Hi Bohdan,

You’re right, TF-M currently uses a mix of relative and absolute paths. There is a plan to switch everything to relative paths where possible, but priority was low since the current solution has been working. With your report, we will revisit that plan. Tentatively, I’d think around Q1’26, though we still need to look into the scope and side effects.

Your contribution would be very welcome as well. If you’re planning to work on this, please let me know to avoid duplication.

Best regards,
Anton

From: Bohdan.Hunko--- via TF-M <tf-m@lists.trustedfirmware.org>
Sent: Wednesday, December 10, 2025 2:52 PM
To: tf-m@lists.trustedfirmware.org
Cc: Ivan.Kozemchuk@infineon.com
Subject: [TF-M] Issue with absolute paths in exported targets

Hi all,

I have noticed an issue with absolute paths in exported targets:

Background:

During Secure build some header file paths are added to include directories of tfm_config (and some other targets) – for example TARGET_CONFIG_HEADER_FILE, PROJECT_CONFIG_HEADER_FILE
Then tfm_config is exported to install directory and is used in Non-Secure build

There are several issues here:

In Non-Secure build exported tfm_config uses absolute paths that ware defined during secure build. This is an issue as NS-interface (api_ns folder) may be built on another machine.
Also looking into api_ns folder – I don’t see those files being exported (for example TARGET_CONFIG_HEADER_FILE, PROJECT_CONFIG_HEADER_FILE are not exported to api_ns)

Looking into a code I was able to identify at least these defines that are effected (but list may be longer):

i. TARGET_CONFIG_HEADER_FILE

ii. PROJECT_CONFIG_HEADER_FILE

iii. MBEDTLS_PSA_CRYPTO_CONFIG_FILE

iv. MBEDTLS_CONFIG_FILE

Is there a plan to somehow solve this issue? If so, then what is the schedule on it?

Bohdan Hunko

Cypress Semiconductor Ukraine LLC

Senior Engineer

CSS ICW SW INT BFS SFW

Mobile: +380995019714
Bohdan.Hunko@infineon.com