S32K344 SMR Entry Install Service Fail with Invalid Param, Not Supported, and Not Allowed Error Code

[Feifan]

I'm trying to set up advanced secure boot for S32K344. While setting up and running the HSE SMR entry install service, I keep getting a mix of following error codes: HSE_SRV_RSP_INVALID_PARAM, HSE_SRV_RSP_NOT_SUPPORTED, and HSE_SRV_RSP_NOT_ALLOWED. Could you guys help take a look at this? Thanks in advance!

The algo i'm using is ECDSA P-256 + SHA2-256.

I've double checked that:
Instruction cache is turned off
Data cache is turned off
MPU is turned off
SMR region is inside internal code flash, thus memory mapped
XRDC configuration is at default, so HSE should be able to access the code flash
Public key used is set to verify only
Has super user access and in CUST_DEL state
Erased SMR before install service

Below is a snippet of the code:
#define APP_BL_START_ADDR (0x00401000)
#define APP_BL_SIZE (0x1000)

#define APP_BL_SIGNATURE_R_START_ADDR (0x0041ff00)
#define APP_BL_SIGNATURE_R_SIZE (0x20)
#define APP_BL_SIGNATURE_S_START_ADDR (0x0041ff80)
#define APP_BL_SIGNATURE_S_SIZE (0x20)

// key handle for the ecc public key
hseKeyHandle_t verif_key_handle =
    (hseKeyHandle_t)GET_KEY_HANDLE(HSE_KEY_CATALOG_ID_NVM, 0, 0);

// function call to import the public key, HSE returned good status

// set up the signature scheme also the hash algo for signing
hseAuthScheme_t auth_scheme;
auth_scheme.sigScheme.signSch = HSE_SIGN_ECDSA;
auth_scheme.sigScheme.sch.ecdsa.hashAlgo = HSE_HASH_ALGO_SHA2_256;

// set up the decryption scheme, in this case we're not doing
// encryption/decryption
hseSmrDecrypt_t decryption_scheme;
decryption_scheme.decryptKeyHandle = HSE_SMR_DECRYPT_KEY_HANDLE_NOT_USED;

hseSmrConfig_t smr_config = HSE_SMR_CFG_FLAG_INSTALL_AUTH;

// gs_bl_smr_entry is located inside non-cached memory
gs_bl_smr_entry.pSmrsrc=(HOST_ADDR)APP_BL_START_ADDR;
gs_bl_smr_entry.smrSize = APP_BL_SIZE;
gs_bl_smr_entry.pSmrDest = 0;
gs_bl_smr_entry.configFlags = smr_config;
gs_bl_smr_entry.checkPeriod = 0;
gs_bl_smr_entry.authKeyHandle = verif_key_handle;
gs_bl_smr_entry.authScheme = auth_scheme;
gs_bl_smr_entry.pInstAuthTag[0] = (HOST_ADDR)(APP_BL_SIGNATURE_R_START_ADDR);
gs_bl_smr_entry.pInstAuthTag[1] = (HOST_ADDR)(APP_BL_SIGNATURE_S_START_ADDR);
gs_bl_smr_entry.smrDecrypt = decryption_scheme;
gs_bl_smr_entry.versionOffset = HSE_SMR_VERSION_NOT_USED;

// SMR install service, service descriptor is also inside non-cached memory
hse_srv_desc_ptr->srvId = HSE_SRV_ID_SMR_ENTRY_INSTALL;
smr_entry_install_ptr->accessMode = HSE_ACCESS_MODE_ONE_PASS;
smr_entry_install_ptr->entryIndex = 0;
smr_entry_install_ptr->pSmrEntry = (HOST_ADDR)&gs_bl_smr_entry;

smr_entry_install_ptr->pSmrData = (HOST_ADDR)APP_BL_START_ADDR;
smr_entry_install_ptr->smrDataLength = APP_BL_SIZE;
smr_entry_install_ptr->pAuthTag[0] = (HOST_ADDR)APP_BL_SIGNATURE_R_START_ADDR;
smr_entry_install_ptr->pAuthTag[1] = (HOST_ADDR)APP_BL_SIGNATURE_S_START_ADDR;
smr_entry_install_ptr->authTagLength[0] = 256;
smr_entry_install_ptr->authTagLength[1] = 256;

// send service descriptor to hse

[Feifan · Accepted solution]

Found the root cause being MPU is not properly disabled. Once the MPU is properly disabled, this works.