topic Re: HSE active passive block fail in S32K

HSE active passive block fail

liangyouchao — Wed, 17 May 2023 02:54:48 GMT

CHIP: S32K312

LC: HSE_LC_CUST_DEL

HSE FW ver: 1.13.0.1.2.1

My code is 90KB, I copy 128KB data from address 0x00400000 to 0x00500000, and then execute the service HSE_SRV_ID_ACTIVATE_PASSIVE_BLOCK, but the hseSrvResponse code returns HSE_SRV_RSP_NOT_ALLOWED.

#define HSE_SRV_RSP_NOT_ALLOWED ((hseSrvResponse_t)0xAA55A21CUL) /**< @brief The operation is not allowed because of some restrictions (in attributes, life-cycle dependent operations, key-management, etc.). */

what could be the reason for this?

Re: HSE active passive block fail

lukaszadrapa — Thu, 18 May 2023 09:52:30 GMT

Hi @liangyouchao

Although the HSE RM does not specify the Super User (SU) right requirements for partition swap service, SU is needed.
LC CUST DEL has SU rights by default but user rights can be forced (from HSE RM):

"The execution rights after reset in LC states CUST_DEL and OEM_PROD can be forced to User rights configuring the “Start as User” option within hseAttrExtendCustSecurityPolicy_t and hseAttrExtendOemSecurityPolicy_t attributes."

Could you confirm you are not forcing user rights?

Also, it should be noted that the partition swap service ACTVATE Passive block can be given once in a reset cycle, so if you call the service twice it also returns error "HSE_SRV_RSP_NOT_ALLOWED".

Regards,

Lukas

Re: HSE active passive block fail

liangyouchao — Mon, 22 May 2023 09:33:19 GMT

Hi Lukas, Thank you for your reply.

My project is a basic project, s32k312 HSE function has just started testing, I have not done any operations, such as advance LC, program ADPK key, and format HSE key catalogs, etc., so the chip status is default.

The test code and allowed results are shown in the following figure：

void hse_init() { hseStatus_t HseStatus; hseSrvResponse_t HseSrvResponse; OsIf_Init(NULL_PTR); Crypto_Init(NULL_PTR); HostFlash_Init(); /* read HSE FW Version */ HseSrvResponse = HSE_GetVersion(&HseFwVersion); LOGI("HSE Version: %d.%d.%d.%d.%d.%d\r\n", HseFwVersion.reserved, HseFwVersion.socTypeId, HseFwVersion.fwTypeId, HseFwVersion.majorVersion, HseFwVersion.minorVersion, HseFwVersion.patchVersion); /* read Lifecycle */ HseSrvResponse = HSE_ReadLifecycle(&HseAttrSecureLifecycle); LOGI("HseAttrSecureLifecycle: %d\r\n", HseAttrSecureLifecycle); /* read AttrExtendCustSecurityPolicy */ HseSrvResponse = HSE_ReadAttrExtendCustSecurityPolicy(&HseAttrExtendCustSecurityPolicy); LOGI("HseAttrExtendCustSecurityPolicy: enableADKm = %d, startAsUser = %d\r\n", HseAttrExtendCustSecurityPolicy.enableADKm, HseAttrExtendCustSecurityPolicy.startAsUser); /* copy active data to passive */ HostFlash_PassiveUpgradeTest(); LOGI("HostFlash_PassiveUpgrade success\r\n"); /* ab swap */ HseSrvResponse = HSE_ActivatePassiveBlock(); if (HSE_SRV_RSP_OK != HseSrvResponse) LOGI("HSE_ActivatePassiveBlock fail [error_code: 0x%x]\r\n", HseSrvResponse); else LOGI("HSE_ActivatePassiveBlock success\r\n"); } #define MU0 (0) #define HSE_ADMIN_CHANNEL (0) hseSrvResponse_t HSE_ActivatePassiveBlock(void) { hseSrvResponse_t hseStatus = HSE_SRV_RSP_GENERAL_ERROR; uint8_t u8MuChannel = HSE_ADMIN_CHANNEL; hseSrvDescriptor_t* pHseSrvDesc; pHseSrvDesc = &gHseSrvDesc[MU0][u8MuChannel]; memset(pHseSrvDesc, 0, sizeof(hseSrvDescriptor_t)); pHseSrvDesc->srvId = HSE_SRV_ID_ACTIVATE_PASSIVE_BLOCK; hseStatus = HSE_Send(MU0, u8MuChannel, gSyncTxOption, pHseSrvDesc); /* wait for positive response */ ASSERT(HSE_SRV_RSP_OK == hseStatus); return hseStatus; }

Re: HSE active passive block fail

lukaszadrapa — Wed, 24 May 2023 08:19:36 GMT

Hi @liangyouchao

please try to update the FW to latest version which is 0.2.6.0.

The correct file for AB Swap version (which ensures that OTA flag is enabled by HSE) is this one:

s32k3x2_hse_fw_1.13.0_2.6.0_pb221129.bin.pink

Update also the SBAF. It can be found in the 0.2.6.0 FW package too. It will ensure that all the HSE services will be available.

Regards,

Lukas

Re: HSE active passive block fail

MengWang1 — Thu, 25 May 2023 08:17:33 GMT

Hi Lukas,

I have updated HSE_FW_S32K3XX_0_2_6_0. How do I update SBAF

Re: HSE active passive block fail

lukaszadrapa — Thu, 25 May 2023 13:20:51 GMT

If you use scripts from the demo app, you can just select in T32:

The SBAF can be found here:

c:\NXP\HSE_FW_S32K3XX_0_2_6_0\hse_full_mem\sbaf\bin\s32k3x2_Secure_Baf_0.13.0_0.9.0_pb220502.bin.pink

Or it is described in the HSE Firmware Reference Manual in section 12.7 Secure-BAF update.

In short, it's necessary to load the pink file somewhere to flash and then call service HSE_SRV_ID_SBAF_UPDATE.

Regards,

Lukas

Re: HSE active passive block fail

huangmingsong — Thu, 01 Feb 2024 18:15:12 GMT

Hi，I will update SBAF，but return HSE_SRV_RSP_NOT_ALLOWED，why ？