ASUS SplashTop and Phoenix Hyperspace infringing kernel copyright and GPL

ASUS SplashTop and Phoenix Hyperspace infringing kernel copyright and GPL

[Stan Cunningham]

Hi,

SplashTop is an extension of BIOS that runs on the Linux kernel and has been distributed by ASUS on certain high-end motherboards and laptops since October, 2007. In May 2008, ASUS announced that it will ship SplashTop on *ALL* its motherboards. The problem is that ever since SplashTop's inception ASUS has been infringing on the copyright of Linux kernel contributors.

SplashTop's so-called source code (http://www.splashtop.com/download3.php?token=1bfb156d0cd5fef5df4a43ad2b46a531) contains a few patches to the Linux kernel but not the whole, compilable modified kernel source code as the GPL requires. This clearly constitutes a copyright violation.

I haven't bought any of the motherboards or laptops containing SplashTop, but ASUS may have left out the obligatory notice on boxes and/or manuals informing the recipients that the product contains GPL code and where that source code can be obtained. If they indeed left out the notice, that constitutes another violation of the GPL and consequently of copyright law.

Another product that likely violates the GPL is Hyperspace, which is marketed by the infamous proprietary PC BIOS maker Phoenix. Even though Hyperspace clearly runs Linux and has been reported to do so in the press, Phoenix doesn't even mention the word Linux or the GPL on its website (http://www.phoenix.com/en/Products/Browse+by+Products/Phoenix+HyperSpace/default.htm), and certainly doesn't provide any source code. I am not sure what motherboards Hyperspace is distributed on, but I would expect that they also fail to mention Linux, the GPL and the availability of source code. This again violates the GPL and the copyrights of Linux kernel contributors like yourselves.

I urge you to uphold your copyrights and protect the rights of Free Software users by making unscrupulous companies like ASUS and Phoenix respect the conditions set out by the GPL and give back their improvements in the form of source code. And if they refuse, sue them in court! Some of the improvements to Linux that they try to illegally keep secret would really help distros in areas such as hardware support and extremely quick boot time.

Thanks,
Stan


      

Re: ASUS SplashTop and Phoenix Hyperspace infringing kernel copyright and GPL

[Chris Snook]

Stan Cunningham wrote:
> Hi,
> 
> SplashTop is an extension of BIOS that runs on the Linux kernel and has been
> distributed by ASUS on certain high-end motherboards and laptops since
> October, 2007. In May 2008, ASUS announced that it will ship SplashTop on
> *ALL* its motherboards. The problem is that ever since SplashTop's inception
> ASUS has been infringing on the copyright of Linux kernel contributors.
> 
> SplashTop's so-called source code
> (http://www.splashtop.com/download3.php?token=1bfb156d0cd5fef5df4a43ad2b46a531)
> contains a few patches to the Linux kernel but not the whole, compilable
> modified kernel source code as the GPL requires. This clearly constitutes a
> copyright violation.
> 
> I haven't bought any of the motherboards or laptops containing SplashTop, but
> ASUS may have left out the obligatory notice on boxes and/or manuals
> informing the recipients that the product contains GPL code and where that
> source code can be obtained. If they indeed left out the notice, that
> constitutes another violation of the GPL and consequently of copyright law.
> 
> Another product that likely violates the GPL is Hyperspace, which is marketed
> by the infamous proprietary PC BIOS maker Phoenix. Even though Hyperspace
> clearly runs Linux and has been reported to do so in the press, Phoenix
> doesn't even mention the word Linux or the GPL on its website
> (http://www.phoenix.com/en/Products/Browse+by+Products/Phoenix+HyperSpace/default.htm),
> and certainly doesn't provide any source code. I am not sure what
> motherboards Hyperspace is distributed on, but I would expect that they also
> fail to mention Linux, the GPL and the availability of source code. This
> again violates the GPL and the copyrights of Linux kernel contributors like
> yourselves.
> 
> I urge you to uphold your copyrights and protect the rights of Free Software
> users by making unscrupulous companies like ASUS and Phoenix respect the
> conditions set out by the GPL and give back their improvements in the form of
> source code. And if they refuse, sue them in court! Some of the improvements
> to Linux that they try to illegally keep secret would really help distros in
> areas such as hardware support and extremely quick boot time.
> 
> Thanks, Stan

Out of curiosity, have you tried asking them nicely?  ASUS seems to be pretty 
responsive when oversights like this are pointed out to them.  Of course, if you 
start with a lawsuit threat you're inclined to hit the slow path (legal) rather 
than the fast path (support/community relations).  I have no idea how responsive 
Phoenix is to issues like this, but a friendly request goes over much better 
than a shot across the bow.

-- Chris

Re: ASUS SplashTop and Phoenix Hyperspace infringing kernel copyright and GPL

[Stan Cunningham]

Hi,

--- On Mon, 5/19/08, Chris Snook <csnook@redhat.com> wrote:
> Out of curiosity, have you tried asking them nicely?  ASUS
> seems to be pretty 
> responsive when oversights like this are pointed out to
> them.  Of course, if you 
> start with a lawsuit threat you're inclined to hit the
> slow path (legal) rather 
> than the fast path (support/community relations).  I have
> no idea how responsive 
> Phoenix is to issues like this, but a friendly request goes
> over much better 
> than a shot across the bow.

I haven't heard anything from ASUS, but an employee from DeviceVM, the company that develops SplashTop, responded here: http://lists.gpl-violations.org/pipermail/legal/attachments/20080521/f74f7e2d/ASUSSplashTopandPhoenixHyperspaceinfringingkernelcopyrightandGPL-0001.mht

There are several unresolved issues: first of all, it is ASUS and not DeviceVM that is distributing the binary to customers who buy motherboards and laptops. It is therefore ASUS' obligation to provide the the "complete machine-readable" source code to those customers. I've included the relevant section of the GPLv2 below. You'll notice that the GPLv2 sets out three possible ways to provide source code, detailed in sections 3a, 3b and 3c. ASUS _cannot_ hide behind section 3c by simply pointing customers to SplashTop/DeviceVM's website because neither ASUS nor DeviceVM are noncommercial, and in fact, they are _selling_ motherboards and laptops containing GPLv2 software. 

------------------------
3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:

    a) Accompany it with the complete corresponding machine-readable
    source code, which must be distributed under the terms of Sections
    1 and 2 above on a medium customarily used for software
    interchange; or,

    b) Accompany it with a written offer, valid for at least three
    years, to give any third party, for a charge no more than your
    cost of physically performing source distribution, a complete
    machine-readable copy of the corresponding source code, to be
    distributed under the terms of Sections 1 and 2 above on a medium
    customarily used for software interchange; or,

    c) Accompany it with the information you received as to the offer
    to distribute corresponding source code.  (This alternative is
    allowed only for noncommercial distribution and only if you
    received the program in object code or executable form with such
    an offer, in accord with Subsection b above.)
------------------------

So ASUS must either satisfy either 3a or 3b. To satisfy 3a, ASUS must package the complete Linux source code and any other GPL-ed code with every SplashTop-containing motherboard and laptop. To satisfy 3b, they must place a written offer to provide the  "complete machine-readable" source code to the .

One thing I want to ask everybody out there who has bought a Splashtop-containing motherboard or laptop: did it come with the source code (thus fulfilling section 3a) or with a written offer in the package (thus fulfilling section 3b)? If not, then ASUS is definitely violating the GPLv2.

Secondly: if ASUS is simply distributing DeviceVM's patches to the Linux kernel, ASUS is still violating the GPLv2 because patches by definition are _not complete_ and they leave out the main bulk of the kernel code. DeviceVM admits (http://www.splashtop.com/blog/index.php/2008/05/20/reminder-source-code-and-how-to-get-it/) that the "Source Code" they provide is only ~12MB, which is blatantly insuffcient considering that the code for a linux-2.6 kernel is at least 41 MB.

You may think patches are OK because the mainline kernel to which they are applied is mirrored elsewhere: this is still a violation because the GPLv2 requires _complete_ source code, no ifs ands or buts. The GPLv2 never even mentions patches.

Now I have a theory as to why ASUS/DeviceVM are posting patches instead of the full kernel: it makes it harder for copyright holders to find out that a driver or modification is missing from the patchset. ASUS can claim that the differences in behavior between a patched mainline kernel and the binary blob burnt onto the BIOS flash chip are due to the patch not being applied to the correct version of the mainline kernel. Plus, if they are caught, they don't look as bad saying "Oops, we forgot a patch within the patchset. Sorry."

However, if ASUS were to provide the complete yet incorrect source code, and compiling it yielded a kernel with a different behavior from the binary kernel that is burnt onto the BIOS flash chip, then it would be immediately obvious that they are intentionally leaving out modifications from the source code.

I also think that ASUS is using DeviceVM a front-man with which to skirt the law, and if worse comes to worse ASUS will try to blame DeviceVM for infringing on the GPL. But it's not going to work because ASUS is a commercial entity, selling GPL-ed software on commercial products, and is itself responsible for distributing the code as specified by sections 3a and 3b of the GPLv2.

Finally, I'd like to bring your attention to an article (http://community.zdnet.co.uk/blog/0,1000000567,10008346o-2000331761b,00.htm) in which DeviceVM states that " the part of Splashtop that is embedded into BIOS and achieves the instant-on first screen is based on a proprietary RTOS that DeviceVM developed." This sounds less of a bootloader and more like a Virtual Machine because it apparently brings up Linux from a frozen state without booting it. In any case, I urge someone with the hardware and know-how to check if this "proprietary RTOS" uses any EXPORT_SYMBOL_GPL.

Thanks,
Stan


      

Re: ASUS SplashTop and Phoenix Hyperspace infringing kernel copyright and GPL

[David Newall]

Stan Cunningham wrote:
> There are several unresolved issues: first of all, it is ASUS and not DeviceVM that is distributing the binary to customers who buy motherboards and laptops.

Yet it is DeviceVM that distributes it to ASUS, so the GPL obligations
attach thereto.

Re: ASUS SplashTop and Phoenix Hyperspace infringing kernel copyright and GPL

[Alan Cox]

>distributing the binary to customers who buy motherboards and laptops. It is therefore ASUS' >obligation to provide the the "complete machine-readable" source code to those customers. I've

>ASUS _cannot_ hide behind section 3c by simply pointing customers to
>SplashTop/DeviceVM's website because neither ASUS nor DeviceVM are
>noncommercial, and in fact, they are _selling_ motherboards and laptops
>containing GPLv2 software. 

Thst isn't a simple question and rather depends upon the contractual
arrangements don't you think ? If I offer to supply it by CD your
software will be delivered by the postal service, from whom you did not
buy the product.

A company might have liability for the failure of its agents to perform
services but that is a different question

> Now I have a theory as to why ASUS/DeviceVM are posting patches instead of the full kernel: it makes it harder for copyright holders to find out that a driver or modification is missing from the patchset. ASUS can claim that the differences in behavior between a patched mainline kernel and the

Let me propose a different theory: ASUS thought a smaller 12MB download
would be more convenient and useful to their userbase.

> Finally, I'd like to bring your attention to an article (http://community.zdnet.co.uk/blog/0,1000000567,10008346o-2000331761b,00.htm) in which DeviceVM states that " the part of Splashtop that is embedded into BIOS and achieves the instant-on first screen is based on a proprietary RTOS that DeviceVM developed." This sounds less of a bootloader and more like a Virtual Machine because it apparently brings up Linux from a frozen state without booting it. In any case, I urge someone with the hardware and know-how to check if this "proprietary RTOS" uses any EXPORT_SYMBOL_GPL.

It's a mini virtual machine using the cpu extensions. It really shouldn't
need any deeply magical kernel patches except maybe interfaces to
virtualised drivers.

I really don't see a big problem providing ASUS are including the written
offer in the manual somewhere or have an agreement with devicevm to act
as their GPL fulfilment - and DeviceVM do so.

What we *really* need to happen is to get DeviceVM/Phoenix merging their
work into the base kernel tree nicely and cleanly.

Alan