2393077_en-US

Yes

S32K3 bootloader and HSE - best practice ?

Hi NXP team,

We are implementing a robust OTA update architecture on an S32K312 using HSE full-block A/B swap.

Our target architecture is:

- S32K312 with 2 MB PFlash split into two 1 MB physical blocks.
- HSE AB_SWAP is used via the passive-block activation service.
- OTA package is received over Modbus/serial.
- Bootloader stages the signed image into the passive PFlash block.
- HSE verifies the passive image/SMR.
- Bootloader requests AP_SWAP.
- After reset, the newly swapped bank boots provisionally.
- A confirm command makes the swap permanent; otherwise the device rolls back.

Originally we tried to keep one global bootloader in DFlash, outside the two PFlash banks. That bootloader would receive OTA, program the passive PFlash bank, request HSE AP_SWAP, and then continue to manage confirm/rollback.

We ran into architectural and runtime complexity with that approach:

1. HSE AB_SWAP appears to operate on full PFlash block boundaries, not arbitrary app partitions.
2. A single DFlash bootloader is outside the swapped/authenticated bank image.
3. The active PFlash bank still needs valid boot/IVT/reset structure after swap.
4. We had difficult execution hazards when DFlash was also involved in bootloader runtime/record handling.
5. It became unclear whether a global DFlash bootloader is compatible with a clean full-bank HSE AB_SWAP production design.

We therefore moved to a duplicated PFlash bootloader mode for now:

- Each 1 MB PFlash bank contains its own IVT + bootloader + application.
- The bootloader has a reserved slot at the base of each bank.
- The application starts after the bootloader slot.
- The signed OTA image is a full bank image containing bootloader + application.
- After HSE AB_SWAP, the newly active bank is self-contained and bootable.

This appears much cleaner for HSE full-block A/B swap, but I would like to confirm the intended/production-safe approach. This is suboptimal as it partially defeats the purpose of a factory bootloader.

Questions:

1. For S32K312 HSE AB_SWAP, is a single global DFlash-resident bootloader outside the swapped PFlash banks a supported/recommended architecture?
2. Or does HSE AB_SWAP effectively require/recommend that each swapped PFlash block be independently bootable, with its own IVT/bootloader/reset path?
3. If a DFlash bootloader is possible, how should the post-swap boot flow be structured so SBAF/HSE boot expectations are still met?
4. Are there any NXP reference examples showing a DFlash bootloader managing full-block HSE AB_SWAP on S32K3?
5. For production OTA with rollback/confirm semantics, is the duplicated PFlash bootloader model the safer intended design?

We have seen that code and IVT can be linked into DFlash by modifying the linker script (and we tried that), but our question is specifically about whether that is appropriate when using HSE full-block A/B swap and secure boot/SMR verification.

Thank you.