S32KのトピックRe: HSE_SRV_ID_GET_KEY_INFO service return - HSE_SRV_RSP_NOT_ALLOWED responce

HSE_SRV_ID_GET_KEY_INFO service return - HSE_SRV_RSP_NOT_ALLOWED responce

KaleRushikesh — Fri, 01 May 2026 15:18:50 GMT

I am working with the HSE on an S32K3 device and have successfully imported an AES-128 key into NVM using the IMPORT_KEY service. The import service completes without error.

To verify the key, I am using the GET_KEY_INFO service descriptor as shown below-

static hseSrvResponse_t App_GetKeyInfo
(
    const uint8 u8MuInstance,
    hseKeyInfo_t* pAes128NvmKeyInfo
)
{
    hseSrvDescriptor_t* pHseSrvDescriptor;
    hseGetKeyInfoSrv_t* pHseGetKeyInfo;

    pHseSrvDescriptor = &Hse_aSrvDescriptor[MU_ADMIN_CHANNEL_U8];
    memset(pHseSrvDescriptor, 0, sizeof(hseSrvDescriptor_t));

    pHseGetKeyInfo = &(pHseSrvDescriptor->hseSrv.getKeyInfoReq);

    pHseSrvDescriptor->srvId = HSE_SRV_ID_GET_KEY_INFO;
    pHseGetKeyInfo->keyHandle = GET_KEY_HANDLE(HSE_KEY_CATALOG_ID_NVM, 1U, 0U);
    pHseGetKeyInfo->pKeyInfo = (HOST_ADDR)pAes128NvmKeyInfo;

    HseIp_aRequest[MU_ADMIN_CHANNEL_U8].eReqType   = HSE_IP_REQTYPE_SYNC;
    HseIp_aRequest[MU_ADMIN_CHANNEL_U8].u32Timeout = TIMEOUT_TICKS_U32;

    return Hse_Ip_ServiceRequest(u8MuInstance, MU_ADMIN_CHANNEL_U8,
                                 &HseIp_aRequest[MU_ADMIN_CHANNEL_U8],
                                 pHseSrvDescriptor);}

However, when I call this service, the response is not HSE_SRV_RSP_OK. Instead, the service seems to return HSE_SRV_ID_GET_KEY_INFO.

My device is currently in CUST_DEL lifecycle state.

Here is the Aes import key service descriptor-

static hseSrvResponse_t App_AesLoadPlainNvmKey(void)

{

hseSrvResponse_t RetVal = HSE_SRV_RSP_GENERAL_ERROR;

hseSrvDescriptor_t *pHseSrvDescriptor;

uint8 u8MuChannel = Hse_Ip_GetFreeChannel(MU0_INSTANCE_U8);

keyInfo.keyBitLen = 128;

keyInfo.keyType = HSE_KEY_TYPE_AES;

keyInfo.keyFlags = ( HSE_KF_USAGE_DECRYPT | HSE_KF_USAGE_ENCRYPT | HSE_KF_USAGE_KEY_PROVISION );

keyInfo.keyCounter = 0; // first time while NVM key importing it should be greater than or equal to 0.

keyInfo.smrFlags = 0;

keyInfo.specific.aesBlockModeMask = HSE_KU_AES_BLOCK_MODE_ANY;

if(HSE_IP_INVALID_MU_CHANNEL_U8 != u8MuChannel)

{

pHseSrvDescriptor = &Hse_aSrvDescriptor[u8MuChannel];

memset(pHseSrvDescriptor, 0, sizeof(hseSrvDescriptor_t));

pHseSrvDescriptor->srvId = HSE_SRV_ID_IMPORT_KEY;

pHseSrvDescriptor->hseSrv.importKeyReq.keyLen[2] = 16;

pHseSrvDescriptor->hseSrv.importKeyReq.pKey[2] = HSE_PTR_TO_HOST_ADDR(App_au8AesNvmKey);

pHseSrvDescriptor->hseSrv.importKeyReq.pKeyInfo= HSE_PTR_TO_HOST_ADDR(&keyInfo);

pHseSrvDescriptor->hseSrv.importKeyReq.targetKeyHandle = GET_KEY_HANDLE(1,1,0);

// Both the fields given below must be configured.

pHseSrvDescriptor->hseSrv.importKeyReq.cipher.cipherKeyHandle= HSE_INVALID_KEY_HANDLE;

pHseSrvDescriptor->hseSrv.importKeyReq.keyContainer.authKeyHandle= HSE_INVALID_KEY_HANDLE;

/* Build the request to be sent to Hse Ip layer */

HseIp_aRequest[u8MuChannel].eReqType = HSE_IP_REQTYPE_SYNC;

HseIp_aRequest[u8MuChannel].u32Timeout = TIMEOUT_TICKS_U32;

/* Send the request to Hse Ip layer */

RetVal = Hse_Ip_ServiceRequest(MU0_INSTANCE_U8, u8MuChannel, &HseIp_aRequest[u8MuChannel], pHseSrvDescriptor);

}

return RetVal;

}

Re: HSE_SRV_ID_GET_KEY_INFO service return - HSE_SRV_RSP_NOT_ALLOWED responce

lukaszadrapa — Mon, 04 May 2026 08:10:02 GMT

Hi @KaleRushikesh

I can see nothing wrong, HSE_SRV_ID_GET_KEY_INFO is simple service, this should work.

Isn't that just data cache issue? Could you try to turn off the data cache to see if it makes a difference? All objects used for communication with HSE must be forced to non-cacheable memory.

Regards,

Lukas

Re: HSE_SRV_ID_GET_KEY_INFO service return - HSE_SRV_RSP_NOT_ALLOWED responce

KaleRushikesh — Mon, 04 May 2026 16:22:14 GMT

Hii @lukaszadrapa

1. As you can see in following line, the variable is placed in non-cacheable memory and that is verified.
/* The variables in the section below need to be put in non-cacheable memory area in order to be correctly seen by the HSE */
#define CRYPTO_START_SEC_VAR_CLEARED_UNSPECIFIED_NO_CACHEABLE
#include "Crypto_MemMap.h"

/* Variable where HSE will write (return) the supported capabilities */
static hseAttrCapabilities_t Hse_AttrCapabilities;
static hseAttrSecureLifecycle_t hseAttrSecureLifecycle;
static hseKeyInfo_t aes128NvmKeyInfo;

/* Variable where application will store the request of configuring (enabling/disabling) the MU instances */
static hseAttrMUConfig_t Hse_MuConfig;

#define CRYPTO_STOP_SEC_VAR_CLEARED_UNSPECIFIED_NO_CACHEABLE
#include "Crypto_MemMap.h"

#define CRYPTO_START_SEC_VAR_SHARED_CLEARED_UNSPECIFIED_NO_CACHEABLE
#include "Crypto_MemMap.h"

2. Also tried with disabling cache memory, the result is same.

Re: HSE_SRV_ID_GET_KEY_INFO service return - HSE_SRV_RSP_NOT_ALLOWED responce

lukaszadrapa — Tue, 05 May 2026 10:59:27 GMT

Now I noticed that you use MU_ADMIN_CHANNEL_U8 here (i.e. channel 0):

return Hse_Ip_ServiceRequest(u8MuInstance, MU_ADMIN_CHANNEL_U8,
                                 &HseIp_aRequest[MU_ADMIN_CHANNEL_U8],
                                 pHseSrvDescriptor);}

That's not correct. HSE_SRV_ID_GET_KEY_INFO service is not administrator service. It's not possible to use channel 0. You need to use channel 1 or higher. Then it will work as expected.

Regards,

Lukas

Re: HSE_SRV_ID_GET_KEY_INFO service return - HSE_SRV_RSP_NOT_ALLOWED responce

KaleRushikesh — Tue, 05 May 2026 17:17:51 GMT

Thanks @lukaszadrapa