From 8b3e843495a6d08896436f4015bb569179707300 Mon Sep 17 00:00:00 2001
From: Aidan Garske <aidan@wolfssl.com>
Date: Tue, 15 Sep 2026 10:55:20 -0700
Subject: [PATCH] Shrink unused fwTPM NV slots so the STM32H5 secure stack fits

---
 options.mk | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/options.mk b/options.mk
index 05a03a57..ce6915d0 100644
--- a/options.mk
+++ b/options.mk
@@ -1271,6 +1271,10 @@ ifeq ($(WOLFCRYPT_TZ_FWTPM),1)
   CFLAGS+=-DWC_RSA_PSS
   CFLAGS+=-DWOLFSSL_PSS_SALT_LEN_DISCOVER
   CFLAGS+=-DFWTPM_MAX_COMMAND_SIZE=4096
+  # NV is disabled here; the default 16x2KB NV index slots are dead weight that
+  # pushes the fwTPM context into the secure stack on the 128KB STM32H5 RAM.
+  CFLAGS+=-DFWTPM_MAX_NV_INDICES=2
+  CFLAGS+=-DFWTPM_MAX_NV_DATA=512
   CFLAGS+=-I$(WOLFBOOT_LIB_WOLFTPM)
   ifeq ($(USE_CLANG),1)
     CLANG_MULTILIB_FLAGS:=$(filter -mthumb -mlittle-endian,$(LDFLAGS)) $(filter -mcpu=%,$(CFLAGS))