Linksys WRT54G and the GPL

Hi,

Sorry for the very lengthly posting, but I want to be as precise as possible in describing this problem.

Awhile ago, I mentioned that the Linksys WRT54G wireless access point used several GPL projects in its firmware, but did not seem to have any of the source available, or acknowledge the use of the GPLed software. Four weeks ago, I spoke with an employee at Linksys who confirmed that the system did use Linux, and also mentioned that he would work with his management to ensure that the source was released. Unfortunately, my e-mails to this individual over the past three weeks have gone unanswered. Of course, I also tried contacting Linksys through their common public e-mail accounts ([email protected], [email protected]) to no avail.

However, it is hard for me to know if my contact in the company has just gone on a three week vacation (and not set an auto-responder), or has been asked to not answer anymore mail on this subject. Also, I should note that I don't own this product, so I can't determine if the source is shipped with it. However, I have gone through all the available information on the Linksys website, and can find no reference to the GPL, Linux (as it relates to this product), or the firmware source code. Also, the firmware binary (see below) is freely available from their website. There is no link from the download page to the source, or any mention of Linux or the GPL. Finally, it would be strange if the source was included in the physical package, as my contact at Linksys was initially unaware Linux was used in this product.

The following steps can be used to determine the exact nature of the possible GPL violation.

1. Go to the following URL:
http://www.linksys.com/download/firmware.asp?fwid=178

2. Download the "firmware upgrade files":
ftp://ftp.linksys.com/pub/network/WRT54G_1.02.1_US_code.bin

    (MD5SUM: b54475a81bc18462d3754f96c9c7cc0f)

3. While it is downloading, confirm that there is nothing on the webpage to indicate that this binary contains GPLed software.

4. Once the download is complete, copy the contents of the file from offset 0xC0020 onward into a new file.

    dd if=WRT54G_1.02.1_US_code.bin of=test.dump skip=24577c bs=32c

5. Notice that this file is an image of a CramFS filesystem. Mount it.

6. Explore the filesystem. You will notice that the system appears to be based on Linux 2.4.5.
Incidentally, there is at least one other GPLed project in the firmware:
the BusyBox userland component: (http://www.busybox.net/)

7. The Linux kernel (I think) is mixed up with a bunch of other stuff in:
bin/boot.bin

You might want to know why I am interested in getting the code for the kernel used in this device.

There's been some discussion here about Linux's lack of wireless support for a few of the newer 802.11b and (nearly?) all 802.11g chips. Incidentally, Linux has excellent support for at least one manufacturer's wireless family. The following Broadcom chips all appear to be supported under Linux -- if you happen to be running Linux on a MIPS processor in a Linksys router:

Broadcom BCM4301 Wireless 802.11b Controller Broadcom BCM4307 Wireless 802.11b Controller Broadcom BCM4309 Wireless 802.11a Controller Broadcom BCM4309 Wireless 802.11b Controller Broadcom BCM4309 Wireless 802.11 Multiband Controller Broadcom BCM4310 Wireless 802.11b Controller Broadcom BCM4306 Wireless 802.11b/g Controller Broadcom BCM4306 Wireless 802.11a Controller Broadcom BCM4306 Wireless 802.11 Multiband Controller

This list was produced by running strings on:
lib/modules/2.4.5/kernel/drivers/net/wl/wl.o

I am trying to determine exactly how tightly coupled these drivers are to the kernel.

As an aside, I know that some wireless companies have been hesitant of releasing open source drivers because they are worried their radios might be pushed out of spec. However, if the drivers are already written, would there be any technical reason why they could not simply be recompiled for Intel hardware, and released as binary-only modules?

Finally, I know that traditionally, Linux has allowed binary-only modules. However, I was always under the impression that this required that the final customer be allowed to remove them at will. That is to say, you couldn't choose to implement a portion of the kernel critical to the system's operation in a module, and then not release that module under the GPL. In this particular case, I would argue that the wireless drivers are critical to this device's operation (after all, it is a wireless access point). In addition, the final user in this case really can't just "rmmod" the wireless driver.

The Broadcom driver, kernel, and really everything else in the firmware, are (IMHO anyways) being used to form a discrete package -- the WRT54Gs firmware. Does/should this have any implication on whether the Broadcom wireless module must be covered by the GPL?

I would be very interested in knowing if I am mistaken in any of my claims or conclusions, and if not, how I should proceed in getting this issue resolved.

-- Andrew Miklas

Curiously, the Belkin products (http://networking.belkin.com) also seem to be based upon the same source. Looks like they could just be rebranded firmware images with some features disabled.

Additionally, strings(1) output of firmware image may be interesting to users of their 54g WAPs. Seems it has a lot more html pages inside than what is documented. The 'low-end' version I bought doesn't mention anything about firewall, dhcp, dns configuration, or parental controls, however it's all in there if you know the right URLs. Fun.

Dave

If Belkin are shipping the same code and apparently got it from Linksys someone migth also care to write to Belkin and inform them about this. They may not even know about their rather large potential liability.

[...]

just for curious, anybody run nmap against these devices?

Ulisses

Debian GNU/Linux: a dream come true
-----------------------------------------------------------------------------
"Computers are useless. They can only give answers." Pablo Picasso

---> Visita http://www.valux.org/ para saber acerca de la <---
---> Asociación Valenciana de Usuarios de Linux <---

[general note: please cc, I'm not on lkml]

Andrew,

I was involved in a similar such action with Dell, though I had somewhat different approach, but nevertheless I'm going to recount my experiences as it may be useful for the purposes of comparison. Others: mark as read now if you don't like long mails.

Early in the year, I purchased a nice new Dell Laptop, for running Linux on, of course. Since it saved me money, I bought a Dell TrueMobile 1184 Access Point/Router at the same time.

http://tinyurl.com/ds6i (accessories.us.dell.com)

http://tinyurl.com/ds6d (support.ap.dell.com)

Give an impression of the product. Being a Network Engineer, I felt compelled to fingerprint the device, very quickly finding that it ran telnet on port 333, and after loging in (using the root username, and the admin password), found that it was running armlinux:

# cat /proc/version

Linux version 2.2.14-v1.9 ([email protected]) (gcc version 2.9-vLinux-armtool-0523) #5357 Sat Jan 25 17:39:42 CST 2003

# cat /proc/cpuinfo   
Processor       : S3C4510/SEC arm7tdmi rev 0
BogoMips        : 44.24
Hardware        : <NULL>

Other GPL software was abundant, including ipchains, busybox .. and other things you would expect. Running Linux of course pleased me, because it meant I put it to some real use (currently it's also my house print server for example) as I had a self-built router I wasnt going to stop using (I mean how could anyone live without IPv6?).

After some discussion on ILUG (www.linux.ie), I researched it further, I double-checked, and none of the documentation Dell sent me, nor the software CD, nor the website indicated it was using GPL software, and did provide me with a copy of the license, or a written offer with a means to obtain the source. I'm not a licensing hack, and I almost would have been prepared to just leave it be had the Documentation not said:

"Requirements:

You must have at least one computer that has the following:

1. Running Microsoft(R) Windows(R) 98, 98SE, Windows Me, Windows 2000, Windows XP Home or XP Professional ( Windows 2000 or XP require you to have administrator privileges on your computer in order to configure the router - see the computers users' guide for more information)
2. A CD drive
3. An active Internet connection"

Which supremely annoyed me, as of course all you need is *any* IP capable system for the router to work, it just uses plain NAT, nothing Windows specific, and you can use any browser to configure it's luser interface. So after some grepping:

# cat /etc/hosts
127.0.0.1               vLinux/Vitals_System_Inc.

They appear to have a website at:

http://www.vitalsystem.com/

Though

http://www.onsoftwarei.com/

seem to be the people who license support vlinux:

http://www.onsoftwarei.com/product/prod_vlinux.htm

I'm sure there are people on-list with much more in-depth knowlege of these companies.

Anyway, since in my case, Dell were the direct vendor, I contacted them first. After some number chasing, I was passed to Dell Ireland's Legal Director, who got on to the Dell US guys.

I have to say that allthough it took some time for the issue to be resolved, Dell were abosulutely brilliant about it, and kept me informed, they were extremely friendly and helpful about the request.

The original mail I sent Dell is available at:

http://www.redbrick.dcu.ie/~colmmacc/TrueMobile-1184/dell.letter

But after that, most of the action happened on phone. 6 weeks later, Seamus (Dell Legal) was able to respond positively to my request, and I got a CD including the source free of Charge, and a nice letter:

http://www.redbrick.dcu.ie/~colmmacc/TrueMobile-1184/dell.jpg

The contents are available online, and if anyone wants it, mails me and I'll give you the URL, but to save me bandwidth - it's vanilla Linux 2.2.14 with the 2.2.14-rmk4 patch, nothing bespoke. But now that I had the configuration, I could actually build a replacement IPv6 capable kernel.

Dell have also reviewed their procedures to ensure that this kind of thing does not happen again, and from talking to Dell Legal I got the impression that it was the result of suppliers not fully informing Dell about Licensing provisions.

Dell now ship a copy of the source and the license on the CD that comes with the TrueMobile kit. I really have to make clear here, Dell did amazingly well, they researched it, kept me informed, responded positively, and rectified procedures. It's a great example of how to do it right.

So, I don't know what the linksys situation is fully, but I do hope that this report may help you in that it gives an example of a near-identical situation having been resolved successfully in the past.

I also know from Dell Legal, that my request generated a lot of e-mail internal to Dell legal, so I'm sure they researched it very well. If Dell Legal come to the conclusion that this is what they must do, that certainly might be a useful example to point Linksys at.

Colm MacCárthaigh                        Public Key: [email protected]
[email protected]					  http://www.stdlib.net/

Nice. This looks like the first hardware router that could really fancy my wishes. And if I buy this piece of hardware, Dell can attribute that directly to the software running on it and the kind of control it offers to me.

Should be a great thing for companies as well. Unknown software without support or updates and a direct internet connection is a nightmare for security. And that was what most "hardware" routers boiled down to and still do.

Jörn

A surrounded army must be given a way out.
-- Sun Tzu

and www.armlinux.net. Linus has already been informed of this situation, and we came to the conclusion that, at the time, there was no way to enforce the copyright due to their location in the world. This may have changed recently.

Since this is the case, it may be arguable that the users of vLinux from Vitals are unkowningly breaking the GPL due to the apparant licensing which Vitals Systems Inc are re-distributing the code to their customers.

Russell King ([email protected])                The developer of ARM Linux
             http://www.arm.linux.org.uk/personal/aboutme.html

In the hopes that somebody from Linksys is reading this thread, I'll add my $0.02. I have one of these routers. I'd buy a second instantly, if only I could build the firmware and fix some bugs in it. I love the overall concept, but the buggy html interface is more than a little annoying.

Furthermore, I can think of a lot of uses for this little box, other than just a router. If I had the source, I'd try some out, and if the results turned out as well expected, I'd make that public. It's hard to see how this would be bad for Linksys.

Regards,

Daniel

Hi,

I'm pleased to report that Linksys has noticed the activity here and is now in the process of determining what must be released under the GPL. I will keep this list updated on what I receive.

My current contact within Linksys also noted that the company has a long tradition of support for Linux. Previously, they have shipped CDs containing GPL'd source with their networking products. I'm told the lack of source for the WRT54G was not intentional and is an isolated incident.

If anyone has any material that they want me to forward on to the people at Linksys, please drop me a line at this address.

-- Andrew

Thats good news. Thanks for bugging your contacts

Cool!

-kb, the Kent who is pleased the GPL is building this kind of precedence as it will maybe make the eventual legal defence of the GPL a smidge easier, also the Kent who looks like he will finally be buying a home wireless access point--and it looks like it will be a Linksys (are the other Linksys boxes going to be opened?).

Requoting the above license violations for context.

Note that including the source with the physical package is not enough to meet the GPL requirements. The source must be available to any third party, not just purchasers of the product.

/fc

Not true, you have two options, physical medium or written offer. Choosing just one is perfectly acceptable.

Frank Cusack <[email protected]> said:

[...]

Nope. The product (binary) has to be freely redistributable, and everybody who gets the binary has the right to get the source.

IANAL, and no GPL-expert either, but...

Dr. Horst H. von Brand                   User #22616 counter.li.org
Departamento de Informatica                     Fono: +56 32 654431
Universidad Tecnica Federico Santa Maria              +56 32 654239
Casilla 110-V, Valparaiso, Chile                Fax:  +56 32 797513

Wrong. Its a common misconception. The GPL requires I make source available to those I give the binaries, be it a box on a supermarket shelf or a one of product for a client.

In fact the GPL has to do this because it is really import that the author is not hit with the cost of third party distribution. What the author cannot do is forbid that third party distribution.

In Linksys case dumping the required source on the end of the CD of goodies that comes with the kit and including a notice would be sufficient.

It depends which choice the distributor chooses regarding section three of the GPL.

If he chooses 3b ("written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code") he has to give it to everyone.

You are right for 3a (source shipped together with the binaries) and 3c (noncommercial redistribution of binaries received under 3b).

Yup.

cu
Adrian

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

As I read 3b, it only applies if the person requesting the source code
actually has physical possession of the written offer. (Though the offer could be transferred to anyone.)

No, it would not be. They also distribute the software from their web page,
and that distribution must also be accompanied by source code or a written offer.

DS

"to give any third party" in 3b is pretty non-ambiguous.

I missed the fact they make it available at their web page.

cu
Adrian

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

You've skipped the qualifing predicate condition. Every clause of section 3 begins with "Accompany it with", referring to the distribution of the Program in object code or executable form.

Randolph Bentson
[email protected]

You definitely don't need physical possession of the written offer. Otherwise 3c wouldn't work.

cu
Adrian

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

You cannot mix the terms of clauses 3a, 3b, and 3c. The "written offer" is only an element of clause 3b.

A significant point which seems to be glossed over is that the distributor is the entity which selects which of these clauses, 3a, 3b, or 3c, is to be exercised to satisfy the GPL. Each places a different obligation on the distributor.

If the distributor elects to distribute the object code or executable form under clause 3a, the distributor need only distribute copies of the source to the recipients of the object code or executable form.

If the distributor elects to distribute the object code or executable form under clause 3b, one might reasonably argue that the distributor need only distribute the source to those third parties in possession of the written offer which must be included. Others may argue that this clause requires that the distributor make the source available to everyone, but even then the distributor is not obliged to put it on the web and the distributor may charge for the distribution cost.

If the distributor elects to distribute the object code or executable form under clause 3c, and is qualified to do so, the distributor need only distribute the information to those who receive the object code or executable form. The distributor is not obliged to give this information to everyone.

Of course, once anyone has a copy of this source, it may be further distributed under sections 1, 2, or 3.

I'd like to see Linksys elect to distribute under clause 3b by putting a note in each box with a pointer to source files which everyone can fetch from their web site. (I believe that web based distribution qualifies as "a medium customarily used for software interchange" cited in 3b and that they can simply absorb the cost of this method of distribution.) Recent news suggests that this will be the case. Let's hope that they, and other such distributors of embedded GPL based systems, follow this course.

--
Randolph Bentson
[email protected]

"Accompany it with a written offer, ..., to give any third party, ..., a complete machine-readable copy of the corresponding source code..."

This is non-ambiguous. You might _not_ "reasonably argue" about it, the "any third party" leaves no room for other interpretations.

cu
Adrian

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

Think about this logically. Suppose a company releases a product and
(maybe) accompanies it with such a written offer (I mean, how could you know for sure if you hadn't seen it?). You call the company up to try to enforce the offer. They say, "What offer?" You say, "the written offer that accompanied some copies of your product." You can't cite the text of the written offer, you can't specify any specific person they made the offer to.

It is totally reasonable to construe "any third party" to mean that the
offer can't specify that it's only vaild for certain particular individuals. In fact, I always understood simply to mean that you couldn't limit the offer to only the purchaser (assuming the product was sold).

What would the purpose be of a "written offer" (and why would you have to
"accompany" the object code with it?) if not that the offer is an enforceable 'coupon'? Why wouldn't the GPL just say that you have to "provide any third party with a complete machine-readable copy of the corresponding source code". Why specify a written offer if it just meant that you had to offer it?

DS

<snip>

Because:

http://www.gnu.org/licenses/gpl-faq.html#TOCWhatDoesWrittenOfferValid

Regards,

Filip

"Computers are not intelligent.  They only think they are."
	-- Martin Schulze

So you have to have a copy of the written offer to request the source code. Anyone who gives out the binary must also give out that same written offer, so you may have sold it to Anne, who gave it to Bob, who gave it to Charles, who came to you with the written offer. You would be required to give Charles the source code. If Anne also came with the written offer, you'd give it to her as well. But you would not have to give it to Diane if she does not have the written offer.

Eli
--------------------. "If it ain't broke now,
Eli Carter \ it will be soon." -- crypto-gram
eli.carter(a)inet.com `-------------------------------------------------

Including the source with the product would be insufficient to meet the GPL
requirements. They would have to offer the source (or a written offer to obtain the source for no more than the cost of physically copying it) to everyone who downloaded their software from their web site. The GPL is quite clear that the source code offer must be made to anyone to whom the object code is distributed. (The program must be accompanied by the offer.)

DS

No, a source code *offer* must be made to anyone, period.

Section 3(b) of GPLv2 says "Accompany it with a written offer ... to give any third party ... [the] source code".

If the source code is actually distributed with the object code, then they need only make it available to those who obtain the object code. Of course those folks are free to redistribute to anyone, if they want.

/fc

	No.

"Accompany" means two things have to travel together. If I have to
accompany a car with an instruction manual, it does not follow that I must give the instruction manual to anyone who requests it.

But the object code is available from their web site. I don't see how you
can accompany a download with a written offer, so to comply with the GPL, they must "accompany" the object code with the source code.

DS

This is specific only to the written offer case. MOst people I know throw the tar ball on the CD they already ship holding manuals, windows installer for the pointless gui config app etc

Wrong.

If you read section 3 from the beginning you notice that 3b is only one of three choices.

cu
Adrian

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed