Custom SPM dependencies

[NelsonGoncalves]

Hello,

We need to add secure services to our application, and I followed the guide in https://devzone.nordicsemi.com/nordic/nrf-connect-sdk-guides/b/software/posts/using-a-custom-secure-partition-manager-wtih-your-application

However the build fails because:

C:/Nordic/v1.5.0/nrf/subsys/nonsecure/secure_services_ns.c:26: undefined reference to `spm_request_random_number_nse'
collect2.exe: error: ld returned 1 exit status

It seems that it is expecting a function that generates secure random numbers (which we do not need this in our project). Searching for

this function call, it is defined in nrf/subsys/spm\secure_services.c and available if CONFIG_SPM_SERVICE_RNG is set.

I explicitly disable this config option (CONFIG_SPM_SERVICE_RNG=n) in the prj.conf off both the application and the custom SPM,

but it still appears to be set somewhere else. Where is CONFIG_SPM_SERVICE_RNG set and how can I disable it ?

Or is it best to also copy the files in nrf\subsys\smp and add them to my custom SPM project ? 

[Heidi]

Hi!

I'm not able to reproduce this build error when following the tutorial. 

Here is the application I am building with, can you see if there are any difference to your application. 

custom_spm_NCS_1_5_0.7z

Best regards,

Heidi

[NelsonGoncalves]

Hello Heidi,

We are using roughly the same configuration options and directory structure, the differences are:

• my custom SPM does not use the UARTE2 nor the PWM peripherals
• my custom SPM uses the crypto hardware and the mbedtls library

Looking at the documentation here https://developer.nordicsemi.com/nRF_Connect_SDK/doc/1.5.0/kconfig/CONFIG_SPM_SERVICE_RNG.html?highlight=config_spm_service_rng#cmdoption-arg-CONFIG_SPM_SERVICE_RNG, I believe that CONFIG_SPM_SERVICE_RNG is set when building the SPM.

Maybe it is because I am including the mbedtls library ? 

[Heidi]

Hi, you can use menuconfig (run west menuconfig in the build directory) to see why a configuration is set and then go up from there. 

Use "/" to search for symbols and "?" to see more information about the symbol (for instance, why it's been set). 

Note that if it's been set by prj.conf directly, then that won't show up here. 

I'm not able to reproduce what you're seeing but if you send over your application I can try to do this myself.

[NelsonGoncalves]

Hello Heidi,

Searching through the menuconfig, it seems that option CONFIG_SPM_SERVICE_RNG is set (=y) because CONFIG_SECURE_SERVICES is set, which in turn is set by CONFIG_SPM.

So I believe it is mandatory whem building a custom SPM. And it's strange that you are not able to reproduce it.

Here is the skeleton of my application, which reproduces the error.

custom_spm_dependencies.zip

[Heidi]

Hi, I'm able to reproduce the error you're seeing when building the application you provided. 

Unfortunately, I have not been able to solve the issue yet as we are very short-staffed due to the summer holidays.

[NelsonGoncalves]

I found the cause this morning, while trying to figure out the reason behind this issue. 

Because I am using crypto functions in my non-secure app, the crypto library needs an entropy source from the secure side. This is implemented as a secure service, in function "`spm_request_random_number_nse".

I need to explicitly set CONFIG_SPM_SERVICE_RNG=y in the custom SPM prj.conf, so that it gets build in the SPM image and can latter be used by the non-secure application.

Because I do not use an entropy source, I believed it was not needed. But it turns out it is required by the crypto library. Hence the confusion.