elf.c

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * elf.c - ELF access library
 *
 * Adapted from kpatch (https://github.com/dynup/kpatch):
 * Copyright (C) 2013-2015 Josh Poimboeuf <jpoimboe@redhat.com>
 * Copyright (C) 2014 Seth Jennings <sjenning@redhat.com>
 */

#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <ctype.h>
#include <linux/align.h>
#include <linux/kernel.h>
#include <linux/interval_tree_generic.h>
#include <linux/log2.h>
#include <objtool/builtin.h>
#include <objtool/elf.h>
#include <objtool/klp.h>
#include <objtool/warn.h>

static ssize_t demangled_name_len(const char *name);

u32 str_hash_demangled(const char *str)
{
	return jhash(str, demangled_name_len(str), 0);
}

#define elf_hash_add(name, node, key)					\
({									\
	struct elf_hash_node *__node = node;				\
	__node->next = __elf_table_entry(elf, name, key);		\
	__elf_table_entry(elf, name, key) = __node;			\
})

static inline void __elf_hash_del(struct elf_hash_node *node,
				  struct elf_hash_node **head)
{
	struct elf_hash_node *cur, *prev;

	if (node == *head) {
		*head = node->next;
		return;
	}

	for (prev = NULL, cur = *head; cur; prev = cur, cur = cur->next) {
		if (cur == node) {
			prev->next = cur->next;
			break;
		}
	}
}

#define elf_hash_del(name, node, key) \
	__elf_hash_del(node, &__elf_table_entry(elf, name, key))

#define elf_alloc_hash(name, size)					\
({									\
	__elf_bits(elf, name) = max(10, ilog2(size));			\
	__elf_table(elf, name) = mmap(NULL,				\
				 sizeof(struct elf_hash_node *) << __elf_bits(elf, name), \
				 PROT_READ|PROT_WRITE,			\
				 MAP_PRIVATE|MAP_ANON, -1, 0);		\
	if (__elf_table(elf, name) == (void *)-1L) {			\
		ERROR_GLIBC("mmap fail " #name);			\
		__elf_table(elf, name) = NULL;				\
	}								\
	__elf_table(elf, name);						\
})

static inline unsigned long __sym_start(struct symbol *s)
{
	return s->offset;
}

static inline unsigned long __sym_last(struct symbol *s)
{
	return s->offset + (s->len ? s->len - 1 : 0);
}

INTERVAL_TREE_DEFINE(struct symbol, node, unsigned long, __subtree_last,
		     __sym_start, __sym_last, static inline __maybe_unused,
		     __sym)

#define __sym_for_each(_iter, _tree, _start, _end)			\
	for (_iter = __sym_iter_first((_tree), (_start), (_end));	\
	     _iter; _iter = __sym_iter_next(_iter, (_start), (_end)))

struct symbol_hole {
	unsigned long key;
	const struct symbol *sym;
};

/*
 * Find the last symbol before @offset.
 */
static int symbol_hole_by_offset(const void *key, const struct rb_node *node)
{
	const struct symbol *s = rb_entry(node, struct symbol, node);
	struct symbol_hole *sh = (void *)key;

	if (sh->key < s->offset)
		return -1;

	if (sh->key >= s->offset + s->len) {
		sh->sym = s;
		return 1;
	}

	return 0;
}

struct section *find_section_by_name(const struct elf *elf, const char *name)
{
	struct section *sec;

	elf_hash_for_each_possible(elf, section_name, sec, name_hash, str_hash(name)) {
		if (!strcmp(sec->name, name))
			return sec;
	}

	return NULL;
}

static struct section *find_section_by_index(struct elf *elf,
					     unsigned int idx)
{
	struct section *sec;

	elf_hash_for_each_possible(elf, section, sec, hash, idx) {
		if (sec->idx == idx)
			return sec;
	}

	return NULL;
}

static struct symbol *find_symbol_by_index(struct elf *elf, unsigned int idx)
{
	struct symbol *sym;

	elf_hash_for_each_possible(elf, symbol, sym, hash, idx) {
		if (sym->idx == idx)
			return sym;
	}

	return NULL;
}

struct symbol *find_symbol_by_offset(struct section *sec, unsigned long offset)
{
	struct rb_root_cached *tree = (struct rb_root_cached *)&sec->symbol_tree;
	struct symbol *sym;

	__sym_for_each(sym, tree, offset, offset) {
		if (sym->offset == offset && !is_sec_sym(sym))
			return sym->alias;
	}

	return NULL;
}

struct symbol *find_func_by_offset(struct section *sec, unsigned long offset)
{
	struct rb_root_cached *tree = (struct rb_root_cached *)&sec->symbol_tree;
	struct symbol *func;

	__sym_for_each(func, tree, offset, offset) {
		if (func->offset == offset && is_func_sym(func))
			return func->alias;
	}

	return NULL;
}

struct symbol *find_symbol_containing(const struct section *sec, unsigned long offset)
{
	struct rb_root_cached *tree = (struct rb_root_cached *)&sec->symbol_tree;
	struct symbol *sym = NULL, *tmp;

	__sym_for_each(tmp, tree, offset, offset) {
		if (tmp->len) {
			if (!sym) {
				sym = tmp;
				continue;
			}

			if (sym->offset != tmp->offset || sym->len != tmp->len) {
				/*
				 * In the rare case of overlapping symbols,
				 * pick the smaller one.
				 *
				 * TODO: outlaw overlapping symbols
				 */
				if (tmp->len < sym->len)
					sym = tmp;
			}
		}
	}

	return sym ? sym->alias : NULL;
}

/*
 * Also match the symbol end address which can be used for a bounds comparison.
 */
struct symbol *find_symbol_containing_inclusive(const struct section *sec,
						unsigned long offset)
{
	struct symbol *sym = find_symbol_containing(sec, offset);

	if (!sym && offset)
		sym = find_symbol_containing(sec, offset - 1);

	return sym;
}

/*
 * Returns size of hole starting at @offset.
 */
int find_symbol_hole_containing(const struct section *sec, unsigned long offset)
{
	struct symbol_hole hole = {
		.key = offset,
		.sym = NULL,
	};
	struct rb_node *n;
	struct symbol *s;

	/*
	 * Find the rightmost symbol for which @offset is after it.
	 */
	n = rb_find(&hole, &sec->symbol_tree.rb_root, symbol_hole_by_offset);

	/* found a symbol that contains @offset */
	if (n)
		return 0; /* not a hole */

	/*
	 * @offset >= sym->offset + sym->len, find symbol after it.
	 * When hole.sym is empty, use the first node to compute the hole.
	 * If there is no symbol in the section, the first node will be NULL,
	 * in which case, -1 is returned to skip the whole section.
	 */
	if (hole.sym)
		n = rb_next(&hole.sym->node);
	else
		n = rb_first_cached(&sec->symbol_tree);

	if (!n)
		return -1; /* until end of address space */

	/* hole until start of next symbol */
	s = rb_entry(n, struct symbol, node);
	return s->offset - offset;
}

struct symbol *find_func_containing(struct section *sec, unsigned long offset)
{
	struct rb_root_cached *tree = (struct rb_root_cached *)&sec->symbol_tree;
	struct symbol *func;

	__sym_for_each(func, tree, offset, offset) {
		if (is_func_sym(func))
			return func->alias;
	}

	return NULL;
}

struct symbol *find_symbol_by_name(const struct elf *elf, const char *name)
{
	struct symbol *sym;

	elf_hash_for_each_possible(elf, symbol_name, sym, name_hash, str_hash(name)) {
		if (!strcmp(sym->name, name))
			return sym;
	}

	return NULL;
}

/* Find local symbol with matching STT_FILE */
static struct symbol *find_local_symbol_by_file_and_name(const struct elf *elf,
							 struct symbol *file,
							 const char *name)
{
	struct symbol *sym;

	elf_hash_for_each_possible(elf, symbol_name, sym, name_hash, str_hash_demangled(name)) {
		if (sym->bind == STB_LOCAL && sym->file == file &&
		    !strcmp(sym->name, name)) {
			return sym;
		}
	}

	return NULL;
}

struct symbol *find_global_symbol_by_name(const struct elf *elf, const char *name)
{
	struct symbol *sym;

	elf_hash_for_each_possible(elf, symbol_name, sym, name_hash, str_hash_demangled(name)) {
		if (!strcmp(sym->name, name) && !is_local_sym(sym))
			return sym;
	}

	return NULL;
}

/* If there are multiple matches, return the first one in the range */
struct reloc *find_reloc_by_dest_range(const struct elf *elf, struct section *sec,
				       unsigned long offset, unsigned int len)
{
	struct reloc *reloc, *r = NULL;
	struct section *rsec;
	unsigned long o;

	rsec = sec->rsec;
	if (!rsec)
		return NULL;

	for_offset_range(o, offset, offset + len) {
		elf_hash_for_each_possible(elf, reloc, reloc, hash,
					   sec_offset_hash(rsec, o)) {
			if (reloc->sec != rsec)
				continue;

			if (reloc_offset(reloc) >= offset &&
			    reloc_offset(reloc) < offset + len) {
				if (!r || reloc_offset(reloc) < reloc_offset(r))
					r = reloc;
			}
		}
		if (r && (reloc_offset(r) & OFFSET_STRIDE_MASK) == o)
			return r;
	}

	return r;
}

struct reloc *find_reloc_by_dest(const struct elf *elf, struct section *sec, unsigned long offset)
{
	return find_reloc_by_dest_range(elf, sec, offset, 1);
}

static bool is_dwarf_section(struct section *sec)
{
	return !strncmp(sec->name, ".debug_", 7);
}

static int read_sections(struct elf *elf)
{
	Elf_Scn *s = NULL;
	struct section *sec;
	size_t shstrndx, sections_nr;
	int i;

	if (elf_getshdrnum(elf->elf, &sections_nr)) {
		ERROR_ELF("elf_getshdrnum");
		return -1;
	}

	if (elf_getshdrstrndx(elf->elf, &shstrndx)) {
		ERROR_ELF("elf_getshdrstrndx");
		return -1;
	}

	if (!elf_alloc_hash(section, sections_nr) ||
	    !elf_alloc_hash(section_name, sections_nr))
		return -1;

	elf->section_data = calloc(sections_nr, sizeof(*sec));
	if (!elf->section_data) {
		ERROR_GLIBC("calloc");
		return -1;
	}
	for (i = 0; i < sections_nr; i++) {
		sec = &elf->section_data[i];

		INIT_LIST_HEAD(&sec->symbol_list);

		s = elf_getscn(elf->elf, i);
		if (!s) {
			ERROR_ELF("elf_getscn");
			return -1;
		}

		sec->idx = elf_ndxscn(s);

		if (!gelf_getshdr(s, &sec->sh)) {
			ERROR_ELF("gelf_getshdr");
			return -1;
		}

		sec->name = elf_strptr(elf->elf, shstrndx, sec->sh.sh_name);
		if (!sec->name) {
			ERROR_ELF("elf_strptr");
			return -1;
		}

		if (sec_size(sec) != 0 && !is_dwarf_section(sec)) {
			sec->data = elf_getdata(s, NULL);
			if (!sec->data) {
				ERROR_ELF("elf_getdata");
				return -1;
			}
			if (sec->data->d_off != 0 ||
			    sec->data->d_size != sec_size(sec)) {
				ERROR("unexpected data attributes for %s", sec->name);
				return -1;
			}
		}

		list_add_tail(&sec->list, &elf->sections);
		elf_hash_add(section, &sec->hash, sec->idx);
		elf_hash_add(section_name, &sec->name_hash, str_hash(sec->name));

		if (is_reloc_sec(sec))
			elf->num_relocs += sec_num_entries(sec);
	}

	if (opts.stats) {
		printf("nr_sections: %lu\n", (unsigned long)sections_nr);
		printf("section_bits: %d\n", elf->section_bits);
	}

	/* sanity check, one more call to elf_nextscn() should return NULL */
	if (elf_nextscn(elf->elf, s)) {
		ERROR("section entry mismatch");
		return -1;
	}

	return 0;
}

/*
 * Returns desired length of the demangled name.
 * If name doesn't need demangling, return strlen(name).
 */
static ssize_t demangled_name_len(const char *name)
{
	ssize_t idx;
	const char *p;

	p = strstr(name, ".llvm.");
	if (p)
		return p - name;

	if (!strstarts(name, "__UNIQUE_ID_") && !strchr(name, '.'))
		return strlen(name);

	for (idx = strlen(name) - 1; idx >= 0; idx--) {
		char c = name[idx];

		if (!isdigit(c) && c != '.' && c != '_')
			break;
	}
	if (idx <= 0)
		return strlen(name);
	return idx + 1;
}

/*
 * Remove number suffix of a symbol.
 *
 * Specifically, remove trailing numbers for "__UNIQUE_ID_" symbols and
 * symbols with '.'.
 *
 * With CONFIG_LTO_CLANG_THIN, it is possible to have nested __UNIQUE_ID_,
 * such as
 *
 *   __UNIQUE_ID_addressable___UNIQUE_ID_pci_invalid_bar_694_695
 *
 * to remove both trailing numbers, also remove trailing '_'.
 *
 * For symbols with llvm suffix, i.e., foo.llvm.<hash>, remove the
 * .llvm.<hash> part.
 */
static const char *demangle_name(struct symbol *sym)
{
	char *str;
	ssize_t len;

	if (!is_func_sym(sym) && !is_object_sym(sym))
		return sym->name;

	len = demangled_name_len(sym->name);
	if (len == strlen(sym->name))
		return sym->name;

	str = strndup(sym->name, len);
	if (!str) {
		ERROR_GLIBC("strdup");
		return NULL;
	}

	return str;
}

static int elf_add_symbol(struct elf *elf, struct symbol *sym)
{
	struct list_head *entry;
	struct rb_node *pnode;
	struct symbol *iter;

	INIT_LIST_HEAD(&sym->pv_target);
	sym->alias = sym;

	sym->type = GELF_ST_TYPE(sym->sym.st_info);
	sym->bind = GELF_ST_BIND(sym->sym.st_info);

	if (is_file_sym(sym))
		elf->num_files++;

	sym->offset = sym->sym.st_value;
	sym->len = sym->sym.st_size;

	__sym_for_each(iter, &sym->sec->symbol_tree, sym->offset, sym->offset) {
		if (!is_undef_sym(iter) && iter->offset == sym->offset &&
		    iter->type == sym->type && iter->len == sym->len)
			iter->alias = sym;
	}

	__sym_insert(sym, &sym->sec->symbol_tree);
	pnode = rb_prev(&sym->node);
	if (pnode)
		entry = &rb_entry(pnode, struct symbol, node)->list;
	else
		entry = &sym->sec->symbol_list;
	list_add(&sym->list, entry);

	sym->demangled_name = demangle_name(sym);
	if (!sym->demangled_name)
		return -1;

	list_add_tail(&sym->global_list, &elf->symbols);
	elf_hash_add(symbol, &sym->hash, sym->idx);
	elf_hash_add(symbol_name, &sym->name_hash, str_hash(sym->demangled_name));

	if (is_func_sym(sym) &&
	    (strstarts(sym->name, "__pfx_") ||
	     strstarts(sym->name, "__cfi_") ||
	     strstarts(sym->name, "__pi___pfx_") ||
	     strstarts(sym->name, "__pi___cfi_")))
		sym->prefix = 1;

	if (strstarts(sym->name, ".klp.sym"))
		sym->klp = 1;

	if (!sym->klp && !is_sec_sym(sym) && strstr(sym->name, ".cold")) {
		sym->cold = 1;

		/*
		 * Clang doesn't mark cold subfunctions as STT_FUNC, which
		 * breaks several objtool assumptions.  Fake it.
		 */
		sym->type = STT_FUNC;
	}

	sym->pfunc = sym->cfunc = sym;

	return 0;
}

static int read_symbols(struct elf *elf)
{
	struct section *symtab, *symtab_shndx, *sec;
	struct symbol *sym, *pfunc, *file = NULL;
	int symbols_nr, i;
	char *coldstr;
	Elf_Data *shndx_data = NULL;
	Elf32_Word shndx;

	symtab = find_section_by_name(elf, ".symtab");
	if (symtab) {
		symtab_shndx = find_section_by_name(elf, ".symtab_shndx");
		if (symtab_shndx)
			shndx_data = symtab_shndx->data;

		symbols_nr = sec_num_entries(symtab);
	} else {
		/*
		 * A missing symbol table is actually possible if it's an empty
		 * .o file. This can happen for thunk_64.o. Make sure to at
		 * least allocate the symbol hash tables so we can do symbol
		 * lookups without crashing.
		 */
		symbols_nr = 0;
	}

	if (!elf_alloc_hash(symbol, symbols_nr) ||
	    !elf_alloc_hash(symbol_name, symbols_nr))
		return -1;

	elf->symbol_data = calloc(symbols_nr, sizeof(*sym));
	if (!elf->symbol_data) {
		ERROR_GLIBC("calloc");
		return -1;
	}

	INIT_LIST_HEAD(&elf->symbols);

	for (i = 0; i < symbols_nr; i++) {
		sym = &elf->symbol_data[i];

		sym->idx = i;

		if (!gelf_getsymshndx(symtab->data, shndx_data, i, &sym->sym,
				      &shndx)) {
			ERROR_ELF("gelf_getsymshndx");
			return -1;
		}

		sym->name = elf_strptr(elf->elf, symtab->sh.sh_link,
				       sym->sym.st_name);
		if (!sym->name) {
			ERROR_ELF("elf_strptr");
			return -1;
		}

		/*
		 * "klp diff" renames the placeholder symbols of KLP relocs to
		 * hide them from modpost.  Hide the prefix from the rest of
		 * objtool so its many name-based heuristics (noreturns,
		 * uaccess safe list, ...) still see the original symbol name.
		 *
		 * st_name is left alone, so the renamed symbol is preserved in
		 * the output file.
		 */
		if (strstarts(sym->name, KLP_TOMBSTONE_PREFIX))
			sym->name += strlen(KLP_TOMBSTONE_PREFIX);

		if ((sym->sym.st_shndx > SHN_UNDEF &&
		     sym->sym.st_shndx < SHN_LORESERVE) ||
		    (shndx_data && sym->sym.st_shndx == SHN_XINDEX)) {
			if (sym->sym.st_shndx != SHN_XINDEX)
				shndx = sym->sym.st_shndx;

			sym->sec = find_section_by_index(elf, shndx);
			if (!sym->sec) {
				ERROR("couldn't find section for symbol %s", sym->name);
				return -1;
			}
			if (GELF_ST_TYPE(sym->sym.st_info) == STT_SECTION) {
				sym->name = sym->sec->name;
				sym->sec->sym = sym;
			}
		} else
			sym->sec = find_section_by_index(elf, 0);

		if (elf_add_symbol(elf, sym))
			return -1;

		if (is_file_sym(sym))
			file = sym;
		else if (sym->bind == STB_LOCAL && !is_sec_sym(sym))
			sym->file = file;
	}

	if (opts.stats) {
		printf("nr_symbols: %lu\n", (unsigned long)symbols_nr);
		printf("symbol_bits: %d\n", elf->symbol_bits);
	}

	/* Create parent/child links for any cold subfunctions */
	list_for_each_entry(sec, &elf->sections, list) {
		sec_for_each_sym(sec, sym) {
			char *pname;
			size_t pnamelen;

			if (!sym->cold)
				continue;

			coldstr = strstr(sym->name, ".cold");
			if (!coldstr) {
				ERROR("%s(): cold subfunction without \".cold\"?", sym->name);
				return -1;
			}

			pnamelen = coldstr - sym->name;
			pname = strndup(sym->name, pnamelen);
			if (!pname) {
				ERROR("%s(): failed to allocate memory", sym->name);
				return -1;
			}

			pfunc = find_local_symbol_by_file_and_name(elf, sym->file, pname);
			if (!pfunc)
				pfunc = find_global_symbol_by_name(elf, pname);
			free(pname);

			if (!pfunc) {
				ERROR("%s(): can't find parent function", sym->name);
				return -1;
			}

			sym->pfunc = pfunc->alias;
			pfunc->cfunc = sym;
			pfunc->alias->cfunc = sym;

			/*
			 * Unfortunately, -fnoreorder-functions puts the child
			 * inside the parent.  Remove the overlap so we can
			 * have sane assumptions.
			 *
			 * Note that pfunc->len now no longer matches
			 * pfunc->sym.st_size.
			 */
			if (sym->sec == pfunc->sec &&
			    sym->offset >= pfunc->offset &&
			    sym->offset + sym->len == pfunc->offset + pfunc->len) {
				pfunc->len -= sym->len;
			}
		}
	}

	return 0;
}

static int mark_group_syms(struct elf *elf)
{
	struct section *symtab, *sec;
	struct symbol *sym;

	symtab = find_section_by_name(elf, ".symtab");
	if (!symtab) {
		ERROR("no .symtab");
		return -1;
	}

	for_each_sec(elf, sec) {
		if (sec->sh.sh_type == SHT_GROUP &&
		    sec->sh.sh_link == symtab->idx) {
			sym = find_symbol_by_index(elf, sec->sh.sh_info);
			if (!sym) {
				ERROR("%s: can't find SHT_GROUP signature symbol",
				      sec->name);
				return -1;
			}

			sym->group_sec = sec;
		}
	}

	return 0;
}

/*
 * @sym's idx has changed.  Update the relocs which reference it.
 */
static int elf_update_sym_relocs(struct elf *elf, struct symbol *sym)
{
	struct reloc *reloc;

	for (reloc = sym->relocs; reloc; reloc = sym_next_reloc(reloc))
		set_reloc_sym(elf, reloc, reloc->sym->idx);

	return 0;
}

/*
 * The libelf API is terrible; gelf_update_sym*() takes a data block relative
 * index value, *NOT* the symbol index. As such, iterate the data blocks and
 * adjust index until it fits.
 *
 * If no data block is found, allow adding a new data block provided the index
 * is only one past the end.
 */
static int elf_update_symbol(struct elf *elf, struct section *symtab,
			     struct section *symtab_shndx, struct symbol *sym)
{
	Elf32_Word shndx;
	Elf_Data *symtab_data = NULL, *shndx_data = NULL;
	Elf64_Xword entsize = symtab->sh.sh_entsize;
	int max_idx, idx = sym->idx;
	Elf_Scn *s, *t = NULL;
	bool is_special_shndx = sym->sym.st_shndx >= SHN_LORESERVE &&
				sym->sym.st_shndx != SHN_XINDEX;

	shndx = is_special_shndx ? sym->sym.st_shndx : sym->sec->idx;

	s = elf_getscn(elf->elf, symtab->idx);
	if (!s) {
		ERROR_ELF("elf_getscn");
		return -1;
	}

	if (symtab_shndx) {
		t = elf_getscn(elf->elf, symtab_shndx->idx);
		if (!t) {
			ERROR_ELF("elf_getscn");
			return -1;
		}
	}

	for (;;) {
		/* get next data descriptor for the relevant sections */
		symtab_data = elf_getdata(s, symtab_data);
		if (t)
			shndx_data = elf_getdata(t, shndx_data);

		/* end-of-list */
		if (!symtab_data) {
			/*
			 * Over-allocate to avoid O(n^2) symbol creation
			 * behaviour.  The down side is that libelf doesn't
			 * like this; see elf_truncate_section() for the fixup.
			 */
			int num = max(1U, sym->idx/3);
			void *buf;

			if (idx) {
				/* we don't do holes in symbol tables */
				ERROR("index out of range");
				return -1;
			}

			/* if @idx == 0, it's the next contiguous entry, create it */
			symtab_data = elf_newdata(s);
			if (t)
				shndx_data = elf_newdata(t);

			buf = calloc(num, entsize);
			if (!buf) {
				ERROR_GLIBC("calloc");
				return -1;
			}

			symtab_data->d_buf = buf;
			symtab_data->d_size = num * entsize;
			symtab_data->d_align = 1;
			symtab_data->d_type = ELF_T_SYM;

			mark_sec_changed(elf, symtab, true);
			symtab->truncate = true;

			if (t) {
				buf = calloc(num, sizeof(Elf32_Word));
				if (!buf) {
					ERROR_GLIBC("calloc");
					return -1;
				}

				shndx_data->d_buf = buf;
				shndx_data->d_size = num * sizeof(Elf32_Word);
				shndx_data->d_align = sizeof(Elf32_Word);
				shndx_data->d_type = ELF_T_WORD;

				mark_sec_changed(elf, symtab_shndx, true);
				symtab_shndx->truncate = true;
			}

			break;
		}

		/* empty blocks should not happen */
		if (!symtab_data->d_size) {
			ERROR("zero size data");
			return -1;
		}

		/* is this the right block? */
		max_idx = symtab_data->d_size / entsize;
		if (idx < max_idx)
			break;

		/* adjust index and try again */
		idx -= max_idx;
	}

	/* something went side-ways */
	if (idx < 0) {
		ERROR("negative index");
		return -1;
	}

	/* setup extended section index magic and write the symbol */
	if (shndx < SHN_LORESERVE || is_special_shndx) {
		sym->sym.st_shndx = shndx;
		if (!shndx_data)
			shndx = 0;
	} else {
		sym->sym.st_shndx = SHN_XINDEX;
		if (!shndx_data) {
			ERROR("no .symtab_shndx");
			return -1;
		}
	}

	if (!gelf_update_symshndx(symtab_data, shndx_data, idx, &sym->sym, shndx)) {
		ERROR_ELF("gelf_update_symshndx");
		return -1;
	}

	return 0;
}

struct symbol *elf_create_symbol(struct elf *elf, const char *name,
				 struct section *sec, unsigned int bind,
				 unsigned int type, unsigned long offset,
				 size_t size)
{
	struct section *symtab, *symtab_shndx;
	Elf32_Word first_non_local, new_idx;
	struct symbol *old, *sym;

	sym = calloc(1, sizeof(*sym));
	if (!sym) {
		ERROR_GLIBC("calloc");
		return NULL;
	}

	sym->name = strdup(name);
	if (!sym->name) {
		ERROR_GLIBC("strdup");
		return NULL;
	}

	if (type != STT_SECTION) {
		sym->sym.st_name = elf_add_string(elf, NULL, sym->name);
		if (sym->sym.st_name == -1)
			return NULL;
	}

	if (sec) {
		sym->sec = sec;
	} else {
		sym->sec = find_section_by_index(elf, 0);
		if (!sym->sec) {
			ERROR("no NULL section");
			return NULL;
		}
	}

	sym->sym.st_info  = GELF_ST_INFO(bind, type);
	sym->sym.st_value = offset;
	sym->sym.st_size  = size;

	symtab = find_section_by_name(elf, ".symtab");
	if (!symtab) {
		ERROR("no .symtab");
		return NULL;
	}

	symtab_shndx = find_section_by_name(elf, ".symtab_shndx");

	new_idx = sec_num_entries(symtab);

	if (bind != STB_LOCAL)
		goto non_local;

	/*
	 * Move the first global symbol, as per sh_info, into a new, higher
	 * symbol index. This frees up a spot for a new local symbol.
	 */
	first_non_local = symtab->sh.sh_info;
	old = find_symbol_by_index(elf, first_non_local);
	if (old) {

		elf_hash_del(symbol, &old->hash, old->idx);
		elf_hash_add(symbol, &old->hash, new_idx);
		old->idx = new_idx;

		if (elf_update_symbol(elf, symtab, symtab_shndx, old)) {
			ERROR("elf_update_symbol move");
			return NULL;
		}

		if (elf_update_sym_relocs(elf, old))
			return NULL;

		if (old->group_sec) {
			old->group_sec->sh.sh_info = new_idx;
			mark_sec_changed(elf, old->group_sec, true);
		}

		new_idx = first_non_local;
	}

	/*
	 * Either way, we will add a LOCAL symbol.
	 */
	symtab->sh.sh_info += 1;

non_local:
	sym->idx = new_idx;
	if (sym->idx && elf_update_symbol(elf, symtab, symtab_shndx, sym))
		return NULL;

	symtab->sh.sh_size += symtab->sh.sh_entsize;
	mark_sec_changed(elf, symtab, true);