methodmissing opened a new pull request, #20538:
URL: https://github.com/apache/nuttx/pull/20538
## Summary
`rpmsg_virtio` on the driver side takes the TX buffer length from
`used->len` and hands
`rpmsg_hdr.len` to endpoint callbacks unchecked; both are written by the
remote. A `used->len` of 0
became a 4 GB payload capacity and reset the chip on an RT1176; a header
length larger than the
buffer let callbacks read past it. Patch `0020` fixes the driver-side TX
size to `h2r_buf_size`,
clamps the RX length to `r2h_buf_size` and drops a message whose header does
not fit before any
callback runs. Applies to every rptun backend. The same change is in the
OpenAMP library itself
unchanged on its main branch, so this is also a candidate for
OpenAMP/open-amp; the NuttX patch
carries it until then. Found with the RT1170 RPTUN backend
(apache/nuttx#TBD), independent of it.
## Impact
* New feature: NO. Existing feature changed: YES, malformed remote lengths
are rejected.
* User: NO for a conforming remote. Build: one more patch in
`openamp/open-amp.defs`. Hardware: NO.
* Documentation: NO. Security: YES, positive. Compatibility: NO, the wire
protocol is unchanged.
## Testing
* Host: macOS, GNU Arm Embedded 9-2020-q2 (gcc 9.3.1). Built standalone as
`fmu-v6xrt:rptun` on
apache/nuttx master with the patch applied, and as the PX4
`px4_fmu-v6xrt_rpmsg` variant on the
PX4/NuttX 12.12 fork, where the same change is patch `0015`
(PX4/NuttX#421).
* Target: FMU-v6X-RT (i.MX RT1176 rB0) with a CM4 remote that injects the
two faults on request.
The fault injection runs from the PX4 image; the master build was
compile-tested and used for
the normal path only.
Logs before change, on the 12.12 fork: after `used->len` 0 the first ping
resets the chip, the
shell drops and the CM4 is back at state boot on reconnect.
Logs after change, 12.12 fork, run of 2026-09-28:
```
nsh> remote_core fault badused; remote_core ping 10 64
INFO [remote_core] cm4: badused: next host TX buffer comes back with
used->len 0
cm4 state 0xc0de0003 (rpmsg ready), ipsr 0, kicks rx 105, msgs tx 105
INFO [remote_core] 10/10 replies, 64 byte payload
INFO [remote_core] rtt min 28 us, avg 34 us, max 69 us
nsh> remote_core fault badhdr; remote_core hello
ERROR [remote_core] badhdr: no reply within 500 ms
cm4 state 0xc0de0003 (rpmsg ready), ipsr 0, kicks rx 116, msgs tx 116
INFO [remote_core] cm7 -> cm4: "hello from cm7"
INFO [remote_core] cm4 -> cm7: "hello from cm4 #111 (got: "hello from cm7")"
```
## PR verification Self-Check
* [x] This PR introduces only one functional change.
* [x] I have updated all required description fields above.
* [x] My PR adheres to Contributing Guidelines and Documentation.
* [x] My PR is still work in progress (not ready for review).
* [ ] My PR is ready for review and can be safely merged into a codebase.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
