Branch: refs/heads/main
Home: https://github.com/OpenAMP/open-amp
Commit: 4d412df37f25cd28fa21b9614eaf37ee69df3f53
https://github.com/OpenAMP/open-amp/commit/4d412df37f25cd28fa21b9614eaf37ee…
Author: Ben Levinsky <ben.levinsky(a)amd.com>
Date: 2026-09-22 (Tue, 22 Sep 2026)
Changed paths:
M lib/include/openamp/remoteproc_virtio.h
M lib/remoteproc/remoteproc.c
M lib/remoteproc/remoteproc_virtio.c
Log Message:
-----------
remoteproc: Validate virtqueue alignment
The remote resource table controls the vring alignment, which is used
for pointer rounding without validation. vring_init() rounds the used
ring address with a ~(align - 1) mask, so a zero alignment leaves a
NULL used ring that is dereferenced later.
Reject a zero alignment before calculating the vring size and before
storing the vring metadata taken from the resource table.
Signed-off-by: Ben Levinsky <ben.levinsky(a)amd.com>
Assisted-by: Codex:GPT-5
Commit: 22ddff1a4ec37f40e4785c65ea632404af8413a5
https://github.com/OpenAMP/open-amp/commit/22ddff1a4ec37f40e4785c65ea632404…
Author: Ben Levinsky <ben.levinsky(a)amd.com>
Date: 2026-09-22 (Tue, 22 Sep 2026)
Changed paths:
M lib/remoteproc/rsc_table_parser.c
Log Message:
-----------
remoteproc: Validate resource table entry bounds
Resource offsets from a copied firmware table are dereferenced without
bounds checks when no I/O region is present. Handlers can then access
memory beyond the table through a VDEV's flexible vring array.
Reject a NULL table, validate offset-array arithmetic, and require
every entry to remain inside the table before dispatch. Check fixed
sizes, VDEV vrings and config data, and vendor lengths using
overflow-safe subtraction.
Signed-off-by: Ben Levinsky <ben.levinsky(a)amd.com>
Assisted-by: Codex:GPT-5
Compare: https://github.com/OpenAMP/open-amp/compare/d0e5e0d376a3...22ddff1a4ec3
To unsubscribe from these emails, change your notification settings at https://github.com/OpenAMP/open-amp/settings/notifications
Hello,
The v2026.10 release of the OpenAMP project repositories is scheduled for the end of next month.
Please note that the feature freeze will take effect on October 16th. After this date, only bug fixes will be accepted until the release.
To ensure sufficient time for the review process, please submit your pull requests at least two weeks before the feature freeze date.
Thanks and regards,
Arnaud Pouliquen
Branch: refs/heads/main
Home: https://github.com/OpenAMP/openamp-system-reference
Commit: b80874929d1d195dda93cfc23ffac83cdac43ff6
https://github.com/OpenAMP/openamp-system-reference/commit/b80874929d1d195d…
Author: Ben Levinsky <ben.levinsky(a)amd.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M examples/legacy_apps/machine/xlnx/zynqmp_r5/freertos/gic_init.c
M examples/legacy_apps/machine/xlnx/zynqmp_r5/generic/gic_init.c
M examples/legacy_apps/machine/xlnx/zynqmp_r5/platform_info.c
Log Message:
-----------
examples: legacy_apps: xlnx: Remove xlnx_hw_to_bsp_irq()
The Lopper-generated amd_platform_info.h already accounts for BSP.
So remove the unneeded function xlnx_hw_to_bsp_irq() which tries to account
for IRQ system number difference from baremetal (generic) and FreeRTOS BSPs.
Signed-off-by: Ben Levinsky <ben.levinsky(a)amd.com>
Commit: c515eff24cc345d16c061ffa951395d44315f5b7
https://github.com/OpenAMP/openamp-system-reference/commit/c515eff24cc345d1…
Author: Ben Levinsky <ben.levinsky(a)amd.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M examples/legacy_apps/machine/xlnx/README.md
Log Message:
-----------
examples: legacy_apps: vendor: Update README to show picking up SDT
Ensure that picking up system device tree (SDT), YAMLs and lopper setup are
present in README
Signed-off-by: Ben Levinsky <ben.levinsky(a)amd.com>
Compare: https://github.com/OpenAMP/openamp-system-reference/compare/0d54a0b29d2c...…
To unsubscribe from these emails, change your notification settings at https://github.com/OpenAMP/openamp-system-reference/settings/notifications
Branch: refs/heads/main
Home: https://github.com/OpenAMP/openamp-system-reference
Commit: 877039581b38baa11180104eaf7ffa8706af4f74
https://github.com/OpenAMP/openamp-system-reference/commit/877039581b38baa1…
Author: Sipke Vriend <sipke(a)direktembedded.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M examples/zephyr/dual_qemu_ivshmem/README.rst
Log Message:
-----------
examples: zephyr: dual_qemu_ivhmem: remove $ prompt from code blocks
Remove the prompt $ symbol from console block command lines, so it is not
copied as well when using github or IDE copy button.
Signed-off-by: Sipke Vriend <sipke(a)direktembedded.com>
Commit: 13d0cd249b00d12002bc3b126cc820d7c16fb4c2
https://github.com/OpenAMP/openamp-system-reference/commit/13d0cd249b00d120…
Author: Sipke Vriend <sipke(a)direktembedded.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M examples/zephyr/dual_qemu_ivshmem/README.rst
Log Message:
-----------
examples: zephyr: dual_qemu_ivhmem: split Zephyr uart code blocks
Split the zephyr console blocks into command line and output blocks to
allow the command line to be copied when using github or IDE.
Signed-off-by: Sipke Vriend <sipke(a)direktembedded.com>
Commit: b24346cb17bd5ed5e00f8f24e1813ee978ce287e
https://github.com/OpenAMP/openamp-system-reference/commit/b24346cb17bd5ed5…
Author: Sipke Vriend <sipke(a)direktembedded.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M examples/legacy_apps/machine/xlnx/microblaze_generic/README.md
M examples/linux/rpmsg-echo-test/README.md
M examples/linux/rpmsg-mat-mul/README.md
M examples/linux/rpmsg-proxy-app/README.md
Log Message:
-----------
examples: readme: use shell block for command lines
Use the markdown shell block so that users can copy the block, or
execute lines as supported by IDEs.
Signed-off-by: Sipke Vriend <sipke(a)direktembedded.com>
Commit: 797f19f9c186e9c73b44c6953cc6e6dac541c63e
https://github.com/OpenAMP/openamp-system-reference/commit/797f19f9c186e9c7…
Author: Sipke Vriend <sipke(a)direktembedded.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
R examples/linux/rpmsg-utils/README
A examples/linux/rpmsg-utils/README.md
Log Message:
-----------
examples: linux: rpmsg-utils: rename to make README a Markdown file
To allow for formatting of readme rename to README.md
Signed-off-by: Sipke Vriend <sipke(a)direktembedded.com>
Commit: 0d54a0b29d2cd01387aea14668ab962037cd3a70
https://github.com/OpenAMP/openamp-system-reference/commit/0d54a0b29d2cd013…
Author: Sipke Vriend <sipke(a)direktembedded.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M examples/linux/rpmsg-utils/README.md
Log Message:
-----------
examples: linux: rpmsg-utils: Format with markdown code block and heading
Use a code block for the udev rules and extend the heading underline
for eptdestroy.
Signed-off-by: Sipke Vriend <sipke(a)direktembedded.com>
Compare: https://github.com/OpenAMP/openamp-system-reference/compare/4ca6a085a7e2...…
To unsubscribe from these emails, change your notification settings at https://github.com/OpenAMP/openamp-system-reference/settings/notifications
Branch: refs/heads/main
Home: https://github.com/OpenAMP/libmetal
Commit: 9aa2f15556c5fe95e7c4d3ea33d15f3a113eaba8
https://github.com/OpenAMP/libmetal/commit/9aa2f15556c5fe95e7c4d3ea33d15f3a…
Author: Chirag Shilwant <c-shilwant(a)ti.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M lib/system/linux/device.c
Log Message:
-----------
linux: remove sudo modprobe fallback from metal_linux_probe_driver
A library must not attempt to escalate its own privileges.
The sudo modprobe fallback was incorrect for three reasons:
1. A library silently attempting privilege escalation on behalf of its
caller is unexpected behavior and a security concern.
2. If modprobe failed due to missing CAP_SYS_MODULE, sudo will also
fail unless passwordless sudo is explicitly configured in sudoers
making the fallback redundant in practice.
3. On embedded and production Linux systems, sudo is often not
installed, causing system() to fail silently or hang waiting for
a password prompt.
If the driver is not found after modprobe, return -ENODEV and let the
caller handle it.
Fixes: commit 7bda1db4a90d ("Initial commit")
Signed-off-by: Chirag Shilwant <c-shilwant(a)ti.com>
Commit: f05a041762532320a5e8d8532b118c22fc3e8e1e
https://github.com/OpenAMP/libmetal/commit/f05a041762532320a5e8d8532b118c22…
Author: Chirag Shilwant <c-shilwant(a)ti.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M .github/workflows/continuous-integration.yml
Log Message:
-----------
ci: load UIO kernel modules before running nonreg tests
The nr_tests job was relying on libmetal's internal sudo modprobe
fallback in metal_linux_probe_driver() to load UIO modules at runtime.
Now that the sudo escalation has been removed from the library, the CI
environment must explicitly load the required modules before invoking
the test suite.
Add a "sudo modprobe" step for uio, uio_pdrv_genirq, and uio_dmem_genirq
prior to make test. Module loading with sudo privileges is the
responsibility of the environment, not the library.
Signed-off-by: Chirag Shilwant <c-shilwant(a)ti.com>
Compare: https://github.com/OpenAMP/libmetal/compare/02e46d91d3d8...f05a04176253
To unsubscribe from these emails, change your notification settings at https://github.com/OpenAMP/libmetal/settings/notifications
Branch: refs/heads/main
Home: https://github.com/OpenAMP/open-amp
Commit: 372048d49dc46a58586af3b62e94d4952bf92d59
https://github.com/OpenAMP/open-amp/commit/372048d49dc46a58586af3b62e94d495…
Author: Ben Levinsky <ben.levinsky(a)amd.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M lib/service/rpmsg/rpc/rpmsg_rpc_server.c
Log Message:
-----------
rpmsg: rpc: Validate and initialize server requests
The RPC callback does not receive the request length, so it may
inspect bytes beyond a short message. Those bytes currently come from
an uninitialized stack buffer. A message shorter than the function ID
can also make the dispatch path read uninitialized data.
Reject messages that do not contain a complete function ID and
zero-initialize the request buffer so callbacks never consume stale
stack contents from bytes omitted by the remote peer.
Signed-off-by: Ben Levinsky <ben.levinsky(a)amd.com>
Assisted-by: Codex:GPT-5
Commit: 2b7013e7335aa62de8e62f2084e668fa6c6995c2
https://github.com/OpenAMP/open-amp/commit/2b7013e7335aa62de8e62f2084e668fa…
Author: Ben Levinsky <ben.levinsky(a)amd.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M lib/proxy/rpmsg_retarget.c
Log Message:
-----------
proxy: Validate retarget write length
_write() copies a caller-controlled length into a fixed-size stack
buffer without checking that the RPC header and payload fit. Negative
lengths also become large unsigned memcpy() sizes, and the stdout NUL
terminator is written one byte beyond its intended position.
Reject invalid lengths before constructing the request. Include the
optional terminator in the capacity check and place the terminator
immediately after the copied payload.
Signed-off-by: Ben Levinsky <ben.levinsky(a)amd.com>
Assisted-by: Codex:GPT-5
Commit: 49780d11b49f3e2bea558d9ccd22e61487ed9e85
https://github.com/OpenAMP/open-amp/commit/49780d11b49f3e2bea558d9ccd22e614…
Author: Ben Levinsky <ben.levinsky(a)amd.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M lib/service/rpmsg/rpc/rpmsg_rpc_client.c
Log Message:
-----------
rpmsg: rpc: Validate client reply lengths
The RPC client reads the reply ID and status without checking that the
remote message contains the fixed reply header. It also passes the
total message length to callbacks that receive a parameters pointer,
making the reported length include the header bytes.
Reject replies shorter than the fixed header and pass callbacks only
the number of bytes that follow it.
Signed-off-by: Ben Levinsky <ben.levinsky(a)amd.com>
Assisted-by: Codex:GPT-5
Commit: f7c918bf07e3ad884247d06aad84b892c958e065
https://github.com/OpenAMP/open-amp/commit/f7c918bf07e3ad884247d06aad84b892…
Author: Ben Levinsky <ben.levinsky(a)amd.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M lib/include/openamp/rpmsg_rpc_client_server.h
M lib/service/rpmsg/rpc/rpmsg_rpc_client.c
Log Message:
-----------
rpmsg: rpc: Validate client request lengths
The RPC client copies caller-provided parameters into a fixed-size
stack buffer without checking whether the complete request fits.
Oversized requests can therefore overwrite the caller's stack frame.
Reject requests that exceed the remaining parameter capacity before
copying them, validate nonempty parameter pointers, and document the
public API limit.
Signed-off-by: Ben Levinsky <ben.levinsky(a)amd.com>
Assisted-by: Codex:GPT-5
Commit: d0e5e0d376a320026211312df890fedf46ec4bc4
https://github.com/OpenAMP/open-amp/commit/d0e5e0d376a320026211312df890fedf…
Author: Ben Levinsky <ben.levinsky(a)amd.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M lib/proxy/rpmsg_retarget.c
Log Message:
-----------
proxy: Validate retarget read response length
_read() converts the peer-provided unsigned data length to a signed
integer and bounds it only against the caller's buffer size. Large
values can bypass that comparison or make memcpy() read beyond the
fixed response buffer.
Reject nonpositive destination sizes, retain the peer length as an
unsigned value, and clamp it to both the response payload capacity and
the caller's buffer before copying.
Signed-off-by: Ben Levinsky <ben.levinsky(a)amd.com>
Assisted-by: Codex:GPT-5
Compare: https://github.com/OpenAMP/open-amp/compare/80284e3ac0e9...d0e5e0d376a3
To unsubscribe from these emails, change your notification settings at https://github.com/OpenAMP/open-amp/settings/notifications
Branch: refs/heads/main
Home: https://github.com/OpenAMP/open-amp
Commit: 80284e3ac0e94d2e9f15bab79e84f57d4cf77976
https://github.com/OpenAMP/open-amp/commit/80284e3ac0e94d2e9f15bab79e84f57d…
Author: Francesco Valla <francesco(a)valla.it>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M lib/include/openamp/virtqueue.h
M lib/virtio/virtqueue.c
Log Message:
-----------
virtqueue: add writable buffer helper
An application at device side might need to know if a buffer has been
marked as device-writable by the driver.
An example is the virtio SPI protocol, in which the direction of an
half-duplex communication can be determined by the device only by
checking if the buffer containing the data is writable or not.
Add a simple helper to test if a buffer is device-writable, that is,
if the VRING_DESC_F_WRITE flag is present on it.
Signed-off-by: Francesco Valla <francesco(a)valla.it>
To unsubscribe from these emails, change your notification settings at https://github.com/OpenAMP/open-amp/settings/notifications
Branch: refs/heads/main
Home: https://github.com/OpenAMP/open-amp
Commit: 2ad0328fe688978b33c59251dff38de44739f6bd
https://github.com/OpenAMP/open-amp/commit/2ad0328fe688978b33c59251dff38de4…
Author: Ben Levinsky <ben.levinsky(a)amd.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M lib/include/internal/utilities.h
M lib/remoteproc/elf_loader.c
Log Message:
-----------
remoteproc: add checked arithmetic helpers
Add generic checked addition, subtraction, and multiplication helpers
with consistent input validation across builtin and fallback
implementations.
Add a generic range-containment helper which reports arithmetic
overflow separately from non-containment. This lets the ELF loader
distinguish malformed ranges from data absent from the current image
chunk.
Signed-off-by: Ben Levinsky <ben.levinsky(a)amd.com>
Commit: f3b110faff3df0f36c0f5126b9d9ecdfca2575e5
https://github.com/OpenAMP/open-amp/commit/f3b110faff3df0f36c0f5126b9d9ecdf…
Author: Ben Levinsky <ben.levinsky(a)amd.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M lib/remoteproc/elf_loader.c
Log Message:
-----------
remoteproc: validate ELF header shape before table loading
Reject malformed ELF headers before using program or section table
metadata from the firmware image.
Validate the ELF class, ELF header size, program header entry size,
section header entry size, and section string-table index. Release an
image-info object allocated by this call if validation fails, while
leaving caller-owned objects untouched.
Signed-off-by: Ben Levinsky <ben.levinsky(a)amd.com>
Commit: 8d245caca221297ff395bce00a2331430506b04e
https://github.com/OpenAMP/open-amp/commit/8d245caca221297ff395bce00a233143…
Author: Ben Levinsky <ben.levinsky(a)amd.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M lib/remoteproc/elf_loader.c
Log Message:
-----------
remoteproc: check ELF program and section table sizes
Use checked multiplication when computing ELF program and section header
table sizes from e_phnum/e_phentsize and e_shnum/e_shentsize.
Also replace wrapping offset-plus-length range checks with overflow-safe
image chunk validation before allocation and memcpy. Malformed firmware
images with impossible table sizes now fail with -RPROC_EINVAL.
Signed-off-by: Ben Levinsky <ben.levinsky(a)amd.com>
Commit: 872a4fcae7e3a2ead1366a52dd8e044534043186
https://github.com/OpenAMP/open-amp/commit/872a4fcae7e3a2ead1366a52dd8e0445…
Author: Ben Levinsky <ben.levinsky(a)amd.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M lib/remoteproc/elf_loader.c
Log Message:
-----------
remoteproc: harden ELF section string-table range checks
Use overflow-safe range validation before copying the ELF section string
table from the firmware image.
The section string-table offset and size are read from untrusted section
headers. Validate that the full table is present in the current image
chunk without relying on wrapping offset arithmetic.
Signed-off-by: Ben Levinsky <ben.levinsky(a)amd.com>
Commit: 08a45aca334d49133abdf89b21817af1217595fc
https://github.com/OpenAMP/open-amp/commit/08a45aca334d49133abdf89b21817af1…
Author: Ben Levinsky <ben.levinsky(a)amd.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M lib/include/openamp/elf_loader.h
M lib/remoteproc/elf_loader.c
Log Message:
-----------
remoteproc: track loaded ELF section string-table size
Store the loaded section string-table size in the ELF image information
for both ELF32 and ELF64 images.
Keeping the size alongside the string-table pointer allows later section
name lookups to validate sh_name offsets against the actual loaded table
bounds.
Signed-off-by: Ben Levinsky <ben.levinsky(a)amd.com>
Commit: 28b0a020c633715d7b90341b3b9ec44277d030d4
https://github.com/OpenAMP/open-amp/commit/28b0a020c633715d7b90341b3b9ec442…
Author: Ben Levinsky <ben.levinsky(a)amd.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M lib/remoteproc/elf_loader.c
Log Message:
-----------
remoteproc: bound ELF section name lookups
Make ELF section-name lookup validate sh_name before reading from the
loaded section string table.
Skip malformed section names whose sh_name offset is outside the table
or whose string is not NUL-terminated within the remaining table bytes.
Use bounded comparison for valid candidates so .resource_table lookup
cannot read past the loaded string table.
Signed-off-by: Ben Levinsky <ben.levinsky(a)amd.com>
Commit: 3ea751021e4f157c561b8bf2598d263ac072a8ef
https://github.com/OpenAMP/open-amp/commit/3ea751021e4f157c561b8bf2598d263a…
Author: Ben Levinsky <ben.levinsky(a)amd.com>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
M lib/remoteproc/remoteproc.c
Log Message:
-----------
remoteproc: avoid wrapping loader offset comparison
Replace the non-seekable loader offset comparison that used offset + len
with an overflow-safe equivalent.
This preserves existing behavior for normal ranges while avoiding a
wraparound case when deciding whether required image data is contiguous
with the current chunk.
Signed-off-by: Ben Levinsky <ben.levinsky(a)amd.com>
Compare: https://github.com/OpenAMP/open-amp/compare/1e2cae3a2edc...3ea751021e4f
To unsubscribe from these emails, change your notification settings at https://github.com/OpenAMP/open-amp/settings/notifications
Branch: refs/heads/main
Home: https://github.com/OpenAMP/open-amp
Commit: bb45852c584be0746f1eb3c62052f214606b4bac
https://github.com/OpenAMP/open-amp/commit/bb45852c584be0746f1eb3c62052f214…
Author: Sipke Vriend <sipke(a)direktembedded.com>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
M README.md
Log Message:
-----------
README: use shell block for commands in Markdown files
Use the markdown shell block instead of prepending $ to command so that
users can copy the block, as supported in github and IDEs.
Signed-off-by: Sipke Vriend <sipke(a)direktembedded.com>
Commit: c0359e4ae5bfa71a09654c78abf0049d6b06720a
https://github.com/OpenAMP/open-amp/commit/c0359e4ae5bfa71a09654c78abf0049d…
Author: Sipke Vriend <sipke(a)direktembedded.com>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
M .github/actions/build_ci/README.md
M README.md
Log Message:
-----------
github actions:README: use shell block for commands in Markdown files
Use the markdown shell block instead of prepending $ to command so that
users can copy the block, as supported in github and IDEs.
Signed-off-by: Sipke Vriend <sipke(a)direktembedded.com>
Commit: 2b172cef30f1563d01a7a8ba7ca0027964c78dd6
https://github.com/OpenAMP/open-amp/commit/2b172cef30f1563d01a7a8ba7ca00279…
Author: Sipke Vriend <sipke(a)direktembedded.com>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
M .github/actions/build_ci/README.md
Log Message:
-----------
github actions:README: add some new lines and code block for clarity
Multiple lines of text are concatenated so use a code block for the
supported targets so they are on individual lines.
Signed-off-by: Sipke Vriend <sipke(a)direktembedded.com>
Compare: https://github.com/OpenAMP/open-amp/compare/2e83e405d3a0...2b172cef30f1
To unsubscribe from these emails, change your notification settings at https://github.com/OpenAMP/open-amp/settings/notifications