汽车EE架构

1 AUTOSAR
MOPED ArcticCore v4.0
python xlrd: excel read

2 Audi
CARIAD: Car I am Digital
HCP - High Performance Computing Platform
HCP1 - Powertrain / Chassis
HCP2 - Assistance and Security
HCP3 - Interior, HMI, powered by Samsung EA9
HCP4 - Body and Security
HCP5 - Gateway
ICAS3: in-car application server, 3 for Cockpit
IPv6: only one :: could exist when there are continuous 0000:0000,...
MIB2: Modular Infotainment Base
OTA-FC: Over The Air Functional Controller

3 BMW
3.1 Abbreviations
3.1.1 ADAS
ACC: Active Cruise Control, Conti design
ADCAM: Autonomous Driving CAMera, KAFAS，双目摄像头，based on EyeQ5. ADCAM-Low is designed by Magna, ADCAM-Mid is designed by Aptiv
hPAD: Highway Pilot Autonomous Driving, L3, based on Intel Denverton 8 Core (Atom C3758) and Aurix TC39X
KAFAS: Kamera Fahrer Assistenz System, Camera-based Driver Assistance Systems, replaced by ADCAM，双目摄像头，Conti design
mPAD: middle Pilot Autonomous Driving, L2, based on Intel Denverton 2 Core (Atom C3308, released in 2017) and Aurix TC39X
SAS: Speed Assistance Systems，自动驾驶执行机构，SAS uses FlexRay

3.1.2 Camera
ARC Deserializer: AR Camera, connected to head unit
IRK: Innenraumkamera, interior camera, AR-HUD, Gesture
RFK: Rear View Camera
TRSVC: Top, Rear, Side View Camera, 360 Surround, i.MX6 + BCM89531 switch + 4 x 130M cameras, TRSVC is a part of UCAP, Bosch design
UCAP: UltraSonics Camera Automated Parking, based on 360 Surround View Camera

3.1.3 Gateway
BDC_BCP21: Body Domain Controller (Gen3)_Basis Central Platform 2021, BCM89541, DP83TC811, SPC58NH92C5HMI0, SPC58NH92C3HMI0, ST33G768A, S32K116BF
BDC-03: Renesas MCU and Broadcom switch
IPBasis: Integration Platform Basis, gateway by Lear
IPNext25: Integration Platform Next 2025 with 802.1AE MACsec, camera gateway by Valeo
ZGW: MOST gateway

3.1.4 General
Harness: 汽车电器需要导线去连接，自从点火系统的应用，在汽车的发动机周围开始出现了若干布线。这些布线使人们想起了马车的挽具和缰绳，英语叫harness，所以形象的叫它电线的缰绳（wireharness），意译成中文叫线束
ICM: Integrated Chassis Management
JBE: Junction Box Electronics
K-CAN: Kommunikation, Communication, K-CAN means Body CAN
KL30: Klemme, German term for connector/connection. KL30 is 12V battery positive, KL31 is 12V battery negative
KL30a: 12/24V positive
KL40: 48V positive
KL41: 48V negative
KLR: Klemme Radio

3.1.5 IVI
28nm BCM8953X: used by MGU18, firmware uses Erika OS v2.1
Debug Token: stored in the persistency partition in a none encrypted folder /var/opt, Debug Token based on VIN
EDIABAS: Electronic Diagnostics Basis System, for DTC
HCB: Hypervisor Configuration Block
ICC: Infotainment Cockpit Computer
ICON: WiFi and BT
IDC: BMW Infotainment Domain Controller
iDrive 7.0: intelligent Drive 7.0, based on MGU18
iDrive 8.0 2022: based on MGU21 (Media Graphic Unit), APL A3960
INAP56xR: INAP56xR acts as ethernet PHY, refer to 9.0 Ethernet communication (MII/RMII) of INAP56xR datasheet
IPK: OpenWrt Install Package, 7-Zip can extract IPK file
MARS: Modular Audio Receiver System, previously called RAM
MGU: Media Graphic Unit (processor for display, I drive interface)
NCAR: Next Cluster Architecture with AVB supported
NICC: WAVE2
NSM: Node State Manager for On/Off
OAP: Online Application Platform
PaDi: Panorama Display, RSE
PDX: Packed ODX, Packaged Open Diagnostic Data Exchange
RAM: Receiver Audio Module (tuner, diversity antenna, Amplifier)
SEI: Supplemental Enhancement Information for AVB camera
SFI: Safety Island
SP21: Service Pack 21
vlm: virtual communication link memory
WAVE: Wireless Access in Vehicle Environment

3.2 TRSVC
以下为BMW第三代TRSVC的原理简介。
4个摄像头通过以太网AVB连接至TRSVC控制单元。
TRSVC控制单元通过以太网AVB连接至BDC。TRSVC控制单元通过前部配电器利用总线端30B供电。TRSVC控制单元为各个摄像头供电。另外，TRSVC控制单元还通过本地CAN与驻车助手（Parking Manoeuvring Assistant）控制单元相连。
BDC通过以太网AVB连接至HU，HU通过APIX数据导线将摄像头拍摄的图像数据发送给中央信息显示器。

TRSVC outputs CVF MJPEG to BDC via 100Mbps AVB. Wireshark uses ieee1722.subtype == 0x03 to filter AVB CVF packets.

3.3 switch MACsec
3.3.1 2021 28nm 88Q5151
SPI data format: 1-byte CMD + 2-byte addr + 2-byte data
2-byte addr: bit[9:5] for 32 addressable devices (GLB1 and GLB2), bit[4:0] for 32 register addressable per device. GLB2 offset 0x16 and 0x17 for AVB Command and AVB Data, GLB2 offset 0x18 and 0x19 for SMI PHY Command and SMI PHY Data.

2018 55nm 88Q5050 switch does not support MACsec. port6 is connected to APIX, if port6 is enabled but no MDIO clock provided, which will cause switch packets loss, to fix this issue, APIX will provide the MDIO clock.

88Q5151 switch supports MACsec, and internal port0 does not support MACsec, port0 is connected to Cortex R52. There are 512 Entry TCAM inside 88Q5151. Injection key to MACsec PHY via MDIO master is plaintext.

3.3.2 MACsec
MACsec是WiFi中WPA2的有线等效。
CAK (32 hexdecimal characters) is saved in RPMB or switch flash, then compute SAK (32 hexdecimal characters) from CAK, write SAK and 4-byte SSCI (computed based on 8-byte SCI) to Ethernet PHY registers. Refer to Decrypt macsec frame python (AES-GCM).
MACsec has been an industry standard since 2006 when the IEEE published the 802.1AE-2006 document. For automotive ARP, gPTP and AVB.
MACsec packet format:
12-byte DA/SA +
8-byte or 16-byte SecTAG (2-byte MACsec EtherType + 4-byte PN + 8-byte SCI) +
Secure Data (4-byte VLAN TAG + EtherType + Payload) +
8-byte or 16-byte ICV +
4-byte CRC
ICV字段的计算包含DA/SA、SecTAG、Secure Data。
CRC是整个报文的CRC，也即是包含DA/SA、SecTAG、Secure Data和ICV字段。

Cisco WAN MACsec:
4-byte VLAN TAG followed by SecTAG, and Secure Data only includes EtherType + Payload

switch port mirror抓包都是MACsec加密前或者解密后的报文，无法抓到加密的报文。 
Starting with Linux kernel 4.6 (Sabrina Dubroca committed this patch) and Wireshark 3.4 support MACsec. iproute2 is used to configure MACsec.
ip macsec show
ip macsec命令中的参数port不等于switch的port，而是一个逻辑值
The last parameter of Linux ip macsec is CAK (32 hexdecimal characters).
SA: Secure Association
SCI：Secure Channel Identifier，SCI是由6字节的MAC地址和2字节的Port Identifier组成，唯一标识系统内的安全通道，这里的port就是ip macsec命令中的port参数

3.3.3 port-mirror
set port-mirror enable 5 0x80 0
mirror P7 to P5, 0 means for both ingress and egress.

4 Daimler
KSZ8895: Micrel Kendin ethernet switch, used by Daimler NTG6 head unit
LKA: Lane Keeping Assist, based on Binocular Camera (BC)
MC: Monocular Camera
MMA: Mercedes-Benz Modular Architecture
NTG6: New Telematics Generation 6 Head Unit, based on Tegra186, running hypervisor/RTLinux and Rich Linux
OS81118: Microchip MOST with USB device for Daimler NTG6 head unit, USB device connected to Tegra186 4-port MPH xHCI port3
SLA: Speed Limit Assist, based on Binocular Camera (BC)
SPV CAM: Special Purpose Vehicle, for Taxi, Emergency, etc

5 Others
5.1 Ford
PAC: Phoenix Audio Controller
PDC: Phoenix Domain Controller

5.2 Jaguar Land Rover
EVA2: Electric Vehicle Architecture 2
GWM: GateWay Module

5.3 Tesla
Auto Pilot PCB
GPU PCB
Head Unit PCB

5.4 Volvo
TCAM: Telematics Connectivity Antenna Module

6 CD Head Unit
6.1 Teardown
Buick Excelle
Korea Tamul TMC55DU with USB FS Host

GM Fox
NEC uPD70F3352

Honda
NEC uPD70F3368
NXP SAF7730HV audio DSP
NXP TEF6721HL tuner IC

Hyundai Sonata
Telechips TCC8601

Subaru OUTBACK
NEC uPD70F3368

6.2 CPU
6.2.1 NEC V-series
NEC V20 (8086), 1984
NEC V60, 1986, can run DOS
NEC V850, 1990

6.2.2 CPU
NEC uPD70F3368, uPD stands for micro Product Digital, F means Flash
Panasonic MN103SH40QVB, AM32 CPU, comes from Matsushita National core
Toshiba TMPM324F10FG, ARM CPU
2008 STM STA1052 with ARM7TDMI
2015 STM STA1080 with ARM Cortex-R4

6.3 USB Host
2010 Renesas AE1-L
2012 Rohm BU94xxx, BU94502 (Chery HU)
2018 VLSI Solution VS1003
Domestic
Guangzhou Nine chip N910x
Wtchip WT2003HX

7 Abbreviations
AEC-Q100: Automotive Electronics Council, founded by Chrysler, Ford, General Motors
backup RAM：Retention RAM
Benz G-class: Germany Gelndewagen
CANoe: 音同英语独木舟的发音
CVE: Common Vulnerabilities and Exposures
ECCNs 3A991p: 8 TOPS
LPR：License Plate Recognition，车牌识别
Mask ROM：8051/8052中的0表示Mask ROM型单片机，1表示4K，2表示8K
Microchip MCP2517FD：使用Kvaser CAN FD IP核
NeoVI RED: Vehicle Interface
NMGw: Network Management of Gateway
SecOC: AutoSAR CAN Security Onboard Communication
TOPS: Tera Operations Per Second, TOPS for GPU MAC (Multiply Accumulate), 1TOPS = 10^12, L3 20 - 30TOPS