Immutable bootloader private key in zephyr

RE: Immutable bootloader private key in zephyr

kk2mkk — Tue, 13 Oct 2020 12:15:28 GMT

I do need firmware upgrade functionality, but if i start providing my self generated private key i end up in this booting issue.

2020-10-13T11:26:59.824Z DEBUG modem << *** Booting Zephyr OS build v2.3.0-rc1-ncs1-3614-ga4ead9805140  ***
2020-10-13T11:26:59.844Z DEBUG modem << Attempting to boot slot 0.
2020-10-13T11:26:59.856Z DEBUG modem << Attempting to boot from address 0x8200.
2020-10-13T11:26:59.860Z DEBUG modem << Firwmare has been invalidated: 0x91020000.
2020-10-13T11:26:59.860Z DEBUG modem << Failed to validate, permanently invalidating!
2020-10-13T11:26:59.860Z DEBUG modem << Attempting to boot slot 1.
2020-10-13T11:26:59.861Z DEBUG modem << No fw_info struct found.
2020-10-13T11:26:59.861Z DEBUG modem << No bootable image found. Aborting boot.

Build log

C:\Data\GIT\ncs\master\zephyr\samples\hello_world\build>ninja rom_report
[0/1] Re-running CMake...
Including boilerplate (Zephyr base (cached)): C:/Data/GIT/ncs/master/zephyr/cmake/app/boilerplate.cmake
-- Application: C:/Data/GIT/ncs/master/zephyr/samples/hello_world
-- Using NCS Toolchain 1.3.0 for building. (C:/Data/GIT/ncs/master/toolchain/cmake)
-- Zephyr version: 2.4.0 (C:/Data/GIT/ncs/master/zephyr)
-- Found west (found suitable version "0.7.3", minimum required is "0.7.1")
-- Board: nrf9160dk_nrf9160ns
-- Cache files will be written to: C:/Data/GIT/ncs/master/zephyr/.cache
-- Found dtc: C:/Data/GIT/ncs/master/toolchain/opt/bin/dtc.exe (found suitable version "1.4.7", minimum required is "1.4.6")
-- Found toolchain: gnuarmemb (C:/Data/GIT/ncs/master/toolchain/opt)
-- Found BOARD.dts: C:/Data/GIT/ncs/master/zephyr/boards/arm/nrf9160dk_nrf9160/nrf9160dk_nrf9160ns.dts
-- Generated zephyr.dts: C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/zephyr/include/generated/devicetree_unfixed.h
Parsing C:/Data/GIT/ncs/master/zephyr/Kconfig
Loaded configuration 'C:/Data/GIT/ncs/master/zephyr/boards/arm/nrf9160dk_nrf9160/nrf9160dk_nrf9160ns_defconfig'
Merged configuration 'C:/Data/GIT/ncs/master/zephyr/samples/hello_world/prj.conf'
Configuration saved to 'C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/zephyr/.config'
Kconfig header saved to 'C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/zephyr/include/generated/autoconf.h'
Changed board to secure nrf9160dk_nrf9160 (NOT NS)

=== child image spm -  begin ===
Including boilerplate (Zephyr base (cached)): C:/Data/GIT/ncs/master/zephyr/cmake/app/boilerplate.cmake
-- Application: C:/Data/GIT/ncs/master/nrf/samples/spm
-- Using NCS Toolchain 1.3.0 for building. (C:/Data/GIT/ncs/master/toolchain/cmake)
-- Zephyr version: 2.4.0 (C:/Data/GIT/ncs/master/zephyr)
-- Found west (found suitable version "0.7.3", minimum required is "0.7.1")
-- Board: nrf9160dk_nrf9160
-- Cache files will be written to: C:/Data/GIT/ncs/master/zephyr/.cache
-- Found dtc: C:/Data/GIT/ncs/master/toolchain/opt/bin/dtc.exe (found suitable version "1.4.7", minimum required is "1.4.6")
-- Found toolchain: gnuarmemb (C:/Data/GIT/ncs/master/toolchain/opt)
-- Found BOARD.dts: C:/Data/GIT/ncs/master/zephyr/boards/arm/nrf9160dk_nrf9160/nrf9160dk_nrf9160.dts
-- Found devicetree overlay: C:/Data/GIT/ncs/master/nrf/samples/spm/nrf9160dk_nrf9160.overlay
-- Generated zephyr.dts: C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/spm/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/spm/zephyr/include/generated/devicetree_unfixed.h
Parsing C:/Data/GIT/ncs/master/zephyr/Kconfig
Loaded configuration 'C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/spm/zephyr/.config'
No change to configuration in 'C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/spm/zephyr/.config'
No change to Kconfig header in 'C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/spm/zephyr/include/generated/autoconf.h'
-- Configuring done
-- Generating done
-- Build files have been written to: C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/spm
=== child image spm -  end ===

Changed board to secure nrf9160dk_nrf9160 (NOT NS)

=== child image b0 -  begin ===
Including boilerplate (Zephyr base (cached)): C:/Data/GIT/ncs/master/zephyr/cmake/app/boilerplate.cmake
-- Application: C:/Data/GIT/ncs/master/nrf/samples/bootloader
-- Using NCS Toolchain 1.3.0 for building. (C:/Data/GIT/ncs/master/toolchain/cmake)
-- Zephyr version: 2.4.0 (C:/Data/GIT/ncs/master/zephyr)
-- Found west (found suitable version "0.7.3", minimum required is "0.7.1")
-- Board: nrf9160dk_nrf9160
-- Cache files will be written to: C:/Data/GIT/ncs/master/zephyr/.cache
-- Found dtc: C:/Data/GIT/ncs/master/toolchain/opt/bin/dtc.exe (found suitable version "1.4.7", minimum required is "1.4.6")
-- Found toolchain: gnuarmemb (C:/Data/GIT/ncs/master/toolchain/opt)
-- Found BOARD.dts: C:/Data/GIT/ncs/master/zephyr/boards/arm/nrf9160dk_nrf9160/nrf9160dk_nrf9160.dts
-- Generated zephyr.dts: C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/b0/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/b0/zephyr/include/generated/devicetree_unfixed.h
Parsing C:/Data/GIT/ncs/master/zephyr/Kconfig
Loaded configuration 'C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/b0/zephyr/.config'
No change to configuration in 'C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/b0/zephyr/.config'
No change to Kconfig header in 'C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/b0/zephyr/include/generated/autoconf.h'
CMake Warning at ../../subsys/bootloader/CMakeLists.txt:21 (message):


        --------------------------------------------------------
        --- WARNING: When using the immutable bootloader on  ---
        --- this SoC, the UICR must be erased when flashing. ---
        --- E.g. by calling 'west flash --erase'             ---
        --------------------------------------------------------


CMake Warning at C:/Data/GIT/ncs/master/zephyr/kernel/CMakeLists.txt:54 (message):
  Single threaded mode (CONFIG_MULTITHREADING=n) is deprecated


-- Configuring done
-- Generating done
-- Build files have been written to: C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/b0
=== child image b0 -  end ===

Changed board to secure nrf9160dk_nrf9160 (NOT NS)

=== child image mcuboot -  begin ===
Including boilerplate (Zephyr base (cached)): C:/Data/GIT/ncs/master/zephyr/cmake/app/boilerplate.cmake
-- Application: C:/Data/GIT/ncs/master/bootloader/mcuboot/boot/zephyr
-- Using NCS Toolchain 1.3.0 for building. (C:/Data/GIT/ncs/master/toolchain/cmake)
-- Zephyr version: 2.4.0 (C:/Data/GIT/ncs/master/zephyr)
-- Found west (found suitable version "0.7.3", minimum required is "0.7.1")
-- Board: nrf9160dk_nrf9160
-- Cache files will be written to: C:/Data/GIT/ncs/master/zephyr/.cache
-- Found dtc: C:/Data/GIT/ncs/master/toolchain/opt/bin/dtc.exe (found suitable version "1.4.7", minimum required is "1.4.6")
-- Found toolchain: gnuarmemb (C:/Data/GIT/ncs/master/toolchain/opt)
-- Found BOARD.dts: C:/Data/GIT/ncs/master/zephyr/boards/arm/nrf9160dk_nrf9160/nrf9160dk_nrf9160.dts
-- Found devicetree overlay: C:/Data/GIT/ncs/master/bootloader/mcuboot/boot/zephyr/dts.overlay
-- Found devicetree overlay: C:/Data/GIT/ncs/master/bootloader/mcuboot/boot/zephyr/dts.overlay
-- Generated zephyr.dts: C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/mcuboot/zephyr/zephyr.dts
CMake Warning at C:/Data/GIT/ncs/master/zephyr/kernel/CMakeLists.txt:54 (message):
-- Generated devicetree_unfixed.h: C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/mcuboot/zephyr/include/generated/devicetree_unfixed.h
Parsing C:/Data/GIT/ncs/master/bootloader/mcuboot/boot/zephyr/Kconfig
Loaded configuration 'C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/mcuboot/zephyr/.config'
No change to configuration in 'C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/mcuboot/zephyr/.config'
No change to Kconfig header in 'C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/mcuboot/zephyr/include/generated/autoconf.h'
-- Configuring done
-- Generating done
-- Build files have been written to: C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/mcuboot
  Single threaded mode (CONFIG_MULTITHREADING=n) is deprecated


MCUBoot bootloader key file: C:/Data/GIT/ncs/master/bootloader/mcuboot/root-rsa-2048.pem
=== child image mcuboot -  end ===

CMake Warning at C:/Data/GIT/ncs/master/nrf/cmake/mcuboot.cmake:115 (message):


        ---------------------------------------------------------
        --- WARNING: Using default MCUBoot key, it should not ---
        --- be used for production.                           ---
        ---------------------------------------------------------


Call Stack (most recent call first):
  C:/Data/GIT/ncs/master/bootloader/mcuboot/zephyr/CMakeLists.txt:1 (include)


-- Configuring done
-- Generating done
-- Build files have been written to: C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build
[0/157] Performing build step for 'spm_subimage'
[149/153] Linking C executable zephyr\zephyr_prebuilt.elf
Memory region         Used Size  Region Size  %age Used
           FLASH:       32256 B        48 KB     65.63%
            SRAM:        5520 B        64 KB      8.42%
        IDT_LIST:          40 B         2 KB      1.95%
[153/153] Linking C executable zephyr\zephyr.elf
[2/153] Performing build step for 'b0_subimage'
[105/109] Linking C executable zephyr\zephyr_prebuilt.elf
Memory region         Used Size  Region Size  %age Used
           FLASH:       26200 B        32 KB     79.96%
            SRAM:       38824 B        64 KB     59.24%
        IDT_LIST:          40 B         2 KB      1.95%
[109/109] Linking C executable zephyr\zephyr.elf
[129/153] Linking C executable zephyr\zephyr_prebuilt.elf
Memory region         Used Size  Region Size  %age Used
           FLASH:       15396 B     392704 B      3.92%
            SRAM:        4040 B       128 KB      3.08%
        IDT_LIST:          56 B         2 KB      2.73%
[132/151] Creating public key from private key used for signing
[139/151] Performing build step for 'mcuboot_subimage'
[118/122] Linking C executable zephyr\zephyr_prebuilt.elf
Memory region         Used Size  Region Size  %age Used
           FLASH:       40588 B        48 KB     82.58%
            SRAM:       24724 B        64 KB     37.73%
        IDT_LIST:          88 B         2 KB      4.30%
[122/122] Linking C executable zephyr\zephyr.elf
[144/149] Creating signature of application
[145/149] Creating validation for zephyr.hex, storing to
[148/149] cmd.exe /C "cd /D C:\Data\GIT\ncs\master\zephyr\samples\hello_world\build\...t.py --input C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/partitions.yml"
 (0x100000 - 1024kB):
+------------------------------------------+
+---0x0: b0 (0x8000)-----------------------+
| 0x0: b0_image (0x8000)                   |
+---0x8000: s0 (0xc200)--------------------+
| 0x8000: s0_pad (0x200)                   |
+---0x8200: s0_image (0xc000)--------------+
| 0x8200: mcuboot (0xc000)                 |
| 0x14200: EMPTY_0 (0xe00)                 |
+---0x15000: s1 (0xc200)-------------------+
| 0x15000: s1_pad (0x200)                  |
| 0x15200: EMPTY_1 (0x6e00)                |
| 0x1c000: s1_image (0xc000)               |
+---0x28000: mcuboot_primary (0x6c000)-----+
| 0x28000: mcuboot_pad (0x200)             |
+---0x28200: mcuboot_primary_app (0x6be00)-+
+---0x28200: spm_app (0x6be00)-------------+
| 0x28200: spm (0xc000)                    |
| 0x34200: app (0x5fe00)                   |
| 0x94000: mcuboot_secondary (0x6c000)     |
+------------------------------------------+
[148/149] cmd.exe /C "cd /D C:\Data\GIT\ncs\master\zephyr\samples\hello_world\build\...d/build --json C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/rom.json rom"
Traceback (most recent call last):
  File "C:/Data/GIT/ncs/master/zephyr/scripts/footprint/size_report", line 643, in <module>
    main()
  File "C:/Data/GIT/ncs/master/zephyr/scripts/footprint/size_report", line 605, in main
    print("WARN: Symbol '{0}' is not in RAM or ROM".format(sym['name']))
TypeError: string indices must be integers
FAILED: zephyr/cmake/reports/CMakeFiles/rom_report
cmd.exe /C "cd /D C:\Data\GIT\ncs\master\zephyr\samples\hello_world\build\zephyr\cmake\reports && C:\Data\GIT\ncs\master\toolchain\opt\bin\python.exe C:/Data/GIT/ncs/master/zephyr/scripts/footprint/size_report -k C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/zephyr/zephyr.elf -z C:/Data/GIT/ncs/master/zephyr -o C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build --json C:/Data/GIT/ncs/master/zephyr/samples/hello_world/build/rom.json rom"
ninja: build stopped: subcommand failed.

C:\Data\GIT\ncs\master\zephyr\samples\hello_world\build>west flash

openssl ecparam -name prime256v1 -genkey -noout -out priv.pem

# b0 Bootloader
CONFIG_SECURE_BOOT=y
CONFIG_SB_SIGNING_KEY_FILE="C:/Data/GIT/ncs/master/zephyr/samples/hello_world/priv.pem"

# MCUboot as upgradable bootloader
CONFIG_BOOTLOADER_MCUBOOT=y

RE: Immutable bootloader private key in zephyr

shibshab — Tue, 13 Oct 2020 09:54:34 GMT

That configuration is currently not supported. Is it so that you only want secure boot, no firmware upgrade functionality?

RE: Immutable bootloader private key in zephyr

kk2mkk — Tue, 13 Oct 2020 09:51:34 GMT

You are correct, i haven't enabled MCUBoot boot, only secured boot was enabled

# Bootloader
CONFIG_SECURE_BOOT=y

the question is do we need mcuboot, can't b0+app(including spm) suffice? ya i do do agree the the application upgrade wont be possible if we dont have mcuboot.

regards

RE: Immutable bootloader private key in zephyr

shibshab — Tue, 13 Oct 2020 07:17:16 GMT

You are correct in that the bootloaders (both b0 and mcuboot) are automatically built for the secure variant of the board. In the case of your issue, I'm wondering if you have enabled MCUBoot or not (when you saw the issue about missing validation info)

RE: Immutable bootloader private key in zephyr

kk2mkk — Tue, 13 Oct 2020 07:12:42 GMT

To my understanding when you build the application(with NS) with secure boot and mcuoot support the child images are build automatically with their respective secure or NS configuration, no need to specify explicitly.

Lets us consider an application on which i am presently working on i.e ncs\master\nrf\applications\serial_lte_modem, by adding the following config lines to the my application builds the b0 and mcuboo(NS) automatically

# b0 Bootloader
CONFIG_SECURE_BOOT=y

# MCUboot as upgradable bootloader
CONFIG_BOOTLOADER_MCUBOOT=y

ROM map

terminal o/p

-------------------------------b0 -------------------------------------------------
2020-10-13T06:54:51.280Z DEBUG modem << *** Booting Zephyr OS build v2.3.0-rc1-ncs1-3614-ga4ead9805140  ***
2020-10-13T06:54:51.284Z DEBUG modem << Attempting to boot slot 0.
2020-10-13T06:54:51.289Z DEBUG modem << Attempting to boot from address 0x8200.
2020-10-13T06:54:51.291Z DEBUG modem << Verifying signature against key 0.
2020-10-13T06:54:51.298Z DEBUG modem << Hash: 0x8e...d7
2020-10-13T06:54:51.316Z DEBUG modem << Firmware signature verified.
2020-10-13T06:54:51.318Z DEBUG modem << Firmware version 1
2020-10-13T06:54:51.324Z DEBUG modem << Setting monotonic counter (version: 1, slot: 0)
2020-10-13T06:54:51.325Z DEBUG modem << Booting (0x8200).
-------------------------------mcuboot -------------------------------------------------
2020-10-13T06:54:51.334Z DEBUG modem << *** Booting Zephyr OS build v2.3.0-rc1-ncs1-3614-ga4ead9805140  ***
2020-10-13T06:54:51.337Z DEBUG modem << [00:00:00.006,042] [0m<inf> mcuboot: Starting bootloader[0m
2020-10-13T06:54:51.350Z DEBUG modem << [00:00:00.012,359] [0m<inf> mcuboot: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3[0m
2020-10-13T06:54:51.353Z DEBUG modem << [00:00:00.022,491] [0m<inf> mcuboot: Boot source: none[0m
2020-10-13T06:54:51.357Z DEBUG modem << [00:00:00.028,015] [0m<inf> mcuboot: Swap type: none[0m
2020-10-13T06:54:51.374Z DEBUG modem << [00:00:00.033,691] [0m<inf> mcuboot: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3[0m
2020-10-13T06:54:51.376Z DEBUG modem << [00:00:00.043,792] [0m<inf> mcuboot: Boot source: none[0m
2020-10-13T06:54:51.386Z DEBUG modem << [00:00:00.049,346] [0m<inf> mcuboot: Swap type: none[0m
2020-10-13T06:54:51.652Z DEBUG modem << [00:00:00.319,702] [0m<inf> mcuboot: Bootloader chainload address offset: 0x28000[0m
2020-10-13T06:54:51.664Z DEBUG modem << [00:00:00.327,514] [0m<inf> mcuboot: Jumping to the first image slot[0m
-------------------------------app---------------------------------------------
2020-10-13T06:54:52.037Z DEBUG modem << Ready
2020-10-13T06:54:55.659Z DEBUG modem >> AT
2020-10-13T06:54:55.675Z DEBUG modem << OK
2020-10-13T06:54:56.153Z DEBUG modem >> AT
2020-10-13T06:54:56.168Z DEBUG modem << OK

regrads

RE: Immutable bootloader private key in zephyr

shibshab — Tue, 13 Oct 2020 05:58:02 GMT

Are you building for a non-secure board? If so you should use MCUBoot as the single stage bootloader instead. B0 does not support non-secure apps as the next step in the bootloader chain.

RE: Immutable bootloader private key in zephyr

kk2mkk — Tue, 13 Oct 2020 03:44:21 GMT

Yes i put extra caution in doing that step

RE: Immutable bootloader private key in zephyr

shibshab — Mon, 12 Oct 2020 18:57:36 GMT

Have performed a chip erase before flashing b0? `nrfjprog -e`

RE: Immutable bootloader private key in zephyr

kk2mkk — Mon, 12 Oct 2020 15:12:44 GMT

I think its nothing to do with the private key, even just enabling CONFIG_SECURE_BOOT=y doesn't work either

regards

RE: Immutable bootloader private key in zephyr

kk2mkk — Mon, 12 Oct 2020 14:04:38 GMT

Hi shibshab,

I tried the above steps on nrf master, by specifying the private in absolute and relative path but the applicant failed to boot, with following error message.

# Bootloader
CONFIG_SECURE_BOOT=y
#CONFIG_SB_SIGNING_KEY_FILE="priv.pem"
CONFIG_SB_SIGNING_KEY_FILE="C:/Data/GIT/ncs/master/zephyr/samples/hello_world/priv.pem"

2020-10-12T13:50:30.809Z DEBUG modem << *** Booting Zephyr OS build v2.3.0-rc1-ncs1-3614-ga4ead9805140  ***
2020-10-12T13:50:30.817Z DEBUG modem << Attempting to boot slot 0.
2020-10-12T13:50:30.819Z DEBUG modem << Attempting to boot from address 0x8000.
2020-10-12T13:50:30.820Z DEBUG modem << Firwmare has been invalidated: 0x91020000.
2020-10-12T13:50:30.822Z DEBUG modem << Failed to validate, permanently invalidating!
2020-10-12T13:50:30.825Z DEBUG modem << Attempting to boot slot 1.
2020-10-12T13:50:30.827Z DEBUG modem << No fw_info struct found.
2020-10-12T13:50:30.831Z DEBUG modem << No bootable image found. Aborting boot.

thanks and regards

RE: Immutable bootloader private key in zephyr

shibshab — Thu, 09 Jan 2020 07:50:21 GMT

I performed the following steps, and did not see any issue. Please let me know what you have done differently:

1. Jump to latest master (you should be able to do this on older commits as well)
2. West update <- The warning about the 'TEST_RANDOM_GENERATOR' might indicate that this step is not done properly
3. Use BOARD nrf9160_pca10090ns
4. Jump to zephyr/samples/hello_world
5. Run your openssl command
6. modify zephyr/samples/hello_world prj.conf by adding the two lines you mention above
7. cmake -GNinja -DBOARD=nrf9160_pca10090ns && ninja flash
8. Verify that hello world boots.

Also, the help text for the 'SB_SIGNING_KEY_FILE' explicitly states that the path shall be absolute. Note that for this case, the relative path provided by you also worked for me.

Try to follow those steps, and let me know if/when it fails.

Edit: I see now that you are on windows. Please try to use the absolute path :)

RE: Immutable bootloader private key in zephyr

Øyvind — Wed, 08 Jan 2020 14:07:18 GMT

Thanks for providing this information. I have forwarded it to our R&D team and will get back to asap.

Kind regards,
Øyvind

RE: Immutable bootloader private key in zephyr

Chris Burns — Mon, 06 Jan 2020 15:55:50 GMT

Here is the CMakeError.log:

Compiling the C compiler identification source file "CMakeCCompilerId.c" failed.
Compiler: C:/gnuarmemb/bin/arm-none-eabi-gcc.exe 
Build flags: 
Id flags:  

The output was:
1
c:/gnuarmemb/bin/../lib/gcc/arm-none-eabi/7.3.1/../../../../arm-none-eabi/lib\libc.a(lib_a-exit.o): In function `exit':
exit.c:(.text.exit+0x2c): undefined reference to `_exit'
collect2.exe: error: ld returned 1 exit status


Compiling the CXX compiler identification source file "CMakeCXXCompilerId.cpp" failed.
Compiler: C:/gnuarmemb/bin/arm-none-eabi-gcc.exe 
Build flags: 
Id flags:  

The output was:
1
c:/gnuarmemb/bin/../lib/gcc/arm-none-eabi/7.3.1/../../../../arm-none-eabi/lib\libc.a(lib_a-exit.o): In function `exit':
exit.c:(.text.exit+0x2c): undefined reference to `_exit'
collect2.exe: error: ld returned 1 exit status

And here's the CMakeOutput.log:

The target system is: Generic - 2.0.99 - arm
The host system is: Windows - 10.0.17763 - AMD64
Compiling the C compiler identification source file "CMakeCCompilerId.c" succeeded.
Compiler: C:/gnuarmemb/bin/arm-none-eabi-gcc.exe 
Build flags: 
Id flags: -c 

The output was:
0


Compilation of the C compiler identification source "CMakeCCompilerId.c" produced "CMakeCCompilerId.o"

The C compiler identification is GNU, found in "C:/Users/me/Repos/myproject/build/CMakeFiles/3.14.5/CompilerIdC/CMakeCCompilerId.o"

Compiling the CXX compiler identification source file "CMakeCXXCompilerId.cpp" succeeded.
Compiler: C:/gnuarmemb/bin/arm-none-eabi-gcc.exe 
Build flags: 
Id flags: -c 

The output was:
0


Compilation of the CXX compiler identification source "CMakeCXXCompilerId.cpp" produced "CMakeCXXCompilerId.o"

The CXX compiler identification is GNU, found in "C:/Users/me/Repos/myproject/build/CMakeFiles/3.14.5/CompilerIdCXX/CMakeCXXCompilerId.o"

Checking whether the ASM compiler is GNU using "--version" matched "(GNU assembler)|(GCC)|(Free Software Foundation)":
arm-none-eabi-gcc.exe (GNU Tools for Arm Embedded Processors 7-2018-q2-update) 7.3.1 20180622 (release) [ARM/embedded-7-branch revision 261907]
Copyright (C) 2017 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

When setting the path to the PEM, which folder is it referencing? I put it in the same folder as my CMakeLists.txt but that isn't correct. Using an absolute path can't be the best way to do it, so

Where should the PEM file be? Or
How can I use a relative path?

I'm not using the Segger IDE - just command line tools and text editors.