- Tsc - lists.openampproject.org

[Call for vote] Establishing Security policy for OpenAMP

by Chan King Choy, Nathalie

Public Hi OpenAMP TSC, Based on the March 2026 OpenAMP Board meeting, the OpenAMP System Reference working group has been discussing what needs to be done in preparation for the EU Cyber Resilience Act. Conclusions: * Given OpenAMP's very low membership fee and low level of contributor bandwidth, it is not currently feasible to set up a Security team & Security support will be on a reasonable-effort basis * We can at least set up security reporting using built-in GitHub functionality<https://www.google.com/url?q=https://docs.github.com/en/code-security/how-t…> to track what has been reported & evaluated * The OpenAMP System Reference working group has drafted a security policy below * For the repos in the OpenAMP org that are staging forks of some upstream project, we should have a different security.md pointing people to submit their advisories to the upstream & that the staging repos are not security-supported. * Based on Greg KH's Embedded Recipes talk<https://youtu.be/u44eMQpGlxA?si=ZFgGuCZVBIYnbHi0&t=750> 12:30-13:32, it sounds like this is sufficient for compliance: "Part of the CRA is going to require manufacturers to report vulnerabilities that they find. They have to report it to you, the creator of the software, and they have to report it to the EU through ENISA. They just need a way to contact you. And you don't have to fix the problem. They just have to contact you. They can provide a fix if they want, but you don't have to take the fix." * If any OpenAMP member disagrees with this level of support, they should contribute staffing and/or propose how to fund a higher level of support. * E.g. maybe it is less costly to the member(s) to implement these fixes upstream Votes can be sent directly to me with Arnaud in CC. The rules for the vote are the same applied for Board voting, described in the charter<https://www.openampproject.org/docs/OpenAMPProject_Charter_Approved2024AugE…>. TSC voting members will get a reminder in about a week & voting will close on 17th Sept, 2026. === Purpose This policy outlines how security issues in repos of the OpenAMP GitHub organization should be reported, how they are handled, and what users can expect from the OpenAMP Project. Scope OpenAMP does not ship products or deployable binaries; it supplies source code and reference implementations only. Because the project team has very limited visibility into how the code is incorporated downstream and very limited maintainer time, consumers of the OpenAMP code are responsible for implementing any security fixes, mitigations, or processes that meet their own regulatory or product-specific requirements. Organisations placing devices or software on the EU market under the CRA remain accountable for performing their own risk and conformity assessments, generating and maintaining any required SBOMs, and any other EU CRA compliance. Fixes contributed for reported issues will be evaluated and merged on a reasonable-effort basis. The OpenAMP project welcomes patches that improve CRA alignment, provided they do not impose an unsustainable maintenance burden on the community. Security support is limited to the next release: fixes will be added to the main branch of the relevant repositories. Earlier versions remain available as-is, but do NOT receive security updates. Response targets Acknowledgement, assessment & publishing of advisories will occur on a reasonable-effort basis. If you need a faster turnaround, please consider contributing a fix or maintaining a downstream fork. Reporting a Vulnerability If you discover a security vulnerability in OpenAMP, please report it privately and responsibly: open a confidential security issue on at https://github.com/OpenAMP/<repository-with-the-issue>/security/advisories Please include: * If you/your company is reporting this issue under embargo so that you have time to provide a fix. * If reported under embargo, OpenAMP will respect the reporter's request for a limited time (up to 90 days), after which public disclosure may occur. * A clear description of the vulnerability. * Steps to reproduce the issue. * Any relevant details (affected components and versions, possible impact, etc.) * If an AI tool was used to discover the issue (Assisted-by: [Agent Name]:[Model Version] [Tool1] [Tool2]) GitHub How-to documentation on privately reporting a security vulnerability can be found here<https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabili…>. To keep this process safe and productive for everyone, all reports and related activities must comply with the OpenAMP Project code of conduct<https://www.openampproject.org/conduct>. No Pre-disclosure List * OpenAMP does not maintain a pre-disclosure list or offer embargoed advisories to downstream users. Publication of Security Advisories Advisories will be published at https://github.com/OpenAMP/<repository>/security/advisories. Reported issues that are assessed to be purely theoretical and not applicable in any real hardware system will be documented as "[Fix not planned]". Limitations of Liability & No Legal Advice This document is provided "AS IS" and does not constitute legal advice. The OpenAMP project members make no warranties regarding compliance with any law or regulation. Use at your own risk. === Thanks & regards, Nathalie

4 days, 13 hours

1
0
0 0

Creating AI-generated code policy for OpenAMP

by Chan King Choy, Nathalie

AMD General Hi OpenAMP TSC members, The question came up in a recent OpenAMP System Reference call regarding use of AI generated code for OpenAMP. Many companies are pushing heavily for their engineers to adopt AI assistance wherever possible. Here are some resources to seed the discussion for creating AI-generated code policy for OpenAMP. OpenAMP ties in closely to Linux kernel. Policy for Linux kernel: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Doc… * Human is responsible fully responsible for the contribution to the kernel, ensuring it follows the rules & meets license requirements * Transparency: Use assisted-by tag OpenAMP ties in closely to Zephyr. Policy for Zephyr is nearly identical to Linux kernel, like one did copy-paste-tweak of the other: https://docs.zephyrproject.org/latest/contribute/guidelines.html#ai-coding-… In case folks want to broaden their analysis, here are some references shared by the Linux Foundation legal team to the LF Member Counsels: * https://www.linuxfoundation.org/legal/generative-ai * Each Linux Foundation project gets to decide for themselves * High-level guidelines provided * https://lwn.net/Articles/1061544/ (March 2026) * Debian didn't set an official policy & would handle case-by-case. * https://www.redhat.com/en/blog/ai-assisted-development-and-open-source-navi… (Oct 2025) * Red Hat highlighted list of legal issues related to AI being debated in OSS communities What are your thoughts on creating an AI-generated code policy for OpenAMP? Thanks & regards, Nathalie

1 month, 2 weeks

2
3
0 0

Linaro Connect LIS2025 resources are now posted

by Chan King Choy, Nathalie

[Public] Hi everyone, if you were not able to attend Linaro Connect and want to see the presentations about the virtio-related work, the Linaro resources page is live with the slides & recordings. I made a post about this from the OpenAMP account, so you can get the link to the resources page there. Also, if anyone wants to help spread the word by liking or reposting that would be appreciated: https://www.linkedin.com/posts/openamp_linaroconnect2025-lis25-opensource-a… And, in case you were not aware of our OpenAMP YouTube playlist, I've added Bill's and Edgar's presentations from LIS25. https://www.youtube.com/playlist?list=PL4zm63BPM6v4DypP2KA1M55Ykr-V01fCt Best regards, Nathalie

1 year, 3 months

1
0
0 0

OpenAMP Docs Request for Proposals is live

by Chan King Choy, Nathalie

Hi OpenAMP TSC, We've discussed with the Board & TSC previously about using part of our project budget to hire a tech writer to improve the docs to make it easier for users and contributors to get started. We spun up a working group to put together this Request for Proposals to outline the problem and get quotes from potential contractors. The LinkedIn post is up, please share with your networks. https://www.linkedin.com/posts/openamp_openamp-opensource-techwriters-activ… The RFP PDF is also on our website: https://www.openampproject.org/docs/rfps/OpenAMP_DocsRFP_2024.pdf Thanks & regards, Nathalie

2 years, 7 months

1
0
0 0

Defining OpenAMP GitHub main branch security policies

by Chan King Choy, Nathalie

Hi Ben & OpenAMP TSC members, During today's OpenAMP System Reference call, the question came up about defining GitHub main branch security policies. Bill mentioned that Ben had some thoughts on low-hanging fruit in this area, so starting up a thread on this topic. Please let us know your recommendations. Thanks & regards, Nathalie P.S. Thanks to Bill for getting the OpenAMP GitHub organization upgraded to team level!

2 years, 7 months

1
1
0 0

2023-11-20 OpenAMP TSC notes and action items

by Chan King Choy, Nathalie

Hi all, The notes from the 2023-11-20 OpenAMP TSC are now available at: https://github.com/OpenAMP/open-amp/wiki/TSC-Meeting-Notes-2023#user-conten… Please let us know if you spot any errors or important omissions. Action items * Arnaud: Reach out to Felipe about if he has feedback on the OpenAMP docs * Gokhan: Reach out to manager about new team member who might be a candidate to give feedback on the OpenAMP docs * Nathalie: Schedule call with Bill, Tammy, Arnaud, Nathalie, Tomas & Ed about coming up with RFP for docs contractor Decisions/Conclusions * OpenAMP Governance on webpage now reflects what we actually do * October release of libraries & meta-open-amp is done, but some items remain (demo images, docs) * AMP Virtio work is continuing * OpenAMP has a lot of potential benefit to other projects if we can get them to adopt it * RISC-V: Would like them not to invent their own version of how to do AMP. The TSC participants who went to RISC-V Summit unfortunately weren't able to join the call * Docs: ** It might be useful to hire a professional tech writer contractor to try out & improve the docs further. No one was against the idea, but there are open questions. --> Spin up a small working group to discuss what RFP could look like (Bill, Tammy, Arnaud, Nathalie, Tomas + will ask Ed, Felipe & Arm guy) ** Who are we trying to attract? Want to get OpenAMP running on new architectures & new operating systems * Another candidate for how to use budget: ** Libmetal is big & over-designed for RTOS-only. Would be good to keep what Linux user space needs, but have compile time flag to trim it down. ** Bill: Wrote an outline as an issue in libmetal for Compile-flag effort https://github.com/OpenAMP/libmetal/issues/278 Thanks & regards, Nathalie

2 years, 9 months

1
0
0 0

Re: OpenAMP TSC

by Evensen, Tomas

[AMD Official Use Only - General] Meeting started. From: nathalie.chan-king-choy(a)amd.com When: 07:00 - 08:00 November 20, 2023 Subject: OpenAMP TSC Location: https://amd.zoom.us/j/95766873248?pwd=UlhJekp4eU9qSnRLSUtnVmpGNFNVdz09&from… Caution: This message originated from an External Source. Use proper caution when opening attachments, clicking links, or responding. Notes from previous TSC calls can be found at https://github.com/OpenAMP/open-amp/wiki/Meeting-Notes#user-content-2023 Will call for agenda closer to the date of the meeting. [Image removed by sender.]<https://zoom.us/> Hi there, Nathalie Chan King Choy is inviting you to a scheduled Zoom meeting. Join Zoom Meeting<https://amd.zoom.us/j/95766873248?pwd=UlhJekp4eU9qSnRLSUtnVmpGNFNVdz09&from…> Phone one-tap: US: +17209289299,,95766873248#,,,,,,0#,,2123515372#<tel:+17209289299,,95766873248#,,,,,,0#,,2123515372#> or +19292056099,,95766873248#,,,,,,0#,,2123515372#<tel:+19292056099,,95766873248#,,,,,,0#,,2123515372#> Meeting URL: https://amd.zoom.us/j/95766873248?pwd=UlhJekp4eU9qSnRLSUtnVmpGNFNVdz09&from… Meeting ID: 957 6687 3248 Passcode: w5%CWufP8% Join by Telephone For higher quality, dial a number based on your current location. Dial: US: +1 720 928 9299 or +1 929 205 6099 or +1 669 900 6833 or 833 928 4609 (Toll Free) or 833 928 4610 (Toll Free) or 877 853 5257 (Toll Free) or 888 475 4499 (Toll Free) or 833 548 0276 (Toll Free) or 833 548 0282 (Toll Free) or 833 928 4608 (Toll Free) India: +91 806 480 2722 or +91 80 71 279 440 or +91 116 480 2722 or +91 22 48 798 004 or +91 224 879 8012 or +91 225 097 2744 or +91 225 097 2745 or +91 226 480 2722 or +91 22 71 279 525 or +91 406 480 2722 or +91 446 480 2722 or 000 800 050 2340 (Toll Free) or 000 800 050 2400 (Toll Free) or 000 800 919 1676 (Toll Free) or 000 800 001 4002 (Toll Free) or 000 800 050 5050 (Toll Free) Ireland: +353 1 653 3895 or +353 6 163 9031 or +353 1 536 9320 or 1800 943 965 (Toll Free) or 1800 949 238 (Toll Free) or 1800 901 561 (Toll Free) Singapore: +65 3158 7288 or +65 3165 1065 or 800 101 3814 (Toll Free) or 800 852 6054 (Toll Free) or 1800 407 5602 (Toll Free) Meeting ID: 957 6687 3248 Passcode: 2123515372 International numbers<https://amd.zoom.us/u/aesPfAHnDg> Join from a Video Conference room system Meeting ID: 957 6687 3248 Passcode: 2123515372 US: 95766873248(a)global.zoomcrc.com<mailto:95766873248@global.zoomcrc.com> Passcode: 2123515372 APAC: 95766873248(a)global.zoomcrc.com<mailto:95766873248@global.zoomcrc.com> Passcode: 2123515372 India: 95766873248(a)global.zoomcrc.com<mailto:95766873248@global.zoomcrc.com> Passcode: 2123515372 Europe: 95766873248(a)global.zoomcrc.com<mailto:95766873248@global.zoomcrc.com> Passcode: 2123515372 SIP: 95766873248(a)zoomcrc.com<mailto:95766873248@zoomcrc.com> Passcode: 2123515372

2 years, 9 months

1
0
0 0

Calling for agenda: 2023-11-20 OpenAMP TSC

by Chan King Choy, Nathalie

Hi all, Please let us know if you have specific topics to cover during the OpenAMP TSC. Several OpenAMP contributors were at Linux Plumbers this week & possibly a few at RISC-V Summit earlier in the month. Here are a few suggestions for agenda topics: * Brief updates: * OpenAMP Governance page * Latest news from the working groups * Board has approved some infrastructure spending * Any OpenAMP-related topics coming out of Linux Plumbers? * RISC-V * Tomas: RISE & OpenAMP * Any OpenAMP-related topics coming out of RISC-V Summit? * Documentation improvements * Improvements over the past ~1 year * Suggestion was raised at Board meeting to consider if OpenAMP should hire a professional tech writer who could also be a user & go through OpenAMP docs to clean up & make it more usable - raise issues, call out what's missing. Tomas will run the call (it's 50/50 if I will make it). If someone could remind him/us to record the call, that would be great! Thanks & regards, Nathalie -----Original Appointment----- From: Chan King Choy, Nathalie Sent: Wednesday, November 1, 2023 11:31 AM To: Chan King Choy, Nathalie; OpenAMP TSC; Bill Mills; Ashfield, Bruce; Milea, Danut Gabriel (Danut); gokhan.gokce(a)arm.com; Drew Reed; Grant Likely; hnagalla(a)ti.com; Glaropoulos, Ioannis; jeffrey.hancock(a)siemens.com; Jiafei Pan; Nishanth Menon; Bajjuri, Praneeth; White Weng Cc: Burton, Felix; Leino, Tammy; Ed Mooring; Andrew Wafaa; Shah, Tanmay; Evensen, Tomas; Loic PALLARDY; Cufí, Carles Subject: OpenAMP TSC When: Monday, November 20, 2023 7:00 AM-8:00 AM (UTC-08:00) Pacific Time (US & Canada). Where: https://amd.zoom.us/j/95766873248?pwd=UlhJekp4eU9qSnRLSUtnVmpGNFNVdz09&from… Notes from previous TSC calls can be found at https://github.com/OpenAMP/open-amp/wiki/Meeting-Notes#user-content-2023 Will call for agenda closer to the date of the meeting. [https://st2.zoom.us/static/6.3.16616/image/new/ZoomLogo_110_25.png]<https://zoom.us/> Hi there, Nathalie Chan King Choy is inviting you to a scheduled Zoom meeting. Join Zoom Meeting<https://amd.zoom.us/j/95766873248?pwd=UlhJekp4eU9qSnRLSUtnVmpGNFNVdz09&from…> Phone one-tap: US: +17209289299,,95766873248#,,,,,,0#,,2123515372#<tel:+17209289299,,95766873248#,,,,,,0#,,2123515372#> or +19292056099,,95766873248#,,,,,,0#,,2123515372#<tel:+19292056099,,95766873248#,,,,,,0#,,2123515372#> Meeting URL: https://amd.zoom.us/j/95766873248?pwd=UlhJekp4eU9qSnRLSUtnVmpGNFNVdz09&from… Meeting ID: 957 6687 3248 Passcode: w5%CWufP8% Join by Telephone For higher quality, dial a number based on your current location. Dial: US: +1 720 928 9299 or +1 929 205 6099 or +1 669 900 6833 or 833 928 4609 (Toll Free) or 833 928 4610 (Toll Free) or 877 853 5257 (Toll Free) or 888 475 4499 (Toll Free) or 833 548 0276 (Toll Free) or 833 548 0282 (Toll Free) or 833 928 4608 (Toll Free) India: +91 806 480 2722 or +91 80 71 279 440 or +91 116 480 2722 or +91 22 48 798 004 or +91 224 879 8012 or +91 225 097 2744 or +91 225 097 2745 or +91 226 480 2722 or +91 22 71 279 525 or +91 406 480 2722 or +91 446 480 2722 or 000 800 050 2340 (Toll Free) or 000 800 050 2400 (Toll Free) or 000 800 919 1676 (Toll Free) or 000 800 001 4002 (Toll Free) or 000 800 050 5050 (Toll Free) Ireland: +353 1 653 3895 or +353 6 163 9031 or +353 1 536 9320 or 1800 943 965 (Toll Free) or 1800 949 238 (Toll Free) or 1800 901 561 (Toll Free) Singapore: +65 3158 7288 or +65 3165 1065 or 800 101 3814 (Toll Free) or 800 852 6054 (Toll Free) or 1800 407 5602 (Toll Free) Meeting ID: 957 6687 3248 Passcode: 2123515372 International numbers<https://amd.zoom.us/u/aesPfAHnDg> Join from a Video Conference room system Meeting ID: 957 6687 3248 Passcode: 2123515372 US: 95766873248(a)global.zoomcrc.com<mailto:95766873248@global.zoomcrc.com> Passcode: 2123515372 APAC: 95766873248(a)global.zoomcrc.com<mailto:95766873248@global.zoomcrc.com> Passcode: 2123515372 India: 95766873248(a)global.zoomcrc.com<mailto:95766873248@global.zoomcrc.com> Passcode: 2123515372 Europe: 95766873248(a)global.zoomcrc.com<mailto:95766873248@global.zoomcrc.com> Passcode: 2123515372 SIP: 95766873248(a)zoomcrc.com<mailto:95766873248@zoomcrc.com> Passcode: 2123515372

2 years, 9 months

1
0
0 0

OpenAMP TSC

by Chan King Choy, Nathalie

Notes from previous TSC calls can be found at https://github.com/OpenAMP/open-amp/wiki/Meeting-Notes#user-content-2023 Will call for agenda closer to the date of the meeting. [https://st2.zoom.us/static/6.3.16616/image/new/ZoomLogo_110_25.png]<https://zoom.us/> Hi there, Nathalie Chan King Choy is inviting you to a scheduled Zoom meeting. Join Zoom Meeting<https://amd.zoom.us/j/95766873248?pwd=UlhJekp4eU9qSnRLSUtnVmpGNFNVdz09&from…> Phone one-tap: US: +17209289299,,95766873248#,,,,,,0#,,2123515372#<tel:+17209289299,,95766873248#,,,,,,0#,,2123515372#> or +19292056099,,95766873248#,,,,,,0#,,2123515372#<tel:+19292056099,,95766873248#,,,,,,0#,,2123515372#> Meeting URL: https://amd.zoom.us/j/95766873248?pwd=UlhJekp4eU9qSnRLSUtnVmpGNFNVdz09&from… Meeting ID: 957 6687 3248 Passcode: w5%CWufP8% Join by Telephone For higher quality, dial a number based on your current location. Dial: US: +1 720 928 9299 or +1 929 205 6099 or +1 669 900 6833 or 833 928 4609 (Toll Free) or 833 928 4610 (Toll Free) or 877 853 5257 (Toll Free) or 888 475 4499 (Toll Free) or 833 548 0276 (Toll Free) or 833 548 0282 (Toll Free) or 833 928 4608 (Toll Free) India: +91 806 480 2722 or +91 80 71 279 440 or +91 116 480 2722 or +91 22 48 798 004 or +91 224 879 8012 or +91 225 097 2744 or +91 225 097 2745 or +91 226 480 2722 or +91 22 71 279 525 or +91 406 480 2722 or +91 446 480 2722 or 000 800 050 2340 (Toll Free) or 000 800 050 2400 (Toll Free) or 000 800 919 1676 (Toll Free) or 000 800 001 4002 (Toll Free) or 000 800 050 5050 (Toll Free) Ireland: +353 1 653 3895 or +353 6 163 9031 or +353 1 536 9320 or 1800 943 965 (Toll Free) or 1800 949 238 (Toll Free) or 1800 901 561 (Toll Free) Singapore: +65 3158 7288 or +65 3165 1065 or 800 101 3814 (Toll Free) or 800 852 6054 (Toll Free) or 1800 407 5602 (Toll Free) Meeting ID: 957 6687 3248 Passcode: 2123515372 International numbers<https://amd.zoom.us/u/aesPfAHnDg> Join from a Video Conference room system Meeting ID: 957 6687 3248 Passcode: 2123515372 US: 95766873248(a)global.zoomcrc.com<mailto:95766873248@global.zoomcrc.com> Passcode: 2123515372 APAC: 95766873248(a)global.zoomcrc.com<mailto:95766873248@global.zoomcrc.com> Passcode: 2123515372 India: 95766873248(a)global.zoomcrc.com<mailto:95766873248@global.zoomcrc.com> Passcode: 2123515372 Europe: 95766873248(a)global.zoomcrc.com<mailto:95766873248@global.zoomcrc.com> Passcode: 2123515372 SIP: 95766873248(a)zoomcrc.com<mailto:95766873248@zoomcrc.com> Passcode: 2123515372

2 years, 10 months

1
0
0 0

Slides and recording from OpenAMP BOF at Linaro Connect 2023

by Chan King Choy, Nathalie

Hi all, We've posted to the OpenAMP LinkedIn group about where to find the slides & recording from our BOF at Linaro Connect. In case you are not following that group, you can find & share the BOF resources in this post: https://www.linkedin.com/posts/openamp_lhr23-222-amp-bof-activity-706465974… If you can't access LinkedIn, the materials are available at https://resources.linaro.org/en/resource/ivxrQF2tyyQcQEoBCkMCM4 Best regards, Nathalie

3 years, 3 months

1
0
0 0

2026

2025

2024

2023

2022

2021

2020

2019

Tsc