Cannot use Zephyr built-in mbedTLS library with nRF5340

RE: Cannot use Zephyr built-in mbedTLS library with nRF5340

makoto.inoue — Thu, 18 Jul 2024 07:29:02 GMT

Never mind, I've decided to modify the Zephyr's AWS IoT Core MQTT sample, and it is working now (I can connect to test.mosquitto.org). My issue seems that I was not setting up the MbedTLS settings correctly...

Best Regards,

Makoto

RE: Cannot use Zephyr built-in mbedTLS library with nRF5340

makoto.inoue — Wed, 17 Jul 2024 10:57:32 GMT

Hello Marco,

I am working with the same hardware setup (nrf5340dk + w5500 ethernet shield), trying to get nRF Connect SDK sample (samples/net/mqtt) working with TLS. I started this thread on Devzone.

Do you mind sharing:

1. Which nRF Connect SDK version you used?

2. If you used the default Zephyr W5500 driver?

3. The overlay file for the w5500 ethernet shield?

Best Regards,

Makoto

RE: Cannot use Zephyr built-in mbedTLS library with nRF5340

Marco Russi — Tue, 09 Jul 2024 08:35:04 GMT

I have managed to get the project compiling and running.

To anyone interested: here are the final .conf files:

devzone.nordicsemi.com/.../2110.prj.conf

devzone.nordicsemi.com/.../7801.nrf5340dk_5F00_nrf5340_5F00_cpuapp_5F00_ns.conf

RE: Cannot use Zephyr built-in mbedTLS library with nRF5340

Håkon Alseth — Mon, 24 Jun 2024 09:00:17 GMT

Hi,

When a fault occurs, make sure that you have "CONFIG_RESET_ON_FATAL_ERROR=n" set, and enter debug mode to see the call stack.

Share any output, related to where you are stuck.

Kind regards,

Håkon

RE: Cannot use Zephyr built-in mbedTLS library with nRF5340

Marco Russi — Fri, 21 Jun 2024 09:57:12 GMT

Hi,

I managed to get rid of all the warning with the following conf file:

devzone.nordicsemi.com/.../5554.nrf5340dk_5F00_nrf5340_5F00_cpuapp_5F00_ns.conf

I also share the prj.conf:

devzone.nordicsemi.com/.../48185.prj.conf

What worries me is that I had to disable the SSL context serialization to disable related warning:

CONFIG_MBEDTLS_SSL_CONTEXT_SERIALIZATION=n

I am not convinced about it.

Despite of it compiles, I do not see any RTT log being printed after flashing. If I instead run a simple application bypassing the board specific conf file and not compiling the network related application then I see the LOG. This confirms that the board and the RTT log itself works fine.

I guess a crash or something happens on init.

Thanks.

RE: Cannot use Zephyr built-in mbedTLS library with nRF5340

Håkon Alseth — Thu, 20 Jun 2024 09:05:08 GMT

Hi,

These are my configurations, and I'm just using a shield (-DSHIELD=arceli_eth_w5500) to get the sensor added to the board itself.

# DNS
CONFIG_DNS_RESOLVER=y
CONFIG_NET_SOCKETS_DNS_TIMEOUT=30000

# NET sockets
CONFIG_NET_NATIVE=y
CONFIG_NET_L2_ETHERNET=y
CONFIG_NET_TCP=y
CONFIG_NET_UDP=y
CONFIG_NET_SOCKETS_OFFLOAD=n
CONFIG_NET_DHCPV4=y
CONFIG_NET_CONTEXT_SNDTIMEO=y

# TLS networking
CONFIG_NET_SOCKETS_ENABLE_DTLS=n
CONFIG_NET_SOCKETS_TLS_MAX_CONTEXTS=2
CONFIG_NET_SOCKETS_SOCKOPT_TLS=y

# TLS credentials
CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE=y

# mbedTLS
CONFIG_NRF_SECURITY=y
CONFIG_MBEDTLS=y
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=81920
CONFIG_MBEDTLS_RSA_C=y
CONFIG_MBEDTLS_TLS_LIBRARY=y
CONFIG_MBEDTLS_SSL_SERVER_NAME_INDICATION=y

# Optimize T-FM
CONFIG_TFM_PROFILE_TYPE_SMALL=y
CONFIG_PM_PARTITION_SIZE_TFM_SRAM=0xc000
CONFIG_PM_PARTITION_SIZE_TFM=0x20000

# General
CONFIG_POSIX_CLOCK=y
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=4096
CONFIG_HEAP_MEM_POOL_SIZE=81920
CONFIG_NET_RX_STACK_SIZE=2048

# Optimize T-FM
CONFIG_TFM_PROFILE_TYPE_SMALL=y
CONFIG_PM_PARTITION_SIZE_TFM_SRAM=0xc000
CONFIG_PM_PARTITION_SIZE_TFM=0x20000

# PSA crypto
CONFIG_PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY=y
CONFIG_PSA_WANT_RSA_KEY_SIZE_2048=y

For your case, I think these two should be enough:

# PSA crypto
CONFIG_PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY=y
CONFIG_PSA_WANT_RSA_KEY_SIZE_2048=y

Do you still see compiler issues with similar setting?

Kind regards,

Håkon

RE: Cannot use Zephyr built-in mbedTLS library with nRF5340

Marco Russi — Tue, 18 Jun 2024 15:08:40 GMT

Thanks. I have added those lines but I get kconfig warnings as apparently there are missing dependencies. Here is the log: devzone.nordicsemi.com/.../3348.log.txt

and the .config file:devzone.nordicsemi.com/.../4024.config.txt

RE: Cannot use Zephyr built-in mbedTLS library with nRF5340

Håkon Alseth — Tue, 18 Jun 2024 09:00:22 GMT

Hi,

Looks like mbedtls elliptic curves are missing. Try adding these:

https://github.com/nrfconnect/sdk-nrf/blob/v2.7.0-rc2/samples/net/http_server/overlay-tls-nrf91.conf#L48-L58

[quote user="Marco Russi"]

NOTE: CONFIG_NRF_SECURITY seems to be always y no matter if I add it.

[/quote]

Yes, it will be selected by other components in your configuration.

If it still fails, could you share log + build/zephyr/.config file?

Kind regards,

Håkon

RE: Cannot use Zephyr built-in mbedTLS library with nRF5340

Marco Russi — Mon, 17 Jun 2024 10:34:08 GMT

Hi, I have already tried that. I have added these 2 lines:

CONFIG_NRF_SECURITY=y

CONFIG_MBEDTLS_RSA_C=y

and I get similar errors:

devzone.nordicsemi.com/.../0523.log.txt

I have then tried to fix all the checks few times but looks like I never get it right.

NOTE: CONFIG_NRF_SECURITY seems to be always y no matter if I add it.

Thanks.

RE: Cannot use Zephyr built-in mbedTLS library with nRF5340

Håkon Alseth — Mon, 17 Jun 2024 10:27:19 GMT

Hi,

NRF_SECURITY should be y-selected, so that you do not get the kconfig warning during cmake project generation.

It looks like you're missing "CONFIG_MBEDTLS_RSA_C". Try setting this and see if the compiler errors still exists.

Kind regards,

Håkon

RE: Cannot use Zephyr built-in mbedTLS library with nRF5340

Marco Russi — Mon, 17 Jun 2024 10:02:20 GMT

Hi, thank you for helping out.

I have moved most of the network related configs into a dedicated board conf file as you suggested and I modified the mbedtls configs based on the project you pointed out. Although I am not sure I am selecting the zephyr built-in mdebtls library as I removed that config macro. Anyway here is the full cmake log where you can see if complaints about some mbetls missing dependencies. This checks are done by a .h file inside nrf so I am not sure with mbedtls it is meant to use. Find the log in this txt file.

devzone.nordicsemi.com/.../8182.log.txt

and here are the two .conf file:

devzone.nordicsemi.com/.../8422.prj.conf

devzone.nordicsemi.com/.../5226.nrf5340dk_5F00_nrf5340_5F00_cpuapp_5F00_ns.conf

Thank you.

RE: Cannot use Zephyr built-in mbedTLS library with nRF5340

Håkon Alseth — Mon, 17 Jun 2024 08:08:14 GMT

Hi,

I would recommend that you split your board related configurations into the boards/ catalog, and use similar settings as done in most of the nrf/samples/net/ samples, here for the nRF7002-DK:

https://github.com/nrfconnect/sdk-nrf/blob/main/samples/net/https_client/boards/nrf7002dk_nrf5340_cpuapp_ns.conf#L37-L64

Could you try this and report back, with the full cmake generation log if it still fails?

Kind regards,

Håkon

RE: Cannot use Zephyr built-in mbedTLS library with nRF5340

Marco Russi — Sat, 15 Jun 2024 09:15:04 GMT

Hi,

I yes I am using the _ns prefix. The board is the nrf5340dk with the ethernet w5500 Arduino shield on top. I have attached the prj.conf file in the post.

Thank you.

RE: Cannot use Zephyr built-in mbedTLS library with nRF5340

Håkon Alseth — Fri, 14 Jun 2024 07:50:14 GMT

Hi,

The nRF5340 differs from nRF52840 wrt. the cortex m33 core; which provides optional Trustzone features.

Can you share information on how you're configuring your project? Which board do you use?

Do you use the _ns prefix?

Kind regards,

Håkon