[ Please CC replies as I am not subscribed ]
I have had some luck resolving the GPL violation by wireless
manufacturers issue. I have sent letters regarding the issue to
Linksys, Belkin and Buffalo. This is the letter I received from
Buffalo Technologies and below that is the letter I sent to the three
manufacturers:
--------------
Hi Sir,
We are aware of these requirements and we have the PDF document
(attached) and a statement/notice that will be put onto the website
within 48 hours for this product. Please let me know if you require
further assistance or if you would like to talk further.
NOTICE:
This product uses software of GPL/LGPL.
You have the right to acquire source code, change it, and re-
distribute it.
The warranty on the product is only applicable if the original or an
official Buffalo firmware is on the unit.
Please refer to GNU_LICENSE.PDF.
We don?t have any obligation to pay if a user has to pay to
distribute or change the source code.
Thanks for your time.
Craig Reid
Technical Sales Engineer
-----------
-----------
Dear sirs,
Hereby I would like to inform you that the software on at least one
of your products is offered in violation of the General Public
License (GPL) as published by the GNU Software Foundation. This may
not be known to you due to inclusion of acquired or licensed
technology from third-party manufacturers in your product.
The affected product is the Buffalo (Melco) WBR-G54 Wireless Access
Point
The infringement of the GPL consists of the following:
Your product makes use of Linux kernel version 2.4.5 and Busybox
software, which are both licensed under GPL terms and conditions.
The GPL allows copying and distribution of licensed software,
provided that the complete corresponding machine-readable source
code or a written offer to a complete machine-readable copy of the
corresponding source code accompanies the product. As you have
fulfilled neither of these obligations, you are in violation GPL
terms and conditions.
Your product includes a kernel driver module that is inserted into
the GPL licensed Linux kernel when the product is turned on. There
is no possible way for the user to prevent the insertion of this
module into the kernel. It is also impossible for the user to remove
the kernel module from the running kernel. The operation of the
included software on your product depends on the operation of the
kernel module. For these reasons the kernel driver module is not
offered as a separate work as described in Section II of the GPL and
must therefore be distributed under the terms and conditions of the
GPL. As you have not included the complete corresponding machine-
readable source code or a written offer to a complete machine-
readable copy of the corresponding source code you are clearly in
violation of GPL terms and conditions.
Because of the huge liability your company could be facing I advise
you to take appropriate measures to cease offering your product in
violation of the GPL.
With Regards,
Richard Ten Brink
--------
> Your product includes a kernel driver module that is inserted into
> the GPL licensed Linux kernel when the product is turned on. There
> is no possible way for the user to prevent the insertion of this
> module into the kernel. It is also impossible for the user to remove
> the kernel module from the running kernel. The operation of the
> included software on your product depends on the operation of the
> kernel module. For these reasons the kernel driver module is not
> offered as a separate work as described in Section II of the GPL and
> must therefore be distributed under the terms and conditions of the
> GPL.
Perhaps it's not a separate work from the programs that access it, but it's
certainly a separate work from the kernel. The kernel can operate just fine
without the module. The module extends the kernel through a well-defined
boundary.
The GPL says:
"These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works. But when you
distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote it."
So is a Linux distribution "a whole which is a work based on the" Linux
kernel? Would you argue that RedHat can't include proprietary software on
the same CD as the Linux kernel? All the software on the CD, assuming it's
Linux software, likewise extends the kernel through a well-defined boundary.
DS
[ Please CC replies as I am not subscribed ]
In response to DS:
> So is a Linux distribution "a whole which is a work based on the" Linux
> kernel? Would you argue that RedHat can't include proprietary software on
> the same CD as the Linux kernel? All the software on the CD, assuming it's
> Linux software, likewise extends the kernel through a well-defined boundary.
No, definitely not. If that were the case, SuSE and Lindows etc. etc.
would not be able to distribute proprietary software together with
GPL'ed software. The GPL calls this 'mere aggregation':
"In addition, mere aggregation of another work not based on the
Program with the Program (or with a work based on the Program) on a
volume of a storage or distribution medium does not bring the other
work under the scope of this License."
These wireless products are different. The user doesn't have a choice
to use or not to use the non-gpl'ed kernel module. He can not prevent
the module from loading, he can not remove it from the running kernel
and the device doesn't operate without the module. The module and the
embedded Linux OS on the device are so interconnected that they can
not be considered 'seperate works' under the GPL. Therefore the
kernel module actually is GPL software itself.
Buffalo Technology's response indicates that they agree with me (or
perhaps they just don't want any trouble).
In response to Zack Gilburd:
> ...But where are the downloads? :-\
They don't have to offer the source as a download under the GPL. They
just have to enable you to get to the source. As soon as Buffalo puts
on the their website that they use GPL'ed software (they said they
would do that within 48 hours) you should be able to request and
receive the source code of the embedded Linux OS as well as the
source code of the kernel module.
Richard Ten Brink
> In response to DS:
> > So is a Linux distribution "a whole which is a work based on the" Linux
> > kernel? Would you argue that RedHat can't include proprietary
> > software on
> > the same CD as the Linux kernel? All the software on the CD,
> > assuming it's
> > Linux software, likewise extends the kernel through a
> > well-defined boundary.
> No, definitely not. If that were the case, SuSE and Lindows etc. etc.
> would not be able to distribute proprietary software together with
> GPL'ed software. The GPL calls this 'mere aggregation':
> "In addition, mere aggregation of another work not based on the
> Program with the Program (or with a work based on the Program) on a
> volume of a storage or distribution medium does not bring the other
> work under the scope of this License."
But they're not just on the same CD. The additional work extends the Linux
kernel and is useless without it (or without something that emulates it).
> These wireless products are different. The user doesn't have a choice
> to use or not to use the non-gpl'ed kernel module.
So any software a Linux distribution installs by default has to be GPL?
> He can not prevent
> the module from loading, he can not remove it from the running kernel
> and the device doesn't operate without the module.
That the device doesn't operate without the module says nothing about the
relationship between the linux kernel and the module. That they provide no
interface to unload the module doesn't change the fact that there's a
boundary between the kernel and the module that keeps them separate works.
> The module and the
> embedded Linux OS on the device are so interconnected that they can
> not be considered 'seperate works' under the GPL. Therefore the
> kernel module actually is GPL software itself.
Obviously, I don't agree. The linux kernel is totally usable without the
module. The module only extends the kernel through a standardized interface.
This is sufficient, in my book, to make them separate works. That they are
shipped on the same medium and that the user can't separate them is
irrelevent -- you can't separate them if they're shipped on the same CD
anyway without a scalpel.
The GPL can't declare a legal fiction and thereby make it into a fact. I
would think it's quite probable that a court would interpret the GPL's "work
based on" concept to be equivalent to the legal concept of a derived work.
Otherwise, the GPL can't restrict its distribution (a copyright holder has
the right to control the distribution of derived works but not works that
aren't derived, even if they meet the license's definition of 'based on').
> Buffalo Technology's response indicates that they agree with me (or
> perhaps they just don't want any trouble).
Perhaps they just prefer to release the module under the GPL.
DS
This begun as a short reply, but I
On tisdagen den 24 juni 2003 13.20, [email protected] wrote:
> They don't have to offer the source as a download under the GPL. They
> just have to enable you to get to the source. As soon as Buffalo puts
> on the their website that they use GPL'ed software (they said they
> would do that within 48 hours) you should be able to request and
> receive the source code of the embedded Linux OS as well as the
> source code of the kernel module.
ONLY if you are a customer, are you? If not, why all this noice?
(They could require you to enter a serial number to get the source...)
A customer of a product B that uses GPL project A can
require the source for A. But what about the primary developer?
Suppose the company charges an obscene amount of money for
the product (that might be an enhanced project A, like a patch to allow
compilation on Win32) - the primary developer might not afford to buy that
product.
One can hope that the customer is smart enough to release the source
to the original developer... But there are no guarantees...
/RogerL
--
Roger Larsson
Skellefte?
Sweden
[ CC replies as I am not subscribed ]
In reply to DS:
A final attempt to convince you; after that it is back to the paid
legal work for me :).
When you load a non-gpl kernel module (like that kernel driver module
on the router) you 'taint the kernel', as it is called. After doing
so, the running kernel is a 'modified program' under the gpl.
Distributing a modified program 'as a whole' gpls (is that a verb?)
the combination as a whole.
Under the gpl you are however allowed to distribute the gpl kernel
and the non-gpl module separately, like NVidia does with their non-
gpl kernel modules. Distribution on separate volumes would also be
allowed (mere aggregation).
How do you distribute the two separately? My opinion is: definitely
not by making the driver module load itself automatically, thereby
tainting the kernel automatically, with no option for removal of the
module, like the wireless router does. You have to provide the user
an option to load or at least unload the module at will.
So how would you distribute a non-gpl module separately in a wireless
router? I honestly don't know. Fact of the matter is that in my
opinion it is quite scary to use a GPL'ed OS on an embedded system if
you want to keep your modules a secret. It is a 'viroid'-license as
Bill G. calls it, because of its license-infecting capabilities.
Regarding the "work based on" = "derived" issue: unfortunately I can
tell you a lot about Dutch and European Law, but I know too little
about American law to judge on that.
Regards,
Richard.
On 24 Jun 2003 at 11:18, David Schwartz wrote:
> > In response to DS:
>
> > > So is a Linux distribution "a whole which is a work based on
the" Linux
> > > kernel? Would you argue that RedHat can't include proprietary
> > > software on
> > > the same CD as the Linux kernel? All the software on the CD,
> > > assuming it's
> > > Linux software, likewise extends the kernel through a
> > > well-defined boundary.
>
> > No, definitely not. If that were the case, SuSE and Lindows etc.
etc.
> > would not be able to distribute proprietary software together
with
> > GPL'ed software. The GPL calls this 'mere aggregation':
>
> > "In addition, mere aggregation of another work not based on the
> > Program with the Program (or with a work based on the Program) on
a
> > volume of a storage or distribution medium does not bring the
other
> > work under the scope of this License."
>
> But they're not just on the same CD. The additional work extends
the Linux
> kernel and is useless without it (or without something that
emulates it).
>
> > These wireless products are different. The user doesn't have a
choice
> > to use or not to use the non-gpl'ed kernel module.
>
> So any software a Linux distribution installs by default has to be
GPL?
>
> > He can not prevent
> > the module from loading, he can not remove it from the running
kernel
> > and the device doesn't operate without the module.
>
> That the device doesn't operate without the module says nothing
about the
> relationship between the linux kernel and the module. That they
provide no
> interface to unload the module doesn't change the fact that there's
a
> boundary between the kernel and the module that keeps them separate
works.
>
> > The module and the
> > embedded Linux OS on the device are so interconnected that they
can
> > not be considered 'seperate works' under the GPL. Therefore the
> > kernel module actually is GPL software itself.
>
> Obviously, I don't agree. The linux kernel is totally usable
without the
> module. The module only extends the kernel through a standardized
interface.
> This is sufficient, in my book, to make them separate works. That
they are
> shipped on the same medium and that the user can't separate them is
> irrelevent -- you can't separate them if they're shipped on the
same CD
> anyway without a scalpel.
>
> The GPL can't declare a legal fiction and thereby make it into a
fact. I
> would think it's quite probable that a court would interpret the
GPL's "work
> based on" concept to be equivalent to the legal concept of a
derived work.
> Otherwise, the GPL can't restrict its distribution (a copyright
holder has
> the right to control the distribution of derived works but not
works that
> aren't derived, even if they meet the license's definition of
'based on').
>
> > Buffalo Technology's response indicates that they agree with me
(or
> > perhaps they just don't want any trouble).
>
> Perhaps they just prefer to release the module under the GPL.
>
> DS
>
>
On Tuesday 24 June 2003 11:25, Roger Larsson wrote:
> A customer of a product B that uses GPL project A can
> require the source for A. But what about the primary developer?
> Suppose the company charges an obscene amount of money for
> the product (that might be an enhanced project A, like a patch to allow
> compilation on Win32) - the primary developer might not afford to buy that
> product.
Not exactly. By my understanding of the GPL, if you plan on distributing
binaries outside of your corporation, you MUST make the source available to
any and all third parties. In adition, you must bundle the source code with
the binary.
That's just what I have read from the GPL -- IANAL.
--
Zack Gilburd
http://tehunlose.com
no, you have to make source available to anyone you give the binary to.
you can't prevent that person from giving the source to the world, but you
are not required to.
they could compress the source and stick it on the driver CD that they
bundle with the product and you would not be allowed to duplicate that CD
(it contains commercial programs), but you could copy the source off of
the CD and put it on your website.
David Lang
On Tue, 24 Jun 2003, Zack Gilburd wrote:
> Date: Tue, 24 Jun 2003 17:27:51 -0700
> From: Zack Gilburd <[email protected]>
> To: [email protected]
> Subject: Re: developers and GPL in products (Was: Re: GPL violations by
> wi reless manufacturers)
>
> On Tuesday 24 June 2003 11:25, Roger Larsson wrote:
> > A customer of a product B that uses GPL project A can
> > require the source for A. But what about the primary developer?
> > Suppose the company charges an obscene amount of money for
> > the product (that might be an enhanced project A, like a patch to
> allow
> > compilation on Win32) - the primary developer might not afford to buy
> that
> > product.
>
> Not exactly. By my understanding of the GPL, if you plan on
> distributing
> binaries outside of your corporation, you MUST make the source available
> to
> any and all third parties. In adition, you must bundle the source code
> with
> the binary.
>
> That's just what I have read from the GPL -- IANAL.
>
> --
> Zack Gilburd
> http://tehunlose.com
>
Zack Gilburd wrote:
> Not exactly. By my understanding of the GPL, if you plan on distributing
> binaries outside of your corporation, you MUST make the source available to
> any and all third parties. In adition, you must bundle the source code with
> the binary.
Please actually read the GPL License before you spew.
GPL only requires you to distribute source to those you distribute
binaries to, not everybody. If the binary seller wishes they can
provide source to everybody but it is not required.
- Bryan
Therefore, if Company A "sells" the package to anybody outside the
company then it has to "make available" the source, including people
like the primary developer.
But i think the second part of Zack's reply might not be right.
The company A only needs to make "available" the source. it doesnt
"have" to bundle the source with the binaries... (maybe make it
available on the website or make some such provisions...)
robins
On Wed, 2003-06-25 at 05:57, Zack Gilburd wrote:
> On Tuesday 24 June 2003 11:25, Roger Larsson wrote:
> > A customer of a product B that uses GPL project A can
> > require the source for A. But what about the primary developer?
> > Suppose the company charges an obscene amount of money for
> > the product (that might be an enhanced project A, like a patch to allow
> > compilation on Win32) - the primary developer might not afford to buy that
> > product.
>
> Not exactly. By my understanding of the GPL, if you plan on distributing
> binaries outside of your corporation, you MUST make the source available to
> any and all third parties. In adition, you must bundle the source code with
> the binary.
>
> That's just what I have read from the GPL -- IANAL.
>
> --
> Zack Gilburd
> http://tehunlose.com
"David Schwartz" <[email protected]> said:
> > In response to DS:
>
> > > So is a Linux distribution "a whole which is a work based on the" Linux
> > > kernel? Would you argue that RedHat can't include proprietary
> > > software on
> > > the same CD as the Linux kernel? All the software on the CD,
> > > assuming it's
> > > Linux software, likewise extends the kernel through a
> > > well-defined boundary.
>
> > No, definitely not. If that were the case, SuSE and Lindows etc. etc.
> > would not be able to distribute proprietary software together with
> > GPL'ed software. The GPL calls this 'mere aggregation':
>
> > "In addition, mere aggregation of another work not based on the
> > Program with the Program (or with a work based on the Program) on a
> > volume of a storage or distribution medium does not bring the other
> > work under the scope of this License."
> But they're not just on the same CD. The additional work extends
> the Linux kernel and is useless without it (or without something that
> emulates it).
Just like Oracle, or Opera, or my sendmail binary, or a lot of other
stuff. That they would be useless without Linux doesn't make them GPL. The
GPL is quite clear; the head penguin also clarified that propietary modules
are OK.
Now can we please stop this? If there is something to discuss around this,
it is clearly _not_ kernel development.
--
Dr. Horst H. von Brand User #22616 counter.li.org
Departamento de Informatica Fono: +56 32 654431
Universidad Tecnica Federico Santa Maria +56 32 654239
Casilla 110-V, Valparaiso, Chile Fax: +56 32 797513
Robins Tharakan wrote:
> Therefore, if Company A "sells" the package to anybody outside the
> company then it has to "make available" the source, including people
> like the primary developer.
>
> But i think the second part of Zack's reply might not be right.
> The company A only needs to make "available" the source. it doesnt
> "have" to bundle the source with the binaries... (maybe make it
> available on the website or make some such provisions...)
There is a choice of ONE of THREE options. Company A may EITHER:
1. include the source
OR
2. accompany the binary with a written offer for the source
OR
3. if it is a noncommercial RE-distribution of the binary, include the
offer that was received in terms with #2.
If the binary is downloaded from somewhere, having the source available
at the same place counts as #1.
IANAL, but that's how it all boils down for me. Hopefully that'll help
someone understand that part a little better.
Brian Davids
Hi,
David Schwartz wrote:
> Perhaps it's not a separate work from the programs that access it, but it's
> certainly a separate work from the kernel. The kernel can operate just fine
> without the module. The module extends the kernel through a well-defined
> boundary.
I'm not sure this is entirely accurate. A quick look at the module in
question (wl.o) with "nm" reveals quite a few interesting imports and
exports.
The module, for example, makes approximately 50 imports from the kernel where
the import doesn't seem to be part of the regular kernel tree (ie. I searched
using http://lxr.linux.no to no avail). However, these symbols seem to be
defined in the kernel included with the device. That is to say, the symbols
aren't provided by another module. Therefore, it would appear that this
module will not work with a "stock" Linux kernel.
These symbols (they all appear to be routines) begin with the following
prefixes: bcm, dma, osl, pkt, sb.
The purpose of some of these routines can be determined by the function name.
For example, the 'sb' series of functions seem to be used for manipulating
the Sonics SiliconBackplane that is used by the BCM43xx. The DMA routines
might be used to handle the TX and RX ring buffers. Some of the others I am
not so sure about. (By the way, this was also discovered by Lex Winter,
whose post to LKML seems to show up in groups.google, but not in the other
archives.)
Additionally, the module exports (ie. shows up with 'T' in an nm listing) no
less than 117 symbols. Some of these appear pretty low-level:
read_radio_reg
wlc_set_11a_txpower
wlc_set_11b_radiopwr
wlc_set_channel
wlc_aphy_temp_sense
write_radio_reg
to name just a few.
Admittingly, I don't know very much about what constitutes the standard kernel
to wireless driver interface for Linux. Also, I don't know if all these
exported functions are actually called externally. However, after looking
through some other wireless driver modules (airo, hermes, orinoco) I can't
seem to find an example where a module exports nearly as many functions.
If anyone would like a copy of the symbol list for wl.o (it requires a MIPS
binutils), please drop me an e-mail, and I'd be happy to send it out.
Additionally, if I've made any mistakes in these conclusions, please also let
me know.
-- Andrew
Roger Larsson <[email protected]> writes:
> A customer of a product B that uses GPL project A can
> require the source for A. But what about the primary developer?
> Suppose the company charges an obscene amount of money for
> the product (that might be an enhanced project A, like a patch to allow
> compilation on Win32) - the primary developer might not afford to buy that
> product.
There is no problem with that. Still, the company may choose not to
release the product at all. But, if it does, anyone (any customer)
can make that software public, as permitted by the license.
--
Krzysztof Halasa
Network Administrator
Horst,
Now stop being rational and using logic, this is all a touchy-feely issue.
First thing is IANAL comes to the surface, and few can say they have a
lawyer and less a team of lawyers. If you have proof, and filed your
copyright with LOC goto court. Stop pissing around and making noise.
There are those who can do it.
The rest say they can.
The latter is a BOHA, and the former is serious.
Cheers,
Andre Hedrick
LAD Storage Consulting Group
On Tue, 24 Jun 2003, Horst von Brand wrote:
> "David Schwartz" <[email protected]> said:
> > > In response to DS:
> >
> > > > So is a Linux distribution "a whole which is a work based on the" Linux
> > > > kernel? Would you argue that RedHat can't include proprietary
> > > > software on
> > > > the same CD as the Linux kernel? All the software on the CD,
> > > > assuming it's
> > > > Linux software, likewise extends the kernel through a
> > > > well-defined boundary.
> >
> > > No, definitely not. If that were the case, SuSE and Lindows etc. etc.
> > > would not be able to distribute proprietary software together with
> > > GPL'ed software. The GPL calls this 'mere aggregation':
> >
> > > "In addition, mere aggregation of another work not based on the
> > > Program with the Program (or with a work based on the Program) on a
> > > volume of a storage or distribution medium does not bring the other
> > > work under the scope of this License."
>
> > But they're not just on the same CD. The additional work extends
> > the Linux kernel and is useless without it (or without something that
> > emulates it).
>
> Just like Oracle, or Opera, or my sendmail binary, or a lot of other
> stuff. That they would be useless without Linux doesn't make them GPL. The
> GPL is quite clear; the head penguin also clarified that propietary modules
> are OK.
>
> Now can we please stop this? If there is something to discuss around this,
> it is clearly _not_ kernel development.
> --
> Dr. Horst H. von Brand User #22616 counter.li.org
> Departamento de Informatica Fono: +56 32 654431
> Universidad Tecnica Federico Santa Maria +56 32 654239
> Casilla 110-V, Valparaiso, Chile Fax: +56 32 797513
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
>
In reply to Rick:
> I was wondering if they ever made the source code available to you?
> I checked their web site and did not find it.
Buffalo Technologies wrote to me they would put a GPL notice on their
website and they haven't done so. They did not release source code to
me nor to anyone else. I am quite disappointed by all of this.
The other two manufacturers I sent emails to, Belkin and Linksys,
did not respond at all.
I will send another email to Buffalo Technologies and this time I
will include the excellent research by Andrew Miklas. I hope the
issue will be resolved eventually.
Regards,
Richard.
On 28 Jun 2003 at 15:15, Rick Richardson wrote:
> Richard:
>
> "We are aware of these requirements and we have the PDF document
> (attached) and a statement/notice that will be put onto the website
> within 48 hours for this product. Please let me know if you require
> further assistance or if you would like to talk further."
>
> I was wondering if they ever made the source code available to you? I
> checked their web site and did not find it.
>
> -Rick
>
> --
> Rick Richardson [email protected] http://home.mn.rr.com/richardsons/
> Stock information at your fingertips: http://linuxtrade.0catch.com/
>
> I prefer three holes.
>