How to reduce the code size of TF-M

[Tide]

After porting the application to sdk v2.4.0, I get the following error after compiling the code:

"opt/zephyr-sdk/arm-zephyr-eabi/bin/... /lib/gcc/arm-zephyr-eabi/12.2.0/... /... /... /... /arm-zephyr-eabi/bin/ld.bfd.exe: region `FLASH' overflow 47368 bytes"

The partitions I use are as follows:

flash_primary (0x100000 - 1024kB):
+--------------------------------------------------+
| 0x0: mcuboot (0xc000 - 48kB) |
| 0xc000: EMPTY_0 (0x4000 - 16kB) |
+---0x10000: mcuboot_primary (0x68000 - 416kB)-----+
+---0x10000: tfm_secure (0x40000 - 256kB)----------+
| 0x10000: mcuboot_pad (0x200 - 512B) |
+---0x10200: mcuboot_primary_app (0x67e00 - 415kB)-+
| 0x10200: tfm (0x3fe00 - 255kB) |
+---0x50000: tfm_nonsecure (0x28000 - 160kB)-------+
| 0x50000: app (0x28000 - 160kB) |
+--------------------------------------------------+
| 0x78000: mcuboot_secondary (0x68000 - 416kB) |
| 0xe0000: EMPTY_3 (0x8000 - 32kB) |
+---0xe8000: nonsecure_storage (0x6000 - 24kB)-----+
| 0xe8000: nvs_storage (0x6000 - 24kB) |
+--------------------------------------------------+
| 0xee000: EMPTY_2 (0x6000 - 24kB) |
+---0xf4000: tfm_storage (0x8000 - 32kB)-----------+
| 0xf4000: tfm_its (0x2000 - 8kB) |
| 0xf6000: tfm_otp_nv_counters (0x2000 - 8kB) |
| 0xf8000: tfm_ps (0x4000 - 16kB) |
+--------------------------------------------------+
| 0xfc000: EMPTY_1 (0x4000 - 16kB) |
+--------------------------------------------------+

otp (0x2f4 - 756B):
+------------------------------+
| 0xff8108: otp (0x2f4 - 756B) |
+------------------------------+

sram_primary (0x40000 - 256kB):
+--------------------------------------------------+
+---0x20000000: mcuboot_sram (0x16000 - 88kB)------+
+---0x20000000: sram_secure (0x16000 - 88kB)-------+
| 0x20000000: tfm_sram (0x16000 - 88kB) |
+---0x20016000: sram_nonsecure (0x2a000 - 168kB)---+
+---0x20016000: nrf_modem_lib_sram (0x7ce8 - 31kB)-+
| 0x20016000: nrf_modem_lib_ctrl (0x4e8 - 1kB) |
| 0x200164e8: nrf_modem_lib_tx (0x5800 - 22kB) |
| 0x2001bce8: nrf_modem_lib_rx (0x2000 - 8kB) |
+--------------------------------------------------+
| 0x2001dce8: sram_primary (0x22318 - 136kB) |
+--------------------------------------------------+

Only 160K bytes are reserved for app, TF-M uses 255K bytes of flash.  I only use secp256k1 crypto in my application, how do I configure TF-M to reduce the TF-M code size ?

[Håkon Alseth]

Hi,

 

Unfortunately, it is not trivial to configure one specific cipher support only with TFM at this time. I've tried to get it slimmed down, but ended up hitting several issues wrt. missing settings in mbedtls.

I have created an internal jira ticket to improve this configuration setting.

 

Kind regards,

Håkon

[Tide]

Hi,

For this issue, please sync any progress on your end to this ticket and look forward to your progress.

[Tide]

Thank you very much, I will test it and get back to you as soon as possible.

[Tide]

Hi,
I set prj.conf::CONFIG_TFM_PROFILE_TYPE_MEDIUM=y, just like the example you shared above, but my TF-M code size did not decrease. This is the dynamic partition generation in my project:

flash_primary (0x100000 - 1024kB):
+--------------------------------------------------+
| 0x0: mcuboot (0xc000 - 48kB) |
| 0xc000: EMPTY_0 (0x4000 - 16kB) |
+---0x10000: mcuboot_primary (0x68000 - 416kB)-----+
+---0x10000: tfm_secure (0x40000 - 256kB)----------+
| 0x10000: mcuboot_pad (0x200 - 512B) |
+---0x10200: mcuboot_primary_app (0x67e00 - 415kB)-+
| 0x10200: tfm (0x3fe00 - 255kB) |
+---0x50000: tfm_nonsecure (0x28000 - 160kB)-------+
| 0x50000: app (0x28000 - 160kB) |
+--------------------------------------------------+
| 0x78000: mcuboot_secondary (0x68000 - 416kB) |
| 0xe0000: EMPTY_3 (0x8000 - 32kB) |
+---0xe8000: nonsecure_storage (0x6000 - 24kB)-----+
| 0xe8000: nvs_storage (0x6000 - 24kB) |
+--------------------------------------------------+
| 0xee000: EMPTY_2 (0x6000 - 24kB) |
+---0xf4000: tfm_storage (0x8000 - 32kB)-----------+
| 0xf4000: tfm_its (0x2000 - 8kB) |
| 0xf6000: tfm_otp_nv_counters (0x2000 - 8kB) |
| 0xf8000: tfm_ps (0x4000 - 16kB) |
+--------------------------------------------------+
| 0xfc000: EMPTY_1 (0x4000 - 16kB) |
+--------------------------------------------------+

otp (0x2f4 - 756B):
+------------------------------+
| 0xff8108: otp (0x2f4 - 756B) |
+------------------------------+

sram_primary (0x40000 - 256kB):
+--------------------------------------------------+
+---0x20000000: mcuboot_sram (0x16000 - 88kB)------+
+---0x20000000: sram_secure (0x16000 - 88kB)-------+
| 0x20000000: tfm_sram (0x16000 - 88kB) |
+---0x20016000: sram_nonsecure (0x2a000 - 168kB)---+
+---0x20016000: nrf_modem_lib_sram (0x7ce8 - 31kB)-+
| 0x20016000: nrf_modem_lib_ctrl (0x4e8 - 1kB) |
| 0x200164e8: nrf_modem_lib_tx (0x5800 - 22kB) |
| 0x2001bce8: nrf_modem_lib_rx (0x2000 - 8kB) |
+--------------------------------------------------+
| 0x2001dce8: sram_primary (0x22318 - 136kB) |
+--------------------------------------------------+

And i still get the message that the app code size is not enough.

"arm-zephyr-eabi/bin/ld.bfd.exe: region `FLASH' overflowed by 47424 bytes"

[Håkon Alseth]

Could you try setting this instead?

CONFIG_PM_PARTITION_SIZE_TFM=0x2FE00

 

Remember to regenerate your build (ie. delete the build folder) after making such a change.

 

Kind regards,

Håkon

[Tide]

Thanks, it worked and now TF-M only takes up 191KB!

flash_primary (0x100000 - 1024kB):
+--------------------------------------------------+
| 0x0: mcuboot (0xc000 - 48kB) |
| 0xc000: EMPTY_0 (0x4000 - 16kB) |
+---0x10000: mcuboot_primary (0x68000 - 416kB)-----+
+---0x10000: tfm_secure (0x30000 - 192kB)----------+
| 0x10000: mcuboot_pad (0x200 - 512B) |
+---0x10200: mcuboot_primary_app (0x67e00 - 415kB)-+
| 0x10200: tfm (0x2fe00 - 191kB) |
+---0x40000: tfm_nonsecure (0x38000 - 224kB)-------+
| 0x40000: app (0x38000 - 224kB) |
+--------------------------------------------------+
| 0x78000: mcuboot_secondary (0x68000 - 416kB) |
| 0xe0000: EMPTY_3 (0x8000 - 32kB) |
+---0xe8000: nonsecure_storage (0x6000 - 24kB)-----+
| 0xe8000: nvs_storage (0x6000 - 24kB) |
+--------------------------------------------------+
| 0xee000: EMPTY_2 (0x6000 - 24kB) |
+---0xf4000: tfm_storage (0x8000 - 32kB)-----------+
| 0xf4000: tfm_its (0x2000 - 8kB) |
| 0xf6000: tfm_otp_nv_counters (0x2000 - 8kB) |
| 0xf8000: tfm_ps (0x4000 - 16kB) |
+--------------------------------------------------+
| 0xfc000: EMPTY_1 (0x4000 - 16kB) |
+--------------------------------------------------+

otp (0x2f4 - 756B):
+------------------------------+
| 0xff8108: otp (0x2f4 - 756B) |
+------------------------------+

sram_primary (0x40000 - 256kB):
+--------------------------------------------------+
+---0x20000000: mcuboot_sram (0x16000 - 88kB)------+
+---0x20000000: sram_secure (0x16000 - 88kB)-------+
| 0x20000000: tfm_sram (0x16000 - 88kB) |
+---0x20016000: sram_nonsecure (0x2a000 - 168kB)---+
+---0x20016000: nrf_modem_lib_sram (0x7ce8 - 31kB)-+
| 0x20016000: nrf_modem_lib_ctrl (0x4e8 - 1kB) |
| 0x200164e8: nrf_modem_lib_tx (0x5800 - 22kB) |
| 0x2001bce8: nrf_modem_lib_rx (0x2000 - 8kB) |
+--------------------------------------------------+
| 0x2001dce8: sram_primary (0x22318 - 136kB) |
+--------------------------------------------------+

[Håkon Alseth]

Happy to help out, glad to hear that it worked!

 

Kind regards,

Håkon