Cannot configure the build system to include X509 functions

[randomdude]

Hi,

I'm working on a simple app that is supposed to generate a CSR and have it signed by a web server.

The problem is, I can't even get zephyr to build the components I need, as there seems to be some sort of circular dependency in Kconfig.

When I want to select MBEDTLS_X509_CSR_WRITE_C via menuconfig, I am forced to enable MBEDTLS_X509_LIBRARY, NRF_SECURITY_ADVANCED, NRF_SECURITY_ANY_BACKEND, and NORDIC_SECURITY_BACKEND to even get there. But if I correctly understand the help text for that symbol, all these need to be disabled. Which would explain, that after saving that configuration (which prompts no complaints from west or ninja), the build will fail, and even re-configuration via `west build -t menuconfig` fails with the same error message, and the only way to recover is to restore .config from .config.old.

Is this really broken or am I just missing something?

Best Regards and thanks in advance,

Alex

[Øivind]

Hi,

Those configs need to be enabled in order to use MBEDTLS_X509_CSR_WRITE_C : https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/kconfig/CONFIG_MBEDTLS_X509_CSR_WRITE_C.html

What is the error you are seeing when you try to build? Can you attach the build log here?

[randomdude]

of course. here you are:

$ west build
[0/1] Re-running CMake...
Including boilerplate (Zephyr base (cached)): /path_to/src/project/ncs/zephyr/cmake/app/boilerplate.cmake
-- Application: /path_to/src/project/ncs/nrf9160-button
-- Zephyr version: 2.7.0 (/path_to/src/project/ncs/zephyr), build: v2.7.0-ncs1-rc2
-- Found west (found suitable version "0.12.0", minimum required is "0.7.1")
-- Board: nrf9160dk_nrf9160_ns, Revision: 0.7.0
-- Cache files will be written to: /path_to/.cache/zephyr
-- Using toolchain: zephyr 0.13.1 (/opt/zephyr-sdk-0.13.1)
-- Found dtc: /opt/zephyr-sdk-0.13.1/sysroots/x86_64-pokysdk-linux/usr/bin/dtc (found suitable version "1.6.0", minimum required is "1.4.6")
-- Found BOARD.dts: /path_to/src/project/ncs/zephyr/boards/arm/nrf9160dk_nrf9160/nrf9160dk_nrf9160_ns.dts
-- Found devicetree overlay: /path_to/src/project/ncs/nrf9160-button/boards/nrf9160dk_nrf9160_ns.overlay
nrf9160dk_nrf9160_ns.dts.pre.tmp:367.32-371.5: Warning (simple_bus_reg): /soc/cryptocell-sw: missing or empty reg/ranges property
-- Generated zephyr.dts: /path_to/src/project/ncs/nrf9160-button/build/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: /path_to/src/project/ncs/nrf9160-button/build/zephyr/include/generated/devicetree_unfixed.h
-- Generated device_extern.h: /path_to/src/project/ncs/nrf9160-button/build/zephyr/include/generated/device_extern.h
-- Including generated dts.cmake file: /path_to/src/project/ncs/nrf9160-button/build/zephyr/dts.cmake
Parsing /path_to/src/project/ncs/nrf9160-button/Kconfig
Loaded configuration '/path_to/src/project/ncs/nrf9160-button/build/zephyr/.config'

warning: Experimental symbol NET_SOCKETS_OFFLOAD is enabled.


warning: MBEDTLS_PK_C (defined at /path_to/src/project/ncs/nrfxlib/nrf_security/Kconfig:1573) has direct dependencies MBEDTLS_TLS_LIBRARY && NRF_SECURITY_ADVANCED && NRF_SECURITY_ANY_BACKEND && NORDIC_SECURITY_BACKEND with value n, but is currently being y-selected by the following symbols:
 - MBEDTLS_X509_LIBRARY (defined at /path_to/src/project/ncs/nrf/modules/trusted-firmware-m/Kconfig.mbedtls_minimal.defconfig:12, /path_to/src/project/ncs/nrfxlib/nrf_security/Kconfig:45), with value y, direct dependencies TFM_MINIMAL || NORDIC_SECURITY_BACKEND (value: y), and select condition NORDIC_SECURITY_BACKEND (value: y)

error: Aborting due to Kconfig warnings

CMake Error at /path_to/src/project/ncs/zephyr/cmake/kconfig.cmake:270 (message):
  command failed with return code: 1
Call Stack (most recent call first):
  /path_to/src/project/ncs/zephyr/cmake/app/boilerplate.cmake:546 (include)
  /path_to/src/project/ncs/zephyr/share/zephyr-package/cmake/ZephyrConfig.cmake:24 (include)
  /path_to/src/project/ncs/zephyr/share/zephyr-package/cmake/ZephyrConfig.cmake:40 (include_boilerplate)
  CMakeLists.txt:9 (find_package)


-- Configuring incomplete, errors occurred!
See also "/path_to/src/project/ncs/nrf9160-button/build/CMakeFiles/CMakeOutput.log".
See also "/path_to/src/project/ncs/nrf9160-button/build/CMakeFiles/CMakeError.log".
FAILED: build.ninja 
/usr/bin/cmake --regenerate-during-build -S/path_to/src/project/ncs/nrf9160-button -B/path_to/src/project/ncs/nrf9160-button/build
ninja: error: rebuilding 'build.ninja': subcommand failed
FATAL ERROR: command exited with status 1: /usr/bin/cmake --build /path_to/src/project/ncs/nrf9160-button/build

[Øivind]

Which operating system and version are you using?

[randomdude]

I'm using Linux Mint 20, with kernel 5.11.0. Also, I had to re-install my OS over the weekend, but I just successfully built my program without the mbedtls parts, just to make sure everything that worked before still works.

[Øivind]

Not sure about that error, but a colleague solved a similar error recently by changing the name of the sample.

Try changing the name of the sample folder to something you are certain is completely unique. Delete the build folder again for good measure.

[randomdude]

I did what you suggested, but it didn't help. here's the linker error again:

[270/279] Linking C executable zephyr/zephyr_prebuilt.elf
FAILED: zephyr/zephyr_prebuilt.elf zephyr/zephyr_prebuilt.map /path_to/src/project/ncs/csr-signing-demo/build/zephyr/zephyr_prebuilt.map
: && ccache /opt/zephyr-sdk-0.13.1/arm-zephyr-eabi/bin/arm-zephyr-eabi-gcc   zephyr/CMakeFiles/zephyr_prebuilt.dir/misc/empty_file.c.obj -o zephyr/zephyr_prebuilt.elf  zephyr/CMakeFiles/offsets.dir/./arch/arm/core/offsets/offsets.c.obj  tfm/secure_fw/s_veneers.o  -fuse-ld=bfd  -Wl,-T  zephyr/linker_zephyr_prebuilt.cmd  -Wl,-Map=/path_to/src/project/ncs/csr-signing-demo/build/zephyr/zephyr_prebuilt.map  -Wl,--whole-archive  app/libapp.a  zephyr/libzephyr.a  zephyr/arch/common/libarch__common.a  zephyr/arch/arch/arm/core/aarch32/libarch__arm__core__aarch32.a  zephyr/arch/arch/arm/core/aarch32/cortex_m/libarch__arm__core__aarch32__cortex_m.a  zephyr/arch/arch/arm/core/aarch32/cortex_m/cmse/libarch__arm__core__aarch32__cortex_m__cmse.a  zephyr/arch/arch/arm/core/aarch32/mpu/libarch__arm__core__aarch32__mpu.a  zephyr/lib/libc/newlib/liblib__libc__newlib.a  zephyr/lib/posix/liblib__posix.a  zephyr/soc/arm/common/cortex_m/libsoc__arm__common__cortex_m.a  zephyr/boards/boards/arm/nrf9160dk_nrf9160_ns/libboards__arm__nrf9160dk_nrf9160.a  zephyr/subsys/net/libsubsys__net.a  zephyr/subsys/net/ip/libsubsys__net__ip.a  zephyr/subsys/random/libsubsys__random.a  zephyr/drivers/clock_control/libdrivers__clock_control.a  zephyr/drivers/console/libdrivers__console.a  zephyr/drivers/gpio/libdrivers__gpio.a  zephyr/drivers/serial/libdrivers__serial.a  zephyr/drivers/entropy/libdrivers__entropy.a  zephyr/drivers/timer/libdrivers__timer.a  modules/nrf/lib/nrf_modem_lib/lib..__nrf__lib__nrf_modem_lib.a  modules/nrf/lib/at_monitor/lib..__nrf__lib__at_monitor.a  modules/nrf/lib/at_cmd_parser/lib..__nrf__lib__at_cmd_parser.a  modules/nrf/lib/lte_link_control/lib..__nrf__lib__lte_link_control.a  modules/nrf/lib/fatal_error/lib..__nrf__lib__fatal_error.a  modules/nrf/lib/modem_key_mgmt/lib..__nrf__lib__modem_key_mgmt.a  modules/nrf/subsys/fw_info/lib..__nrf__subsys__fw_info.a  modules/trusted-firmware-m/libtfm_api.a  modules/hal_nordic/nrfx/libmodules__hal_nordic__nrfx.a  /path_to/src/project/ncs/nrfxlib/nrf_modem/lib/cortex-m33/soft-float/libmodem.a  modules/nrfxlib/nrfxlib/nrf_security/src/zephyr/libmbedtls_zephyr.a  -Wl,--no-whole-archive  zephyr/kernel/libkernel.a  -L"/opt/zephyr-sdk-0.13.1/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/thumb/v8-m.main/nofp"  -L/path_to/src/project/ncs/csr-signing-demo/build/zephyr  -lgcc  zephyr/arch/common/libisr_tables.a  tfm/platform/libplatform_ns.a  tfm/app/libtfm_api_ns.a  -Wl,--gc-sections  -Wl,--build-id=none  -Wl,--sort-common=descending  -Wl,--sort-section=alignment  -Wl,-u,_OffsetAbsSyms  -Wl,-u,_ConfigAbsSyms  -nostdlib  -static  -no-pie  -Wl,-X  -Wl,-N  -Wl,--orphan-handling=warn  spm/libspmsecureentries.a  -lm  -Wl,-lc  -L"/opt/zephyr-sdk-0.13.1/arm-zephyr-eabi/arm-zephyr-eabi"/lib/thumb/v8-m.main/nofp  -Wl,-lgcc  -lc  -lgcc  -specs=nano.specs  modules/nrfxlib/nrfxlib/nrf_security/src/mbedtls/libmbedtls.a  modules/nrfxlib/nrfxlib/nrf_security/src/mbedtls/libmbedx509.a  -mcpu=cortex-m33  -mthumb  -mabi=aapcs  -mfp16-format=ieee  modules/nrfxlib/nrfxlib/nrf_security/src/libmbedcrypto.a  -lc  -L && cd /path_to/src/project/ncs/csr-signing-demo/build/zephyr && /usr/bin/cmake -E echo
arm-zephyr-eabi-gcc: error: missing argument to '-L'
ninja: build stopped: subcommand failed.
FATAL ERROR: command exited with status 1: /usr/bin/cmake --build /path_to/src/project/ncs/csr-signing-demo/build


[Øivind]

Hm, could I get the full log again?

[randomdude]

Of course. This is the complete west build output after deleting the build directory and running west build  --board nrf9160dk_nrf9160_ns -t menuconfig

[0/1] Re-running CMake...
Including boilerplate (Zephyr base (cached)): /path_to/src/project/ncs/zephyr/cmake/app/boilerplate.cmake
-- Application: /path_to/src/project/ncs/csr-signing-demo
-- Zephyr version: 2.7.0 (/path_to/src/project/ncs/zephyr), build: v2.7.0-ncs1-rc2
-- Found west (found suitable version "0.12.0", minimum required is "0.7.1")
-- Board: nrf9160dk_nrf9160_ns, Revision: 0.7.0
-- Cache files will be written to: /path_to/.cache/zephyr
-- Using toolchain: zephyr 0.13.1 (/opt/zephyr-sdk-0.13.1)
-- Found dtc: /opt/zephyr-sdk-0.13.1/sysroots/x86_64-pokysdk-linux/usr/bin/dtc (found suitable version "1.6.0", minimum required is "1.4.6")
-- Found BOARD.dts: /path_to/src/project/ncs/zephyr/boards/arm/nrf9160dk_nrf9160/nrf9160dk_nrf9160_ns.dts
-- Found devicetree overlay: /path_to/src/project/ncs/csr-signing-demo/boards/nrf9160dk_nrf9160_ns.overlay
nrf9160dk_nrf9160_ns.dts.pre.tmp:367.32-371.5: Warning (simple_bus_reg): /soc/cryptocell-sw: missing or empty reg/ranges property
-- Generated zephyr.dts: /path_to/src/project/ncs/csr-signing-demo/build/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: /path_to/src/project/ncs/csr-signing-demo/build/zephyr/include/generated/devicetree_unfixed.h
-- Generated device_extern.h: /path_to/src/project/ncs/csr-signing-demo/build/zephyr/include/generated/device_extern.h
-- Including generated dts.cmake file: /path_to/src/project/ncs/csr-signing-demo/build/zephyr/dts.cmake
Parsing /path_to/src/project/ncs/csr-signing-demo/Kconfig
Loaded configuration '/path_to/src/project/ncs/csr-signing-demo/build/zephyr/.config'
No change to configuration in '/path_to/src/project/ncs/csr-signing-demo/build/zephyr/.config'
Kconfig header saved to '/path_to/src/project/ncs/csr-signing-demo/build/zephyr/include/generated/autoconf.h'

warning: Experimental symbol NET_SOCKETS_OFFLOAD is enabled.

Dropping partition 'nrf_modem_lib_trace' since its size is 0.
-- Configuring done
-- Generating done
-- Build files have been written to: /path_to/src/project/ncs/csr-signing-demo/build
ninja: error: 'spm/libspmsecureentries.a', needed by 'zephyr/zephyr_prebuilt.elf', missing and no known rule to make it
FATAL ERROR: command exited with status 1: /usr/bin/cmake --build /path_to/src/project/ncs/csr-signing-demo/build

What puzzles me is that the error seems to change, and I can't tell when or why. Sometimes it's a linker error, and sometimes it's this. I'm new to the zephyr ecosystem, but it's not like this is my first ever embedded project, so I'm supposed to generally know what I'm doing. Still, I have no idea what's going on here.

BTW, I started out with following the getting started guide and then copying the nrf9160-button example, if that's of any help.

[Øivind]

I'm sorry for not being clear, but could I get the full build log after the build folder has been deleted? Otherwise a lot is left out.

It might be an issue with the SDK installation. I'll ask a colleague who is very familiar with how the SDK works on linux to take a look when you post the full log.

[randomdude]

I now managed to build my project without errors, but only after I manually configured all the X509/MBEDTLS stuff in my prj.conf.

You see, the way I initially went at this was to remove the build-folder, then run 'west build  --board nrf9160dk_nrf9160_ns -t menuconfig', set all the crypto foo there, and then re-build the project, which failed in all the colorful ways listed above. Up until then I hadn't even touched the prj.conf.

In the process of trying to satisfy your latest request for a full build log, I stumbled over a lot of discrepancies I hadn't noticed or just stupidly ignored before. So thanks for forcing me to clean up my own mess.

I'd like to read up a bit on the build process, especially how all the new (to me) tools like west, and ninja translate to "old people's tools" like make, gcc, and so on. Can you point me in the right direction?

[Øivind]

Great to hear that it builds without errors now!

For the Build and Configuration System as a whole, you can look at this guide: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/1.8.0/zephyr/guides/build/index.html

For West specifically, this guide should be useful: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/1.8.0/zephyr/guides/west/index.html

For Ninja, you should probably look at the Ninja manual: https://ninja-build.org/manual.html