HSE_SRV_ID_FORMAT_KEY_CATALOGS returns NOT_ALLOWED on S32K344

[JasonB1]

Hello,

I am currently working with the S32K344EVB-Q172 + HSE-B, using S32DS 3.6.1, RTD 6.0.0, and a PEmicro debug probe.

While my AES/CMAC flow is working correctly, I am unable to enable EdDSA. The HSE_SRV_ID_FORMAT_KEY_CATALOGS service consistently returns NOT_ALLOWED, even though the device is in the following state:

- Lifecycle = CUST_DEL (0x04)

- INSTALL_OK = 0

- CUST_SU = 1

I have already tried the following troubleshooting steps:

- Applying a custom AES+ECC catalog

- Using a generated catalog

- Running the CQC Demo

- Reinstalling the HSE FW (S32K344_HSE_FW_INSTALL)

- Executing HSE_SRV_ID_ERASE_HSE_NVM_DATA

- Power cycling and re-initializing

Unfortunately, all of these attempts still result in the same NOT_ALLOWED error.

I have a few questions regarding this behavior:

1. Is this NOT_ALLOWED response expected if the board was previously formatted or provisioned?

2. Does the NVM Data Erase command remove only the keys, while leaving the existing catalog structure intact?

3. Is there any supported way to completely reformat the HSE key catalog on this specific board using PEmicro and S32DS?

4. If not, does this situation require a fresh board, or is there an alternative provisioning flow I should follow?

Thank you in advance for your time and assistance.

[lukaszadrapa]

Hi @JasonB1 

Could you share your catalogs?

Take a look at section “6.1.5.3 Key catalog formatting” in HSE firmware reference manual rev. 2.7. There’s a list of reasons why the formatting may fail.

Isn’t that data cache issue? Did you try to turn off data cache in your project?

Service HSE_SRV_ID_ERASE_HSE_NVM_DATA erases all HSE data including key catalogs. This is the right way to start over.

Regards,

Lukas

[JasonB1]

Hi Lukas, thank you for the response.

it was a data cache / DMA access issue. The key catalog arrays were declared as const (placed in Flash .rodata), and HSE DMA couldn't access them. Removing const to place them in SRAM resolved the NOT_ALLOWED issue.

FormatKeyCatalogs now returns OK, and AES Import + CMAC verify are working.

Thank you for the pointer!

One follow-up question: after FormatKeyCatalogs succeeds (with AES + ECC_PAIR groups), HSE_SRV_ID_KEY_GENERATE for Ed25519 returns 0x5A3C1769 (non-standard response). Is this also a DMA/cache issue with the public key output buffer? Or is there another
reason?