Move start-address finding to Target, implement fallback if main executable does not have a start address

[jasonmolenda]

Summary

On the upcoming version of macOS, 10.15 or Catalina, there are userlang kernel drivers ("DriverKit" processes) and one unique thing about a DriverKit main binary is that it has no start address load command in the same way that a normal user process binary has. lldb uses the entry address ("main") as a function address that is never called during the normal execution of the program, after the process has started, for doing inferior function calls. It creates a fake stack frame with "main" as the return address, puts a breakpoint on main, and uses that breakpoint hit to indicate that the function call completed successfully. Because DriverKit processes don't have a traditional main, lldb can't do inferior function calls.

Currently this is found in ThreadPlanCallFunction::ConstructorSetup - it finds the Target's main executable, asks for its entry address. This patch moves that code into a new Target::GetEntryPointAddress method which tries the main executable, but if that executable fails, steps through every other Module asking if there is an entry address for that module. The patch also changes ObjectFileMachO to look for the function _dyld_start in the dyld binary -- another function that is never called -- and uses that as a backup entry address function.

Testing this is a bit difficult - these DriverKit userland drivers are not launched like normal processes, we can't run a test DriverKit from the testsuite under lldb. I'm still thinking about this; to test this by hand I #if 0'ed out ObjectFileMachO's normal entry address logic (looking at LC_MAIN load command etc) so it had to fall back to the _dyld_start one.

[jingham]

I wonder if we ought to allow target properties (target as an example) that are only for testing, so they don't print when you do settings list, etc. But the we could have some settings like a "target.testing.dont-read-LC_MAIN" and that would make it easy to automate your hand testing. Kind of like the "experimental" decorator, except you have to know they exist to use them...

[jasonmolenda]

Hm, that could be really helpful! I think I'd like to do that as a separate piece of work a little bit later, but I'll look at that.

lldb/trunk/include/lldb/Target/Target.h

void ApplyNameToBreakpoints(BreakpointName &bp_name);
 
   /// Return the next available number for numbered persistent variables.
   unsigned GetNextPersistentVariableIndex() {
     return m_next_persistent_variable_index++;
   }
 
   lldb::addr_t GetPersistentSymbol(ConstString name);
 
+  /// This method will return the address of the starting function for
+  /// this binary, e.g. main() or its equivalent.  This can be used as
+  /// an address of a function that is not called once a binary has 
+  /// started running - e.g. as a return address for inferior function
+  /// calls that are unambiguous completion of the function call, not
+  /// called during the course of the inferior function code running.
+  ///
+  /// If no entry point can be found, an invalid address is returned.
+  ///
+  /// \param [out] err
+  ///     This object will be set to failure if no entry address could
+  ///     be found, and may contain a helpful error message.
+  //
+  /// \return
+  ///     Returns the entry address for this program, LLDB_INVALID_ADDRESS
+  ///     if none can be found.
+  lldb_private::Address GetEntryPointAddress(Status &err);
+
   // Target Stop Hooks
   class StopHook : public UserID {
   public:
     StopHook(const StopHook &rhs);
 
     ~StopHook();
 
     StringList *GetCommandPointer() { return &m_commands; }

lldb/trunk/source/Plugins/ObjectFile/Mach-O/ObjectFileMachO.h

public:
 
   bool SetLoadAddress(lldb_private::Target &target, lldb::addr_t value,
                       bool value_is_offset) override;
 
   lldb::ByteOrder GetByteOrder() const override;
 
   bool IsExecutable() const override;
 
+  bool IsDynamicLoader() const;
+
   uint32_t GetAddressByteSize() const override;
 
   lldb_private::AddressClass GetAddressClass(lldb::addr_t file_addr) override;
 
   lldb_private::Symtab *GetSymtab() override;
 
   bool IsStripped() override;
 

lldb/trunk/source/Plugins/ObjectFile/Mach-O/ObjectFileMachO.cpp

 ByteOrder ObjectFileMachO::GetByteOrder() const {
   return m_data.GetByteOrder();
 }
 
 bool ObjectFileMachO::IsExecutable() const {
   return m_header.filetype == MH_EXECUTE;
 }
 
+bool ObjectFileMachO::IsDynamicLoader() const {
+  return m_header.filetype == MH_DYLINKER;
+}
+
 uint32_t ObjectFileMachO::GetAddressByteSize() const {
   return m_data.GetAddressByteSize();
 }
 
 AddressClass ObjectFileMachO::GetAddressClass(lldb::addr_t file_addr) {
   Symtab *symtab = GetSymtab();
   if (symtab) {
     Symbol *symbol = symtab->FindSymbolContainingFileAddress(file_addr);

 }
 
 lldb_private::Address ObjectFileMachO::GetEntryPointAddress() {
   // If the object file is not an executable it can't hold the entry point.
   // m_entry_point_address is initialized to an invalid address, so we can just
   // return that. If m_entry_point_address is valid it means we've found it
   // already, so return the cached value.
 
-  if (!IsExecutable() || m_entry_point_address.IsValid())
+  if ((!IsExecutable() && !IsDynamicLoader()) || 
+      m_entry_point_address.IsValid()) {
     return m_entry_point_address;
+  }
 
   // Otherwise, look for the UnixThread or Thread command.  The data for the
   // Thread command is given in /usr/include/mach-o.h, but it is basically:
   //
   //  uint32_t flavor  - this is the flavor argument you would pass to
   //  thread_get_state
   //  uint32_t count   - this is the count of longs in the thread state data
   //  struct XXX_thread_state state - this is the structure from
for (i = 0; i < m_header.ncmds; ++i) {
       }
       if (done)
         break;
 
       // Go to the next load command:
       offset = cmd_offset + load_cmd.cmdsize;
     }
 
+    if (start_address == LLDB_INVALID_ADDRESS && IsDynamicLoader()) {
+      if (GetSymtab()) {
+        Symbol *dyld_start_sym = GetSymtab()->FindFirstSymbolWithNameAndType(
+                      ConstString("_dyld_start"), SymbolType::eSymbolTypeCode, 
+                      Symtab::eDebugAny, Symtab::eVisibilityAny);
+        if (dyld_start_sym && dyld_start_sym->GetAddress().IsValid()) {
+          start_address = dyld_start_sym->GetAddress().GetFileAddress();
+        }
+      }
+    }
+
     if (start_address != LLDB_INVALID_ADDRESS) {
       // We got the start address from the load commands, so now resolve that
       // address in the sections of this ObjectFile:
       if (!m_entry_point_address.ResolveAddressUsingFileSections(
               start_address, GetSectionList())) {
         m_entry_point_address.Clear();
       }
     } else {

lldb/trunk/source/Target/Target.cpp

m_scratch_type_system_map.ForEach(
           if (address != LLDB_INVALID_ADDRESS)
             return false; // Stop iterating the ForEach
         }
         return true; // Keep iterating the ForEach
       });
   return address;
 }
 
+lldb_private::Address Target::GetEntryPointAddress(Status &err) {
+  err.Clear();
+  Address entry_addr;
+  Module *exe_module = GetExecutableModulePointer();
+
+  if (!exe_module || !exe_module->GetObjectFile()) {
+    err.SetErrorStringWithFormat("No primary executable found");
+  } else {
+    entry_addr = exe_module->GetObjectFile()->GetEntryPointAddress();
+    if (!entry_addr.IsValid()) {
+      err.SetErrorStringWithFormat(
+         "Could not find entry point address for executable module \"%s\".",
+         exe_module->GetFileSpec().GetFilename().AsCString());
+    }
+  }
+
+  if (!entry_addr.IsValid()) {
+    const ModuleList &modules = GetImages();
+    const size_t num_images = modules.GetSize();
+    for (size_t idx = 0; idx < num_images; ++idx) {
+      ModuleSP module_sp(modules.GetModuleAtIndex(idx));
+      if (module_sp && module_sp->GetObjectFile()) {
+        entry_addr = module_sp->GetObjectFile()->GetEntryPointAddress();
+        if (entry_addr.IsValid()) {
+          // Clear out any old error messages from the original
+          // main-executable-binary search; one of the other modules
+          // was able to provide an address.
+          err.Clear();
+          break;
+        }
+      }
+    }
+  }
+
+  return entry_addr;
+}
+
+
 lldb::addr_t Target::GetCallableLoadAddress(lldb::addr_t load_addr,
                                             AddressClass addr_class) const {
   auto arch_plugin = GetArchitecturePlugin();
   return arch_plugin ?
       arch_plugin->GetCallableLoadAddress(load_addr, addr_class) : load_addr;
 }
 
 lldb::addr_t Target::GetOpcodeLoadAddress(lldb::addr_t load_addr,

lldb/trunk/source/Target/ThreadPlanCallFunction.cpp

m_constructor_errors.Printf(
         "Trying to put the stack in unreadable memory at: 0x%" PRIx64 ".",
         m_function_sp);
     if (log)
       log->Printf("ThreadPlanCallFunction(%p): %s.", static_cast<void *>(this),
                   m_constructor_errors.GetData());
     return false;
   }
 
-  Module *exe_module = GetTarget().GetExecutableModulePointer();
+  m_start_addr = GetTarget().GetEntryPointAddress(error);
 
-  if (exe_module == nullptr) {
-    m_constructor_errors.Printf(
-        "Can't execute code without an executable module.");
-    if (log)
-      log->Printf("ThreadPlanCallFunction(%p): %s.", static_cast<void *>(this),
-                  m_constructor_errors.GetData());
+  if (log && error.Fail()) {
+    m_constructor_errors.Printf("%s", error.AsCString());
     return false;
-  } else {
-    ObjectFile *objectFile = exe_module->GetObjectFile();
-    if (!objectFile) {
-      m_constructor_errors.Printf(
-          "Could not find object file for module \"%s\".",
-          exe_module->GetFileSpec().GetFilename().AsCString());
-
-      if (log)
-        log->Printf("ThreadPlanCallFunction(%p): %s.",
-                    static_cast<void *>(this), m_constructor_errors.GetData());
-      return false;
-    }
 
-    m_start_addr = objectFile->GetEntryPointAddress();
-    if (!m_start_addr.IsValid()) {
-      m_constructor_errors.Printf(
-          "Could not find entry point address for executable module \"%s\".",
-          exe_module->GetFileSpec().GetFilename().AsCString());
-      if (log)
-        log->Printf("ThreadPlanCallFunction(%p): %s.",
-                    static_cast<void *>(this), m_constructor_errors.GetData());
-      return false;
-    }
-  }
 
   start_load_addr = m_start_addr.GetLoadAddress(&GetTarget());
 
   // Checkpoint the thread state so we can restore it later.
   if (log && log->GetVerbose())
     ReportRegisterState("About to checkpoint thread before function call.  "
                         "Original register state was:");