...
1.3.2.1 Secure and Non-Secure project organization
Renesas e2studio/FSP simplified simplifies Trust Zone support implementation by allowing having S project and the corresponding NS project to co-exist and interoperate in the same workspace, such that when the compiled firmware is loaded into the MCU, S code/data are loaded into the TZ-protected memory, and NS code/data are loaded into NS memory.
For every new NPI device requiring firmware, the BMS Firmware team will develop a complete catalog solution comprised of both S parts and NS parts.
If the MCU paired with the device supports TZ, then the BMS Firmware team will put the S parts in the S project, and the NS parts in the NS project. The combined catalog firmware pre-programed in the device during production. Instead of distributing both S project and NS projects, BMS Firmware team shall only distribute the Secure Bundle to customers and BMS apps team. The Secure Bundle comprises of NS source code plus the .sbd file containing linking information so that NS code can link to the S code without having the S source code.
With the Secure Bundle, both customers and BMS apps team can customize the catalog firmware and reclaim the NS code/data footprint, as is illustrated by the below figure. This process enables creation of a catalog device, and permitting the same catalog device to be customized. That means customers only needs to maintain a single inventory for all future customization based on the same version of firmware IP. This also means that whenever a major firmware IP is introduced, a new catalog device with a different part number is also introduced requiring separate inventory.
- Describe Secure Bundle distribution model
- How to place "secret sauce" in secure memory
- How to call S code from NS code
- How to call NS code from S code
...