spl: binman: Check at runtime if binman symbols were filled in

Binman lets us declare symbols in SPL/TPL that refer to other entries in
the same binman image as them. These symbols are filled in with the
correct values while binman assembles the images, but this is done
in-memory only. Symbols marked as optional can be filled with
BINMAN_SYM_MISSING as an error value if their referred entry is missing.

However, the unmodified SPL/TPL binaries are still available on disk,
and can be used by people. For these files, nothing ensures that the
symbols are set to this error value, and they will be considered valid
when they are not.

Empirically, all symbols show up as zero in a sandbox_vpl build when we
run e.g. tpl/u-boot-tpl directly. On the other hand, zero is a perfectly
fine value for a binman-written symbol, so we cannot say the symbols
have wrong values based on that.

Declare a magic symbol that binman always fills in with a fixed value.
Check this value as an indicator that symbols were filled in correctly.
Return the error value for all symbols when this magic symbol has the
wrong value.

For binman tests, we need to make room for the new symbol in the mocked
SPL/TPL data by extending them by four bytes. This messes up some test
image layouts. Fix the affected values, and check the magic symbol
wherever it makes sense.

Signed-off-by: Alper Nebi Yasak <alpernebiyasak@gmail.com>

1 files changed, 43 insertions, 2 deletions

diff --git a/include/binman_sym.h b/include/binman_sym.h
index 8586ef8731..528d7e4e90 100644
--- a/include/binman_sym.h
+++ b/include/binman_sym.h
@@ -11,6 +11,8 @@
 #ifndef __BINMAN_SYM_H
 #define __BINMAN_SYM_H
 
+/* BSYM in little endian, keep in sync with tools/binman/elf.py */
+#define BINMAN_SYM_MAGIC_VALUE	(0x4d595342UL)
 #define BINMAN_SYM_MISSING	(-1UL)
 
 #if CONFIG_IS_ENABLED(BINMAN_SYMBOLS)
@@ -63,6 +65,37 @@
 		section(".binman_sym")))
 
 /**
+ * _binman_sym_magic - Internal magic symbol for validity checks
+ *
+ * When building images, binman fills in this symbol with the magic
+ * value #defined above. This is used to check at runtime if the
+ * symbol values were filled in and are OK to use.
+ */
+extern ulong _binman_sym_magic;
+
+/**
+ * DECLARE_BINMAN_MAGIC_SYM - Declare the internal magic symbol
+ *
+ * This macro declares the _binman_sym_magic symbol so that it exists.
+ * Declaring it here would cause errors during linking due to multiple
+ * definitions of the symbol.
+ */
+#define DECLARE_BINMAN_MAGIC_SYM \
+	ulong _binman_sym_magic \
+		__attribute__((aligned(4), section(".binman_sym")))
+
+/**
+ * BINMAN_SYMS_OK - Check if the symbol values are valid
+ *
+ * This macro checks if the magic symbol's value is filled properly,
+ * which indicates that other symbols are OK to use as well.
+ *
+ * Return: 1 if binman symbol values are usable, 0 if not
+ */
+#define BINMAN_SYMS_OK \
+	(*(ulong *)&_binman_sym_magic == BINMAN_SYM_MAGIC_VALUE)
+
+/**
  * binman_sym() - Access a previously declared symbol
  *
  * This is used to get the value of a symbol. E.g.:
@@ -72,10 +105,14 @@
  * @_type: Type f the symbol (e.g. unsigned long)
  * @entry_name: Name of the entry to look for (e.g. 'u_boot_spl')
  * @_prop_name: Property value to get from that entry (e.g. 'pos')
- * @returns value of that property (filled in by binman)
+ *
+ * Return: value of that property (filled in by binman), or
+ *	   BINMAN_SYM_MISSING if the value is unavailable
  */
 #define binman_sym(_type, _entry_name, _prop_name) \
-	(*(_type *)&binman_symname(_entry_name, _prop_name))
+	(BINMAN_SYMS_OK ? \
+	 (*(_type *)&binman_symname(_entry_name, _prop_name)) : \
+	 BINMAN_SYM_MISSING)
 
 #else /* !CONFIG_IS_ENABLED(BINMAN_SYMBOLS) */
 
@@ -85,6 +122,10 @@
 
 #define binman_sym_extern(_type, _entry_name, _prop_name)
 
+#define DECLARE_BINMAN_MAGIC_SYM
+
+#define BINMAN_SYMS_OK (0)
+
 #define binman_sym(_type, _entry_name, _prop_name) BINMAN_SYM_MISSING
 
 #endif /* CONFIG_IS_ENABLED(BINMAN_SYMBOLS) */