HSE active passive block fail

[liangyouchao]

CHIP:     S32K312

LC:    HSE_LC_CUST_DEL

HSE FW ver:    1.13.0.1.2.1

My code is 90KB, I copy 128KB data from address 0x00400000 to 0x00500000, and then execute the service HSE_SRV_ID_ACTIVATE_PASSIVE_BLOCK, but the hseSrvResponse code returns HSE_SRV_RSP_NOT_ALLOWED.

#define HSE_SRV_RSP_NOT_ALLOWED                 ((hseSrvResponse_t)0xAA55A21CUL)  /**< @brief The operation is not allowed because of some restrictions (in attributes, life-cycle dependent operations, key-management, etc.). */

what could be the reason for this?

[lukaszadrapa]

Hi @liangyouchao 

Although the HSE RM does not specify the Super User (SU) right requirements for partition swap service, SU is needed.
LC CUST DEL has SU rights by default but user rights can be forced (from HSE RM):

"The execution rights after reset in LC states CUST_DEL and OEM_PROD can be forced to User rights configuring the “Start as User” option within hseAttrExtendCustSecurityPolicy_t and hseAttrExtendOemSecurityPolicy_t attributes."

Could you confirm you are not forcing user rights?

Also, it should be noted that the partition swap service ACTVATE Passive block can be given once in a reset cycle, so if you call the service twice it also returns error "HSE_SRV_RSP_NOT_ALLOWED".

Regards,

Lukas

[liangyouchao]

Hi Lukas, Thank you for your reply.

My project is a basic project, s32k312 HSE function has just started testing, I have not done any operations, such as advance LC, program ADPK key, and format HSE key catalogs, etc., so the chip status is default.

The test code and allowed results are shown in the following figure：

void hse_init()
{
    hseStatus_t        HseStatus;
    hseSrvResponse_t   HseSrvResponse;

    OsIf_Init(NULL_PTR);

    Crypto_Init(NULL_PTR);

    HostFlash_Init();

    /* read HSE FW Version */
    HseSrvResponse = HSE_GetVersion(&HseFwVersion);
    LOGI("HSE Version: %d.%d.%d.%d.%d.%d\r\n", HseFwVersion.reserved, HseFwVersion.socTypeId, HseFwVersion.fwTypeId, 
    HseFwVersion.majorVersion, HseFwVersion.minorVersion, HseFwVersion.patchVersion);

    /* read Lifecycle */
    HseSrvResponse = HSE_ReadLifecycle(&HseAttrSecureLifecycle);
    LOGI("HseAttrSecureLifecycle: %d\r\n", HseAttrSecureLifecycle);

    /* read AttrExtendCustSecurityPolicy */
    HseSrvResponse = HSE_ReadAttrExtendCustSecurityPolicy(&HseAttrExtendCustSecurityPolicy);
    LOGI("HseAttrExtendCustSecurityPolicy: enableADKm = %d, startAsUser = %d\r\n", 
        HseAttrExtendCustSecurityPolicy.enableADKm, HseAttrExtendCustSecurityPolicy.startAsUser);

    /* copy active data to passive */
    HostFlash_PassiveUpgradeTest();
    LOGI("HostFlash_PassiveUpgrade success\r\n");

    /* ab swap */
    HseSrvResponse = HSE_ActivatePassiveBlock();
    if (HSE_SRV_RSP_OK != HseSrvResponse)
        LOGI("HSE_ActivatePassiveBlock fail [error_code: 0x%x]\r\n", HseSrvResponse);
    else 
        LOGI("HSE_ActivatePassiveBlock success\r\n");
}

#define MU0 (0)
#define HSE_ADMIN_CHANNEL (0)

hseSrvResponse_t HSE_ActivatePassiveBlock(void)
{
    hseSrvResponse_t hseStatus = HSE_SRV_RSP_GENERAL_ERROR;
    uint8_t u8MuChannel = HSE_ADMIN_CHANNEL; 
    hseSrvDescriptor_t* pHseSrvDesc;

    pHseSrvDesc = &gHseSrvDesc[MU0][u8MuChannel];
    memset(pHseSrvDesc, 0, sizeof(hseSrvDescriptor_t));

    pHseSrvDesc->srvId = HSE_SRV_ID_ACTIVATE_PASSIVE_BLOCK;
    hseStatus = HSE_Send(MU0, u8MuChannel, gSyncTxOption, pHseSrvDesc);

    /* wait for positive response */
    ASSERT(HSE_SRV_RSP_OK == hseStatus);
    return hseStatus;
}

[lukaszadrapa · Accepted solution]

Hi @liangyouchao 

please try to update the FW to latest version which is 0.2.6.0.

The correct file for AB Swap version (which ensures that OTA flag is enabled by HSE) is this one:

s32k3x2_hse_fw_1.13.0_2.6.0_pb221129.bin.pink

Update also the SBAF. It can be found in the 0.2.6.0 FW package too. It will ensure that all the HSE services will be available.

Regards,

Lukas

[MengWang1]

Hi Lukas,

I have updated HSE_FW_S32K3XX_0_2_6_0. How do I update SBAF

[lukaszadrapa]

If you use scripts from the demo app, you can just select in T32:

 The SBAF can be found here:

c:\NXP\HSE_FW_S32K3XX_0_2_6_0\hse_full_mem\sbaf\bin\s32k3x2_Secure_Baf_0.13.0_0.9.0_pb220502.bin.pink

Or it is described in the HSE Firmware Reference Manual in section 12.7 Secure-BAF update.

In short, it's necessary to load the pink file somewhere to flash and then call service HSE_SRV_ID_SBAF_UPDATE.

Regards,

Lukas

[huangmingsong]

Hi，I will update SBAF，but return HSE_SRV_RSP_NOT_ALLOWED，why ？