Error building custom_spm_app

[Pablosanserr]

Hi.

I'm trying to add a SPM partition to my project. Like another project i did in the past, i followed this guide: https://devzone.nordicsemi.com/guides/nrf-connect-sdk-guides/b/software/posts/using-a-custom-secure-partition-manager-wtih-your-application

I had problems while building my project so I decided to use the same example that can be downloaded in the guide. However, i get an error when i build it. I have not modified the example.

I'm using an nRF5340DK and I'm building using Visual Studio Code and nRF Connect SDK v1.9.1. I'm building the non-secure module (application) with this build configuration:

- Board: nrf5340dk_nrf5340_cpuapp_ns
- Configuration: prj.conf

Project zip: sample_custom_spm_1_4_0.zip

CMakeError.log obtained after building:

Compiling the C compiler identification source file "CMakeCCompilerId.c" failed.
Compiler: E:/Programs/Nordic/v1.9.1/toolchain/opt/bin/arm-none-eabi-gcc.exe
Build flags:
Id flags:

The output was:
1
e:/programs/nordic/v1.9.1/toolchain/opt/bin/../lib/gcc/arm-none-eabi/9.2.1/../../../../arm-none-eabi/bin/ld.exe: e:/programs/nordic/v1.9.1/toolchain/opt/bin/../lib/gcc/arm-none-eabi/9.2.1/../../../../arm-none-eabi/lib\libc.a(lib_a-exit.o): in function `exit':
exit.c:(.text.exit+0x2c): undefined reference to `_exit'
collect2.exe: error: ld returned 1 exit status

Compiling the CXX compiler identification source file "CMakeCXXCompilerId.cpp" failed.
Compiler: E:/Programs/Nordic/v1.9.1/toolchain/opt/bin/arm-none-eabi-gcc.exe
Build flags:
Id flags:

The output was:
1
e:/programs/nordic/v1.9.1/toolchain/opt/bin/../lib/gcc/arm-none-eabi/9.2.1/../../../../arm-none-eabi/bin/ld.exe: e:/programs/nordic/v1.9.1/toolchain/opt/bin/../lib/gcc/arm-none-eabi/9.2.1/../../../../arm-none-eabi/lib\libc.a(lib_a-exit.o): in function `exit':
exit.c:(.text.exit+0x2c): undefined reference to `_exit'
collect2.exe: error: ld returned 1 exit status

Terminal when i try to build the project:

> Executing task: nRF Connect: Generate config nrf5340dk_nrf5340_cpuapp_ns for c:\Nordic\custom_spm_app\application <

Building application
west build --build-dir c:\Nordic\custom_spm_app\application\build c:\Nordic\custom_spm_app\application --pristine --board nrf5340dk_nrf5340_cpuapp_ns -- -DNCS_TOOLCHAIN_VERSION:STRING="NONE"

-- west build: generating a build system
Including boilerplate (Zephyr base): E:/Programs/Nordic/v1.9.1/zephyr/cmake/app/boilerplate.cmake
-- Application: C:/Nordic/custom_spm_app/application
-- Zephyr version: 2.7.99 (E:/Programs/Nordic/v1.9.1/zephyr), build: v2.7.99-ncs1-1
-- Found Python3: E:/Programs/Nordic/v1.9.1/toolchain/opt/bin/python.exe (found suitable exact version "3.8.2") found components: Interpreter
-- Found west (found suitable version "0.12.0", minimum required is "0.7.1")
-- Board: nrf5340dk_nrf5340_cpuapp_ns
-- Cache files will be written to: E:/Programs/Nordic/v1.9.1/zephyr/.cache
-- Found dtc: E:/Programs/Nordic/v1.9.1/toolchain/opt/bin/dtc.exe (found suitable version "1.4.7", minimum required is "1.4.6")
-- Found toolchain: gnuarmemb (e:/Programs/Nordic/v1.9.1/toolchain/opt)
-- Found BOARD.dts: E:/Programs/Nordic/v1.9.1/zephyr/boards/arm/nrf5340dk_nrf5340/nrf5340dk_nrf5340_cpuapp_ns.dts
-- Generated zephyr.dts: C:/Nordic/custom_spm_app/application/build/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: C:/Nordic/custom_spm_app/application/build/zephyr/include/generated/devicetree_unfixed.h
-- Generated device_extern.h: C:/Nordic/custom_spm_app/application/build/zephyr/include/generated/device_extern.h
-- Including generated dts.cmake file: C:/Nordic/custom_spm_app/application/build/zephyr/dts.cmake
Parsing E:/Programs/Nordic/v1.9.1/zephyr/Kconfig
Loaded configuration 'E:/Programs/Nordic/v1.9.1/zephyr/boards/arm/nrf5340dk_nrf5340/nrf5340dk_nrf5340_cpuapp_ns_defconfig'
Merged configuration 'C:/Nordic/custom_spm_app/application/prj.conf'
Configuration saved to 'C:/Nordic/custom_spm_app/application/build/zephyr/.config'
Kconfig header saved to 'C:/Nordic/custom_spm_app/application/build/zephyr/include/generated/autoconf.h'
-- The C compiler identification is GNU 9.2.1
-- The CXX compiler identification is GNU 9.2.1
-- The ASM compiler identification is GNU
-- Found assembler: E:/Programs/Nordic/v1.9.1/toolchain/opt/bin/arm-none-eabi-gcc.exe
Skipping building of spm
CMake Warning at E:\Programs\Nordic\v1.9.1\nrf\samples\CMakeLists.txt:49 (message):
NOTE: SPM is not built from source, and the firmware use secure entry
functions. However, the configured library file is not found.

Ensure that the configuration 'ARM_ENTRY_VENEERS_LIB_NAME'
points to the .a file (default 'spm/libspmsecureentries.a')
generated alongside the flashed or merged SPM hex file

Changed board to secure nrf5340dk_nrf5340_cpuapp (NOT NS)

=== child image spm - begin ===
loading initial cache file C:/Nordic/custom_spm_app/application/build/spm/child_image_preload.cmake
Including boilerplate (Zephyr base): E:/Programs/Nordic/v1.9.1/zephyr/cmake/app/boilerplate.cmake
-- Application: C:/Nordic/custom_spm_app/spm_module/zephyr/spm
-- Zephyr version: 2.7.99 (E:/Programs/Nordic/v1.9.1/zephyr), build: v2.7.99-ncs1-1
-- Found Python3: E:/Programs/Nordic/v1.9.1/toolchain/opt/bin/python.exe (found suitable exact version "3.8.2") found components: Interpreter
-- Found west (found suitable version "0.12.0", minimum required is "0.7.1")
-- Board: nrf5340dk_nrf5340_cpuapp
-- Cache files will be written to: E:/Programs/Nordic/v1.9.1/zephyr/.cache
-- Found dtc: E:/Programs/Nordic/v1.9.1/toolchain/opt/bin/dtc.exe (found suitable version "1.4.7", minimum required is "1.4.6")
-- Found toolchain: gnuarmemb (e:/Programs/Nordic/v1.9.1/toolchain/opt)
-- Found BOARD.dts: E:/Programs/Nordic/v1.9.1/zephyr/boards/arm/nrf5340dk_nrf5340/nrf5340dk_nrf5340_cpuapp.dts
-- Generated zephyr.dts: C:/Nordic/custom_spm_app/application/build/spm/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: C:/Nordic/custom_spm_app/application/build/spm/zephyr/include/generated/devicetree_unfixed.h
-- Generated device_extern.h: C:/Nordic/custom_spm_app/application/build/spm/zephyr/include/generated/device_extern.h
-- Including generated dts.cmake file: C:/Nordic/custom_spm_app/application/build/spm/zephyr/dts.cmake
Parsing E:/Programs/Nordic/v1.9.1/zephyr/Kconfig
Loaded configuration 'E:/Programs/Nordic/v1.9.1/zephyr/boards/arm/nrf5340dk_nrf5340/nrf5340dk_nrf5340_cpuapp_defconfig'
Merged configuration 'C:/Nordic/custom_spm_app/spm_module/zephyr/spm/prj.conf'
Merged configuration 'E:/Programs/Nordic/v1.9.1/nrf/subsys/partition_manager/partition_manager_enabled.conf'
Merged configuration 'C:/Nordic/custom_spm_app/application/build/spm/zephyr/misc/generated/extra_kconfig_options.conf'
Configuration saved to 'C:/Nordic/custom_spm_app/application/build/spm/zephyr/.config'
Kconfig header saved to 'C:/Nordic/custom_spm_app/application/build/spm/zephyr/include/generated/autoconf.h'
-- The C compiler identification is GNU 9.2.1
-- The CXX compiler identification is GNU 9.2.1
-- The ASM compiler identification is GNU
-- Found assembler: E:/Programs/Nordic/v1.9.1/toolchain/opt/bin/arm-none-eabi-gcc.exe
-- Configuring done
-- Generating done
-- Build files have been written to: C:/Nordic/custom_spm_app/application/build/spm
=== child image spm - end ===

CMake Warning at E:\Programs\Nordic\v1.9.1\nrf\cmake\partition_manager.cmake:58 (message):
One or more child image is not configured to be built from source.
However, there is no static configuration provided to the partition
manager. Please provide a static configuration as described in the
'Scripts -> Partition Manager -> Static configuration' chapter in the
documentation. Without this information, the build system is not able to
place the image correctly in flash.
Call Stack (most recent call first):
E:\Programs\Nordic\v1.9.1\zephyr\cmake\app\boilerplate.cmake:678 (include)
E:\Programs\Nordic\v1.9.1\zephyr\share\zephyr-package\cmake\ZephyrConfig.cmake:24 (include)
E:\Programs\Nordic\v1.9.1\zephyr\share\zephyr-package\cmake\ZephyrConfig.cmake:35 (include_boilerplate)
c:\Nordic\custom_spm_app\application\build\CMakeLists.txt:12 (find_package)

Traceback (most recent call last):
File "E:/Programs/Nordic/v1.9.1/nrf/scripts/partition_manager.py", line 1938, in <module>
main()
File "E:/Programs/Nordic/v1.9.1/nrf/scripts/partition_manager.py", line 1006, in main
pm_config = load_reqs(args.input_files)
File "E:/Programs/Nordic/v1.9.1/nrf/scripts/partition_manager.py", line 675, in load_reqs
raise PartitionError(
__main__.PartitionError: Conflicting configuration found for 'C:/Nordic/custom_spm_app/application/build/spm/modules/nrf/subsys/partition_manager/pm.yml.trustzone' value for key 'sram_secure' differs. val1: {'region': 'sram_primary', 'span': ['pcd_sram']} val2: {'span': [], 'region': 'sram_primary'}
CMake Error at E:\Programs\Nordic\v1.9.1\nrf\cmake\partition_manager.cmake:274 (message):
Partition Manager failed, aborting. Command:
E:/Programs/Nordic/v1.9.1/toolchain/opt/bin/python.exe;E:/Programs/Nordic/v1.9.1/nrf/scripts/partition_manager.py;--input-files;C:/Nordic/custom_spm_app/application/build/spm/zephyr/include/generated/pm.yml;C:/Nordic/custom_spm_app/application/build/spm/modules/nrf/subsys/partition_manager/pm.yml.trustzone;C:/Nordic/custom_spm_app/application/build/zephyr/include/generated/pm.yml;C:/Nordic/custom_spm_app/application/build/modules/nrf/subsys/partition_manager/pm.yml.trustzone;--regions;sram_primary;otp;flash_primary;--output-partitions;C:/Nordic/custom_spm_app/application/build/partitions.yml;--output-regions;C:/Nordic/custom_spm_app/application/build/regions.yml;--sram_primary-size;0x80000;--sram_primary-base-address;0x20000000;--sram_primary-placement-strategy;complex;--sram_primary-dynamic-partition;sram_primary;--otp-size;764;--otp-base-address;0xff8100;--otp-placement-strategy;start_to_end;--flash_primary-size;0x100000;--flash_primary-base-address;0x0;--flash_primary-placement-strategy;complex;--flash_primary-device;NRF_FLASH_DRV_NAME
Call Stack (most recent call first):
E:\Programs\Nordic\v1.9.1\zephyr\cmake\app\boilerplate.cmake:678 (include)
E:\Programs\Nordic\v1.9.1\zephyr\share\zephyr-package\cmake\ZephyrConfig.cmake:24 (include)
E:\Programs\Nordic\v1.9.1\zephyr\share\zephyr-package\cmake\ZephyrConfig.cmake:35 (include_boilerplate)
c:\Nordic\custom_spm_app\application\build\CMakeLists.txt:12 (find_package)

-- Configuring incomplete, errors occurred!
See also "C:/Nordic/custom_spm_app/application/build/CMakeFiles/CMakeOutput.log".
See also "C:/Nordic/custom_spm_app/application/build/CMakeFiles/CMakeError.log".
FATAL ERROR: command exited with status 1: 'e:\Programs\Nordic\v1.9.1\toolchain\opt\bin\cmake.EXE' '-DWEST_PYTHON=e:\Programs\Nordic\v1.9.1\toolchain\opt\bin\python.exe' '-Bc:\Nordic\custom_spm_app\application\build' '-Sc:\Nordic\custom_spm_app\application' -GNinja -DBOARD=nrf5340dk_nrf5340_cpuapp_ns -DNCS_TOOLCHAIN_VERSION:STRING=NONE
The terminal process terminated with exit code: 1.

[Sigurd Hellesvik]

Hi Pablo

The guide you follow is old, and I do not recommend following it.

From nRF Connect SDK v2.0.0 Release Notes:
"Trusted Firmware M (TF-M) replaces the Secure Partition Manager (SPM) for secure image firmware. TF-M is now enabled by default for most nRF9160 and nRF5340 applications and samples."

We are in other words phasing out the use of SPM. So I recommend that you try to use Trusted Firmware-M(TF-M) instead. See Security for how to get started.

For TF-M, have a look at our TF-M secure peripheral partition sample. Does this sample do what you want?
If not, if you explain your reason for adding a custom SPM partition to your project, I could try to help you find the best solution to solve that issue.

Regards,
Sigurd Hellesvik

[Pablosanserr]

Hi Sigurd

I am developing a a Bluetooth project (started from Bluetooth Peripheral UART sample) with nRF Connect SDK v1.9.0. I use NVS to store some data in non-volatile memory. My idea was to move my NVS storage to a secure module using SPM.

Regards,

Pablo

[Sigurd Hellesvik]

Hi

Which kind of data is it that you want to store?

Will the data be in the non-secure partition before being stored?

Regards,
Sigurd Hellesvik

[Pablosanserr]

Hi

I am currently storing an integer value and an array of structs containing strings.

The idea is to use TrustZone to store this information. If it were stored there, there would be no need to keep the values in the non-secure partition.

The storage can be accessed by methods that allow to add new elements to the array, to get a list or to delete them.

Regards,

Pablo

[Sigurd Hellesvik]

Hi Pablo

I will persist in recommending using nRF Connect SDK v2.0.0 for your application.
Here are some reasons:

• SPM will be deprecated out in future releases of the nRF Connect SDK, meaning if you use SPM, you will have a hard time upgrading later.
• We have a Migration notes from nRF Connect SDK v1.9.1 to nRF Connect SDK v2.0.0, making the transition of your earlier application easier.
• The nRF Connect SDK v2.0.0 has an example doing exactly what you want.

However, if you are set on using v1.9.0 still, try copying the TF-M secure peripheral partition sample to 1.9.0 and run it there.

Either way TF-M has its own solutions for storing variables into persistent memory. See PSA Storage API.

• Protected Storage: Saves data to secure internal storage.
• PSA Key Management: Generates keys stores them in secure internal storage.
• ITS: Stores keys to internal secures storage from secure partition. See description in PSA Storage API.
  ITS services can only be called from the secure partition, and not from non-secure.
  To use ITS, I think you can call the ITS Secure API from a secure service. I am unsure, so I asked our developers about this. I will let you know when I they confirm or not.

Does this make sense to you?

Regards,
Sigurd Hellesvik

[Pablosanserr]

Hi Sigurd.

First of all, thank you very much for your help and information.

I will take a look at the documentation you have sent and try the different options, to see how I continue to approach the project.

My doubt is clarified. If I had any other problems, I would open another ticket.

Regards,

Pablo