OpenThread MTD devices don't play well with CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED

[Louis]

We ran into issues enabling CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED on a MTD device. The device fails to join the network. Oddly enough, exit seems to be called ("exit" is outputted on the console) and the device just stalls as it attempts to join the Thread network.

uart:~$ *** Booting Zephyr OS build v3.3.99-ncs1-1 ***
exit

The issue can be reproduced on a nrf5340dk_nrf5340_cpuapp board using the openthread/cli sample and the following configuration:

#
# Copyright (c) 2020 Nordic Semiconductor
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#

# Network shell
CONFIG_SHELL=y
CONFIG_OPENTHREAD_SHELL=y
CONFIG_SHELL_ARGC_MAX=26
CONFIG_SHELL_CMD_BUFF_SIZE=416

# Enable OpenThread features set
CONFIG_OPENTHREAD_NORDIC_LIBRARY_MTD=y
CONFIG_OPENTHREAD_MTD=y
CONFIG_OPENTHREAD_FTD=n
CONFIG_OPENTHREAD_JOINER=y
CONFIG_OPENTHREAD_MANUAL_START=n
CONFIG_OPENTHREAD_JOINER_AUTOSTART=y
CONFIG_OPENTHREAD_JOINER_PSKD="J01NU5"
CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED=y
CONFIG_NET_L2_OPENTHREAD=y

# Generic networking options
CONFIG_NETWORKING=y

CONFIG_MBEDTLS_SHA1_C=n
CONFIG_FPU=y

CONFIG_GPIO_SHELL=y

Removing CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED=y or using CONFIG_OPENTHREAD_NORDIC_LIBRARY_MASTER=y fixes the issue.

[Charlie]

Hi Louis,

I don't think you can use this configuration option with this sample directly if the document does not claim support for mbedtls library.

You can read more about CONFIG_OPENTHREAD_NORDIC_LIBRARY_MASTER on pages Thread: CLI — nRF Connect SDK 2.4.2 documentation (nordicsemi.com) and Pre-built libraries — nRF Connect SDK 2.4.2 documentation (nordicsemi.com). Obviously, CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED is not an alternative option for it.

Best regards,

Charlie

[Louis]

Hi Charlie,

I’m not sure I understand. The intention is not to use this configuration option with this sample directly but to provide an easy way to reproduce what I believe is a bug. The final intention is to have a MTD device which also uses Mbed TLS and more specifically functionalities enabled by CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED (ex.: mbedtls_ssl_conf_psk).

[Louis]

Could it be that because the openthread library is prebuild, some mbedtls structures (ex. : mbedtls_ssl_config) are missing members in the pre-compiled version?

[Louis]

I pretty sure that's the issue. Adding: 

CONFIG_OPENTHREAD_SOURCES=y
CONFIG_OPENTHREAD_BUILD_OUTPUT_STRIPPED=y

fixed the issue. Of couse, it can make the certification a little trickier. I think it would make sense to provide those libraries compiled in a way that those structures include all the possible members.