S32K3 Secure Boot

[mws]

Hello,

I am currently developing Secure Boot on the S32K3 series, and I have encountered an issue where I am unable to program via JTAG.
I would like to ask: when the device enters Recovery Mode, is it expected that JTAG cannot be used together with the IDE for direct programming?

Here are the test conditions:

1.HSE AB Swap is installed

2.ADKP is enabled

3.LifeCycle is set to OEM_PROD

4.Using Basic Secure Boot, with an intentionally incorrect GMAC TAG

5.IVT_AUTH is disabled

6.Before programming, ADKP was successfully unlocked using the official Python script

Could you please advise whether these settings would prevent JTAG programming in Recovery Mode, and if there are any recommended steps to resolve this issue?

Thank you for your support.

Best regards,

[davidtosenovjan]

If the device is in OEM_PROD mode, there is only a limited time window (with a 30-second timeout) during which the recovery counter must be between 8 and 16. Within this range, the debugger must establish a connection and likely also perform debug authorization, since the MCU has been reset. If the counter exceeds 16, the device remains in reset.

[mws]

I am currently using HSE firmware version V2.55. Based on my current configuration:

• IVT BCW = 0x09 → the RESET_RECOVERY_MODE bit is 0

• DCMRWP1 was not modified → so it should also be 0

• According to the Entry into Recovery Mode behavior table in the HSE Reference Manual, if both of these control bits are set to 0, it means that Recovery Mode is disabled.

Therefore, when I attempt to enter Recovery Mode, the device actually does not enter it, which explains why I cannot use JTAG with the IDE for programming under this condition.

My understanding is that:

• If I want to be able to program/debug through Recovery Mode using JTAG, I would need to configure RESET_RECOVERY_MODE to 1 in either IVT or DCMRWP1.

• In addition, since the device LifeCycle is already set to OEM_PROD, this may further restrict certain debug and recovery options. I believe this could also be related to why the JTAG functionality is blocked under the current Secure Boot setup.

Could you please confirm if my interpretation is correct?

[davidtosenovjan]

Yes, correct.

Recovery mode can be disabled in configuration, so in this case it is not invoked.

[mws]

In my current state, is it still possible to program normally using JTAG, or is this already considered a bricked state?

[davidtosenovjan]

Yes, in my opinion you have it is bricked state. Without recovery you cannot connect by JTAG.