Changes

Deployment of [[Embedded Linux]] systems is the typical operation which follows the development phase. When the application is ready and fully tested in the develoment development environment, it's time to take the system to the field for the “real work”. This phase brings a lot of concerns to cope with, for example creating a suitable root filesystem, saving the data properly, implement and implementing successful on-the-field update strategies. This how-to guide explains how to solve lists some of the problems connected common issues related to the deployment of an embedded linux Linux system.

= Watchdog Non-volatile memories partitioning scheme = TypicallyIn general, during application developmentmany different schemes can be implemented. Cost, the watchdog device included in the embedded system is turned off. Before moving to the fieldreliability, enabling the watchdog is often a mandatory choice (*). The use of this peripheral is a little bit tricky because it involves both U-Boot and Linux. The following sequence shows the typical scenario when the system is working on the field:  # Processor comes out of reset; internal watchdog is disabled# U-Boot enables watchdog (timeout = 5 s); U-Boot main loop will take care speed are just some of refreshing it# Before giving control to Linux kernel, U-Boot will set up long (e.g 180 seconds) timeout. This is required in order to allow the kernel parameters to complete the boot stage and to run the application that will handle the watchdog refresh# Once the kernel boot process has completed, watchdog application will open the watchdog device file and will take care of its refresh (timeout = 10 s) To enable watchdog support in U-Boot, source code must be modified and considered when designing the bootloader must be recompiledpartitioning scheme. Usually, this means enabling CONFIG_WATCHDOG and CONFIG_xxx (where xxx is the name of the watchdog device). Once Linux is started (and if the kernel is compiled with watchdog support), watchdog is refreshed by a simple application like the one shown below: <pre>#include <stdio.h>#include <unistd.h>#include <fcntl.h>#include <stdlib.h>int main(int argc, const char *argv[]){ int fd=open[Standalone_boot_("/devBELK/watchdog",O_WRONLY); if(fd==-1BXELK){ perror("watchdog"); exit(1); } while(1){ write(fd,"\0",1); fsync(fd); sleep(5); }}</pre> |This requires the character device file:<pre>crw-r--r-- 1 root root 10, 130 Oct 3 2006 /dev/watchdog</pre> which can be created using article]] shows two quite different schemes on the following command:<pre>mknod /dev/watchdog c 10 130</pre>   (*) Enabling the watchdog functionality has several system-level consequences as well. As suchsame platform, system integrators need the freedom to decide whether to enable it or not. For instance, there are applications for which the system integrators do not want to enable the watchdog. They prefer that their final users are aware of software hangs and that the users reset the board manually. Of course, this approach might not make any sense in case of unattended devicesexample.

Some applications require a quick boot time. When deploying an embedded Linux system, this time has to be evaluated in order to verify if it matches the system requirement, if any. Should the boot sequence is too long, several techniques can be used to speed it up. For more details, please see [[SDVX-TN-001:_Fast_boot_time|this page]] or [https://elinux.org/Boot_Time this article]]. = Setting the MAC address = In case the system provides Ethernet interface, it must be guaranteed that each device is delivered with a unique MAC address. MAC addresses are managed by IEEE Registration Authority: IEEE Registration Authority IEEE Standards Department 445 Hoes Lane Piscataway NJ 08854 Phone: (732) 562-3813 Fax: (732) 562-1571 http://standards.ieee.org/contact/form.html For more details see also:<br>* http://standards.ieee.org/develop/regauth/index.html* http://standards.ieee.org/develop/regauth/tut/index.html

Generally speaking, it is worth to remember that '''DAVE Embedded Systems''' owns an IAB (Individual Address Block, a set different type of 4096 addresses), that is in the public listing, so everyone memories can find out that an address is associated lead to '''DAVE Embedded Systemslargely different boot times'''. Note that A common scenario is the registration authority provides only IABs and OUIs following:* The proof of concept (16000000+ addressesPoC), and that of a company new product is not allowed to request another IAB until at least 95% of the MAC addresses of the previous IAB have been useddeveloped using a microSD card as boot memory. Customers who build their products using '''DAVE Embedded Systems'''' SOMs (NaonEverything is stored there: bootloader, Lizardo.s. kernel, Qongroot file system, Zefeer,...) usually provide MAC numbers by themselves by acquiring them from IEEE. In fact there are many reasons for thatetc. Three can be stressed: * A CPU module Then, the software is NOT an end-product. It is not a product that goes directly deployed onto the target according to the final user as a LAN PCI board, or a printer serverproduction configuration by using SoM's onboard non-volatile memories. See [[Standalone_boot_(BELK/BXELK)#Use_case_. So, in 231|this real case of CPU modules, who gets a CPU module and build its own product with it, is responsible for handling the MAC address.* Even if '''DAVE Embedded Systems''' programs the MAC address in flash (]] as an example) at manufacturing stage, customer may erase, overwrite, modify this number for . Due to the actual CPU module. Also, fact that a large portion of the strategy and software is stored onto the position (NOR, NANDflash, E2PROM,...) of the MAC address overall boot time may varyincrease significantly. '''Why?**microSD card has a synchronous interface to the host, while raw NAND flashes used on DAVE Embedded Systems''' cannot guarantee system- in other words on- that MAC address is maintained in modules have not. Data communication between the form system-on-chio (SoC) and position it had when deliveredthe memory is much slower.* An end-product hosting a *More importantly, raw NAND flashes are unmanaged memories. Unlike microSD cards, they don'''DAVE Embedded Systems''' CPU module is not always t embed a '''DAVE Embedded Systems'''' product. When it is (controller for handling the commands received from the host and there are some examples), '''DAVE Embedded Systems''' puts taking care of low-level management of the proper MAC address underlying memory (which is based on the productNAND flash technology as well⁠). When it's This includes but is notlimited to wear leveling, DAVE can't provide MAC addresses: as already statedbad blocks management, and read errors handling. In the list case of DAVE's MAC addresses is publicraw NAND flashes, and these tasks are all performed by reading this list everybody can see that the product manufacturer is '''DAVE Embedded Systems''', which is not trueoperating system running on the host processor.

Basically , we can upgrade the system through the bootloader or through the kernel.

When the system doesn't allow a remote access, an operator must locally access the system through its user interface (in the best case) or through the serial port (in the worst case). If the

More information are is available in README, INSTALL and MULTI files included in the Dropbear distribution. Please note that for recent systems, as Lizard and Naon, Dropbear can be installed from '''pre-built packages''' (please refer to the distribution's package-manager documentation). =Security=Nowadays, a large number of newly designed embedded systems are used in Internet-connected products. As such, these systems have to face severe issues in terms of cybersecurity. This topic is huge and it is obviously beyond the scope of this document. It is worth remembering, however, that modern SOCs provide a rich set of native functionalities that address this issue. For instance, see [[XUELK-WP-001:_Secure_boot_on_iMX6UL|this page]] or [[BELK-TN-001:_Real-timeness,_system_integrity_and_TrustZone%C2%AE_technology_on_AMP_configuration|this technical note]]. These documents show how some of such functionalities were leveraged on DAVE Embedded Systems products. For a more general discussion about the security of Internet-connected devices, see for example the [https://www.iotsecurityfoundation.org/ IoT Security foundation website] or [https://www.microsoft.com/en-us/research/publication/seven-properties-highly-secure-devices/ this paper] by Microsoft. =Licensing=It is known that a GNU/Linux system is based on a large amount of open source software. Consequently, the manufacturers of a product embedding such software must deal with the open source license compliance. This topic is beyond the scope of this document, but a couple of links are provided anyway:*[https://elinux.org/Legal_Issues This article] provides an overview of license-related legal issues*Yocto build system generates automatically a manifest file to make the compliance management easier. For more details, please refer to [[https://www.yoctoproject.org/docs/1.8/dev-manual/dev-manual.html#maintaining-open-source-license-compliance-during-your-products-lifecycle|this link]] =Certifications=In general, all the products must conform to a set of standards in order to get the certificates required to be sold ([https://en.wikipedia.org/wiki/CE_marking CE marking] and [https://en.wikipedia.org/wiki/FCC_Declaration_of_Conformity FCC_Declaration_of_Conformity] are two well-known examples. In many cases, software modifications to the Board Support Package (BSP) or the user applications are required to pass the compliance tests dictated by these regulations (*). In a typical scenario, these modifications are usually carried out after the development of the user applications. Nevertheless, these changes must be committed to the source repositories in order to be part of the production images that are stored into the product.   (*) A common example is the enabling of the spread-spectrum technique to reduce the electromagnetic emission peak associated with a digital clock, which is usually implemented at boot loader level. =Misc=== Watchdog == Typically, during application development, the watchdog device included in the embedded system is turned off. Before moving to the field, enabling the watchdog is often a mandatory choice (*). The use of this peripheral is a little bit tricky because it involves both U-Boot and Linux. The following sequence shows the typical scenario when the system is working on the field:  # Processor comes out of reset; internal watchdog is disabled# U-Boot enables watchdog (timeout = 5 s); U-Boot main loop will take care of refreshing it# Before giving control to Linux kernel, U-Boot will set up long (e.g 180 seconds) timeout. This is required in order to allow the kernel to complete the boot stage and to run the application that will handle the watchdog refresh# Once the kernel boot process has completed, watchdog application will open the watchdog device file and will take care of its refresh (timeout = 10 s) To enable watchdog support in U-Boot, source code must be modified and the bootloader must be recompiled. Usually, this means enabling CONFIG_WATCHDOG and CONFIG_xxx (where xxx is the name of the watchdog device). Once Linux is started (and if the kernel is compiled with watchdog support), watchdog is refreshed by a simple application like the one shown below: <pre>#include <stdio.h>#include <unistd.h>#include <fcntl.h>#include <stdlib.h>int main(int argc, const char *argv[]){ int fd=open("/dev/watchdog",O_WRONLY); if(fd==-1){ perror("watchdog"); exit(1); } while(1){ write(fd,"\0",1); fsync(fd); sleep(5); }}</pre> This requires the character device file:<pre>crw-r--r-- 1 root root 10, 130 Oct 3 2006 /dev/watchdog</pre> which can be created using the following command:<pre>mknod /dev/watchdog c 10 130</pre>   (*) Enabling the watchdog functionality has several system-level consequences as well. As such, system integrators need the freedom to decide whether to enable it or not. For instance, there are applications for which the system integrators do not want to enable the watchdog. They prefer that their final users are aware of software hangs and that the users reset the board manually. Of course, this approach might not make any sense in case of unattended devices.  == Setting the MAC address of network interfaces== In case the system provides an Ethernet interface, it must be guaranteed that each device is delivered with a unique MAC address. MAC addresses are managed by IEEE Registration Authority: IEEE Registration Authority IEEE Standards Department 445 Hoes Lane Piscataway NJ 08854 Phone: (732) 562-3813 Fax: (732) 562-1571 http://standards.ieee.org/contact/form.html For more details see also:<br>* http://standards.ieee.org/develop/regauth/index.html* http://standards.ieee.org/develop/regauth/tut/index.html '''DAVE Embedded Systems''' owns an IAB (Individual Address Block, a set of 4096 addresses), that is in the public listing, so everyone can find out that an address is associated to '''DAVE Embedded Systems'''. Note that the registration authority provides only IABs and OUIs (16000000+ addresses), and that a company is not allowed to request another IAB until at least 95% of the MAC addresses of the previous IAB have been used. Customers who build their products using '''DAVE Embedded Systems'''' SOMs (Naon, Lizard, Qong, Zefeer,...) usually provide MAC numbers by themselves by acquiring them from IEEE. In fact, there are many reasons for this. Three can be stressed: * A CPU module is NOT an end-product. It is not a product that goes directly to the final user as a LAN PCI board, or a printer server. So, in case of CPU modules, who gets a CPU module and build its own product with it, is responsible for handling the MAC address.* Even if '''DAVE Embedded Systems''' programs the MAC address in flash (as an example) at the manufacturing stage, the customer may erase, overwrite, modify this number for the actual CPU module. Also, the strategy and the position (NOR, NAND, E2PROM,...) of the MAC address may vary. '''DAVE Embedded Systems''' cannot guarantee - in other words - that MAC address is maintained in the form and position it had when delivered.* An end-product hosting a '''DAVE Embedded Systems''' CPU module is not always a '''DAVE Embedded Systems'''' product. When it is (and there are some examples), '''DAVE Embedded Systems''' puts the proper MAC address on the product. When it's not, DAVE can't provide MAC addresses: as already stated, the list of DAVE's MAC addresses is public, and by reading this list everybody can see that the product manufacturer is '''DAVE Embedded Systems''', which is not true. ==Handling different product models==It is quite common to manufacture different product models on the top of the same hardware platform. In such cases, it is convenient to use a unified software for all models. DAVE Embedded Systems provides the [[ConfigID_and_UniqueID|ConfigID]] mechanism that can be exploited to achieve this goal. ConfigID can be exploited at boot loader level, at kernel level, and at application level.