Subject: Re: [E3-hacking] PBL V5.1

From: Cliff Lawson <[email-masked]>
Date: Tue, 9 Oct 2007 09:34:33 +0100

Ralph,

Well if you want it I'll happily supply you the source of the program I use
to sign the images but what I won't supply you are the keys so I'm not sure
exactly what you would gain from it. I've already read messages here that
have identified the standard algorithms I'm using and there's open source
for them all over the internet - it's no secret (but my keys are!)

Cliff

> -----Original Message-----
> From: Ralph Corderoy [mailto:[email-masked]]
> Sent: 06 October 2007 14:49
> To: Discussion of the Amstrad E3 emailer hardware/software
> Subject: Re: [E3-hacking] PBL V5.1
> 
> 
> 
> Hi Cliff,
> 
> > > From: Alexander [mailto:[email-masked]]
> > > As things stand now with PBL V5.1?  Do I have a chance to use the
> > > device?
> >
> > Err, no.  (trust me on this ;-)
> 
> Oh, but aren't you forgetting our previous off-list conversation?  I
> pointed out GPL ver. 2 says
> 
>     The source code for a work means the preferred form of 
> the work for
>     making modifications to it.  For an executable work, 
> complete source
>     code means all the source code for all modules it 
> contains, plus any
>     associated interface definition files, plus the scripts used to
>     control compilation and installation of the executable.
> 
> Leaving aside for the moment the fact that Amstrad never released
> matching sources to the binaries, even to those paying GBP25 for a CD,
> the bit in the GPL about scripts used to install means what you use to
> upload firmware over the EXT serial port in the lab and 
> factory.  And if
> that signs the firmware before uploading, it includes that too.
> 
> In reply, your offer was to do the upload for anyone that sends you
> their phone and firmware.  Personally, I don't think that 
> complies and I
> suspect the FSF and http://gpl-violations.org/faq/sourcecode-faq.html
> would agree.
> 
> Cheers,
> 
> 
> Ralph.
> 
> 
> _______________________________________________
> e3-hacking mailing list
> [email-masked]
> http://www.earth.li/cgi-bin/mailman/listinfo/e3-hacking
> 

This e-mail and any attachments are confidential and intended exclusively for the addressee. If you are not the intended recipient please delete it from your system and notify the sender immediately. This message is attributed to the sender and may not necessarily reflect the views of Amstrad Plc or its subsidiaries.

For further information on Amstrad Plc please visit our website: www.amstrad.com

Amstrad Plc.
Brentwood House
169 Kings Road
Brentwood
Essex CM14 4EF
Registered in England : No. 955321

WEE PRODUCER No. WEE/AF0046SY

---

From: Antony Stone <[email-masked]>
Date: Tue, 9 Oct 2007 12:17:16 +0100

> for them all over the internet - it's no secret (but my keys are!)

Doesn't this go against both the spirit and the letter of 
http://gpl-violations.org/faq/sourcecode-faq.html which says:

"Always keep in mind that it is the purpose of the GPL to enable the users to 
exercise his freedoms. Specifically, the freedom to make modified versions of 
the program, and to run such modified versions of the program."

and

"Please note that this is of special practical importance in the case of 
embedded devices, since the executable program(s) need to be somehow 
installed onto the device. If the user is not given a way to install his own 
(modified) versions of the program, he has no way of exercising his freedom 
to run modified versions of the program."

Antony

-- 
I don't know, maybe if we all waited then cosmic rays would write all our 
software for us. Of course it might take a while.

 - Ron Minnich, Los Alamos National Laboratory

                                                     Please reply to the list;
                                                           please don't CC me.

---

From: Alexander <[email-masked]>
Date: Wed, 10 Oct 2007 10:25:09 +0400

> installed onto the device. If the user is not given a way to install his
> own (modified) versions of the program, he has no way of exercising his
> freedom to run modified versions of the program."

Agreed. That is what I want is just to run on your device modified version of 
Linux.

---

From: Antony Stone <[email-masked]>
Date: Wed, 10 Oct 2007 10:35:21 +0100

On Wednesday 10 October 2007 07:25, Alexander wrote:

> Agreed. That is what I want is just to run on your device modified version
> of Linux.

It occurs to me that Amstrad don't want to release the keys they've used to 
sign/encrypt their new code, however the new 5.1 bootloader won't accept 
unsigned/unenecrypted code, and therefore we get a sort of stalemate.

How would both Amstrad and the open source community here feel about the 
following proposal?

	Amstrad provides a signed/encrypted (whatever is needed to get it to load
	onto a 5.1 device) copy of the 4.9 bootloader, so that it becomes possible to
	'downgrade' a device to a state where we _can_ load our own open source code.

That way Amstrad keeps its keys, but the devices which were released running 
Linux remain open for us to use as the GPL requires.

Comments, people?

Antony.

-- 
It is against Google's terms of service for anyone under the age of 18 (in the 
UK, at least) to use the Google search system:

"2.3 You may not use the Services and may not accept the Terms if you are not 
of legal age to form a binding contract with Google."

http://www.google.com/accounts/TOS

---

From: David Ford <[email-masked]>
Date: Wed, 10 Oct 2007 10:42:00 +0100

> Linux remain open for us to use as the GPL requires.

I suspect that Amstrad would not be happy with this, since I suspect the
main purpose of the encryption was to prevent people using the device
other than with their source.

---

From: David Given <[email-masked]>
Date: Wed, 10 Oct 2007 11:12:27 +0100

Antony Stone wrote:
[...]
> unsigned/unenecrypted code, and therefore we get a sort of stalemate.

AIUI, the reason why Amstrad are doing this in the first place is to 
prevent people from buying up large numbers of emailers (which are sold 
at a loss, remember), reflashing them, and then selling them on. This is 
apparently fairly likely in eastern Europe.

[...]
> Linux remain open for us to use as the GPL requires.

Except the whole point of the exercise is to *close* the device...

(And the GPL, v2 at least, *doesn't* require the devices be open. The 
exact phrasing is:

“The source code for a work means the preferred form of the work for 
making modifications to it. For an executable work, complete source code 
means all the source code for all modules it contains, plus any 
associated interface definition files, plus the scripts used to control 
compilation and installation of the executable.”

PBL and the encryption keys are not covered by this. PBL because it's 
not GPLd, and the encryption keys because they're not an interface 
definition file or script.)

What they might be more likely to go with is a mechanism for obtaining 
the key to an individual emailer --- either by paying them the 
difference in price between what it cost to build and what it's sold at 
(so that they don't end up out of pocket), or by just asking nicely; 
they don't seem to have a problem with small numbers of hobbyists. 
However, it's probably not possible to unlock an individual device. I 
wouldn't have thought they'd have per-machine keys.

-- 
David Given
[email-masked]

---

From: Ralph Corderoy <[email-masked]>
Date: Wed, 10 Oct 2007 11:27:59 +0100

Hi Antony,

> How would both Amstrad and the open source community here feel about
> the following proposal?
> 
> 	Amstrad provides a signed/encrypted (whatever is needed to get
> 	it to load onto a 5.1 device) copy of the 4.9 bootloader, so
> 	that it becomes possible to 'downgrade' a device to a state
> 	where we _can_ load our own open source code.
> 
> That way Amstrad keeps its keys, but the devices which were released
> running Linux remain open for us to use as the GPL requires.
> 
> Comments, people?

Amstrad's aim is to lock down the device.  The use of GPL software in a
device sold at a subsidised price was an error on their part since the
GPL allows me to alter the E3 and remove the part that earns Amstrad
post-sales revenue whilst maintaining functionality.  Given Amstrad's
lack of compliance knowledge when I initially contacted them, and that
they never included the license in the package, I think they were poorly
advised by MontaVista and didn't do sufficient research themselves.

To summarise the concern expressed privately to me: it's that 1,000
units can be picked up by some commercial outfit, e.g. from Russia,
taken back there, and used to some completely end that earns Amstrad no
revenue.

Having put the key system in place, adding to their list of GPL
violations, I doubt they'll release a downgrade that lets us circumvent
it.

Cheers,

Ralph.

---

From: "Neil Stainton" <[email-masked]>
Date: Wed, 10 Oct 2007 11:39:40 +0100

Sorry if this has been covered before, but can't the NOR flash be read
or rewritten simply by bit banging the memory bus via JTAG? The JTAG
port on the POMAP5910JGDY is IEEE 1149 compliant which I take to mean
that all the I/O on the device can be manually overidden.

Is the JTAG port brought out to a handy set of pads somewhere? If not,
are the appropriate balls brought out to vias underneath the CPU?

Neil

On Wed, 10 Oct 2007 11:12:27 +0100, "David Given" <[email-masked]> said:
> &#8220;The source code for a work means the preferred form of the work for 
> compilation and installation of the executable.&#8221;
>

---

From: David Given <[email-masked]>
Date: Wed, 10 Oct 2007 12:14:28 +0100

> are the appropriate balls brought out to vias underneath the CPU?

Yup, this is perfectly possible, and I believe that there are some handy 
pads inside. (If you brick the device this is the only way of fixing it.)

However, in order to reflash it, you have to take the lid off, do some 
soldering, and apply some technical knowledge --- which means that it's 
not going to be suitable for mass production. Reflashing using PBL, 
though, only requires plugging a jack in the back of the machine.

-- 
David Given
[email-masked]

---

From: Antony Stone <[email-masked]>
Date: Wed, 10 Oct 2007 12:34:06 +0100

> though, only requires plugging a jack in the back of the machine.

Yes, but considering that (as far as I know) we've never seen a retail unit 
already containing PBL 5.1 (this only happens when the machine gets poisoned 
by plugging it into a UK phone line), it means that:

 - anyone who wants to reprogram virgin devices en masse can do so using the 
jack socket on the back, talking to PBL 4.9

 - anyone who wants to rejuvenate a used device which has been "upgraded" to 
5.1 can do so with the once-off inconvenience of using the JTAG socket/pads

I'm assuming of course that it's possible to reflash 4.9 into a device using 
the JTAG interface, although I've never attempted to do this (I've made sure 
none of my E3s get near a phone socket).

Antony.

-- 
I want to build a machine that will be proud of me.

 - Danny Hillis, creator of The Connection Machine

---

From: "Neil Stainton" <[email-masked]>
Date: Wed, 10 Oct 2007 12:49:06 +0100

> though, only requires plugging a jack in the back of the machine.

I see, but if Amstrad's concern is that thousands of units might end up
abroad and be reprogrammed then would it not be beyond the wit of the
outfit potentially doing the reprogramming to set up a little production
line to manually remove and replace the cover in order to do it? I
believe in a country such as Russia (mentioned elsewhere in this thread)
semi-skilled labour would not be prohibitively expensive.

Just seems odd that Amstrad would go to the effort of adding the
encryption when the extra effort involved in circumventing it is not
that great, unless the purpose was to protect the binary from being
copied.

Neil

---

From: "Matt Callow" <[email-masked]>
Date: Wed, 10 Oct 2007 21:19:47 +1000

> pads inside. (If you brick the device this is the only way of fixing it.)

Do you know where the pads are? I've tried previously to find them -
and failed.  AFAIK, this information is not on the web anywhere

Matt

---

From: David Given <[email-masked]>
Date: Wed, 10 Oct 2007 13:10:31 +0100

Matt Callow wrote:
[...]
> and failed.  AFAIK, this information is not on the web anywhere

I found this info via Ralph's website:

http://www.en4rab.dsl.pipex.com/

However, it does seem to be E2 and not E3. I could have sworn I saw 
someone report using JTAG on the E3, but I can't find it now either... 
the pads must be in there *somewhere*.

-- 
David Given
[email-masked]

---

From: "Neil Stainton" <[email-masked]>
Date: Wed, 10 Oct 2007 13:39:18 +0100

> the pads must be in there *somewhere*.

Correlating the TI data sheet (GDY package, bottom of page 21) with Jon
Masters' photos, it looks as though the JTAG balls are all bunched
together around one corner and I guess that would correspond to cluster
of vias between C52 and T158. Can't really tell from the photos where
the traces lead off to. Also, it doesn't seem as though there are enough
vias on the back of the processor for all of the signals, so there might
be some buried vias there.

http://focus.ti.com/docs/prod/folders/print/omap5910.html
http://photos.jonmasters.org/amstrad_emailer_e3_20050108/dscn4682?full=1
http://photos.jonmasters.org/amstrad_emailer_e3_20050108/dscn4672?full=1

Neil

---

From: Alexander <[email-masked]>
Date: Thu, 11 Oct 2007 10:29:15 +0400

> taken back there, and used to some completely end that earns Amstrad no

I live in Russia, and I know that the number of tons of devices is maintained 
very low - I found no mention of the Russians at their sites and forums.

However, I bought the device, which has already been used, indicating that 
Amstrad has already received its anticipated income. A new device, as I 
understand it, and so contain PBL v 4.9. Further, as rightly observed, the 
number intuziastov able to make a change in the device is very low-well 
illustrated on the proposals at E3 on eBay. And, of course, nothing can 
justify the violation of the license is the huge number of people invested 
their work in the original products. Moreover, the opening of source and 
loader may lead to facilitate the development of new versions of the programs 
Amstrad.
It comes, in particular, Asus, Britain, Rapsody, and others.