Merge remote-tracking branch cros/main into factory-brya-14909.124.B-main

Generated by: util/update_release_branch.py --baseboard brya --relevant_paths_file
baseboard/brya/relevant-paths.txt factory-brya-14909.124.B-main

Relevant changes:

git log --oneline 19d4d68ffa..aa40b859b3 -- baseboard/brya board/agah
board/anahera board/banshee board/brya board/crota board/felwinter
board/gimble board/kano board/mithrax board/osiris board/primus
board/redrix board/taeko board/taniks board/vell board/volmar
driver/bc12/pi3usb9201_public.* driver/charger/bq25710.*
driver/ppc/nx20p348x.* driver/ppc/syv682x_public.*
driver/retimer/bb_retimer_public.* driver/tcpm/nct38xx.*
driver/tcpm/ps8xxx_public.* driver/tcpm/tcpci.* include/power/alderlake*
include/intel_x86.h power/alderlake* power/intel_x86.c
util/getversion.sh

e6da633c38 driver: Sort header files
234a87ae2d tcpci: Add FRS enable to driver structure
a56be59ccd tcpm_header: add test for tcpm_dump_registers
57b3256963 Rename CONFIG_CHARGER_INPUT_CURRENT to _CHARGER_DEFAULT_CURRENT_LIMIT
e420c8ff9a marasov: Modify TypeC and TypeA configuration.
43b53e0045 Add default implementation of board_set_charge_limit
b75dc90677 Add CONFIG_CHARGER_MIN_INPUT_CURRENT_LIMIT
f1b563c350 baseboard: Sort header files
7d01b1e58d driver/retimer/ps8818.h: Add I2C ADDR FLAGS 0x30, 0x58, 0x70
ec31407993 Add CONFIG_CHARGER_INPUT_CURRENT_DERATE_PCT
8f89f69a5b crota: disable lid angle sensor for clamshell

BRANCH=None
BUG=b:260630630 b:163093572 b:259002141 b:255184961 b:259354679
BUG=b:247100970 b:254328661
TEST=`emerge-brya chromeos-ec`

Force-Relevant-Builds: all
Change-Id: I0ecfa0e6af68631283c7a9e8f1afb9d827176c62
Signed-off-by: YH Lin <yueherngl@google.com>

1 files changed, 33 insertions, 3 deletions

diff --git a/common/system.c b/common/system.c
index 375cca2882..e10712259c 100644
--- a/common/system.c
+++ b/common/system.c
@@ -27,6 +27,7 @@
 #ifdef CONFIG_MPU
 #include "mpu.h"
 #endif
+#include "cros_version.h"
 #include "panic.h"
 #include "sysjump.h"
 #include "system.h"
@@ -36,7 +37,6 @@
 #include "usb_pd.h"
 #include "usb_pd_tcpm.h"
 #include "util.h"
-#include "cros_version.h"
 #include "watchdog.h"
 
 /* Console output macros */
@@ -67,6 +67,11 @@ static enum ec_reboot_cmd reboot_at_shutdown;
 
 static enum sysinfo_flags system_info_flags;
 
+/* Ensure enough space for panic_data, jump_data and at least one jump tag */
+BUILD_ASSERT((sizeof(struct panic_data) + sizeof(struct jump_data) +
+	      JUMP_TAG_MAX_SIZE) <= CONFIG_PRESERVED_END_OF_RAM_SIZE,
+	     "End of ram data size is too small for panic and jump data");
+
 STATIC_IF(CONFIG_HIBERNATE) uint32_t hibernate_seconds;
 STATIC_IF(CONFIG_HIBERNATE) uint32_t hibernate_microseconds;
 
@@ -349,15 +354,24 @@ test_mockable int system_jumped_late(void)
 int system_add_jump_tag(uint16_t tag, int version, int size, const void *data)
 {
 	struct jump_tag *t;
+	size_t new_entry_size;
 
 	/* Only allowed during a sysjump */
 	if (!jdata || jdata->magic != JUMP_DATA_MAGIC)
 		return EC_ERROR_UNKNOWN;
 
 	/* Make room for the new tag */
-	if (size > 255)
+	if (size > JUMP_TAG_MAX_SIZE)
+		return EC_ERROR_INVAL;
+
+	new_entry_size = ROUNDUP4(size) + sizeof(struct jump_tag);
+
+	if (system_usable_ram_end() - new_entry_size < JUMP_DATA_MIN_ADDRESS) {
+		ccprintf("ERROR: out of space for jump tags\n");
 		return EC_ERROR_INVAL;
-	jdata->jump_tag_total += ROUNDUP4(size) + sizeof(struct jump_tag);
+	}
+
+	jdata->jump_tag_total += new_entry_size;
 
 	t = (struct jump_tag *)system_usable_ram_end();
 	t->tag = tag;
@@ -378,6 +392,10 @@ test_mockable const uint8_t *system_get_jump_tag(uint16_t tag, int *version,
 	if (!jdata)
 		return NULL;
 
+	/* Ensure system_usable_ram_end() is within bounds */
+	if (system_usable_ram_end() < JUMP_DATA_MIN_ADDRESS)
+		return NULL;
+
 	/* Search through tag data for a match */
 	while (used < jdata->jump_tag_total) {
 		/* Check the next tag */
@@ -918,6 +936,18 @@ void system_common_pre_init(void)
 		else
 			delta = sizeof(struct jump_data) - jdata->struct_size;
 
+		/*
+		 * Check if enough space for jump data.
+		 * Clear jump data and return if not.
+		 */
+		if (system_usable_ram_end() < JUMP_DATA_MIN_ADDRESS) {
+			/* TODO(b/251190975): This failure should be reported
+			 * in the panic data structure for more visibility.
+			 */
+			memset(jdata, 0, sizeof(struct jump_data));
+			return;
+		}
+
 		if (delta && jdata->jump_tag_total) {
 			uint8_t *d = (uint8_t *)system_usable_ram_end();
 			memmove(d, d + delta, jdata->jump_tag_total);