Film-Tech Forum ARCHIVE: KDM's getting nuked after last DCI upgrade?

This is topic KDM's getting nuked after last DCI upgrade? in forum Digital Cinema Forum at Film-Tech Forum ARCHIVE.

To visit this topic, use this URL:
https://ft-forum.com/ft/cgi-bin/ubb/ultimatebb.cgi?ubb=get_topic;f=16;t=001032

Posted by Dominic Espinosa (Member # 2122) on 02-19-2012, 12:41 AM:

Hey guys,
I know us Sony 4K users are few and far between here on the forums but I thought I'd ask anyway.

So, since the last DCI upgrade, which forced a replacement of the SSP board in the media block we have had a new symptom in our R220's. That is, if you open up the enclosure for ANY reason (such as to connect a Bluray player to the DVI input) the normal thing happens: Security is disabled and the mariage certificate becomes inactive -- no encrypted content can be played.

Now, what is SUPPOSED to happen with the covers are reinstalled is you can go and re-enable security and the marriage and all will be fine.

We're seeing though that the keys are gone. Completely. We have to re-ingest the keys again.

This wouldn't really be a big deal if we didn't have to pull the covers off to do hard resets on the media block and/or sms 2 or 3 times a week.

I called Sony who (as usual) said this was the first reported instance.
I'm really just curious if anyone else has had this happen.

Posted by David Zylstra (Member # 4230) on 02-20-2012, 11:46 AM:

I've heard discussions on what has to be flushed when a secure door is opened on a projector - it may be that flushing the KDMs is by design - I have heard discussions about the letter of the security rules (probably something in FIPS) say that internal certificates are supposed to flush as well during a "security breach" which would require more than just re-ingesting KDMs to fix (I have not read nor would understand the finer points of FIPS requirements).

I do not have Sonys, but I heard there is some kind of "maintenance mode" to activate before opening the access panels?

Posted by Dominic Espinosa (Member # 2122) on 02-20-2012, 01:15 PM:

Interesting.

As I understand it the marriage between media block and projector is supposed to divorce if the video cables are disconnected from the projector and media block.
This would necessitate calling the NOC for a new certificate before you can play out again.
This is only if there is power to the two units when it occurs. If the Media Block and Projector are both completely off (not in standby) and reconnected before power up they're fine.

The marriage becomes inaccessible when the CSS is tripped generating a FIPS error because the cover(s) have been removed.

As far as KDM's go, the Sony NOC told me they're supposed to be normal again after security is re-enabled and the marriage is secure. That is, we aren't supposed to have to re-ingest the keys.

I'm beginning to think I should read the DCI/FIPS documentation...

Posted by Tony Bandiera Jr (Member # 2365) on 02-20-2012, 03:42 PM:

LOL I'm beginning to think you should get rid of those stupid "Four-Letter-S-Words" and get real projectors that actually work..Like Barco, Christie, NEC.... [Big Grin]

Posted by Steven J Hart (Member # 2340) on 02-20-2012, 05:22 PM:

Tony, you gotta have a little sympathy. These guys aren't working with Sonys because they want to work with them. It's because they have to work with them. Management types aren't going to say "Oh we made a horrible mistake, lets spend millions of $'s more to get rid of these machines" It would indeed be a rare day when the suits will admit they made a mistake.

Posted by Dominic Espinosa (Member # 2122) on 02-21-2012, 11:33 AM:

+1 on what Steven said.

I tried all year last year to get F-T systems instead [Frown]

Posted by Tony Bandiera Jr (Member # 2365) on 02-24-2012, 01:56 PM:

Steven, you need to develop a sense of humor and note the use of the smilie in the post. [Razz]

I am more than aware that most of the folks here are stuck with whatever equipment the powers that be decide to buy, regardless of if it is right or not.

In other words, lighten up dude.

Dominic, I am disappointed that you "+1'd" his comment as I would hope that you know me better than that as we have talked in the past. [Frown]

Posted by Dominic Espinosa (Member # 2122) on 02-25-2012, 02:22 PM:

Tony, the gist of his comment was the truth so I +1'd it.

I can't tell if you're being serious now or not. I guess text isn't the best way to convey tone.
I have a lot of respect and appreciation for you, Tony, so no offense intended.

As far as this sitch goes, I've been told by 3 different NOC reps 3 different answers to the question.
One says they're supposed to delete immediately. Another says no, they should come back on their own.
And the third says they go away after 15 minutes and come back after security is established again.

Anyhow, just replaced the media block for the second time in our biggest house, we'll see how it goes now!

Posted by James Ness (Member # 4631) on 03-06-2012, 11:03 PM:

this definitely happens
i had to take the covers off to put DVI cables into 4 of mine
all of them had to have the keys re-ingested as they were completed erased, even after clearing the security error

Posted by Geoff Newitt (Member # 6663) on 03-08-2012, 05:53 AM:

Certainly the R110s and R210s I had the 'pleasure' of dealing with back in 2007/8 would delete KDMs if the boxes were opened or the power switched off.

It was also a painfully long 25 minute boot up in those days - please tell me that's got a bit quicker?

Over the course of about 18 months, I had three R110s and two R210s; we were guinea pigs, since we were close to Sony's European HQ at Basingstoke. There was no NOC in those days - we had so many issues that in the end they gave us the super secret code to reinitiate the security ourselves. I sometimes wonder if it's ever changed...

Posted by Marco Giustini (Member # 4544) on 03-09-2012, 04:34 PM:

I would definitely recommend to patch the DVI cables to the basement or to a rack so you don't have to open the projector to connect a DVI player.
About the hard reset, I'm not familiar with 220s, but if the hard reset is just resetting the power like a normal computer, I guess you could just unplug the power/switch the UPS off. Does not the LMT shutdown by touchpanel, does it crash?

Posted by Dominic Espinosa (Member # 2122) on 03-10-2012, 05:04 PM:

Geoff, this is all automated now. No codes needed.

I'd love to have root password so I can login via SSH and review the system logs...

Anyhow...

There is no soft shutdown for the LMT. You can soft reboot it from SMS-C but not from the PJT.
The only other option is to kill the power by the switch on the back.
It's a disc-on-chip but that doesn't help that the RAID drives are still mounted when it goes down...

Power switch resetting it has been an issue of scold from the NOC as of late however it's the only way when the damn thing doesn't respond and was in fact the method taught in maintenance training at Sony.

The UPS is inside the cabinet so you still have to open it up and break security. And if you kill the UPS you knock down the SMS server too.

Even better than that, there's a kill switch on the rear of the 220 (not sure about the 320's or earlier models) that will actually knock out EVERYTHING all at once. No soft shutdown, just BOOM off.
We'd been advised in the past to hit that thing and then told not to later on. Common sense says it's a bad idea.
Even if it doesn't do any damage it will take drastically longer.

The boot time from power off to ready to play is something like 12-15 minutes with everything off.
LMT can be rebooted in about 5, same with SMS. Projector just a couple minutes.
But synching everything back up is what takes the time. Especially with SMS.

Posted by Marco Giustini (Member # 4544) on 03-10-2012, 05:22 PM:

Gosh, I am used to 320s, apparently they're a tad better then! Anyhow, I'd recommend the DVI patch on your setup, at least you don't have to open the thing too often!

Posted by Dominic Espinosa (Member # 2122) on 03-10-2012, 07:33 PM:

That's what I'm told. Couple more weeks and we're rolling out 320's on our remaining screens.

We route the DVI cables most of the time and just leave it.
The KDM thing has become a nuissance though simply because we have to do a reboot either because SMS is totally unresponsive and therefore cannot be restarted from SMS-C or the media block crashed and wont respond to SMS.