Contender**: TODO\n\n```asm\n; XCR0 must enable AMX components (bits 17-18); state area ~8KB\nxrstor64 (%rsi)         ; rsi -> MMIO region, same technique as fxrstor64\n```\n\n## ARM Leaderboard\n\n* T.B.D.\n\n## RISC-V Leaderboard\n\n* T.B.D.\n  \n## Author\n\nThe assembly hall-of-shame is a research effort from Christopher Domas ([@xoreaxeaxeax](https:\u002F\u002Fx.com\u002Fxoreaxeaxeax\u002F)).","该项目是一个面向底层硬件性能极限探索的汇编级基准测试工具，旨在系统性测量单条x86指令在真实硬件上的最差执行延迟（即‘性能下限’）。它通过精心构造的指令序列（如fxrstor64配合PCIe MMIO带宽饱和、非对齐向量加载等）触发微架构级瓶颈（如根复合体拥塞、SMM设计缺陷、微码最长路径），并严格遵循单指令计时、不可中断、出厂配置等规则进行标准化评测。适用于CPU微架构研究、安全侧信道分析、硬件异常行为验证及系统级性能边界教学场景。","2026-08-09 02:30:02","CREATED_QUERY"]