-----Original Message----- From: TF-A tf-a-bounces@lists.trustedfirmware.org On Behalf Of Sandrine Bailleux via TF-A Sent: 16 June 2020 13:09 To: Alexei Fedorov Alexei.Fedorov@arm.com; Madhukar Pappireddy Madhukar.Pappireddy@arm.com; Varun Wadekar vwadekar@nvidia.com Cc: tf-a@lists.trustedfirmware.org Subject: Re: [TF-A] Upgrading libfdt library

Hi Alexei,

On 6/16/20 1:51 PM, Alexei Fedorov wrote:

...

Thanks for your very detailed explanation of the reason behind this solution. This brings the question on how do we monitor libfdt bug fixes, code cleanup, etc. (which Madhukar pointed out) and integrate these changes in TF-A source tree.

Right now, it is a manual process and not only for libfdt but for all projects TF-A depends on. We keep an eye on them and aim at updating them when necessary. Unfortunately, like any manual process, it is error-prone and things might slip through the cracks. The TF-A release tick is usually a good reminder to update all dependencies but unfortunately libfdt has been left behind for some time (about 2 years)...

As I recall, when we tried to update libfdt last time, there was significant code bloat in generated binary (feature creep?) and we abandoned the update. The policy was to stick to a stable version and only update if there are any bugfixes or new feature we would want to make use of.

Generally speaking, we might have done several fixes in the imported 3rd party library by running static checks like for MISRA compliance etc and this has to be repeated when the library is updated. Also, for security audits, it is important to be sure of the "security status" of the imported library and hence we tended to not update for every release.

But I agree that we do have to be on top of bug fixes and hence we need to update but not sure how we can balance this with concerns above.

Regarding MbedTLS, being a security critical project, we would like to encourage platform integrators to take ownership of staying upto date rather than relying on update from TF-A repo. Hence the motivation to keep it separate.

Best Regards Soby Mathew

Regards, Sandrine -- TF-A mailing list TF-A@lists.trustedfirmware.org https://lists.trustedfirmware.org/mailman/listinfo/tf-a