Electronic apparatus and method

A method for controlling an electronic apparatus which includes a nonvolatile memory, the method comprising:

• executing a firmware program and a monitor program from each other,
• switching between a plurality of operation modes of the monitor program, the plurality of operation mode including a first mode and a second mode, and
• starting up the firmware program according to the monitor program;
• wherein
• a nonvolatile memory includes:
• storage regions in which a plurality of firmware programs is stored,
• a signature table configured to hold signatures of the plurality of firmware programs individually stored in the storage regions or a signature of one of the firmware programs including an identification number of an update notification used for update,
• a firmware program storage configured to store therein information specifying a firmware program selected to be executed, in accordance with the monitor program, among the plurality of firmware programs,
• a first storage configured to hold a result of execution of a firmware program selected in accordance with the monitor program among the plurality of firmware programs,
• a second storage configured to hold the update notification acquired as a result of the execution of the firmware program, and
• a third storage configured to hold a maximum identification number of firmware programs that have been executed among the plurality of firmware programs, wherein
• the method further comprising:
• in the first mode,
• determining, according to a result of a previous execution of a firmware program, validity of a function of the firmware program;
• after failing to determine the validity of the function of the firmware program, selecting and executing one firmware program from the plurality of firmware programs stored in the storage regions according to a given order of priority;
• and
• after succeeding in determining the validity of the function of the firmware program, performing a first verification of verifying the update notification acquired and held in the second storage, and
• changing an operation mode to be used from the first mode to the second mode to execute the firmware program, when the identification number of the update notification is larger than the maximum identification number, and
• in the second mode,
• after succeeding in a second verification of verifying the update notification stored in the second storage, succeeding in a third verification of verifying a firmware program acquired and stored in the storage region by the previous execution of the firmware program in response to the update notification, and succeeding in a fourth verification of confirming that the identification number is larger than the maximum identification number,
• transferring the update notification from the second storage to an entry of the signature table corresponding to the firmware program,
• changing the firmware program to be executed and an operation mode to be used from the second mode to the first mode and executing the firmware program, and
• executing the firmware program again after failing in any of the second verification, the third verification, and the fourth verification.