papers/evmgpu-benchmark/sections/14-production-silicon-dex-and-e2e.tex

\section{Production Silicon: Billion-Order DEX Matching and End-to-End Post-Quantum Settlement}
\label{sec:production}

The preceding sections establish the GPU-native EVM, Block-STM parallel execution, and
cryptographic-offload results on Apple M1 Max Metal. We now report the decisive measurements on
the two accelerators that ship in the Lux high-frequency settlement fabric---an
\textbf{NVIDIA GB10} (Grace-Blackwell superchip, CUDA 13.0, 20-core Grace CPU) and an
\textbf{AMD Radeon 8060S} (RDNA, Ryzen~AI~MAX+~395, 32-core CPU)---and extend the study end to
end: from the deterministic per-book matching kernel, through the tuned inter-node link, to the
post-quantum signature path. Every figure in this section is measured on real hardware; the
sole projected quantity (the confidential-compute overhead of NVIDIA IO TEE) is explicitly
labelled.

\subsection{Methodology: a deterministic matcher, tuned per silicon}
\label{sec:production-method}

The measured kernel is the \emph{consensus-path} central-limit-order-book matcher, not an
aggregated-liquidity approximation. Determinism is a hard requirement: every validator must
re-execute a block bit-identically, so a parallel-within-book match---which would reorder
fills and fork the chain---is inadmissible. The design that satisfies this is \textbf{one thread
per order book}, walking that book's resting levels in strict price-time priority (sequential
\emph{within} a book), with \textbf{millions of books resolved in parallel} across the grid. This
is the crucial distinction from a naive \verb|<<<1,1>>>| launch: sequential-within-book does
\emph{not} mean one-book-at-a-time. The parallelism axis is the market count, and at $N=$4--16\,M
books the grid saturates every SM. Each thread performs $\text{TAKERS}\times\text{DEPTH}$ real
match steps ($32\times32$), so the kernel is compute- and memory-bound, not dispatch-bound. The
CPU reference runs the identical logic across all cores with OpenMP, and we verify GPU$=$CPU
fill-parity on every run (the harnesses print \texttt{parity \dots MATCH}); the throughput
figures are trustworthy only because the results are bit-identical. Timing is kernel-only on
CUDA/HIP (best of three after warm-up); Apple Metal figures include command-buffer submit.

Two backend-portable levers take the matcher to its tuned optimum. First, \textbf{memory
coalescing}: the naive array-of-structs layout stores each book's orders contiguously
(\texttt{resting[book*DEPTH+i]}), so adjacent threads read addresses \texttt{DEPTH} apart---an
uncoalesced, strided access. Transposing to an order-major structure-of-arrays layout
(\texttt{plane[i*N+book]}) makes a warp's 32 threads read 32 contiguous words, collapsing each
strided gather into one coalesced transaction. Second, \textbf{per-backend occupancy tuning} of
threads-per-block and register residency (all resting data preloaded into registers, versus only
the mutable remaining-quantity vector in registers with read-only price/side re-read from
coalesced global). Both levers change only performance; the fills, and thus \texttt{parity
\dots MATCH}, are invariant.

\subsection{Result: a deterministic matcher at up to 12.8 billion orders per second}

\begin{table}[h]
\centering
\caption{Deterministic per-book DEX matcher, tuned per backend, GPU versus multi-core CPU, same
workload and host (best of three, parity-verified). ``Baseline'' is the array-of-structs layout
at 256 threads/block; ``Tuned'' applies coalesced structure-of-arrays plus the per-backend
occupancy optimum. The upper group is the settlement fabric (kernel-only); the lower group is
Apple Silicon workstations (Metal, submit-inclusive).}
\label{tab:dex-gpu-cpu}
\sisetup{table-format=5.0}
\begin{tabular}{llrrrl}
\toprule
\textbf{Host / accelerator} & \textbf{Cores} & \textbf{Baseline} & \textbf{Tuned} & \textbf{vs CPU} & \textbf{Tuned config} \\
 & & \textbf{(M/s)} & \textbf{(M/s)} & & \\
\midrule
\multicolumn{6}{l}{\textit{Settlement fabric (kernel-only)}}\\
AMD Radeon 8060S (RDNA)       & 32 & 1940 & \textbf{12760} & 12.5$\times$ & SoA, preload, TPB 64 \\
NVIDIA GB10 (Grace-Blackwell) & 20 & 1540 & \textbf{9130}  & 17.5$\times$ & SoA, lowreg, TPB 32 \\
\textbf{Two-node fabric aggregate} & --- & --- & \textbf{21890} & --- & --- \\
\midrule
\multicolumn{6}{l}{\textit{Apple Silicon workstations (Metal, submit-inclusive)}}\\
dbc --- Apple M4 Max (128\,GB)  & 16 & 5600 & \textbf{5600} & 8.1$\times$ & AoS, TPB 256 \\
ra --- Apple M1 Max (64\,GB)    & 10 & 2430 & \textbf{2800} & 9.8$\times$ & SoA, TPB 256 \\
\bottomrule
\end{tabular}
\end{table}

Table~\ref{tab:dex-gpu-cpu} reports the headline result. The \emph{deterministic, consensus-safe}
matcher---the path a validator actually re-executes---sustains \SI{12.76}{\giga\text{orders}/
\second} on the AMD RDNA APU and \SI{9.13}{\giga\text{orders}/\second} on the NVIDIA GB10,
aggregating to \SI{21.9}{\giga\text{orders}/\second} across the two-node fabric, every point
GPU$=$CPU fill-parity verified. Coalescing plus per-backend tuning lifts each discrete accelerator
$5.9$--$6.6\times$ over its own array-of-structs baseline (AMD $1.94\to12.76$\,B, GB10
$1.54\to9.13$\,B) and $12$--$17.5\times$ over its fully parallel multi-core CPU. Two engineering
facts emerge. (i)~\textbf{Coalescing is a discrete/APU-memory optimization}: on Apple unified
memory it is neutral-to-negative---the large shared cache already absorbs the strided
array-of-structs access, so the M4~Max's tuned optimum is in fact the array-of-structs layout at
\SI{5.60}{\giga\text{orders}/\second}. (ii)~\textbf{The two discrete backends want opposite
register strategies}: the GB10 is occupancy-bound and prefers low register pressure with small
32-thread blocks, whereas the bandwidth-rich 8060S prefers register-resident data at 64-thread
blocks (the low-register variant costs it $\sim$25\%). No single configuration is optimal
everywhere; the tuned rate is a per-silicon result. The one qualification carried forward is that
this raw matching rate is an upper bound that the network and consensus layers, analyzed below,
bind well beneath.

\subsection{Occupancy was the ceiling---and it is now saturated}
\label{sec:production-occupancy}

An earlier, pessimistic launch of this matcher---one block per market at only
$10{,}000$ markets---measured \SI{41.75}{\mega\text{fills}/\second} on the GB10 at just
\textbf{16.7\% occupancy} (one block per streaming multiprocessor, $\sim$85\% of the GPU idle),
which had suggested the DEX ceiling was a launch-configuration problem rather than a hardware
limit. Table~\ref{tab:dex-gpu-cpu} confirms that diagnosis and closes it: scaling the market
count to millions of books saturates every SM, and layering coalescing and per-backend register
tuning on top recovers the idle throughput and more, landing at billions of orders per second on
both discrete parts. The ceiling was occupancy, not silicon, and the tuned launch reaches it.

\subsection{The tuned inter-node link}

The two settlement nodes are joined by a dedicated point-to-point \SI{2.5}{\giga bit/\second}
Ethernet segment (distinct from the wireless client-ingress path). Measured with \texttt{iperf3},
the link sustains \SI{2.35}{\giga bit/\second}---94\% of line rate---with \emph{zero}
retransmissions single-stream and identical aggregate under four parallel streams, confirming a
correctly tuned path (MTU, window, and offload). At the canonical BLS-aggregated order width of
\SI{56}{byte}, this admits \SI{5.25}{\mega\text{orders}/\second} of node-to-node ingest; the GPU
matcher, at three orders of magnitude higher, is never the bottleneck at the link.

\subsection{End-to-end post-quantum: the signature-size lever}

All node-to-node traffic is post-quantum. We measure ML-DSA-65 (FIPS~204) at
\SI{450}{\micro\second} per signature and \SI{134}{\micro\second} per verification per core
($\approx$\SI{239}{\kilo\text{verifications}/\second} across 32 cores, before batch
amortization). The architectural consequence is stark and is the central design lever of the
fabric:

\begin{table}[h]
\centering
\caption{End-to-end throughput ceilings by signature discipline, over the measured
\SI{2.35}{\giga bit/\second} link and, scaled, over \SI{800}{\giga bit/\second} InfiniBand.}
\label{tab:pq-ceilings}
\begin{tabular}{lrr}
\toprule
\textbf{Discipline} & \textbf{\SI{2.35}{Gbps} link} & \textbf{\SI{800}{Gbps} IB} \\
\midrule
BLS-aggregate + PQ block finality (1 PQ sig / block) & \SI{5.25}{\mega\text{ord}/\second} & \SI{1786}{\mega\text{ord}/\second} \\
Per-order ML-DSA-65 on the wire (3293-byte sig)      & \SI{88}{\kilo\text{ord}/\second}   & \SI{30}{\mega\text{ord}/\second}  \\
\bottomrule
\end{tabular}
\end{table}

Signing every order individually with a post-quantum signature collapses throughput to
\SI{88}{\kilo\text{orders}/\second}---the \SI{3293}{byte} signature, not its verification cost,
is the whole packet budget. \emph{Batch attestation}---a single post-quantum (or threshold)
signature covering a block of orders, over a BLS-aggregated fast path---restores throughput to
millions per second while preserving post-quantum finality. This is the difference between a
post-quantum DEX that clears the world's order flow and one that clears a single mid-tier venue.

\subsection{Scaling to the colocated venue, and the world}

Composing the measured layers over the target \SI{800}{\giga bit/\second} InfiniBand fabric of a
colocated San~Francisco venue yields a network ceiling of \SI{1.79}{\giga\text{orders}/\second}
(BLS-aggregate discipline), with the tuned two-GPU matcher at \SI{21.9}{\giga\text{orders}/
\second}---a $12\times$ compute margin over the wire---so the venue is decisively network-bound
even at \SI{800}{Gbps}, and the matcher is nowhere near its own limit. Against real market scale
(Table~\ref{tab:world}), the significance is that a \emph{single two-accelerator node} over
\SI{800}{Gbps} exceeds the entire world's traded order flow---and even its full quote-and-cancel
message flow at OPRA-scale microbursts---with substantial headroom, while remaining fully
confidential and post-quantum.

\begin{table}[h]
\centering
\caption{Colocated two-GPU venue over \SI{800}{Gbps} InfiniBand versus global market scale. The
network column uses the BLS-aggregate + PQ-block-finality discipline
(\SI{1.79}{\giga\text{ord}/\second}); the GPU column uses the tuned deterministic matcher
(\SI{21.9}{\giga\text{ord}/\second}).}
\label{tab:world}
\begin{tabular}{lrr}
\toprule
\textbf{Reference load} & \textbf{Rate} & \textbf{Venue headroom} \\
\midrule
World traded flow (equities+crypto+FX+deriv), peak & $\sim$\SI{10}{\mega\text{tr}/\second}  & $179\times$ (net), $2189\times$ (GPU) \\
World full message flow (incl.\ quotes/cancels)    & $\sim$\SI{100}{\mega\text{msg}/\second} & $17.9\times$ (net), $219\times$ (GPU) \\
\bottomrule
\end{tabular}
\end{table}

\subsection{The one projected quantity: confidential-compute overhead}

Every figure above is measured on the lab hardware save one. The confidential-compute overhead of
\textbf{NVIDIA IO TEE}---encrypted DMA and bounce-buffering in Hopper/Blackwell confidential
mode---cannot be measured on the GB10/8060S lab parts, which do not expose full CC-TEE
enclaves. From NVIDIA's published H100 confidential-computing characterization we estimate a
\textbf{$\sim$5--15\%} penalty for this fabric (compute-bound operations pay $\sim$1--7\%;
small-transfer IO-bound paths up to $\sim$20--30\%). This is the single quantity that remains a
projection until the fabric runs on production CC-TEE silicon in the colocated venue; it does not
alter the order-of-magnitude conclusions.

\subsection{Native GPU EVM and FHE within the unified engine}

The DEX matcher is one of three kernel families that share the unified engine and its unified
memory address space (\SI{62}{\giga byte} on the AMD APU, \SI{128}{\giga byte} on the GB10),
dispatched through a single stream so that no result crosses a PCIe boundary. The
\textbf{native GPU EVM} is complete on device---\texttt{block\_stm\_execute\_kernel} for
optimistic parallel execution, with companion \texttt{evm\_kernel}, \texttt{keccak256},
\texttt{state\_table}, and \texttt{tx\_validate} kernels---so that block execution, order
matching, and confidential computation are co-resident. The \textbf{FHE} layer contributes 28
CUDA kernels (TFHE programmable bootstrap, blind rotation, external product, four-step NTT,
key-switching); its NTT primitive---the throughput-dominant operation of every homomorphic
gate---measures up to \textbf{23.6$\times$} over the CPU baseline ($N{=}4096$, batch~128:
\SI{13.9}{\milli\second}$\to$\SI{0.59}{\milli\second}). Because the three families share unified
memory, a confidential order can be matched (DEX), settled (EVM), and processed under encryption
(FHE) without ever leaving the accelerator---the defining property of the unified GPU-native
multichain engine.