MbedTLS configuration/socket issue. Migrating from 1.8.0->2.2.0 nRF Connect

RE: MbedTLS configuration/socket issue. Migrating from 1.8.0->2.2.0 nRF Connect

dimitrois — Thu, 04 May 2023 10:46:23 GMT

Hi, thanks for the response.

Unfortunately I was getting different types of errors (multiple definitions at compile time related to systick) with your suggestion (maybe I was doing something wrong).

What worked for me: I added

&systick {
status = "okay";
};

to our custom board .dts file and used workarounds from this post:

devzone.nordicsemi.com/.../multiple-definition-errors-when-trying-to-migrate-code-from-toolchain-1-7-1-to-1-9-1

The application now runs fine and authenticates with the server without any issues, so this ticket can be closed.

Transitioning to TF-M will be another headache if we need to migrate to a newer version of SDK but at least the other updates are already implemented.

RE: MbedTLS configuration/socket issue. Migrating from 1.8.0->2.2.0 nRF Connect

Sigurd Hellesvik — Wed, 03 May 2023 11:42:33 GMT

Instead of adding the overlay using -Dsmp_DTC_OVERLAY_FILE, try to move systick_enabled.overlay into child_image/spm.conf instead.

This child_image folder will be in your project directory.

See Multi-image builds for more info on this folder structure.

Regards,
Sigurd Hellesvik

RE: MbedTLS configuration/socket issue. Migrating from 1.8.0->2.2.0 nRF Connect

dimitrois — Tue, 02 May 2023 08:20:24 GMT

Hi,

I have now abandoned attempts to make our application work with TFM and Nordic Security Backend.

TFM is not a hard requirement for us and SPM is still supported in nRF SDK v2.2.0, so I decided to change the approach and use SPM for now (I am aware it is removed after 2.2.0). This way I do not need to use Nordic Security Backend.

I made the necessary changes to revert back to SPM but it turns out SPM was broken in release v2.2.0.

There is a known issue described here: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrf/known_issues.html?v=v2-2-0 under Secure Partition Manager section.

I have tried using this workaround but get compilation error:

-- Found Dtc: /home/.../ncs/toolchains/v2.2.0/usr/local/bin/dtc (found suitable version "1.4.7", minimum required is "1.4.6")
-- Found BOARD.dts: /home/../custom_boards/boards/arm/... .dts
-- Found devicetree overlay: systick_enabled.overlay
<command-line>: fatal error: systick_enabled.overlay: No such file or directory
compilation terminated.
-- Configuring incomplete, errors occurred!

The command I use to build (same as without this workaround except for the last part):

west build -b ....@1.0.0 -d build_dir_ns -p -- -Dspm_DTC_OVERLAY_FILE=systick_enabled.overlay

It seems the compiler does not see the overlay file. I tried placing it into different places but the result is always the same.

Could you advise, what is the correct way of using this workaround?

RE: MbedTLS configuration/socket issue. Migrating from 1.8.0->2.2.0 nRF Connect

dimitrois — Fri, 31 Mar 2023 14:41:30 GMT

Hi,

This work was put on hold by the customer for an unknown period of time, so no further findings at this stage.

I will look into potential solutions you suggested and will post an update when/if there is any progress.

RE: MbedTLS configuration/socket issue. Migrating from 1.8.0->2.2.0 nRF Connect

Sigurd Hellesvik — Fri, 31 Mar 2023 13:48:08 GMT

Hi,

I will continue helping in this case.

[quote user="kme"]Sorry no:
https://devzone.nordicsemi.com/f/nordic-q-a/95688/config_mbedtls_config_c-does-not-work [/quote]

Answer is still "no" but I added a comment to this case.

Have you found anything else since last time?

Have a look at how our HTTPS sample is Using Mbed TLS and TF-M, maybe this can be helpful.
Maybe specifically the configurations at overlay-tfm_mbedtls.conf.

[quote user=""]I am not an expert in MbedTLS and the major pain for me is that I can't use the original "legacy" MbedTLS settings.[/quote]

Yea, as far as I have seen, we do not support nrf_security and legacy MbedTLS at the same time. It will either not work, or drastically increase the flash usage of your application.

If you can still not figure this out with the HTTPS sample linked above, can you capture a Modem Trace and upload it here as a .binary file using Insert -> Image/video/file?

(Also include modem firmware version.)

Regards,
Sigurd Hellesvik

RE: MbedTLS configuration/socket issue. Migrating from 1.8.0->2.2.0 nRF Connect

Kenneth — Wed, 01 Mar 2023 16:54:54 GMT

Hello,

Not sure what the problem is, but have you looked at the psa_tls sample which can be configured to run RSA using TF-M:
https://github.com/nrfconnect/sdk-nrf/tree/main/samples/crypto/psa_tls/

[quote user=""]Also, is there any civilized way of getting detailed logs from MbedTLS/sockets?[/quote]

Sorry no:
https://devzone.nordicsemi.com/f/nordic-q-a/95688/config_mbedtls_config_c-does-not-work

Kenneth