Platform index / Audio-over-Ethernet platform
Waves SoundGrid
Not a console, but the transport a great many of them hang off. Documented from both ends at once — the server firmware and the host driver are the same protocol version.
The load-bearing finding. The SoundGrid Server is a hard-realtime appliance, not a general-purpose Linux box. Its kernel command line isolates every worker core from the scheduler, RCU, tick, idle and frequency scaling, and SoundGrid frames are steered to a dedicated uncoalesced hardware receive queue.
Verdict. The most conventionally documentable platform here, because both sides of the same protocol version were available and corroborate each other — the driver names its C++ classes and the server names its message types.
Method
Static analysis of vendor-distributed binaries and configuration files already present on a machine holding a licensed installation. No Waves source code, NDA material or SDK was involved. Techniques: reading plain-text scripts, demangling C++ symbol and RTTI tables, extracting strings, and disassembling a small number of functions in the GPL kernel module.
Artifacts examined
- SoundGrid Driver (macOS kext) 16.5.15.119 — unstripped C++ symbols
- SGS firmware image
SGS_16.5, External_Version 16.5.79.183 — extracted SquashFS AG_NSServer— stripped ELF, retains C++ RTTIwsgnf.ko— GPL-licensed kernel module, unstripped- 141 ×
.wfiper-model I/O firmware files, referenced by name only
No manufacturer firmware, binaries or documentation are redistributed here. Artifacts are referenced by name and version only. See themethod and legal statement for the basis on which this analysis was performed and the boundaries it observes.
Hardware architecture
| Item | Finding | Confidence |
|---|---|---|
| Server platform | x86_64 appliance; the binary names an Intel I225-V 2.5GbE-class controller | Verified |
| Boot | SYSLINUX/EFI into a RAM-resident root filesystem — SquashFS (zstd) initrd on /dev/ram0, overlaid read-write on tmpfs and pivot_root'ed into | Verified |
| Base distribution | ryolinux-release 4.3, Buildroot-derived, hostname buildroot | Verified |
| Kernel | 6.12.11 SMP PREEMPT_RT — fully preemptible realtime | Verified |
| Link layer | EtherType 0x8908, steered by ethtool receive-flow rules to hardware queue 1 with interrupt coalescing disabled (rx-frames 1, tx-frames 1) | Verified |
Software architecture
| Item | Finding | Confidence |
|---|---|---|
| Process model | A single userland process, AG_NSServer (AudioGrid Network Shell Server), owns the protocol. It starts before the network stack is brought up | Verified |
| Realtime partitioning | Command-line options name a control core, a master core and a worker core set, plus AudioGrid and kernel CPU reserve percentages | Verified |
| Kernel fast path | wsgnf.ko — character device, an mmap region shared with userland, ioctls for sample-set enable/disable and interface naming, and /proc debug and stats entries | Verified |
| Shared mapping | Carries at least a mutex and a switch timestamp — the latter being how userland and kernel agree on the exact sample instant a configuration change takes effect | Inferred |
| Protocol shape | Not a flat command set. A set of node families, each with its own protocol version, addressed by node number, each exposing a description-get operation plus family-specific commands | Verified |
| Self-description | The server can emit its own protocol description as XML (-M, node protocol xml). Capturing that output is the single highest-value next step | Verified |
Update path & security model
| Item | Finding | Confidence |
|---|---|---|
| Scope boundary | Licensing, authorisation and entitlement mechanisms are explicitly out of scope and were not analysed | Verified |
| GPL obligation | wsgnf.ko declares license=GPL in its module metadata and is distributed in binary form as part of a product. The source-availability obligation applies on its own terms. No claim is made here about whether it has been met | Verified |
These rows describe how a platform validates a firmware image, because that is a structural fact about its architecture. They are not a vulnerability disclosure and no exploit, bypass or circumvention technique is published here. Licensing and entitlement mechanisms are out of scope throughout — seescope boundaries.
What is programmable
- 1An independently created node
The stated goal: a device that appears on a SoundGrid network as a discoverable node, recovers the network sample clock, and exchanges multichannel audio with servers and I/O devices.
Traps
Mistakes this analysis actually made, or came close to making. They are recorded because each one produces a plausible-looking wrong answer rather than an obvious failure.
- This is not black-box analysis and should never be described as such — the findings come substantially from inspecting vendor binaries.
- It is not clean-room analysis either, because no implementation exists yet and therefore no team separation has been established. Both terms are commonly misapplied to work of this kind.
Open questions
- No claim has been validated against live hardware. Nothing has been tested against a real SoundGrid network.
- Every wire layout should be treated as provisional until a packet capture confirms it.
- The XML self-description has not yet been captured from a running server.
Status of this entry. A written teardown exists and its claims carry evidence citations. Unless a row says otherwise, nothing on this page has been verified against physical hardware.