前面主要是看下xnu的源码，要是对源码不感兴趣的童鞋，可以直接看捕捉。

什么是signal

POSIX

POSIX表示可移植操作系统接口（Portable Operating System Interface of UNIX，缩写为 POSIX ），POSIX标准定义了操作系统应该为应用程序提供的接口标准。

POSIX标准意在期望获得源代码级别的软件可移植性。换句话说，为一个POSIX兼容的操作系统编写的程序，应该可以在任何其它的POSIX操作系统（即使是来自另一个厂商）上编译执行。

很明显iOS和macOS也是兼容这个标准的。这个标准中有一块信号机制就是signal。

和Mach的关系

Mach已经通过异常机制提供了底层的陷阱处理，详见《iOS_Crash收集之Mach》。而BSD则在异常机制之上建立了信号处理机制。硬件产生的信号被Mach层捕捉，然后转换为对应的Unix信号。为了维护一个统一的机制，操作系统和用户产生的信号首先被转换为Mach异常，然后再转换为信号。

以上的东西讲的太宽泛，我们可以查看下xnu的源码。

//bsd/uxkern/ux_exception.c
void
ux_handler_init(void)
{
    thread_t    thread = THREAD_NULL;

    ux_exception_port = MACH_PORT_NULL;
    //启动一个新线程，开启ux_handler任务
    (void) kernel_thread_start((thread_continue_t)ux_handler, NULL, &thread);
    thread_deallocate(thread);
    //加锁，等待ux_exception_port注册成功
    proc_list_lock();
    if (ux_exception_port == MACH_PORT_NULL)  {
        (void)msleep(&ux_exception_port, proc_list_mlock, 0, "ux_handler_wait", 0);
    }
    proc_list_unlock();
}


//bsd/kern/bsd_init.c

void
bsdinit_task(void)
{
    proc_t p = current_proc();
    struct uthread *ut;
    thread_t thread;
    //设置进程名称为 init
    process_name("init", p);

    //开启 Unix异常处理线程，注册ux_exception_port
    ux_handler_init();

    thread = current_thread();
    //设置exception监听端口，这里不就是mach中的 XXXX_set_exception_ports么？
    (void) host_set_exception_ports(host_priv_self(),
                    EXC_MASK_ALL & ~(EXC_MASK_RPC_ALERT),//pilotfish (shark) needs this port
                    (mach_port_t) ux_exception_port,
                    EXCEPTION_DEFAULT| MACH_EXCEPTION_CODES,
                    0);

    ut = (uthread_t)get_bsdthread_info(thread);

#if CONFIG_MACF
    mac_cred_label_associate_user(p->p_ucred);
#endif

    vm_init_before_launchd();


    bsd_init_kprintf("bsd_do_post - done");
    //加载程序
    load_init_program(p);
    lock_trace = 1
｝

通过调用host_set_exception_ports函数，bsdinit_task将所有的Mach异常消息都重定向到
ux_exception_port，这个端口被ux_handler持有，并且在ux_handler中处理异常消息。

接下来看看ux_handler是个啥？

__attribute__((noreturn))
static void
ux_handler(void)
{
    task_t      self = current_task();
    mach_port_name_t    exc_port_name;
    mach_port_name_t    exc_set_name;

    /* self->kernel_vm_space = TRUE; */
    ux_handler_self = self;


    /*
     *  分配端口，通过这个端口接受异常信息
     */
    if (mach_port_allocate(get_task_ipcspace(ux_handler_self), MACH_PORT_RIGHT_PORT_SET,  &exc_set_name) != MACH_MSG_SUCCESS)
        panic("ux_handler: port_set_allocate failed");

    /*
     *  分配异常端口，并且通过ipc_object_copyin将端口转换成全局的名称
     *  将端口放入集合
    */
    if (mach_port_allocate(get_task_ipcspace(ux_handler_self), MACH_PORT_RIGHT_RECEIVE, &exc_port_name) != MACH_MSG_SUCCESS)
    panic("ux_handler: port_allocate failed");
    if (mach_port_move_member(get_task_ipcspace(ux_handler_self),
                exc_port_name,  exc_set_name) != MACH_MSG_SUCCESS)
    panic("ux_handler: port_set_add failed");

    if (ipc_object_copyin(get_task_ipcspace(self), exc_port_name,
            MACH_MSG_TYPE_MAKE_SEND, 
            (void *) &ux_exception_port) != MACH_MSG_SUCCESS)
        panic("ux_handler: object_copyin(ux_exception_port) failed");

    proc_list_lock();
    thread_wakeup(&ux_exception_port);
    proc_list_unlock();

    /*消息处理循环 */

    for (;;) {
    struct rep_msg {
        mach_msg_header_t Head;
        NDR_record_t NDR;
        kern_return_t RetCode;
    } rep_msg;
    struct exc_msg {
        mach_msg_header_t Head;
        /* start of the kernel processed data */
        mach_msg_body_t msgh_body;
        mach_msg_port_descriptor_t thread;
        mach_msg_port_descriptor_t task;
        /* end of the kernel processed data */
        NDR_record_t NDR;
        exception_type_t exception;
        mach_msg_type_number_t codeCnt;
        mach_exception_data_t code;
        /* some times RCV_TO_LARGE probs */
        char pad[512];
    } exc_msg;
    mach_port_name_t    reply_port;
    kern_return_t    result;

    exc_msg.Head.msgh_local_port = CAST_MACH_NAME_TO_PORT(exc_set_name);
    exc_msg.Head.msgh_size = sizeof (exc_msg);
#if 0
    result = mach_msg_receive(&exc_msg.Head);
#else
    result = mach_msg_receive(&exc_msg.Head, MACH_RCV_MSG,
                 sizeof (exc_msg), exc_set_name,
                 MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL,
                 0);
#endif
    if (result == MACH_MSG_SUCCESS) {
        reply_port = CAST_MACH_PORT_TO_NAME(exc_msg.Head.msgh_remote_port);
        // mach_exc_server 会调用 mach_exception_raise,
        // 然后会被 mach_catch_exception_raise捕获，
        //信号处理逻辑就在mach_catch_exception_raise
        if (mach_exc_server(&exc_msg.Head, &rep_msg.Head)) {
        result = mach_msg_send(&rep_msg.Head, MACH_SEND_MSG,
            sizeof (rep_msg),MACH_MSG_TIMEOUT_NONE,MACH_PORT_NULL);
        if (reply_port != 0 && result != MACH_MSG_SUCCESS)
            mach_port_deallocate(get_task_ipcspace(ux_handler_self), reply_port);
        }

    }
    else if (result == MACH_RCV_TOO_LARGE)
        /* ignore oversized messages */;
    else
        panic("exception_handler");
    }
}

消息被mach_catch_exception_raise 捕捉到，mach_catch_exception_raise主要就是将异常转换成signal,那就看看源码吧。

kern_return_t
catch_mach_exception_raise(
        __unused mach_port_t exception_port,
        mach_port_t thread,
        mach_port_t task,
        exception_type_t exception,
        mach_exception_data_t code,
        __unused mach_msg_type_number_t codeCnt
)
{
    task_t          self = current_task();
    thread_t        th_act;
    ipc_port_t      thread_port;
    struct proc     *p;
    kern_return_t       result = MACH_MSG_SUCCESS;
    int         ux_signal = 0;
    mach_exception_code_t   ucode = 0;
    struct uthread      *ut;
    mach_port_name_t thread_name = CAST_MACH_PORT_TO_NAME(thread);
    mach_port_name_t task_name = CAST_MACH_PORT_TO_NAME(task);

    /*
     *  Convert local thread name to global port.
     */
   if (MACH_PORT_VALID(thread_name) &&
       (ipc_object_copyin(get_task_ipcspace(self), thread_name,
               MACH_MSG_TYPE_PORT_SEND,
               (void *) &thread_port) == MACH_MSG_SUCCESS)) {
        if (IPC_PORT_VALID(thread_port)) {
       th_act = convert_port_to_thread(thread_port);
       ipc_port_release_send(thread_port);
    } else {
       th_act = THREAD_NULL;
    }

    /*
     *  Catch bogus ports
     */
    if (th_act != THREAD_NULL) {

        /*
         *  将异常转换成signal和code
         */
        ux_exception(exception, code[0], code[1], &ux_signal, &ucode);

        ut = get_bsdthread_info(th_act);
        p = proc_findthread(th_act);

        /* Can't deliver a signal without a bsd process reference */
        if (p == NULL) {
            ux_signal = 0;
            result = KERN_FAILURE;
        }

        /*
         * 堆栈溢出需要特别处理
         */
        if (code[0] == KERN_PROTECTION_FAILURE &&
        ux_signal == SIGBUS) {
            user_addr_t     sp, stack_min, stack_max;
            int         mask;
            struct sigacts  *ps;

            sp = code[1];

            stack_max = p->user_stack;
            stack_min = p->user_stack - MAXSSIZ;
            if (sp >= stack_min &&
            sp < stack_max) {
                /*
                 * This is indeed a stack overflow.  Deliver a
                 * SIGSEGV signal.
                 */
                ux_signal = SIGSEGV;

                /*
                 * If the thread/process is not ready to handle
                 * SIGSEGV on an alternate stack, force-deliver
                 * SIGSEGV with a SIG_DFL handler.
                 */
                mask = sigmask(ux_signal);
                ps = p->p_sigacts;
                if ((p->p_sigignore & mask) ||
                (ut->uu_sigwait & mask) ||
                (ut->uu_sigmask & mask) ||
                (ps->ps_sigact[SIGSEGV] == SIG_IGN) ||
                (! (ps->ps_sigonstack & mask))) {
                    p->p_sigignore &= ~mask;
                    p->p_sigcatch &= ~mask;
                    ps->ps_sigact[SIGSEGV] = SIG_DFL;
                    ut->uu_sigwait &= ~mask;
                    ut->uu_sigmask &= ~mask;
                }
            }
        }
        /*
         *  发送信号
         */
        if (ux_signal != 0) {
            ut->uu_exception = exception;
            //ut->uu_code = code[0]; // filled in by threadsignal
            ut->uu_subcode = code[1];           
            threadsignal(th_act, ux_signal, code[0], TRUE);
        }
        if (p != NULL) 
            proc_rele(p);
        thread_deallocate(th_act);
    }
    else
        result = KERN_INVALID_ARGUMENT;
    }
    else
        result = KERN_INVALID_ARGUMENT;

    /*
     *  Delete our send rights to the task port.
     */
    (void)mach_port_deallocate(get_task_ipcspace(ux_handler_self), task_name);

    return (result);
}

到这里源码上面的mach exception 转 signal 的流程就走完了。看图大概更直观：

mach-signal流程.jpg

signal类型

signal类型.jpg

signal类型2.jpg

signal解释.jpg

signal异常捕获

• 获取已存在的异常处理句柄
• 设置新的异常处理句柄

    //用于储存已存在的异常处理句柄
    static struct sigaction* dt_previousSignalHandlers = NULL;
    #define PreviousSignalHandlersSize sizeof(*dt_previousSignalHandlers)

    int getPreviousSignalHandlers() {
        //初始化内存。
        /*
            self.signals = @[@SIGABRT,
                     @SIGBUS,
                     @SIGFPE,
                     @SIGILL,
                     @SIGPIPE,
                     @SIGSEGV,
                     @SIGSYS,
                     @SIGTRAP];
        */
        dt_previousSignalHandlers = malloc(PreviousSignalHandlersSize * self.signals.count);
        
        struct sigaction action = {{0}};
        action.sa_flags = SA_SIGINFO | SA_ONSTACK;
    #if defined(__LP64__)
        action.sa_flags |= SA_64REGSET;
    #endif
        sigemptyset(&action.sa_mask);
        action.sa_sigaction = &handleSignal;
        
        for (int i = 0; i < self.signals.count;  i++) {
        int signum =((NSNumber *)self.signals[i]).intValue;
        //保存原来的异常处理句柄，设置新的异常处理句柄
        int result = sigaction(signum,
                               &action,
                               &dt_previousSignalHandlers[i]);
        if (result != 0) {
            for (i -- ; i >= 0 ; i --) {
                sigaction(signum,
                 &dt_previousSignalHandlers[i], 
                 NULL);
            }
            return -1;
        }
        return 0;
    }

• 实现异常处理方法

    static void handleSignal(int sigNum, siginfo_t* signalInfo, void* userContext) {
                #ifdef __arm64__
    #define UC_MCONTEXT uc_mcontext64
        typedef ucontext64_t SignalUserContext;
    #else
    #define UC_MCONTEXT uc_mcontext
        typedef ucontext_t SignalUserContext;
    #endif
        //可以从uc中拿到backtrace

        _STRUCT_MCONTEXT *uc = ((SignalUserContext*)userContext)->UC_MCONTEXT;
        
      int signalNum = signalInfo->si_signo;
      int signalCode = signalInfo->si_code;
      uintptr_t  signalAddress = (uintptr_t)signalInfo->si_addr;    
      raise(sigNum);

    }

• 重置异常处理句柄

    void resetSignalHandler() {
        for (int i = 0; i < self.signals.count; ++ i) {
            int signum =((NSNumber *)self.signals[i]).intValue;
  
            int result = sigaction(signum, &cuckoo_previousSignalHandlers[i], NULL);
            if (result != 0) {
                CuckooError(@"Sigaction uninstall failure:using default signal %d",signum);
                struct sigaction sa;
                
                memset(&sa, 0, sizeof(sa));
                sa.sa_handler = SIG_ERR;
                sigemptyset(&sa.sa_mask);
                sigaction(signum, &sa, NULL);
            }
        }
    }
  

堆栈解析###

详见堆栈解析