Platform index / Networked audio module
Allen & Heath Dante option card (KLANTE)
A&H's in-house replacement for the Audinate Brooklyn II Dante module, codenamed KLANTE: a Xilinx Zynq-7010 running embedded Linux that hosts Audinate's Dante IP core. It is the one A&H firmware in this index that is cryptographically signed.
The load-bearing finding. The 28 MB .q16 is a SWUpdate package — and unlike every A&H console here, it is RSA-signed with per-image SHA-256. Inside is a whole Zynq-7010 Linux system (KlanteDDR_7010_RU.bit, U-Boot, kernel, JFFS2) running the Dante IP core, not an off-the-shelf Audinate module.
Verdict. The interesting outlier of the A&H set. Where the consoles are unsigned and open, this little Zynq-7010 — A&H's in-house Brooklyn II replacement — runs Linux and is the only firmware here protected by a real signature. The strong crypto in this ecosystem lives on the Audinate-derived network module, not on the mixers.
Method
Static analysis of QUDante16.q16 V1.0.2 — a SWUpdate cpio whose sw-description manifest, .bit bitstream header and boot payloads name every component. No hardware inspected.
Artifacts examined
QUDante16.q16— a SWUpdate cpio: signedsw-description+.sig,boot.bin/u-boot.img/uImage/devicetree.dtb, rootfs, FPGA bitstream, and the Dantecap1.binKlanteDDR_7010_RU.bit— Vivado 2019.2, part7z010clg400, designKlanteDDRTop, built 2024-10-31
No manufacturer firmware, binaries or documentation are redistributed here. Artifacts are referenced by name and version only. See the method and legal statement for the basis on which this analysis was performed and the boundaries it observes.
Hardware architecture
| Item | Finding | Confidence |
|---|---|---|
| SoC | Xilinx Zynq-7010 (XC7Z010, clg400) — IDCODE 0x03722093 read straight from the bitstream, part string 7z010clg400; the manifest's hardware-compatibility: 7010revA agrees | Verified |
| Role | A&H's own Dante endpoint, codenamed KLANTE (string KLANTE - Brooklyn II replacement module) — it replaces the Audinate Brooklyn II (itself a Zynq-7020) with a cheaper 7010 running the Dante IP core in software | Verified |
| Dante core | Dante is a loadable IP core, not a drop-in module: cap1.bin is installed to /dante/cap/cap1.bin (the manifest's files section) — Audinate Dante IP licensed onto A&H silicon | Verified |
| FPGA design | KlanteDDRTop, Vivado 2019.2, bitstream KlanteDDR_7010_RU.bit built 2024-10-31 — the small 7010 PL that carries the Dante glue | Verified |
Software architecture
| Item | Finding | Confidence |
|---|---|---|
| Operating system | Embedded Linux, not bare-metal — Buildroot 2018.02 (arm gnueabihf, gcc 6.4.0), booted FSBL (boot.bin) → U-Boot → uImage + devicetree.dtb + rootfs.cpio.uboot initramfs, with a userddr.jffs2 data partition. The only A&H design examined here that runs Linux on audio-side silicon (the AHM's silicon is unidentified) | Verified |
| This build | QUDante16 V1.0.2; internal version 0.1.0, codenames KLANTE / 'Blueberries' | Verified |
Update path & security model
| Item | Finding | Confidence |
|---|---|---|
| Signed updates | The one signed A&H firmware among those examined here — the AHM's update package has not been opened, so it is not a counterexample either way. SWUpdate verifies a detached sw-description.sig (256 B → RSA-2048, raw PKCS#1) over the manifest, and every image and script carries a SHA-256 checked against that signed manifest — authenticity, not just integrity, the opposite of the consoles' CRC/MD5-only posture | Verified |
| Recovery | Full A/B redundancy: every partition has a _backup twin (kernel, FPGA, rootfs, device-tree, u-boot) written in the same update | Verified |
| Container | .q16 is a plain SWUpdate cpio — cpio -idm yields the whole parts list (manifest, signature, boot chain, bitstream, Dante cap) | Verified |
These rows describe how a platform validates a firmware image, because that is a structural fact about its architecture. They are not a vulnerability disclosure and no exploit, bypass or circumvention technique is published here. Licensing and entitlement mechanisms are out of scope throughout — seescope boundaries.
What is programmable
- 1It is a Dante endpoint — interoperate, don't rehost
The whole point of the card is Dante/AES67 networking; Dante Controller and the published protocols cover the useful surface without touching firmware.
- 2The signature is the real barrier
Unlike the consoles, the update path is RSA-signed, so swapping firmware is gated by the signing key rather than a recomputable checksum. Whether Zynq secure boot is also fused is the open question.
- 3The 7010 FPGA
A small Zynq-7010 PL (
KlanteDDRTop) carrying the Dante DDR/MAC glue — analysable in principle but niche, and downstream of no useful goal.
Traps
Mistakes this analysis actually made, or came close to making. They are recorded because each one produces a plausible-looking wrong answer rather than an obvious failure.
.q16is a standard SWUpdate cpio, not an opaque A&H container —cpio -idmplus thesw-descriptionmanifest give you the entire parts list and per-file hashes.- The RSA signature is over the SWUpdate manifest (
sw-description.sig), which is not the same as Zynq secure boot — a signed update does not prove the boot chain itself is authenticated. - KLANTE is a general Brooklyn II replacement, so a finding here may generalise to any A&H product that uses this Dante card, not just the Qu.
Open questions
- Whether Zynq-7010 secure boot (an RSA-authenticated FSBL) is actually fused on, or only SWUpdate-level signing is enforced —
boot.binwas not checked for an authentication certificate. - Which A&H products share the KLANTE module — it is framed as a general Brooklyn II replacement, not Qu-specific.
- The Dante IP-core version inside
cap1.binand its licensing terms.
Status of this entry. A written teardown exists and its claims carry evidence citations. Nothing on this page has been verified against physical hardware — no unit of this platform has been opened, connected to or modified.