/* $NetBSD: mdreloc.c,v 1.19 2024/07/22 23:10:35 riastradh Exp $ */

/*-
 * Copyright (c) 2014 The NetBSD Foundation, Inc.
 * All rights reserved.
 *
 * This code is derived from software contributed to The NetBSD Foundation
 * by Matt Thomas of 3am Software Foundry.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

/*-
 * Copyright (c) 2014-2015 The FreeBSD Foundation
 * All rights reserved.
 *
 * Portions of this software were developed by Andrew Turner
 * under sponsorship from the FreeBSD Foundation.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include <sys/cdefs.h>
#ifndef lint
__RCSID("$NetBSD: mdreloc.c,v 1.19 2024/07/22 23:10:35 riastradh Exp $");
#endif /* not lint */

/*
 * AArch64 ELF relocations.
 *
 * References:
 *
 *      [AAELF64] ELF for the Arm 64-bit Architecture (AArch64),
 *      2022Q3.  Arm Ltd.
 *      https://github.com/ARM-software/abi-aa/blob/2982a9f3b512a5bfdc9e3fea5d3b298f9165c36b/aaelf64/aaelf64.rst
 *
 *      [TLSDESC] Glauber de Oliveira Costa and Alexandre Oliva,
 *      `Thread-Local Storage Access in Dynamic Libraries in the ARM
 *      Platform', 2006.
 *      https://www.fsfla.org/~lxoliva/writeups/TLS/paper-lk2006.pdf
 */

#include <sys/types.h>
#include <string.h>

#include "debug.h"
#include "rtld.h"

struct tls_data {
        size_t          td_tlsindex;
        Elf_Addr        td_tlsoffs;
};

void _rtld_bind_start(void);
void _rtld_relocate_nonplt_self(Elf_Dyn *, Elf_Addr);
Elf_Addr _rtld_bind(const Obj_Entry *, Elf_Word);
void *_rtld_tlsdesc_static(void *);
void *_rtld_tlsdesc_undef(void *);
void *_rtld_tlsdesc_dynamic(void *);

/*
 * AARCH64 PLT looks like this;
 *
 *      PLT HEADER <8 instructions>
 *      PLT ENTRY #0 <4 instructions>
 *      PLT ENTRY #1 <4 instructions>
 *      .
 *      .
 *      PLT ENTRY #n <4 instructions>
 *
 * PLT HEADER
 *      stp  x16, x30, [sp, #-16]!
 *      adrp x16, (GOT+16)
 *      ldr  x17, [x16, #PLT_GOT+0x10]
 *      add  x16, x16, #PLT_GOT+0x10
 *      br   x17
 *      nop
 *      nop
 *      nop
 *
 * PLT ENTRY #n
 *      adrp x16, PLTGOT + n * 8
 *      ldr  x17, [x16, PLTGOT + n * 8]
 *      add  x16, x16, :lo12:PLTGOT + n * 8
 *      br   x17
 */
void
_rtld_setup_pltgot(const Obj_Entry *obj)
{

        obj->pltgot[1] = (Elf_Addr) obj;
        obj->pltgot[2] = (Elf_Addr) &_rtld_bind_start;
}

static struct tls_data *
_rtld_tlsdesc_alloc(size_t tlsindex, Elf_Addr offs)
{
        struct tls_data *tlsdesc;

        tlsdesc = xmalloc(sizeof(*tlsdesc));
        tlsdesc->td_tlsindex = tlsindex;
        tlsdesc->td_tlsoffs = offs;

        return tlsdesc;
}

static void
_rtld_tlsdesc_fill(const Obj_Entry *obj, const Elf_Rela *rela, Elf_Addr *where, u_int flags)
{
        const Elf_Sym *def;
        const Obj_Entry *defobj;
        Elf_Addr offs = 0;
        unsigned long symnum = ELF_R_SYM(rela->r_info);

        if (symnum != 0) {
                def = _rtld_find_symdef(ELF_R_SYM(rela->r_info), obj, &defobj,
                    flags);
                if (def == NULL)
                        _rtld_die();
                if (def == &_rtld_sym_zero) {
                        /* Weak undefined thread variable */
                        where[0] = (Elf_Addr)_rtld_tlsdesc_undef;
                        where[1] = rela->r_addend;

                        rdbg(("TLSDESC %s (weak) in %s --> %p",
                            obj->strtab + obj->symtab[symnum].st_name,
                            obj->path, (void *)where[1]));

                        return;
                }
                offs = def->st_value;
        } else {
                defobj = obj;
        }
        offs += rela->r_addend;

        if (defobj->tls_static) {
                /* Variable is in initially allocated TLS segment */
                where[0] = (Elf_Addr)_rtld_tlsdesc_static;
                where[1] = defobj->tlsoffset + offs +
                    sizeof(struct tls_tcb);

                rdbg(("TLSDESC %s --> %p static",
                    obj->path, (void *)where[1]));
        } else {
                /* TLS offset is unknown at load time, use dynamic resolving */
                where[0] = (Elf_Addr)_rtld_tlsdesc_dynamic;
                where[1] = (Elf_Addr)_rtld_tlsdesc_alloc(defobj->tlsindex, offs);

                rdbg(("TLSDESC %s in %s --> %p dynamic (%zu, %p)",
                    obj->strtab + obj->symtab[symnum].st_name,
                    obj->path, (void *)where[1], defobj->tlsindex, (void *)offs));
        }
}

void
_rtld_relocate_nonplt_self(Elf_Dyn *dynp, Elf_Addr relocbase)
{
        const Elf_Rela *rela = 0, *relalim;
        Elf_Addr relasz = 0;
        Elf_Addr *where;

        for (; dynp->d_tag != DT_NULL; dynp++) {
                switch (dynp->d_tag) {
                case DT_RELA:
                        rela = (const Elf_Rela *)(relocbase + dynp->d_un.d_ptr);
                        break;
                case DT_RELASZ:
                        relasz = dynp->d_un.d_val;
                        break;
                }
        }
        relalim = (const Elf_Rela *)((const uint8_t *)rela + relasz);
        for (; rela < relalim; rela++) {
                where = (Elf_Addr *)(relocbase + rela->r_offset);
                *where += (Elf_Addr)relocbase;
        }
}

int
_rtld_relocate_nonplt_objects(Obj_Entry *obj)
{
        const Elf_Sym *def = NULL;
        const Obj_Entry *defobj = NULL;
        unsigned long last_symnum = ULONG_MAX;

        for (const Elf_Rela *rela = obj->rela; rela < obj->relalim; rela++) {
                Elf_Addr        *where;
                Elf_Addr        tmp;
                unsigned long   symnum = ULONG_MAX;

                where = (Elf_Addr *)(obj->relocbase + rela->r_offset);

                switch (ELF_R_TYPE(rela->r_info)) {
                case R_TYPE(ABS64):     /* word S + A */
                case R_TYPE(GLOB_DAT):  /* word S + A */
                case R_TLS_TYPE(TLS_DTPREL):
                case R_TLS_TYPE(TLS_DTPMOD):
                case R_TLS_TYPE(TLS_TPREL):
                        symnum = ELF_R_SYM(rela->r_info);
                        if (last_symnum != symnum) {
                                last_symnum = symnum;
                                def = _rtld_find_symdef(symnum, obj, &defobj,
                                    false);
                                if (def == NULL)
                                        return -1;
                        }

                default:
                        break;
                }

                switch (ELF_R_TYPE(rela->r_info)) {
                case R_TYPE(NONE):
                        break;

                case R_TYPE(ABS64):     /* word S + A */
                case R_TYPE(GLOB_DAT):  /* word S + A */
                        tmp = (Elf_Addr)defobj->relocbase + def->st_value +
                            rela->r_addend;
                        if (*where != tmp)
                                *where = tmp;
                        rdbg(("ABS64/GLOB_DAT %s in %s --> %p @ %p in %s",
                            obj->strtab + obj->symtab[symnum].st_name,
                            obj->path, (void *)tmp, where, defobj->path));
                        break;

                case R_TYPE(IRELATIVE):
                        /* IFUNC relocations are handled in _rtld_call_ifunc */
                        if (obj->ifunc_remaining_nonplt == 0)
                                obj->ifunc_remaining_nonplt = obj->relalim - rela;
                        rdbg(("IRELATIVE in %s, %zx", obj->path,
                            obj->ifunc_remaining_nonplt));
                        /* FALLTHROUGH */

                case R_TYPE(RELATIVE):  /* word B + A */
                        *where = (Elf_Addr)(obj->relocbase + rela->r_addend);
                        rdbg(("RELATIVE in %s --> %p", obj->path,
                            (void *)*where));
                        break;

                case R_TYPE(COPY):
                        /*
                         * These are deferred until all other relocations have
                         * been done.  All we do here is make sure that the
                         * COPY relocation is not in a shared library.  They
                         * are allowed only in executable files.
                         */
                        if (obj->isdynamic) {
                                _rtld_error(
                        "%s: Unexpected R_COPY relocation in shared library",
                                    obj->path);
                                return -1;
                        }
                        rdbg(("COPY (avoid in main)"));
                        break;

                case R_TYPE(TLSDESC):
                        _rtld_tlsdesc_fill(obj, rela, where, 0);
                        break;

                case R_TLS_TYPE(TLS_DTPREL):
                        *where = (Elf_Addr)(def->st_value + rela->r_addend);

                        rdbg(("TLS_DTPREL %s in %s --> %p",
                            obj->strtab + obj->symtab[symnum].st_name,
                            obj->path, (void *)*where));
                        break;

                case R_TLS_TYPE(TLS_DTPMOD):
                        *where = (Elf_Addr)(defobj->tlsindex);

                        rdbg(("TLS_DTPMOD %s in %s --> %p",
                            obj->strtab + obj->symtab[symnum].st_name,
                            obj->path, (void *)*where));
                        break;

                case R_TLS_TYPE(TLS_TPREL):
                        if (!defobj->tls_static &&
                            _rtld_tls_offset_allocate(__UNCONST(defobj)))
                                return -1;

                        *where = (Elf_Addr)(def->st_value + defobj->tlsoffset +
                            rela->r_addend + sizeof(struct tls_tcb));

                        rdbg(("TLS_TPREL %s in %s --> %p in %s",
                            obj->strtab + obj->symtab[symnum].st_name,
                            obj->path, (void *)*where, defobj->path));
                        break;

                default:
                        rdbg(("sym = %lu, type = %lu, offset = %p, "
                            "addend = %p, contents = %p",
                            (u_long)ELF_R_SYM(rela->r_info),
                            (u_long)ELF_R_TYPE(rela->r_info),
                            (void *)rela->r_offset, (void *)rela->r_addend,
                            (void *)*where));
                        _rtld_error("%s: Unsupported relocation type %ld "
                            "in non-PLT relocations",
                            obj->path, (u_long) ELF_R_TYPE(rela->r_info));
                        return -1;
                }
        }
        return 0;
}

int
_rtld_relocate_plt_lazy(Obj_Entry *obj)
{

        if (!obj->relocbase)
                return 0;

        for (const Elf_Rela *rela = obj->pltrela; rela < obj->pltrelalim; rela++) {
                Elf_Addr *where = (Elf_Addr *)(obj->relocbase + rela->r_offset);

                assert(ELF_R_TYPE(rela->r_info) == R_TYPE(JUMP_SLOT) ||
                       ELF_R_TYPE(rela->r_info) == R_TYPE(TLSDESC) ||
                       ELF_R_TYPE(rela->r_info) == R_TYPE(IRELATIVE));

                switch (ELF_R_TYPE(rela->r_info)) {
                case R_TYPE(JUMP_SLOT):
                        /* Just relocate the GOT slots pointing into the PLT */
                        *where += (Elf_Addr)obj->relocbase;
                        rdbg(("fixup !main in %s --> %p", obj->path, (void *)*where));
                        break;
                case R_TYPE(TLSDESC):
                        _rtld_tlsdesc_fill(obj, rela, where, SYMLOOK_IN_PLT);
                        break;
                case R_TYPE(IRELATIVE):
                        obj->ifunc_remaining = obj->pltrelalim - rela;
                        break;
                }
        }

        return 0;
}

void
_rtld_call_ifunc(Obj_Entry *obj, sigset_t *mask, u_int cur_objgen)
{
        const Elf_Rela *rela;
        Elf_Addr *where, target;

        while (obj->ifunc_remaining > 0 && _rtld_objgen == cur_objgen) {
                rela = obj->pltrelalim - obj->ifunc_remaining;
                --obj->ifunc_remaining;
                if (ELF_R_TYPE(rela->r_info) == R_TYPE(IRELATIVE)) {
                        where = (Elf_Addr *)(obj->relocbase + rela->r_offset);
                        target = (Elf_Addr)(obj->relocbase + rela->r_addend);
                        _rtld_exclusive_exit(mask);
                        target = _rtld_resolve_ifunc2(obj, target);
                        _rtld_exclusive_enter(mask);
                        if (*where != target)
                                *where = target;
                }
        }
}

static int
_rtld_relocate_plt_object(const Obj_Entry *obj, const Elf_Rela *rela,
        Elf_Addr *tp)
{
        Elf_Addr *where = (Elf_Addr *)(obj->relocbase + rela->r_offset);
        Elf_Addr new_value;
        const Elf_Sym  *def;
        const Obj_Entry *defobj;

        switch (ELF_R_TYPE(rela->r_info)) {
        case R_TYPE(JUMP_SLOT):
                def = _rtld_find_plt_symdef(ELF_R_SYM(rela->r_info), obj,
                    &defobj, tp != NULL);
                if (__predict_false(def == NULL))
                        return -1;
                if (__predict_false(def == &_rtld_sym_zero))
                        return 0;

                if (ELF_ST_TYPE(def->st_info) == STT_GNU_IFUNC) {
                        if (tp == NULL)
                                return 0;
                        new_value = _rtld_resolve_ifunc(defobj, def);
                } else {
                        new_value = (Elf_Addr)(defobj->relocbase +
                             def->st_value);
                }
                rdbg(("bind now/fixup in %s --> old=%p new=%p",
                    defobj->strtab + def->st_name, (void *)*where,
                    (void *)new_value));
                if (*where != new_value)
                        *where = new_value;
                if (tp)
                        *tp = new_value;
                break;
        case R_TYPE(TLSDESC):
                _rtld_tlsdesc_fill(obj, rela, where, SYMLOOK_IN_PLT);
                break;
        }

        return 0;
}

Elf_Addr
_rtld_bind(const Obj_Entry *obj, Elf_Word relaidx)
{
        const Elf_Rela *rela = obj->pltrela + relaidx;
        Elf_Addr new_value = 0;

        _rtld_shared_enter();
        int err = _rtld_relocate_plt_object(obj, rela, &new_value);
        if (err)
                _rtld_die();
        _rtld_shared_exit();

        return new_value;
}
int
_rtld_relocate_plt_objects(const Obj_Entry *obj)
{
        const Elf_Rela *rela;
        int err = 0;

        for (rela = obj->pltrela; rela < obj->pltrelalim; rela++) {
                err = _rtld_relocate_plt_object(obj, rela, NULL);
                if (err)
                        break;
        }

        return err;
}