S32K3 Safety & Self-test questions

[jbirchy]

Q1) Are  “Crypto driver”(Pic 1) and “Safety & security”(pic 2) referring to the same functionalities?

  What else does the Safety & Security block encompass?

See attached Pic1 & Pic2

Q2) How can we include HSM block for cyber security? Seems like it’s not included in RTD?

Q3) It looks like self-test libraries are not included in the MCAL. Will it need to be purchased? 

Q4) How can we test/evaluate the CCST (Structural core self test)?

Q5) Will there be any EB tresos configurator license included or it needs to be purchased? What EB tresos version is supported?

Q6) Most of the example are prepared with EB Tresos. Any particular advantage with EB Tresos or De Vinci configurator from Vector versus using S32DS?

Q7) If any AutoSAR provider has MCAL integration package, will they just download your RTD package and help us integrate using their configurator tool? Or usually they’d require NXP support?

Q8) If we as a customer need to work on the integration, how NXP would be able to support? Any training or support hours needs to be purchased?

[namnguyenviet]

Hello,

A1: "Crypto driver" and "Safety and Security" uses the same hardware/firmware underlying: HSE hardware/firmware acceleration. While "Crypto driver" is designed as AUTOSAR compliant, low level "Safety and Security" interacts with HSE and covers more functionalities that AUTOSAR Crypto driver doesn't cover. For more information, you can order the HSE firmware documentation (required NDA contract).

A2: NXP HSE hardware/firmware acceleration is the next generation of automotive security solution. You will integrate HSM via HSE firmware, which is a separated package. HSM or HSE are just the name of SoC hardware security underlying. You can use HSE firmware as a standalone package, or integrate the RTD Crypto driver, which supports interact with HSE firmware.

A3: S32K3 SCST is part of S32K3 premium software, and you need to purchase it.

A4: You can refer to M7_S32K3xx_SCST_User_Manual.pdf

A5: After purchase S32K3 RTD product, an EB tresos evaluation license will be provided to customer free-of-charged, and it will be renew every 3 months. If customer wants to go production, they need to order a permanent license. S32K3 RTD is verified with EB Tresos 27.1

A6: There wasn't any comparison between integrate using S32DS and using EB Tresos/Da Vinci. However, with S32DS, not only integrating AUTOSAR BSW, but you can also integrate low-level API, take advantage of Port pin GUI configuration, Clock tree,... Also, S32DS is an IDE rather than a configurator tool, it includes also project integrating and debugging. On another part, Elektrobit and Vector offers the integration of AUTOSAR BSW upper layers, which NXP doesn't provide and doesn't support in S32DS.

A7: Other 3rd party integrators like Elektrobit and Vector often get the NXP package then integrate by their own, with supports from NXP if needed.

A8: There are documents (User manual and Integration manual) in each driver to help customers integrate the driver to their applications. Also, there are examples which demonstrate how to configure the driver. No training or support hours are needed to be purchased, customer can contact our field application engineers to get supports, or create tickets in our portal: https://support.nxp.com/ 

Best Regards,

Nam

[jbirchy]

Thanks Nam, please see below:

from A2 - is the HSM available from NXP or a 3rd party?  If NXP, is there a fee for it?

From A4 – that is a very poor answer.  Please provide the location of that file (I don’t see it on the NXP website nor DocStore) and a reference within that file.  I would suggest that you include a summery in your response instead of just telling some to go look at a file.

From A5 – the RTD is free!  Is the Tresos production license free also?

[Luis_Garabo]

Hi John,

Answer 2.1: The HSE is provided by NXP. The price is included in silicon price with no extra cost for a production license. It can be downloaded from here: https://www.nxp.com/webapp/swlicensing/sso/downloadSoftware.sp?catid=SW32K3-STDSW-D

Answer 4.1: The Structural Core Self Test (SCST) provides required Diagnostic Coverage (up to 90%) with Arm Cortex M7. The license Model is a one-time license fee. An evaluation, including the documentation, can be found here: https://www.nxp.com/webapp/swlicensing/sso/downloadSoftware.sp?catid=SW32K3-M7SCST-E

Answer 5.1: You are correct. Sorry for the mistake. RTD is free. After the evaluation time expires the customer has to acquire their license with Tresos and it is not free.

Best Regards,
Garabo

[jbirchy]

Q2 was regarding HSM

Is the HSM available from NXP or a 3rd party?

If NXP, is there a fee for it?

Is there any links for HSM?

[namnguyenviet]

Hello @jbirchy ,

(Sorry I made a confuse. I modified the answer A2, and the following information are the addition):

HSM (hardware security module), HSE (hardware security engine) or CSE (crypto security engine) are all aim to the SoC hardware security underlying. From our NXP portfolio, we define the differences between HSM, HSE and CSE family as the following snapshot:

There are some familiar Automotive Security Specifications: SHE (Secure Hardware Extension), EVITA HSM (Hardware Secure Engine), FIPS 140-2... S32K3 supports HSE, which covers SHE, EVITA HSM and some other services. Other OEMs/3rd parties can create their own technical specifications  including select aspects of SHE, EVITA, and FIPS 140-2. For example, Vector provides Vector Cyber Security Solution – vHSM Firmware: https://cdn.vector.com/cms/content/events/2019/Webinars19/Vector_Webinar_MICROSAR_HSM.pdf  or ETAS provides ESCRYPT:  https://www.etas.com/download-center-files/DLC_realtimes/RT_2019_2020_en_58_rgb_ESCRYPT.pdf 

The following link can be helpful in order to understand about how NXP HSE supports: https://community.nxp.com/pwmxy87654/attachments/pwmxy87654/connects/103/1/AMF-AUT-T3680_NextGenerat...

About the fee, @Luis_Garabo has explained in the previous comment.

Best Regards,

Nam

[jbirchy]

@namnguyenviet   Sorry, now I need these answers for the S32K1 which has the CSEc instead of the HSE.  Customer is looking at S32K146 now.

1. Same questoin as before ... is it referring to the same functionalities in the  “Crypto driver”(Pic 1) and “Safety & security”(pic 2)?
2. Does the S32K1 support HSM?  It looks like it only supports SHE.
3. Are the CSEc drivers included in the RTD?
4. Is there a Stuctural Core SelfTest (SCST)  for the S32K1?  If not, what self-test libraries do we have?
5. Is Tresos still used for configuration
6. Can one just use S32DS for configuration instead of Tresos?

[namnguyenviet]

Hello @jbirchy 

1. "Crypto driver" refers to the AUTOSAR Crypto. "Safety and Security" feature refers to the CSEc low-level driver. Both interacts with CSEc as hardware underlying.

2. S32K1 CSEc only supports SHE.

3. Yes, CSEc driver is included in RTD driver as a low-level driver.

4. Yes, SCST is available in K1

5. and 6. Both EB Tresos and S32DS can be used in RTD K1.

Best Regards,

Nam

[jbirchy]

Sorry I forgot to ask, what's the latest version of Tresos that supports the S32K1?

[jbirchy]

Where wold I find the SCST for the S32K1?

[namnguyenviet]

Hello @jbirchy 

Unfortunately,  the link to download the K1 SCST product is not public. You can contact your local sale representative/ field application engineers to order the product.

The latest EB Tresos version that supports K1 is 27.0, however it depends on the dedicated K1 product. For instance, K1 RTD is verified with Tresos 27.0, while K1 SMCAL AUTOSAR 4.3 is verified with Tresos 24.0/23.0. The version of EB Tresos that is verified is noted in the Release Note.

Best Regards,

Nam

[jbirchy]

How can a customer evaluate the S32K1 SCST?

[namnguyenviet]

Hello @jbirchy ,

After download the SCST package, the customers can refer to the M4_S32K144_SCST_User_Manual.pdf,  located in e.g. C:\NXP\SCST_M4_S32K144_RTM_1.0.6\User_Documentation\, in order to evaluate the product. They can also download the SCST_M4_S32K144_RTM_1.0.6_SafetyPack.zip file, which is delivered along with the software package, in order to get details regarding the assessment of the coverage, safety analysis, etc.

Best Regards,

Nam

[Luis_Garabo]

Hi John,

Perhaps I am misunderstanding the meaning of HSM. Could you please clarify to me the meaning of HSM?

The HSE in the S32K3 is the Hardware Secure Engine. This is our security module and to use it it is required to have the HSE Firmware provided by NXP, which can be downloaded from the link provided before: https://www.nxp.com/webapp/swlicensing/sso/downloadSoftware.sp?catid=SW32K3-STDSW-D

The cost is already included with the silicon.

Best Regards,
Garabo

[jbirchy]

just to verify, one doesn't have to use Tresos, configuration can be done in S32DS, correct?

[Luis_Garabo]

Hi John,

This is correct. The RTD can be configured by just using the S32 Design Studio.

Best Regards,
Garabo