VMware is hit by lawsuit contending GPL violation
Controversial Code
For nearly 10 years, VMware has been suspected of using GPL-licensed code with its ESX system, a hypervisor created by VMware to deploy and server virtual machines. Negotiations with VMware to correct non-compliance issues started originally with the non-profit Software Freedom Conservancy (SFC) because of a report of another GPL violation that occurred in 2011 [1]. This report concerned the BusyBox project, which is included in VMware's ESXi products. In the course of these negotiations, SFC discovered – according to its own account – that there might be another infringement concerning the copyrights of Linux kernel developer Christoph Hellwig.
One of the 20 most prolific contributors to the Linux kernel, Hellwig has penned 279,653 lines of codes in kernel version 3.19. Hellwig also has expertise in code review, which he has exercised by inspecting many code additions from third parties. Hellwig said that after the SFC had informed him that his copyrights might be violated in newer VMware versions, he began to prepare this case.
Background
As a maintainer of Linux SCSI storage, Hellwig in 2006 [2] let VMware employee Zachary Amsden know rather bluntly on the kernel mailing list that he was accusing VMware of violating Linux code copyrights with the ESX server (Figure 1). The parties have spent several years attempting to find an amicable agreement; however, according to information from the SFC, attempts to settle the matter amicably failed. Even efforts by Hellwig could not lead to an agreement.
The SFC revealed that VMware last proposed an agreement at the end of 2014. However, Hellwig would have had to sign a non-disclosure agreement for this offer to be realized – which he refused to do. Hellwig filed a lawsuit against VMware in Hamburg, Germany, a few months later. He is represented by lawyer Till Jaeger, who is experienced in GPL matters. For example, Jaeger represented Harald Welte in his successful lawsuit against Skype [3].
Institutional Support
The SFC is providing financial support for Hellwig's lawsuit. According to information from the SFC, support will continue until the end of the case. The funds are coming from an appeal for funds [1] that brought in around $100,000 within a month and thus exceeded the target of $50,000.
SFC also runs the GPL Compliance Project for Linux Developers [4], which focuses on pertinent legal issues. Hellwig is a member of this project. Other organizations and projects, including the Free Software Foundation, the Gnome Foundation, the Samba Team, and the Open Source Initiative added their support without becoming directly involved.
The Case to Prove
The lawsuit in Hamburg concerns answering the technically challenging question of whether the proprietary VMware kernel needs the Linux kernel to load drivers and modules. Therefore, the plaintiff must show in detail that VMware kernel functions access the Linux kernel. Hellwig thinks the technical facts are pretty clear: He said that VMware confirmed this in a short press release.
VMware's ESXi 5.5 is the object of detailed code tests. The code examples that were put forward to demonstrate alleged access to the Linux kernel, and published by the SFC in a FAQ for the proceedings against VMware [5], also come from this test. A diagram from SFC of the kernel architecture claims to show how access occurs (Figure 2).
VMware's Argument
VMware has also talked about the upcoming case and says it believes the lawsuit to be unfounded. In response to a request for information, the company said it feels very close to the open source community, takes part in the community's work, and is committed to it. The company is therefore convinced that it will prevail in the court proceedings.
In the first reaction [6] after the lawsuit was filed, the company expressed disappointment with the SFC and said it regretted the situation had come to a lawsuit. At question is whether the inclusion of the Linux code makes ESX Server a "derivative work," which would require GPL licensing, or whether the open source components form a separate entity that merely interacts with the proprietary kernel, VMware argues that the VMware kernel does not violate the GPL and that the ESXi kernel contains an API for device drivers and loadable modules [6].
Moreover, third parties can write drivers and modules that can integrate with the kernel. If a Linux driver is involved, the vmklinux kernel module is offered; it is loaded in connection with the third-party drivers and cooperates with the VMware kernel via the VMK API. Vmklinux is offered under the GPL and the source code is available.
Options
The lawsuit has another dimension. According to the SFC, if the subject of the GPL lawsuit is a combined work comprising GPL-licensed and proprietary code, VMware would then have to publish the combined work arising from the link. The GPLv2 [7], under which the Linux kernel is licensed, requires the publication of works from combined or derived sources.
Hellwig is hoping for successful proceedings and that other companies will avoid similar cases in the future. He does not believe that a defeat for VMware would mean further complications for the company, other than publishing the code. Hellwig says that a defeat for him would not be good for many companies in the Linux environment because companies such as VMware would get the message they can use the community's contributions without having to give anything back to the developer community.