Firmware

SiteManager can download display firmware, keep it in a local cache, and update displays in a staged rollout.

For step-by-step help, see Update display firmware.

Signed firmware

SiteManager checks the signature of every image it keeps and labels it Signed by MultiTaction, Unsigned or Signed by another CA (refused). Displays whose firmware checks signatures install only images signed by MultiTaction, and SiteManager refuses, before anything is sent, to give them any other image. Displays that do not check signatures still take unsigned images. See Update display firmware. Displays whose firmware supports it also keep their own update server and branch; see Update channel.

The Firmware page

Open Firmware in the menu. The page has a catalogue, the cached images and a form to import a file.

Catalogue

The catalogue lists the firmware versions that are available. For each version it shows the display model it is for (MT556 or MT557), the firmware versions it can be installed over, and whether it is already in the cache.

• Select Download to fetch an image into the cache.
• Select Fetch the catalogue again to reload the list. SiteManager reuses a list it fetched in the last 10 minutes.

By default SiteManager asks MultiTaction's signed catalogue first and checks its signature, expiry and date before it lists anything. If the signed catalogue cannot be fetched, SiteManager lists the legacy update server instead, under Legacy update server (plain HTTP), and a warning says why. A signed catalogue that fails its check is never replaced by the legacy list: the page says the catalogue failed its check and was not used, with the reason. Change the catalogue with the --firmware-catalogue and --firmware-legacy options of the service. See Update display firmware.

If the computer has no access to the update server, import images from a file instead.

Cached images

Every image SiteManager holds is listed with its version, size, SHA-256 checksum, source, whether it matches the catalogue (match, mismatch, unknown or not-in-catalogue), its Signature label, and when it was added. Select Remove to delete an image from the cache. Images are kept in the firmware folder of the state directory.

Import a .swu file

Under Import a .swu file, choose a .swu file and select Import. A file can be up to 2 GiB. SiteManager checks that it is an update image with a version and the firmware it is for, and checks its signature, before it keeps it. If the file does not match the catalogue entry for its version, a warning says so.

Update firmware

You update displays in a rollout. Open Select displays, tick the displays or a whole wall, and choose Update firmware. The rollout page also has a From the catalogue block that offers, per display model, the catalogue versions that are not cached yet.

1. Choose the Image from the cache. If the cache is empty, download or import an image first.
2. Choose the Canary: the display that is updated alone first. The default is the first display.
3. Set Displays per batch (default 4) and Uploads at once (default 2).
4. Tick Allow downgrade or reinstall only if you want to install an image that is not newer than what the display has now. Without it, such displays are refused.
5. Select Check.

The check reads every display and shows What would happen: for each display its model, its current firmware and ready, a note that it is a downgrade or reinstall, or the problem that stops it. The check sends nothing. If any display has a problem, nothing starts. Fix the problem or leave that display out, and check again.

When every display is ready, the page shows a Standby block. It says that nothing has been sent to a display yet. Select Go · update N displays to start the rollout, or Stand down to go back. See Standby and Go. The rollout runs as a job:

• The canary display is updated first, alone.
• Then the other displays follow in batches. Within a batch, SiteManager works on at most Uploads at once displays together.
• For each group, SiteManager uploads the image to every display, checks again that the wall is idle, and only then flashes the displays and waits for them to come back with the new version.
• The rollout stops at the first failure. Displays already running finish, and the rest are not started.

Before each upload and before each flash, SiteManager runs the idle-wall check. If the wall looks in use, or SiteManager cannot tell, the job pauses and asks for your go-ahead on the job page. It checks again every minute and carries on by itself when the wall is idle. Tick Do not wait for a busy wall to skip the pause. The verdict is then only written to the log.

You can cancel a rollout from the job page. Displays that are already flashing finish.

From the command line, use sitemanager firmware. See Command reference.

Firmware re-check

For the steps and what to do, see After the update: the re-check.

A display whose firmware tries a new version once reports how its firmware started: trial until the new firmware has proved itself, then confirmed. If it never confirms, the display goes back to the firmware it had and restarts. SiteManager follows this in two stages.

During the update. After the restart and the version check, the display's row on the job page reads Waiting for the display to confirm the new firmware. SiteManager asks the display every 5 seconds, also through offline periods, for up to 10 minutes.

• Confirmed, with the new version: the row ends Running and the version, · confirmed.
• The display reports another version than the one installed: the update fails for that display. If it is the version the display had before, the error is went back to firmware after the update to : the new firmware did not start properly, so the display returned to the previous one. Try the update again; if it happens again, collect diagnostics and contact MultiTaction support. and the alert Firmware went back is raised. If it is a third version, the error says the display now runs another firmware than the one SiteManager installed, and the same alert is raised.
• Still in the trial after 10 minutes: the row ends · not confirmed yet; SiteManager will check again, and the display is checked again 5 minutes later.
• Does not say how it started: a display whose firmware has an encrypted connection or access keys is given 30 seconds to say. After that the row ends running and the version, and the display is checked again 15 minutes later. A display without either is not waited for, and is checked again 15 minutes later.

After the update. The watch list holds each updated display until it has been checked. It is the file firmware-watch.json in the state directory (readable only by the account that runs the service; it is not part of the diagnostics bundle; it survives a restart). Once a minute the service looks at each entry that is due and asks that display for its information, nothing else.

• The expected version, and confirmed or no state: the entry is removed, the row becomes · confirmed (or · the display did not report a confirmation), and an open Firmware went back alert for that display clears.
• The version the display had before: the alert Firmware went back is raised, critical, with the sentence above, and the row says so.
• Another version: the alert says the display runs another firmware than SiteManager installed, and that it may have been updated with another tool.
• Trial again: checked again 5 minutes later.
• The display cannot be reached: tried again the next minute. An entry that has waited 24 hours is dropped, with the audit note could not re-check.
• A display removed from the site is forgotten at the next minute. A new update of the same display replaces its entry. If firmware-watch.json cannot be read, the service still starts with an empty list, keeps the file aside (the five newest copies) and raises a SiteManager settings file alert.

Every outcome is written to the audit log as firmware.recheck, with the outcome (kept, reverted, changed, could not re-check or display removed), the job, the expected, previous and running versions and the boot state.

Where it shows:

• The job page lists Will check again at a time (your local time) for each display still to be checked, once the job has finished. The running order lists the same under the finished entry.
• A display's page and sitemanager displays show SERIAL (the line firmware start) use the same words: confirmed; waiting for the display to confirm, with ; SiteManager checks again at a time when the display is on the list; or just SiteManager checks again at a time when the display does not say. A confirmed display shows no check time. When the display does not say and nothing is watched, there is no suffix. The page reads the state when it loads.
• sitemanager firmware watch lists the entries. See Command reference.
• The JSON API has GET /api/v1/firmware/watch, and firmwareBoot and firmwareRecheck on a display. See The JSON API.
• The alert is Firmware went back (see Alerts). Notifications use it in the subject.