S32K3 Secure Boot activation timing question

[minjaekang99]

Hello, I am working with Secure Boot on the S32K324 (HSE firmware), and I want to confirm whether my understanding is correct.

1. Once Secure Boot is activated and the SMR/CR entries are provisioned, will the device refuse to boot if the application firmware changes even by one byte (e.g., code modification, rebuild, RTD version change, etc.) because the hash/signature no longer matches?

2. Given this behavior, is the recommended workflow to complete all firmware development first, finalize the application image, and activate Secure Boot only at the very end of the project (since any further code changes would cause Secure Boot verification to fail)?

Thank you in advance for your clarification.

[lukaszadrapa]

Hi @minjaekang99 

1. This is described in section "7.10.4 Sanctions" in HSE firmware reference manual. If the secure boot fails, alternate image can be executed (if configured). If it fails too, the device enters recovery mode. Or you can only disable usage of individual keys (based on smrFlags) or all keys. Or the device can be reset and it can enter a recovery mode after 8 resets... See mentioned section in the manual for more details and also check HSE Service API reference manual. 

2. Yes, common way is to finalize your application and then start with configuration of secure boot. 

Regards,

Lukas

[minjaekang99]

Can anyone answer this question?