modules: tf-m: improve logic for building Crypto partition

[tomi-font]

Align TF-M builds with their secure-only counterparts, enabling the Crypto partition automatically based on CONFIG_PSA_CRYPTO.

[NordicBuilder]

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff
zephyr	nrfconnect/sdk-zephyr@0e25e66 (main)	nrfconnect/sdk-zephyr#4352	nrfconnect/sdk-zephyr#4352/files

⛔ DNM label due to: 1 project with PR revision

Note: This message is automatically posted and updated by the Manifest GitHub Action.

[NordicBuilder]

CI Information

^{To view the history of this post, click the 'edited' button above}
Build number: 2

Inputs:

Sources:

sdk-nrf: PR head: 6216e1cb20a96e8e20e25c7fe48e073c6d65045c
zephyr: PR head: ead4556f9422fcabeca3803df87c43f5fe827603

more details

sdk-nrf:

PR head: 6216e1cb20a96e8e20e25c7fe48e073c6d65045c
merge base: b083a6dc0114775587297962f111f05ec6b14e36
target head (main): 0d443a29fc2502f1e65f3a8872db34a6ec5ada62
Diff

zephyr:

PR head: ead4556f9422fcabeca3803df87c43f5fe827603
merge base: 0e25e66118d903037be2350cccc382134b7e62ad
target head (main): 0e25e66118d903037be2350cccc382134b7e62ad
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister
✅	ci-run-draft	Run CI on draft pull requests

List of changed files detected by CI (11)

modules
│  ├── trusted-firmware-m
│  │  ├── Kconfig
│  │  ├── Kconfig.tfm.defconfig
│  │  │ Kconfig.tfm_minimal.defconfig
west.yml
zephyr
│  ├── modules
│  │  ├── trusted-firmware-m
│  │  │  │ Kconfig.tfm.partitions
│  ├── subsys
│  │  ├── settings
│  │  │  │ Kconfig
│  ├── tests
│  │  ├── drivers
│  │  │  ├── entropy
│  │  │  │  ├── api
│  │  │  │  │  ├── entropy_psa_crypto.conf
│  │  │  │  │  │ testcase.yaml
│  │  ├── modules
│  │  │  ├── tf-m
│  │  │  │  ├── regression
│  │  │  │  │  │ prj.conf
│  │  ├── subsys
│  │  │  ├── random
│  │  │  │  ├── rng
│  │  │  │  │  ├── prj_hw_random_psa_crypto.conf
│  │  │  │  │  │ testcase.yaml

Outputs:

Toolchain

Version: 3d934a3d8a
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:3d934a3d8a_a140d687bb

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

• ◻️ Toolchain - Skipped: existing toolchain is used
• ❌ Build twister
  • sdk-nrf test count: 1642
  • sdk-zephyr test count: 561
• ❌ Integration tests
  • ❌ test-fw-nrfconnect-nfc
  • ❌ test-fw-nrfconnect-nrf_crypto
  • ❌ test-fw-nrfconnect-rs
  • ❌ test-fw-nrfconnect-fem
  • ❌ test-fw-nrfconnect-tfm
  • ❌ test-fw-nrfconnect-thread-main
  • ❌ test-sdk-find-my
  • ❌ test-fw-nrfconnect-nrf_lrcs_mosh
  • ❌ test-fw-nrfconnect-nrf_lrcs_positioning
  • ❌ test-sdk-mcuboot
  • ❌ test-sdk-dfu
  • ⚠️ test-fw-nrfconnect-nrf-iot_cloud
  • ⚠️ test-fw-nrfconnect-nrf_lrcs_mosh
  • ⚠️ test-fw-nrfconnect-nrf_lrcs_positioning

Disabled integration tests

• • desktop52_verification
  • test_ble_nrf_config
  • test-fw-nrfconnect-apps
  • test-fw-nrfconnect-apps_nrfdesktop
  • test-fw-nrfconnect-ble_mesh
  • test-fw-nrfconnect-ble_samples
  • test-fw-nrfconnect-nrf-iot_libmodem-nrf
  • test-fw-nrfconnect-nrf-iot_lwm2m
  • test-fw-nrfconnect-nrf-iot_samples
  • test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
  • test-fw-nrfconnect-ps-main
  • test-fw-nrfconnect-rpc
  • test-low-level
  • test-sdk-audio
  • test-sdk-wifi
  • test-sdk-wifi-net
  • test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

[github-actions]

You can find the documentation preview for this PR here.

[Copilot]

Pull request overview

This PR aims to align TF-M builds with secure-only behavior by making the TF-M Crypto partition enablement follow PSA Crypto configuration (CONFIG_PSA_CRYPTO), so Crypto is brought in automatically when needed.

Changes:

• Updates the Zephyr module revision in west.yml to pick up required upstream behavior for TF-M/Crypto partition logic.
• Adjusts TF-M Kconfig to better couple ITS encryption and minimal-profile crypto feature selections to whether PSA Crypto is enabled.
• Refactors TF-M minimal defconfig so Crypto-partition-related module options are only defined when the Crypto partition is enabled.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
west.yml	Updates Zephyr revision to a PR ref to obtain upstream TF-M-related changes.
modules/trusted-firmware-m/Kconfig.tfm.defconfig	Removes an out-of-tree override of TFM_PARTITION_CRYPTO dependency behavior.
modules/trusted-firmware-m/Kconfig.tfm_minimal.defconfig	Reorders/guards minimal-profile crypto options under TFM_PARTITION_CRYPTO and adds a dependency gate.
modules/trusted-firmware-m/Kconfig	Gates encrypted ITS on Crypto partition and makes minimal profile PSA algorithm selects conditional on PSA_CRYPTO.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.