How to use latest Mbed TLS (2.26.0) with nRF Connect SDK v1.5.0 on Thingy:91

RE: How to use latest Mbed TLS (2.26.0) with nRF Connect SDK v1.5.0 on Thingy:91

Franck_Code — Sun, 28 Mar 2021 18:13:38 GMT

The comment in the following line is wrong:

#CONFIG_APP_LINK_WITH_MBEDTLS=y # switches between nrf-config.h and nrf-config-noglue.h

During the build (see command line build output to check for yourself) some modules use "nrf-config.h" and some use "nrf-config-noglue.h". This means that in the Mbed TLS c files the line #include "common.h" includes one of the these header files depending on compile options.

RE: How to use latest Mbed TLS (2.26.0) with nRF Connect SDK v1.5.0 on Thingy:91

Franck_Code — Thu, 25 Mar 2021 08:09:54 GMT

It now compiles successfully. Thanks a lot!

RE: How to use latest Mbed TLS (2.26.0) with nRF Connect SDK v1.5.0 on Thingy:91

Vidar Berg — Thu, 25 Mar 2021 07:55:38 GMT

Thanks for updating the thread earlier and clarifying what the goal was. With regards to the linker error, I have seen it before, but can't remember exactly what caused it. Could you try to build with CONFIG_MBEDTLS_INSTALL_PATH="DUMMY" and see if that helps? This is the configuration used by the crypto test projects in \v1.5.0\nrf\tests\crypto at least.

RE: How to use latest Mbed TLS (2.26.0) with nRF Connect SDK v1.5.0 on Thingy:91

Franck_Code — Wed, 24 Mar 2021 19:28:40 GMT

Using the options from above in prj.conf in a standard installation of nRF Connect SDK v1.5.0 and "west build -b thingy91_nrf9160ns" in a command line build (as well as in Segger Embedded Studio) leads to a build error:

...
-- Build files have been written to: C:/Users/ffp/ncs/v1.5.0/nrf/samples/nrf9160/at_client/build
-- west build: building application
[23/257] Performing build step for 'spm_subimage'
[201/206] Linking C executable zephyr\zephyr_prebuilt.elf
Memory region Used Size Region Size %age Used
FLASH: 64 KB 64 KB 100.00%
SRAM: 8768 B 64 KB 13.38%
IDT_LIST: 88 B 2 KB 4.30%
[206/206] Linking C executable zephyr\zephyr.elf
[251/257] Linking C executable zephyr\zephyr_prebuilt.elf
FAILED: zephyr/zephyr_prebuilt.elf
cmd.exe /C "cd . && C:\Users\ffp\ncs\v1.5.0\toolchain\opt\bin\arm-none-eabi-gcc.exe zephyr/CMakeFiles/zephyr_prebuilt.dir/misc/empty_file.c.obj -o zephyr\zephyr_prebuilt.elf -Wl,-T zephyr/linker.cmd -Wl,-Map=C:/Users/ffp/ncs/v1.5.0/nrf/samples/nrf9160/at_client/build/zephyr/zephyr_prebuilt.map -Wl,--whole-archive app/libapp.a zephyr/libzephyr.a zephyr/arch/common/libarch__common.a zephyr/arch/arch/arm/core/aarch32/libarch__arm__core__aarch32.a zephyr/arch/arch/arm/core/aarch32/cortex_m/libarch__arm__core__aarch32__cortex_m.a zephyr/arch/arch/arm/core/aarch32/cortex_m/mpu/libarch__arm__core__aarch32__cortex_m__mpu.a zephyr/arch/arch/arm/core/aarch32/cortex_m/cmse/libarch__arm__core__aarch32__cortex_m__cmse.a zephyr/lib/libc/minimal/liblib__libc__minimal.a zephyr/lib/posix/liblib__posix.a zephyr/soc/arm/common/cortex_m/libsoc__arm__common__cortex_m.a zephyr/boards/boards/arm/thingy91_nrf9160ns/lib..__nrf__boards__arm__thingy91_nrf9160.a zephyr/subsys/net/libsubsys__net.a zephyr/subsys/net/ip/libsubsys__net__ip.a zephyr/subsys/random/libsubsys__random.a zephyr/drivers/gpio/libdrivers__gpio.a zephyr/drivers/i2c/libdrivers__i2c.a zephyr/drivers/spi/libdrivers__spi.a zephyr/drivers/serial/libdrivers__serial.a zephyr/drivers/entropy/libdrivers__entropy.a modules/nrf/lib/nrf_modem_lib/lib..__nrf__lib__nrf_modem_lib.a modules/nrf/lib/at_cmd/lib..__nrf__lib__at_cmd.a modules/nrf/lib/at_notif/lib..__nrf__lib__at_notif.a modules/nrf/lib/at_host/lib..__nrf__lib__at_host.a modules/nrf/lib/fatal_error/lib..__nrf__lib__fatal_error.a modules/nrf/subsys/fw_info/lib..__nrf__subsys__fw_info.a C:/Users/ffp/ncs/v1.5.0/nrfxlib/nrf_modem/lib/cortex-m33/hard-float/libmodem.a modules/nrfxlib/nrf_security/src/mbedtls/libmbedtls_base_vanilla.a modules/hal_nordic/libmodules__hal_nordic.a -Wl,--no-whole-archive zephyr/kernel/libkernel.a zephyr/CMakeFiles/offsets.dir/./arch/arm/core/offsets/offsets.c.obj -L"c:/users/ffp/ncs/v1.5.0/toolchain/opt/bin/../lib/gcc/arm-none-eabi/9.2.1/thumb/v8-m.main+fp/hard" -LC:/Users/ffp/ncs/v1.5.0/nrf/samples/nrf9160/at_client/build/zephyr -lgcc -Wl,--print-memory-usage zephyr/arch/common/libisr_tables.a modules/nrfxlib/nrf_security/src/mbedtls/shared/libmbedcrypto_shared.a modules/nrfxlib/nrf_security/src/mbedtls/vanilla/libmbedcrypto_vanilla.a -mcpu=cortex-m33 -mthumb -mabi=aapcs -mfpu=fpv5-sp-d16 -Wl,--gc-sections -Wl,--build-id=none -Wl,--sort-common=descending -Wl,--sort-section=alignment -Wl,-u,_OffsetAbsSyms -Wl,-u,_ConfigAbsSyms -nostdlib -static -no-pie -Wl,-X -Wl,-N -Wl,--orphan-handling=warn spm/libspmsecureentries.a -lgcc modules/nrfxlib/nrf_security/src/mbedtls/libmbedtls_external.a -L && cd ."
arm-none-eabi-gcc.exe: error: missing argument to '-L'
ninja: build stopped: subcommand failed.

I also set ARM_MBEDTLS_PATH=C:\Users\ffp\ncs\v1.5.0\mbedtls if that might be the missing path.
Do you have any idea? (As a side note on my second installation on Linux the same error occurs.)

RE: How to use latest Mbed TLS (2.26.0) with nRF Connect SDK v1.5.0 on Thingy:91

Franck_Code — Wed, 24 Mar 2021 14:19:53 GMT

https://github.com/nrfconnect/sdk-nrfxlib/blob/master/nrf_security/Kconfig

comment "mbed TLS Configuration File"

config MBEDTLS_CFG_FILE
string "mbed TLS configuration file"
default "nrf-config.h"

config GENERATE_MBEDTLS_CFG_FILE
bool
prompt "Generate mbed TLS config file"
default y
help
nRF Connect SDK Security will generate a mbed TLS configuration file
based on the selection of configuration options in Kconfig.
However, if the generated configuration file needs custom
adjustments, this setting can be used to disable generating the
mbed TLS configuration file. Only disable this setting if you know
what you are doing.

This answers my question regarding nrf-config-noglue.h.
-------
Update:
The answer is to let the build process generate the config file(s) and modify the(se) generated config file(s) as desired. This is described in the documentation at developer.nordicsemi.com/.../mbed_tls_header.html

RE: How to use latest Mbed TLS (2.26.0) with nRF Connect SDK v1.5.0 on Thingy:91

Franck_Code — Wed, 24 Mar 2021 13:57:25 GMT

The motivation is to experiment with the latest Mbed TLS crypto implementation on nrf9160/thingy:91 hardware. This means in particular not to use the provided hardware-accelerated or pre-compiled implementations. (Later it might be interesting to use some hardware-acceleration.)

The linked security module documentation was studied intensively by me. Nevertheless, it was difficult for me to figure out the specific set of settings. Originally I hoped that CONFIG_MBEDTLS_VANILLA_BACKEND=y would be sufficient but it did not show any effect (As written in https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrfxlib/nrf_security/doc/configuration.html CONFIG_NORDIC_SECURITY_BACKEND=y is needed first). CONFIG_MBEDTLS=y used alone did bring zephyr/module/mbedtls into the project which was not the desired version. Therefore, it took me quite some time using trial and error to figure out the precise settings.

RE: How to use latest Mbed TLS (2.26.0) with nRF Connect SDK v1.5.0 on Thingy:91

Vidar Berg — Wed, 24 Mar 2021 08:06:09 GMT

I'm don't see any problems with the configuration above. However, I forgot to ask what the motivation for doing this update was, so I'm not sure what the goal is. Both the Oberon and the cc3xx backend should be better in terms of performance.

Nordic security module documentation for reference: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrfxlib/nrf_security/README.html

RE: How to use latest Mbed TLS (2.26.0) with nRF Connect SDK v1.5.0 on Thingy:91

Franck_Code — Wed, 24 Mar 2021 00:01:38 GMT

Adding the following lines to C:\ncs\nrf\samples\nrf9160\at_client\prj.conf brings the files from C:\ncs\mbedtls into the project:

CONFIG_NORDIC_SECURITY_BACKEND=y
CONFIG_MBEDTLS_VANILLA_BACKEND=y
CONFIG_MBEDTLS=y
CONFIG_MBEDTLS_LIBRARY=y
CONFIG_MBEDTLS_BUILTIN=n
CONFIG_CC3XX_BACKEND=n
CONFIG_OBERON_BACKEND=n
#CONFIG_APP_LINK_WITH_MBEDTLS=y # switches between nrf-config.h and nrf-config-noglue.h

Are these settungs correct?

As nrf-config.h and nrf-config-noglue.h are generated what is the proper way to modify the defines within nrf-config-noglue.h? (E.g. just comment or uncomment them in nrf-config-noglue.h?)

RE: How to use latest Mbed TLS (2.26.0) with nRF Connect SDK v1.5.0 on Thingy:91

Franck_Code — Tue, 23 Mar 2021 23:20:06 GMT

Setting "revision: mbedtls-2.26.0" in c:\ncs\nrf\west.yml and "west update" brings the proper version into C:\ncs\mbedtls

RE: How to use latest Mbed TLS (2.26.0) with nRF Connect SDK v1.5.0 on Thingy:91

Franck_Code — Tue, 23 Mar 2021 11:45:59 GMT

Not yet but I will.

RE: How to use latest Mbed TLS (2.26.0) with nRF Connect SDK v1.5.0 on Thingy:91

Vidar Berg — Tue, 23 Mar 2021 10:27:26 GMT

Hello,

Have you tried to just update the mbedtls version in the nrf manifest? NCS v.1.5.0 tag is on mbedtls version 2.24.0 as you can see form the west manifest here: https://github.com/nrfconnect/sdk-nrf/blob/8e8c60897eac40f61db9f578ce521970fff8e4d2/west.yml#L134

RE: How to use latest Mbed TLS (2.26.0) with nRF Connect SDK v1.5.0 on Thingy:91

Franck_Code — Mon, 22 Mar 2021 09:51:17 GMT

Just to add that, in general, I followed the steps described in https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS.