NCS 1.9.1 unable to use PSA crypto methods with OpenThread enabled

I'm unable to use the PSA crypto methods when OpenThread is enabled on NCS 1.9.1. Linking fails with undefined references to PSA crypto methods.

To reproduce, us the nrf/samples/crypto/aes_cbc example, and add the following to prj.conf:

CONFIG_NETWORKING=y
CONFIG_NET_L2_OPENTHREAD=y

Building for the nrf52840dk_nrf52840  yields errors:

FAILED: zephyr/zephyr_pre0.elf zephyr/zephyr_pre0.map /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/build/zephyr/zephyr_pre0.map 
: && ccache /home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/arm-zephyr-eabi-g++   zephyr/CMakeFiles/zephyr_pre0.dir/misc/empty_file.c.obj -o zephyr/zephyr_pre0.elf  zephyr/CMakeFiles/offsets.dir/./arch/arm/core/offsets/offsets.c.obj  -fuse-ld=bfd  -Wl,-T  zephyr/linker_zephyr_pre0.cmd  -Wl,-Map=/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/build/zephyr/zephyr_pre0.map  -Wl,--whole-archive  app/libapp.a  zephyr/libzephyr.a  zephyr/arch/common/libarch__common.a  zephyr/arch/arch/arm/core/aarch32/libarch__arm__core__aarch32.a  zephyr/arch/arch/arm/core/aarch32/cortex_m/libarch__arm__core__aarch32__cortex_m.a  zephyr/arch/arch/arm/core/aarch32/mpu/libarch__arm__core__aarch32__mpu.a  zephyr/lib/libc/newlib/liblib__libc__newlib.a  zephyr/lib/posix/liblib__posix.a  zephyr/soc/arm/common/cortex_m/libsoc__arm__common__cortex_m.a  zephyr/soc/arm/nordic_nrf/nrf52/libsoc__arm__nordic_nrf__nrf52.a  zephyr/subsys/net/libsubsys__net.a  zephyr/subsys/net/l2/openthread/libsubsys__net__ip__l2__openthread.a  zephyr/subsys/net/ip/libsubsys__net__ip.a  zephyr/subsys/net/lib/openthread/platform/libopenthread_platform.a  zephyr/subsys/random/libsubsys__random.a  zephyr/drivers/clock_control/libdrivers__clock_control.a  zephyr/drivers/console/libdrivers__console.a  zephyr/drivers/gpio/libdrivers__gpio.a  zephyr/drivers/ieee802154/libdrivers__ieee802154.a  zephyr/drivers/flash/libdrivers__flash.a  zephyr/drivers/serial/libdrivers__serial.a  zephyr/drivers/entropy/libdrivers__entropy.a  zephyr/drivers/timer/libdrivers__timer.a  modules/nrf/lib/multithreading_lock/lib..__nrf__lib__multithreading_lock.a  modules/nrf/lib/fatal_error/lib..__nrf__lib__fatal_error.a  modules/nrf/subsys/mpsl/init/lib..__nrf__subsys__mpsl__init.a  modules/nrf/subsys/ieee802154/lib..__nrf__subsys__ieee802154.a  modules/nrf/drivers/mpsl/clock_control/lib..__nrf__drivers__mpsl__clock_control.a  modules/nrf/drivers/mpsl/flash_sync/lib..__nrf__drivers__mpsl__flash_sync.a  modules/nrf/drivers/mpsl/temp_nrf5/lib..__nrf__drivers__mpsl__temp_nrf5.a  modules/nrf/drivers/hw_cc310/lib..__nrf__drivers__hw_cc310.a  modules/hal_nordic/nrf_802154/libnrf-802154-platform.a  modules/nrfxlib/nrf_802154/nrf_802154/driver/libnrf-802154-driver.a  modules/hal_nordic/nrfx/libmodules__hal_nordic__nrfx.a  modules/segger/libmodules__segger.a  modules/nrfxlib/nrfxlib/nrf_security/src/zephyr/libmbedtls_zephyr.a  -Wl,--no-whole-archive  zephyr/kernel/libkernel.a  -L"/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/thumb/v7e-m/nofp"  -L/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/build/zephyr  -lgcc  zephyr/arch/common/libisr_tables.a  modules/hal_nordic/nrf_802154/libnrf-802154-platform.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/nrf_802154/sl/sl/lib/nRF52840/soft-float/libnrf-802154-sl.a  -no-pie  -Wl,--gc-sections  -Wl,--build-id=none  -Wl,--sort-common=descending  -Wl,--sort-section=alignment  -Wl,-u,_OffsetAbsSyms  -Wl,-u,_ConfigAbsSyms  -nostdlib  -static  -Wl,-X  -Wl,-N  -Wl,--orphan-handling=warn  -lm  -Wl,-lc  -L"/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/arm-zephyr-eabi"/lib/thumb/v7e-m/nofp  -Wl,-lgcc  -specs=nano.specs  modules/openthread/build/src/core/libopenthread-ftd.a  modules/openthread/build/third_party/tcplp/libtcplp.a  modules/openthread/build/src/core/libopenthread-mtd.a  modules/openthread/build/src/core/libopenthread-ftd.a  modules/openthread/build/third_party/tcplp/libtcplp.a  modules/openthread/build/src/core/libopenthread-mtd.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/mpsl/lib/cortex-m4/soft-float/libmpsl.a  modules/nrfxlib/nrfxlib/nrf_security/src/libmbedtls.a  modules/nrfxlib/nrfxlib/nrf_security/src/libmbedx509.a  modules/nrfxlib/nrfxlib/nrf_security/src/libmbedcrypto.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_cc310_mbedcrypto/lib/cortex-m4/soft-float/no-interrupts/libnrf_cc310_psa_crypto_0.9.13.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_cc310_mbedcrypto/lib/cortex-m4/soft-float/no-interrupts/libnrf_cc310_mbedcrypto_0.9.13.a  modules/nrfxlib/nrfxlib/nrf_security/src/libmbedcrypto.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_cc310_mbedcrypto/lib/cortex-m4/soft-float/no-interrupts/libnrf_cc310_psa_crypto_0.9.13.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_cc310_mbedcrypto/lib/cortex-m4/soft-float/no-interrupts/libnrf_cc310_mbedcrypto_0.9.13.a  -lc  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_oberon/lib/cortex-m4/soft-float/liboberon_psa_3.0.10.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_oberon/lib/cortex-m4/soft-float/liboberon_mbedtls_3.0.10.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_oberon/lib/cortex-m4/soft-float/liboberon_3.0.10.a  /home/zcornelius/code/nrf-base/ncs/nrfxlib/crypto/nrf_cc310_platform/lib/cortex-m4/soft-float/no-interrupts/libnrf_cc310_platform_0.9.13.a  modules/nrfxlib/nrfxlib/nrf_security/src/libmbedcrypto_base.a  -mcpu=cortex-m4  -mthumb  -mabi=aapcs  -mfp16-format=ieee  -lc && cd /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/build/zephyr && /usr/bin/cmake -E echo
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(main.c.obj): in function `crypto_init':
/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:56: undefined reference to `psa_crypto_init'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(main.c.obj): in function `crypto_finish':
/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:68: undefined reference to `psa_destroy_key'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(main.c.obj): in function `generate_key':
/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:95: undefined reference to `psa_generate_key'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:102: undefined reference to `psa_reset_key_attributes'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(main.c.obj): in function `encrypt_cbc_aes':
/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:118: undefined reference to `psa_cipher_encrypt_setup'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:125: undefined reference to `psa_cipher_generate_iv'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:132: undefined reference to `psa_cipher_update'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:141: undefined reference to `psa_cipher_finish'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:155: undefined reference to `psa_cipher_abort'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(main.c.obj): in function `decrypt_cbc_aes':
/home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:169: undefined reference to `psa_cipher_decrypt_setup'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:176: undefined reference to `psa_cipher_set_iv'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:183: undefined reference to `psa_cipher_update'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:192: undefined reference to `psa_cipher_finish'
/home/zcornelius/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/10.3.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/zcornelius/code/nrf-base/ncs/nrf/samples/crypto/aes_cbc/src/main.c:214: undefined reference to `psa_cipher_abort'

Parents
  • Hi Zack,


    After some investigation, we found enabling PSA crypto APIs in OpenThread is limited to some configurations around ECJPAKE (required for OpenThread)

    There are a few things missing in TLS/DTLS to handle pure PSA crypto APIs. Unfortunately, we have some conflicts with regards to old and new configurations so we can't enable both in case TLS/DTLS is in use. We hope to solve some of this before nRF Connect SDK 2.0.0 timeline, but it may be fairly heavy work, so we don't have a good estimation of when the alternative solution will be ready by far.

    Is that OK you continue your development with the legacy crypto library and switch to the new one later?

    Best regards,

    Charlie

Reply
  • Hi Zack,


    After some investigation, we found enabling PSA crypto APIs in OpenThread is limited to some configurations around ECJPAKE (required for OpenThread)

    There are a few things missing in TLS/DTLS to handle pure PSA crypto APIs. Unfortunately, we have some conflicts with regards to old and new configurations so we can't enable both in case TLS/DTLS is in use. We hope to solve some of this before nRF Connect SDK 2.0.0 timeline, but it may be fairly heavy work, so we don't have a good estimation of when the alternative solution will be ready by far.

    Is that OK you continue your development with the legacy crypto library and switch to the new one later?

    Best regards,

    Charlie

Children
Related