Not Modifiable Flash

[addisonaudette1]

I would like to protect the internal flash regions containing the boot image and application image on the S32k board. The images are stored in Program Flash (PFlash), with related application data potentially stored in Data Flash (DFlash).

Is there a way to make the selected regions non-writable and non-erasable after the approved software is programmed. Ideally, this protection would prevent modification through application software, JTAG/debug access, programming tools, mass erase, recovery mechanisms, and lifecycle transitions.

Does the S32K344 provide a permanent mechanism for making selected PFlash or DFlash sectors non-writable and non-erasable?

If permanent protection is unavailable, what is NXP’s recommended configuration for the strongest reversible protection?

Is there any supported hardware-based method, such as a dedicated pin or jumper-controlled signal, that can enable or prevent programming of internal PFlash and DFlash?

[petervlna]

Hello,

S32K344 does not provide a user-accessible OTP mechanism to permanently lock arbitrary PFlash or DFlash sectors against erase/write.

There is not mechanism equivalent to the MPC57xx OTP flash-sector locking clients is available on S32K344.

Protection of boot and application images is intended to be implemented using the HSE security architecture (secure boot, lifecycle management, debug authentication, and authenticated firmware update), rather than permanent OTP locking of PFlash sectors.

Best regards,

Peter

[addisonaudette1]

Is there a hardware-level method to disable or physically restrict JTAG or another programming interface from accessing, erasing, or modifying the S32K344 internal PFlash and DFlash (permanently or not) like physically isolating the JTAG signals, removing the debug connection, or controlling access through external hardware for example?