NCS 1.9.1 unable to use PSA crypto methods with OpenThread enabled

I'm unable to use the PSA crypto methods when OpenThread is enabled on NCS 1.9.1. Linking fails with undefined references to PSA crypto methods.

To reproduce, us the nrf/samples/crypto/aes_cbc example, and add the following to prj.conf:

CONFIG_NETWORKING=y
CONFIG_NET_L2_OPENTHREAD=y

Building for the nrf52840dk_nrf52840  yields errors:

FAILED: zephyr/zephyr_pre0.elf zephyr/zephyr_pre0.map /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/build/zephyr/zephyr_pre0.map 
: && ccache /home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/arm-zephyr-eabi-g++   zephyr/CMakeFiles/zephyr_pre0.dir/misc/empty_file.c.obj -o zephyr/zephyr_pre0.elf  zephyr/CMakeFiles/offsets.dir/./arch/arm/core/offsets/offsets.c.obj  -fuse-ld=bfd  -Wl,-T  zephyr/linker_zephyr_pre0.cmd  -Wl,-Map=/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/build/zephyr/zephyr_pre0.map  -Wl,--whole-archive  app/libapp.a  zephyr/libzephyr.a  zephyr/arch/common/libarch__common.a  zephyr/arch/arch/arm/core/aarch32/libarch__arm__core__aarch32.a  zephyr/arch/arch/arm/core/aarch32/cortex_m/libarch__arm__core__aarch32__cortex_m.a  zephyr/arch/arch/arm/core/aarch32/mpu/libarch__arm__core__aarch32__mpu.a  zephyr/lib/libc/newlib/liblib__libc__newlib.a  zephyr/lib/posix/liblib__posix.a  zephyr/soc/arm/common/cortex_m/libsoc__arm__common__cortex_m.a  zephyr/soc/arm/nordic_nrf/nrf52/libsoc__arm__nordic_nrf__nrf52.a  zephyr/subsys/net/libsubsys__net.a  zephyr/subsys/net/l2/openthread/libsubsys__net__ip__l2__openthread.a  zephyr/subsys/net/ip/libsubsys__net__ip.a  zephyr/subsys/net/lib/openthread/platform/libopenthread_platform.a  zephyr/subsys/random/libsubsys__random.a  zephyr/drivers/clock_control/libdrivers__clock_control.a  zephyr/drivers/console/libdrivers__console.a  zephyr/drivers/gpio/libdrivers__gpio.a  zephyr/drivers/ieee802154/libdrivers__ieee802154.a  zephyr/drivers/flash/libdrivers__flash.a  zephyr/drivers/serial/libdrivers__serial.a  zephyr/drivers/entropy/libdrivers__entropy.a  zephyr/drivers/timer/libdrivers__timer.a  modules/nrf/lib/multithreading_lock/lib..__nrf__lib__multithreading_lock.a  modules/nrf/lib/fatal_error/lib..__nrf__lib__fatal_error.a  modules/nrf/subsys/mpsl/init/lib..__nrf__subsys__mpsl__init.a  modules/nrf/subsys/ieee802154/lib..__nrf__subsys__ieee802154.a  modules/nrf/drivers/mpsl/clock_control/lib..__nrf__drivers__mpsl__clock_control.a  modules/nrf/drivers/mpsl/flash_sync/lib..__nrf__drivers__mpsl__flash_sync.a  modules/nrf/drivers/mpsl/temp_nrf5/lib..__nrf__drivers__mpsl__temp_nrf5.a  modules/nrf/drivers/hw_cc310/lib..__nrf__drivers__hw_cc310.a  modules/hal_nordic/nrf_802154/libnrf-802154-platform.a  modules/nrfxlib/nrf_802154/nrf_802154/driver/libnrf-802154-driver.a  modules/hal_nordic/nrfx/libmodules__hal_nordic__nrfx.a  modules/segger/libmodules__segger.a  modules/nrfxlib/nrfxlib/nrf_security/src/zephyr/libmbedtls_zephyr.a  -Wl,--no-whole-archive  zephyr/kernel/libkernel.a  -L"/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/thumb/v7e-m/nofp"  -L/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/build/zephyr  -lgcc  zephyr/arch/common/libisr_tables.a  modules/hal_nordic/nrf_802154/libnrf-802154-platform.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/nrf_802154/sl/sl/lib/nRF52840/soft-float/libnrf-802154-sl.a  -no-pie  -Wl,--gc-sections  -Wl,--build-id=none  -Wl,--sort-common=descending  -Wl,--sort-section=alignment  -Wl,-u,_OffsetAbsSyms  -Wl,-u,_ConfigAbsSyms  -nostdlib  -static  -Wl,-X  -Wl,-N  -Wl,--orphan-handling=warn  -lm  -Wl,-lc  -L"/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/arm-zephyr-eabi"/lib/thumb/v7e-m/nofp  -Wl,-lgcc  -specs=nano.specs  modules/openthread/build/src/core/libopenthread-ftd.a  modules/openthread/build/third_party/tcplp/libtcplp.a  modules/openthread/build/src/core/libopenthread-mtd.a  modules/openthread/build/src/core/libopenthread-ftd.a  modules/openthread/build/third_party/tcplp/libtcplp.a  modules/openthread/build/src/core/libopenthread-mtd.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/mpsl/lib/cortex-m4/soft-float/libmpsl.a  modules/nrfxlib/nrfxlib/nrf_security/src/libmbedtls.a  modules/nrfxlib/nrfxlib/nrf_security/src/libmbedx509.a  modules/nrfxlib/nrfxlib/nrf_security/src/libmbedcrypto.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_cc310_mbedcrypto/lib/cortex-m4/soft-float/no-interrupts/libnrf_cc310_psa_crypto_0.9.13.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_cc310_mbedcrypto/lib/cortex-m4/soft-float/no-interrupts/libnrf_cc310_mbedcrypto_0.9.13.a  modules/nrfxlib/nrfxlib/nrf_security/src/libmbedcrypto.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_cc310_mbedcrypto/lib/cortex-m4/soft-float/no-interrupts/libnrf_cc310_psa_crypto_0.9.13.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_cc310_mbedcrypto/lib/cortex-m4/soft-float/no-interrupts/libnrf_cc310_mbedcrypto_0.9.13.a  -lc  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_oberon/lib/cortex-m4/soft-float/liboberon_psa_3.0.10.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_oberon/lib/cortex-m4/soft-float/liboberon_mbedtls_3.0.10.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_oberon/lib/cortex-m4/soft-float/liboberon_3.0.10.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_cc310_platform/lib/cortex-m4/soft-float/no-interrupts/libnrf_cc310_platform_0.9.13.a  modules/nrfxlib/nrfxlib/nrf_security/src/libmbedcrypto_base.a  -mcpu=cortex-m4  -mthumb  -mabi=aapcs  -mfp16-format=ieee  -lc && cd /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/build/zephyr && /usr/bin/cmake -E echo
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(main.c.obj): in function `crypto_init':
/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:56: undefined reference to `psa_crypto_init'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(main.c.obj): in function `crypto_finish':
/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:68: undefined reference to `psa_destroy_key'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(main.c.obj): in function `generate_key':
/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:95: undefined reference to `psa_generate_key'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:102: undefined reference to `psa_reset_key_attributes'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(main.c.obj): in function `encrypt_cbc_aes':
/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:118: undefined reference to `psa_cipher_encrypt_setup'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:125: undefined reference to `psa_cipher_generate_iv'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:132: undefined reference to `psa_cipher_update'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:141: undefined reference to `psa_cipher_finish'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:155: undefined reference to `psa_cipher_abort'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(main.c.obj): in function `decrypt_cbc_aes':
/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:169: undefined reference to `psa_cipher_decrypt_setup'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:176: undefined reference to `psa_cipher_set_iv'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:183: undefined reference to `psa_cipher_update'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:192: undefined reference to `psa_cipher_finish'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:214: undefined reference to `psa_cipher_abort'

Parents
  • Hi Zack,

    I am not sure if you can enable openthread support in this sample directly. If you work on an openthread related project, it would be better to start with openthread samples and add other features you need.

    I will do some investigation and feedback to you later.

    Best regards,

    Charlie

  • Our actual application is based off an OpenThread sample, and added PSA crypto. Even when the new PSA crypto methods are enabled, they're not linked (undefined reference to all PSA crypto methods)

    A bit more testing and it appears the culprit here is actually the legacy crypto support. 

    Just adding 

    CONFIG_NORDIC_SECURITY_BACKEND=y

    to that aes_cbc sample causes the same compilation failures. It just happens that OpenThread is using the legacy crypto, rather than the newer CONFIG_NRF_SECURITY.

    What can we do to have legacy crypto support and the newer PSA methods enabled at the same time?

Reply
  • Our actual application is based off an OpenThread sample, and added PSA crypto. Even when the new PSA crypto methods are enabled, they're not linked (undefined reference to all PSA crypto methods)

    A bit more testing and it appears the culprit here is actually the legacy crypto support. 

    Just adding 

    CONFIG_NORDIC_SECURITY_BACKEND=y

    to that aes_cbc sample causes the same compilation failures. It just happens that OpenThread is using the legacy crypto, rather than the newer CONFIG_NRF_SECURITY.

    What can we do to have legacy crypto support and the newer PSA methods enabled at the same time?

Children
No Data
Related