nrf_security: pull in Mbed TLS commits from Zephyr#27488
Merged
rlubos merged 14 commits intoApr 9, 2026
Merged
Conversation
Contributor
|
The following west manifest projects have changed revision in this Pull Request:
✅ All manifest checks OK Note: This message is automatically posted and updated by the Manifest GitHub Action. |
Contributor
CI InformationTo view the history of this post, click the 'edited' button above Inputs:Sources:sdk-nrf: PR head: 0809ecc9c2c996ca72c1f5d892210ee680cc0823 more detailssdk-nrf:
matter:
zephyr:
Github labels
List of changed files detected by CI (233)Outputs:ToolchainVersion: 911f4c5c26 Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped;
|
|
You can find the documentation preview for this PR here. Preview links for modified nRF Connect SDK documents: https://ncsbmdoc.z6.web.core.windows.net/ncs/PR-27488/nrf/releases_and_maturity/releases/release-notes-changelog.html |
tomi-font
force-pushed
the
mbedtls_4.0_integration_pull_mbedtls_updates
branch
from
dd65300 to
e49a75b
Compare
tomi-font
force-pushed
the
mbedtls_4.0_integration_pull_mbedtls_updates
branch
from
e49a75b to
c64d16b
Compare
tomi-font
force-pushed
the
mbedtls_4.0_integration_pull_mbedtls_updates
branch
from
c64d16b to
c981634
Compare
tomi-font
force-pushed
the
mbedtls_4.0_integration_pull_mbedtls_updates
branch
from
c981634 to
dc20426
Compare
Contributor
Author
|
CI is green. @nrfconnect/ncs-co-build-system please review |
nordicjm
approved these changes
Mar 16, 2026
alxelax
approved these changes
Mar 16, 2026
tomi-font
added a commit
to tomi-font/ncs
that referenced
this pull request
Apr 1, 2026
Document changes that were made in the commits preceding this one. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
Contributor
Author
|
ping |
sachinthegreen
approved these changes
Apr 7, 2026
hermabe
approved these changes
Apr 7, 2026
LuDuda
approved these changes
Apr 8, 2026
jhirsi
approved these changes
Apr 8, 2026
bama-nordic
approved these changes
Apr 8, 2026
nvlsianpu
reviewed
Apr 8, 2026
Contributor
nvlsianpu
left a comment
nvlsianpu
left a comment
There was a problem hiding this comment.
We depends from CONFIG_NRF_SECURITY in a few places in sdk-mcuboot. We don't need to change that as I read your patch. Correct?
Contributor
Author
Correct, it's only about how it's enabled. |
nvlsianpu
approved these changes
Apr 9, 2026
This is coupled with the revert of "[nrf noup] modules: mbedtls: Allow MBEDTLS_BUILTIN to be deselected" in sdk-zephyr which removes the opton altogether. This really shouldn't be needed, so clean this up. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
Stop setting CONFIG_MBEDTLS_BUILTIN manually, the automatic value for CONFIG_MBEDTLS_IMPLEMENTATION should be sensible. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
…_PSA The Kconfig choice is gone from Zephyr. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
By the Mbed TLS configurations it used to enable, namely MBEDTLS_PEM_PARSE_C and MBEDTLS_PEM_WRITE_C. Kconfig option naming fix comes from Zephyr. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
Pulls in upstream Mbed TLS-related commits and reverts some noups in sdk-zephyr. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
Renames CONFIG_OPENTHREAD_SECURITY and removes CONFIG_NRF_SECURITY_ADVANCED. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
CONFIG_CUSTOM_OPENTHREAD_SECURITY has been renamed to CONFIG_OPENTHREAD_SECURITY_CUSTOM_CONFIG in Zephyr, so it would have needed a renaming here. However CONFIG_NORDIC_SECURITY_PROMPTLESS doesn't really serve a purpose anymore (and CONFIG_NORDIC_SECURITY_BACKEND is going away soon), so just remove it. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
To CONFIG_OPENTHREAD_SECURITY_CONFIG as was done upstream. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
…TION By CONFIG_MBEDTLS_SSL_SERVER_NAME_INDICATION. Kconfig option naming fix comes from Zephyr. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
Key exchanges/ciphersuites using RSA encryption have been removed starting with Mbed TLS 4.0. Replace them with other ciphersuites. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
It has had no effect for some time. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
Instead of making it select IRONSIDE_SE_CALL, make it depend on HAS_IRONSIDE_SE_CALL. IRONSIDE_SE_CALL is already `default y` and it depends on HAS_IRONSIDE_SE_CALL. This avoids scenarios when compiling for cpuppr when PSA_CRYPTO and NRF_SECURITY are enabled where the build would fail because of this select not being possible. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
NRF_SECURITY is made promptless and auto-enabled by PSA_CRYPTO_PROVIDER_CUSTOM. It means that end users now only need to enable CONFIG_PSA_CRYPTO regardless of the underlying device/implementation (nrf_security, builtin Mbed TLS, IronSide...). CONFIG_NRF_SECURITY=y is removed from configurations where it should not be necessary, and replaced by CONFIG_PSA_CRYPTO=y in others. The `default y if DT_HAS_ZEPHYR_PSA_CRYPTO_RNG_ENABLED` is kept (and moved to PSA_CRYPTO as the roles are inverted) because without it we get too many CI failures. Eventually we should ideally be able to get rid of this `default y`. ARM is added as a requisite so that board targets like cpuppr don't end up enabling NRF_SECURITY when PSA_CRYPTO is enabled, which would result in the following build failure: `Assertion failed: GCC_M_CPU must be set to find correct lib` Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
Document relevant changes that were made in the commits preceding this one. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
Szynkaa
approved these changes
Apr 9, 2026
m-alperen-sener
approved these changes
Apr 9, 2026
PavelVPV
approved these changes
Apr 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update
sdk-zephyrwith Mbed TLS-related commits (up to but excluding the Mbed TLS 4 version update) and align to them. Get rid of some noups at the same time.test_crypto: PR-978
test_ble_mesh: PR-241