2411206_en-US

[#1]

[Urgent]S32N55 GrayVIP HSE MAC service returns KEY_EMPTY (0xA5AA5317) when called from SEM task

Hello.

Could you please check for this issue?

Environment:

SW32N5_GRAYVIP_1.0.25.0
Trying to re-install SMRs at runtime (for OTA) via a custom SEM task job

What I did:

Added a custom SEM command that triggers SMR re-installation from Fss_Sem_PerformHSERequests (SEM task context)
SMR signing uses AES-256 CMAC via HSE_SRV_ID_MAC (GenerateMAC), key installed in an AES NvmKeyGroup (MuMask = MU_0)
The HSE request is sent via Fss_Sem_SendServiceRequest(FSS_SEM_CSSI_MU0, ...), same path as PublishSysImage

Problem:

The MAC service request is accepted (send returns OK), but the HSE response is 0xA5AA5317 (HSE_SRV_RSP_KEY_EMPTY)
The same CMAC key and key slot work correctly during the initial boot-time SMR installation
Only when called from the SEM task (runtime) does it return KEY_EMPTY
PublishSysImage (read-only, no key) from the same SEM task works fine

Question:

Is runtime SMR re-installation (after initial provisioning) a supported workflow? If so, what is the recommended approach?
Why would the same key slot report KEY_EMPTY only in the SEM task context, when it works at boot time? Is there a MU/partition or key-catalog access restriction after secure boot is enabled?

Re: [Urgent]S32N55 GrayVIP HSE MAC service returns KEY_EMPTY (0xA5AA5317) when called from SEM task

Hello, @EddiePark 

Thanks for your post and glad to support again.

From my understanding, the keys linked with a SMR entry will become unavailable after successful installation of the SMR entry. Which may be the reason that the same key could not be used correctly during run time.

BR

Chenyin