nRF54L15DK - AWS IoT sample - "net_sock_tls: Failed to parse certificate on tag 201, err: -0x2100"

zpm1066 1 day ago

Hello,

I've built sample aws_iot for target nrf54l15dk/nrf54l15/cpuapp, using the provided .conf & .overlay files for nrf54l15dk using NCS 3.4.1.

The certificates and keys were generated as per Nordic instructions and placed in folder <project/certs>. The WiFi module nrf7002eb2 is placed in port P1 and the build uses "-DSHIELD=nrf7002eb2".

The only code changes were to set the Kconfigs for th eclient id and AWS broker:

CONFIG_AWS_IOT_CLIENT_ID_STATIC="my-thing"

CONFIG_AWS_IOT_BROKER_HOST_NAME="xxx.amazonaws.com"

After flashing with erase and configuring the local WiFI credentials, the nrf54l15dk connects successfully to the local WiFi but fails to parse certificate.

[00:00:00.021,423] <inf> wifi_nrf_bus: SPIM spi@c8000: freq = 8 MHz
[00:00:00.021,442] <inf> wifi_nrf_bus: SPIM spi@c8000: latency = 0
[00:00:00.275,771] <inf> fs_zms: 2 Sectors of 4096 bytes
[00:00:00.275,782] <inf> fs_zms: alloc wra: 0, f70
[00:00:00.275,790] <inf> fs_zms: data wra: 0, f0
*** Booting nRF Connect SDK v3.4.1-b20f8619ba9a ***
*** Using Zephyr OS v4.4.2-33fa6a7aac6a ***
[00:00:00.276,950] <inf> aws_iot_sample: The AWS IoT sample started, version: v1.0.0
[00:00:00.276,964] <inf> aws_iot_sample: Bringing network interface up and connecting to the network
[00:00:00.277,399] <inf> wifi_supplicant: wpa_supplicant initialized
[00:00:00.278,714] <dbg> net_sock_svc: socket_service_thread: (net_socket_service): Service WEST_TOPDIR/zephyr/subsys/net/lib/dns/resolve.c:45 has 1 pollable sockets
[00:00:00.278,731] <dbg> net_sock_svc: socket_service_thread: (net_socket_service): Monitoring 1 socket entries
[00:00:00.279,405] <dbg> mqtt_helper: mqtt_helper_poll_loop: Waiting for connection_poll_sem
[00:00:01.756,828] <inf> net_wifi_mgmt: Connection requested
[00:00:03.196,980] <inf> wpa_supp: wlan0: Reject scan trigger since one is already pending
[00:00:03.197,078] <wrn> wpa_supp: wlan0: Failed to initiate AP scan
[00:00:03.197,876] <inf> wpa_supp: wlan0: Reject scan trigger since one is already pending
[00:00:03.197,974] <wrn> wpa_supp: wlan0: Failed to initiate AP scan
[00:00:03.198,248] <inf> net_wifi_mgmt: Connection requested
[00:00:03.198,299] <dbg> mqtt_helper: mqtt_state_set: State transition: MQTT_STATE_UNINIT --> MQTT_STATE_DISCONNECTED
[00:00:04.198,320] <inf> wpa_supp: wlan0: Reject scan trigger since one is already pending
[00:00:04.198,427] <wrn> wpa_supp: wlan0: Failed to initiate AP scan
[00:00:05.198,773] <inf> wpa_supp: wlan0: Reject scan trigger since one is already pending
[00:00:05.198,880] <wrn> wpa_supp: wlan0: Failed to initiate AP scan
[00:00:05.654,274] <inf> wpa_supp: wlan0: SME: Trying to authenticate with 1e:a3:e6:b2:c8:0e (SSID='Tachyon-Ravi' freq=2437 MHz)
[00:00:06.051,349] <inf> wpa_supp: wlan0: Trying to associate with 1e:a3:e6:b2:c8:0e (SSID='Tachyon-Ravi' freq=2437 MHz)
[00:00:06.078,325] <wrn> net_if: iface 1 pkt 0x2003a388 send failure status -1
[00:00:06.082,676] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x20003080, pkt=0x2003a564, st=0, user_data=0
[00:00:06.087,783] <inf> wpa_supp: wlan0: Associated with 1e:a3:e6:b2:c8:0e
[00:00:06.088,401] <inf> wpa_supp: wlan0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
[00:00:06.102,642] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x20003080, pkt=0x2003a520, st=0, user_data=0
[00:00:06.115,149] <inf> wpa_supp: wlan0: WPA: Key negotiation completed with 1e:a3:e6:b2:c8:0e [PTK=CCMP GTK=CCMP]
[00:00:06.115,812] <inf> wpa_supp: wlan0: CTRL-EVENT-CONNECTED - Connection to 1e:a3:e6:b2:c8:0e completed [id=0 id_str=]
Connected
[00:00:06.166,283] <dbg> net_sock: zsock_socket_internal: (rx_q[0]): socket: ctx=0x20003148, fd=10
[00:00:06.167,427] <dbg> net_sock_svc: socket_service_thread: (net_socket_service): Received restart event.
[00:00:06.191,035] <inf> net_dhcpv4: Received: 172.20.10.10
[00:00:06.191,257] <inf> aws_iot_sample: Network connectivity established
[00:00:11.191,335] <inf> aws_iot_sample: Connecting to AWS IoT
[00:00:11.191,372] <dbg> aws_iot: aws_iot_connect: No hostname provided, using Kconfig value: a3sttejt5r02fo-ats.iot.us-east-1.amazonaws.com
[00:00:11.191,390] <dbg> aws_iot: aws_iot_connect: No device ID provided, using Kconfig value: nrf54l15dk-1
[00:00:11.191,495] <dbg> mqtt_helper: broker_init: Resolving IP address for a3sttejt5r02fo-ats.iot.us-east-1.amazonaws.com
[00:00:11.191,573] <dbg> net_sock_addr: exec_query: (sysworkq): Timeout 2000
[00:00:11.234,362] <dbg> net_sock: zsock_received_cb: (rx_q[0]): ctx=0x20003148, pkt=0x2003a520, st=0, user_data=0
[00:00:11.235,106] <dbg> net_sock_addr: dns_resolve_cb: (net_socket_service): dns status: -100
[00:00:11.235,125] <dbg> net_sock_addr: dns_resolve_cb: (net_socket_service): dns status: -103
[00:00:11.235,166] <dbg> net_sock_addr: exec_query: (sysworkq): Timeout 2000
[00:00:11.244,641] <dbg> net_sock: zsock_received_cb: (rx_q[0]): ctx=0x20003148, pkt=0x2003a520, st=0, user_data=0
[00:00:11.245,615] <dbg> net_sock_addr: dns_resolve_cb: (net_socket_service): dns status: -100
[00:00:11.245,642] <dbg> net_sock_addr: dns_resolve_cb: (net_socket_service): dns status: -103
[00:00:11.245,702] <dbg> mqtt_helper: broker_init: IPv4 Address found 54.204.16.139 (AF_INET)
[00:00:11.245,721] <dbg> mqtt_helper: client_connect: Using build-time provided security tag value from Kconfig
[00:00:11.245,756] <dbg> mqtt_helper: mqtt_state_set: State transition: MQTT_STATE_DISCONNECTED --> MQTT_STATE_TRANSPORT_CONNECTING
[00:00:11.245,883] <dbg> net_sock_tls: tls_alloc: (sysworkq): Allocated TLS context, 0x200027f0
[00:00:11.246,057] <dbg> net_tcp: tcp_conn_ref: (sysworkq): [0x2003a6b8] ref_count: 1
[00:00:11.246,076] <dbg> net_tcp: tcp_conn_alloc: (sysworkq): [0x2003a6b8] Allocated
[00:00:11.246,228] <dbg> net_sock: zsock_socket_internal: (sysworkq): socket: ctx=0x20003210, fd=12
[00:00:11.251,868] <err> net_sock_tls: Failed to parse certificate on tag 201, err: -0x2100
[00:00:11.252,006] <dbg> net_sock: zsock_close_ctx: (sysworkq): close: ctx=0x20003210, fd=12
[00:00:11.252,025] <dbg> net_tcp: net_tcp_recv: (sysworkq): [0x2003a6b8] context: 0x20003210, cb: 0, user_data: 0
[00:00:11.252,091] <dbg> net_tcp: net_tcp_put: (sysworkq): [0x2003a6b8]  [LISTEN Seq=0{0} Ack=0{0}]
[00:00:11.252,112] <dbg> net_tcp: net_tcp_put: (sysworkq): [0x2003a6b8] context 0x20003210 IDLE
[00:00:11.252,129] <dbg> net_tcp: tcp_conn_unref: (sysworkq): [0x2003a6b8] ref_count=1
[00:00:11.252,153] <err> mqtt_helper: mqtt_connect, error: -22
[00:00:11.252,177] <dbg> mqtt_helper: mqtt_state_set: State transition: MQTT_STATE_TRANSPORT_CONNECTING --> MQTT_STATE_DISCONNECTED
[00:00:11.252,182] <err> aws_iot: mqtt_helper_connect, error: -22
[00:00:11.252,188] <err> aws_iot_sample: aws_iot_connect, error: -22
[00:00:11.252,193] <err> aws_iot_sample: Fatal error! Rebooting the device.

"net_sock_tls: Failed to parse certificate on tag 201, err: -0x2100". The 0x2100 corresponds to MBEDTLS_ERR_X509_UNKNOWN_OID.

The same certificate & key generation process was used for nrf54lm20dk. However, nrf54lm20dk connects to AWS IoT successfully.

Is there any reason why the certificate isn't being parsed correctly for nrf54l15dk?

Thank you.

0 Simon D-M 1 day ago
Hi,

I quickly checked what difference there was between the two boards config file (.conf) and I can see that the nRF54LM20 has the following config that the nRF54L15 one doesn't :

CONFIG_MBEDTLS_RSA_C=y CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT=y CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT=y CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE=y CONFIG_PSA_WANT_ALG_ECDH=y CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE=y CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT=y

Can you please add them to boards/nrf54l15dk_nrf54l15_cpuapp.conf and try again?

Best regards,

Simon
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 zpm1066 13 hours ago in reply to Simon D-M

Hi Simon,

Thank you for picking up the ticket.

I added the above additional Kconfigs. I no longer get the parse certificate failure after the nrf54l15dk connects successfully to the local WiFi. However, this gives a stack overflow error.

00:00:00.261,993] <dbg> net_tcp: net_tcp_init: (main): Workq started. Thread ID: 0x200046a8
[00:00:00.266,235] <inf> wifi_nrf_bus: SPIM spi@4002f000: freq = 8 MHz
[00:00:00.266,265] <inf> wifi_nrf_bus: SPIM spi@4002f000: latency = 0
[00:00:00.555,603] <inf> fs_nvs: 8 Sectors of 4096 bytes
[00:00:00.555,603] <inf> fs_nvs: alloc wra: 0, fd0
[00:00:00.555,603] <inf> fs_nvs: data wra: 0, f0
*** Booting Zephyr OS build ncs-v3.4.1 ***
*** Booting nRF Connect SDK v3.4.1-b20f8619ba9a ***
*** Using Zephyr OS v4.4.2-33fa6a7aac6a ***
[00:00:00.557,403] <inf> aws_iot_sample: The AWS IoT sample started, version: v1.0.0
[00:00:00.557,464] <inf> aws_iot_sample: Bringing network interface up and connecting to the network
[00:00:00.558,227] <inf> wifi_supplicant: wpa_supplicant initialized
[00:00:00.560,363] <dbg> net_sock_svc: socket_service_thread: (net_socket_service): Service WEST_TOPDIR/zephyr/subsys/net/lib/dns/resolve.c:45 has 1 pollable sockets
[00:00:00.560,394] <dbg> net_sock_svc: socket_service_thread: (net_socket_service): Monitoring 1 socket entries
[00:00:00.560,485] <dbg> mqtt_helper: mqtt_helper_poll_loop: Waiting for connection_poll_sem
[00:00:04.499,847] <inf> net_wifi_mgmt: Connection requested
[00:00:04.499,938] <dbg> mqtt_helper: mqtt_state_set: State transition: MQTT_STATE_UNINIT --> MQTT_STATE_DISCONNECTED
[00:00:08.830,139] <wrn> net_if: iface 1 pkt 0x2003d3d8 send failure status -1
[00:00:08.839,538] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x20004128, pkt=0x2003ee44, st=0, user_data=0
[00:00:08.869,140] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x20004128, pkt=0x2003ee00, st=0, user_data=0
[00:00:10.319,000] <dbg> net_sock: zsock_socket_internal: (rx_q[0]): socket: ctx=0x200041f0, fd=10
[00:00:10.321,258] <dbg> net_sock_svc: socket_service_thread: (net_socket_service): Received restart event.
[00:00:10.419,006] <inf> aws_iot_sample: Network connectivity established
[00:00:11.935,363] <inf> net_dhcpv4: Received: 172.20.10.9
[00:00:11.935,852] <inf> aws_iot_sample: DHCP IP address: 172.20.10.9
[00:00:15.419,067] <inf> aws_iot_sample: Connecting to AWS IoT
[00:00:15.419,128] <dbg> aws_iot: aws_iot_connect: No hostname provided, using Kconfig value: a3sttejt5r02fo-ats.iot.us-east-1.amazonaws.com
[00:00:15.419,189] <dbg> aws_iot: aws_iot_connect: No device ID provided, using Kconfig value: xenon-1
[00:00:15.419,403] <dbg> mqtt_helper: broker_init: Resolving IP address for a3sttejt5r02fo-ats.iot.us-east-1.amazonaws.com
[00:00:15.419,494] <dbg> net_sock_addr: exec_query: (sysworkq): Timeout 5000
[00:00:15.437,988] <dbg> net_sock: zsock_received_cb: (rx_q[0]): ctx=0x200041f0, pkt=0x2003ee00, st=0, user_data=0
[00:00:15.439,208] <dbg> net_sock_addr: dns_resolve_cb: (net_socket_service): dns status: -100
[00:00:15.439,270] <dbg> net_sock_addr: dns_resolve_cb: (net_socket_service): dns status: -103
[00:00:15.439,331] <dbg> net_sock_addr: exec_query: (sysworkq): Timeout 5000
[00:00:15.448,883] <dbg> net_sock: zsock_received_cb: (rx_q[0]): ctx=0x200041f0, pkt=0x2003ee00, st=0, user_data=0
[00:00:15.453,826] <dbg> net_sock_addr: dns_resolve_cb: (net_socket_service): dns status: -100
[00:00:15.453,887] <dbg> net_sock_addr: dns_resolve_cb: (net_socket_service): dns status: -103
[00:00:15.453,979] <dbg> mqtt_helper: broker_init: IPv4 Address found 18.213.248.238 (AF_INET)
[00:00:15.454,010] <dbg> mqtt_helper: client_connect: Using build-time provided security tag value from Kconfig
[00:00:15.454,071] <dbg> mqtt_helper: mqtt_state_set: State transition: MQTT_STATE_DISCONNECTED --> MQTT_STATE_TRANSPORT_CONNECTING
[00:00:15.454,376] <dbg> net_sock_tls: tls_alloc: (sysworkq): Allocated TLS context, 0x200028f0
[00:00:15.454,711] <dbg> net_tcp: tcp_conn_ref: (sysworkq): [0x2003d790] ref_count: 1
[00:00:15.454,742] <dbg> net_tcp: tcp_conn_alloc: (sysworkq): [0x2003d790] Allocated
[00:00:15.455,047] <dbg> net_sock: zsock_socket_internal: (sysworkq): socket: ctx=0x200042b8, fd=12
[00:00:15.499,572] <dbg> net_tcp: net_tcp_recv: (sysworkq): [0x2003d790] context: 0x200042b8, cb: 0x258a9, user_data: 0
[00:00:15.500,030] <dbg> net_tcp: net_tcp_connect: (sysworkq): [0x2003d790] context: 0x200042b8, local: 0.0.0.0, remote: 18.213.248.238
[00:00:15.500,640] <dbg> net_tcp: net_tcp_connect: (sysworkq): [0x2003d790] src: 172.20.10.9, dst: 18.213.248.238
[00:00:15.500,976] <dbg> net_tcp: tcp_start_handshake: (sysworkq): [0x2003d790] LISTEN->SYN_SENT
[00:00:15.501,007] <dbg> net_tcp: tcp_conn_ref: (sysworkq): [0x2003d790] ref_count: 2
[00:00:15.584,503] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] SYN,ACK Seq=2157556659{2157556659} Ack=1{577747015} Len=0 [SYN_SENT Seq=0{577747015} Ack=2137410637{0}]
[00:00:15.584,564] <dbg> net_tcp: tcp_options_check: (rx_q[0]): len=4
[00:00:15.584,594] <dbg> net_tcp: tcp_options_check: (rx_q[0]): opt: 2, opt_len: 4
[00:00:15.584,625] <dbg> net_tcp: tcp_options_check: (rx_q[0]): MSS=1370
[00:00:15.584,655] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] Lowering send window from 26883 to 1365
[00:00:15.584,716] <dbg> net_tcp: tcp_new_reno_log: (rx_q[0]): [0x2003d790] ca init, cwnd=1370, ssthres=4110, fast_pend=0
[00:00:15.584,991] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] SYN_SENT->ESTABLISHED
[00:00:15.585,388] <dbg> net_tcp: net_tcp_connect: (sysworkq): [0x2003d790] ret=0
[00:00:15.634,216] <dbg> net_tcp: net_tcp_recv: (sysworkq): [0x2003d790] context: 0x200042b8, cb: 0x258a9, user_data: 0
[00:00:15.635,314] <dbg> net_tcp: tcp_send_data: (sysworkq): [0x2003d790] total=179, unacked_len=179, send_win=1365, mss=1370
[00:00:15.635,375] <dbg> net_tcp: tcp_send_data: (sysworkq): [0x2003d790] send_data_timer=0, send_data_retries=0
[00:00:15.704,254] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] ACK Seq=1{2157556660} Ack=180{577747194} Len=0 [ESTABLISHED Seq=4294967117{577747015} Ack=0{2157556660}]
[00:00:15.704,315] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] Lowering send window from 27872 to 1365
[00:00:15.704,345] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] len_acked=179
[00:00:15.704,406] <dbg> net_tcp: tcp_new_reno_log: (rx_q[0]): [0x2003d790] ca pkts_acked, cwnd=1549, ssthres=4110, fast_pend=0
[00:00:15.704,467] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] total=0, unacked_len=0, send_win=1365, mss=1370
[00:00:15.704,498] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] send_data_timer=1, send_data_retries=0
[00:00:15.706,420] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] ACK,PSH Seq=1{2157556660} Ack=180{577747194} Len=100 [ESTABLISHED Seq=0{577747194} Ack=0{2157556660}]
[00:00:15.706,451] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] Lowering send window from 27872 to 1365
[00:00:15.706,756] <dbg> net_sock: zsock_received_cb: (rx_q[0]): ctx=0x200042b8, pkt=0x2003ee00, st=0, user_data=0
[00:00:15.713,684] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] ACK Seq=101{2157556760} Ack=180{577747194} Len=682 [ESTABLISHED Seq=0{577747194} Ack=0{2157556760}]
[00:00:15.713,775] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] Lowering send window from 27872 to 1365
[00:00:15.713,897] <dbg> net_sock: zsock_received_cb: (rx_q[0]): ctx=0x200042b8, pkt=0x2003ee00, st=0, user_data=0
[00:00:15.774,078] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] Lowering send window from 27872 to 1365
--- 1 messages dropped ---
[00:00:15.774,383] <dbg> net_sock: zsock_received_cb: (rx_q[0]): ctx=0x200042b8, pkt=0x2003ee00, st=0, user_data=0
[00:00:15.782,867] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] ACK Seq=1465{2157558124} Ack=180{577747194} Len=682 [ESTABLISHED Seq=0{577747194} Ack=0{2157558124}]
[00:00:15.782,897] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] Lowering send window from 27872 to 1365
[00:00:15.783,020] <dbg> net_sock: zsock_received_cb: (rx_q[0]): ctx=0x200042b8, pkt=0x2003ee00, st=0, user_data=0
[00:00:15.829,833] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] ACK,PSH Seq=2147{2157558806} Ack=180{577747194} Len=682 [ESTABLISHED Seq=0{577747194} Ack=0{2157558806}]
[00:00:15.829,864] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] Lowering send window from 27872 to 1365
[00:00:15.830,169] <dbg> net_sock: zsock_received_cb: (rx_q[0]): ctx=0x200042b8, pkt=0x2003ee00, st=0, user_data=0
[00:00:15.838,684] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] ACK Seq=2829{2157559488} Ack=180{577747194} Len=682 [ESTABLISHED Seq=0{577747194} Ack=0{2157559488}]
[00:00:15.838,775] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] Lowering send window from 27872 to 1365
[00:00:15.838,897] <dbg> net_sock: zsock_received_cb: (rx_q[0]): ctx=0x200042b8, pkt=0x2003ee00, st=0, user_data=0
[00:00:15.893,188] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] Lowering send window from 27872 to 1365
--- 4 messages dropped ---
[00:00:15.893,310] <dbg> net_sock: zsock_received_cb: (rx_q[0]): ctx=0x200042b8, pkt=0x2003ee00, st=0, user_data=0
[00:00:15.945,434] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] ACK,PSH Seq=4875{2157561534} Ack=180{577747194} Len=608 [ESTABLISHED Seq=0{577747194} Ack=0{2157561534}]
[00:00:15.945,465] <dbg> net_tcp: tcp_in: (rx_q[0]): [0x2003d790] Lowering send window from 27872 to 1365
[00:00:15.945,770] <dbg> net_sock: zsock_received_cb: (rx_q[0]): ctx=0x200042b8, pkt=0x2003ee00, st=0, user_data=0
[00:00:16.007,049] <dbg> net_tcp: net_tcp_recv: (sysworkq): [0x2003d790] context: 0x200042b8, cb: 0x258a9, user_data: 0
[00:00:16.007,659] <dbg> net_tcp: tcp_send_data: (sysworkq): [0x2003d790] total=876, unacked_len=876, send_win=1365, mss=1370
[00:00:16.007,690] <dbg> net_tcp: tcp_send_data: (sysworkq): [0x2003d790] send_data_timer=0, send_data_retries=0
[00:00:16.057,189] <dbg> net_tcp: net_tcp_recv: (sysworkq): [0x2003d790] context: 0x200042b8, cb: 0x258a9, user_data: 0
[00:00:16.058,319] <err> os: ***** MPU FAULT *****
[00:00:16.058,319] <err> os:   Stacking error (context area might be not valid)
[00:00:16.058,319] <err> os:   Data Access Violation
[00:00:16.058,349] <err> os:   MMFAR Address: 0x2002559c
[00:00:16.058,380] <err> os: r0/a1:  0xaaaaaaaa  r1/a2:  0xaaaaaaaa  r2/a3:  0xaaaaaaaa
[00:00:16.058,410] <err> os: r3/a4:  0xaaaaaaaa r12/ip:  0xaaaaaaaa r14/lr:  0xaaaaaaaa
[00:00:16.058,410] <err> os:  xpsr:  0xaaaaaa00
[00:00:16.058,441] <err> os: Faulting instruction address (r15/pc): 0xaaaaaaaa
[00:00:16.058,471] <err> os: >>> ZEPHYR FATAL ERROR 2: Stack overflow on CPU 0
[00:00:16.058,502] <err> os: Current thread: 0x20004da8 (sysworkq)
[00:00:16.751,281] <err> os: Halting system

As has been the case to successfully connect nRF5340DK / nRF54LM20DK devices (non-secure & secure) to AWS IoT, in the past I've had to tweak various heap sizes to resolve potential crashes during TLS connections.

After tweaking the following Kconfig, I'm able to successfully connect to AWS IoT and the connection is stable. No issues.

CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=8192

CONFIG_MBEDTLS_HEAP_SIZE=45000

CONFIG_HEAP_MEM_POOL_SIZE=32000

CONFIG_NRF_WIFI_DATA_HEAP_SIZE=30000

These changes yielded RAM usage at just under 92%.

Console output:

[00:00:00.021,037] <inf> wifi_nrf_bus: SPIM spi@c8000: freq = 8 MHz
[00:00:00.021,056] <inf> wifi_nrf_bus: SPIM spi@c8000: latency = 0
[00:00:00.274,264] <inf> fs_zms: 2 Sectors of 4096 bytes
[00:00:00.274,275] <inf> fs_zms: alloc wra: 0, f70
[00:00:00.274,284] <inf> fs_zms: data wra: 0, f0
*** Booting nRF Connect SDK v3.4.1-b20f8619ba9a ***
*** Using Zephyr OS v4.4.2-33fa6a7aac6a ***
[00:00:00.275,341] <inf> aws_iot_sample: The AWS IoT sample started, version: v1.0.0
[00:00:00.275,356] <inf> aws_iot_sample: Bringing network interface up and connecting to the network
[00:00:00.275,752] <inf> wifi_supplicant: wpa_supplicant initialized
[00:00:05.524,289] <inf> wpa_supp: wlan0: SME: Trying to authenticate with b2:9a:79:94:c9:0b (SSID='Tachyon-Ravi' freq=2437 MHz)
[00:00:05.897,563] <inf> wpa_supp: wlan0: Trying to associate with b2:9a:79:94:c9:0b (SSID='Tachyon-Ravi' freq=2437 MHz)
[00:00:05.932,988] <inf> wpa_supp: wlan0: Associated with b2:9a:79:94:c9:0b
[00:00:05.933,987] <inf> wpa_supp: wlan0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
[00:00:05.960,411] <inf> wpa_supp: wlan0: WPA: Key negotiation completed with b2:9a:79:94:c9:0b [PTK=CCMP GTK=CCMP]
[00:00:05.961,075] <inf> wpa_supp: wlan0: CTRL-EVENT-CONNECTED - Connection to b2:9a:79:94:c9:0b completed [id=0 id_str=]
Connected
[00:00:07.468,133] <inf> aws_iot_sample: Network connectivity established
[00:00:12.468,221] <inf> aws_iot_sample: Connecting to AWS IoT
[00:00:12.468,259] <dbg> aws_iot: aws_iot_connect: No hostname provided, using Kconfig value: a3sttejt5r02fo-ats.iot.us-east-1.amazonaws.com
[00:00:12.468,279] <dbg> aws_iot: aws_iot_connect: No device ID provided, using Kconfig value: nrf54l15dk-1
[00:00:14.130,957] <dbg> aws_iot: on_connack: MQTT client connected!
[00:00:14.130,987] <dbg> aws_iot: subscribe: Subscribing to topic: my-custom-topic/example
[00:00:14.131,006] <dbg> aws_iot: subscribe: Subscribing to topic: my-custom-topic/example_2
[00:00:14.132,995] <dbg> aws_iot: subscribe: Subscribing to topic: $aws/things/nrf54l15dk-1/shadow/get/accepted
[00:00:14.133,020] <dbg> aws_iot: subscribe: Subscribing to topic: $aws/things/nrf54l15dk-1/shadow/get/rejected
[00:00:14.133,043] <dbg> aws_iot: subscribe: Subscribing to topic: $aws/things/nrf54l15dk-1/shadow/update/delta
[00:00:14.236,492] <dbg> aws_iot: on_suback: Received ACK for subscribe message: id = 2469 result = 0
[00:00:14.290,204] <dbg> aws_iot: on_suback: Received ACK for subscribe message: id = 1984 result = 0
[00:00:14.290,223] <dbg> aws_iot: aws_iot_send: Using message ID 1
[00:00:14.290,248] <dbg> aws_iot: aws_iot_send: Publishing to topic: $aws/things/nrf54l15dk-1/shadow/get
[00:00:14.291,051] <dbg> aws_iot: device_shadow_document_request: Device shadow document requested
[00:00:14.291,158] <inf> aws_iot_sample: AWS_IOT_EVT_CONNECTED
[00:00:14.291,323] <inf> aws_iot_sample: Publishing message: {"state":{"reported":{"uptime":14291,"app_version":"v1.0.0"}}} to AWS IoT shadow
[00:00:14.291,338] <dbg> aws_iot: aws_iot_send: Using message ID 2
[00:00:14.291,359] <dbg> aws_iot: aws_iot_send: Publishing to topic: $aws/things/nrf54l15dk-1/shadow/update
[00:00:14.471,227] <dbg> aws_iot: on_publish: Received message: topic = $aws/things/nrf54l15dk-1/shadow/get/accepted and len = 197 
[00:00:14.471,252] <inf> aws_iot_sample: AWS_IOT_EVT_DATA_RECEIVED
[00:00:14.471,308] <inf> aws_iot_sample: Received message: "{"state":{"reported":{"uptime":58377,"app_version":"v1.0.0"}},"metadata":{"reported":{"uptime":{"timestamp":1794338812},"app_version":{"timestamp":1794338812}}},"version":93,"timestamp":1794338870}" on topic: "$aws/things/nrf54l15dk-1/shadow/get/accepted"
uart:~$ 
[00:00:31.438,813] <dbg> aws_iot: on_publish: Received message: topic = my-custom-topic/example_2 and len = 56 
[00:00:31.438,948] <inf> aws_iot_sample: AWS_IOT_EVT_DATA_RECEIVED
[00:00:31.439,305] <inf> aws_iot_sample: Received message: "{
                                                               "message": "Hello from nRF54L15DK AWS IoT console"
                                                                                                                 }" on topic: "my-custom-topic/example_2"
[00:01:14.292,067] <inf> aws_iot_sample: Publishing message: {"state":{"reported":{"uptime":74291,"app_version":"v1.0.0"}}} to AWS IoT shadow
[00:01:14.292,092] <dbg> aws_iot: aws_iot_send: Using message ID 3
[00:01:14.292,114] <dbg> aws_iot: aws_iot_send: Publishing to topic: $aws/things/nrf54l15dk-1/shadow/update
[00:02:14.292,954] <inf> aws_iot_sample: Publishing message: {"state":{"reported":{"uptime":134292,"app_version":"v1.0.0"}}} to AWS IoT shadow
[00:02:14.292,979] <dbg> aws_iot: aws_iot_send: Using message ID 4
[00:02:14.293,003] <dbg> aws_iot: aws_iot_send: Publishing to topic: $aws/things/nrf54l15dk-1/shadow/update
uart:~$ 
[00:02:19.473,699] <dbg> aws_iot: on_publish: Received message: topic = my-custom-topic/example and len = 45 
[00:02:19.473,732] <inf> aws_iot_sample: AWS_IOT_EVT_DATA_RECEIVED
[00:02:19.473,786] <inf> aws_iot_sample: Received message: "{
                                                               "message": "Hello from AWS IoT console"
                                                                                                      }" on topic: "my-custom-topic/example"
[00:03:14.293,868] <inf> aws_iot_sample: Publishing message: {"state":{"reported":{"uptime":194293,"app_version":"v1.0.0"}}} to AWS IoT shadow
[00:03:14.293,893] <dbg> aws_iot: aws_iot_send: Using message ID 5
[00:03:14.293,915] <dbg> aws_iot: aws_iot_send: Publishing to topic: $aws/things/nrf54l15dk-1/shadow/update
[00:04:14.294,738] <inf> aws_iot_sample: Publishing message: {"state":{"reported":{"uptime":254294,"app_version":"v1.0.0"}}} to AWS IoT shadow
[00:04:14.294,762] <dbg> aws_iot: aws_iot_send: Using message ID 6
[00:04:14.294,784] <dbg> aws_iot: aws_iot_send: Publishing to topic: $aws/things/nrf54l15dk-1/shadow/update
[00:05:14.295,658] <inf> aws_iot_sample: Publishing message: {"state":{"reported":{"uptime":314295,"app_version":"v1.0.0"}}} to AWS IoT shadow
[00:05:14.295,682] <dbg> aws_iot: aws_iot_send: Using message ID 7
[00:05:14.295,706] <dbg> aws_iot: aws_iot_send: Publishing to topic: $aws/things/nrf54l15dk-1/shadow/update
[00:06:14.296,535] <inf> aws_iot_sample: Publishing message: {"state":{"reported":{"uptime":374296,"app_version":"v1.0.0"}}} to AWS IoT shadow

Btw - There are too many heap buffers and some stacks to adjust for TLS connectivity to work successfully. it would be good if Nordic Semi provide a runtime heap monitoring tool. Your colleague (Kenneth) suggested using shared heap where the Mbed TLS heap gets moved onto the system heap. I haven't tried this yet but will soon.

Now that the target nrf54l15dk/nrf54l15/cpuapp works successfully, I've tried to generate a non-secure build.

I was unable to find any example of "nrf54l15dk_nrf54l15_cpuapp_ns.overlay", so I created the following.

/*
 * Copyright (c) 2024 Nordic Semiconductor ASA
 *
 * SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
 */

/delete-node/ &slot0_partition;
/delete-node/ &storage_partition;
/delete-node/ &slot0_ns_partition;
/delete-node/ &tfm_its_partition;
/delete-node/ &tfm_otp_partition;
/delete-node/ &tfm_ps_partition;

&cpuapp_rram {
	partitions {
		slot0_s_partition: partition@0 {
			compatible = "zephyr,mapped-partition";
			label = "image-0-secure";
			reg = <0x0 0x40000>;
		};

		tfm_storage_partition: partition@40000 {
			compatible = "zephyr,mapped-partition";
			label = "tfm-storage";
			reg = <0x40000 DT_SIZE_K(40)>;
			ranges = <0x0 0x40000 DT_SIZE_K(40)>;
			#address-cells = <1>;
			#size-cells = <1>;

			tfm_its_partition: partition@0 {
				compatible = "zephyr,mapped-partition";
				label = "tfm-its";
				reg = <0x0 DT_SIZE_K(16)>;
			};

			tfm_otp_partition: partition@4000 {
				compatible = "zephyr,mapped-partition";
				label = "tfm-otp";
				reg = <0x4000 DT_SIZE_K(8)>;
			};

			tfm_ps_partition: partition@6000 {
				compatible = "zephyr,mapped-partition";
				label = "tfm-ps";
				reg = <0x6000 DT_SIZE_K(16)>;
			};
		};

		slot0_ns_partition: partition@4a000 {
			compatible = "zephyr,mapped-partition";
			label = "image-0-nonsecure";
			reg = <0x4a000 0x131000>;
		};

		nonsecure_storage: partition@17b000 {
			compatible = "zephyr,mapped-partition";
			label = "nonsecure-storage";
			reg = <0x17b000 DT_SIZE_K(8)>;
			ranges = <0x0 0x17b000 DT_SIZE_K(8)>;
			#address-cells = <1>;
			#size-cells = <1>;

			storage_partition: partition@0 {
				compatible = "zephyr,mapped-partition";
				label = "storage";
				reg = <0x0 DT_SIZE_K(8)>;
			};
		};
	};
};

/*
 * Default SRAM planning when building for nRF54L15 with ARM TrustZone-M support
 * - Lowest 128 kB SRAM allocated to Secure image (sram0_s).
 * - Upper 128 kB SRAM allocated to Non-Secure image (sram0_ns).
 *
 * nRF54L15 has 256 kB of volatile memory (SRAM).
 * This static layout needs to be the same with the upstream TF-M layout in the
 * header flash_layout.h of the relevant platform. Any updates in the layout
 * needs to happen both in the flash_layout.h and in this file at the same time.
 */
&cpuapp_sram {
	sram0_s: image_s@0 {
		#address-cells = <1>;
		#size-cells = <1>;
		/* Secure image memory */
		reg = <0x0 DT_SIZE_K(56)>;
		ranges = <0x0 0x0 DT_SIZE_K(56)>;
	};

	sram0_ns: image_ns@20000 {
		#address-cells = <1>;
		#size-cells = <1>;
		/* Non-Secure image memory */
		reg = <0xE000 DT_SIZE_K(200)>;
		ranges = <0x0 0xE000 DT_SIZE_K(200)>;
	};
};

As per Nordic docs, nRF54L15 has 256 kB, with default TF-M configured with lowest 128 kB for Secure image and the upper 128 kB allocated to Non-Secure image.

I've tried to adjust this to TF-M 56 kB and non-secure to 200 kB in the hope that it'll be sufficient for AWS IoT connection to work successfully.

However, it seems that I also need to change "flash_layout.h". I'm unclear which "flash_layout.h" needs tmodification.

Could you please review how to adjust TF-M size for nRF54L15?

With the following "nrf54l15dk_nrf54l15_cpuapp_ns.conf", I'm able to successfully build the aws_iot application but on execution I don't get any console output. The TF-M output looks fine.

#
# Copyright (c) 2024 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#

CONFIG_TFM_ITS_ENCRYPTED=n

# Wi-Fi
CONFIG_WIFI=y
CONFIG_WIFI_NRF70=y
CONFIG_WIFI_CREDENTIALS=y
# Needed for Wi-Fi credentials
CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y
CONFIG_ZMS=y
CONFIG_SETTINGS=y

# WPA supplicant
CONFIG_WIFI_NM_WPA_SUPPLICANT=y
CONFIG_WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_INF=y

# Networking
CONFIG_NET_L2_ETHERNET=y
CONFIG_NET_SOCKETS=y
CONFIG_NET_IPV6=y
CONFIG_NET_UDP=y
CONFIG_NET_TCP=y
CONFIG_NET_DHCPV4=y
CONFIG_DNS_RESOLVER=y
CONFIG_DNS_RESOLVER_AI_MAX_ENTRIES=4

# NET sockets
CONFIG_NET_UDP=y
CONFIG_NET_TCP=y
CONFIG_NET_MAX_CONN=6
CONFIG_NET_MAX_CONTEXTS=5
CONFIG_ZVFS_POLL_MAX=8
CONFIG_NET_SOCKETS_OFFLOAD=n
CONFIG_NET_DHCPV4=y
CONFIG_NET_CONTEXT_SNDTIMEO=y
CONFIG_NET_CONTEXT_RCVTIMEO=y
CONFIG_NET_MAX_CONTEXTS=3

# NET buffers
CONFIG_NET_PKT_TX_COUNT=6
CONFIG_NET_PKT_RX_COUNT=6
CONFIG_NET_BUF_TX_COUNT=12
CONFIG_NET_BUF_RX_COUNT=6
CONFIG_NRF70_RX_NUM_BUFS=6
CONFIG_NET_PKT_BUF_RX_DATA_POOL_SIZE=4096
CONFIG_NET_PKT_BUF_TX_DATA_POOL_SIZE=4096
CONFIG_NRF70_MAX_TX_AGGREGATION=1

# MQTT
CONFIG_MQTT_HELPER_PROVISION_CERTIFICATES=y

# Kernel options
CONFIG_POSIX_NETWORKING=y

# Shell
CONFIG_SHELL=y
CONFIG_SHELL_CMDS_RESIZE=n
CONFIG_NET_L2_WIFI_SHELL=y

# TLS
# RSA and ECDH/ECDSA are needed for TLS handshake
CONFIG_MBEDTLS_RSA_C=y
CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT=y
CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT=y
CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE=y
CONFIG_PSA_WANT_ALG_ECDH=y
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE=y
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT=y
CONFIG_NET_SOCKETS_SOCKOPT_TLS=y
CONFIG_NET_SOCKETS_TLS_MAX_CONTEXTS=1
CONFIG_MBEDTLS=y
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_SSL_KEEP_PEER_CERTIFICATE=n
CONFIG_MBEDTLS_SSL_SERVER_NAME_INDICATION=y
CONFIG_TLS_CREDENTIALS=y
CONFIG_TLS_CREDENTIALS_BACKEND_VOLATILE=y

# Zephyr NET Connection Manager Connectivity layer.
CONFIG_L2_WIFI_CONNECTIVITY=y
CONFIG_L2_WIFI_CONNECTIVITY_AUTO_CONNECT=y
CONFIG_L2_WIFI_CONNECTIVITY_AUTO_DOWN=n

# Stack sizes
#CONFIG_NET_CONNECTION_MANAGER_MONITOR_STACK_SIZE=5000
CONFIG_MAIN_STACK_SIZE=6144
CONFIG_NET_TX_STACK_SIZE=2048
CONFIG_NET_RX_STACK_SIZE=2048
CONFIG_NET_MGMT_EVENT_STACK_SIZE=1024
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=3100
CONFIG_NRF70_IRQ_WQ_STACK_SIZE=1024
CONFIG_NRF70_BH_WQ_STACK_SIZE=2300
#CONFIG_SHELL_STACK_SIZE=4400
CONFIG_SHELL_STACK_SIZE=4100
CONFIG_ISR_STACK_SIZE=512

# Heap sizes
CONFIG_HEAP_MEM_POOL_IGNORE_MIN=y
#CONFIG_MBEDTLS_HEAP_SIZE=45000
CONFIG_HEAP_MEM_POOL_SIZE=32000
#CONFIG_MBEDTLS_HEAP_SIZE=30000
CONFIG_HEAP_MEM_POOL_SIZE=20000
CONFIG_NRF_WIFI_CTRL_HEAP_SIZE=20000
#CONFIG_NRF_WIFI_DATA_HEAP_SIZE=40000
CONFIG_NRF_WIFI_DATA_HEAP_SIZE=30000

# POSIX API memory optimizations
CONFIG_POSIX_FD_MGMT=n
CONFIG_POSIX_MESSAGE_PASSING=n
CONFIG_POSIX_THREAD_THREADS_MAX=0

# Floating-point printf support
CONFIG_CBPRINTF_FP_SUPPORT=y

Thank you for reviewing the above.

Kind regards,
Ravi

0 Simon D-M 2 hours ago in reply to zpm1066

Hi Ravi,

zpm1066 said:
With the following "nrf54l15dk_nrf54l15_cpuapp_ns.conf", I'm able to successfully build the aws_iot application but on execution I don't get any console output. The TF-M output looks fine.

Did you check both serial port? On the nRF54L the UART can't be shared between TFM and the application. So Usually the application is using UART20 and TFM uses UART30.

If you still don't see the application output, you can try to silence the TFM logging using thee following config : CONFIG_TFM_LOG_LEVEL_SILENCE=y

-

On another note, I believe that the nRF54L15 might be a bit short to fit everything at the same time comfortably...

Usually when you start having to play with memory allocations every time you are doing modification to an application, it is a good sign that you need to upgrade your chip.

I would recommend you to upgrade to a nRF54LM20 for this application.

The thing is that even if you somehow manage to make everything fit inside the nRF54L15, as soon as you will add a new feature, add FOTA, or anything else that requires a bit of memory, you will either have to find more space again, make compromise or upgrade the chip.

It is a good idea to always have a bit of spare room when it comes to these things to add a bit of flexibility and account for future updates.

Best regards,

Simon
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel