Software Release Notes - Matrix G3 and LED Video Wall Firmware ============================================================== The Matrix G3 and LED video wall system supports multiple 4K60 inputs (4 HDMI inputs per VC4H-BP+ or VC9H-BP+ video controller) with very flexible built-in features for displaying input sources on the video wall in any layout, configured via the easy to use Planar WallDirector web-based application. Product: Matrix G3 and LED Video Controller (VC) and Remote Power Supply (RPS) Firmware Part Number: 010-1613-05 Build Date: Nov 2, 2020 Firmware Version: 7.1.805 Supported VC Models: VC4H-BP+ VC9H-BP+ Supported RPS Models: RPS110-1 RPS110-2 RPS110-3 RPS220-1 RPS220-2 RPS220-3 Panel/DLI Firmware Version: 1.7.323 CPU Build: 3912 Video Processor Build: 503 / 43 ## Release Purpose - v7.1 This release adds support for the LX46S Matrix G3 panel model. This release also improves product security as suggested by a third-party audit in the following areas: - Firmware update and autorun package authenticity verification - WallDirector authentication and authorization checks - Strong encryption and protection of WallDirector passwords - Defense against attacks via malicious user data entry At this time there are no known instances of exploits against the Matrix and DLX video wall system. We generally recommend that customers should upgrade when new firmware includes security enhancements. Customers should decide whether to upgrade based on their own upgrade policies and assessment of the risk of exposure of their systems to likely threats. For example, if the Matrix / DLX control network is isolated from the enterprise and public networks, and if adequate physical security measures restrict access to the video wall components, then the customer may decide that the risk of exposure to future exploit is lower than the cost of potential downtime. In such a case upgrade may not be called for. ### Upgrading to v7.1 The enhanced firmware and autorun package authenticity checks mean that firmware v7.1 and later will no longer accept v7.0 and earlier firmware packages and autoruns. Similarly, v7.0 and earlier firmware versions cannot recognize the new more secure format of v7.1 and later firmware packages and autoruns. A special firmware package for upgrading systems from v7.0 and earlier is provided with the release. This firmware package can be recognized by v7.0 and older versions, and so must be used to upgrade these older versions to the current release. To upgrade a v7.0 or earlier system to the current release, use the firmware package named: FW_v7.1.805_upgrade_pre7.1.pkg When upgrading firmware from version 6.x or older to version 7.x, the following apply: 1. The WallDirector admin user password is reset to 'admin'. + Note that both prior and new security measures prevent the firmware from automatically retaining the customer's previous admin password, if it was set to anything other than 'admin'. + Customer sites that had set a custom admin password in a version older than 7.0 must set the admin password again after upgrading in order to re-establish their chosen admin password. 2. If the implicit auto-login conditions were met before the upgrade (admin password is 'admin' and no other users defined) then the auto-login user is set to be the 'admin' user. 3. Any other existing WallDirector user passwords are retained as-is. 4. The network TCP/UDP serial command service is enabled on port 57. This service is always enabled in versions lower than 7.0. For testing purposes, some customers may wish to downgrade a system from v7.1 or later to a firmware version of v7.0 or earlier. A new autorun is provided with the release that can be used to downgrade systems in this case. See the folder named "Autorun Downgrade" in the release distribution zip for detailed instructions. **Downgrade Note:** If any system is downgraded from firmware v7.1 or later to a version lower than or equal to 7.0, the WallDirector admin user password is set to 'admin', and the password for other user accounts is set to the same as the login name for each account. The extra security measures in place for version 7.1 and higher make it impossible for the firmware to preserve passwords through a downgrade to a version lower than 7.1. Future downgrades from versions higher than 7.1 to another version equal to or higher than 7.1 will retain the WallDirector admin and user passwords. ## Release Purpose - v7.0 This version provides several security enhancements which apply to version 7.0 and later: 1. New product shipments by default have the admin password set to the serial number of the system master unit. 2. A new option allows the installer to disable the network service that accepts serial commands on port 57 over TCP and UDP. See the new ADMIN: SECURITY SETTINGS dialog in WallDirector. 3. Auto-login behavior is controlled by an explicit setting that can designate any user as the auto-login user. This setting defaults to no user, i.e. no auto-login, except in the one upgrade case described below. 4. Factory reset does NOT reset the admin password. In order to recover a lost password, it is necessary to connect to either the RS232 or USB port of the system master unit and send the new command PASSWORD.SET (see below for details). + A new USB autorun is available that resets the admin password to the serial number and saves the serial number back to the USB drive. + Note: After factory reset the network TCP/UDP command service on port 57 is always enabled. 5. Security-related serial commands such as PASSWORD.SET are never allowed by the network service that accepts serial commands on port 57 over TCP and UDP. 6. Security-related settings such as enabling the TCP/UDP command service and setting the auto-login user are restricted to either the one user with login 'admin' (in WallDirector), or to UI's that require physical access such as the on-screen or VC front-panel menus. 7. The Command Console in WallDirector is restricted to only the one user with login 'admin'. + This, together with other security enhancements to the Command Console, enables it to be used to issue security-related serial commands. 8. Several internal software components have been updated to include recent security patches or recommended configuration changes to better secure those components. ### New Features - v7.0 - New firmware update features allow you to update other components to the system master version without uploading the firmware package, and also to download the last-installed firmware package from the system master unit. - A Source Absent Color can now be selected to help diagnose source absence vs. other potential issues preventing source display on the video wall. - When Auto Layout cannot be used to set panel positions, now you can drag and drop panels in the WallDirector SETUP view to change the panel column, row position. - TWA and TWS LED cabinet models have been added to the list of cabinet models for convenience in installations that use those cabinet types. - Added VC Output information for Panels in the VIDEO WALL SUMMARY dialog and CSV export. - Changing VC output panel refresh rate between 50Hz and 60Hz no longer requires a reboot. - Changing VC output video mode between 1080p and 4K no longer requires a reboot. ### New Serial Commands - v7.0 - AUTO.LAYOUT and RESET.LAYOUT For LCD video walls, use these commands with no modifier. For LED video walls, a panel identifier is required. The AUTO.LAYOUT(PN1) command, as an example, performs the setup steps for Panel 1's DLX cabinets commonly referred to as "detect, assign, and set position" in a single operation. As of this release, no function is implemented for RESET.LAYOUT(PN1) for DLX walls. This will be added in a future release. - COMMAND.ENABLE(NETWORK) = YES | NO This command can be used to enable and disable the command service that accepts serial commands via TCP or UDP on port 57 of the system master's network interface. - OUTPUT.MODE = 1080p | 4K This command can be used to force the system-wide (all VC's) output mode to either 1080p or 4K UHD. Note that the output mode must match the capability of the connected display system, which is always either ONLY 1080p or ONLY 4K UHD for all currently supported display types. With a VC modifier, this command can be used to query but NOT to set an individual VC's current output mode, e.g. OUTPUT.MODE(VC1)? Normally the VC system automatically detects the correct output mode according to the first display type connected to the system after a factory reset. Prior to any display being connected to a system the response to OUTPUT.MODE? will be AUTO to indicate this behavior. You cannot set a value of AUTO for output mode except indirectly by issuing a factory reset. - OUTPUT.VREFRESH = 50 | 60 This command can be used to set or get the system-wide (all VC's) output refresh rate to 50Hz or 60Hz. - PASSWORD.SET = "new password" This command can be used to directly set the password for the user named 'admin' from a trusted command interface only (RS232, USB serial, or WallDirector command console). This command is not accepted over network connections via the port 57 service. When using a serial connection it must be made directly to the system master unit. - SOURCE.ABSENT.COLOR and SOURCE.ABSENT.RGB These commands can be used to set and get the color to be shown on screen when sources are detected to be absent. Values for SOURCE.ABSENT.COLOR are BLACK, GRAY, RED, GREEN, BLUE CYAN, YELLOW, MAGENTA. Values for SOURCE.ABSENT.RGB are the 3 color components of the source absent color in red, green, blue order as 10-bit integers (range 0-1023). For example after SOURCE.ABSENT.COLOR=RED, SOURCE.ABSENT.RGB? returns 1023 0 0. - WALL.BRIGHTNESS and PANEL.BRIGHTNESS.OFFSET These commands can be used to set and get the global wall brightness in the range 0-100 and the individual panel brightness offset (used to match brightness for adjacent panels) in the range -100 to 100. The effective brightness setting of each panel is the sum of the global wall brightness setting and the individual panel's brightness offset, where the sum is clipped to the final range of 0-100 (effective value cannot be less than zero nor greater than 100). ## Certificate Requirements for iOS and macOS Changes were made by Apple, Inc. in trusted certificates requirements as of iOS 13 and macOS 10.15. In summary, server certificates must not have a validity period greater than 825 days, and must have a compliant ExtendedKeyUsage extension. For more detailed information, see https://support.apple.com/en-us/HT210176 Customers who have installed custom certificates in order to use certain iOS and macOS devices to access WallDirector will need to update their certificates to meet these requirements, when those devices are updated to the latest versions of their respective operating systems. ## MX65U-4K Installation Notes NOTE: For MX65U...-F (fiber option) panels, it is strongly recommended to disable genlock. This is not the same as disabling the Auto Genlock feature. The genlock disable option is hidden in OSD menus and the WallDirector web app prior to version 7.0, so in earlier versions you must use EXPERT mode to show the Disable Genlock option, or send the serial command GENLOCK.DISABLE=YES. This recommendation is due to the known issue #25539 where the fiber link can fail when the genlock feature adjusts the output timing to the panel. 1. Ensure all components are updated to firmware version 6.0.712 or later. Panel firmware version must be 1.6.304 or later. Panels are updated when they are powered and connected properly to a VC to which a firmware update is applied. 2. Two Cat 6A cables are required to be connected from adjacent VC outputs to each MX65U-4K panel. These connections must be made from VC OUT 1 & OUT 2, or VC OUT 3 & OUT 4 to the same panel. 3. The first connection must be made from VC OUT 1 or OUT 3 to the panel's primary input (farthest from the panel 48V power connectors). 4. The adjacent VC OUT 2 or OUT 4 must be connected to the panel's secondary input (nearest to the panel 48V power connectors). 5. VC's are shipped from the factory in 1080p output mode. Each VC decides independently to switch output mode to 4K, when that VC detects a 4K panel is connected and powered on. With firmware version 6 this switch to 4K mode requires a reboot of the VC to be effective. In version 7 and higher the switch to 4K mode is done without requiring a reboot. 6. Version 7 firmware adds an option to set VC output mode to 4K through the VC front panel menu without requiring any panel connected. See the ADVANCED: SYSTEM menu for this option. 7. Because of the higher bandwidth required, the maximum Cat 6A cable length for MX65U-4K is 40m. ## Security Updates - v7.1 Defect | Description :------|:--------------------------------------------------------------------- #26424 | Strengthen defense against malicious user data entry #26428 | Improve firmware update and autorun package authenticity verification #26425 | Ensure comprehensive WallDirector authentication and authorization checks #26434 | Use stronger encryption and protection of WallDirector passwords ## Fixed Defects - v7.1 Defect | Description :------|:--------------------------------------------------------------------- #26695 | Corrected MX55M 50Hz timing. To apply the fix, the system output vertical | refresh rate must be changed to 60Hz and then back to 50Hz again, after | upgrading firmware to version 7.1 or later. ## Fixed Defects - v7.0 Defect | Description :------|:--------------------------------------------------------------------- #25405 | MX65U-4K..-F (fiber) panels sometimes start up with bad or no video on half the panel. #25663 | Upstream switchers with frequent changes or unstable sources can cause VC lockup. #26009 | Interlaced sources (e.g. 1080i) garbled when connected to VC IN 2-4. | Note that generally VC IN 1 should be preferentially used for interlaced sources. #25323 | On MX/LX55M only, Panel Sync causes slight image horizontal shift for up-scaled zones. #23587 | After loading a saved configuration with network settings different from the current | settings, UI would show settings from the configuration, but actual network setup was | unchanged from before loading the configuration. #24266 | Adjusting wall brightness or LCD panel backlight offset causes a large jump in effective | brightness when the sum of the wall setting and the panel offset changes from 99 to 100. #23888 | 4096x2160@60Hz can't loop to more than 8 VC's. #24268 | 5760x3240@30Hz and 7680x3240@23Hz cannot loop via DP under 4.0 and later versions. #24214 | Error in backlight auto control where ambient threshold setting changes were not effective. #24183 | Incorrect reply to PANEL.SYNC.ENABLE serial commands. #25268 | Setting NETWORK.DNS1 and NETWORK.DNS2 by serial command not working. #25277 | Errors in the KEY serial command for KEY=nnn syntax and some symbols. #25295 | Error when getting system color temperature setting by COLOR.TEMP? serial command. #25466 | Serial command handler stops responding after SERIAL.NUMBER(unit)? is sent, when the | given unit identifier is invalid. ## Known Defects Defect | Description :------|:--------------------------------------------------------------------- #26987 | VC9H-BP+ may only show 4 outputs initially, with outputs 5-9 not working. | Workarounds: use factory reset, or delete the problem VCs from the configuration | and then reboot the system or disconnect/reconnect the VCs to cause them to be | rebuilt in the configuration. The problem is likelier to occur on larger systems. #25539 | MX65U...-F fiber link sometimes fails when genlock adjusts output timing #21819 | WallDirector can in rare cases stop responding, leaving user stuck at login screen. | The only workaround at this time is to reboot the system if this happens. #24344 | Polling LED cabinets for alerts can disrupt cabinet input AUTO mode behavior. | Use serial command CABINET.POLLING.INTERVAL to adjust the rate of polling from | 1000ms (1s) to 10000ms (10s). The default value is 2000 (2s). #24692 | Loading a bad HTTPS certificate can disable WallDirector entirely. | There is an autorun named "Remove HTTPS Certificate" that can help recover, or the | serial command RESET(HTTPS) followed by a system reboot can be used also. | Note that when uploading a new certificate, existing browser sessions must be | restarted, and it may be necessary to clear browser cache also. #22455 | OSD can draw menus slightly offset with shifted portion on another panel #23926 | DLX: FW update of DLI from 3.0 to 4.0 leaves cabinets set at brightness=0 #23895 | Assigned static IP address is still configured even after user changes back to DHCP #21860 | USB-serial driver gets a certificate / signing error on later Win 10 versions (workaround available) #20807 | Firmware update complete message may not show (use VC/RPS status LED to know when update is complete) ## Install Instructions ### Install method: WallDirector Firmware Update In version 3.0 and later, WallDirector supports updating all VC, RPS, and panels with one operation. Click the ADMIN: FIRMWARE UPDATE menu item to show the FIRMWARE UPDATE dialog. Then click the Select Firmware Package button and navigate to find the desired .pkg firmware package. When the upload to the system master finishes, click the UPDATE button to begin the system firmware update process. You can then close the FIRMWARE UPDATE dialog and monitor progress of the update via either or both of the SYSTEM ALERT messages in WallDirector and the status LEDs on the VC and RPS units. At any time until the UPDATE button is clicked you can simply close the dialog, or click a CANCEL button, to stop before the firmware update begins. ### Install method: Autorun Update System See the files included with this distribution named "Autorun Update System Instructions" and "autorun-update-system.pkg" for detailed instructions to apply this method. ### Install method: autorun.pkg 1. Place the FW file with extension .pkg (included in this distribution) at the root of a USB drive. This USB drive must be formatted with the FAT32 file system. Rename this file to autorun.pkg (all lowercase). 2. Insert the USB drive into the AUX USB port on the back of the target RPS or VC. 3. The firmware installation will proceed automatically shortly after the USB drive is inserted. If the indicator LED described below does not start blinking within 10-20 seconds, remove the USB drive, double check its contents, and try again. 4. When the front panel LED on the VC, or the Status/Cntrl LED on the RPS starts slowly blinking (about 1Hz), the RC or RPS is reading the firmware package. 5. When the front panel LED on the VC, or the Status/Cntrl LED on the RPS starts rapidly blinking (about 4Hz), the RC or RPS is done reading the firmware package to temporary local storage and has started to install the firmware. At this point it is safe to remove the USB drive from the AUX USB port. 5. Wait for the indicator LED to stop rapid blinking (normally 3 - 5 minutes). You can monitor the status of the update with the FIRMWARE.UPDATE? command. 6. Reboot the unit by cycling AC power to run the new firmware version. ## Updating From Version 2.0 When updating from any version 2.0 firmware to version 2.1 or later, it is necessary to ensure that the panel firmware update (included in the overall firmware package) is successfully applied to all LCD panels/DLIs in the video wall system. Depending on the install method used, and on the reliability of the Cat6 cables for data transfer (this varies), it may be necessary to apply the overall firmware update more than once to the VCs in the system, in order to successfully update all the panels or DLIs to the latest panel firmware. If you use the Autorun Update System install method to update from version 2.0, then none of the panels will update their firmware on the first update. You can reboot, wait at least 2 minutes after the system reboots, and then apply the Autorun Update System again. On the second system update, the panel firmware update will proceed. If you use the autorun.pkg method to update from version 2.0, then the panel firmware update will proceed during the first update. You may hear the VC fans accelerate to their maximum speed during this update - this is normal. In all cases, it is necessary for the integrator to double check that each panel in the system has updated to the current panel firmware version included with this package, in order for all features included in this update to function properly. If any panels have not updated after a second firmware update attempt, the autorun.pkg install method, applied only to those VCs that have panels attached that still need to be updated, will be the fastest way to finish the updates. The integrator must use either the OSD menus or the WallDirector web application to double check that every panel is updated in order for the system firmware update to be complete. In some cases VCs or RPSs may show a blank firmware version in v2.1 - the firmware update must be applied again until the correct firmware version is displayed for identification. This condition has been observed in particular for VCs - the fix for defect #22243 included in version 2.1 should reduce the likelihood of this problem for VCs, but again, it may require the installer to apply the update twice before the correct updated firmware version can be confirmed. Firmware v3.0 and later may show CPU/Video Processor build numbers when the overall firmware package version is not available (RPS reports only CPU build). ## Version Identification This version can be identified with the SYSTEM.VERSION and SYSTEM.PANEL.VERSION commands. ``` system.version? SYSTEM.VERSION:"7.1.805" system.panel.version? SYSTEM.PANEL.VERSION:"1.7.323" ``` All version information is also available in VC front panel menus in the FIRMWARE VERSION menu as of firmware version 5.1 and later. Version 4.0 and later report "System Firmware Version" in WallDirector, in the detail views for the VIDEO WALL in either the MONITOR or SETUP tabs, and in the OSD menus in the Information menu. If the reported System Firmware Version shows an asterisk (*) then at least one VC or RPS was connected with a firmware version that didn't match the system version. Version 5.1 and later add "Panel Firmware Version" reported in WallDirector, in the detail views for the VIDEO WALL in either the MONITOR or SETUP tabs, and in the OSD menus in the Information menu. If the reported Panel Firmware Version shows an asterisk (*) then at least panel was connected with a firmware version that didn't match the other panels. VC and RPS firmware versions can also be identified in the OSD menus in the Information -> Video Controller Information or Power Supply Information menus, respectively, or through the WallDirector web application in the detail views for Video Controllers and Power Supplies in either the MONITOR or SETUP tabs. Panel firmware version can be identified in the OSD menus in the Information -> Panel Information menu, or through the WallDirector web application in the PANEL SETUP: INFORMATION area of the SETUP tab or the PANEL DETAILS: INFORMATION area of the MONITOR tab. Version 4.0 and later add a FIRMWARE.VERSION serial command that can be used to get the firmware version of individual VC, RPS, and panel components as shown in these examples: ``` firmware.version(PS1)? FIRMWARE.VERSION(PS1):"4.0.650" firmware.version(VC2)? FIRMWARE.VERSION(VC2):"4.0.650" firmware.version(PN3)? FIRMWARE.VERSION(PN3):"1.4.207" ``` ## Version History Version | Date | Rev | Description :--------|:-----------|:----|:------------------------------------------------------------------ 7.1.805 | 2020/11/02 | 05 | Adds LX46S, includes security updates 7.0.765 | 2020/03/03 | 04 | Admin PW = master SN (new shipments) or 'admin' (upgrades) 6.3.743 | 2019/12/17 | 03D | Fix VC hangs on source switching and black zones / zone parts 6.2.737 | 2019/12/03 | 03C | Fix synchronized source image shift / wrap 6.1.730 | 2019/11/01 | 03B | All-decimal MAC fix; fix vulnerabilities noted by 3rd party scan 6.0.712 | 2019/10/03 | 03 | MX/LX55M and MX65U-4K support, improved deinterlacer 5.1.687 | 2019/07/15 | 02F | Configurable alerts, scheduled on/off, & mobile WallDirector 4.0.650 | 2019/04/23 | 02E | Fix for VC9H thermal bugs #24231 and #21655 4.0.617 | 2019/03/07 | 02D | Update panel fw only to fix bugs #23772 and #23953 4.0.605 | 2019/02/28 | 02C | VC9H-BP+; 9 zones; 72 panels; Zone and color balance cmds; Info cmds 3.0.504 | 2018/09/12 | 02B | Adds panel/DLI firmware 1.3.161 to support LED video walls 3.0.503 | 2018/09/12 | 02A | Adds max intensity, new branding, WallDirector features, bug fixes 2.1.498 | 2018/09/10 | 01B | Same as 2.1.456 with improved panel firmware update script 2.1.456 | 2018/06/26 | 01 | Adds WallSync, panel v1.2.110, several bug fixes 2.0.409 | 2018/05/11 | 00B | Fixes #21877 and #21087 2.0.393 | 2018/04/25 | 00 | First release to production supporting VC4H-BP+