Skip to content

modules: tf-m: improve logic for building Crypto partition #30592

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
tomi-font wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

modules: tf-m: improve logic for building Crypto partition #30592

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4f711dd
modules: tf-m: fix building without Crypto partition
tomi-font Aug 7, 2026
e45ae06
modules: tf-m: build Crypto partition only when CONFIG_PSA_CRYPTO=y
tomi-font Aug 7, 2026
790832d
tests: tf-m: explicitly enable CONFIG_PSA_CRYPTO
tomi-font Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions modules/trusted-firmware-m/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -235,6 +235,7 @@ config TFM_ITS_ENCRYPTED
bool
prompt "PSA Internal Trusted Storage with encryption"
default y if SOC_SERIES_NRF54L || SOC_SERIES_NRF71
depends on TFM_PARTITION_CRYPTO
select PSA_WANT_KEY_TYPE_CHACHA20 if SOC_SERIES_NRF54L || SOC_SERIES_NRF71
select PSA_WANT_ALG_CHACHA20_POLY1305 if SOC_SERIES_NRF54L || SOC_SERIES_NRF71
select PSA_WANT_GENERATE_RANDOM
Expand Down Expand Up @@ -326,8 +327,8 @@ choice TFM_PROFILE_TYPE

config TFM_PROFILE_TYPE_MINIMAL
bool "TF-M build profile: minimal"
select PSA_WANT_GENERATE_RANDOM
select PSA_WANT_ALG_HMAC_DRBG
select PSA_WANT_GENERATE_RANDOM if PSA_CRYPTO
select PSA_WANT_ALG_HMAC_DRBG if PSA_CRYPTO
help
Minimal TF-M build profile. This will make the TF-M image fit within 32kB.
No configuration of the size of the partition nor the features of the
Expand Down
5 changes: 0 additions & 5 deletions modules/trusted-firmware-m/Kconfig.tfm.defconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,11 +82,6 @@ config TFM_PARTITION_PROTECTED_STORAGE
select PSA_WANT_ALG_GCM if SOC_NRF5340_CPUAPP
select PSA_WANT_ALG_GCM if SOC_SERIES_NRF54L || SOC_SERIES_NRF71

# Override TF-M crypto dependency on ITS when using KMU
config TFM_PARTITION_CRYPTO
bool
depends on TFM_PARTITION_INTERNAL_TRUSTED_STORAGE || CRACEN_KMU

configdefault TFM_INSTALL_TF_PSA_CRYPTO_HEADERS
default n

Expand Down
11 changes: 8 additions & 3 deletions modules/trusted-firmware-m/Kconfig.tfm_minimal.defconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,13 @@ config TFM_MCUBOOT_IMAGE_NUMBER
int
default 1

config TFM_PARTITION_CRYPTO
bool
depends on PSA_CRYPTO_PROVIDER_TFM
default y

if TFM_PARTITION_CRYPTO

config TFM_CRYPTO_RNG_MODULE_ENABLED
bool
default y
Expand All @@ -17,9 +24,7 @@ config TFM_CRYPTO_HASH_MODULE_ENABLED
depends on PSA_HAS_HASH_SUPPORT
default y

config TFM_PARTITION_CRYPTO
bool
default y
endif # TFM_PARTITION_CRYPTO

config TFM_PARTITION_PLATFORM
bool
Expand Down
2 changes: 2 additions & 0 deletions tests/tfm/tfm_psa_test/prj.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@ CONFIG_TFM_ISOLATION_LEVEL=2

CONFIG_IDENTITY_KEY_TFM=y

CONFIG_PSA_CRYPTO=y

# RNG
CONFIG_PSA_WANT_GENERATE_RANDOM=y

Expand Down
2 changes: 1 addition & 1 deletion tests/zephyr/modules/tf-m/regression/prj.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ CONFIG_PSA_WANT_RSA_KEY_SIZE_3072=y
CONFIG_PSA_WANT_ALG_SP800_108_COUNTER_CMAC=y

# Regression tests are included if a related secure partition is enabled.
CONFIG_PSA_CRYPTO=y
CONFIG_TFM_PARTITION_PROTECTED_STORAGE=y
CONFIG_TFM_PARTITION_INTERNAL_TRUSTED_STORAGE=y
CONFIG_TFM_PARTITION_CRYPTO=y
CONFIG_TFM_PARTITION_PLATFORM=y
2 changes: 1 addition & 1 deletion west.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ manifest:
# https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/zephyr/guides/modules.html
- name: zephyr
repo-path: sdk-zephyr
revision: 0e25e66118d903037be2350cccc382134b7e62ad
revision: pull/4352/head
import:
Comment thread
tomi-font marked this conversation as resolved.
# In addition to the zephyr repository itself, NCS also
# imports the contents of zephyr/west.yml at the above
Expand Down
Loading