Information processing device and information processing program

Abstract

To provide an information processing apparatus and an information processing program that can recover even if an error occurs without implementing a download program in a binary of a part of firmware composed of three or more binaries.SOLUTION: Firmware is composed of three binaries including a boot program implementing a light-weight download program, a kernel program, and an application program implementing a download program. The boot program, the kernel program, and the application program are booted in this order and programs following each of them are verified. When the kernel program not implementing the download program verifies the application program and an error occurs, a verification NG flag is turned ON and is recorded in a non-volatile region. When the verification NG flag ON is recorded at reboot, the light-weight download program is executed to recover the error.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to an information processing device and an information processing program. [Background technology]

[0002] Patent Document 1 proposes a download device and a download method that dramatically reduces the increase in program capacity while allowing various communication means available for a control program to be used when downloading the control program. Specifically, a startup program having a download program that performs downloading using only a communication driver that communicates using a communication means that can be controlled with simple processing, and a control program having a communication program that communicates using at least a communication means that requires complex processing together with a main program, etc., and a self-modifying program that can be downloaded using the communication program are stored in a ROM. If the control program is valid, the self-modifying program enables downloading using a highly functional communication means, and at this time, since the OS, etc. are not held redundantly, the capacity can be reduced.

[0003] Patent Document 2 proposes an electronic control device that performs a program tamper detection process for each partial program obtained by dividing a program to be verified for tampering, and that reduces the memory area consumed for storing a verification authenticator while satisfying the constraints of startup time. Specifically, the proposed electronic control device has a memory unit that stores a plurality of divided programs obtained by dividing a program and a verification authenticator, a cryptographic calculation unit that generates a partial authenticator for each of the plurality of divided programs by cryptographic calculation, and a verification unit that generates a calculation authenticator by performing a logical calculation using the plurality of partial authenticators, and verifies whether the program has been tampered with based on whether the verification authenticator and the calculation authenticator match.

[0004] Patent Document 3 proposes an information processing device capable of properly and quickly booting a program. Specifically, the information processing device is capable of executing a secure boot, and the first memory in which the program is stored is and a second nonvolatile memory area in which a first flag having a first value indicating that the program is unverified or a second value indicating that the program has been verified is stored; and a storage device for storing a second flag having a third value indicating that rewriting to the first nonvolatile memory area is prohibited or a fourth value indicating that rewriting is permitted, and an authorization unit that receives a rewrite permission request and if the first flag has the second value, changes the value of the first flag to the first value and changes the second flag to the fourth value in accordance with the change of the first flag; a determination unit that determines that program verification is necessary if the first flag has the first value at the start-up of the information processing device, and determines that program verification is unnecessary if the first flag has the second value at the start-up of the information processing device; and a verification unit that controls the authorization unit to change the second flag to the third value when a verification request is received or if program verification is necessary, performs verification of the program in accordance with the change of the second flag, and skips program verification if program verification is unnecessary. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2003-263323 A [Patent Document 2] JP 2019-020872 A [Patent Document 3] JP 2017-156945 A Summary of the Invention [Problem to be solved by the invention]

[0006] In firmware that consists of three or more binaries, it would be redundant to have a download program installed in every binary. On the other hand, if there is a binary that does not have a download program, it may not be possible to recover if the binary that does not have a download program verifies the next program and the result is an error.

[0007] It is therefore an object of the present invention to provide an information processing device and an information processing program that are capable of recovery even if an error occurs, without loading a download program into some of the binaries of firmware consisting of three or more binaries. [Means for solving the problem]

[0008] In order to achieve the above object, an information processing device according to a first aspect includes a processor, the processor acquires firmware that is composed of three or more binaries including a first program, a second program, and a third program, and in which a download program is loaded into the first program and the firmware is started in sequence starting from the first program, verifies subsequent programs by starting them in sequence starting from the first program, verifies a program followed by a program that does not load the download program, and if an error occurs, records an error flag in a non-volatile area, and upon restart, if the error flag is recorded in the non-volatile area, executes the download program to recover from the error.

[0009] An information processing device according to a second aspect is the information processing device according to the first aspect, further comprising a download program loaded into the first program and the program to be started last.

[0010] In addition, an information processing device according to a third aspect is the information processing device according to the second aspect, in which the download program loaded into the first program is a simpler program than the download program loaded into the program launched last.

[0011] In addition, an information processing device according to a fourth aspect is an information processing device according to any one of the first to third aspects, wherein the firmware is composed of three binaries, the first program, the second program, and the third program, the first program being a startup program equipped with a downloaded program, the second program being a core program that is the core of the operating system, and the third program being an application program that runs on the operating system.

[0012] In addition, in an information processing device according to a fifth aspect, in the information processing device according to any one of the first to fourth aspects, the processor deletes the error flag recorded in the non-volatile area when a download is executed by the download program after a restart, or when a program corresponding to the error flag is verified after a restart and no error is found.

[0013] In addition, in an information processing device according to a sixth aspect, in the information processing device according to any one of the first to sixth aspects, the processor further performs processing to display on a display unit, when the error occurs, a message indicating that an error has occurred and that the error can be recovered by restarting.

[0014] In addition, an information processing program according to a seventh aspect causes a computer to acquire firmware composed of three or more binaries including a first program, a second program, and a third program, the first program being loaded with a download program and being started in sequence starting from the first program, verifies subsequent programs by starting them in sequence starting from the first program, verifies a program followed by a program not loaded with the download program, and if an error occurs, records an error flag in a non-volatile area, and upon restart, executes the download program to recover from the error. Effect of the Invention

[0015] According to the first aspect, it is possible to provide an information processing device that is capable of recovery even if an error occurs, without loading a download program into some of the binaries of firmware that is composed of three or more binaries.

[0016] According to the second aspect, even if the download program is not loaded into the second program to be started in the firmware consisting of three binaries, recovery is possible even if an error occurs.

[0017] According to the third aspect, it is possible to reduce the firmware size, compared to a case in which neither the first program nor the second program is a simple download program.

[0018] According to the fourth aspect, even if an error occurs when verifying an application program by the core program, by rebooting the computer, the application program can be downloaded and recovered by executing the download program of the startup program.

[0019] According to the fifth aspect, it is possible to prevent the error flag from being deleted at the time of reboot, which makes recovery impossible.

[0020] According to the sixth aspect, when an error occurs, it is possible to check how to recover.

[0021] According to the seventh aspect, it is possible to provide an information processing program that is capable of being recovered even if an error occurs, without loading a download program into some of the binaries of firmware that is composed of three or more binaries. [Brief description of the drawings]

[0022] [Figure 1] 1 is a diagram showing a schematic configuration of an information processing device according to an embodiment of the present invention; [Diagram 2] 2 is a block diagram showing an example of the configuration of firmware stored in a ROM of the information processing device according to the present embodiment. FIG. [Diagram 3] 10 is a flowchart showing an example of a flow of processing performed in the information processing device according to the present embodiment. [Figure 4] FIG. 1 is a block diagram showing an example of the configuration of conventional firmware. [Diagram 5] 13 is a flowchart showing a process flow in the case where recovery is impossible because the core program is not equipped with a download program. [Figure 6] 11 is a flowchart showing an example of a process flow in the case where firmware is configured with a startup program, an (N-1) program, and an application program. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0023] An example of an embodiment of the present invention will be described in detail below with reference to the drawings. In this embodiment, an information processing device included in an image forming apparatus will be described as an example. FIG. 1 is a diagram showing a schematic configuration of an information processing apparatus according to this embodiment. An image forming apparatus including an information processing apparatus 10 is applied to an image forming apparatus having multiple functions such as a facsimile function, an image reading function, an image forming function, a copying function, a storage function for storing image information, etc., and a transmission function for transmitting image information, etc.

[0024] The information processing device 10 includes a CPU (Central Processing Unit) 10A as an example of a processor, a ROM (Read Only Memory) 10B, a RAM (Random Access Memory) 10C, a storage 10D, an operation unit 10E, a display unit 10F, and a communication unit 10G. The CPU 10A controls the overall operation of the information processing device 10. The ROM 10B stores various control programs and various parameters in advance. The RAM 10C is used as a work area when the CPU 10A executes various programs. The storage 10D stores various data and programs. The operation unit 10E is used to input various information. The display unit 10F is used to display various information. The communication unit 10G is connectable to an external device 12 and transmits and receives various data to and from the external device 12. The above-mentioned units of the information processing device 10 are electrically connected to each other via a system bus 10H.

[0025] With the above configuration, the information processing device 10 according to the present embodiment executes, by the CPU 10A, access to the ROM 10B, the RAM 10C, and the storage 10D, acquisition of various data via the operation unit 10E, and display of various information on the display unit 10F. In addition, the information processing device 10 executes, by the CPU 10A, control of transmission and reception of various data via the communication unit 10G.

[0026] The information processing device 10 according to the present embodiment also includes various other configurations for image formation. For example, it includes configurations for performing image processing and image formation. Note that, in the present embodiment, the information processing device 10 is described as being included in an image forming device, but is not limited thereto, and may be included in various other devices. For example, it may be included in an image reading device. In this case, in addition to the configuration of FIG. 1, it includes configurations for image reading, image processing, and the like.

[0027] Incidentally, in the information processing device 10 according to the present embodiment, firmware is stored in the ROM 10B or the storage 10D, and the firmware can be updated. In the information processing device 10 according to the present embodiment, the ROM 10B or the storage 10D is a rewritable non-volatile memory such as an EEPROM (Electrically Erasable Programmable Read-Only Memory) or a flash memory. In the following description, it is assumed that the firmware is stored in the ROM 10B.

[0028] The ROM 10B of the information processing device 10 according to this embodiment stores programs executed by the CPU 10A, data used during execution, and the like, and in particular, here, updatable firmware. In this embodiment, the firmware is composed of three binaries: boot, kernel, and application. Hereinafter, boot is referred to as a startup program, kernel is referred to as a core program, and application is referred to as an application program. Note that each program of the firmware may be stored in the same ROM 10B, or may be stored in different ROMs or other storage 10D, etc. At least the core program and the application program are stored in a rewritable area or a storage unit such as a flash memory. Hereinafter, the two programs, the core program and the application program, may be collectively referred to as a control program.

[0029] The RAM 10C may be used as a work area when the CPU 10A operates, and may also be configured to temporarily store received data including new control programs when downloading firmware.

[0030] The CPU 10A operates according to programs such as firmware in the ROM 10B, and provides various functions and overall control of the information processing device 10. It also downloads transmission data including a new control program from the external device 12 and performs processing to rewrite the control program.

[0031] Here, a brief description will be given of an example of the configuration of firmware in the information processing device 10 according to this embodiment. Fig. 2 is a block diagram showing an example of the configuration of the firmware 14 stored in the ROM 10B of the information processing device 10 according to this embodiment.

[0032] As shown in FIG. 2, the firmware 14 includes three binaries: a startup program 20 as an example of a first program, a core program 30 as an example of a second program, and an application program 40 as an example of a third program.

[0033] The startup program 20 includes a boot program 22, a mode determination program 24, a communication driver 26, and a light download program 28. The boot program 22 is a program that operates at startup, such as when the power is turned on or when the device is reset. The mode determination program 24 is a program that determines the mode after being started by the boot program. For example, in this embodiment, the mode determination program 24 determines one of the normal mode, the download mode, and the light download mode. The mode is selected by a predetermined special operation, such as starting the device while pressing a predetermined key on the operation unit 10E when the power is turned on. The light download mode is, for example, a mode for developers, and the download mode is a mode for users. The communication driver 26 is, for example, a minimum communication driver, and communicates through a simple process via the communication unit 10G. Here, the simple process does not require the operating system 32 and the protocol stack 34, and the startup program 20 does not include the operating system 32 and the protocol stack 34, but may have a minimum configuration as necessary. The lightweight download program 28 is a simpler program than a download program 44 of the application program 40 described below, and is a program that performs downloading and rewriting via the communication driver 26 .

[0034] The core program 30 includes an operating system 32, a protocol stack 34, and a plurality of communication drivers 36, and is the core part of the operating system 32. The operating system 32 controls operations such as the operation, management, and running of the image forming apparatus including the information processing apparatus 10. The protocol stack 34 defines a hierarchy of protocols. The communication drivers 36 include a plurality of communication drivers 36, each of which performs high-performance communication with more complex processing than the communication driver 26 of the startup program 20 via the communication unit 10G.

[0035] The application program 40 includes a normal program 42 and a download program 44. The normal program 42 is a variety of programs used for each function of the image forming apparatus, and the download program 44 is a program that performs downloading and rewriting.

[0036] Next, a process performed in the information processing device 10 according to the present embodiment configured as described above will be described. Fig. 3 is a flowchart showing an example of the flow of the process performed in the information processing device 10 according to the present embodiment. Note that the process in Fig. 3 starts when the power is turned on by a power button (not shown) or the like, for example.

[0037] In step 100, the CPU 10A starts the startup program 20 and proceeds to step .

[0038] In step 102, the CPU 10A judges whether or not the light download mode has been selected. This judges whether or not the light download mode has been selected by a predetermined special operation, such as starting up while pressing a predetermined key on the operation unit 10E. If the judgement is affirmative, the process proceeds to step 104, and if the judgement is negative, the process proceeds to step 106.

[0039] In step 104, CPU 10A executes light download program 28. In step 104, when a download is executed by light download program 28 after reboot, if the verification NG flag is on and recorded in the non-volatile area, CPU 10A may delete the verification NG flag by turning it off.

[0040] In step 106, CPU 10A verifies core program 30 and proceeds to step 108. For example, a checksum or the like is used to verify that core program 30 has not been tampered with.

[0041] In step 108, CPU 10A judges whether the verification is OK or the verification NG flag is OFF. This judges whether the verification result in step 106 is OK or whether the verification NG flag described later is OFF. If the judgement is negative, the process proceeds to step 110, and if the judgement is affirmative, the process proceeds to step 200.

[0042] In step 110, the CPU 10A judges whether or not the mode is the download mode. This judges whether or not the download mode is selected by a predetermined special operation. If the judgement is affirmative, the process proceeds to step 104, where the program that has failed verification is recovered by executing the light download program.

[0043] If the determination in step 110 is negative, the process proceeds to step 112, where an error screen is displayed on the display unit 10F. If a restart is instructed or a predetermined time has elapsed, the information processing device 10 is restarted and the process returns to step 100 to repeat the above-mentioned process.

[0044] On the other hand, in step 200, CPU 10A starts core program 30 and proceeds to step 202.

[0045] In step 202, the CPU 10A verifies the application program 40, and proceeds to step 204. For example, a checksum or the like is used to verify whether the application program 40 has been tampered with.

[0046] In step 204, CPU 10A judges whether or not the verification is OK. This judges whether or not the verification result in step 202 is OK. If the judgement is negative, the process proceeds to step 206, and if the judgement is affirmative, the process proceeds to step 300. If the verification result is judged to be OK in step 204, and if the verification NG flag is on and recorded in the non-volatile area, CPU 10A may delete the flag by turning off the verification NG flag. Note that the verification NG flag is deleted under either of two conditions. That is, the flag is deleted when a download is executed by the lightweight download program 28 after rebooting, or when the program corresponding to the verification NG flag is verified after rebooting and no error occurs.

[0047] In step 206, the CPU 10A turns on a verification NG flag as an error flag indicating that the application program may have been tampered with, records this in a non-volatile area such as an EEPROM or flash memory, and then proceeds to step 208.

[0048] In step 208, CPU 10A displays an error screen on display unit 10F. For example, display unit 10F displays the occurrence of an error and that recovery is possible by restarting. If a restart is instructed here, or if a predetermined time has elapsed, information processing device 10 is restarted, and the process returns to step 100 to repeat the above-mentioned process.

[0049] On the other hand, in step 300, CPU 10A starts application program 40 and proceeds to step 302.

[0050] In step 302, CPU 10A performs mode determination. For example, if the normal mode is selected by a predetermined special operation, the process proceeds to step 304, and if the download mode is selected by a predetermined special operation, the process proceeds to step 306.

[0051] In step 304, CPU 10A executes normal program 42. On the other hand, in step 306, CPU 10A executes download program 44. By executing download program 44, recovery is achieved even if a problem occurs.

[0052] Here, as a comparative example, a conventional firmware will be briefly described. Fig. 4 is a block diagram showing a configuration example of the conventional firmware. Note that components corresponding to the components of the firmware 14 in this embodiment are given the same reference numerals and detailed description will be omitted.

[0053] Conventional firmware 50 is composed of two binaries, a startup program 20 and a control program 60, as described in Japanese Patent Application Laid-Open No. 2003-263323.

[0054] The startup program 20 is immutable after being written at the time of production, and includes a boot program 22, a mode determination program 24, a communication driver 26, and a lightweight download program 28.

[0055] On the other hand, the control program 60 is configured by combining the core program 30 and the application program 40 of the firmware 14 in this embodiment. That is, it includes an operating system 32, a protocol stack 34, a communication driver 36, a normal program 42, and a download program 44.

[0056] The start-up program 20 verifies whether the control program 60 has been tampered with by using a checksum or the like, starts the control program 60 if it is determined that the control program has not been tampered with, and stops the start-up if it is determined that the control program has been tampered with.

[0057] Conventional firmware 50 also has a normal mode, a download mode, and a light download mode. In the case of light download, the startup program 20 executes the light download program 28 in the startup program 20 without starting the control program 60. In the normal mode and download mode, the startup program 20 verifies the control program 60 and then starts it by providing the mode as a parameter. The startup program 20 has a recovery function, and for example, if it is started in the download mode but fails to verify the control program 60, it transitions to the light download mode instead and performs recovery.

[0058] When changing from a two-binary configuration like conventional firmware 50 to a three-binary configuration like firmware 14 in this embodiment, if a download program is included in all programs that make up firmware 50 as in conventional firmware 50, it would become redundant.

[0059] On the other hand, if some of the programs are not equipped with a download program, when an error occurs when starting a program that is not equipped and verifying the subsequent program, recovery is not possible. For example, as in this embodiment, when a download program is not equipped with core program 30, recovery becomes impossible during execution of the core program, as shown in the flowchart in FIG.

[0060] Here, a process flow will be described for the case where firmware 14 is configured from three binaries and no download program is included in core program 30. Figure 5 is a flowchart showing the process flow when recovery is impossible because no download program is included in core program 30. Note that processes common to Figure 3 will be described with the same reference numerals.

[0061] In step 100, the CPU 10A starts the startup program 20 and proceeds to step .

[0062] In step 106, CPU 10A verifies core program 30 and proceeds to step 107. For example, a checksum or the like is used to verify that core program 30 has not been tampered with.

[0063] In step 107, CPU 10A judges whether or not the verification is OK. This judges whether or not the verification result in step 106 is OK. If the judgement is negative, the process proceeds to step 104 to execute light download program 28, and if the judgement is positive, the process proceeds to step 200.

[0064] In step 200 , CPU 10 A starts core program 30 and proceeds to step 202 .

[0065] In step 202, the CPU 10A verifies the application program 40, and proceeds to step 204. For example, a checksum or the like is used to verify whether the application program 40 has been tampered with.

[0066] In step 204, CPU 10A judges whether or not the verification is OK. This judges whether or not the verification result in step 202 is OK. If the judgement is positive, the process proceeds to step 300, and the process thereafter is the same as in the above embodiment, so that the explanation of steps 300 and after will be omitted. However, if the judgement in step 204 is negative, the downloaded program cannot be executed, and recovery is impossible.

[0067] In contrast, in this embodiment, as described above, in core program 30 not equipped with a download program, if the application program 40 to be executed next is verified and found to be NG, a verification NG flag is turned on and stored in a non-volatile area. As a result, at the time of rebooting, if the verification NG flag is checked and found to be on, the program in question is downloaded by light download program 28 equipped in startup program 20 for recovery.

[0068] It is also conceivable to verify all programs when the startup program 20 is executed, but since the lightness of processing of a startup program affects the startup speed, a method of verifying all programs at startup is not preferable. Therefore, it is preferable to verify only the programs that need to be executed, since this requires the minimum processing time. For example, if the startup program 20 verifies the core program 30 and the application programs 40, and then cannot continue processing due to insufficient memory caused by corruption or the like in the middle of processing the core program 30, the verification of the application programs will be wasted, and the time until an error screen is displayed will be long, which is not preferable.

[0069] In the present embodiment, an example in which the firmware 14 is composed of three binaries has been described, but the number of binaries is not limited to three, and the firmware 14 may be composed of four or more binaries. FIG. 6 is a flow chart showing an example of a process flow in the case where the firmware is composed of the startup program 20, the (N-1) program, and the application program 40. The same processes as those in FIG. 3 are indicated by the same reference numerals. In the example of FIG. 6, the startup program 20 is equipped with a light download program, the application program 40 is equipped with a download program, and the (N-1) program is not equipped with a download program. In FIG. 6, the startup program 20 and the application program 40 perform the same process as in FIG. 3, and the (N-1) program performs the same process as the core program 30 in FIG. 3. That is, if the next program is verified and verification is NG, a verification NG flag is turned on and recorded in a non-volatile area, and an error screen is displayed. As a result, the program with a problem is recovered at the time of restart by executing the light download program of the startup program 20.

[0070] 6 shows an example in which the light download program 28 or the download program 44 is not installed in all of the (N-1) programs, but the present invention is not limited to this. For example, the light download program 28 or the download program 44 may be installed in some of the (N-1) programs.

[0071] In addition, in the above embodiment, an example was described in which the startup program 20 is equipped with a lightweight download program 28, but the startup program 20 may also be equipped with a download program 44 similar to the application program 40, which is not a lightweight download program.

[0072] In addition, in the above embodiment, the CPU has been described as an example of a processor, but the term "processor" refers to a processor in a broad sense, and includes general-purpose processors (e.g., CPUs, etc.) and dedicated processors (e.g., GPU: Graphics Processing Unit, ASIC: Application Specific Integrated Circuit, FPGA: Field Programmable Gate Array, programmable logic devices, etc.).

[0073] In addition, the operations of the processor in the above embodiments may be performed not only by one processor, but also by multiple processors located at physically separate locations working together. The order of the operations of the processor is not limited to the order described in the above embodiments, and may be changed as appropriate.

[0074] Furthermore, the firmware 14 in the above embodiment may be stored in a storage medium and distributed.

[0075] Furthermore, the present invention is not limited to the above, and it goes without saying that various modifications can be made without departing from the spirit and scope of the present invention. [Explanation of symbols]

[0076] 10. Information processing device 10A CPU 10B ROM 10D Storage 14 Firmware 20 Startup Programs 28 Lightweight Download Programs 30 Core Programs 40 Application Programs 44 Download Program

Claims

1. a processor, the processor comprising: Acquire firmware that is composed of three or more binaries including a first program, a second program, and a third program, and that is loaded with a download program in the first program and is started in order from the first program; verifying the subsequent programs by starting the first program in order, verifying the subsequent programs that are not equipped with the downloaded program, and if an error occurs while verifying the subsequent programs, recording an error flag in a non-volatile area; The information processing apparatus performs a process of recovering from the error by executing the downloaded program when the error flag is recorded in the non-volatile area upon reboot.

2. 2. The information processing apparatus according to claim 1, wherein the first program and the program to be started last are loaded with a download program.

3. 3. The information processing apparatus according to claim 2, wherein the download program included in the first program is a simpler program than the download program included in the program to be started last.

4. the firmware is composed of three binaries, the first program, the second program, and the third program, An information processing device according to any one of claims 1 to 3, wherein the first program is a startup program equipped with a download program, the second program is a core program that serves as the core of an operating system, and the third program is an application program that runs on the operating system.

5. An information processing device as described in any one of claims 1 to 4, wherein the processor deletes the error flag recorded in the non-volatile area when a download is executed by the download program after reboot, or when the processor verifies the program corresponding to the error flag after reboot and no error occurs.

6. 6. The information processing apparatus according to claim 1, wherein the processor further performs a process of, when the error occurs, displaying on a display unit a message indicating that the error has occurred and that recovery is possible by restarting the apparatus.

7. On the computer, Acquire firmware that is composed of three or more binaries including a first program, a second program, and a third program, and that is loaded with a download program in the first program and is started in order from the first program; verifying the subsequent programs by starting the first program in order, verifying the subsequent programs that are not equipped with the downloaded program, and if an error occurs while verifying the subsequent programs, recording an error flag in a non-volatile area; an information processing program for executing a process of recovering from the error by executing the downloaded program if the error flag is recorded in the non-volatile area upon rebooting;

Images