fast_pair: Fix bt_fast_pair partition for TF-M + change TF-M profile in fast_pair samples

doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst

@@ -310,10 +310,18 @@ Bluetooth Fast Pair samples
 ---------------------------
 
 * Added support for the ``nrf54l15dk/nrf54l05/cpuapp`` and ``nrf54l15dk/nrf54l10/cpuapp`` board targets in all Fast Pair samples.
+* Updated the non-secure target (``nrf5340dk/nrf5340/cpuapp/ns`` and ``thingy53/nrf5340/cpuapp/ns``) configurations of the following samples to use configurable TF-M profile instead of the predefined minimal TF-M profile:
+
+  * :ref:`fast_pair_locator_tag`
+  * :ref:`fast_pair_input_device`
+
+  This change results from the Bluetooth subsystem transition to the PSA cryptographic standard.
+  The Bluetooth stack can now use the PSA crypto API in the non-secure domain as all necessary TF-M partitions are configured properly.
 
 * :ref:`fast_pair_locator_tag` sample:
 
   * Added support for the :ref:`zephyr:nrf54h20dk_nrf54h20` board target.
+  * Updated the partition layout for the ``nrf5340dk/nrf5340/cpuapp/ns`` and ``thingy53/nrf5340/cpuapp/ns`` board targets to accommodate the partitions needed due to change in the TF-M profile configuration.
 
 Bluetooth Mesh samples
 ----------------------
@@ -569,6 +577,10 @@ Binary libraries
 Bluetooth libraries and services
 --------------------------------
 
+* :ref:`bt_fast_pair_readme` library:
+
+  * Updated the automatically generated ``bt_fast_pair`` partition definition (located in the :file:`subsys/partition_manager/pm.yml.bt_fast_pair`) to work correctly when building with TF-M.
+
 * :ref:`bt_mesh` library:
 
   * Fixed an issue in the :ref:`bt_mesh_light_ctrl_srv_readme` model to automatically resume the Lightness Controller after recalling a scene (``NCSDK-30033`` known issue).

samples/bluetooth/fast_pair/input_device/boards/nrf5340dk_nrf5340_cpuapp_ns.conf

@@ -0,0 +1,16 @@
+#
+# Copyright (c) 2025 Nordic Semiconductor ASA
+#
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+#
+
+# TF-M profile has to be properly configured to be able to run
+# the Bluetooth stack which uses PSA crypto API.
+# The following configuration is a minimal set of options required.
+CONFIG_TFM_PROFILE_TYPE_NOT_SET=y
+
+CONFIG_TFM_PARTITION_PLATFORM=y
+CONFIG_TFM_PARTITION_CRYPTO=y
+CONFIG_TFM_PARTITION_INTERNAL_TRUSTED_STORAGE=y
+CONFIG_TFM_PARTITION_PROTECTED_STORAGE=n
+CONFIG_TFM_PARTITION_INITIAL_ATTESTATION=n

samples/bluetooth/fast_pair/locator_tag/configuration/boards/nrf5340dk_nrf5340_cpuapp_ns.conf

@@ -0,0 +1,16 @@
+#
+# Copyright (c) 2025 Nordic Semiconductor ASA
+#
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+#
+
+# TF-M profile has to be properly configured to be able to run
+# the Bluetooth stack which uses PSA crypto API.
+# The following configuration is a minimal set of options required.
+CONFIG_TFM_PROFILE_TYPE_NOT_SET=y
+
+CONFIG_TFM_PARTITION_PLATFORM=y
+CONFIG_TFM_PARTITION_CRYPTO=y
+CONFIG_TFM_PARTITION_INTERNAL_TRUSTED_STORAGE=y
+CONFIG_TFM_PARTITION_PROTECTED_STORAGE=n
+CONFIG_TFM_PARTITION_INITIAL_ATTESTATION=n

samples/bluetooth/fast_pair/locator_tag/configuration/boards/nrf5340dk_nrf5340_cpuapp_ns_release.conf

@@ -4,5 +4,16 @@
 # SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
 #
 
+# TF-M profile has to be properly configured to be able to run
+# the Bluetooth stack which uses PSA crypto API.
+# The following configuration is a minimal set of options required.
+CONFIG_TFM_PROFILE_TYPE_NOT_SET=y
+
+CONFIG_TFM_PARTITION_PLATFORM=y
+CONFIG_TFM_PARTITION_CRYPTO=y
+CONFIG_TFM_PARTITION_INTERNAL_TRUSTED_STORAGE=y
+CONFIG_TFM_PARTITION_PROTECTED_STORAGE=n
+CONFIG_TFM_PARTITION_INITIAL_ATTESTATION=n
+
 # Disable TF-M logging
 CONFIG_TFM_LOG_LEVEL_SILENCE=y

samples/bluetooth/fast_pair/locator_tag/configuration/boards/thingy53_nrf5340_cpuapp_ns.conf

@@ -34,3 +34,14 @@ CONFIG_DULT_BATTERY_TYPE_RECHARGEABLE=y
 #   * thingy53/nrf5340/cpuapp(/ns)
 CONFIG_BT_ADV_PROV_TX_POWER_CORRECTION_VAL=-12
 CONFIG_BT_FAST_PAIR_FMDN_TX_POWER_CORRECTION_VAL=-12
+
+# TF-M profile has to be properly configured to be able to run
+# the Bluetooth stack which uses PSA crypto API.
+# The following configuration is a minimal set of options required.
+CONFIG_TFM_PROFILE_TYPE_NOT_SET=y
+
+CONFIG_TFM_PARTITION_PLATFORM=y
+CONFIG_TFM_PARTITION_CRYPTO=y
+CONFIG_TFM_PARTITION_INTERNAL_TRUSTED_STORAGE=y
+CONFIG_TFM_PARTITION_PROTECTED_STORAGE=n
+CONFIG_TFM_PARTITION_INITIAL_ATTESTATION=n

samples/bluetooth/fast_pair/locator_tag/configuration/boards/thingy53_nrf5340_cpuapp_ns_release.conf

@@ -29,3 +29,14 @@ CONFIG_DULT_BATTERY_TYPE_RECHARGEABLE=y
 #   * thingy53/nrf5340/cpuapp(/ns)
 CONFIG_BT_ADV_PROV_TX_POWER_CORRECTION_VAL=-12
 CONFIG_BT_FAST_PAIR_FMDN_TX_POWER_CORRECTION_VAL=-12
+
+# TF-M profile has to be properly configured to be able to run
+# the Bluetooth stack which uses PSA crypto API.
+# The following configuration is a minimal set of options required.
+CONFIG_TFM_PROFILE_TYPE_NOT_SET=y
+
+CONFIG_TFM_PARTITION_PLATFORM=y
+CONFIG_TFM_PARTITION_CRYPTO=y
+CONFIG_TFM_PARTITION_INTERNAL_TRUSTED_STORAGE=y
+CONFIG_TFM_PARTITION_PROTECTED_STORAGE=n
+CONFIG_TFM_PARTITION_INITIAL_ATTESTATION=n

samples/bluetooth/fast_pair/locator_tag/configuration/pm_static_nrf5340dk_nrf5340_cpuapp_ns.yml

@@ -10,7 +10,7 @@ mcuboot_primary:
   - tfm
   - app
   region: flash_primary
-  size: 0xef000
+  size: 0xe8000
   span: *id001
 mcuboot_pad:
   address: 0xc000
@@ -19,38 +19,46 @@ mcuboot_pad:
 tfm:
   address: 0xc200
   region: flash_primary
-  size: 0xbe00
+  size: 0x17e00
 tfm_secure:
   address: 0xc000
-  size: 0xc000
+  size: 0x18000
   span: [mcuboot_pad, tfm]
 tfm_nonsecure:
-  address: 0x18000
-  size: 0xe3000
+  address: 0x24000
+  size: 0xd0000
   span: [app]
 app:
-  address: 0x18000
+  address: 0x24000
   region: flash_primary
-  size: 0xe3000
+  size: 0xd0000
 mcuboot_primary_app:
   address: 0xc200
   orig_span: &id002
   - tfm
   - app
   region: flash_primary
-  size: 0xeee00
+  size: 0xe7e00
   span: *id002
 
+nonsecure_storage:
+  address: 0xf4000
+  size: 0x8000
+  span: [bt_fast_pair, settings_storage]
 bt_fast_pair:
-  address: 0xfb000
+  address: 0xf4000
   region: flash_primary
   size: 0x1000
+settings_storage:
+  address: 0xf5000
+  region: flash_primary
+  size: 0x7000
 
-nonsecure_storage:
+tfm_storage:
   address: 0xfc000
   size: 0x4000
-  span: [settings_storage]
-settings_storage:
+  span: [tfm_its]
+tfm_its:
   address: 0xfc000
   region: flash_primary
   size: 0x4000

samples/bluetooth/fast_pair/locator_tag/configuration/pm_static_thingy53_nrf5340_cpuapp_ns.yml

@@ -10,7 +10,7 @@ mcuboot_primary:
   - tfm
   - app
   region: flash_primary
-  size: 0xef000
+  size: 0xe8000
   span: *id001
 mcuboot_pad:
   address: 0xc000
@@ -19,38 +19,46 @@ mcuboot_pad:
 tfm:
   address: 0xc200
   region: flash_primary
-  size: 0xbe00
+  size: 0x17e00
 tfm_secure:
   address: 0xc000
-  size: 0xc000
+  size: 0x18000
   span: [mcuboot_pad, tfm]
 tfm_nonsecure:
-  address: 0x18000
-  size: 0xe3000
+  address: 0x24000
+  size: 0xd0000
   span: [app]
 app:
-  address: 0x18000
+  address: 0x24000
   region: flash_primary
-  size: 0xe3000
+  size: 0xd0000
 mcuboot_primary_app:
   address: 0xc200
   orig_span: &id002
   - tfm
   - app
   region: flash_primary
-  size: 0xeee00
+  size: 0xe7e00
   span: *id002
 
+nonsecure_storage:
+  address: 0xf4000
+  size: 0x8000
+  span: [bt_fast_pair, settings_storage]
 bt_fast_pair:
-  address: 0xfb000
+  address: 0xf4000
   region: flash_primary
   size: 0x1000
+settings_storage:
+  address: 0xf5000
+  region: flash_primary
+  size: 0x7000
 
-nonsecure_storage:
+tfm_storage:
   address: 0xfc000
   size: 0x4000
-  span: [settings_storage]
-settings_storage:
+  span: [tfm_its]
+tfm_its:
   address: 0xfc000
   region: flash_primary
   size: 0x4000

subsys/partition_manager/pm.yml.bt_fast_pair

@@ -1,5 +1,12 @@
+#include <zephyr/autoconf.h>
+
 bt_fast_pair:
   placement:
-    before: end
+    before: [tfm_storage, end]
+#ifdef CONFIG_BUILD_WITH_TFM
+    align: {start: CONFIG_NRF_TRUSTZONE_FLASH_REGION_SIZE}
+#else
     align: {start: 0x04}
+#endif
+  inside: [nonsecure_storage]
   size: 0x48