Recommended

Rooting the KORG Kronos

Disclaimer: The following file is provided without any warranties. Backup all your settings before using it - maybe you'll need to ...

Search

Sonntag, 28. Februar 2016

Need help from experienced Kronos users

I am working on a way to increase the Kronos' performance (polyphony, simulatneous effects, boot time, etc.) significantly. To test the effectivity and reliability of my modifications, I need some test cases.

Ideally, you could provide me configuration examples that drive the Kronos into it's limits. The limitations (e.g. voice stealing, missing effects, etc.) should be easy to hear. I cannot rely on the Kronos' performance meters.

Please leave your examples in the comments or contact me via mail (kronoshacking@gmail.com).

Sneak preview:



Thanks!

Samstag, 12. September 2015

Compiling a Linux kernel for the KORG Kronos

It is not a secret that the KORG Kronos is running Linux with RTAI extensions.

To understand how the Kronos software works and also for development of custom software, it would certainly be useful to be able to compile our own kernel that loads and runs KORG's proprietary modules and the Kronos software.

The Version Magic String of the kernel distributed with the Kronos is "2.6.32.11-korg SMP preempt mod_unload ATOM". Futhermore, /proc/version tells us that the kernel was compiled using GCC 4.5.0.

Let us have a look at the kernel log output related to RTAI:
RTAI[hal]: <3.8.1> mounted over IPIPE-NOTHREADS 2.6-03.
RTAI[hal]: compiled with gcc version 4.5.0 (GCC) .
RTAI[hal]: mounted (IPIPE-NOTHREADS, IMMEDIATE (INTERNAL IRQs VECTORED), ISOL_CPUS_MASK: 0).
RTAI[malloc]: global heap size = 2097152 bytes, <BSD>.
RTAI[sched]: IMMEDIATE, MP, USER/KERNEL SPACE: <with RTAI OWN KTASKs>, <uses LINUX SYSCALLs>, kstacks pool size = 524288 bytes.
RTAI[sched]: hard timer type/freq = APIC/10416873(Hz); default timing: periodic; linear timed lists.
RTAI[sched]: Linux timer freq = 1000 (Hz), TimeBase freq = 1666440000 hz.
RTAI[sched]: timer setup = 999 ns, resched latency = 2944 ns.

Since the kernel and RTAI are distributed under the GPL, KORG should deliver all sources necessary to build the kernel together with the compiled binary file (or include a written offer to send the sources on request).

In some documentation, it says that the sources for GPLed code would ship on "Accessory Disk 2". 

Since KORG is distributing the compiled Linux kernel online in the Kronos Firmware Update downloads, the Kernel sources should also be available online. I have not been able to find them, so this is probably a GPL violation.

Since I have bought a Kronos, I also own the Accessory Disks and - indeed - on Accessory Disk 2, there are the sources for the Linux kernel version 2.6.32.11 and RTAI 3.8.1 together with two patches (scroll to the bottom of this post to see the patches in detail).

If you do not have the Accessory Disks, the sources are of course also available for download:


So, we should have everything to build our own kernel for the Kronos, right?

Unfortunately, we are still missing one crucial part of information: the kernel configuration. Usually, this configuration is compiled into the kernel and available under /proc/config.gz, but KORG has disabled that feature. So, we need to find the kernel configuration by trial and error. It is important to get this right if you want to load the proprietary modules from KORG. The rely on sizes of data structures that may differ if the kernel configuration differs. In that case, the system will behave strange and/or just crash.

Download the kernel configuration I have found by trial and error here. It is not perfect, but matches close enough.

Now, we can boot our own kernel on the synthesizer. But something is strange - the proprietary modules will not load. loadmod.ko which is supposed to mount the encrypted loop filesystems with the synthesizer software just errors out. I have already explained the reason for that behavior.

What KORG did here is a clear violation of the Linux kernel's software license - the GPL. All sources necessary to build the software must be made available with the distributed binary.

To remedy this problem (I really want my own kernel on my Kronos), I have developed a set of patches that imitate the behaviour of the kernel distributed by KORG close enough, so that loadmod.ko works:

hal-linux-2.6.32.11-x86-2.6-03.patch
This patch is taken directly and unmodified out of the RTAI archive (RTAI 3.8.1). It implements lots of changes and hooks that the RTAI modules need to integrate themselves into the kernel.

kronos-provide-meminfo.patch
This patch exports two symbols (orig_mem_size and orig_mem_start). orig_mem_size is used by OA.ko (the actual synthesizer running in kernel mode) to determine how much memory is available on the system. This is important because OA.ko bypasses the kernel's dynamic memory management by ioremapping physical memory that is not used by the kernel.

kronos-cryptostuff.patch
This patch implements some cryptographic helpers that KORG hid inside the generic cdrom driver. Those functions are used by loadmod.ko to calculate the keys required to the security IC. If they are not implemented properly in the kernel, loadmod.ko cannot read the secret per-device key that is used to decrypt the authorization file (detailed explanation).

kronos-export-do_generic_file_read.patch
This patch exports do_generic_file_read() which is required by KORG's proprietary modules.

kronos-fix-kconfigs.patch
This patch enables FB_DEFERED_IO which is required by KORG's framebuffer driver (the Kronos' screen is actually a framebuffer which is sent to the OMAP via USB). Also it enables support for the legacy firewire driver which is used by KORG, but masked by BROKEN in the kernel.

kronos-backport-xhci-driver.patch
This patch backports the XHCI driver from a later kernel version as the experimental driver in 2.6.32.11 does not support isochronous transfers (which are required by the NKS4 board).
The patch is required only if you want to upgrade your synthesizer with a XHCI-only mainboard.

kronos-increase-mlock-limit.patch
Eva (the userspace part of the Kronos firmware responsible for the UI) communicates with OA.ko (the kernel part of the Kronos firmware) via mmapped memory ranges. This patch removes the kernel's default limit on mmapped memory to accommodate Eva's requirements.

kronos-kernel-config.patch
This patch replaces the stock .config (kernel configuration file) with the kernel config I researched for the Kronos. There are some small additions (USB debugging, XHCI support) that do not forfeit binary compatibility between Korg's proprietary kernel modules and the compiled kernel.

KorgHwmonPermsPatch
This patch is actually published by Korg on their rescue CD. Changes permissions for hardware sensor access.

load_module_patch
This patch is actually published by Korg on their rescue CD. Patches module loading to trade memory usage for system startup time.

The latest set of patches (2016-04-02) is available here.

Using those patches, you can now compile your own bzImage for the Kronos and use it as a starting point for your own development. Have fun!

Donnerstag, 3. September 2015

Installing EXs using '/sbin/InstallEXs' form the command line

Installing EXs files is not done by Eva (the userspace GUI) or OA (the kernel engine). Instead, Eva calls a helper binary: /sbin/InstallEXs If you have installed the extensions for ssh access to your Kronos, you can also run the helper directly. Use the following syntax:
/sbin/InstallEXs -m VFAT -t disk -f exins-file -p exs-directory
where disk is 0 for install on first SSD or 1 for install on second SSD exins-file is the name of the install info file (without path name) exs-directory is the directory where the EXs files are located
An example:
# /sbin/InstallEXs -m VFAT -t 0 -f EXs13.exsins -p /mnt/usbdisk0/EXs13/
InstallEXs will now count to 100 (this is the percentage shown in the GUI). After the installation is finished, there is debug info in /tmp/installer_debug.

Samstag, 13. Juni 2015

Rooting the KORG Kronos

Disclaimer:

The following file is provided without any warranties. Backup all your settings before using it - maybe you'll need to reinstall your Kronos. You might even break it beyond repair (unlikely). Whatever happens - you are responsible - I am not liable in any way. Everything you do, you do on your own risk!

After the update, you can login into your Kronos as "root" and look around. The update also installs a busybox for your convinience. Be careful and do not change anything or you will likely end up with a non-bootable system.


How to install:
  1. Make sure that your Kronos is updated to software version 3.0.2
  2. Copy the files in the archive on a USB drive - just like a real update
  3. Insert the USB drive into the Kronos and start the update process
  4. Wait until the update is reported as successful
  5. Power cycle the Kronos
How to access your Kronos:
  1. Connect a compatible USB network adapter (or use the mainboard's ethernet connector).
  2. Set a FTP password in the settings
  3. Make sure the network settings are correct and look up the IP address of your Kronos
  4. Use ssh/scp/putty/winscp/... to connect as user "root" with the passwort set in the network settings as FTP password
Have fun!


Filesystem Integrity Check by loadmod.ko

When the Kronos is booting, the contents of the following files is hashed (MD5). The MD5 sum is compared to a static value compiled into loadmod.ko. If the values do not match, loadmod.ko will bail out. Do not change the files in this list on your Kronos or it will not boot anymore!

/
/bin
/bin/sync
/bin/awk
/bin/touch
/bin/grep
/bin/test
/bin/ls
/bin/mount
/bin/cut
/bin/setterm
/bin/gzip
/bin/echo
/bin/false
/bin/dc
/bin/stat
/bin/chown
/bin/mv
/bin/bash
/bin/bar
/bin/dd
/bin/cp
/bin/RunGrub.sh
/bin/env
/bin/tar
/bin/fanctrld
/bin/usleep
/bin/sed
/bin/vmstat
/bin/kill
/bin/gawk
/bin/ipcalc
/bin/sleep
/bin/umount
/bin/hostname
/bin/df
/bin/ShowReauthScreen
/bin/expr
/bin/date
/bin/vi
/bin/rm
/bin/mkdir
/bin/chmod
/bin/true
/bin/cat
/bin/sh
/bin/uname
/sbin
/sbin/ifconfig
/sbin/OmapNKS4Module.ko
/sbin/init
/sbin/insmod.static
/sbin/loadoa
/sbin/e2fsck
/sbin/hwclock
/sbin/dhclient-script
/sbin/insmod
/sbin/killall5
/sbin/MIDID
/sbin/GetPubIdMod.ko
/sbin/dosfsck
/sbin/hdparm
/sbin/modprobe
/sbin/shutdown
/sbin/grub
/sbin/UpdateOS
/sbin/mkswap
/sbin/iptables
/sbin/sysctl
/sbin/ip
/sbin/ifup.lite
/sbin/loadmod.ko
/sbin/tune2fs
/sbin/arping
/sbin/rmmod
/sbin/poweroff
/sbin/losetup
/sbin/runlevel
/sbin/reboot
/sbin/swapoff
/sbin/mke2fs
/sbin/ifdown.lite
/sbin/swapon
/sbin/halt
/sbin/pidof
/sbin/OmapVideoModule.ko
/sbin/STGEnabler.ko
/etc
/etc/sysconfig
/etc/sysconfig/network
/etc/sysconfig/network-scripts
/etc/sysconfig/network-scripts/ifcfg-eth0
/etc/sysconfig/network-scripts/ifcfg-lo
/etc/modprobe.conf
/etc/sysctl.conf
/etc/OA.rc
/etc/ld.so.conf
/etc/mtab
/etc/OA.si
/etc/inittab
/etc/fstab
/sys
/korg
/korg/ro
/korg/Eva
/korg/rw
/korg/Mod
/tmp
/mnt
/var
/usr
/usr/realtime
/usr/realtime/modules
/usr/realtime/modules/rtai_hal.ko
/usr/realtime/modules/rtai_fifos.ko
/usr/realtime/modules/rtai_sched.ko
/usr/realtime/modules/rtai_sem.ko
/usr/realtime/modules/rtai_ndbg.ko
/usr/realtime/modules/rtai_smp.ko
/usr/share
/usr/share/fonts
/usr/share/fonts/truetype
/usr/share/fonts/truetype/Arialbd.ttf
/usr/share/fonts/truetype/Geneva.ttf
/usr/share/fonts/truetype/Arial.ttf
/usr/share/fonts/truetype/Geneva_Bold.ttf
/usr/share/terminfo
/usr/share/terminfo/a
/usr/share/terminfo/a/ansi
/usr/share/terminfo/l
/usr/share/terminfo/l/linux
/boot
/dev
/lib
/lib/libcrypto.so.6
/lib/libresolv.so.2
/lib/modules
/lib/modules/2.6.32.11-korg
/lib/modules/2.6.32.11-korg/modules.pcimap
/lib/modules/2.6.32.11-korg/modules.dep
/lib/modules/2.6.32.11-korg/modules.inputmap
/lib/modules/2.6.32.11-korg/modules.ofmap
/lib/modules/2.6.32.11-korg/modules.ieee1394map
/lib/modules/2.6.32.11-korg/modules.usbmap
/lib/modules/2.6.32.11-korg/kernel
/lib/modules/2.6.32.11-korg/kernel/drivers
/lib/modules/2.6.32.11-korg/kernel/drivers/net
/lib/modules/2.6.32.11-korg/kernel/drivers/net/mii.ko
/lib/modules/2.6.32.11-korg/kernel/drivers/net/r8169.ko
/lib/modules/2.6.32.11-korg/kernel/drivers/scsi
/lib/modules/2.6.32.11-korg/kernel/drivers/scsi/scsi_wait_scan.ko
/lib/modules/2.6.32.11-korg/modules.isapnpmap
/lib/modules/2.6.32.11-korg/modules.ccwmap
/lib/modules/2.6.32.11-korg/source
/lib/modules/2.6.32.11-korg/modules.order
/lib/modules/2.6.32.11-korg/modules.seriomap
/lib/modules/2.6.32.11-korg/build
/lib/modules/2.6.32.11-korg/modules.symbols
/lib/modules/2.6.32.11-korg/modules.alias
/lib/libcom_err.so.2
/lib/ld-linux.so.2
/lib/libfreetype.so.6
/lib/libtinfo.so.5
/lib/libsepol.so.1
/lib/libext2fs.so.2
/lib/libattr.so.1
/lib/libdl.so.2
/lib/libpcre.so.0
/lib/libgssapi_krb5.so.2
/lib/libaudit.so.0
/lib/libpthread.so.0
/lib/libe2p.so.2
/lib/libstdc++.so.6
/lib/libgmp.so.10
/lib/libkrb5support.so.0
/lib/libselinux.so.1
/lib/librt.so.1
/lib/libz.so.1
/lib/libsysfs.so.2
/lib/libkrb5.so.3
/lib/libc.so.6
/lib/libblkid.so.1
/lib/libm.so.6
/lib/libncurses.so.5
/lib/libpopt.so.0
/lib/libssl.so.6
/lib/libkeyutils.so.1
/lib/libproc-3.2.7.so
/lib/libk5crypto.so.3
/lib/libuuid.so.1
/lib/libacl.so.1
/lib/libgcc_s.so.1
/lib/libdevmapper.so.1.02
/proc

The anatomy of a Kronos firmware update

The ZIP file contains some files that should be copied to a USB stick which is to be inserted into the Kronos. Let's have a look at the files:

bc
X86 32 Bit Linux Binary - a calculator

md5sum
X86 32 Bit Linux Binary - calculates MD5 checksums of files

DisplayUpdaterMessage
X86 32 Bit Linux Binary - opens a linux frame buffer device (/dev/fb1) that represents the Kronos' display (managed by the OMAP).

install.info
Holds information about the update itself. This is the first file that the Kronos reads when updating. Contains references to 3 other files (KRONOS_Update_3_0_2.tar.gz, pretar.sh, posttar.sh) and a signature.

The signature is the SHA1 of the following data (concatenated in the mentioned order):

  • the contents of the pretar script (if given in the install.info)
  • the contents of the posttar script (if given in the install.info)
  • the following 16 "magic bytes": 13h, D0h, AFh, EFh, E0h, 3Ch, 9Bh, 92h, 16h, 2Fh, AEh, FFh, 77h, 53h, 55h, E1h

The updater (UpdateOS) will only accept the update if the signature in install.info is correct.

pretar.sh
A shell script (bash) that is called in the upgrade progress before the actual firmware is extracted. This script does the following things:


  • Call DisplayUpdaterMessage to show "Verifying install media..."
  • Call md5sum to calculate the MD5-Checksum of "KRONOS_Update_3_0_2.tar.gz" and compare it to a known value
  • Call md5sum to calculate the MD5-Checksum of "DisplayUpdaterMessage" and compare it to a known value (pointless since DisplayUpdaterMessage has already been called before)
  • Call md5sum to calculate the MD5-Checksum of "bc" and compare it to a known value
  • Make sure (via kill and kill -9) that the following processes are not running: vsftpd, avahi-daemon, messagebus, ifplugd
  • Make sure that the date is at least 1.12.2014

posttar.sh
A shell script (bash) that is called in the upgrade progress after the actual firmware is extracted. This script checks all extracted files' checkusms against the checksums stored in "KRONOS_Update_3_0_2.csum". It displays a progress bar by using "bc" to calulate the percentage of finished files and writing it to "writing to /proc/OmapNKS4ProgressBar"

KRONOS_Update_3_0_2.tar.gz
Contains the Kronos' root file system. This is the acutal firmware update. I will look into it and explain it's contents later in this post.

KRONOS_Update_3_0_2.csum
Contains checksums for all files in "KRONOS_Update_3_0_2.tar.gz". Used by posttar.sh to make sure that the firmware update was properly installed

Mittwoch, 3. Juni 2015

And one more GPL violation: vsftpd

The FTP service on the KORG Kronos is actually a vsftpd. Parts of the configuration have been patched into the binary. Here is part of the output of "strings vsftpd":
/SSD1
/korg/rw/HD%s/%s
/SSD2
/korg/rw2/HD%s/%s
/korg/ftp/%s
/korg/rw/HD
According to vsftpd's website, vsftp is licensed under the GPL. However, the changed sources for vsftpd are not provided on the recovery DVD. There is also no written offer to deliver the sources on request. This makes vsftpd the third GPL violation inside the Kronos...