S32K3XX HSE Firmware

[KadirY]

Greetings,

Within the "S32K3XX SECURITY OVERVIEW AND BRING UP" document, there is a figure showing the locations of the HSE Firmware. For the S32K3 series, the HSE Firmware is located in the internal flash, while for the more secure S32G2 and S32R41 series chips, it is situated in secure external flash. You can view the figure and the document in the attachments. Since the internal flash is accessible during runtime, I am concerned that it can be edited, raising concerns over the Secure Boot of the platform.

1-) Is the placement of HSE Firmware in the internal flash a drawback?

2-) Can it be tampered with in any way?

3-) Is there a method to detect such tampering and halt the MCU boot (this is needed for Secure Boot) ?

4-) What precautions can be implemented to address security concerns related to this issue?

Thanks in advance.

KadirY

[lukaszadrapa · Accepted solution]

Hi @KadirY 

The HSE firmware is placed to internal flash but this flash is not accessible for user after installation of HSE firmware. Part(s) of flash used for HSE firmware are removed from the memory map and HSE has exclusive access to this flash. So, there are no security concerns. It is ensured by internal design / internal features that user can't access it.

Regards,

Lukas

[Sanjana_k]

then we need to get access to secure files first before firmware flashing onto the board right ?