Undefined reference to mbedtls_sha256

[nanotech]

Hello, we are currently migrating from nRF Connect v2.9.1 to v3.0.2. When doing so, we found that the tinycrypt API was deprecated and decided to move things to mbedtls. We got things to build when we have Bluetooth Security Manager Protocol (SMP) disabled, however, once we enable the security manager protocol, we run into a build error where the mbedtls functions are not defined (due to NRF_SECURITY being enabled).

Is there a configuration that will allow us to use the mbedtls functions without disabling SMP? If not, is there a way to compute the hash through Zephyr?

[dejans]

Hi,

Can you provide build log which shows the error (in NCS v3.0.2, with SMP enabled)?

Best regards,
Dejan

[nanotech]

Here's our log:

```

   ******************************
   * Running CMake for firmware *
   ******************************

-- Application: /home/user/advanced-optronics/pcap04-zephyr/firmware
-- CMake version: 3.21.0
Loading Zephyr default modules (Zephyr base).
-- Found Python3: /home/user/ncs/toolchains/7cbc0036f4/usr/local/bin/python (found suitable version "3.12.4", minimum required is "3.10") found components: Interpreter 
-- Cache files will be written to: /home/user/.cache/zephyr
-- Zephyr version: 4.0.99 (/home/user/ncs/v3.0.2/zephyr)
-- Found west (found suitable version "1.2.0", minimum required is "0.14.0")
-- Board: nrf52840dk, qualifiers: nrf52840
-- Found host-tools: zephyr 0.17.0 (/home/user/ncs/toolchains/7cbc0036f4/opt/zephyr-sdk)
-- Found toolchain: zephyr 0.17.0 (/home/user/ncs/toolchains/7cbc0036f4/opt/zephyr-sdk)
-- Found Dtc: /home/user/ncs/toolchains/7cbc0036f4/usr/bin/dtc (found suitable version "1.5.0", minimum required is "1.4.6") 
-- Found BOARD.dts: /home/user/ncs/v3.0.2/zephyr/boards/nordic/nrf52840dk/nrf52840dk_nrf52840.dts
-- Generated zephyr.dts: /home/user/advanced-optronics/pcap04-zephyr/firmware/build/firmware/zephyr/zephyr.dts
-- Generated pickled edt: /home/user/advanced-optronics/pcap04-zephyr/firmware/build/firmware/zephyr/edt.pickle
-- Generated zephyr.dts: /home/user/advanced-optronics/pcap04-zephyr/firmware/build/firmware/zephyr/zephyr.dts
-- Generated devicetree_generated.h: /home/user/advanced-optronics/pcap04-zephyr/firmware/build/firmware/zephyr/include/generated/zephyr/devicetree_generated.h
-- Including generated dts.cmake file: /home/user/advanced-optronics/pcap04-zephyr/firmware/build/firmware/zephyr/dts.cmake

warning: LOG_PRINTK (defined at subsys/logging/Kconfig.processing:8) was assigned the value 'y' but
got the value 'n'. Check these unsatisfied dependencies: LOG (=n). See
docs.zephyrproject.org/.../kconfig.html and/or look up LOG_PRINTK in the
menuconfig/guiconfig interface. The Application Development Primer, Setting Configuration Values,
and Kconfig - Tips and Best Practices sections of the manual might be helpful too.


warning: LOG_BACKEND_UART (defined at subsys/logging/backends/Kconfig.uart:4) was assigned the value
'y' but got the value 'n'. Check these unsatisfied dependencies: LOG (=n). See
docs.zephyrproject.org/.../kconfig.html and/or look up
LOG_BACKEND_UART in the menuconfig/guiconfig interface. The Application Development Primer, Setting
Configuration Values, and Kconfig - Tips and Best Practices sections of the manual might be helpful
too.


warning: SHELL_LOG_BACKEND (defined at subsys/shell/Kconfig:272) was assigned the value 'y' but got
the value 'n'. Check these unsatisfied dependencies: LOG (=n). See
docs.zephyrproject.org/.../kconfig.html and/or look up
SHELL_LOG_BACKEND in the menuconfig/guiconfig interface. The Application Development Primer, Setting
Configuration Values, and Kconfig - Tips and Best Practices sections of the manual might be helpful
too.


warning: The choice symbol MBEDTLS_BUILTIN (defined at modules/mbedtls/Kconfig:30,
modules/mbedtls/Kconfig:30) was selected (set =y), but MBEDTLS_LIBRARY_NRF_SECURITY (defined at
/home/user/ncs/v3.0.2/nrf/subsys/nrf_security/Kconfig:250) ended up as the choice selection. See
docs.zephyrproject.org/.../kconfig.html and/or look up
MBEDTLS_BUILTIN in the menuconfig/guiconfig interface. The Application Development Primer, Setting
Configuration Values, and Kconfig - Tips and Best Practices sections of the manual might be helpful
too.

Parsing /home/user/advanced-optronics/pcap04-zephyr/firmware/Kconfig
Loaded configuration '/home/user/ncs/v3.0.2/zephyr/boards/nordic/nrf52840dk/nrf52840dk_nrf52840_defconfig'
Merged configuration '/home/user/advanced-optronics/pcap04-zephyr/firmware/prj.conf'
Merged configuration '/home/user/advanced-optronics/pcap04-zephyr/firmware/ao-common/common.conf'
Merged configuration '/home/user/advanced-optronics/pcap04-zephyr/firmware/config/shell.conf'
Merged configuration '/home/user/advanced-optronics/pcap04-zephyr/firmware/build/firmware/zephyr/.config.sysbuild'
Configuration saved to '/home/user/advanced-optronics/pcap04-zephyr/firmware/build/firmware/zephyr/.config'
Kconfig header saved to '/home/user/advanced-optronics/pcap04-zephyr/firmware/build/firmware/zephyr/include/generated/zephyr/autoconf.h'
-- Found GnuLd: /home/user/ncs/toolchains/7cbc0036f4/opt/zephyr-sdk/arm-zephyr-eabi/arm-zephyr-eabi/bin/ld.bfd (found version "2.38") 
-- The C compiler identification is GNU 12.2.0
-- The CXX compiler identification is GNU 12.2.0
-- The ASM compiler identification is GNU
-- Found assembler: /home/user/ncs/toolchains/7cbc0036f4/opt/zephyr-sdk/arm-zephyr-eabi/bin/arm-zephyr-eabi-gcc
=========== Generating psa_crypto_config ===============
Backup: CONFIG_MBEDTLS_PSA_CRYPTO_SPM: False
Backup: CONFIG_MBEDTLS_PSA_CRYPTO_C: True
Backup: CONFIG_MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER: False
Backup: CONFIG_MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT: False
Backup: CONFIG_MBEDTLS_THREADING: False
Backup: CONFIG_MBEDTLS_THREADING_ALT: True
=========== Checkpoint: backup ===============
Restore: CONFIG_MBEDTLS_PSA_CRYPTO_SPM: False
Restore: CONFIG_MBEDTLS_PSA_CRYPTO_C: True
Restore: CONFIG_MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER: False
Restore: CONFIG_MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT: False
Restore: CONFIG_MBEDTLS_THREADING: False
Restore: CONFIG_MBEDTLS_THREADING_ALT: True
=========== End psa_crypto_config ===============
=========== Generating psa_crypto_library_config ===============
Backup: CONFIG_MBEDTLS_PSA_CRYPTO_C: True
Backup: CONFIG_MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER: False
Backup: CONFIG_MBEDTLS_PSA_CRYPTO_SPM: False
Backup: CONFIG_MBEDTLS_USE_PSA_CRYPTO: True
Backup: CONFIG_MBEDTLS_PLATFORM_PRINTF_ALT: False
Backup: CONFIG_MBEDTLS_THREADING: False
Backup: CONFIG_MBEDTLS_THREADING_ALT: True
=========== Checkpoint: backup ===============
Restore: CONFIG_MBEDTLS_PSA_CRYPTO_C: True
Restore: CONFIG_MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER: False
Restore: CONFIG_MBEDTLS_PSA_CRYPTO_SPM: False
Restore: CONFIG_MBEDTLS_USE_PSA_CRYPTO: True
Restore: CONFIG_MBEDTLS_PLATFORM_PRINTF_ALT: False
Restore: CONFIG_MBEDTLS_THREADING: False
Restore: CONFIG_MBEDTLS_THREADING_ALT: True
=========== End psa_crypto_library_config ===============
-- Using ccache: /home/user/ncs/toolchains/7cbc0036f4/usr/bin/ccache
-- Configuring done
-- Generating done
-- Build files have been written to: /home/user/advanced-optronics/pcap04-zephyr/firmware/build/firmware
-- Configuring done
-- Generating done
-- Build files have been written to: /home/user/advanced-optronics/pcap04-zephyr/firmware/build
-- west build: building application
[1/348] Preparing syscall dependency handling

[6/348] Generating include/generated/zephyr/version.h
-- Zephyr version: 4.0.99 (/home/user/ncs/v3.0.2/zephyr), build: v4.0.99-ncs1-2
[78/348] Building C object CMakeFiles/app.dir/src/pcap.c.obj
[159/348] Building C object zephyr/CMakeFiles/zephyr.dir/home/user/advanced-optronics/pcap04-zephyr/firmware/ao-common/pcap04-driver/src/pcap04_api.c.obj
[343/348] Linking C executable zephyr/zephyr_pre0.elf
FAILED: zephyr/zephyr_pre0.elf zephyr/zephyr_pre0.map /home/user/advanced-optronics/pcap04-zephyr/firmware/build/firmware/zephyr/zephyr_pre0.map 
: && ccache /home/user/ncs/toolchains/7cbc0036f4/opt/zephyr-sdk/arm-zephyr-eabi/bin/arm-zephyr-eabi-gcc  -gdwarf-4 zephyr/CMakeFiles/zephyr_pre0.dir/misc/empty_file.c.obj -o zephyr/zephyr_pre0.elf  zephyr/CMakeFiles/offsets.dir/./arch/arm/core/offsets/offsets.c.obj  -T  zephyr/linker_zephyr_pre0.cmd  -Wl,-Map=/home/user/advanced-optronics/pcap04-zephyr/firmware/build/firmware/zephyr/zephyr_pre0.map  -Wl,--whole-archive  app/libapp.a  zephyr/libzephyr.a  zephyr/arch/common/libarch__common.a  zephyr/arch/arch/arm/core/libarch__arm__core.a  zephyr/arch/arch/arm/core/cortex_m/libarch__arm__core__cortex_m.a  zephyr/arch/arch/arm/core/mpu/libarch__arm__core__mpu.a  zephyr/lib/libc/picolibc/liblib__libc__picolibc.a  zephyr/lib/libc/common/liblib__libc__common.a  zephyr/lib/posix/options/liblib__posix__options.a  zephyr/lib/net_buf/liblib__net_buf.a  zephyr/soc/soc/nrf52840/libsoc__nordic.a  zephyr/subsys/random/libsubsys__random.a  zephyr/subsys/bluetooth/common/libsubsys__bluetooth__common.a  zephyr/subsys/bluetooth/host/libsubsys__bluetooth__host.a  zephyr/subsys/bluetooth/crypto/libsubsys__bluetooth__crypto.a  zephyr/drivers/clock_control/libdrivers__clock_control.a  zephyr/drivers/console/libdrivers__console.a  zephyr/drivers/entropy/libdrivers__entropy.a  zephyr/drivers/flash/libdrivers__flash.a  zephyr/drivers/gpio/libdrivers__gpio.a  zephyr/drivers/hwinfo/libdrivers__hwinfo.a  zephyr/drivers/pinctrl/libdrivers__pinctrl.a  zephyr/drivers/pwm/libdrivers__pwm.a  zephyr/drivers/serial/libdrivers__serial.a  zephyr/drivers/spi/libdrivers__spi.a  zephyr/drivers/timer/libdrivers__timer.a  modules/nrf/lib/dk_buttons_and_leds/lib..__nrf__lib__dk_buttons_and_leds.a  modules/nrf/lib/multithreading_lock/lib..__nrf__lib__multithreading_lock.a  modules/nrf/subsys/bluetooth/controller/lib..__nrf__subsys__bluetooth__controller.a  modules/nrf/subsys/nrf_security/src/zephyr/libmbedtls_zephyr.a  modules/nrf/subsys/mpsl/init/lib..__nrf__subsys__mpsl__init.a  modules/nrf/subsys/mpsl/fem/lib..__nrf__subsys__mpsl__fem.a  modules/nrf/drivers/hw_cc3xx/lib..__nrf__drivers__hw_cc3xx.a  modules/nrf/drivers/mpsl/clock_control/lib..__nrf__drivers__mpsl__clock_control.a  modules/nrf/drivers/mpsl/flash_sync/lib..__nrf__drivers__mpsl__flash_sync.a  modules/hal_nordic/modules/hal_nordic/nrfx/libmodules__hal_nordic__nrfx.a  modules/segger/libmodules__segger.a  -Wl,--no-whole-archive  zephyr/kernel/libkernel.a  -L/home/user/advanced-optronics/pcap04-zephyr/firmware/build/firmware/zephyr  zephyr/arch/common/libisr_tables.a  -mcpu=cortex-m4  -mthumb  -mabi=aapcs  -mfp16-format=ieee  -mtp=soft  -fuse-ld=bfd  -Wl,--gc-sections  -Wl,--build-id=none  -Wl,--sort-common=descending  -Wl,--sort-section=alignment  -Wl,-u,_OffsetAbsSyms  -Wl,-u,_ConfigAbsSyms  -nostdlib  -static  -Wl,-X  -Wl,-N  -Wl,--orphan-handling=warn  -Wl,-no-pie  -specs=picolibc.specs  -DPICOLIBC_LONG_LONG_PRINTF_SCANF  modules/nrf/subsys/nrf_security/src/libmbedcrypto.a  modules/nrf/subsys/nrf_security/src/core/nrf_oberon/liboberon_psa_core.a  modules/nrf/subsys/nrf_security/src/drivers/nrf_oberon/liboberon_psa_driver.a  /home/user/ncs/v3.0.2/nrfxlib/crypto/nrf_oberon/lib/cortex-m4/soft-float/liboberon_mbedtls_3.0.16.a  modules/nrf/subsys/nrf_security/src/libmbedcrypto.a  modules/nrf/subsys/nrf_security/src/core/nrf_oberon/liboberon_psa_core.a  modules/nrf/subsys/nrf_security/src/drivers/nrf_oberon/liboberon_psa_driver.a  /home/user/ncs/v3.0.2/nrfxlib/crypto/nrf_oberon/lib/cortex-m4/soft-float/liboberon_mbedtls_3.0.16.a  /home/user/ncs/v3.0.2/nrfxlib/crypto/nrf_cc310_platform/lib/cortex-m4/soft-float/no-interrupts/libnrf_cc310_platform_0.9.19.a  modules/nrf/subsys/nrf_security/src/libmbedcrypto_base.a  modules/nrf/subsys/nrf_security/src/libnrf_security_utils.a  zephyr/kernel/libkernel.a  /home/user/ncs/v3.0.2/nrfxlib/crypto/nrf_oberon/lib/cortex-m4/soft-float/liboberon_3.0.16.a  /home/user/ncs/v3.0.2/nrfxlib/softdevice_controller/lib/nrf52/soft-float/libsoftdevice_controller_peripheral.a  /home/user/ncs/v3.0.2/nrfxlib/mpsl/fem/common/lib/nrf52/soft-float/libmpsl_fem_common.a  /home/user/ncs/v3.0.2/nrfxlib/mpsl/fem/nrf21540_gpio/lib/nrf52/soft-float/libmpsl_fem_nrf21540_gpio.a  /home/user/ncs/v3.0.2/nrfxlib/mpsl/fem/nrf21540_gpio_spi/lib/nrf52/soft-float/libmpsl_fem_nrf21540_gpio_spi.a  /home/user/ncs/v3.0.2/nrfxlib/mpsl/fem/nrf2220/lib/nrf52/soft-float/libmpsl_fem_nrf2220.a  /home/user/ncs/v3.0.2/nrfxlib/mpsl/fem/nrf2240/lib/nrf52/soft-float/libmpsl_fem_nrf2240.a  /home/user/ncs/v3.0.2/nrfxlib/mpsl/fem/nrf22xx/lib/nrf52/soft-float/libmpsl_fem_nrf22xx.a  /home/user/ncs/v3.0.2/nrfxlib/mpsl/fem/simple_gpio/lib/nrf52/soft-float/libmpsl_fem_simple_gpio.a  /home/user/ncs/v3.0.2/nrfxlib/mpsl/lib/nrf52/soft-float/libmpsl.a -L"/home/user/ncs/toolchains/7cbc0036f4/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/thumb/v7e-m/nofp" -lc -lgcc && cd /home/user/advanced-optronics/pcap04-zephyr/firmware/build/firmware/zephyr && /home/user/ncs/toolchains/7cbc0036f4/usr/local/bin/cmake -E true
/home/user/ncs/toolchains/7cbc0036f4/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(login.c.obj): in function `compute_hash':
/home/user/advanced-optronics/pcap04-zephyr/firmware/src/shell/login.c:112: undefined reference to `mbedtls_sha256'
collect2: error: ld returned 1 exit status
ninja: build stopped: subcommand failed.
FAILED: _sysbuild/sysbuild/images/firmware-prefix/src/firmware-stamp/firmware-build /home/user/advanced-optronics/pcap04-zephyr/firmware/build/_sysbuild/sysbuild/images/firmware-prefix/src/firmware-stamp/firmware-build 
cd /home/user/advanced-optronics/pcap04-zephyr/firmware/build/firmware && /home/user/ncs/toolchains/7cbc0036f4/usr/local/bin/cmake --build .
ninja: build stopped: subcommand failed.
FATAL ERROR: command exited with status 1: /home/user/ncs/toolchains/7cbc0036f4/usr/local/bin/cmake --build /home/user/advanced-optronics/pcap04-zephyr/firmware/build

```

[dejans]

Hi,

Can you show your build command and provide project configuration?

Best regards,
Dejan

[nanotech]

Here is all of our configs (including our shell.conf and common.conf). Note that CONFIG_AOS_SECURITY_AUTHEN selects BT_SMP and the flash settings for authenticated connections.

# Bluetooth Configurations
CONFIG_BT=y
CONFIG_BT_PERIPHERAL=y
CONFIG_AOS=y
CONFIG_AOS_SECURITY_AUTHEN=y
CONFIG_BT_DEVICE_NAME="AO Transmitter"
CONFIG_BT_GATT_CLIENT=y
CONFIG_BT_MAX_PAIRED=1

# Crypto
CONFIG_MBEDTLS=y
CONFIG_MBEDTLS_BUILTIN=y
# CONFIG_MBEDTLS_LIBRARY=y

# TODO: Uncomment these when preferred parameters are confirmed
# CONFIG_BT_PERIPHERAL_PREF_MIN_INT=16
# CONFIG_BT_PERIPHERAL_PREF_MAX_INT=16
# CONFIG_BT_PERIPHERAL_PREF_LATENCY=0
# CONFIG_BT_PERIPHERAL_PREF_TIMEOUT=72
# CONFIG_BT_GAP_AUTO_UPDATE_CONN_PARAMS=y

CONFIG_BT_USER_PHY_UPDATE=y

# 244 bytes of payload
CONFIG_BT_L2CAP_TX_MTU=247
CONFIG_BT_BUF_ACL_TX_SIZE=251
CONFIG_BT_BUF_ACL_RX_SIZE=251
CONFIG_BT_CTLR_DATA_LENGTH_MAX=251

# Clock
CONFIG_CLOCK_CONTROL_NRF=y
CONFIG_CLOCK_CONTROL_NRF_K32SRC_XTAL=y
CONFIG_CLOCK_CONTROL_NRF_K32SRC_RC=n
CONFIG_CLOCK_CONTROL_NRF_K32SRC_SYNTH=n
CONFIG_CLOCK_CONTROL_NRF_K32SRC_RC_CALIBRATION=n

# Dynamic Memory
CONFIG_HEAP_MEM_POOL_SIZE=3000
CONFIG_BT_RX_STACK_SIZE=4096
CONFIG_MPSL_WORK_STACK_SIZE=2048
CONFIG_MAIN_STACK_SIZE=2048
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=4096

# Peripheral Drivers
CONFIG_SPI=y
CONFIG_GPIO=y
CONFIG_PWM=y
CONFIG_PCAP_LIB=y
CONFIG_DK_LIBRARY=y

# Power management
CONFIG_POWEROFF=y
# Uncomment if anything needs to be in a low power state while off
#CONFIG_PM_DEVICE=y
CONFIG_HWINFO=y

# LED API
CONFIG_BLINK_PWM_DC=40
CONFIG_FADE_MAX_DC=40
CONFIG_STEADY_ON_DC=40
CONFIG_BLINK_WORK_PERIOD=250
CONFIG_LED_WORK_STACK_SIZE=1024

# PCAP Interface
CONFIG_PCAP_STACK_SIZE=8192

# Settings
CONFIG_SETTINGS=y
CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y
CONFIG_NVS=y

CONFIG_CRC=y
CONFIG_AO_FRAME_DEVICE=y

CONFIG_AO_SETTINGS=y

CONFIG_SHELL=y
CONFIG_SHELL_BACKEND_SERIAL=y

CONFIG_LOG_PRINTK=y
CONFIG_LOG_BACKEND_UART=y
CONFIG_SHELL_LOG_BACKEND=y

Then here is the build command:

west build --build-dir /home/user/advanced-optronics/pcap04-zephyr/firmware/build /home/user/advanced-optronics/pcap04-zephyr/firmware --pristine --board nrf52840dk/nrf52840 --sysbuild -- -DEXTRA_CONF_FILE="config/shell.conf;ao-common/common.conf" -DCONF_FILE="prj.conf" -DDTC_OVERLAY_FILE="overlay/nrf52840dk.overlay" -DBOARD_ROOT="/home/user/advanced-optronics/pcap04-zephyr"

Then here is the snippet of code that is running into the build problem:

#include <mbedtls/sha256.h>
static int compute_hash(const uint8_t *passwd, size_t input_length,
                        uint8_t *digest) {
    return mbedtls_sha256(passwd, input_length, digest, false);
}

Thank you,
Tom

[dejans]

Hi Tom,

Which configuration file is shown? Is it prj.conf?
You can upload your config files and build log by clicking on Insert->Image/video/file -> Upload.

Best regards,
Dejan