settings: its: enable tf-m PSA headers and run more tests

samples/subsys/settings/prj.conf

@@ -1,9 +1,4 @@
 CONFIG_STDOUT_CONSOLE=y
-CONFIG_FLASH=y
-CONFIG_FLASH_MAP=y
 CONFIG_SETTINGS=y
 CONFIG_SETTINGS_RUNTIME=y
-CONFIG_NVS=y
-CONFIG_SETTINGS_NVS=y
 CONFIG_HEAP_MEM_POOL_SIZE=256
-CONFIG_MPU_ALLOW_FLASH_WRITE=y

samples/subsys/settings/sample.yaml

@@ -1,10 +1,40 @@
 sample:
   name: Settings Sample
 
+common:
+  tags: settings
+  timeout: 20
+  harness: console
+  harness_config:
+    type: multi_line
+    regex:
+      - "subtree <alpha> handler registered: OK"
+      - "# iteration 0"
+      - "[.]*<alpha/length> value exist in the storage"
+      - "[.]*Can\\'t to load the <alpha/length> value as expected"
+      - "<gamma> = 0 \\(default\\)"
+      - "# iteration 1"
+      - "<alpha/length/2> = 59"
+      - "# iteration 2"
+      - "<alpha/length/1> = 42"
+      - "# iteration 3"
+      - "<alpha/beta/voltage> = -3100"
+      - "# iteration 4"
+      - "<alpha/beta/source> = abcd"
+      - "# iteration 5"
+      - "<alpha/angle/1> = 5"
+      - "<alpha/beta/source> is not compatible with the application"
+      - "direct.length = 100"
+      - "direct.length_1 = 46"
+      - "direct.length_2 = 54"
+      - "<gamma> = 5"
+      - "The settings destination off the key <alpha/beta/source> has got value:\
+        \ \"RT\""
+      - "String value \"rtos\" was retrieved from the settings destination off the\
+        \ key <alpha/beta/source>"
+
 tests:
-  sample.subsys.settings:
-    tags: settings
-    timeout: 20
+  sample.subsys.settings.nvs:
     filter: dt_label_with_parent_compat_enabled("storage_partition", "fixed-partitions")
     platform_exclude:
       - nucleo_h723zg
@@ -19,31 +49,18 @@ tests:
       - qemu_cortex_m0/nrf51822
     integration_platforms:
       - native_sim
-    harness: console
-    harness_config:
-      type: multi_line
-      regex:
-        - "subtree <alpha> handler registered: OK"
-        - "# iteration 0"
-        - "[.]*<alpha/length> value exist in the storage"
-        - "[.]*Can\\'t to load the <alpha/length> value as expected"
-        - "<gamma> = 0 \\(default\\)"
-        - "# iteration 1"
-        - "<alpha/length/2> = 59"
-        - "# iteration 2"
-        - "<alpha/length/1> = 42"
-        - "# iteration 3"
-        - "<alpha/beta/voltage> = -3100"
-        - "# iteration 4"
-        - "<alpha/beta/source> = abcd"
-        - "# iteration 5"
-        - "<alpha/angle/1> = 5"
-        - "<alpha/beta/source> is not compatible with the application"
-        - "direct.length = 100"
-        - "direct.length_1 = 46"
-        - "direct.length_2 = 54"
-        - "<gamma> = 5"
-        - "The settings destination off the key <alpha/beta/source> has got value:\
-        \ \"RT\""
-        - "String value \"rtos\" was retrieved from the settings destination off the\
-        \ key <alpha/beta/source>"
+    extra_args:
+      - CONFIG_FLASH=y
+      - CONFIG_FLASH_MAP=y
+      - CONFIG_NVS=y
+      - CONFIG_SETTINGS_NVS=y
+      - CONFIG_MPU_ALLOW_FLASH_WRITE=y
+
+  sample.subsys.settings.tfm-its:
+    tags:
+      - trusted-firmware-m
+    filter: CONFIG_TFM_PARTITION_INTERNAL_TRUSTED_STORAGE
+    integration_platforms:
+      - mps2/an521/cpu0/ns
+    extra_args:
+      - CONFIG_SETTINGS_TFM_ITS=y

subsys/settings/src/CMakeLists.txt

@@ -15,4 +15,5 @@ zephyr_sources_ifdef(CONFIG_SETTINGS_NONE settings_none.c)
 zephyr_sources_ifdef(CONFIG_SETTINGS_SHELL settings_shell.c)
 zephyr_sources_ifdef(CONFIG_SETTINGS_ZMS settings_zms.c)
 zephyr_sources_ifdef(CONFIG_SETTINGS_TFM_ITS settings_its.c)
+zephyr_library_link_libraries_ifdef(CONFIG_SETTINGS_TFM_ITS tfm_api)
 zephyr_sources_ifdef(CONFIG_SETTINGS_RETENTION settings_retention.c)

subsys/settings/src/settings_its.c

@@ -12,17 +12,16 @@
 #include <zephyr/logging/log.h>
 #include <zephyr/psa/its_ids.h>
 
+/* TF-M config file containing ITS_MAX_ASSET_SIZE */
+#include <config_base.h>
+
+#include "settings_its_priv.h"
+
 LOG_MODULE_DECLARE(settings, CONFIG_SETTINGS_LOG_LEVEL);
 
 K_MUTEX_DEFINE(worker_mutex);
 static struct k_work_delayable worker;
 
-struct setting_entry {
-	char name[SETTINGS_MAX_NAME_LEN];
-	char value[SETTINGS_MAX_VAL_LEN];
-	size_t val_len;
-};
-
 static struct setting_entry entries[CONFIG_SETTINGS_TFM_ITS_NUM_ENTRIES];
 static int entries_count;
 
@@ -38,16 +37,15 @@ static const struct settings_store_itf settings_its_itf = {
 static struct settings_store default_settings_its = {.cs_itf = &settings_its_itf};
 
 /* Ensure Key configured max size does not exceed reserved Key range */
-BUILD_ASSERT(sizeof(entries) / CONFIG_TFM_ITS_MAX_ASSET_SIZE <=
-	     ZEPHYR_PSA_SETTINGS_TFM_ITS_UID_RANGE_SIZE,
+BUILD_ASSERT(sizeof(entries) / ITS_MAX_ASSET_SIZE <= ZEPHYR_PSA_SETTINGS_TFM_ITS_UID_RANGE_SIZE,
 	     "entries array exceeds reserved ITS UID range");
 
 static int store_entries(void)
 {
 	psa_status_t status;
 	psa_storage_uid_t uid = ZEPHYR_PSA_SETTINGS_TFM_ITS_UID_RANGE_BEGIN;
 	size_t remaining = sizeof(entries);
-	size_t chunk_size = CONFIG_TFM_ITS_MAX_ASSET_SIZE;
+	size_t chunk_size = ITS_MAX_ASSET_SIZE;
 	const uint8_t *data_ptr = (const uint8_t *)&entries;
 
 	/*
@@ -83,7 +81,7 @@ static int load_entries(void)
 	size_t bytes_read;
 	psa_storage_uid_t uid = ZEPHYR_PSA_SETTINGS_TFM_ITS_UID_RANGE_BEGIN;
 	size_t remaining = sizeof(entries);
-	size_t chunk_size = CONFIG_TFM_ITS_MAX_ASSET_SIZE;
+	size_t chunk_size = ITS_MAX_ASSET_SIZE;
 	uint8_t *data_ptr = (uint8_t *)&entries;
 
 	/*

subsys/settings/src/settings_its_priv.h

@@ -0,0 +1,13 @@
+/*
+ * Copyright (c) 2019-2025 The Zephyr Project Contributors
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <zephyr/settings/settings.h>
+
+struct setting_entry {
+	char name[SETTINGS_MAX_NAME_LEN];
+	char value[SETTINGS_MAX_VAL_LEN];
+	size_t val_len;
+};

tests/subsys/settings/functional/src/settings_basic_test.c

@@ -11,7 +11,6 @@
 
 #include <zephyr/kernel.h>
 #include <zephyr/ztest.h>
-#include <errno.h>
 #include <zephyr/settings/settings.h>
 #include <zephyr/logging/log.h>
 LOG_MODULE_REGISTER(settings_basic_test);
@@ -24,6 +23,13 @@ LOG_MODULE_REGISTER(settings_basic_test);
 #elif defined(CONFIG_SETTINGS_FILE)
 #include <zephyr/fs/fs.h>
 #include <zephyr/fs/littlefs.h>
+#elif defined(CONFIG_SETTINGS_TFM_ITS)
+#include <psa/internal_trusted_storage.h>
+#include <zephyr/psa/its_ids.h>
+/* TF-M config file containing ITS_MAX_ASSET_SIZE */
+#include <config_base.h>
+
+#include <settings_its_priv.h>
 #else
 #error "Settings backend not selected"
 #endif
@@ -38,7 +44,17 @@ LOG_MODULE_REGISTER(settings_basic_test);
  */
 ZTEST(settings_functional, test_clear_settings)
 {
-#if !defined(CONFIG_SETTINGS_FILE)
+#if defined(CONFIG_SETTINGS_TFM_ITS)
+	psa_status_t status;
+
+	/* Remove all potentially accessed ITS entries in the UID range */
+	for (int i = 0; i < sizeof(struct setting_entry) * CONFIG_SETTINGS_TFM_ITS_NUM_ENTRIES /
+		ITS_MAX_ASSET_SIZE + 1; i++) {
+		status = psa_its_remove(ZEPHYR_PSA_SETTINGS_TFM_ITS_UID_RANGE_BEGIN + i);
+		zassert_true(status == PSA_SUCCESS || status == PSA_ERROR_DOES_NOT_EXIST,
+			"psa_its_remove failed");
+	}
+#elif !defined(CONFIG_SETTINGS_FILE)
 	const struct flash_area *fap;
 	int rc;
 

tests/subsys/settings/functional/tfm_psa/CMakeLists.txt

@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: Apache-2.0
+
+cmake_minimum_required(VERSION 3.20.0)
+find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE})
+project(functional_psa)
+
+# The code is in the library common to several tests.
+target_sources(app PRIVATE settings_test_psa.c)
+
+add_subdirectory(../src func_test_bindir)

tests/subsys/settings/functional/tfm_psa/prj.conf

@@ -0,0 +1,6 @@
+CONFIG_ZTEST=y
+
+CONFIG_SETTINGS=y
+
+# 10 is not sufficient for the test
+CONFIG_SETTINGS_TFM_ITS_NUM_ENTRIES=11

tests/subsys/settings/functional/tfm_psa/settings_test_psa.c

@@ -0,0 +1,6 @@
+/* SPDX-License-Identifier: Apache-2.0 */
+/* Copyright (c) 2025 Dmitrii Sharshakov <d3dx12.xx@gmail.com> */
+
+#include <zephyr/ztest.h>
+
+ZTEST_SUITE(settings_functional, NULL, NULL, NULL, NULL, NULL);

tests/subsys/settings/functional/tfm_psa/testcase.yaml

@@ -0,0 +1,16 @@
+tests:
+  settings.functional.tfm-its:
+    filter: CONFIG_TFM_PARTITION_INTERNAL_TRUSTED_STORAGE
+    integration_platforms:
+      - max32657evkit/max32657/ns
+      - nrf5340dk/nrf5340/cpuapp/ns
+      - nrf54l15dk/nrf54l15/cpuapp/ns
+      - nrf54lm20dk/nrf54lm20a/cpuapp/ns
+      - mps2/an521/cpu0/ns
+    platform_exclude:
+      - lpcxpresso55s69/lpc55s69/cpu0/ns
+    tags:
+      - settings
+      - trusted-firmware-m
+    extra_args:
+      - CONFIG_SETTINGS_TFM_ITS=y

tests/subsys/settings/its/prj.conf

@@ -6,8 +6,6 @@ CONFIG_ZTEST=y
 CONFIG_FLASH=y
 CONFIG_FLASH_MAP=y
 CONFIG_TFM_PARTITION_INTERNAL_TRUSTED_STORAGE=y
-CONFIG_TFM_ITS_MAX_ASSET_SIZE_OVERRIDE=y
-CONFIG_TFM_ITS_MAX_ASSET_SIZE=1024
 CONFIG_SETTINGS=y
 CONFIG_SETTINGS_TFM_ITS=y
 CONFIG_SETTINGS_RUNTIME=y

tests/subsys/settings/its/testcase.yaml

@@ -11,5 +11,8 @@ tests:
       - nrf5340dk/nrf5340/cpuapp/ns
       - nrf54l15dk/nrf54l15/cpuapp/ns
       - nrf54lm20dk/nrf54lm20a/cpuapp/ns
+      - mps2/an521/cpu0/ns
     platform_exclude:
       - lpcxpresso55s69/lpc55s69/cpu0/ns
+    tags:
+      - trusted-firmware-m