Embedded Linux and the GPL

Much of the code running in those systems is licensed under the GPL. While no royalties need be paid for the distribution of GPL-licensed code, there are other obligations which must be met. In particular, a Linux-powered gadget is supposed to come with either (1) a copy of the source for the code running inside, or (2) a written offer to ship the source anytime in the next three years. While some companies (e.g. TiVo) make their source available, it would seem that some other embedded system vendors are forgetting about this obligation when they ship their boxes.

Recently, Andrew Miklas noticed that his Linksys WRT54G wireless access point was running GPL-licensed software, including a 2.4.5 kernel and the BusyBox tool suite. The product contains no source, offer of source, or even acknowledgement of the GPL software running inside. Attempts to obtain source from Linksys have, so far, been unsuccessful. The Free Software Foundation is now taking an interest in this case.

Linksys, it seems, is not alone in this behavior. Products from Belken, Buffalo Technology, and QLogic have also been shown to have Linux inside, with no source forthcoming. Lest one despair completely, however, it's worth looking at Colm MacCárthaigh's experience with his Dell TrueMobile 1184 router. Not only was he able to (eventually) get the source from Dell; his efforts also convinced Dell to include a source CD with the product.

Mr. MacCárthaigh's experience is worth noting for a couple of reasons. The first is that Dell was simply unaware that it was supposed to make source available. In most GPL violation cases, the real problem is that the company involved is unaware of its obligations under the license; GPL violations tend to be unintentional. With some persistence - and politeness - it is usually possible to get these companies to move into compliance with the GPL. The Free Software Foundation has been very good at this in the past; in contrast with its loudness on other fronts, the FSF treats GPL problems with discretion and tact. As a result, most GPL violators are brought around to compliance without being pushed into full-scale defensive lockdown.

The other thing to note is that Mr. MacCárthaigh did not get anything all that exciting for his efforts: a stock 2.2.14 kernel with a widely-available patch set. In the Linksys case, many Linux users are getting worked up about the prospect of extracting a new set of wireless network drivers by forcing a release of code. These users will almost certainly be disappointed. The drivers in question will be implemented as loadable modules which, until some disgruntled kernel developer proves otherwise in court, are legal to distribute for use with the kernel. Linksys owes its customers the source for its Linux kernel, BusyBox, and any other GPL software that it includes in its product. But it is under no obligation to open up any proprietary drivers that it is using.

The truly sad part is that embedded system vendors need not even provide source which can be rebuilt and loaded into their devices. As reported here in May, there appears to be no legal impediment that can prevent systems vendors from requiring kernels to be signed by a private key before they can be run. You can look at what your Linux-powered device is running (if you trust the vendor to provide the true source for the binaries in the box), but you may not be able to change it.

Even so, it is important that distributors of GPL-licensed software live up to the obligations imposed by that license. There is a vast body of highly capable software which is available under the GPL, and all that's required to be able to use it is to make the source available under the same license. That is a small price to pay for free (of charge) access to software that, by some estimates, is worth over a billion dollars.

Update: since this article was first published, Linksys has stated that it will release the source for the GPL-licensed code running in the WRT54G router.