1
RYModel *obj = [[RYModel alloc] init];
2
[obj dosomethingA];
3

4
[obj performSelector:NSSelectorFromString(@"dosomethingA")];
5

6
// < Xcode 12
7
//    objc_msgSend((id)obj, sel_registerName("dosomethingA"));
8

9
// Xcode 12 需要转类型，只改Build setting不行
10
((void (*)(id, SEL))(void *)objc_msgSend)(obj, sel_registerName("dosomethingA"));

1
ObjcMsgSend[17313:6255181] -[RYModel dosomethingA]
2
ObjcMsgSend[17313:6255181] -[RYModel dosomethingA]
3
ObjcMsgSend[17313:6255181] -[RYModel dosomethingA]

1
@interface RYSubModel : RYModel
2

3
- (BOOL)isSub;
4

5
@end
6

7
@implementation RYSubModel
8

9
- (BOOL)isSub {
10
    NSLog(@"%s",__FUNCTION__);
11
    [super dosomethingA];
12
    return  YES;
13
}
14

15
@end

1
static BOOL _I_RYSubModel_isSub(RYSubModel * self, SEL _cmd) {
2
    NSLog((NSString *)&__NSConstantStringImpl__var_folders_py_7v1wvf813z5bmw0hr97yplwc0000gn_T_RYModel_c52934_mi_6,__FUNCTION__);
3
    ((void (*)(__rw_objc_super *, SEL))(void *)objc_msgSendSuper)((__rw_objc_super){(id)self, (id)class_getSuperclass(objc_getClass("RYSubModel"))}, sel_registerName("dosomethingA"));
4
    return ((bool)1);
5
}

1
/// Specifies the superclass of an instance.
2
struct objc_super {
3
    /// Specifies an instance of a class.
4
    __unsafe_unretained _Nonnull id receiver;
5

6
    /// Specifies the particular superclass of the instance to message.
7
#if !defined(__cplusplus)  &&  !__OBJC2__
8
    /* For compatibility with old objc-runtime.h header */
9
    __unsafe_unretained _Nonnull Class class;
10
#else
11
    __unsafe_unretained _Nonnull Class super_class;
12
#endif
13
    /* super_class is the first class to search */
14
};

1
/// Specifies the superclass of an instance.
2
struct objc_super {
3
    /// Specifies an instance of a class.
4
    __unsafe_unretained _Nonnull id receiver;
5

6
    /// Specifies the particular superclass of the instance to message.
7
#if !defined(__cplusplus)  &&  !__OBJC2__ //
8
    /* For compatibility with old objc-runtime.h header */
9
    __unsafe_unretained _Nonnull Class class;
10
#else
11
    __unsafe_unretained _Nonnull Class super_class;
12
#endif
13
    /* super_class is the first class to search */
14
};

1
struct objc_super ry_super;
2
ry_super.receiver = obj;
3
ry_super.super_class = [RYModel class];
4
((void (*)(id, SEL))(void *)objc_msgSendSuper)((__bridge id)(&ry_super), sel_registerName("dosomethingA"));
5

6
输出：
7
ObjcMsgSend[17330:6265149] -[RYModel dosomethingA] // 调用父类方法成功

1
/********************************************************************
2
 * GetClassFromIsa_p16 src, needs_auth, auth_address
3
 * src is a raw isa field. Sets p16 to the corresponding class pointer.
4
 * The raw isa might be an indexed isa to be decoded, or a
5
 * packed isa that needs to be masked.
6
 *
7
 * On exit:
8
 *   src is unchanged
9
 *   p16 is a class pointer
10
 *   x10 is clobbered
11
 ********************************************************************/
12
.macro GetClassFromIsa_p16 src, needs_auth, auth_address /* note: auth_address is not required if !needs_auth */
13

14
#if SUPPORT_INDEXED_ISA
15
...
16
#elif __LP64__
17
.if \needs_auth == 0 // _cache_getImp takes an authed class already
18
  mov  p16, \src
19
.else // needs_auth == 1
20
  // 64-bit packed isa
21
  ExtractISA p16, \src, \auth_address
22
.endif
23
#else
24
  // 32-bit raw isa
25
  mov  p16, \src
26

27
#endif
28

29
.endmacro

1
// XS/XS Max/XR A12处理器开始
2
#if __has_feature(ptrauth_calls)
3
// JOP
4
...
5
.macro ExtractISA
6
    // ISA($1) & ISA_MASK 存入 p16p16($0)，即 class
7
  and  $0, $1, #ISA_MASK
8
#if ISA_SIGNING_AUTH_MODE == ISA_SIGNING_STRIP
9
  xpacd  $0
10
#elif ISA_SIGNING_AUTH_MODE == ISA_SIGNING_AUTH
11
  mov  x10, $2
12
  movk  x10, #ISA_SIGNING_DISCRIMINATOR, LSL #48
13
  autda  $0, x10
14
#endif
15
.endmacro
16
...
17

18
// JOP
19
#else
20
// not JOP
21

22
...
23
.macro ExtractISA
24
    // ISA($1) & ISA_MASK 存入 p16($0)，即 class
25
  and    $0, $1, #ISA_MASK
26
.endmacro
27

28
// not JOP
29
#endif

1
/********************************************************************
2
 *
3
 * CacheLookup NORMAL|GETIMP|LOOKUP <function> MissLabelDynamic MissLabelConstant
4
 *
5
 * MissLabelConstant is only used for the GETIMP variant.
6
 *
7
 * Locate the implementation for a selector in a class method cache.
8
 *
9
 * When this is used in a function that doesn't hold the runtime lock,
10
 * this represents the critical section that may access dead memory.
11
 * If the kernel causes one of these functions to go down the recovery
12
 * path, we pretend the lookup failed by jumping the JumpMiss branch.
13
 *
14
 * Takes:
15
 *   x1 = selector
16
 *   x16 = class to be searched
17
 *
18
 * Kills:
19
 *    x9,x10,x11,x12,x13,x15,x1
20
 *
21
 * Untouched:
22
 *    x14
23
 *
24
 * On exit: (found) calls or returns IMP
25
 *                  with x16 = class, x17 = IMP
26
 *                  In LOOKUP mode, the two low bits are set to 0x3
27
 *                  if we hit a constant cache (used in objc_trace)
28
 *          (not found) jumps to LCacheMiss
29
 *                  with x15 = class
30
 *                  For constant caches in LOOKUP mode, the low bit
31
 *                  of x16 is set to 0x1 to indicate we had to fallback.
32
 *          In addition, when LCacheMiss is __objc_msgSend_uncached or
33
 *          __objc_msgLookup_uncached, 0x2 will be set in x16
34
 *          to remember we took the slowpath.
35
 *          So the two low bits of x16 on exit mean:
36
 *            0: dynamic hit
37
 *            1: fallback to the parent class, when there is a preoptimized cache
38
 *            2: slowpath
39
 *            3: preoptimized cache hit
40
 *
41
 ********************************************************************/

1
.macro CacheLookup Mode, Function, MissLabelDynamic, MissLabelConstant
2
  //
3
  // Restart protocol:
4
  //
5
  //   As soon as we're past the LLookupStart\Function label we may have
6
  //   loaded an invalid cache pointer or mask.
7
  //
8
  //   When task_restartable_ranges_synchronize() is called,
9
  //   (or when a signal hits us) before we're past LLookupEnd\Function,
10
  //   then our PC will be reset to LLookupRecover\Function which forcefully
11
  //   jumps to the cache-miss codepath which have the following
12
  //   requirements:
13
  //
14
  //   GETIMP:
15
  //     The cache-miss is just returning NULL (setting x0 to 0)
16
  //
17
  //   NORMAL and LOOKUP:
18
  //   - x0 contains the receiver
19
  //   - x1 contains the selector
20
  //   - x16 contains the isa
21
  //   - other registers are set as per calling conventions
22
  //
23

24
    // 将x16(class)移动到x15
25
  mov  x15, x16      // stash the original isa
26

27
LLookupStart\Function:
28
...
29

30

31
.endmacro

1
LLookupStart\Function:
2
  // p1 = _cmd, p16 = isa
3
#if CACHE_MASK_STORAGE == CACHE_MASK_STORAGE_HIGH_16_BIG_ADDRS
4
// ARM64 && __LP64__: MacOS 或 模拟器
5
...
6
#elif CACHE_MASK_STORAGE == CACHE_MASK_STORAGE_HIGH_16
7
// ARM64 && __LP64__
8
    // ClassISA + #CACHE(0x10) 存入 p11，即cache_t(p11)
9
  ldr  p11, [x16, #CACHE]      // p11 = mask|buckets
10
    #if CONFIG_USE_PREOPT_CACHES
11
        // 真机
12
        #if __has_feature(ptrauth_calls)
13
        // > X 的机型
14
            // 判断 cache_t(p11) 第0位是否不为0，如果为0，是否有共享缓存（first_shared_cache_sel）
15
            // 没缓存：继续走
16
            // 有缓存：跳转 LLookupPreopt\Function
17
            tbnz  p11, #0, LLookupPreopt\Function
18
            // cache_t(p11) & #0x0000ffffffffffff -> p10(buckets)
19
            // 取低 48 位
20
            and  p10, p11, #0x0000ffffffffffff  // p10 = buckets
21
        #else
22
            and  p10, p11, #0x0000fffffffffffe  // p10 = buckets
23
            tbnz  p11, #0, LLookupPreopt\Function
24
        #endif
25

26
        // (_cmd ^ _cmd >> 7) -> p12
27
        eor  p12, p1, p1, LSR #7
28
        // ((cache_t & p12) >> 48) -> p12(HashIndex)
29
        and  p12, p12, p11, LSR #48    // x12 = (_cmd(p1) ^ (_cmd(p1) >> 7)) & mask
30
    #else
31
        and  p10, p11, #0x0000ffffffffffff  // p10 = buckets
32
        and  p12, p1, p11, LSR #48    // x12 = _cmd & mask
33
    #endif // CONFIG_USE_PREOPT_CACHES
34

35
#elif CACHE_MASK_STORAGE == CACHE_MASK_STORAGE_LOW_4
36
// ARM64 && !__LP64__：真机
37
略
38
#else
39
#error Unsupported cache mask storage for ARM64.
40
#endif
41
    // ((buckets + HashIndex) << 1+PTRSHIFT) -> p13(bucket_t)
42
    // 通过偏移找到 bucket_t 存入p13
43
    // p12(HashIndex)
44
    // `buckets`是`buckets`的首地址，HashIndex为Hash表的下标
45
    // 如：HashIndex为1那就偏移1个`bucket_t`的长度，即：16（sel8+imp8）
46
    // 左移`(1+PTRSHIFT))`是为了到`HashIndex-1`位置，这里和cache_t插入缓存的逻辑保持一致，否则找不到的。
47
    // 此时p13存的的是目标bucket_t地址
48
  add  p13, p10, p12, LSL #(1+PTRSHIFT)
49
            // p13 = buckets + ((_cmd & mask) << (1+PTRSHIFT))
50
// #define PTRSHIFT 3  // 1<<PTRSHIFT == PTRSIZE
51

52
// 遍历缓存
53

54
// 第一次循环结束后

1
            // do {
2
// #define BUCKET_SIZE      (2 * __SIZEOF_POINTER__) 即 (sel + imp 指针的大小)
3
// 取出x13 放入 p17(imp) p9(sel)
4
// 然后 `*bucket--` 向前移动2个指针的长度
5
// 即：一个bucket_t的长度
6
// *bucket--: 先取值，再--
7
1:  ldp  p17, p9, [x13], #-BUCKET_SIZE  //     {imp, sel} = *bucket--
8
    // 对比 p1(传入的sel) 和 p9(p13的sel)
9
  cmp  p9, p1        //     if (sel != _cmd) {
10
  b.ne  3f        //         scan more
11
            //     } else {
12
// 命中调用 CacheHit \Mode
13
2:  CacheHit \Mode        // hit:    call or return imp
14
            //     }
15
3:  cbz  p9, \MissLabelDynamic    //     if (sel == 0) goto Miss;
16
  cmp  p13, p10      // } while (bucket >= buckets)
17
    // 未命中 回到 1 继续循环
18
  b.hs  1b

1
// CacheHit: x17 = cached IMP, x10 = address of buckets, x1 = SEL, x16 = isa
2
.macro CacheHit
3
.if $0 == NORMAL
4
    // 调用缓存IMP
5
  TailCallCachedImp x17, x10, x1, x16  // authenticate and call imp
6
.elseif $0 == GETIMP
7
  mov  p0, p17
8
  cbz  p0, 9f      // don't ptrauth a nil imp
9
  AuthAndResignAsIMP x0, x10, x1, x16  // authenticate imp and re-sign as IMP
10
9:  ret        // return IMP
11
.elseif $0 == LOOKUP
12
  // No nil check for ptrauth: the caller would crash anyway when they
13
  // jump to a nil IMP. We don't care if that jump also fails ptrauth.
14
  AuthAndResignAsIMP x17, x10, x1, x16  // authenticate imp and re-sign as IMP
15
  cmp  x16, x15
16
  cinc  x16, x16, ne      // x16 += 1 when x15 != x16 (for instrumentation ; fallback to the parent class)
17
  ret        // return imp via x17
18
.else
19
.abort oops
20
.endif
21
.endmacro

1
#if __has_feature(ptrauth_calls)
2
// JOP
3
...
4

5
.macro TailCallCachedImp
6
  // $0 = cached imp, $1 = address of cached imp, $2 = SEL, $3 = isa
7
    // (addressOfCachedIMP ^ SEL) -> addressOfCachedIMP
8
  eor  $1, $1, $2  // mix SEL into ptrauth modifier
9
    // (addressOfCachedIMP ^ isa) -> addressOfCachedIMP
10
  eor  $1, $1, $3  // mix isa into ptrauth modifier
11
    // 这个指令还没搞明白
12
  brab  $0, $1
13
.endmacro
14

15
// JOP
16
#else
17
// not JOP
18
...
19

20
.macro TailCallCachedImp
21
  // $0 = cached imp, $1 = address of cached imp, $2 = SEL, $3 = isa
22
    // (cachedIMP ^ isa) -> cachedIMP
23
  eor  $0, $0, $3
24
    // 跳转执行 cachedIMP
25
  br  $0
26
.endmacro
27

28
...
29

30
// not JOP
31
#endif

1
// wrap-around:
2
//   p10 = first bucket
3
//   p11 = mask (and maybe other bits on LP64)
4
//   p12 = _cmd & mask
5
//
6
// A full cache can happen with CACHE_ALLOW_FULL_UTILIZATION.
7
// So stop when we circle back to the first probed bucket
8
// rather than when hitting the first bucket again.
9
//
10
// Note that we might probe the initial bucket twice
11
// when the first probed slot is the last entry.
12

13
...
14
  add  p13, p10, p11, LSR #(48 - (1+PTRSHIFT))
15
            // p13 = buckets + (mask << 1+PTRSHIFT)
16
            // see comment about maskZeroBits
17
...
18

19
  add  p12, p10, p12, LSL #(1+PTRSHIFT)
20
            // p12 = first probed bucket
21

22
            // do {
23
4:  ldp  p17, p9, [x13], #-BUCKET_SIZE  //     {imp, sel} = *bucket--
24
  cmp  p9, p1        //     if (sel == _cmd)
25
  b.eq  2b        //         goto hit
26
  cmp  p9, #0        // } while (sel != 0 &&
27
  ccmp  p13, p12, #0, ne    //     bucket > first_probed)
28
  b.hi  4b

1
#if CONFIG_USE_PREOPT_CACHES
2
...
3
    LLookupPreopt\Function:
4
    #if __has_feature(ptrauth_calls)
5
        // cache_t(p11) & #0x007ffffffffffffe 存入 p10
6
        and  p10, p11, #0x007ffffffffffffe  // p10 = buckets
7
        // 验证？没找到这个指令的具体作用
8
        autdb  x10, x16      // auth as early as possible
9
    #endif
10
        // 查找共享缓存内的数据
11
        // x12 = (_cmd - first_shared_cache_sel)
12
        adrp  x9, _MagicSelRef@PAGE
13
        ldr  p9, [x9, _MagicSelRef@PAGEOFF]
14
        sub  p12, p1, p9
15

16
        // w9  = ((_cmd - first_shared_cache_sel) >> hash_shift & hash_mask)
17
    #if __has_feature(ptrauth_calls)
18
        // bits 63..60 of x11 are the number of bits in hash_mask
19
        // bits 59..55 of x11 is hash_shift
20

21
        lsr  x17, x11, #55      // w17 = (hash_shift, ...)
22
        lsr  w9, w12, w17      // >>= shift
23

24
        lsr  x17, x11, #60      // w17 = mask_bits
25
        mov  x11, #0x7fff
26
        lsr  x11, x11, x17      // p11 = mask (0x7fff >> mask_bits)
27
        and  x9, x9, x11      // &= mask
28
    #else
29
        // bits 63..53 of x11 is hash_mask
30
        // bits 52..48 of x11 is hash_shift
31
        lsr  x17, x11, #48      // w17 = (hash_shift, hash_mask)
32
        lsr  w9, w12, w17      // >>= shift
33
        and  x9, x9, x11, LSR #53    // &=  mask
34
    #endif
35

36
        ldr  x17, [x10, x9, LSL #3]    // x17 == sel_offs | (imp_offs << 32)
37
        cmp  x12, w17, uxtw
38

39
    .if \Mode == GETIMP
40
    ...
41
    .else
42
        b.ne    5f                // cache miss
43
        sub    x17, x16, x17, LSR #32        // imp = isa - imp_offs
44

45
    .if \Mode == NORMAL
46
        br  x17
47
    .elseif \Mode == LOOKUP
48
    ...
49

50
    5:  ldursw  x9, [x10, #-8]      // offset -8 is the fallback offset
51
        add  x16, x16, x9      // compute the fallback isa
52
        b  LLookupStart\Function    // lookup again with a new isa
53
    .endif
54
#endif // CONFIG_USE_PREOPT_CACHES

1
// Look up the class for a tagged pointer in x0, placing it in x16.
2
.macro GetTaggedClass
3

4
  and  x10, x0, #0x7    // x10 = small tag
5
  asr  x11, x0, #55    // x11 = large tag with 1s filling the top (because bit 63 is 1 on a tagged pointer)
6
  cmp  x10, #7    // tag == 7?
7
  csel  x12, x11, x10, eq  // x12 = index in tagged pointer classes array, negative for extended tags.
8
          // The extended tag array is placed immediately before the basic tag array
9
          // so this looks into the right place either way. The sign extension done
10
          // by the asr instruction produces the value extended_tag - 256, which produces
11
          // the correct index in the extended tagged pointer classes array.
12

13
  // x16 = _objc_debug_taggedpointer_classes[x12]
14
  adrp  x10, _objc_debug_taggedpointer_classes@PAGE
15
  add  x10, x10, _objc_debug_taggedpointer_classes@PAGEOFF
16
  ldr  x16, [x10, x12, LSL #3]
17

18
.endmacro

1
#if SUPPORT_TAGGED_POINTERS
2
LNilOrTagged:
3
b.eq  LReturnZero    // nil check
4
GetTaggedClass
5
b  LGetIsaDone
6
// SUPPORT_TAGGED_POINTERS
7
#endif

1
LReturnZero:
2
// x0 is already zero
3
mov  x1, #0
4
movi  d0, #0
5
movi  d1, #0
6
movi  d2, #0
7
movi  d3, #0
8
ret

1
.macro MethodTableLookup
2
  // 创建一个栈，为调用方法做准备，存储寄存器中的值
3
  SAVE_REGS MSGSEND
4

5
  // lookUpImpOrForward(obj, sel, cls, LOOKUP_INITIALIZE | LOOKUP_RESOLVER)
6
  // receiver and selector already in x0 and x1
7
  mov  x2, x16
8
  mov  x3, #3
9

10
  bl  _lookUpImpOrForward
11

12
  // IMP in x0
13
  mov  x17, x0
14

15
    // 复原 SAVE_REGS用到的寄存器，出栈
16
  RESTORE_REGS MSGSEND
17

18
.endmacro

1
/***********************************************************************
2
 * search_method_list_inline
3
 **********************************************************************/
4
template<class getNameFunc>
5
ALWAYS_INLINE static method_t *
6
findMethodInSortedMethodList(SEL key, const method_list_t *list, const getNameFunc &getName)
7
{
8
    ASSERT(list);
9

10
    auto first = list->begin();
11
    auto base = first;
12
    decltype(first) probe;
13

14
    uintptr_t keyValue = (uintptr_t)key;
15
    uint32_t count;
16

17
    /**
18
    count >>= 1，右移一位，即二分一次
19
    */
20
    for (count = list->count; count != 0; count >>= 1) {
21
        // 居中的下标
22
        probe = base + (count >> 1);
23

24
        uintptr_t probeValue = (uintptr_t)getName(probe);
25

26
        if (keyValue == probeValue) {
27
            // `probe` is a match.
28
            // Rewind looking for the *first* occurrence of this value.
29
            // This is required for correct category overrides.
30
            /**
31
            probe > first
32
            开始遍历一直把同名的遍历完，因为有分类的存在，所以可能会有同名的。
33
            会掉分类的。
34
            */
35
            while (probe > first && keyValue == (uintptr_t)getName((probe - 1))) {
36
                probe--;
37
            }
38
            return &*probe;
39
        }
40

41
        if (keyValue > probeValue) {
42
            base = probe + 1;
43
            count--;
44
        }
45
    }
46

47
    return nil;
48
}

1
// 判断 cache_t(p11) 第0位是否不为0，如果为0，是否有共享缓存（first_shared_cache_sel）
2
// 没缓存：继续走
3
// 有缓存：跳转 LLookupPreopt\Function
4
tbnz  p11, #0, LLookupPreopt\Function
5
// cache_t(p11) & #0x0000ffffffffffff -> p10(buckets)
6
// 取低 48 位
7
and  p10, p11, #0x0000ffffffffffff  // p10 = buckets