Compiler says auto-generated .h-file for custom secure partition doesn't exist, but it does exist in the filesystem (fatal error: "No such file or directory")

[gdl]

I'm trying to build a custom secure partition, but get the following error when building:

/home/usern/testapplicationone/build_1/tfm/generated/secure_fw/partitions/custompartitiontest/auto_generated/load_info_tfm_custompartitiontest.c:26:10: fatal error: psa_manifest/tfm_custompartitiontest.h: No such file or directory
   26 | #include "psa_manifest/tfm_custompartitiontest.h"
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
compilation terminated.

However when navigating in files to the directory the file "tfm_custompartitiontest.h" exists and is in the correct "psa_manifest" directory.
According to its timestamp it also was auto-generated just before the "load_info_tfm_custompartitiontest.c"-file was generated (that is read by the compiler and references the .h file, leading to the error No such file or directory) so the .h file definitely already exists at the moment it should exist.

EDIT: The error is possibly because the compiler ("arm-zephyr-eabi-gcc" from the toolchain) doesn't add the generated directory to the directories to be searched for headers using the I flag. (The full, very long compiler command as outputted by the terminal is pasted below in a reply.)
It does add the directory of the original source code of custom partition itself to the directories to be searched using the I flag ("-I/home/usern/ncs/modules/tee/tf-m/trusted-firmware-m/secure_fw/partitions/custompartitiontest").
But i think it doesn't add the directory of the auto-generated files of the custom-partition to the directories to be searched.
For other partitions a flag like the following exists (this is for protected_storage, but also exists for many other partitions):

"-I/home/usern/testapplicationone/build_1/tfm/generated/secure_fw/partitions/protected_storage"

However for custompartitiontest it doesn't seem to have been included.

However I don't know how to add it/what file needs to be modified so that the compiler adds the I flag for the generated directory.
Does anybody know how the error might be fixed?

(Just for completeness here the full file-structure in the folder under /home/usern/testapplicationone/build_1/tfm/generated/secure_fw/partitions/custompartitiontest/ with timestamps is:
-auto_generated (folder)
--intermedia_tfm_custompartitiontest.c (Timestamp: 2024-06-10 11:40:26.323433245 +0200)
--load_info_tfm_custompartitiontest.c (Timestamp: 2024-06-10 11:40:26.327433245 +0200)
-psa_manifest (folder)
--tfm_custompartitiontest.h (Timestamp: 2024-06-10 11:40:26.323433245 +0200)
)

Thanks in advance for any help

[Sigurd Hellesvik]

Hi,

Firstly, if you use "Insert->Code" to insert logs, that will make the ticket a bit more tidy.
This can also be done in edit of the ticket and comments to clean up previous ones.

For the issue at hand:
Have you tried our TF-M secure peripheral partition sample which shows how to make a custom secure partition?

Regards,
Sigurd Hellesvik

[gdl]

Hey thanks for your reply. I have changed the logs to code-formatting.

Sigurd Hellesvik said:

For the issue at hand:
Have you tried our TF-M secure peripheral partition sample which shows how to make a custom secure partition?

I have now tried the secure peripheral partition example and when deactivating my own custom partition can successfully build it. (I also previously tried the tfm_hello_world example and building and flashing my own nonsecure-partition code and those worked too.)

The linked secure peripheral sample guide seems to be mainly about how to configure peripherals (and doesn't directly show how to add your own secure partition) if i don't misunderstand it?
The guide also states "For more information on how to add custom secure partitions, see TF-M secure partition integration guide."

full-quote here:

"The sample demonstrates how to configure peripherals as secure peripherals and use them in the secure partition. In this way, the peripheral is only accessible from Secure Processing Environment (SPE), or from the secure partition with isolation level 2 or higher.

The secure partition is located in the secure_peripheral_partition directory. It contains the partition sources, build files and build configuration files. The partition is built by the TF-M build system. See TF-M Build System for more details.

For more information on how to add custom secure partitions, see TF-M secure partition integration guide."

I have followed the TF-M secure partition integration guide (from the docs.nordicsemi.com documentation, but it seems to be the same content) and changed the following files:

created c-files:
/home/usern/ncs/modules/tee/tf-m/trusted-firmware-m/secure_fw/partitions/custompartitiontest/tfm_custompartitiontest.c
/home/usern/ncs/modules/tee/tf-m/trusted-firmware-m/secure_fw/partitions/custompartitiontest/tfm_custompartitiontest.h
/home/usern/ncs/modules/tee/tf-m/trusted-firmware-m/secure_fw/partitions/custompartitiontest/funktionssammlung.c
/home/usern/ncs/modules/tee/tf-m/trusted-firmware-m/secure_fw/partitions/custompartitiontest/funktionssammlung.h

created configuration files:
/home/usern/ncs/modules/tee/tf-m/trusted-firmware-m/secure_fw/partitions/custompartitiontest/CMakeLists.txt
/home/usern/ncs/modules/tee/tf-m/trusted-firmware-m/secure_fw/partitions/custompartitiontest/tfm_custompartitiontest.yaml
/home/usern/ncs/modules/tee/tf-m/trusted-firmware-m/secure_fw/partitions/custompartitiontest/Kconfig

modified configuration files (different directories separated by blank line):
/home/usern/ncs/modules/tee/tf-m/trusted-firmware-m/secure_fw/partitions/CMakeLists.txt
/home/usern/ncs/modules/tee/tf-m/trusted-firmware-m/secure_fw/partitions/Kconfig

/home/usern/ncs/modules/tee/tf-m/trusted-firmware-m/secure_fw/CMakeLists.txt

/home/usern/ncs/modules/tee/tf-m/trusted-firmware-m/tools/tfm_manifest_list.yaml

/home/usern/ncs/modules/tee/tf-m/trusted-firmware-m/config/config_base.cmake

I have already rechecked the steps, but something must be erroneous, leading to the auto-generated files being generated and the compiler trying to compile the .c file, but not finding the .h file.
It doesn't find the .h file because the I flag is missing, but I don't understand what could cause the I flag to be missing?

[gdl]

After rewriting it several times it still doesn't work, but i instead used the code in an out-of-tree secure partition and that built correctly and could also be flashed.

[Sigurd Hellesvik]

Good find!

Yes I think it makes sense to use an out-of-tree secure partition.

Our TF-M implementation is quite intertwined with the nRF Connect SDK, so I think it would be a bit hard to create your secure partition in tree.
We also recommend that you never change the nRF Connect SDK if possible, which is an another argument against doing this in-tree.