WIP

Fixes an issue with linking errors because out is not defined.

Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>

Author: Vge0rge

subsys/nrf_security/configs/psa_crypto_config.h.template

@@ -24,6 +24,11 @@
 #cmakedefine MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT
 #cmakedefine MBEDTLS_PLATFORM_SNPRINTF_ALT
 
+#if defined(MBEDTLS_PLATFORM_PRINTF_ALT) && defined(__NRF_TFM__)
+int nrf_security_tfm_printf(const char *fmt, ...);
+#define MBEDTLS_PLATFORM_STD_PRINTF nrf_security_tfm_printf
+#endif
+
 /* TF-M */
 #cmakedefine MBEDTLS_PSA_CRYPTO_SPM
 

subsys/nrf_security/src/utils/nrf_security_tfm_printf.c

@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) 2026 Nordic Semiconductor ASA
+ *
+ * SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+ */
+
+/*
+ * To be used as MBEDTLS_PLATFORM_STD_PRINTF inside the TF-M secure image.
+ * Without this, taking the address of libc printf (the mbedtls default) pulls
+ * picolibc's stdio into tfm_s.
+ *
+ * When TF-M is built without secure log output (TFM_SP_LOG_RAW_ENABLED=OFF),
+ * tfm_hal_output_sp_log() is not provided and tfm_vprintf_unpriv() cannot be
+ * linked. In that case fall back to a silent no-op.
+ */
+
+#include <stdarg.h>
+
+#ifdef NRF_SECURITY_TFM_HAS_SP_LOG
+#include "tfm_vprintf_unpriv.h"
+#endif
+
+int nrf_security_tfm_printf(const char *fmt, ...)
+{
+#ifdef NRF_SECURITY_TFM_HAS_SP_LOG
+	va_list args;
+	int ret;
+
+	va_start(args, fmt);
+	ret = tfm_vprintf_unpriv(fmt, args);
+	va_end(args);
+
+	return ret;
+#else
+	(void)fmt;
+	return 0;
+#endif
+}
+
+
+
+

subsys/nrf_security/src/utils/nrf_security_utils.cmake

@@ -21,6 +21,20 @@ target_include_directories(psa_crypto_library_config
 )
 
 if(BUILD_INSIDE_TFM)
+  target_sources(nrf_security_utils
+    PRIVATE
+      ${CMAKE_CURRENT_LIST_DIR}/nrf_security_tfm_printf.c
+  )
+
+  # tfm_vprintf_unpriv() ultimately calls tfm_hal_output_sp_log(), which is
+  # only provided when TF-M is built with TFM_SP_LOG_RAW_ENABLED=ON (i.e. a
+  # secure UART is enabled). When logging is silenced, compile the wrapper
+  # as a no-op to avoid an undefined reference at link time.
+  if(TFM_SP_LOG_RAW_ENABLED)
+    set_property(SOURCE ${CMAKE_CURRENT_LIST_DIR}/nrf_security_tfm_printf.c
+      APPEND PROPERTY COMPILE_DEFINITIONS NRF_SECURITY_TFM_HAS_SP_LOG)
+  endif()
+
   # This gives access to cmsis, nrfx and mdk. Link tfm_log_unpriv to
   # resolve the tfm_log_unpriv() symbol forward-declared by the
   # Zephyr-compat <zephyr/sys/__assert.h> shim (the replacement