Re: [tlug] GPL and Linux in Dvico Tivx

[Jim <jep200404@example.com>]

There are GPL notification issues. 

Who knows how to look for proprietary code that is 
statically linked into GPL code? (besides strings browsing)

Also, Mauro[d], does the product link the proprietary code 
with the GPL code when it is running? 

Shall we play? 

Josh wrote:

> On 14/12/05, Jim <jep200404@example.com> wrote:
> 
> > With potential GPL issues, it's definitely on topic now and
> > a good subject for the list.
> 
> Why do you suspect GPL issues? 

Suspect is too strong a word. 
I'm just curious and I smell an _opportunity_. 

I know the culture of the industry. Stephen wrote about this. 
I think it is an interesting exercise to check for compliance. 
Are you ready to play? 

A number of manufacturers of embedded things have incorporated 
GPL code without following the license. In firewall/router/NAT 
boxes, netfilter violation seems to be common. Even Linksys got 
caught. Proprietary drivers for proprietary chips (e.g. Broadcom 
wireless) are problematic for linking with the kernel. (Proprietary) 
drivers for video codecs could be rich ground for proprietary v 
GPL issues. How can one legally ship a product that links a 
proprietary driver to a GPL kernel? 

Also, like I wrote, where's the source? A cursory glance of the 
FAQ and downloads did not reveal anything helpful. How much 
source code does it take to generate a few megabytes of binary 
code? Do you think those 3MB files are bundles of binary code 
and source code, or just binary code. I would guess the latter. 

Google helps: 

   http://www.google.com/search?hl=en&q=site%3Awww.tvix.co.kr+gpl

and leads to: 

   http://www.tvix.co.kr/gpl/

which has a link to some uClinux source code: 

   http://www.tvix.co.kr/GPL/uClinux-2.4.tar.gz

but that is rather boring, since source code for 
uClinux is easily available. All that source code is from 2003. 

> The thing has an ARM processor, which
> is well-supported by a standard Linux kernel. 

Yup. What GPL notice was Maurod given? 

> It looks like they wrote their own audio and video players, 
> no doubt optimised for the ARM CPU and the framebuffer the thing has.

Let's _hope_ that they indeed wrote their own drivers, instead of 
just using proprietary drivers from the codec manufacturers. 
Then if they linked said optimized drivers with the GPL kernel, 
they can be _compelled_ to release the source code. 

If however, a chip manufacturer issues proprietary only binary 
drivers without any GPL code, then that codec manufacturer is 
under _no_ obligation to release their source code. If another 
manufacturer makes a product that incorporates the chip, and 
distributes the proprietary driver linked with GPL code, 
then that product manufacturer has put themselves in an 
impossible situation. End customers can rightly demand the 
source code to the proprietary driver, but product manufacturer 
can not give the source code because they do not own the source 
code and can not compell the chip manufacturer to divulge such. 
The product manufacturer can be compelled to stop further 
infringement, likely shutting down a product. They might 
also be sued for money for past copyright infringement. 

> By all means, if there *are* GPL issues, they should be resolved, but
> I see nothing suspicious about this, and the tone of your email might
> have convinced people who did not read it carefully that there exist
> GPL issues.

Are you ready to play? Let's go exploring. 
Be relaxed and follow your hunches. 
OK, here we go. 

http://www.google.com/search?hl=en&q=site%3Ademod.dvico.com+gpl
leads (only) to http://demod.dvico.com/Manual/TViX/TViX_Manual_1.9.pdf, 
which contains a GPL notice on page 49. Maurod, did you receive 
that manual or a similar one with the GPL notice with the product? 
Just before the GPL, it says that the source code can be downloaded from 
www.tvix.co.kr/gpl. We've already been there and downloaded some 
source code. 

It seems that TViX is a product of Dvico Co., Ltd. 

Of course, getting a copy of the uClinux source code is 
rather boring, but if they linked in some proprietary 
drivers and if Dvico wrote those proprietary drivers, 
then they can be compelled to supply the source code for 
the drivers. That would be the opportunity. If Dvico 
linked somebody else's proprietary code with GPL code, 
well then they would be in a bind. 

Let's go get some binary code. The first download link on 

   http://www.tvix.co.kr/KOR/Support/firmware.aspx

leads to http://demod.dvico.com/down/tvixfw1.9-kr.zip. 
When one downloads the stuff from their site, if it includes GPL 
code, then they are obliged to follow GPL, even if one did not buy 
anything from them. I.e., I have standing to demand source code 
from them if I download GPL binary code from them, even though I've 
not bought anything from them. 

Well, let's follow http://demod.dvico.com/down/tvixfw1.9-kr.zip. 

   $ wget http://demod.dvico.com/down/tvixfw1.9-kr.zip
   $ unzip *.zip
   Archive:  tvixfw1.9-kr.zip
     inflating: flash.bin
     inflating: tvixfw.bin

Let's see what kind of files those *.bin files are: 

   $ file *.bin
   flash.bin:  GNU tar archive
   tvixfw.bin: romfs filesystem, version 1 3272288 bytes, named TViX_PLAYER 1.9.0 Mon Jul  4 17.

Let's look inside the first one: 

   $ tar xf flash.bin
   $ find tvixfw -name '*.o' -exec strings -f {} \; | grep '[.]o: [a-zA-z]*='
   $ find tvixfw -name '*.o' -exec strings -f {} \; | grep -i license
   tvixfw/fipm.o: license=Proprietary. Copyright (c) 2002 Sigma Designs Inc. All rights reserved.
   tvixfw/khwl.o: license=Proprietary. Copyright (c) 2002 Sigma Designs Inc. All rights reserved.
   tvixfw/mtd/mtdcore.o: license=GPL
   tvixfw/mtd/mtdchar.o: license=GPL
   tvixfw/mtd/chips/chipreg.o: license=GPL
   tvixfw/mtd/chips/cfi_probe.o: license=GPL
   tvixfw/mtd/chips/cfi_cmdset_0002.o: license=GPL
   tvixfw/mtd/chips/gen_probe.o: license=GPL
   tvixfw/mtd/chips/jedec_probe.o: license=GPL
   tvixfw/mtd/maps/jaspermap.o: license=GPL

Nuts! fipm.o and khwl.o are by a third party, Sigma Designs Inc., 
so if fipm.o and khwl.o are linked with GPL code 
by someone other than Sigma Designs Inc., 
then disclosure of source code can not be compelled. 

So in flash.bin, it looks like we have an aggregation of 
proprietary and GPL binary code. There should have been 
GPL notice withing flash.bin or tvixfw1.9-kr.zip or 
at least on http://www.tvix.co.kr/KOR/Support/firmware.aspx. 
Oops. We are missing notification that flash.bin has GPL code. 
(Possible GPL violation #1)

When I look at the source code from uClinux-2.4.tar.gz for 
files with names that one would expect for the above *.o GPL files, 
I find substantial matches, so the above GPL code could have 
come from the uClinux-2.4.tar.gz source code. 

What's in tvixfw/flash? 

   $ strings tvixfw/flash
...
    libpng version 1.0.12 - June 8, 2001
      Copyright (c) 1998-2001 Glenn Randers-Pehrson
      Copyright (c) 1996, 1997 Andreas Dilger
      Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.
   1.0.12
    libpng version 1.0.12 - June 8, 2001 (header)
...

I could use some help here. Is that GPL code? 
If so, how do we make the flash file? 

Let's procede to look at tvixfw.bin: 

   $ mkdir mnt
   $ mount -t romfs -o loop tvixfw.bin mnt
   $ cd mnt
   $ find . -type f -not -name '*.png' -not -name '*.jpg' -ls
   852111  244 -rwxr-x---   1 root     root       243876 Dec 31  1969 ./bin/aviplay
   852112  112 -rwxr-x---   1 root     root       110372 Dec 31  1969 ./bin/mpgplay
   852113  260 -rwxr-x---   1 root     root       261384 Dec 31  1969 ./bin/mp3play
   852114  308 -rwxr-x---   1 root     root       310292 Dec 31  1969 ./bin/audioplay
   852115  708 -rwxr-x---   1 root     root       719516 Dec 31  1969 ./bin/init
   852120   20 -rwxr-x---   1 root     root        19107 Dec 31  1969 ./fonts/hangul24.gz
   852121   32 -rwxr-x---   1 root     root        31207 Dec 31  1969 ./fonts/hangul34.gz
   852122  164 -rwxr-x---   1 root     root       160842 Dec 31  1969 ./fonts/hanja24.gz
   852123  308 -rwxr-x---   1 root     root       307345 Dec 31  1969 ./fonts/hanja34.gz
   852124   20 -rwxr-x---   1 root     root        18437 Dec 31  1969 ./fonts/symbol24.gz
   852125   32 -rwxr-x---   1 root     root        28859 Dec 31  1969 ./fonts/symbol34.gz
   852243  340 -rw-r-----   1 root     root       342237 Dec 31  1969 ./khwl.o
   852244   12 -rw-r-----   1 root     root        10660 Dec 31  1969 ./irdrv.o
   852245   60 -rwxr-x---   1 root     root        55644 Dec 31  1969 ./minimod
   852246  452 -rw-r-----   1 root     root       458279 Dec 31  1969 ./linux.bin.gz

Interesting candidates to explore are mnt/bin/*, mnt/*.o, mnt/minimod 
and of course mnt/linux.bin.gz. 

   $ strings -f bin/* | grep -i copyright
   bin/audioplay: Copyright %s
   bin/init:    Copyright (c) 1998-2001 Glenn Randers-Pehrson
   bin/init:    Copyright (c) 1996, 1997 Andreas Dilger
   bin/init:    Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.
   bin/init:  deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly
   bin/init:  inflate 1.1.4 Copyright 1995-2002 Mark Adler
   bin/init: Copyright (C) 1998, Thomas G. Lane
   bin/mp3play: Copyright (C) 1998, Thomas G. Lane

Where did init come from? Is it GPM or proprietary? 
Was it compiled from uClinux-2.4/init/*.c from uClinux-2.4.tar.gz? 
How about bin/*play? Are they GPM, public domain or proprietary? 

   $ find mnt -name '*.o' -exec strings -f {} \; | grep -i license
   mnt/khwl.o: license=Proprietary. Copyright (c) 2002 Sigma Designs Inc. All rights reserved.

mnt/khwl.o is clearly proprietary code. 

   $ strings irdrv.o
   /m3000/uClinux-2.4/include/linux/dcache.h
   /m3000/uClinux-2.4/include/linux/sched.h
   /m3000/uClinux-2.4/include/linux/highmem.h
   IR: ir_check_media_change
   IR: ir_revalidate
   IR: failed to register kernel module
   IR: cleanup_module
   IR: cleanup_module ok
   /m3000/uClinux-2.4/include/linux/dcache.h
   /m3000/uClinux-2.4/include/linux/dcache.h
   /m3000/uClinux-2.4/include/linux/dcache.h
   kernel_version=2.4.17-uc0
   kernel_version=2.4.17-uc0
   kernel_version=2.4.17-uc0
   kernel_version=2.4.17-uc0

Where is the source code for irdrv.o? 
Is it proprietary or OSS code? 
Is it a kernel module? 
I don't seen any similarly name source files for it 
from uClinux-2.4.tar.gz

   $ gunzip <linux.bin.gz >linux.bin
   $ strings linux.bin | grep -i linux

>From http://www.uclinux.org/description/, 
one learns that uClinux is a derivative of Linux kernels. 
I would guess that that means that uClinux is covered by GPL. 
Where's the GPL notice? 

--------------------------------------------------------------

Summary. 

It seems the GPL notices have been thin. Although that 
could mean infringement, it is easily resolved, so 
there is little opportunity there. 

We probably have most of the source code, 
but it is common for such a complex product to need 
custom modifications. Were modifications made to the GPL 
code? Do we have the source code for such modifications? 
If not, then Dvico can be compelled to cough up the 
modified source code? 

Are the proprietary modules linked with the GPL code? 
If so, who does it? 

What code was in the M3000U when Mauro[d] bought it 
(before he downloaded code)? Did that code link proprietary 
code to GPL code? Did Mauro[d] receive GPL notice? 

Is shipping customers a product without code and 
having customers download infringing code some trick 
for shifting infringement to customers? 

Since the obvious proprietary code is by a third party, 
Sigma Designs Inc., unless Sigma incorporated GPL code 
in their proprietary code, it is unlikely that the 
source code for the proprietary code can be forced 
to be divulged. If Dvico linked Sigma's proprietary 
code with GPL code, only Dvico would be in an awkward 
position.