zephyrproject-rtos · valeriosetti · Nov 5, 2024 · Nov 5, 2024 · Oct 30, 2024 · Oct 18, 2024
diff --git a/boards/native/native_sim/Kconfig.defconfig b/boards/native/native_sim/Kconfig.defconfig
@@ -32,5 +32,14 @@ config UART_CONSOLE
 
 endif # CONSOLE
 
+# BT relies on PSA Crypto API to perform crypto operations. On this platform
+# this is implemented by Mbed TLS which requires a (possibly true) random
+# number generator to initialize properly. We enable ENTROPY_GENERATOR here
+# instead of manually adding it to all samples/tests configuration files because
+# it looks more compact and easier to maintain.
+config ENTROPY_GENERATOR
+	bool
+	default y if BT
+
 
 endif # BOARD_NATIVE_SIM
diff --git a/boards/qemu/cortex_m3/Kconfig.defconfig b/boards/qemu/cortex_m3/Kconfig.defconfig
@@ -12,4 +12,13 @@ choice NULL_POINTER_EXCEPTION_DETECTION
 	default NULL_POINTER_EXCEPTION_DETECTION_NONE
 endchoice
 
+# BT relies on PSA Crypto API to perform crypto operations and, on this platform,
+# these APIs are provided thougth Mbed TLS. Unfortunately this platform is not
+# provided with a true random number generator which is required to properly
+# initialize the PSA Crypto core, so we need to enable the fake TEST_RANDOM_GENERATOR.
+config TEST_RANDOM_GENERATOR
+	bool
+	depends on BT
+	default y
+
 endif # BOARD_QEMU_CORTEX_M3
diff --git a/doc/releases/migration-guide-4.0.rst b/doc/releases/migration-guide-4.0.rst
@@ -75,6 +75,12 @@ Mbed TLS
   corresponding build symbol was removed in Mbed TLS 3.1.0 and is now assumed to
   be enabled. (:github:`77657`)
 
+* If a platform has a CSPRNG source available (i.e. :kconfig:option:`CONFIG_CSPRNG_ENABLED`
+  is set), then the Kconfig option :kconfig:option:`CONFIG_MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG`
+  is the default choice for random number source instead of
+  :kconfig:option:`CONFIG_MBEDTLS_PSA_CRYPTO_LEGACY_RNG`. This helps in reducing
+  ROM/RAM footprint of the Mbed TLS library.
+
 TinyCrypt
 =========
 
@@ -227,6 +233,15 @@ Disk
 Enhanced Serial Peripheral Interface (eSPI)
 ===========================================
 
+Entropy
+=======
+
+* BT HCI based entropy driver now directly sends the HCI command to parse random
+  data instead of waiting for BT connection to be ready. This is helpful on
+  platforms where the BT controller owns the HW random generator and the application
+  processor needs to get random data before BT is fully enabled.
+  (:github:`79931`)
+
 GNSS
 ====
 

diff --git a/doc/releases/release-notes-4.0.rst b/doc/releases/release-notes-4.0.rst
@@ -572,6 +572,18 @@ Libraries / Subsystems
     * :kconfig:option:`CONFIG_MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED`
       for TLS 1.3 PSK ephemeral key exchange mode.
 
+  * The Kconfig symbol :kconfig:option:`CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS` was
+    added to allow Mbed TLS to use pre-allocated static buffers to store key material
+    in its PSA Crypto core instead of heap allocated ones. This can help reducing
+    (or removing, if no other components makes use of it) heap memory requirements
+    from the final application.
+
+  * The Kconfig symbol :kconfig:option:`CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT` was
+    added to allow selecting the number of key slots available in the Mbed TLS's
+    implementation of the PSA Crypto core. The default value is 32, the same used in
+    Mbed TLS by default. Since each slot consumes RAM memory even if unused, this
+    value can be tweaked in order to minimize RAM usage.
+
 * CMSIS-NN
 
 * FPGA

@@ -112,7 +112,6 @@ config BT_SILABS_EFR32
 	select MBEDTLS
 	select MBEDTLS_PSA_CRYPTO_C
 	select MBEDTLS_ENTROPY_C
-	select MBEDTLS_ENTROPY_POLL_ZEPHYR
 	help
 	  Use Silicon Labs binary Bluetooth library to connect to the
 	  controller.

@@ -20,9 +20,18 @@ static int entropy_bt_init(const struct device *dev)
 static int entropy_bt_get_entropy(const struct device *dev,
 				  uint8_t *buffer, uint16_t length)
 {
-	if (!bt_is_ready()) {
-		return -EAGAIN;
-	}
+	/* Do not wait for BT to be ready (i.e. bt_is_ready()) before issueing
+	 * the command. The reason is that when crypto is enabled and the PSA
+	 * Crypto API support is provided through Mbed TLS, random number generator
+	 * needs to be available since the very first call to psa_crypto_init()
+	 * which is usually done before BT is completely initialized.
+	 * On the other hand, in devices like the nrf5340, the crytographically
+	 * secure RNG is owned by the cpu_net, so the cpu_app needs to poll it
+	 * to get random data. Again, there is no need to wait for BT to be
+	 * completely initialized for this kind of support. Just try to send the
+	 * request through HCI. If the command fails for any reason, then
+	 * we return failure anyway.
+	 */
 
 	return bt_hci_le_rand(buffer, length);
 }

diff --git a/drivers/wifi/esp32/Kconfig.esp32 b/drivers/wifi/esp32/Kconfig.esp32
@@ -377,7 +377,6 @@ config ESP32_WIFI_MBEDTLS_CRYPTO
 	select MBEDTLS_CIPHER_MODE_CTR_ENABLED
 	select MBEDTLS_CMAC
 	select MBEDTLS_ENTROPY_C
-	select MBEDTLS_ENTROPY_POLL_ZEPHYR
 	help
 	  Select this option to use MbedTLS crypto APIs which utilize hardware acceleration.
 

diff --git a/include/zephyr/bluetooth/mesh/keys.h b/include/zephyr/bluetooth/mesh/keys.h
@@ -28,14 +28,6 @@ struct bt_mesh_key {
 	psa_key_id_t key;
 };
 
-#elif defined CONFIG_BT_MESH_USES_TINYCRYPT
-
-/** The structure that keeps representation of key. */
-struct bt_mesh_key {
-	/** tinycrypt key representation is the pure key value. */
-	uint8_t key[16];
-};
-
 #else
 #error "Crypto library has not been chosen"
 #endif

diff --git a/modules/mbedtls/Kconfig.tls-generic b/modules/mbedtls/Kconfig.tls-generic
@@ -246,6 +246,7 @@ config MBEDTLS_SOME_CIPHER_ENABLED
 
 config MBEDTLS_CIPHER_AES_ENABLED
 	bool "AES block cipher"
+	default y if PSA_WANT_KEY_TYPE_AES && MBEDTLS_PSA_CRYPTO_C
 
 if MBEDTLS_CIPHER_AES_ENABLED
 
@@ -397,6 +398,7 @@ config MBEDTLS_ENTROPY_C
 
 config MBEDTLS_ENTROPY_POLL_ZEPHYR
 	bool "Provide entropy data to Mbed TLS through entropy driver or random generator"
+	default y
 	depends on MBEDTLS_ENTROPY_C
 	help
 	  Provide entropy data to the Mbed TLS's entropy module through either
@@ -480,6 +482,7 @@ config MBEDTLS_SSL_EXTENDED_MASTER_SECRET
 choice MBEDTLS_PSA_CRYPTO_RNG_SOURCE
 	prompt "Select random source for built-in PSA crypto"
 	depends on MBEDTLS_PSA_CRYPTO_C
+	default MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG if CSPRNG_ENABLED
 	default MBEDTLS_PSA_CRYPTO_LEGACY_RNG
 
 config MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
@@ -551,9 +554,10 @@ config MBEDTLS_LMS
 	depends on MBEDTLS_SHA256
 	select PSA_WANT_ALG_SHA_256
 
+if MBEDTLS_PSA_CRYPTO_C
+
 config MBEDTLS_PSA_P256M_DRIVER_ENABLED
 	bool "P256-M driver"
-	depends on MBEDTLS_PSA_CRYPTO_C
 	imply PSA_WANT_ALG_SHA_256
 	help
 	  Enable support for the optimized sofware implementation of the secp256r1
@@ -567,6 +571,38 @@ config MBEDTLS_PSA_P256M_DRIVER_RAW
 	  Warning: Usage of this Kconfig option is prohibited in Zephyr's codebase.
 	           Users can enable it in case of very memory-constrained devices, but be aware that the p256-m interface is absolutely not guaranted to remain stable over time.
 
+config MBEDTLS_PSA_STATIC_KEY_SLOTS
+	bool "Use statically allocated key buffers to store key material"
+	default y if !MBEDTLS_ENABLE_HEAP
+	help
+	  By default Mbed TLS's PSA Crypto core uses heap memory to store the
+	  key's material for each key slot. This might impose an undesired
+	  requirement to support heap memory and its management code affecting
+	  RAM and ROM footprints at the same time.
+	  Enabling this symbol cause Mbed TLS to pre-allocate all the key slot
+	  buffers that are used to store the key's material at built time, thus
+	  removing the need for heap memory. Each buffer will be sized to
+	  contain the largest asymmetric/symmetric key type enabled in the build
+	  through PSA_WANT symbols.
+
+config MBEDTLS_PSA_KEY_SLOT_COUNT
+	int "Number of key slots in PSA Crypto core"
+	default 16
+	depends on MBEDTLS_PSA_CRYPTO_C
+	help
+	  Set the number of key slots that are available in the PSA Crypto core.
+	  Be aware that each slots, even if unused, increases RAM memory
+	  consumption as follows:
+	  * if MBEDTLS_PSA_STATIC_KEY_SLOTS is set: ~40 bytes of overhead for each
+	    slot + the length of the largest asymmetric/symmetric key type
+	    enabled in the build through PSA_WANT symbols. All defined statically
+	    at build time.
+	  * if MBEDTLS_PSA_STATIC_KEY_SLOTS is not set: ~40 bytes of overhead
+	    for each slot defined statically at build time + key material allocated
+	    on heap memory at runtime.
+
+endif # MBEDTLS_PSA_CRYPTO_C
+
 config MBEDTLS_SSL_DTLS_CONNECTION_ID
 	bool "DTLS Connection ID extension"
 	depends on MBEDTLS_DTLS

diff --git a/modules/mbedtls/configs/config-tls-generic.h b/modules/mbedtls/configs/config-tls-generic.h
@@ -483,7 +483,6 @@
 #endif
 
 #if defined(CONFIG_ARCH_POSIX) && !defined(CONFIG_PICOLIBC)
-#define MBEDTLS_PSA_KEY_SLOT_COUNT 64 /* for BLE Mesh tests */
 #define MBEDTLS_PSA_ITS_FILE_C
 #define MBEDTLS_FS_IO
 #endif
@@ -494,6 +493,14 @@
 
 #endif /* CONFIG_MBEDTLS_PSA_CRYPTO_C */
 
+#if defined(CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS)
+#define MBEDTLS_PSA_STATIC_KEY_SLOTS
+#endif
+
+#if defined(CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT)
+#define MBEDTLS_PSA_KEY_SLOT_COUNT CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT
+#endif
+
 #if defined(CONFIG_MBEDTLS_USE_PSA_CRYPTO)
 #define MBEDTLS_USE_PSA_CRYPTO
 #endif

diff --git a/samples/bluetooth/bap_broadcast_assistant/prj.conf b/samples/bluetooth/bap_broadcast_assistant/prj.conf
@@ -7,7 +7,7 @@ CONFIG_BT_BUF_ACL_RX_SIZE=255
 CONFIG_BT_BUF_ACL_TX_SIZE=251
 CONFIG_BT_CTLR_SCAN_DATA_LEN_MAX=191
 
-CONFIG_BT_TINYCRYPT_ECC=y
+CONFIG_BT_SEND_ECC_EMULATION=y
 
 CONFIG_BT_EXT_ADV=y
 CONFIG_BT_BAP_BASS_MAX_SUBGROUPS=2

diff --git a/samples/bluetooth/bap_broadcast_sink/boards/nrf5340bsim_nrf5340_cpuapp.conf b/samples/bluetooth/bap_broadcast_sink/boards/nrf5340bsim_nrf5340_cpuapp.conf
@@ -0,0 +1 @@
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/bap_broadcast_sink/boards/nrf5340dk_nrf5340_cpuapp.conf b/samples/bluetooth/bap_broadcast_sink/boards/nrf5340dk_nrf5340_cpuapp.conf
@@ -1,3 +1,4 @@
 # Use USB Audio as audio sink
 CONFIG_USE_USB_AUDIO_OUTPUT=y
 CONFIG_USB_DEVICE_PRODUCT="USB Broadcast Sink"
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/bap_broadcast_sink/prj.conf b/samples/bluetooth/bap_broadcast_sink/prj.conf
@@ -23,4 +23,4 @@ CONFIG_BT_AUDIO_CODEC_CAP_MAX_DATA_SIZE=64
 
 CONFIG_BT_DEVICE_NAME="Broadcast Audio Sink"
 
-CONFIG_BT_TINYCRYPT_ECC=y
+CONFIG_BT_SEND_ECC_EMULATION=y
diff --git a/samples/bluetooth/bap_broadcast_source/boards/nrf5340bsim_nrf5340_cpuapp.conf b/samples/bluetooth/bap_broadcast_source/boards/nrf5340bsim_nrf5340_cpuapp.conf
@@ -0,0 +1 @@
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/bap_broadcast_source/boards/nrf5340dk_nrf5340_cpuapp.conf b/samples/bluetooth/bap_broadcast_source/boards/nrf5340dk_nrf5340_cpuapp.conf
@@ -1,3 +1,4 @@
 # Use USB Audio as audio source
 CONFIG_USE_USB_AUDIO_INPUT=y
 CONFIG_USB_DEVICE_PRODUCT="Zephyr Broadcast Source"
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/bap_unicast_client/boards/native_sim.conf b/samples/bluetooth/bap_unicast_client/boards/native_sim.conf
@@ -1,5 +1,5 @@
 CONFIG_LOG_MODE_IMMEDIATE=y
-CONFIG_BT_TINYCRYPT_ECC=y
+CONFIG_BT_SEND_ECC_EMULATION=y
 
 CONFIG_LIBLC3=y
 CONFIG_FPU=y
@@ -8,3 +8,5 @@ CONFIG_FPU=y
 # than every 10 ms as each PDU for some reason takes 2 ticks to process.
 CONFIG_SYS_CLOCK_TICKS_PER_SEC=1000
 CONFIG_NATIVE_POSIX_SLOWDOWN_TO_REAL_TIME=y
+
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/bap_unicast_client/boards/nrf5340_audio_dk_nrf5340_cpuapp.conf b/samples/bluetooth/bap_unicast_client/boards/nrf5340_audio_dk_nrf5340_cpuapp.conf
@@ -10,4 +10,6 @@ CONFIG_BT_BUF_ACL_RX_SIZE=255
 CONFIG_BT_BUF_ACL_TX_SIZE=251
 CONFIG_BT_BUF_CMD_TX_SIZE=255
 
-CONFIG_BT_TINYCRYPT_ECC=y
+CONFIG_BT_SEND_ECC_EMULATION=y
+
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/bap_unicast_client/boards/nrf5340bsim_nrf5340_cpuapp.conf b/samples/bluetooth/bap_unicast_client/boards/nrf5340bsim_nrf5340_cpuapp.conf
@@ -7,4 +7,4 @@ CONFIG_BT_BUF_ACL_RX_SIZE=255
 CONFIG_BT_BUF_ACL_TX_SIZE=251
 CONFIG_BT_BUF_CMD_TX_SIZE=255
 
-CONFIG_BT_TINYCRYPT_ECC=y
+CONFIG_BT_SEND_ECC_EMULATION=y
diff --git a/samples/bluetooth/bap_unicast_client/boards/nrf5340dk_nrf5340_cpuapp.conf b/samples/bluetooth/bap_unicast_client/boards/nrf5340dk_nrf5340_cpuapp.conf
@@ -10,4 +10,6 @@ CONFIG_BT_BUF_ACL_RX_SIZE=255
 CONFIG_BT_BUF_ACL_TX_SIZE=251
 CONFIG_BT_BUF_CMD_TX_SIZE=255
 
-CONFIG_BT_TINYCRYPT_ECC=y
+CONFIG_BT_SEND_ECC_EMULATION=y
+
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/bap_unicast_server/boards/native_sim.conf b/samples/bluetooth/bap_unicast_server/boards/native_sim.conf
@@ -1,5 +1,5 @@
 CONFIG_LOG_MODE_IMMEDIATE=y
-CONFIG_BT_TINYCRYPT_ECC=y
+CONFIG_BT_SEND_ECC_EMULATION=y
 
 CONFIG_LIBLC3=y
 CONFIG_FPU=y

diff --git a/samples/bluetooth/bap_unicast_server/boards/nrf5340_audio_dk_nrf5340_cpuapp.conf b/samples/bluetooth/bap_unicast_server/boards/nrf5340_audio_dk_nrf5340_cpuapp.conf
@@ -7,4 +7,4 @@ CONFIG_BT_BUF_ACL_RX_SIZE=255
 CONFIG_BT_BUF_ACL_TX_SIZE=251
 CONFIG_BT_BUF_CMD_TX_SIZE=255
 
-CONFIG_BT_TINYCRYPT_ECC=y
+CONFIG_BT_SEND_ECC_EMULATION=y
diff --git a/samples/bluetooth/bap_unicast_server/boards/nrf5340bsim_nrf5340_cpuapp.conf b/samples/bluetooth/bap_unicast_server/boards/nrf5340bsim_nrf5340_cpuapp.conf
@@ -7,4 +7,6 @@ CONFIG_BT_BUF_ACL_RX_SIZE=255
 CONFIG_BT_BUF_ACL_TX_SIZE=251
 CONFIG_BT_BUF_CMD_TX_SIZE=255
 
-CONFIG_BT_TINYCRYPT_ECC=y
+CONFIG_BT_SEND_ECC_EMULATION=y
+
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/bap_unicast_server/boards/nrf5340dk_nrf5340_cpuapp.conf b/samples/bluetooth/bap_unicast_server/boards/nrf5340dk_nrf5340_cpuapp.conf
@@ -10,4 +10,6 @@ CONFIG_BT_BUF_ACL_RX_SIZE=255
 CONFIG_BT_BUF_ACL_TX_SIZE=251
 CONFIG_BT_BUF_CMD_TX_SIZE=255
 
-CONFIG_BT_TINYCRYPT_ECC=y
+CONFIG_BT_SEND_ECC_EMULATION=y
+
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/beacon/boards/nrf54l15dk_nrf54l15_cpuapp.conf b/samples/bluetooth/beacon/boards/nrf54l15dk_nrf54l15_cpuapp.conf
@@ -0,0 +1,13 @@
+# We need a random number generator to properly initialize the PSA Crypto core
+# implemented by Mbed TLS. The proper thing to do in this platform would be
+# to enable ENTROPY_GENERATOR, but this is not supported right now for the
+# following reasons:
+# - at device-tree level (nrf54l15_cpuapp.dtsi) the only RNG source available
+#   is "zephyr,psa-crypto-rng" which means that TF-M is required in order for
+#   this to work. Unfortunately TF-M is still not supported for this platform, yet.
+# - cpuapp does not have a direct access to the RNG without TF-M, so there's
+#   no other way it can make use of it as of now.
+#
+# Since both options are not viable, we fall back to the test random generator
+# until further support is added to the platform.
+CONFIG_TEST_RANDOM_GENERATOR=y
diff --git a/samples/bluetooth/cap_acceptor/boards/nrf5340_audio_dk_nrf5340_cpuapp.conf b/samples/bluetooth/cap_acceptor/boards/nrf5340_audio_dk_nrf5340_cpuapp.conf
@@ -3,4 +3,5 @@ CONFIG_BT_BUF_ACL_RX_SIZE=255
 CONFIG_BT_BUF_ACL_TX_SIZE=251
 CONFIG_BT_BUF_CMD_TX_SIZE=255
 
-CONFIG_BT_TINYCRYPT_ECC=y
+CONFIG_BT_SEND_ECC_EMULATION=y
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/cap_acceptor/boards/nrf5340dk_nrf5340_cpuapp.conf b/samples/bluetooth/cap_acceptor/boards/nrf5340dk_nrf5340_cpuapp.conf
@@ -3,4 +3,5 @@ CONFIG_BT_BUF_ACL_RX_SIZE=255
 CONFIG_BT_BUF_ACL_TX_SIZE=251
 CONFIG_BT_BUF_CMD_TX_SIZE=255
 
-CONFIG_BT_TINYCRYPT_ECC=y
+CONFIG_BT_SEND_ECC_EMULATION=y
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/cap_initiator/boards/nrf5340_audio_dk_nrf5340_cpuapp.conf b/samples/bluetooth/cap_initiator/boards/nrf5340_audio_dk_nrf5340_cpuapp.conf
@@ -3,4 +3,5 @@ CONFIG_BT_BUF_ACL_RX_SIZE=255
 CONFIG_BT_BUF_ACL_TX_SIZE=251
 CONFIG_BT_BUF_CMD_TX_SIZE=255
 
-CONFIG_BT_TINYCRYPT_ECC=y
+CONFIG_BT_SEND_ECC_EMULATION=y
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/cap_initiator/boards/nrf5340dk_nrf5340_cpuapp.conf b/samples/bluetooth/cap_initiator/boards/nrf5340dk_nrf5340_cpuapp.conf
@@ -3,4 +3,5 @@ CONFIG_BT_BUF_ACL_RX_SIZE=255
 CONFIG_BT_BUF_ACL_TX_SIZE=251
 CONFIG_BT_BUF_CMD_TX_SIZE=255
 
-CONFIG_BT_TINYCRYPT_ECC=y
+CONFIG_BT_SEND_ECC_EMULATION=y
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/central_hr/boards/nrf5340bsim_nrf5340_cpuapp.conf b/samples/bluetooth/central_hr/boards/nrf5340bsim_nrf5340_cpuapp.conf
@@ -1,3 +1,4 @@
 # Set same the ACL RX buffer size as in hci_ipc on netcore so that
 # HCI Controller to Host Flowcontrol is supported.
 CONFIG_BT_BUF_ACL_RX_SIZE=255
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/central_hr/boards/nrf5340dk_nrf5340_cpuapp.conf b/samples/bluetooth/central_hr/boards/nrf5340dk_nrf5340_cpuapp.conf
@@ -0,0 +1 @@
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/central_hr/prj_minimal.conf b/samples/bluetooth/central_hr/prj_minimal.conf
@@ -101,3 +101,14 @@ CONFIG_BT_L2CAP_TX_BUF_COUNT=2
 CONFIG_BT_CTLR_RX_BUFFERS=1
 CONFIG_BT_BUF_ACL_TX_COUNT=3
 CONFIG_BT_BUF_ACL_TX_SIZE=27
+
+# Limit the number of key slots in PSA Crypto core to reduce
+# RAM footprint
+CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT=5
+
+# This is required because otherwise there won't be
+# __heap_start/__heap_end symbols defined in the build. This
+# is due to Mbed TLS which at boot uses standard calloc/free
+# functions and only after the initialization done from Zephyr
+# it switches to its internal memory management functions.
+CONFIG_COMMON_LIBC_MALLOC=y
diff --git a/samples/bluetooth/central_ht/boards/frdm_rw612.conf b/samples/bluetooth/central_ht/boards/frdm_rw612.conf
@@ -1 +1,2 @@
 CONFIG_PM=y
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/central_ht/boards/rd_rw612_bga.conf b/samples/bluetooth/central_ht/boards/rd_rw612_bga.conf
@@ -1 +1,2 @@
 CONFIG_PM=y
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/direction_finding_central/boards/nrf5340dk_nrf5340_cpuapp.conf b/samples/bluetooth/direction_finding_central/boards/nrf5340dk_nrf5340_cpuapp.conf
@@ -0,0 +1 @@
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/direction_finding_connectionless_rx/boards/nrf5340dk_nrf5340_cpuapp.conf b/samples/bluetooth/direction_finding_connectionless_rx/boards/nrf5340dk_nrf5340_cpuapp.conf
@@ -0,0 +1 @@
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/direction_finding_connectionless_tx/boards/nrf5340dk_nrf5340_cpuapp.conf b/samples/bluetooth/direction_finding_connectionless_tx/boards/nrf5340dk_nrf5340_cpuapp.conf
@@ -0,0 +1 @@
+CONFIG_ENTROPY_GENERATOR=y
diff --git a/samples/bluetooth/direction_finding_peripheral/boards/nrf5340dk_nrf5340_cpuapp.conf b/samples/bluetooth/direction_finding_peripheral/boards/nrf5340dk_nrf5340_cpuapp.conf
@@ -0,0 +1 @@
+CONFIG_ENTROPY_GENERATOR=y