1 | | /******************************************************************************* |
2 | | mach_override.c |
3 | | Copyright (c) 2003-2005 Jonathan 'Wolf' Rentzsch: <http://rentzsch.com> |
4 | | Some rights reserved: <http://creativecommons.org/licenses/by/2.0/> |
5 | | |
6 | | ***************************************************************************/ |
7 | | |
8 | | #include "mach_override.h" |
9 | | |
10 | | #include <mach-o/dyld.h> |
11 | | #include <mach/mach_host.h> |
12 | | #include <mach/mach_init.h> |
13 | | #include <mach/vm_map.h> |
14 | | #include <sys/mman.h> |
15 | | |
16 | | #include <CoreServices/CoreServices.h> |
17 | | |
18 | | /************************** |
19 | | * |
20 | | * Constants |
21 | | * |
22 | | **************************/ |
23 | | #pragma mark - |
24 | | #pragma mark (Constants) |
25 | | |
26 | | #if defined(__ppc__) || defined(__POWERPC__) |
27 | | |
28 | | long kIslandTemplate[] = { |
29 | | 0x9001FFFC, // stw r0,-4(SP) |
30 | | 0x3C00DEAD, // lis r0,0xDEAD |
31 | | 0x6000BEEF, // ori r0,r0,0xBEEF |
32 | | 0x7C0903A6, // mtctr r0 |
33 | | 0x8001FFFC, // lwz r0,-4(SP) |
34 | | 0x60000000, // nop ; optionally replaced |
35 | | 0x4E800420 // bctr |
36 | | }; |
37 | | |
38 | | #define kAddressHi 3 |
39 | | #define kAddressLo 5 |
40 | | #define kInstructionHi 10 |
41 | | #define kInstructionLo 11 |
42 | | |
43 | | #elif defined(__i386__) |
44 | | |
45 | | #define kOriginalInstructionsSize 16 |
46 | | |
47 | | char kIslandTemplate[] = { |
48 | | // kOriginalInstructionsSize nop instructions so that we |
49 | | // should have enough space to host original instructions |
50 | | 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, |
51 | | 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, |
52 | | // Now the real jump instruction |
53 | | 0xE9, 0xEF, 0xBE, 0xAD, 0xDE |
54 | | }; |
55 | | |
56 | | #define kInstructions 0 |
57 | | #define kJumpAddress kInstructions + kOriginalInstructionsSize + 1 |
58 | | #endif |
59 | | |
60 | | |
61 | | #define kAllocateHigh 1 |
62 | | #define kAllocateNormal 0 |
63 | | |
64 | | /************************** |
65 | | * |
66 | | * Data Types |
67 | | * |
68 | | **************************/ |
69 | | #pragma mark - |
70 | | #pragma mark (Data Types) |
71 | | |
72 | | typedef struct { |
73 | | char instructions[sizeof(kIslandTemplate)]; |
74 | | int allocatedHigh; |
75 | | } BranchIsland; |
76 | | |
77 | | /************************** |
78 | | * |
79 | | * Funky Protos |
80 | | * |
81 | | **************************/ |
82 | | #pragma mark - |
83 | | #pragma mark (Funky Protos) |
84 | | |
85 | | mach_error_t |
86 | | allocateBranchIsland( |
87 | | BranchIsland **island, |
88 | | int allocateHigh ); |
89 | | |
90 | | mach_error_t |
91 | | freeBranchIsland( |
92 | | BranchIsland *island ); |
93 | | |
94 | | #if defined(__ppc__) || defined(__POWERPC__) |
95 | | mach_error_t |
96 | | setBranchIslandTarget( |
97 | | BranchIsland *island, |
98 | | const void *branchTo, |
99 | | long instruction ); |
100 | | #endif |
101 | | |
102 | | #if defined(__i386__) |
103 | | mach_error_t |
104 | | setBranchIslandTarget_i386( |
105 | | BranchIsland *island, |
106 | | const void *branchTo, |
107 | | char* instructions ); |
108 | | void |
109 | | atomic_mov64( |
110 | | uint64_t *targetAddress, |
111 | | uint64_t value ); |
112 | | |
113 | | static Boolean |
114 | | eatKnownInstructions( |
115 | | unsigned char *code, |
116 | | uint64_t *newInstruction, |
117 | | int *howManyEaten, |
118 | | char *originalInstructions ); |
119 | | #endif |
120 | | |
121 | | /******************************************************************************* |
122 | | * |
123 | | * Interface |
124 | | * |
125 | | *******************************************************************************/ |
126 | | #pragma mark - |
127 | | #pragma mark (Interface) |
128 | | |
129 | | mach_error_t |
130 | | mach_override( |
131 | | char *originalFunctionSymbolName, |
132 | | const char *originalFunctionLibraryNameHint, |
133 | | const void *overrideFunctionAddress, |
134 | | void **originalFunctionReentryIsland ) |
135 | | { |
136 | | assert( originalFunctionSymbolName ); |
137 | | assert( strlen( originalFunctionSymbolName ) ); |
138 | | assert( overrideFunctionAddress ); |
139 | | |
140 | | // Lookup the original function's code pointer. |
141 | | long *originalFunctionPtr; |
142 | | if( originalFunctionLibraryNameHint ) |
143 | | _dyld_lookup_and_bind_with_hint( |
144 | | originalFunctionSymbolName, |
145 | | originalFunctionLibraryNameHint, |
146 | | (void*) &originalFunctionPtr, |
147 | | NULL ); |
148 | | else |
149 | | _dyld_lookup_and_bind( |
150 | | originalFunctionSymbolName, |
151 | | (void*) &originalFunctionPtr, |
152 | | NULL ); |
153 | | |
154 | | return mach_override_ptr( originalFunctionPtr, overrideFunctionAddress, |
155 | | originalFunctionReentryIsland ); |
156 | | } |
157 | | |
158 | | mach_error_t |
159 | | mach_override_ptr( |
160 | | void *originalFunctionAddress, |
161 | | const void *overrideFunctionAddress, |
162 | | void **originalFunctionReentryIsland ) |
163 | | { |
164 | | assert( originalFunctionAddress ); |
165 | | assert( overrideFunctionAddress ); |
166 | | |
167 | | long *originalFunctionPtr = (long*) originalFunctionAddress; |
168 | | mach_error_t err = err_none; |
169 | | |
170 | | #if defined(__ppc__) || defined(__POWERPC__) |
171 | | // Ensure first instruction isn't 'mfctr'. |
172 | | #define kMFCTRMask 0xfc1fffff |
173 | | #define kMFCTRInstruction 0x7c0903a6 |
174 | | |
175 | | long originalInstruction = *originalFunctionPtr; |
176 | | if( !err && ((originalInstruction & kMFCTRMask) == kMFCTRInstruction) ) |
177 | | err = err_cannot_override; |
178 | | #elif defined (__i386__) |
179 | | int eatenCount = 0; |
180 | | char originalInstructions[kOriginalInstructionsSize]; |
181 | | uint64_t jumpRelativeInstruction = 0; // JMP |
182 | | |
183 | | Boolean overridePossible = eatKnownInstructions ((unsigned char *)originalFunctionPtr, |
184 | | &jumpRelativeInstruction, &eatenCount, originalInstructions); |
185 | | if (eatenCount > kOriginalInstructionsSize) { |
186 | | //printf ("Too many instructions eaten\n"); |
187 | | overridePossible = false; |
188 | | } |
189 | | if (!overridePossible) err = err_cannot_override; |
190 | | #endif |
191 | | |
192 | | // Make the original function implementation writable. |
193 | | if( !err ) { |
194 | | err = vm_protect( mach_task_self(), |
195 | | (vm_address_t) originalFunctionPtr, |
196 | | sizeof(long), false, (VM_PROT_ALL | VM_PROT_COPY) ); |
197 | | if( err ) |
198 | | err = vm_protect( mach_task_self(), |
199 | | (vm_address_t) originalFunctionPtr, sizeof(long), false, |
200 | | (VM_PROT_DEFAULT | VM_PROT_COPY) ); |
201 | | } |
202 | | |
203 | | // Allocate and target the escape island to the overriding function. |
204 | | BranchIsland *escapeIsland = NULL; |
205 | | if( !err ) |
206 | | err = allocateBranchIsland( &escapeIsland, kAllocateHigh ); |
207 | | |
208 | | #if defined(__ppc__) || defined(__POWERPC__) |
209 | | if( !err ) |
210 | | err = setBranchIslandTarget( escapeIsland, overrideFunctionAddress, 0 ); |
211 | | |
212 | | // Build the branch absolute instruction to the escape island. |
213 | | long branchAbsoluteInstruction = 0; // Set to 0 just to silence warning. |
214 | | if( !err ) { |
215 | | long escapeIslandAddress = ((long) escapeIsland) & 0x3FFFFFF; |
216 | | branchAbsoluteInstruction = 0x48000002 | escapeIslandAddress; |
217 | | } |
218 | | #elif defined (__i386__) |
219 | | if( !err ) |
220 | | err = setBranchIslandTarget_i386( escapeIsland, overrideFunctionAddress, 0 ); |
221 | | |
222 | | // Build the jump relative instruction to the escape island |
223 | | if (!err) { |
224 | | int32_t addressOffset = ((int32_t)escapeIsland - (int32_t)originalFunctionPtr - 5); |
225 | | addressOffset = OSSwapInt32(addressOffset); |
226 | | |
227 | | jumpRelativeInstruction |= 0xE900000000000000LL; |
228 | | jumpRelativeInstruction |= ((uint64_t)addressOffset & 0xffffffff) << 24; |
229 | | jumpRelativeInstruction = OSSwapInt64(jumpRelativeInstruction); |
230 | | } |
231 | | #endif |
232 | | |
233 | | // Optionally allocate & return the reentry island. |
234 | | BranchIsland *reentryIsland = NULL; |
235 | | if( !err && originalFunctionReentryIsland ) { |
236 | | err = allocateBranchIsland( &reentryIsland, kAllocateNormal ); |
237 | | if( !err ) |
238 | | *originalFunctionReentryIsland = reentryIsland; |
239 | | } |
240 | | |
241 | | #if defined(__ppc__) || defined(__POWERPC__) |
242 | | // Atomically: |
243 | | // o If the reentry island was allocated: |
244 | | // o Insert the original instruction into the reentry island. |
245 | | // o Target the reentry island at the 2nd instruction of the |
246 | | // original function. |
247 | | // o Replace the original instruction with the branch absolute. |
248 | | if( !err ) { |
249 | | int escapeIslandEngaged = false; |
250 | | do { |
251 | | if( reentryIsland ) |
252 | | err = setBranchIslandTarget( reentryIsland, |
253 | | (void*) (originalFunctionPtr+1), originalInstruction ); |
254 | | if( !err ) { |
255 | | escapeIslandEngaged = CompareAndSwap( originalInstruction, |
256 | | branchAbsoluteInstruction, |
257 | | (UInt32*)originalFunctionPtr ); |
258 | | if( !escapeIslandEngaged ) { |
259 | | // Someone replaced the instruction out from under us, |
260 | | // re-read the instruction, make sure it's still not |
261 | | // 'mfctr' and try again. |
262 | | originalInstruction = *originalFunctionPtr; |
263 | | if( (originalInstruction & kMFCTRMask) == kMFCTRInstruction) |
264 | | err = err_cannot_override; |
265 | | } |
266 | | } |
267 | | } while( !err && !escapeIslandEngaged ); |
268 | | } |
269 | | #elif defined (__i386__) |
270 | | // Atomically: |
271 | | // o If the reentry island was allocated: |
272 | | // o Insert the original instructions into the reentry island. |
273 | | // o Target the reentry island at the first non-replaced |
274 | | // instruction of the original function. |
275 | | // o Replace the original first instructions with the jump relative. |
276 | | // |
277 | | // Note that on i386, we do not support someone else changing the code under our feet |
278 | | if ( !err ) { |
279 | | if( reentryIsland ) |
280 | | err = setBranchIslandTarget_i386( reentryIsland, |
281 | | (void*) ((char *)originalFunctionPtr+eatenCount), originalInstructions ); |
282 | | if ( !err ) |
283 | | atomic_mov64((uint64_t *)originalFunctionPtr, jumpRelativeInstruction); |
284 | | } |
285 | | #endif |
286 | | |
287 | | // Clean up on error. |
288 | | if( err ) { |
289 | | if( reentryIsland ) |
290 | | freeBranchIsland( reentryIsland ); |
291 | | if( escapeIsland ) |
292 | | freeBranchIsland( escapeIsland ); |
293 | | } |
294 | | |
295 | | return err; |
296 | | } |
297 | | |
298 | | /******************************************************************************* |
299 | | * |
300 | | * Implementation |
301 | | * |
302 | | *******************************************************************************/ |
303 | | #pragma mark - |
304 | | #pragma mark (Implementation) |
305 | | |
306 | | /***************************************************************************//** |
307 | | Implementation: Allocates memory for a branch island. |
308 | | |
309 | | @param island <- The allocated island. |
310 | | @param allocateHigh -> Whether to allocate the island at the end of the |
311 | | address space (for use with the branch absolute |
312 | | instruction). |
313 | | @result <- mach_error_t |
314 | | |
315 | | ***************************************************************************/ |
316 | | |
317 | | mach_error_t |
318 | | allocateBranchIsland( |
319 | | BranchIsland **island, |
320 | | int allocateHigh ) |
321 | | { |
322 | | assert( island ); |
323 | | |
324 | | mach_error_t err = err_none; |
325 | | |
326 | | if( allocateHigh ) { |
327 | | vm_size_t pageSize; |
328 | | err = host_page_size( mach_host_self(), &pageSize ); |
329 | | if( !err ) { |
330 | | assert( sizeof( BranchIsland ) <= pageSize ); |
331 | | vm_address_t first = 0xfeffffff; |
332 | | vm_address_t last = 0xfe000000 + pageSize; |
333 | | vm_address_t page = first; |
334 | | int allocated = 0; |
335 | | vm_map_t task_self = mach_task_self(); |
336 | | |
337 | | while( !err && !allocated && page != last ) { |
338 | | err = vm_allocate( task_self, &page, pageSize, 0 ); |
339 | | if( err == err_none ) |
340 | | allocated = 1; |
341 | | else if( err == KERN_NO_SPACE ) { |
342 | | page += pageSize; |
343 | | err = err_none; |
344 | | } |
345 | | } |
346 | | if( allocated ) |
347 | | *island = (void*) page; |
348 | | else if( !allocated && !err ) |
349 | | err = KERN_NO_SPACE; |
350 | | } |
351 | | } else { |
352 | | void *block = malloc( sizeof( BranchIsland ) ); |
353 | | if( block ) |
354 | | *island = block; |
355 | | else |
356 | | err = KERN_NO_SPACE; |
357 | | } |
358 | | if( !err ) |
359 | | (**island).allocatedHigh = allocateHigh; |
360 | | |
361 | | return err; |
362 | | } |
363 | | |
364 | | /***************************************************************************//** |
365 | | Implementation: Deallocates memory for a branch island. |
366 | | |
367 | | @param island -> The island to deallocate. |
368 | | @result <- mach_error_t |
369 | | |
370 | | ***************************************************************************/ |
371 | | |
372 | | mach_error_t |
373 | | freeBranchIsland( |
374 | | BranchIsland *island ) |
375 | | { |
376 | | assert( island ); |
377 | | assert( (*(long*)&island->instructions[0]) == kIslandTemplate[0] ); |
378 | | assert( island->allocatedHigh ); |
379 | | |
380 | | mach_error_t err = err_none; |
381 | | |
382 | | if( island->allocatedHigh ) { |
383 | | vm_size_t pageSize; |
384 | | err = host_page_size( mach_host_self(), &pageSize ); |
385 | | if( !err ) { |
386 | | assert( sizeof( BranchIsland ) <= pageSize ); |
387 | | err = vm_deallocate( |
388 | | mach_task_self(), |
389 | | (vm_address_t) island, pageSize ); |
390 | | } |
391 | | } else { |
392 | | free( island ); |
393 | | } |
394 | | |
395 | | return err; |
396 | | } |
397 | | |
398 | | /***************************************************************************//** |
399 | | Implementation: Sets the branch island's target, with an optional |
400 | | instruction. |
401 | | |
402 | | @param island -> The branch island to insert target into. |
403 | | @param branchTo -> The address of the target. |
404 | | @param instruction -> Optional instruction to execute prior to branch. Set |
405 | | to zero for nop. |
406 | | @result <- mach_error_t |
407 | | |
408 | | ***************************************************************************/ |
409 | | #if defined(__ppc__) || defined(__POWERPC__) |
410 | | mach_error_t |
411 | | setBranchIslandTarget( |
412 | | BranchIsland *island, |
413 | | const void *branchTo, |
414 | | long instruction ) |
415 | | { |
416 | | // Copy over the template code. |
417 | | bcopy( kIslandTemplate, island->instructions, sizeof( kIslandTemplate ) ); |
418 | | |
419 | | // Fill in the address. |
420 | | ((short*)island->instructions)[kAddressLo] = ((long) branchTo) & 0x0000FFFF; |
421 | | ((short*)island->instructions)[kAddressHi] |
422 | | = (((long) branchTo) >> 16) & 0x0000FFFF; |
423 | | |
424 | | // Fill in the (optional) instuction. |
425 | | if( instruction != 0 ) { |
426 | | ((short*)island->instructions)[kInstructionLo] |
427 | | = instruction & 0x0000FFFF; |
428 | | ((short*)island->instructions)[kInstructionHi] |
429 | | = (instruction >> 16) & 0x0000FFFF; |
430 | | } |
431 | | |
432 | | //MakeDataExecutable( island->instructions, sizeof( kIslandTemplate ) ); |
433 | | msync( island->instructions, sizeof( kIslandTemplate ), MS_INVALIDATE ); |
434 | | |
435 | | return err_none; |
436 | | } |
437 | | #endif |
438 | | |
439 | | #if defined(__i386__) |
440 | | mach_error_t |
441 | | setBranchIslandTarget_i386( |
442 | | BranchIsland *island, |
443 | | const void *branchTo, |
444 | | char* instructions ) |
445 | | { |
446 | | |
447 | | // Copy over the template code. |
448 | | bcopy( kIslandTemplate, island->instructions, sizeof( kIslandTemplate ) ); |
449 | | |
450 | | // copy original instructions |
451 | | if (instructions) { |
452 | | bcopy (instructions, island->instructions + kInstructions, kOriginalInstructionsSize); |
453 | | } |
454 | | |
455 | | // Fill in the address. |
456 | | int32_t addressOffset = (char *)branchTo - (island->instructions + kJumpAddress + 4); |
457 | | *((int32_t *)(island->instructions + kJumpAddress)) = addressOffset; |
458 | | |
459 | | //MakeDataExecutable( island->instructions, sizeof( kIslandTemplate ) ); |
460 | | msync( island->instructions, sizeof( kIslandTemplate ), MS_INVALIDATE ); |
461 | | |
462 | | return err_none; |
463 | | } |
464 | | #endif |
465 | | |
466 | | |
467 | | #if defined (__i386__) |
468 | | // simplistic instruction matching |
469 | | typedef struct { |
470 | | unsigned int length; // max 15 |
471 | | unsigned char mask[15]; // sequence of bytes in memory order |
472 | | unsigned char constraint[15]; // sequence of bytes in memory order |
473 | | } AsmInstructionMatch; |
474 | | |
475 | | static AsmInstructionMatch possibleInstructions[] = { |
476 | | { 0x1, {0xFF}, {0x90} }, // nop |
477 | | { 0x1, {0xFF}, {0x55} }, // push %esp |
478 | | { 0x2, {0xFF, 0xFF}, {0x89, 0xE5} }, // mov %esp,%ebp |
479 | | { 0x1, {0xFF}, {0x53} }, // push %ebx |
480 | | { 0x3, {0xFF, 0xFF, 0x00}, {0x83, 0xEC, 0x00} }, // sub 0x??, %esp |
481 | | { 0x1, {0xFF}, {0x57} }, // push %edi |
482 | | { 0x1, {0xFF}, {0x56} }, // push %esi |
483 | | { 0x0 } |
484 | | }; |
485 | | |
486 | | static Boolean codeMatchesInstruction(unsigned char *code, AsmInstructionMatch* instruction) |
487 | | { |
488 | | Boolean match = true; |
489 | | |
490 | | int i; |
491 | | for (i=0; i<instruction->length; i++) { |
492 | | unsigned char mask = instruction->mask[i]; |
493 | | unsigned char constraint = instruction->constraint[i]; |
494 | | unsigned char codeValue = code[i]; |
495 | | match = ((codeValue & mask) == constraint); |
496 | | if (!match) break; |
497 | | } |
498 | | |
499 | | return match; |
500 | | } |
501 | | |
502 | | static Boolean |
503 | | eatKnownInstructions( |
504 | | unsigned char *code, |
505 | | uint64_t* newInstruction, |
506 | | int* howManyEaten, |
507 | | char* originalInstructions ) |
508 | | { |
509 | | Boolean allInstructionsKnown = true; |
510 | | int totalEaten = 0; |
511 | | unsigned char* ptr = code; |
512 | | int remainsToEat = 5; // a JMP instruction takes 5 bytes |
513 | | |
514 | | if (howManyEaten) *howManyEaten = 0; |
515 | | while (remainsToEat > 0) { |
516 | | Boolean curInstructionKnown = false; |
517 | | |
518 | | // See if instruction matches one we know |
519 | | AsmInstructionMatch* curInstr = possibleInstructions; |
520 | | do { |
521 | | if (curInstructionKnown = codeMatchesInstruction(ptr, curInstr)) break; |
522 | | curInstr++; |
523 | | } while (curInstr->length > 0); |
524 | | |
525 | | // if all instruction matches failed, we don't know current instruction then, stop here |
526 | | if (!curInstructionKnown) { |
527 | | allInstructionsKnown = false; |
528 | | break; |
529 | | } |
530 | | |
531 | | // At this point, we've matched curInstr |
532 | | int eaten = curInstr->length; |
533 | | ptr += eaten; |
534 | | remainsToEat -= eaten; |
535 | | totalEaten += eaten; |
536 | | } |
537 | | |
538 | | |
539 | | if (howManyEaten) *howManyEaten = totalEaten; |
540 | | |
541 | | if (originalInstructions) { |
542 | | Boolean enoughSpaceForOriginalInstructions = (totalEaten < kOriginalInstructionsSize); |
543 | | |
544 | | if (enoughSpaceForOriginalInstructions) { |
545 | | memset(originalInstructions, 0x90 /* NOP */, kOriginalInstructionsSize); // fill instructions with NOP |
546 | | bcopy(code, originalInstructions, totalEaten); |
547 | | } else { |
548 | | // printf ("Not enough space in island to store original instructions. Adapt the island definition and kOriginalInstructionsSize\n"); |
549 | | return false; |
550 | | } |
551 | | } |
552 | | |
553 | | if (allInstructionsKnown) { |
554 | | // save last 3 bytes of first 64bits of codre we'll replace |
555 | | uint64_t currentFirst64BitsOfCode = *((uint64_t *)code); |
556 | | currentFirst64BitsOfCode = OSSwapInt64(currentFirst64BitsOfCode); // back to memory representation |
557 | | currentFirst64BitsOfCode &= 0x0000000000FFFFFFLL; |
558 | | |
559 | | // keep only last 3 instructions bytes, first 5 will be replaced by JMP instr |
560 | | *newInstruction &= 0xFFFFFFFFFF000000LL; // clear last 3 bytes |
561 | | *newInstruction |= (currentFirst64BitsOfCode & 0x0000000000FFFFFFLL); // set last 3 bytes |
562 | | } |
563 | | |
564 | | return allInstructionsKnown; |
565 | | } |
566 | | |
567 | | asm( |
568 | | ".text;" |
569 | | ".align 2, 0x90;" |
570 | | ".globl _atomic_mov64;" |
571 | | "_atomic_mov64:;" |
572 | | " pushl %ebp;" |
573 | | " movl %esp, %ebp;" |
574 | | " pushl %esi;" |
575 | | " pushl %ebx;" |
576 | | " pushl %ecx;" |
577 | | " pushl %eax;" |
578 | | " pushl %edx;" |
579 | | |
580 | | // atomic push of value to an address |
581 | | // we use cmpxchg8b, which compares content of an address with |
582 | | // edx:eax. If they are equal, it atomically puts 64bit value |
583 | | // ecx:ebx in address. |
584 | | // We thus put contents of address in edx:eax to force ecx:ebx |
585 | | // in address |
586 | | " mov 8(%ebp), %esi;" // esi contains target address |
587 | | " mov 12(%ebp), %ebx;" |
588 | | " mov 16(%ebp), %ecx;" // ecx:ebx now contains value to put in target address |
589 | | " mov (%esi), %eax;" |
590 | | " mov 4(%esi), %edx;" // edx:eax now contains value currently contained in target address |
591 | | " lock; cmpxchg8b (%esi);" // atomic move. |
592 | | |
593 | | // restore registers |
594 | | " popl %edx;" |
595 | | " popl %eax;" |
596 | | " popl %ecx;" |
597 | | " popl %ebx;" |
598 | | " popl %esi;" |
599 | | " popl %ebp;" |
600 | | " ret" |
601 | | ); |
602 | | |
603 | | #endif |