/
RZ/G2L - Firmware Over-The-Air (FOTA) Update

RZ/G2L - Firmware Over-The-Air (FOTA) Update

Introduction

This guide provides steps and instructions for implementing the Firmware Over-The-Air (FOTA) update on the RZ/G2L EVK through AWS IoT Greengrass and the RAUC tool.

Assumption:
Before going through the following steps, please make sure that RZ Gateway Linux environment preparation was completed.

Architecture Description

The FOTA update application on the RZ/G2L receives an event from the AWS cloud and subsequently updates the firmware partitions of the RZ/G2L. The FOTA updater is a Greengrass application, incorporating Lambda Firmware updater and Downloader components to download the firmware bundle from the S3 bucket and apply the firmware update to the device.

Through this application, users can initiate the update of the RZ/G2L firmware remotely via the web UI interface.

The architecture diagram presented below illustrates the AWS services utilized in the cloud and the RZ/G2L EVK. This diagram features two environments: the AWS cloud and the RZ/G2L EVK.

Both environments are interconnected through internet communication protocols, like MQTT.

image-20250806-021947.png

Generate Key ring file using Open-SSL

RAUC uses an x.509 PKI (public key infrastructure) to sign and verify updates. Open-SSL can be used to create a simple key pair for testing.

Note: Please generate and replace the Key ring file before launching the build process described in RZ Gateway Solution Linux Environment Preparation

Use below command to generate key pair for 365 days

openssl req -x509 -newkey rsa:4096 -days 365 -nodes -keyout ca.key.pem -out ca.cert.pem -subj "/O=Renesasas inc. /CN=RZG2L FOTA Update"

Above command will generate ca.cert.pem and ca.key.pem files
Copy and Replace ca.cert.pem at $WORK/rz_gateway_sol/meta-rauc/recipes-core/rauc/files/ using below command

cp ca.cert.pem ca.key.pem $WORK/rz_gateway_sol/meta-rauc/recipes-core/rauc/files/

About RAUC Configuration Setup

RAUC reads the system configuration file and install updates on the target. It needs boot loader information to monitor and manage env of the bootloader. The partitions and bootloader must be configured in a system configuration file. Below is the example for system.conf

[system] compatible=smarc-rzg2l-ota-update-demo bootloader=uboot data-directory=/tmp/rauc bundle-formats=-plain boot-attempts=3 #boot-attempts-primary=1 #activate-installed=true [keyring] path=/etc/rauc/ca.cert.pem [slot.kernel.0] device=/dev/mmcblk0p3 type=raw parent=rootfs.0 [slot.kernel.1] device=/dev/mmcblk0p6 type=raw parent=rootfs.1 [slot.dtb.0] device=/dev/mmcblk0p5 type=raw parent=rootfs.0 [slot.dtb.1] device=/dev/mmcblk0p7 type=raw parent=rootfs.1 #[slot.bootimg.0] #device=/dev/mmcblk0p8 #type=vfat #bootname=A #[slot.bootimg.1] #device=/dev/mmcblk0p10 #type=vfat #bootname=B [slot.rootfs.0] device=/dev/mmcblk0p9 type=ext4 bootname=A [slot.rootfs.1] device=/dev/mmcblk0p11 type=ext4 bootname=B

Above is the rauc system.conf using on RZG2L EVK for FOTA update. For more details, visit RAUC documentation

About RAUC Manifest and bundle Recipe

As part of FOTA update, meta-rauc is integrated to VLP Linux. Using meta-rauc layer, a recipe can be written to create a firmware bundle for firmware update. The recipe collects information of firmware components from the variables and generate manifest file automatically and generates the bundle.
Below are the variables used to create the manifest file and rauc bundle for RZ/G2L EVK:

PROVIDES = "core-image-bsp-bundle" inherit bundle LICENSE = "MIT" LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302" RAUC_BUNDLE_COMPATIBLE ?= "smarc-rzg2l-ota-update-demo" RAUC_BUNDLE_VERSION ?= "v1.0.0" SRC_URI += " file://post_install.sh" RAUC_BUNDLE_HOOKS[file] = "post_install.sh" RAUC_BUNDLE_SLOTS ?= "kernel dtb rootfs" RAUC_SLOT_kernel ?= "linux-renesas" RAUC_SLOT_kernel[type] ?= "file" RAUC_SLOT_kernel[file] ?= "Image-${MACHINE}.bin" RAUC_SLOT_kernel[hooks] ?= "post-install" RAUC_SLOT_dtb ?= "linux-renesas" RAUC_SLOT_dtb[type] ?= "file" RAUC_SLOT_dtb[file] ?= "r9a07g044l2-smarc-${MACHINE}.dtb" RAUC_SLOT_dtb[hooks] ?= "post-install" # RAUC_SLOT_bootimg ?= "bootimg-partition" # RAUC_SLOT_bootimg[fstype] = "vfat" # RAUC_SLOT_bootimg[hooks] ?= "post-install" RAUC_SLOT_rootfs ?= "core-image-bsp" RAUC_SLOT_rootfs[fstype] = "ext4" RAUC_SLOT_rootfs[hooks] ?= "post-install" # Enable building verity format bundles with RAUC_BUNDLE_FORMAT = "verity" # Additionally, you need to provide a certificate and a key file RAUC_KEY_FILE = "${COREBASE}/../meta-rauc/recipes-core/rauc/files/ca.key.pem" RAUC_CERT_FILE = "${COREBASE}/../meta-rauc/recipes-core/rauc/files/ca.cert.pem" # For bundle signature verification a keyring file must be provided RAUC_KEYRING_FILE ?= "${COREBASE}/../meta-rauc/recipes-core/rauc/files/ca.cert.pem"

About partitions map details for FOTA update

FOTA update uses RAUC tool to update the firmware partitions. Partitions AB model is used to update To update firmware partitions. i.e. if the system running on slot-A the new firmware will be updated on alternative partitions (slot-B) and active the slot-B after firmware update is completed. In the next boot, system uses the new firmware. If the system encounters boot issues, the boot part is rollback to old firmware.
Here is the configuration of firmware partitions on wic image

image-20250807-041618.png

Here is the partition table for SD card

image-20250807-041643.png

Step 1 - FOTA Update Bundle Preparation

The FOTA update application requires a RAUC bundle to perform firmware updates on the RZ/G2L EVK. The RAUC bundle can be generated on the Host machine utilizing the Manifest file along with the rauc tool. A recipe has been developed in the VLP to facilitate the automation of both the Manifest file creation and the RAUC bundle generation from the Manifest file. Users can configure the Manifest variables within the $WORK/rz_gateway_sol/meta-rauc/recipes-core/bundles/core-image-bsp-bundle.bb recipe. To create the RAUC bundle, execute the following commands:

cd $WORK/rz_gateway_sol/ TEMPLATECONF=$PWD/meta-renesas/meta-rzg2l/docs/template/conf/ source poky/oe-init-build-env build MACHINE=smarc-rzg2l bitbake core-image-bsp-bundle

After the bitbake command has been successfully executed, the RAUC bundle core-image-bsp-bundle-smarc-rzg2l.raucb will be generated at $WORK/rz_gateway_sol/build/tmp/deploy/images

Step 2 - Upload FOTA update bundle to S3 Bucket

Once the core-image-bsp-bundle-smarc-rzg2l.raucb is generated, user has to manually upload the bundle to S3 bucket. Before upload to S3 bucket user has to setup the infrastructure as explained in setup FOTA update infrastructure.

  1. Open S3 bucket console.

  2. Open fota-update-<AWS_ACCOUNT_ID>
    Note: if not exist create bucket with same name and open it.

image-20250917-071239.png

  1. Create a folder (any name) for the firmware bundle and open it.

image-20250917-071339.png

  1. Upload the RAUC firmware bundle to the created folder.

image-20250829-052537.png

 

  1. User must upload the RAUC firmware bundle to S3 bucket as mentioned in above steps.

Step 4 - Infrastructure Setup

Important Note: About re-setting up the infrastructure
To successfully establish the infrastructure, it is essential for the user to verify that the instances created on the device and in the AWS cloud are deleted before initiating the installation process.

When resetting up the infrastructure, please follow the steps descrided in Remove the instances from both device and AWS Cloud.

Step 4.1 - AWS Credentials Preparation

AWS Credentials are necessary to establish the FOTA update environment on the cloud and the RZ/G2L EVK. The user must create an AWS account and log into the AWS Management Console using either the root account or an existing IAM user with administrative rights. If the user does not have an IAM user, follow the steps outlined below to create one
• Navigate to the IAM service.
• Create a new IAM user (if not have) and ensure Programmatic access is enabled during creation. This will provide an AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.
• Attach appropriate policies to this IAM user to grant the necessary permissions.

image-20250806-022154.png

• Install AWS CLI on Host machine from AWS Documentation.
• Export AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as environment variables on Host Machine.
• Run following AWS cli command to generate AWS_SESSION_TOKEN for 36 hours duration
On Host Machine:

aws sts get-session-token --duration-seconds 129600

Command result:

{ "Credentials": { "AccessKeyId": "123...", "SecretAccessKey": "...", "SessionToken": "...", "Expiration": "2025-07-30T23:47:00Z" } }

• Copy and save the temporary AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN for further use.

Step 4.2 - Setup FOTA update infrastructure

The FOTA update application requires the setup of infrastructure on the AWS cloud and the RZ/G2L Device. On the RZ/G2L device, the application collects events and firmware details through Greengrass v2 components. On the AWS Cloud, deploy the web UI interface to interact with the application using an EC2 instance. The web UI interface publishes information via an MQTT topic. The Greengrass components subscribe to this topic and receive events and information from the AWS Cloud. The entire infrastructure is configured using the Ansible tool, which requires AWS credentials for access and setup on the AWS cloud.
The FOTA update package includes the ota-update.zip file, which contains scripts and source code for setting up the infrastructure. The ota_update.sh script sets up the RZ/G2L EVK using setup_ota_client_env.sh and executes Ansible to establish the cloud infrastructure using setup_ota_server_env.sh. Ansible processes the playbook.yaml to configure the AWS cloud. Follow the steps below to set up the FOTA update infrastructure on the RZ/G2L device and AWS cloud.


On the RZG2L EVK

  1. Download from GitHub the ota_update-v1.0.zip file

  2. Copy ota-update-v1.0.zip file to RZ/G2L /home/root

  3. Extract the zip file and remove the zip file.

unzip ota-update-v1.0.zip rm ota-update-v1.0.zip

  1. Change directory to scripts

cd ~/ota-update/scripts

  1. Run ota_update.sh providing AWS credentials and AWS region as arguments.

./ota_update.sh <AWS_ACCESS_KEY_ID> <AWS_SECRET_ACCESS_KEY> <AWS_SESSION_TOKEN> <AWS_REGION>

  1. The script will execute 30 to 40 minutes to setup the infrastructure on RZ/G2L Device and AWS cloud.

  2. During the execution of the script, it generates logs for each step. The user can review the logs sequentially as outlined below and validate the installation.

Setup on RZ/G2L EVK,
• Verifying and installing dependencies packages required for setup

image-20250807-003748.png

• Create IoT policy, IAM role, IAM policies and attach policies to IAM role.

image-20250807-005750.png

• Install Greengrass v2 on RZ/G2L EVK

image-20250807-005820.png

• Below log shows the summary of FOTA client installation

image-20250807-005846.png

Setup on AWS cloud
• Starts executing step-2, Setting up FOTA server using Ansible

image-20250807-005931.png

• Create EC2 instance key pair

image-20250807-010002.png

• Create and Launch EC2 instance

image-20250807-010056.png

• Connect EC2 instance with ssh

image-20250807-010127.png

• Deploy FastAPI server into EC2

image-20250807-010159.png

• Deploy React app to EC2

image-20250807-010230.png

• Create S3 bucket policies to access S3 bucket

image-20250807-010305.png

• Create Lambda function

image-20250807-010336.png

• Create Greengrass component

image-20250807-010430.png

• On Successful completion of Step-2, the below output is shown

image-20250807-010503.png

If the installation is successful, the above message will be shown on RZ/G2L EVK UART console

Step 5 - Execute FOTA update sample:

This section details the process of updating the RZ/G2L EVK with the selected firmware version through the FOTA update application. Follow the instructions to begin the FOTA update on the RZG2L EVK.

  1. Before initiating the FOTA update, let us review the existing state of the RZ/G2L EVK slots. Use the RAUC tool to check the status of the slots as shown below.

On RZG2L EVK:

rauc status
image-20250807-012118.png

From the above result, slots-A are active, and slots-B are inactive and in bad boot state (corrupted)

2. order to initiate the FOTA update, we must access the web UI interface through a browser. To launch the web UI application, a public IP address is required. Once the infrastructure has been established, the Ansible tool records the public IP in ota_update/scripts/ansible_start/instance_ip.txt.

On RZG2L EVK:

cat ~/ota_update/scripts/ansible_start/instance_ip.txt

18.232.79.133 (for e.g.)

  1. Open the browser and type the URL: http://<instance_ip>

  2. For e.g. http:// 54.91.108.87

image-20250807-012237.png

  1. The application opens log-in page. Enter username as “user” and Password as “1234” and click on log-in.

  2. Upon opening, the application presents the firmware update page.

  3. Select the firmware version from the drop-down list, and subsequently click the update button

image-20250807-012308.png

  1. Once update is started, we can observe logs at DownloadWorker Greengrass component

cat /greengrass/v2/logs/DownloadWorker.log
image-20250807-012341.png
tail -f /greengrass/v2/logs/DownloadWorker.log
image-20250807-012611.png

User can also find state of the state of installation of the firmware bundle using ps command

ps | grep “rauc install”
image-20250807-012736.png

Note: The RAUC installation will take approximately 90 minutes to install the bundle into RZ/G2L EVK
9. The installation completion status of the firmware bundle can be tracked by checking the DownloadWorker.log or by using the rauc status command.

image-20250807-012920.png

In the above result, After the update the system has activated slot-B, which will be effective from next boot.

  1. Now, Restart the RZ/G2L EVK and observe the system is booted from the alternative slot (B) with where the firmware bundle has been installed.

image-20250807-013003.png

After reboot, the system booted from slot-B and activated slot-B

Remove the instances from both device and AWS Cloud

To successfully establish the infrastructure, it is essential for the user to verify that the instances created on the device and in the AWS cloud are deleted before initiating the installation process. Follow the steps below to ensure the instances are removed.

Step 1 - Remove Greengrass core device

This section details the process of cleaning Greengrass instances on the RZG2L EVK and in the AWS cloud to set up the FOTA update on the device again. Following the steps to remove the Greengrass core device and its components.
On RZ/G2L EVK:
• Stop the Greengrass service and remove Greengrass v2 data from the device.

systemctl stop greengrass.service rm -rf /greengrass/v2

On AWS Cloud:
• Open AWS Greengrass console (link) and click on Core devices

image-20250807-000133.png

• Click on g2l_core_ota and click on Delete button

image-20250807-000209.png

• Select Delete option on the popup box. The core device instance will be deleted.
• In Manage -> All Devices -> Things, select g2l_core_ota thing and click on Delete. Click on Delete thing in next page. The g2l_core_ota thing will be deleted.

image-20250807-000301.png

Step 2 - Remove Greengrass components

• In Greengrass Devices -> Components, click on DownloadWorker

image-20250807-000348.png

• Click on Delete version and select Delete on popup box

image-20250807-000415.png

• Similarly select Greengrass Devices -> Components, click on OtaBundleDownloadComponent and delete the component.

Step 3 - Remove Lambda function component

• Open the Lambda Function console (link)

• In Functions select OtaBundleDownload Lambda function

image-20250807-000535.png

• Click on Delete option in the Actions list

image-20250807-000600.png

• Enter confirm in the popup box, the function will be deleted.

Step 4 - Remove EC2 Instance and Key pair

• Open EC2 instance console (link)
• Click on Instances -> Instances, Select ota-server instance

image-20250807-000717.png

• Select Stop Instance in the Instance State list. And click Stop button on popup box. The instance state will be changed from Running to Stopped

image-20250807-000742.png

• Select Terminate (delete) Instance in the Instance State list. And click on Terminate (delete) button on the popup box. The instance state will be changed from Stopped to Terminated.

image-20250807-000806.png

• In EC2 -> Network & Security -> Key Pairs, Select ota-server-key and select Delete in the Actions list. Type Delete in popup box. The EC2 instance ota-server-key will be deleted.

image-20250807-000839.png

Now, the device and cloud are ready to setup the infrastructure for FOTA update.