JP2018128874A - Electronic apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable debugging in an easy operation even if a connector of a debug dedicated interface such as JTAG is omitted.SOLUTION: A firewall block 16 is disposed between an internal bus 12 and a versatile peripheral apparatus interface controller 11. The firewall block 16 accepts an authentication key 31 from a debug system 2 connected to a connector 11a of the versatile peripheral apparatus interface controller 11, executes authentication by comparing between the authentication key 31 accepted from the debug system 2 and a legitimate authentication key, permits the debug access when the authentication successes, and prohibits the debug access when the authentication fails.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an electronic device.

  A certain embedded system includes a JTAG (Joint Test Action Group) interface circuit, and enables debugging of the embedded system by an external device (see, for example, Patent Document 1). Further, in this embedded system, in the debug mode, the user program is received by the high-speed serial communication interface and stored in a specific memory area (an area in which the user program executed in the user mode is stored) by the direct memory controller.

International Publication No. 2005/022390

  In the system described above, a high-speed serial communication interface is used for program transfer, but a JTAG interface circuit is used for debugging.

  In the development stage, such a JTAG interface circuit is provided with a JTAG connector, and an external device (debug system) is connected to the JTAG connector during debugging.

  However, such JTAG connectors are not mounted in the electronic equipment shipped on the market for cost reduction. Therefore, when debugging an electronic device after shipment, it is necessary to disassemble the electronic device and solder the JTAG connector to the board of the embedded system, and then connect the debug system to the JTAG connector. As described above, a large-scale work is required for debugging an electronic device in which the JTAG connector is omitted.

  The present invention has been made in view of the above problems, and an object of the present invention is to obtain an electronic device that enables debugging with a simple operation even if a connector for a debug-dedicated interface is omitted.

  An electronic device according to the present invention includes a general-purpose peripheral device interface controller, a connector of the general-purpose peripheral device interface controller, an internal bus, a processor connected to the internal bus, the internal bus, and the general-purpose peripheral device interface controller. And a firewall block disposed between the two. The firewall block receives an authentication key from a debug system connected to the connector, performs authentication by comparing the authentication key received from the debug system with a regular authentication key, and succeeds in the authentication. When debug access is permitted and the authentication fails, the debug access is prohibited. The debug access is read and write to all resources connected to the internal bus via the connector and the general-purpose peripheral interface controller by the debug system.

  According to the present invention, even in a case where the connector for the debug-dedicated interface is omitted in the electronic device, debugging can be performed with a simple operation.

  These and other objects, features and advantages of the present invention will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings.

FIG. 1 is a block diagram showing a configuration of an electronic apparatus according to an embodiment of the present invention. FIG. 2 is a flowchart illustrating an operation of the electronic device illustrated in FIG.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram showing a configuration of an electronic apparatus according to an embodiment of the present invention.

  The electronic device 1 shown in FIG. 1 has a built-in system. Specifically, the electronic device 1 includes a general-purpose peripheral device interface controller 11, a connector 11 a of the general-purpose peripheral device interface controller 11, internal buses 12 and 13, a processor 14 connected to the internal bus 12, and an internal bus 12. A memory controller 15 connected to the memory controller 15, a memory 15 a connected to the memory controller 15, and a firewall block 16 disposed between the internal bus 12 and the general-purpose peripheral device interface controller 11.

  In this embodiment, the general-purpose peripheral device interface controller 11 is a universal serial bus or PCI (Peripheral Component Interconnect) express interface.

  In this embodiment, the electronic device 1 does not include a debug-dedicated interface connector such as JTAG.

  In this embodiment, the internal bus 12 is a high-speed bus (that is, a bus faster than the internal bus 13) such as AXI (Advanced eXtensible Interface), and the internal bus 13 is, for example, an APB (Advanced Peripheral Bus). A low-speed bus (that is, a bus that is slower than the internal bus 12).

  The processor 14 includes a CPU (Central Processing Unit) and the like, and executes a program. The memory controller 15 performs read / write on the memory 15a. The memory 15a is, for example, a dynamic random access memory (DRAM) that stores data and programs.

  The firewall block 16 is a circuit that relays a read or write command or data for the internal bus 12, receives the authentication key 31 from the debug system 2 connected to the connector 11 a, and the authentication key 31 received from the debug system 2. The authentication is executed by comparing with the regular authentication key. When the authentication is successful, the debug access is permitted, and when the authentication fails, the debug access is prohibited.

  The debug access here refers to all resources (processor 14, memory 15 a (memory controller 15 in FIG. 1) connected to the internal buses 12 and 13 via the connector 11 a and the general-purpose peripheral device interface controller 11 by the debug system 2. Read and write to the network interface 18, GPIO (General Purpose Input / Output) controller 19, power saving management controller 20, interrupt controller 21 and the like.

  In the first embodiment, the firewall block 16 is connected to the internal bus 12 and the internal bus 13, and the regular authentication key is received from the processor 14 via the internal bus 12, the bus bridge 17 and the internal bus 13. get. In other words, the firewall block 16 does not have an area accessible from the internal bus 12, and transmits or blocks commands and data, while having an area accessible from the internal bus 13. Write the regular authentication key in the area.

  The debug system 2 is a terminal device in which a debug program is installed, for example, and acquires and holds the authentication key 31 in advance. In the case of a regular user, the authentication key 31 is a regular authentication key distributed from the vendor of the electronic device 1, for example.

  The bus bridge 17 is disposed between the internal bus 12 and the internal bus 13, connects the two to each other, and relays a read or write command or data between the two.

  The network interface 18 can be connected to a network 3 such as the Internet.

  In this embodiment, the processor 14 holds the above-described regular authentication key in the memory 15a or a storage device (not shown), and obtains the regular authentication key from a predetermined server on the network 3 via the network interface 18. Then, the held regular authentication key is updated with the obtained regular authentication key. The regular authentication key may be updated periodically or at a predetermined timing.

  In this embodiment, the processor 14 notifies the authentication result of the above-described authentication to a predetermined server on the network 3 via the network interface 18. Thereby, unauthorized access to the electronic device 1 can be detected in a remote server.

  Further, a GPIO controller 19, a power saving management controller 20, an interrupt controller 21, etc. are connected to the internal bus 13.

  Next, the operation of the electronic device 1 will be described. FIG. 2 is a flowchart for explaining the operation of the electronic apparatus 1 shown in FIG.

  The processor 14 of the electronic device 1 holds the regular authentication key in advance as described above. The debug system 2 holds the distributed authentication key 31.

  When executing debugging, the debugging system 2 is first connected to the connector 11a with a cable or the like. Then, the debug system 2 outputs the authentication key 31 to the general-purpose peripheral device interface controller 11.

  On the other hand, the firewall block 16 obtains a regular authentication key from the processor 14 as described above. The firewall block 16 receives the authentication key 31 via the general-purpose peripheral device interface controller 11 (step S1), compares the received authentication key 31 with the regular authentication key, performs authentication, and the two match. In this case, it is determined that the authentication has succeeded, and when the two do not match, it is determined that the authentication has failed (step S2).

  If the authentication is successful, the firewall block 16 permits debug access to all resource areas in the electronic device 1 until the connection of the debug system 2 to the connector 11a is released (step S3). That is, when the general peripheral interface controller 11 detects the release of the connection of the debug system 2 to the connector 11a, debug access to the resource area other than the memory 15a is prohibited. After that, when a debug access read command or write command is supplied from the debug system 2, the command or read / write data is relayed by the firewall block 16 (step S4). Therefore, when the authentication is successful, the debug system 2 can create dump data of a value in a specific area in the electronic device 1 or rewrite the value.

  On the other hand, if the authentication fails, the firewall block 16 continues prohibiting debug access (step S5). This prohibits access from the debug system 2 to resources other than the memory 15a as in the case of access from normal peripheral devices. Therefore, if the authentication fails, the debug system 2 generates the dump data of the invalid value even if the dump data of the specific area in the electronic device 1 is created, and the rewrite of the value is blocked by the firewall block 16. Not executed.

  As described above, according to the embodiment, the firewall block 16 is disposed between the internal bus 12 and the general-purpose peripheral device interface controller 11. The firewall block 16 receives the authentication key 31 from the debug system 2 connected to the connector 11a of the general-purpose peripheral device interface controller 11, and compares the authentication key 31 received from the debug system 2 with the regular authentication key to execute authentication. If authentication succeeds, debug access is permitted. If authentication fails, debug access is prohibited.

  Thereby, even if a connector for a debug-dedicated interface such as JTAG is omitted, debugging can be performed by using a general-purpose device interface such as USB or PCI Express. Further, the authentication based on the authentication key 31 suppresses unauthorized access to internal resources using the general-purpose device interface.

  Various changes and modifications to the above-described embodiment will be apparent to those skilled in the art. Such changes and modifications may be made without departing from the spirit and scope of the subject matter and without diminishing its intended advantages. That is, such changes and modifications are intended to be included within the scope of the claims.

  For example, in the above embodiment, the regular authentication key (and the authentication key 31) may be unique to the electronic device 1. For example, a regular authentication key is generated by the electronic device 1 from an identifier unique to the electronic device 1 (for example, a MAC (Media Access Control) address), notified to the server, and distributed as an authentication key 31 from the server to the user. You may be made to do.

  The present invention can be applied to, for example, an electronic device incorporating an embedded system.

DESCRIPTION OF SYMBOLS 1 Electronic device 2 Debug system 3 Network 11 General-purpose peripheral device interface controller 11a Connector 12, 13 Internal bus 14 Processor 16 Firewall block 17 Bus bridge 18 Network interface

Claims (6)

General-purpose peripheral device interface controller,
A connector of the general-purpose peripheral device interface controller;
An internal bus,
A processor connected to the internal bus;
A firewall block disposed between the internal bus and the general-purpose peripheral device interface controller;
The firewall block receives an authentication key from a debug system connected to the connector, performs authentication by comparing the authentication key received from the debug system with a regular authentication key, and succeeds in the authentication. If debug access is allowed and the authentication fails, the debug access is prohibited,
The debug access is a read and write to all resources connected to the internal bus via the connector and the general purpose peripheral interface controller by the debug system;
Electronic equipment characterized by The internal bus comprises a high-speed bus, a low-speed bus slower than the high-speed bus, and a bus bridge disposed between the high-speed bus and the low-speed bus,
The processor is connected to the high-speed bus;
The firewall block (a) is connected to the high-speed bus and the low-speed bus, and (b) obtains a regular authentication key from the processor via the high-speed bus, the bus bridge, and the low-speed bus. ,
The electronic device according to claim 1. A network interface connected to the network;
The processor holds the normal authentication key, acquires the normal authentication key from a predetermined server on the network via the network interface, and holds the normal authentication key with the acquired normal authentication key. Updating the canonical authentication key,
The electronic device according to claim 1, wherein: A network interface connected to the network;
The processor notifies the authentication result of the authentication to a predetermined server on the network via the network interface;
The electronic device according to claim 1, wherein:   5. The electronic device according to claim 1, wherein the general-purpose peripheral device interface controller is a universal serial bus or a PCI express interface.   6. The electronic apparatus according to claim 1, wherein a connector for a debug-dedicated interface is not provided.

Images