manifest: sdk-zephyr: [Backport ncs-v3.4-branch] Updates for TF-M 2.3#29206
Open
NordicBuilder wants to merge 21 commits into
Open
manifest: sdk-zephyr: [Backport ncs-v3.4-branch] Updates for TF-M 2.3#29206NordicBuilder wants to merge 21 commits into
NordicBuilder wants to merge 21 commits into
Conversation
Contributor
Author
|
The following west manifest projects have changed revision in this Pull Request:
Additional metadata changed:
⛔ DNM label due to: 1 added project, 2 projects with PR revision and 2 projects with metadata changes Note: This message is automatically posted and updated by the Manifest GitHub Action. |
Contributor
Author
CI InformationTo view the history of this post, click the 'edited' button above Inputs:Sources:more detailsGithub labels
List of changed files detected by CI (0)Outputs:ToolchainVersion: Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped;
|
|
You can find the documentation preview for this PR here. |
Vge0rge
force-pushed
the
auto-manifest-sdk-zephyr-4155
branch
from
fc76386 to
60236fd
Compare
|
Since quarantine was modified, please make sure you are following the process described in Quarantine Process. |
rlubos
reviewed
Jun 3, 2026
Contributor
rlubos
left a comment
rlubos
left a comment
There was a problem hiding this comment.
oberon-psa-crypto and trusted-firmware-m both have release branches, the manifest should point to those, no?
Vge0rge
force-pushed
the
auto-manifest-sdk-zephyr-4155
branch
from
60236fd to
fcb80f6
Compare
To version 2.3. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
These were renamed in the TF-M version 2.3, updated accordingly. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> (cherry picked from commit 46d638d)
TF-M 2.3 changed the signature of this function which now takes a parameter instead of void. Adapt to this in our implementation. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> (cherry picked from commit b42bb99)
file(COPY) runs at configure time and resolves a relative
destination against CMAKE_CURRENT_BINARY_DIR, so the headers
landed in the directory:
./build/SAMPLE_NAME/tfm/platform/target/tfm_board/interface/include/
which is not part of the include for the NS app.
Change that to use the install commmand with
${INSTALL_INTERFACE_INC_DIR}.
Install runs at install time and resolves a relative destination against
CMAKE_INSTALL_PREFIX, which is in the includes of the NS app.
The headers are now placed in the directory:
./build/SAMPLE_NAME/tfm/api_ns/interface/include/
Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
(cherry picked from commit 14c6acf)
TF-M 2.3 renamed the mbedcrypto target to tfpsacrypto (and the prefix from MBEDTLS_TARGET_PREFIX to TF_PSA_CRYPTO_TARGET_PREFIX). Update the target in nrf_security accordingly. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> (cherry picked from commit ed8563f)
Add psa_driver_api directory in the include path because it is needed for the tfm_builtin_key_loader.h. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> (cherry picked from commit 6c2560f)
TF-M 2.3 introduced a new logging system where it replaced tfm_sp_log.h / tfm_spm_log.h / SPMLOG_* with two new headers: tfm_log.h: for privileged code which provides macros: ERROR/INFO/VERBOSE/etc tfm_log_unpriv.h: for uprivileged code with the same macros suffixed _UNPRIV Adapt to the new logging system. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> (cherry picked from commit 21f8457)
NordicBuilder
force-pushed
the
auto-manifest-sdk-zephyr-4155
branch
from
fcb80f6 to
652064a
Compare
Contributor
For the Oberon-psa-crypto you are right, I will create a PR there. For the TF-M you need to force push the hash that I have here to the branch I think. |
Contributor
Ok, I'll push to tfm repo. Should be ok as current SHA is tagged already (with RC1). |
Fixes a minor missing macro addition: PSA_ALG_IS_SP800_108_COUNTER_CMAC. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
In the TF-M build the stdlib functions such as abs are not available. Create a cracen local abs function which either uses the builtin implementation or a local implementation. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> (cherry picked from commit 842debc)
Link the secure partition with the psa_crypto_config which provides the defines and include folders for the TF-PSA-Crypto. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> (cherry picked from commit f7bb7f7)
The header does not exist anymore with TF-M v2.3. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> (cherry picked from commit 753a004)
TF-M has an option to select if STD functions like printf are available with CONFIG_TFM_INCLUDE_STDLIBC. This option is disabled for nFR devices and it is not tested. MbedlTLS also has a relevant option as well: MBEDTLS_PLATFORM_NO_STD_FUNCTIONS This sets the MBEDTLS_PLATFORM_NO_STD_FUNCTIONS option inside TF-M to align with the TF-M configuration. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> (cherry picked from commit 9acf12b)
To its own folder so that include statements can use <> instead of "". Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> (cherry picked from commit 5a65f0b)
Add manually the option to enable the CMAC key derivation since there is a new test which uses it. (1057) The Kconfig option does not seem to be in upstream Zephyr so it is added here. When the option is added in Zephyr it can be removed. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> (cherry picked from commit 88a0155)
This is a fork of the QCBOR repository with the patches that TF-M applies to the repository. It is needed because currently TF-M clones this repo and applies the patches in every build and this should not be done in sdk-nrf. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> (cherry picked from commit cc7a798)
This is a fork of the t_cose repository with the patches that TF-M applies to the repository. It is needed because currently TF-M clones this repo and applies the patches in every build and this should not be done in sdk-nrf. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> (cherry picked from commit 8a5ad4d)
Since TF-M v2.3 clones and patches the t_cose and qcbor libraries at build time we had to create forks with the patches applied. This adds the path to our forks to the TF-M build. Remove the old qcbor Kconfig and reference. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> (cherry picked from commit 372b97e)
In sdk-nrf TF-PSA-Crypto header files are exposed from Oberon PSA. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> (cherry picked from commit ba4da4c)
This essentially reverts: c5d5400. which cannot be reverted cleanly anymore. With the TF-M v2.3 these tests should work. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
For TF-M 2.3. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> (cherry picked from commit 0acec5f)
Automatically created by action-manifest-pr GH action from PR: nrfconnect/sdk-zephyr#4155 Signed-off-by: Nordic Builder <pylon@nordicsemi.no>
Vge0rge
force-pushed
the
auto-manifest-sdk-zephyr-4155
branch
from
652064a to
fa32b9a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automatically created by action-manifest-pr GH action from PR:
nrfconnect/sdk-zephyr#4155
test_tfm: PR-231