Decrease rom footprint of TFM

RE: Decrease rom footprint of TFM

Simonr — Mon, 02 Feb 2026 08:29:33 GMT

I got an update today on this ticket. The only other thing we can think of is changing the TF-M modes. If you use the IPC mode, that uses a bit more space. This is configured with CONFIG_TFM_IPC. You can disable this and switch to SFN mode if you're okay with having less security isolation. SFN will be inferior in security but it's still better than not using Trustzone at all.

Best regards,

Simon

RE: Decrease rom footprint of TFM

mackz — Fri, 23 Jan 2026 08:31:54 GMT

Hi again, at the moment it is not possible for me to migrate to a newer version but i will keep it in mind if it becomes possible in the future.

RE: Decrease rom footprint of TFM

Simonr — Fri, 23 Jan 2026 06:47:03 GMT

Hi again Marcus

And migrating to a newer version of nRF Connect SDK was not an option for you, was it so? I have asked for more suggestions, but can't guarantee we have more to come with. With static key slots you should be able to save close to 1kb I think.

Best regards,

Simon

RE: Decrease rom footprint of TFM

mackz — Wed, 21 Jan 2026 13:01:21 GMT

I got:

tfm_memory_testing/prj.conf:49: warning: attempt to assign the value 'y' to the undefined symbol MBEDTLS_PSA_STATIC_KEY_SLOTS

It seems like CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS is a newer configuration that does not exist in NCS 2.6.1

And only setting:
CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT=4
did not do any difference to the flash size of TFM.

RE: Decrease rom footprint of TFM

Simonr — Wed, 21 Jan 2026 06:35:58 GMT

I got a suggestion today to save some more space on your end. Try enabling static key slots by tweaking the following configs to these values:

CONFIG_MBEDTLS_PSA_STATIC_KEY_SLOTS=y

CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT=4 # Affects how many keys can be used at the same time

Best regards,

Simon

RE: Decrease rom footprint of TFM

Simonr — Tue, 20 Jan 2026 14:30:24 GMT

Because of security fixes, as well as if you want to update your application yourself with features in the futures, if you have very little room left, you might render yourself unable to do any firmware updates for any reasons.

If you are certain that you won't make updates, it should be fine to cut it close, but it still isn't something we recommend.

I have asked the developers now, but it might take some time to get more suggestions on how to reduce the TF-M size further.

Best regards,

Simon

RE: Decrease rom footprint of TFM

mackz — Tue, 20 Jan 2026 09:59:37 GMT

When i use the MINIMAL profile of TFM this is what i get as memory usage:

Memory region         Used Size  Region Size  %age Used
           FLASH:       31592 B      32256 B     97.94%
             RAM:       14392 B        32 KB     43.92%

Is your recommendation that the flash memory should not be capped to 32kB since it is so close to that?

RE: Decrease rom footprint of TFM

Achim Kraus — Mon, 19 Jan 2026 14:18:45 GMT

Because security fixes may only be available for new versions. And new versions may come with more flash/ram usage.

RE: Decrease rom footprint of TFM

mackz — Mon, 19 Jan 2026 12:22:50 GMT

If there is any possibility to get under i would like to know.
And i do not really understand what you mean when you say that future updates to the application might break the configuration. Does the tfm image size change with the application? If i can find a configuration that works and gives me the ability to use the features i need i do not see any particular reason to why i would change that.

RE: Decrease rom footprint of TFM

Simonr — Mon, 19 Jan 2026 10:12:28 GMT

Hi Marcus

We're struggling to find more suggestions to optimize flash more for you here. But after discussing this with my colleagues I want to reiterate that it is not recommended to just barely have enough room for your application in the device's flash, so even if you are able to optimize flash to fit into the flash with a few bytes to spare, as that will mean that any kind of update in the future of this application will likely reintroduce this issue, so we can't recommend going ahead with this.

If you still want to move forward with it, we'll try to keep assisting you with what we can of course.

Best regards,

Simon

RE: Decrease rom footprint of TFM

mackz — Fri, 16 Jan 2026 14:27:33 GMT

Right now i am trying to optimize for flash, i have gotten the ram footprint to where i want it.
Yes the configs that i have mentioned above is me trying to get a custom build to fit my needs.
and the size i get when i have the the partitions i need ( crypto and ITS) is the result i mentioned in a previous answer.

The only reason for me wanting to get it below 64kB is because i am already so close to it and it would make it easier to create the static partitioning if i could cap it at that.

My application is already close to the limit if i let TFM use 96kB since i use mcuboot and want to be able to do ota updates with swap. So that is the reason for me trying to optimize it as much as i can.

RE: Decrease rom footprint of TFM

Hieu — Thu, 15 Jan 2026 13:04:47 GMT

Hi mackz,

So to be on the same page, are you optimizing RAM or Flash footprint?

Either way, have you looked into custom profile build?
I see that you have a case where that topic is brought up: Crypto operations to generate key pair when TFM profile is set to minimal.

Please refer to this guide and determine which TF-M partitions you need. We first build with only the Partition you need, then we also start taking away unused features from those partition. Please give me an update on what size you have.

Also, as PaKa and Achim mentioned, having TF-M barely fit is not a good idea. It's better to have plenty of space reserved to it. Do you absolutely needs it to occupy only 64kB? Can you not give it a little more? If so, why, in case we can find alternatives there?

Hieu

RE: Decrease rom footprint of TFM

mackz — Mon, 12 Jan 2026 09:19:09 GMT

If i change the ram size from:

tfm:
  address: 0x8200
  end_address: 0x20000
  region: flash_primary
  size: 0x17e00  # 95.5KB for TFM

to 64KB i get flash overflow when building the tfm image.

RE: Decrease rom footprint of TFM

Achim Kraus — Sat, 10 Jan 2026 12:15:43 GMT

FMOPV, not only for the TF-M part, a that small amount of free space will come with a high risk. The last NCS updates always increased the sizes of apps (I haven't analyzed it, but from 2.9.2 to 3.1.0 my apps have increased theirs size, so I had to disable functions.)

RE: Decrease rom footprint of TFM

PaKa — Fri, 09 Jan 2026 13:55:05 GMT

Remember 64kB is 65536 bytes so you are below 64kB today but better to have some margin if you need to make fixes to the code later.

RE: Decrease rom footprint of TFM

mackz — Fri, 09 Jan 2026 13:09:39 GMT

config MBEDTLS_PSA_CRYPTO_STORAGE_C
	bool "PSA storage for persistent keys" if !BUILD_WITH_TFM
	default y if BUILD_WITH_TFM
	help
	  Corresponds to MBEDTLS_PSA_CRYPTO_STORAGE_C setting in mbed TLS config file.

i got this when trying to disable CONFIG_MBEDTLS_PSA_CRYPTO_STORAGE_C:

warning: MBEDTLS_PSA_CRYPTO_STORAGE_C (defined at /home/marcus/ncs/v2.6.1/nrf/modules/trusted-
firmware-m/Kconfig.mbedtls_minimal.defconfig:68,
/home/marcus/ncs/v2.6.1/nrf/subsys/nrf_security/Kconfig.psa:53) was assigned the value 'n' but got
the value 'y'. See
http://docs.zephyrproject.org/latest/kconfig.html#CONFIG_MBEDTLS_PSA_CRYPTO_STORAGE_C and/or look up
MBEDTLS_PSA_CRYPTO_STORAGE_C in the menuconfig/guiconfig interface. The Application Development
Primer, Setting Configuration Values, and Kconfig - Tips and Best Practices sections of the manual
might be helpful too.

and using these configs:

CONFIG_TFM_CRYPTO_RNG_MODULE_ENABLED=y
CONFIG_TFM_CRYPTO_KEY_MODULE_ENABLED=y
CONFIG_TFM_CRYPTO_CIPHER_MODULE_ENABLED=y
CONFIG_TFM_CRYPTO_HASH_MODULE_ENABLED=n
CONFIG_TFM_CRYPTO_MAC_MODULE_ENABLED=n
CONFIG_TFM_CRYPTO_AEAD_MODULE_ENABLED=n
CONFIG_TFM_CRYPTO_ASYM_ENCRYPT_MODULE_ENABLED=n
CONFIG_TFM_CRYPTO_ASYM_SIGN_MODULE_ENABLED=n
CONFIG_TFM_CRYPTO_KEY_DERIVATION_MODULE_ENABLED=n

gave me the same result:

[190/194] Linking C executable bin/tfm_s.axf
Memory region         Used Size  Region Size  %age Used
           FLASH:       64360 B      97792 B     65.81%
             RAM:       21684 B        32 KB     66.17%

Thanks for continuing to assist me with this!

RE: Decrease rom footprint of TFM

Susheel Nuguru — Fri, 09 Jan 2026 11:58:30 GMT

Hi Marcus,

It is hard to say or suggest without knowing your use case. Do you save PSA keys persistently? If not you may disable that storage library (CONFIG_MBEDTLS_PSA_CRYPTO_STORAGE_C=n

Keep only those backends that you use and disable others. For example if you are using AES+RNG then just keep

CONFIG_TFM_CRYPTO_RNG_MODULE_ENABLED=y
CONFIG_TFM_CRYPTO_KEY_MODULE_ENABLED=y
CONFIG_TFM_CRYPTO_CIPHER_MODULE_ENABLED=y

Disable other unused modules.
CONFIG_TFM_CRYPTO_HASH_MODULE_ENABLED=n
CONFIG_TFM_CRYPTO_MAC_MODULE_ENABLED=n
CONFIG_TFM_CRYPTO_AEAD_MODULE_ENABLED=n
CONFIG_TFM_CRYPTO_ASYM_ENCRYPT_MODULE_ENABLED=n
CONFIG_TFM_CRYPTO_ASYM_SIGN_MODULE_ENABLED=n
CONFIG_TFM_CRYPTO_KEY_DERIVATION_MODULE_ENABLED=n

I will ask my colleague who has much deeper knowledge than me in crypto to have a brief look at this and comment if he has any inputs.