Information processing device, method for controlling information processing device, and program

Abstract

To solve the problem that, in order to use a logging function inside an image forming device, the CPU must activate firmware and the system activation must be completed. therefore, when an error occurs before the CPU activates firmware, it may be difficult to determine at which timing in program execution the error has occurred.SOLUTION: The present invention pertains to an information processing device comprising: a nonvolatile memory for storing a first program and a second program; a first controller for executing the first program upon activation of the information processing device and detecting the presence or absence of falsification of the second program; and a second controller for executing the second program when the second program has not been falsified. The second controller transmits a notification regarding completion of execution of the second program to the first controller upon completion of execution of the second program.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an information processing device, a control method for an information processing device, and a program. [Background technology]

[0002] Some image forming devices have a logging function for recording system operation information. This allows the image forming device to record the software operation history as a log, which is used for failure analysis, etc. In many systems, the logging function becomes available after the system has been started up to a certain extent, and in the initial start-up period until the logging function becomes available, a simple alternative method such as limiting the output destination may be used.

[0003] Prior art document 1 discloses a method for outputting information about the operation progress of a system when the power is turned on to an external interface, thereby enabling the progress to be checked when an output device is connected to the external interface. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2011-39684 A Summary of the Invention [Problem to be solved by the invention]

[0005] The configuration of Prior Art Document 1 requires an external output. In order to use the logging function inside the image forming device, the CPU must start the firmware and complete system startup. Therefore, if an error occurs before the CPU starts the firmware, there is a risk that it will not be clear at what point in the program execution the error occurred. [Means for solving the problem]

[0006] The present invention is an information processing device comprising a non-volatile memory that stores a first program and a second program, a first controller that executes the first program upon startup of the information processing device and detects whether the second program has been tampered with, and a second controller that executes the second program if the second program has not been tampered with, and is characterized in that the second controller sends a notification regarding completion of execution of the second program to the first controller upon completion of execution of the second program. Effect of the Invention

[0007] According to the configuration of this embodiment, it is possible to infer, before the CPU starts up the firmware, what program was executed before the start-up was stopped due to an error. [Brief description of the drawings]

[0008] [Figure 1] Block diagram showing the hardware configuration of an image forming apparatus [Diagram 2] Flowchart showing an overview of the startup process [Diagram 3] Flowchart of the process by which EC121 records abnormal information [Figure 4] Flowchart showing an overview of Loader processing DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Each embodiment of the present invention will be described in detail with reference to the attached drawings. Note that the following embodiments do not limit the invention according to the claims, and not all of the combinations of features described in each embodiment are necessarily essential to the solution of the present invention. In this embodiment, an image forming apparatus is used as an example of an information processing apparatus, but the present invention is not limited to this.

[0010] Example 1 Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0011] FIG. 1 is a hardware configuration diagram of the image forming apparatus 1. The configuration of the image forming apparatus 1 will be described with reference to this diagram. A central processing unit (hereinafter, CPU 101) runs software for operating the image forming apparatus 1. A system bus 102 is a bus for the CPU 101 to access other units, and also serves as a path for other units to access each other. A hard disk unit (hereinafter, HDD 103), which is a non-volatile storage device, stores the software of the image forming apparatus 1, various programs necessary for the image forming apparatus 1 to operate, databases, and temporary storage files. The various necessary programs are, for example, Loader, Kernel, Initrd, and Firmware, which will be described later. Note that, although an example in which Loader, Kernel, Initrd, and Firmware are stored in the HDD 103 is shown here, they may be stored in a USB device (not shown).

[0012] A random access memory (hereinafter, RAM 104) is a storage area where the programs of the image forming apparatus 1 are loaded and where variables during program operation and data transferred from each unit by dynamic memory access (hereinafter, DMA) are stored.

[0013] A network controller 105 and a network controller I / F 106 communicate with the image forming apparatus 1 and other devices on the network. A USB host controller 107 and a USB host I / F 108 control communication between the image forming apparatus 1 and USB devices.

[0014] This USB host I / F 108 is connected to a USB device using a USB cable. Depending on the type of the USB device, it may be directly connected without using a USB cable. A display controller 111 controls a display 110 that displays the operating status of the image forming apparatus 1 so that a user or the like can check it, and controls the display on the display.

[0015] The input unit 113 accepts instructions from a user to the image forming apparatus 1. The input unit controller 112 controls the input unit 113. Specifically, the input unit 113 is an input system such as a keyboard, a mouse, a numeric keypad, a cursor key, a touch panel, or an operation keyboard. When the input unit 113 is a touch panel, it is physically mounted on the surface of the display 110.

[0016] A real-time clock (hereinafter referred to as RTC) 114 has a clock function, an alarm function, a timer function, etc. of the image forming apparatus 1, and measures time. A nonvolatile memory 115 is a rewritable nonvolatile storage medium. The nonvolatile memory 115 stores a BIOS program, setting information 125, and ECFW (ECFirmware), which will be described later. The setting information 125 stores key information used for tamper detection, as well as a setting value for whether or not to perform tamper detection. The data stored in the nonvolatile memory 115 is also stored in a nonvolatile memory 120, which is a backup for the nonvolatile memory 115.

[0017] CPLD 109 is a unit that reads the Low / High state of a signal line on a circuit board via CPU 101, or enables CPU 101 to change the setting of the Low / High state. CPLD 109 is a programmable logic device, and is a unit that enables control of power-related ON / OFF on image forming apparatus 1. Inside CPLD 109, there is a General Purpose Input Output (hereinafter referred to as GPIO).

[0018] CPU 101 can turn power-related functions on and off by changing the setting value of the GPIO register. A scanner 117 is connected to image forming apparatus 1 via system bus 102 and a scanner I / F 116. A printer 119 is also connected to image forming apparatus 1 via system bus 102 and a printer I / F 118.

[0019] The EC (Embedded Controller) 121 includes a sub CPU 122, a sub ROM 123, and a sub RAM 124. The sub ROM 123 stores a startup program.

[0020] When the image forming apparatus 1 is started and power is applied to the EC 121, the sub CPU 122 executes a startup program in the sub ROM 123. By executing the startup program, the sub CPU 122 reads ECFW (ECFirmware) from the non-volatile memory 115 and loads it in the sub RAM 124. The sub CPU 122 executes tampering detection of the ECFW loaded in the sub RAM 124. If the ECFW has not been tampered with, the sub CPU 122 executes the ECFW and verifies whether the BIOS program stored in the non-volatile memory 115 has been tampered with.

[0021] The EC 121 is also connected to the non-volatile memory 120 used for backup. When the EC 121 determines that the non-volatile memory 115 is in an invalid state, it overwrites and copies the contents of the non-volatile memory 120 to the non-volatile memory 115.

[0022] The EC 121 is also connected to the CPU 101 so that communication can be performed between them. Additionally, the EC 121 includes a timer 126, which can be used under the control of the sub-CPU 122 to determine whether a predetermined number of seconds has elapsed.

[0023] Fig. 2 is a flowchart showing an outline of the startup process of the image forming apparatus. As described above, when the power switch of the image forming apparatus 1 is turned on and the EC 121 is energized, the EC 121 executes a startup program stored in the sub-ROM 123. This starts the flowchart of Fig. 2.

[0024] The sub CPU 122 reads the ECFW recorded in the non-volatile memory 115 and executes tamper detection. If the ECFW has not been tampered with, the sub CPU 122 executes the ECFW (S201).

[0025] In S202, the sub CPU 122 determines whether the BIOS recorded in the nonvolatile memory 115 has been tampered with, and if no tampering has been found, releases the reset state of the CPU 101. After being released from reset, the CPU 101 executes BIOS processing (S202).

[0026] After completing the execution of the BIOS, the CPU 101 transmits step information (execution completion notification) indicating that the BIOS processing is completed to the EC 121 (sub CPU 122) (S203). The step information includes information that is used to determine how much processing has been performed at the present time. For example, a unique ID may be assigned to each startup process in advance, and the ID may be transmitted at an appropriate timing. The storage control of the step information in the EC 121 will be described later with reference to FIG. 3.

[0027] The CPU 101 determines whether the Loader stored in the HDD 103 or the USB memory 127 has been tampered with and performs initialization processing for each piece of hardware. If the Loader has not been tampered with, the CPU 101 loads the Loader from the HDD 103 or the USB memory 127 into the RAM 104 and starts the Loader processing (S204).

[0028] The CPU 101 determines whether the Kernel and the Initrd stored in the HDD 103 or the USB memory 127 have been tampered with, and if there is no tampering, loads the Kernel and the Initrd into the RAM 104. After the process by the Loader is completed, the CPU 101 transmits Step information indicating that the process by the Loader is completed to the EC 121 (S205). Next, the CPU 101 starts the process of the Kernel (S206).

[0029] The kernel initializes various hardware, loads device drivers, and controls access to the HDD 103 using a file system. After the kernel finishes processing, the CPU 101 transmits to the EC 121 the final step information indicating that the kernel processing is complete and recording of the step information is terminated (S207).

[0030] The CPU 101 determines whether each piece of firmware in the HDD 103 or the USB memory 127 has been tampered with, and if no tampering has been found, starts up the firmware in sequence (S208).

[0031] The firmware includes various software for controlling the image forming apparatus 1, as well as a logging system for recording a system operation log. This makes it possible to record system operation information as a log in the HDD 103 from S208 onwards. For this reason, the CPU 101 stores in the HDD 103 information indicating completion of the execution of the firmware.

[0032] 3 is a flowchart showing the recording of step information by the EC 121, which is a feature of the present invention. This process is performed by the sub CPU 122 in parallel after the EC 121 starts the operation of the CPU 101 after completion of S201 and the CPU 101 starts processing after the BIOS.

[0033] First, the sub CPU 122 sets the timer 126 (S301). This makes it possible to determine whether a predetermined time has elapsed. As for how long to wait, the sub CPU 122 may wait for a preset fixed value, or may wait by referring to a timer value included in the Step information notified from the CPU 101, or may set the value in some other way.

[0034] Next, the sub CPU 122 determines whether the timer 126 has timed out after a predetermined period of time has elapsed (S302) by checking for an interrupt from the timer 126, etc. If the timer 126 has not timed out (No in S302), the sub CPU 122 checks whether a Step notification has been received from the CPU 101 (S303).

[0035] The Step notification here is one that has been sent by CPU 101 in S203, S205, etc. If there is no Step notification (No in S303), the process starts again from checking the expiration of timer 126. If there is a Step notification (Yes in S303), the contents of the subsequently notified Step notification are checked to see if it is the last Step notification (S304).

[0036] Here, the last Step notification refers to the information notified in S207. It may be expressed as the last Step notification by including a unique data string different from other Step notifications, or by defining a bit indicating the end, or any other method may be used. If it is not the last Step notification (No in S304), the sub CPU 122 saves the notified Step notification information in the sub RAM 124 (S305). By saving the information in the sub RAM 124, which is a volatile device rather than a non-volatile storage device, the aim is to suppress wear due to writing to the non-volatile storage device. Next, the sub CPU 122 sets the timer 126 again (S306). By ks306, the sub CPU 122 starts over from checking the expiration of the timer 126 again and waits for the next Step notification. If the Step notification notified in S304 was the last Step notification (Yes in S304), the sub CPU 122 disables the timer 126 and stops waiting for a Step notification from the CPU 101 (S307).

[0037] On the other hand, if the timer 126 has expired (Yes in S302), the sub CPU 122 records in the non-volatile memory 115 (S308) information on the most recently received (latest) Step notification among the Step notifications stored in the sub RAM 124 in S305. When the timer 126 has expired, it is assumed that the CPU 101 has not been able to operate normally and has hung up. At that time, the most recently received Step notification information, which is information indicating approximately how far the process has progressed, is recorded in the non-volatile memory 115. This makes it possible to determine approximately which Step the error occurred after by, for example, retrieving the non-volatile memory 115 and checking the recorded information. After recording in the non-volatile memory 115, the sub CPU 122 disables the timer 126 and stops operation thereafter.

[0038] Fig. 4 is a flowchart of the process of the Loader in Fig. 2. The Loader selects an appropriate Kernel and Initrd, judges whether the Kernel and Initrd have been tampered with, and loads them into the RAM 104.

[0039] First, CPU 101 checks whether a special startup instruction is present (S401). The presence or absence of a special startup instruction can be determined, for example, by reading a register in input controller 112 and checking whether a specific predetermined pattern has been input. Other determination methods may also be used, such as when a specific USB device is connected to USB host I / F 108. If there is no special startup instruction (No in S401), CPU 101 uses the Kernel and Initrd for normal operation (S402). On the other hand, if there is a special startup instruction (Yes in S401), CPU 101 uses the Kernel and Initrd for special startup (S403).

[0040] The special startup Kernel and Initrd are used for limited purposes such as software updates, and are prepared separately so that they can operate even if the ones for normal operation are damaged. Next, the CPU 101 transmits Step information indicating that the tamper detection process has not yet started to the EC 121 (S404).

[0041] Next, the CPU 101 reads the setting information 125 stored in the non-volatile memory 115 and judges whether or not the setting value is for performing tamper detection (S405). If the setting is for performing tamper detection (Yes in S405), the CPU 101 reads the Kernel and Initrd to be used from the HDD 103 and judges whether each of them has been tampered with (S406). As a method of tamper detection, for example, the digital signature of the digital certificate generated in advance for the Kernel and Initrd is verified using a public key held in the device.

[0042] The CPU 101 executes tamper detection (S407). If it is determined that tampering has occurred (Yes in S407), the CPU 101 notifies an error (S408). For example, the CPU 101 operates the display controller 111 to display information indicating the error on the display 110.

[0043] On the other hand, if it is determined that there has been no tampering (No in S407) or if the tampering check is not performed in the first place (No in S405), the CPU 101 transmits Step information indicating that the Kernel and the Initrd have not yet been loaded to the EC 121 (S409). Next, the CPU 101 reads the Kernel and the Initrd from the HDD 103 and loads them into the RAM 104 (S410).

[0044] According to the configuration of this embodiment, by notifying the EC 121 of the current step information at the end of the process, it becomes possible to infer in what process the operation of the CPU 101 stopped. For example, in this figure, this is the access by reading the Kernel and the Initrd from the HDD 103, the write process of loading them into the RAM 104, and the process of the CPU 101 to determine whether or not there has been tampering.

[0045] When unintended behavior occurs due to a failure of the controlled hardware or a timing-dependent problem, the administrator can infer possible malfunctions in the controlled hardware from the Step information stored in EC121.

[0046] (Other embodiments) Although various examples and embodiments of the present invention have been shown and described, the spirit and scope of the present invention is not limited to the specific descriptions within this specification.

[0047] The present invention can also be realized by a process in which a program for implementing one or more of the functions of the above-described embodiments is supplied to a system or device via a network or a storage medium, and one or more processors in a computer of the system or device read and execute the program. The present invention can also be realized by a circuit (e.g., ASIC) that implements one or more of the functions. [Explanation of symbols]

[0048] 101 CPU 103 HDD 104 RAM 115 Non-volatile memory 121EC

Claims

1. An information processing device, a non-volatile memory that stores a first program and a second program; a first controller that executes the first program upon startup of the information processing device and detects whether the second program has been tampered with; a second controller that executes the second program if the second program has not been tampered with; having The information processing apparatus, wherein the second controller transmits a notification regarding the completion of execution of the second program to the first controller based on the completion of execution of the second program.

2. A storage means for storing a third program, The second controller is Executing the second program to detect tampering with the third program; executing the third program if the third program has not been tampered with; 2 . The information processing apparatus according to claim 1 , further comprising: a notification of the completion of the execution of the third program being transmitted to the first controller based on the completion of the execution of the third program.

3. The storage means stores a fourth program, The second controller is Executing the third program to detect tampering with the fourth program; executing the fourth program if the fourth program has not been tampered with; 3 . The information processing apparatus according to claim 2 , further comprising: a notification of the completion of the execution of the fourth program being transmitted to the first controller based on the completion of the execution of the fourth program.

4. The storage means stores a fifth program, The second controller is Executing the fourth program to detect tampering with the fifth program; executing the fifth program if the fifth program has not been tampered with; 4. The information processing apparatus according to claim 3, wherein a notification regarding the completion of the execution of the fifth program is stored in the storage means based on the completion of the execution of the fifth program.

5. the second program is a BIOS; the third program is a Loader, the fourth program is a Kernel, 5. The information processing apparatus according to claim 4, wherein the fifth program is firmware.

6. A timer for measuring time is provided.

5. The information processing apparatus according to claim 4, wherein, when the timer times out, the first controller stores in the non-volatile memory the most recent execution completion notification among the execution completion notifications received before the timer times out.

7. 7. The information processing apparatus according to claim 6, wherein the first controller stores the execution completion notification of the fourth program in the non-volatile memory by accepting the execution completion notification of the fourth program without timing out.

8. A method for controlling an information processing device having a non-volatile memory that stores a first program and a second program, a first controller that executes the first program upon startup of the information processing device and detects whether the second program has been tampered with, and a second controller that executes the second program when the second program has not been tampered with, A method for controlling an information processing apparatus, comprising the steps of: the second controller transmitting a notification regarding the completion of execution of the second program to the first controller based on the completion of execution of the second program.

9. A program for causing a computer to execute the control method according to claim 8.

10. A computer-readable storage medium storing the program according to claim 9.

Images