bluetooth: mesh: Update PSA crypto configuration

Vge0rge · NordicBuilder · commit 8ce94e97de26 · 2025-10-29T14:57:51.000Z
The Kconfig options CONFIG_BT_MESH_USES_MBEDTLS_PSA and
CONFIG_BT_MESH_USES_TFM_PSA have been removed from Zephyr.
The selection of the PSA Crypto provider is now
automatically controlled by Kconfig CONFIG_PSA_CRYPTO.

This updates the bluetooth mesh subsystem and tests to follow the
approach of choosing a PSA crypto provider.

Ref: NCSDK-35983

Signed-off-by: Georgios Vasilakis &lt;georgios.vasilakis@nordicsemi.no&gt;
diff --git a/subsys/bluetooth/mesh/CMakeLists.txt b/subsys/bluetooth/mesh/CMakeLists.txt
@@ -83,6 +83,6 @@ zephyr_library_sources_ifdef(CONFIG_BT_MESH_RPL_STORAGE_MODE_EMDS rpl.c)
 
 zephyr_library_sources_ifdef(CONFIG_BT_MESH_KEY_IMPORTER key_importer.c)
 
-if(CONFIG_BT_MESH_USES_MBEDTLS_PSA AND (NOT CONFIG_SOC_FAMILY_NORDIC_NRF))
+if(CONFIG_PSA_CRYPTO_PROVIDER_MBEDTLS AND (NOT CONFIG_SOC_FAMILY_NORDIC_NRF))
   zephyr_library_link_libraries(mbedTLS)
 endif()
diff --git a/subsys/bluetooth/mesh/Kconfig b/subsys/bluetooth/mesh/Kconfig
@@ -22,7 +22,9 @@ config BT_MESH_ADV_STACK_SIZE
 
 endif # SOC_SERIES_NRF54LX
 
-if BT_MESH_USES_MBEDTLS_PSA
+if BT_MESH_CRYPTO_LIB
+
+if !BUILD_WITH_TFM
 
 config BT_MESH_MBEDTLS_BACKEND_ENABLE
 	bool
@@ -37,6 +39,7 @@ config MBEDTLS_HEAP_SIZE
 	default 2048 if BT_MESH_DFD_SRV
 	default 1152 if BT_MESH_NLC_PERF_BASELINE
 	default 1024
+endif # !BUILD_WITH_TFM
 
 if BT_SETTINGS
 
diff --git a/tests/subsys/bluetooth/mesh/light_ctrl/boards/native_sim.conf b/tests/subsys/bluetooth/mesh/light_ctrl/boards/native_sim.conf
@@ -2,4 +2,4 @@
 # Enforcing usage of built-in Mbed TLS for native simulator.
 CONFIG_MBEDTLS=y
 CONFIG_MBEDTLS_BUILTIN=y
-CONFIG_BT_MESH_USES_MBEDTLS_PSA=y
+CONFIG_PSA_CRYPTO_PROVIDER_MBEDTLS=y
diff --git a/tests/subsys/bluetooth/mesh/light_hue/CMakeLists.txt b/tests/subsys/bluetooth/mesh/light_hue/CMakeLists.txt
@@ -28,7 +28,7 @@ target_compile_options(app
   -DCONFIG_BT_MESH_MOD_ACKD_TIMEOUT_BASE=3000
   -DCONFIG_BT_MESH_MOD_ACKD_TIMEOUT_PER_HOP=50
   -DCONFIG_BT_LOG_LEVEL=0
-  -DCONFIG_BT_MESH_USES_MBEDTLS_PSA=1
+  -DCONFIG_PSA_CRYPTO_PROVIDER_MBEDTLS=1
 )
 
 zephyr_ld_options(
diff --git a/tests/subsys/bluetooth/mesh/light_hue/boards/native_sim.conf b/tests/subsys/bluetooth/mesh/light_hue/boards/native_sim.conf
@@ -2,4 +2,4 @@
 # Enforcing usage of built-in Mbed TLS for native simulator.
 CONFIG_MBEDTLS=y
 CONFIG_MBEDTLS_BUILTIN=y
-CONFIG_BT_MESH_USES_MBEDTLS_PSA=y
+CONFIG_PSA_CRYPTO_PROVIDER_MBEDTLS=y
diff --git a/tests/subsys/bluetooth/mesh/scheduler_model/action_planning/CMakeLists.txt b/tests/subsys/bluetooth/mesh/scheduler_model/action_planning/CMakeLists.txt
@@ -33,7 +33,7 @@ target_compile_options(app
   -DCONFIG_BT_MESH_MODEL_LOG_LEVEL=0
   -DCONFIG_BT_MESH_MOD_ACKD_TIMEOUT_BASE=0
   -DCONFIG_BT_MESH_MOD_ACKD_TIMEOUT_PER_HOP=0
-  -DCONFIG_BT_MESH_USES_MBEDTLS_PSA=1
+  -DCONFIG_PSA_CRYPTO_PROVIDER_MBEDTLS=1
   )
 
 zephyr_ld_options(
diff --git a/tests/subsys/bluetooth/mesh/scheduler_model/action_planning/boards/native_sim.conf b/tests/subsys/bluetooth/mesh/scheduler_model/action_planning/boards/native_sim.conf
@@ -2,4 +2,4 @@
 # Enforcing usage of built-in Mbed TLS for native simulator.
 CONFIG_MBEDTLS=y
 CONFIG_MBEDTLS_BUILTIN=y
-CONFIG_BT_MESH_USES_MBEDTLS_PSA=y
+CONFIG_PSA_CRYPTO_PROVIDER_MBEDTLS=y
diff --git a/tests/subsys/bluetooth/mesh/scheduler_model/message_validity/boards/native_sim.conf b/tests/subsys/bluetooth/mesh/scheduler_model/message_validity/boards/native_sim.conf
@@ -2,4 +2,4 @@
 # Enforcing usage of built-in Mbed TLS for native simulator.
 CONFIG_MBEDTLS=y
 CONFIG_MBEDTLS_BUILTIN=y
-CONFIG_BT_MESH_USES_MBEDTLS_PSA=y
+CONFIG_PSA_CRYPTO_PROVIDER_MBEDTLS=y
diff --git a/tests/subsys/bluetooth/mesh/scheduler_model/timing/CMakeLists.txt b/tests/subsys/bluetooth/mesh/scheduler_model/timing/CMakeLists.txt
@@ -29,7 +29,7 @@ target_compile_options(app
   -DCONFIG_BT_MESH_MODEL_GROUP_COUNT=5
   -DCONFIG_BT_LOG_LEVEL=0
   -DCONFIG_BT_MESH_SCHEDULER_SRV=1
-  -DCONFIG_BT_MESH_USES_MBEDTLS_PSA=1
+  -DCONFIG_PSA_CRYPTO_PROVIDER_MBEDTLS=1
   )
 
 zephyr_ld_options(
diff --git a/tests/subsys/bluetooth/mesh/scheduler_model/timing/boards/native_sim.conf b/tests/subsys/bluetooth/mesh/scheduler_model/timing/boards/native_sim.conf
@@ -2,4 +2,4 @@
 # Enforcing usage of built-in Mbed TLS for native simulator.
 CONFIG_MBEDTLS=y
 CONFIG_MBEDTLS_BUILTIN=y
-CONFIG_BT_MESH_USES_MBEDTLS_PSA=y
+CONFIG_PSA_CRYPTO_PROVIDER_MBEDTLS=y
diff --git a/tests/subsys/bluetooth/mesh/sensor_subsys/CMakeLists.txt b/tests/subsys/bluetooth/mesh/sensor_subsys/CMakeLists.txt
@@ -28,7 +28,7 @@ target_compile_options(app
   -DCONFIG_BT_MESH_SENSOR_CHANNELS_MAX=5
   -DCONFIG_BT_MESH_SENSOR_CHANNEL_ENCODED_SIZE_MAX=4
   -DCONFIG_BT_LOG_LEVEL=0
-  -DCONFIG_BT_MESH_USES_MBEDTLS_PSA=1
+  -DCONFIG_PSA_CRYPTO_PROVIDER_MBEDTLS=1
   )
 
 zephyr_linker_sources(SECTIONS sensor_types.ld)
diff --git a/tests/subsys/bluetooth/mesh/sensor_subsys/boards/native_sim.conf b/tests/subsys/bluetooth/mesh/sensor_subsys/boards/native_sim.conf
@@ -2,4 +2,4 @@
 # Enforcing usage of built-in Mbed TLS for native simulator.
 CONFIG_MBEDTLS=y
 CONFIG_MBEDTLS_BUILTIN=y
-CONFIG_BT_MESH_USES_MBEDTLS_PSA=y
+CONFIG_PSA_CRYPTO_PROVIDER_MBEDTLS=y
diff --git a/tests/subsys/bluetooth/mesh/silvair_enocean_model/CMakeLists.txt b/tests/subsys/bluetooth/mesh/silvair_enocean_model/CMakeLists.txt
@@ -30,7 +30,7 @@ target_compile_options(app
     -DCONFIG_BT_MESH_SILVAIR_ENOCEAN_AUTO_COMMISSION=1
     -DCONFIG_BT_MESH_MODEL_KEY_COUNT=1
     -DCONFIG_BT_MESH_MODEL_GROUP_COUNT=1
-    -DCONFIG_BT_MESH_USES_MBEDTLS_PSA=1
+    -DCONFIG_PSA_CRYPTO_PROVIDER_MBEDTLS=1
     )
 
 zephyr_ld_options(
diff --git a/tests/subsys/bluetooth/mesh/silvair_enocean_model/boards/native_sim.conf b/tests/subsys/bluetooth/mesh/silvair_enocean_model/boards/native_sim.conf
@@ -2,4 +2,4 @@
 # Enforcing usage of built-in Mbed TLS for native simulator.
 CONFIG_MBEDTLS=y
 CONFIG_MBEDTLS_BUILTIN=y
-CONFIG_BT_MESH_USES_MBEDTLS_PSA=y
+CONFIG_PSA_CRYPTO_PROVIDER_MBEDTLS=y
diff --git a/tests/subsys/bluetooth/mesh/time_model/CMakeLists.txt b/tests/subsys/bluetooth/mesh/time_model/CMakeLists.txt
@@ -31,7 +31,7 @@ target_compile_options(app
   -DCONFIG_BT_MESH_TIME_SRV=1
   -DCONFIG_BT_MESH_TIME_SRV_CLOCK_ACCURACY=500
   -DCONFIG_BT_MESH_TIME_MESH_HOP_UNCERTAINTY=30
-  -DCONFIG_BT_MESH_USES_MBEDTLS_PSA=1
+  -DCONFIG_PSA_CRYPTO_PROVIDER_MBEDTLS=1
   )
 
 zephyr_ld_options(
diff --git a/tests/subsys/bluetooth/mesh/time_model/boards/native_sim.conf b/tests/subsys/bluetooth/mesh/time_model/boards/native_sim.conf
@@ -2,4 +2,4 @@
 # Enforcing usage of built-in Mbed TLS for native simulator.
 CONFIG_MBEDTLS=y
 CONFIG_MBEDTLS_BUILTIN=y
-CONFIG_BT_MESH_USES_MBEDTLS_PSA=y
+CONFIG_PSA_CRYPTO_PROVIDER_MBEDTLS=y

Original file line number	Diff line number	Diff line change
`@@ -28,7 +28,7 @@ target_compile_options(app`
`28`	`28`	`-DCONFIG_BT_MESH_MOD_ACKD_TIMEOUT_BASE=3000`
`29`	`29`	`-DCONFIG_BT_MESH_MOD_ACKD_TIMEOUT_PER_HOP=50`
`30`	`30`	`-DCONFIG_BT_LOG_LEVEL=0`
`31`		`- -DCONFIG_BT_MESH_USES_MBEDTLS_PSA=1`
	`31`	`+ -DCONFIG_PSA_CRYPTO_PROVIDER_MBEDTLS=1`
`32`	`32`	`)`
`33`	`33`
`34`	`34`	`zephyr_ld_options(`
Original file line number	Diff line number	Diff line change
`@@ -33,7 +33,7 @@ target_compile_options(app`
`33`	`33`	`-DCONFIG_BT_MESH_MODEL_LOG_LEVEL=0`
`34`	`34`	`-DCONFIG_BT_MESH_MOD_ACKD_TIMEOUT_BASE=0`
`35`	`35`	`-DCONFIG_BT_MESH_MOD_ACKD_TIMEOUT_PER_HOP=0`
`36`		`- -DCONFIG_BT_MESH_USES_MBEDTLS_PSA=1`
	`36`	`+ -DCONFIG_PSA_CRYPTO_PROVIDER_MBEDTLS=1`
`37`	`37`	`)`
`38`	`38`
`39`	`39`	`zephyr_ld_options(`
Original file line number	Diff line number	Diff line change
`@@ -29,7 +29,7 @@ target_compile_options(app`
`29`	`29`	`-DCONFIG_BT_MESH_MODEL_GROUP_COUNT=5`
`30`	`30`	`-DCONFIG_BT_LOG_LEVEL=0`
`31`	`31`	`-DCONFIG_BT_MESH_SCHEDULER_SRV=1`
`32`		`- -DCONFIG_BT_MESH_USES_MBEDTLS_PSA=1`
	`32`	`+ -DCONFIG_PSA_CRYPTO_PROVIDER_MBEDTLS=1`
`33`	`33`	`)`
`34`	`34`
`35`	`35`	`zephyr_ld_options(`