Skip to content

Instantly share code, notes, and snippets.

@lovely-error
Last active December 4, 2024 05:59
Show Gist options
  • Save lovely-error/8f0d1e3f330ea2c2ee1dd648a8453ab0 to your computer and use it in GitHub Desktop.
Save lovely-error/8f0d1e3f330ea2c2ee1dd648a8453ab0 to your computer and use it in GitHub Desktop.
The only way to suppress speculation on branches??
#include <stdio.h>
#include <stdbool.h>
void lmao (bool cond) {
void* jmp_addr ;
__asm__ goto volatile (
"mov %[true_label], %[jmp_addr]\n\t"
"mov %[false_label], %%rbx\n\t"
"test %[cond], %[cond]\n\t"
"cmovz %%rbx, %[jmp_addr]\n\t"
"jmp *%[jmp_addr]\n\t" // this compiles to near jump (ff prefix)
"int3\n\t" // intel manual says this after near jump suppreses speculative execution
: [jmp_addr] "+r" (jmp_addr)
: [true_label] "i" (&&if_true_br_1), [false_label] "i" (&&if_false_br_2), [cond] "r" (cond)
: "rbx"
: if_true_br_1, if_false_br_2
);
if_true_br_1: {
printf("A\n");
goto if_end_1;
};
if_false_br_2: {
printf("B\n");
goto if_end_1;
};
if_end_1: {};
}
// this thing get compiled to different code
void cringe (bool cond) {
void* jmp_addr = cond ? &&if_true_br_1 : &&if_false_br_2;
goto *jmp_addr;
__asm__ volatile ("int3");
if_true_br_1: {
printf("jopa");
goto if_end_1;
};
if_false_br_2: {
printf("piska");
goto if_end_1;
};
if_end_1: {};
}
int main() {
lmao(true);
lmao(false);
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment