2399723_en-US

Yes

S32K396: device locked / asks for ADKP after HSE FW install over MU stopped mid-way

Setup

S32K396, no HSE FW ever installed, no secure boot, no ADKP.
FS26 with 200ms watchdog

What happened

I was installing the AB_SWAP pink image over the MU interface

1. Programmed the HSE FW usage flag in UTEST at 0x1B000000. No other UTEST location touched. SBAF had not programmed it itself despite `FW_USAGE_FLAG_PROGRAM` being set in my boot config.
2. Wrote 0xA5 into DCMRWP1 (0x402AC400) bits 31 to 24 and issued a functional reset.
3. Ran the handshake on MU0 ch0: got 0xFF00F00F, replied 0xF0F00F0F, got 0xDADABABA, wrote the
pink image address. so SBAF started programming the firmware.
4. Sometime after that, everything halted. Nothing more on the UART console. I power-cycled after ~5 minutes.

Since then the board produces no console output at all, and I can no longer debug it the way I normally do: J-Link reports "Locked S32K3xx device detected" and asks for the ADKP. Or reports "Power-up of DAP failed" (See attached file). So I cannot read GPR3, DCMRWP1 or UTEST any more.

I never provisioned an ADKP and never requested a life-cycle advance.

Questions

1. Could the LC have advanced by itself?

2. Or is this recovery mode? In JTAG recovery mode on a CUST_DEL device, can a J-Link connection present as
"locked / password required"? Figure 12 in the HSE_B Firmware Reference manual shows that path as waiting for a debugger without authentication.

3. What can I still test before scrapping the part? Above all: is there any way to read the current LC state over the debug interface when the host core is not released? Or is it possible another debug method using Trace32 would work better?

Re: S32K396: device locked / asks for ADKP after HSE FW install over MU stopped mid-way

1) No, it cannot. It can be programmed either by user directly to UTEST (when HSE FW is not used) or with using of HSE service (when HSE FW is used).

2) I don’t think so, although I don’t have experience with J-Link. It is possible "Locked S32K3xx device detected" message

Yes, the "Locked S32K3xx device detected" message can be a false positive caused by hardware (typically power) rather than an actual security lock. I would recommend to discuss it with Segger:

https://www.segger.com/support/technical-support/

Even the device would be in JTAG recovery mode, if still in CUST_DEL life cycle, you still should be able to connect by debugger, download SW and so.

3) I would try to attach or attach just after POR, possibly erase application SW.

Re: S32K396: device locked / asks for ADKP after HSE FW install over MU stopped mid-way

What I've noticed now is that the 'RESET_RECOVERY_MODE' bit was not set in the BCW. Could not setting this bit in the BCW explain this behavior?

Im a bit confused as to what setting this bit does. Will setting this bit enable recovery mode or disable it?

In `Table 119. BCW bit mapping` in the HSE reference manual its written that 'RESET_RECOVERY_MODE' is "Used to disable entry into recovery mode because of consecutive resets. See Disable Entry into Reset Recovery Mode for more detail".

Then In the chapter `2.6.1.3.3 Disable entry into reset recovery mode` in the HSE reference manual "Entry into recovery mode" is only true while 'RESET_RECOVERY_MODE == 1 AND DCMRWP1 (SBAF_REC_DIS_FRST or SBAF_REC_DIS_DRST) == 0'.

Re: S32K396: device locked / asks for ADKP after HSE FW install over MU stopped mid-way

Thank you for your reply, David.

Okay.
I have reached out to Segger regarding the possibility of a falsely locked device and am awaiting a response.
I connected using the J-Link debugger after a POR while shorting the reset pin. This is the log from that sequence:
In this case, the HSE firmware is not installed, nor is the device locked. The error that remains from both scenarios is the DAP error.

SEGGER J-Link Commander V9.18 (Compiled Feb 11 2026 16:34:58)
DLL version V9.18, compiled Feb 11 2026 16:33:51

Connecting to J-Link via USB...O.K.
Firmware: J-Link V10 compiled Jan 30 2023 11:28:07
Hardware version: V10.10
J-Link uptime (since boot): N/A (Not supported by this model)
S/N: 50116795
License(s): GDB
VTref=4.509V

Type "connect" to establish a target connection, '?' for help
J-Link>connect
Please specify device / core. : S32K396_M7_0
Type '?' for selection dialog
Device>
Please specify target interface:
J) JTAG (Default)
S) SWD
T) cJTAG
TIF>S
Specify target interface speed [kHz]. : 4000 kHz
Speed>
Device "S32K396_M7_0" selected.

Connecting to target via SWD
ConfigTargetSettings() start
ConfigTargetSettings() end - Took 46us
InitTarget() start
SDA_AP detected
Unlocking device if necessary...
Device is not locked. Proceeding without the unlock procedure.
Checking if debug access is already enabled...
Debug access is not enabled yet. Performing enable debug access sequence...
Debug access enabled
Checking if HSE firmware is installed...
HSE firmware not installed
Checking if Cortex-M7_0 and Cortex-M7_1 are operating in lockstep mode
Lock step mode enabled
InitTarget() end - Took 45.5ms
Found SW-DP with ID 0x6BA02477
DPIDR: 0x6BA02477
CoreSight SoC-400 or earlier
AP map detection skipped. Manually configured AP map found.
AP[0]: MEM-AP (IDR: Not set, ADDR: 0x00000000)
AP[1]: APB-AP (IDR: Not set, ADDR: 0x00000000)
AP[2]: MEM-AP (IDR: Not set, ADDR: 0x00000000)
AP[3]: AHB-AP (IDR: Not set, ADDR: 0x00000000)
AP[4]: AHB-AP (IDR: Not set, ADDR: 0x00000000)
AP[5]: AHB-AP (IDR: Not set, ADDR: 0x00000000)
AP[6]: MEM-AP (IDR: Not set, ADDR: 0x00000000)
AP[7]: MEM-AP (IDR: Not set, ADDR: 0x00000000)
AP[4]: Skipped ROMBASE read. CoreBaseAddr manually set by user
AP[4]: Core found
ConfigTargetSettings() start
ConfigTargetSettings() end - Took 15us
InitTarget() start
SDA_AP detected
Unlocking device if necessary...
Device is not locked. Proceeding without the unlock procedure.
Checking if debug access is already enabled...
Core already enabled
Checking if HSE firmware is installed...
HSE firmware not installed
Checking if Cortex-M7_0 and Cortex-M7_1 are operating in lockstep mode
Lock step mode enabled
InitTarget() end - Took 18.2ms
Found SW-DP with ID 0x6BA02477
DPIDR: 0x6BA02477
CoreSight SoC-400 or earlier
AP map detection skipped. Manually configured AP map found.
AP[0]: MEM-AP (IDR: Not set, ADDR: 0x00000000)
AP[1]: APB-AP (IDR: Not set, ADDR: 0x00000000)
AP[2]: MEM-AP (IDR: Not set, ADDR: 0x00000000)
AP[3]: AHB-AP (IDR: Not set, ADDR: 0x00000000)
AP[4]: AHB-AP (IDR: Not set, ADDR: 0x00000000)
AP[5]: AHB-AP (IDR: Not set, ADDR: 0x00000000)
AP[6]: MEM-AP (IDR: Not set, ADDR: 0x00000000)
AP[7]: MEM-AP (IDR: Not set, ADDR: 0x00000000)
AP[4]: Skipped ROMBASE read. CoreBaseAddr manually set by user
AP[4]: Core found

****** Error: DAP error while reading AIRCR.

Error occurred: Could not connect to the target device.
For troubleshooting steps visit: https://kb.segger.com/J-Link_Troubleshooting