On 1/8/26 4:47 PM, Quentin Schulz wrote:
Hi Oliver,
On 12/19/25 4:51 PM, oliver Fendt wrote:
[You don't often get email from [email protected]. Learn why this
is important at https://aka.ms/LearnAboutSenderIdentification ]
Hi all,
I recently did a license analysis of u-boot an I came across some
unclear license information in files. I do not know whether this is
the right place to put my points, nevertheless I want to share my
findings.
1. the file https://eur02.safelinks.protection.outlook.com/?
url=https%3A%2F%2Fgithub.com%2Fu-boot%2Fu-
boot%2Fblob%2Fmaster%2Fdrivers%2Fmmc%2Fsdhci-
cadence6.c&data=05%7C02%7Cquentin.schulz%40cherry.de%7Cdde9821aaf3941a7103108de3f284ddd%7C5e0e1b5221b54e7b83bb514ec460677e%7C0%7C0%7C639017639504977773%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=g9tZGco8ca9ScjhMgxCxzBwZfHvzdMtCoKPg%2FeERyBo%3D&reserved=0
contains the following information SPDX-License-Identifier:
GPL-2.0-or-platform_driver which is not a valid license identifier, I
think GPL-2.0-or-later is meant here.
+Cc @Kuan Lim Lee, @Alex Soo, @Wei Liang Lim who contributed the driver,
they should be able to answer what the intended license was (I assume
the same as you).
2. the file https://eur02.safelinks.protection.outlook.com/?
url=https%3A%2F%2Fgithub.com%2Fu-boot%2Fu-
boot%2Fblob%2Fmaster%2Fdts%2Fupstream%2Fsrc%2Farm64%2Farm%2Fjuno-
clocks.dtsi&data=05%7C02%7Cquentin.schulz%40cherry.de%7Cdde9821aaf3941a7103108de3f284ddd%7C5e0e1b5221b54e7b83bb514ec460677e%7C0%7C0%7C639017639504990800%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=xIjuRJ6aCai1Qkrjyox1zoeuBeqraiHFqrURQoqyPuM%3D&reserved=0
contains the following information "This file is licensed under a dual
GPLv2 or BSD license." the BSD license term is vague is it
BSD-3-Clause or BSD-2-Clause or 0BSD or...
We get this file from the Linux kernel, so report that there. This file
is more than a decade old, but arm is still active in the community so
you should be able to find someone to answer this question.
See: https://elixir.bootlin.com/linux/v6.18.3/source/arch/arm64/boot/
dts/arm/juno-clocks.dtsi
We do NOT modify any file in dts/ folder in U-Boot. It's imported
(merged) from https://git.kernel.org/pub/scm/linux/kernel/git/
devicetree/devicetree-rebasing.git/ which is generated from the Linux
kernel tree from Torvalds.
3. the file https://eur02.safelinks.protection.outlook.com/?
url=https%3A%2F%2Fgithub.com%2Fu-boot%2Fu-
boot%2Fblob%2Fmaster%2Flib%2Fzstd%2Fcommon%2Fcpu.h&data=05%7C02%7Cquentin.schulz%40cherry.de%7Cdde9821aaf3941a7103108de3f284ddd%7C5e0e1b5221b54e7b83bb514ec460677e%7C0%7C0%7C639017639504999145%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=V%2BBI%2BTuw8%2FJfOA9BHSmIO6Mu9tDFE%2BRI5TEZtfuHFRE%3D&reserved=0
an others contain the following text:
* Copyright (c) Facebook, Inc.
* All rights reserved.
*
* This source code is licensed under both the BSD-style license
(found in the
* LICENSE file in the root directory of this source tree) and the
GPLv2 (found
* in the COPYING file in the root directory of this source tree).
* You may select, at your option, one of the above-listed licenses.
when looking up the zstd repo on GitHub there is the same file
Be careful when doing those cross-checks. We import a specific version
of files, so you need to check at that specific time in the repo history
what the license was.
And guess who checked the version used in Linux kernel and not in U-Boot :)
https://eur02.safelinks.protection.outlook.com/?
url=https%3A%2F%2Fgithub.com%2Ffacebook%2Fzstd%2Fblob%2Fdev%2Flib%2Fcommon%2Fcpu.h&data=05%7C02%7Cquentin.schulz%40cherry.de%7Cdde9821aaf3941a7103108de3f284ddd%7C5e0e1b5221b54e7b83bb514ec460677e%7C0%7C0%7C639017639505006974%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=vUDaUjdiT8I5VC5suVIYVFdZDMJmVXJwoOyUdCzrlug%3D&reserved=0 with the
same license information. The root directory contains a COPYING file
and a LICENSE file (both are not present in u-boot) the COPYING file
contains the text of the GPL-2.0 and the LICENSE file contains the
following text:
Redistribution and use in source and binary forms, with or without
modification,
are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright
notice, this
list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright
notice,
this list of conditions and the following disclaimer in the
documentation
and/or other materials provided with the distribution.
* Neither the name Facebook, nor Meta, nor the names of its
contributors may
be used to endorse or promote products derived from this software
without
specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Which is an individualized BSD-3-Clause license. Since the
BSD-3-Clause license is very clear in the wording " must reproduce the
above copyright notice, this list of conditions and the following
disclaimer in the documentation" the exact original license text of
the BSD-3-Clause license from Meta must be reproduced. Furthermore the
IANAL, so don't know if we *really* need to have this customized BSD
license text in our tree or if a generic BSD license text + the
appropriate copyright notice in each imported file would be enough. The
copyright seems to be the same in lib/zstd/decompress_sources.h in U-
Boot and LICENSE in the zstd repo, so that could be covered this way.
GPL-2.0 is acc. to the text GPL-2.0-only and not GPL-2.0-or-later like
it is mentioned in
https://eur02.safelinks.protection.outlook.com/?
url=https%3A%2F%2Fgithub.com%2Fu-boot%2Fu-
boot%2Fblob%2Fmaster%2Flib%2Fzstd%2Fdecompress_sources.h&data=05%7C02%7Cquentin.schulz%40cherry.de%7Cdde9821aaf3941a7103108de3f284ddd%7C5e0e1b5221b54e7b83bb514ec460677e%7C0%7C0%7C639017639505015023%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=hQFytbMb02p%2FbodM3WFBtQUNa9qABC8vPhMQ%2FrdL9E8%3D&reserved=0:
/* SPDX-License-Identifier: GPL-2.0+ OR BSD-3-Clause */
/*
* Copyright (c) Facebook, Inc.
* All rights reserved.
*
* This source code is licensed under both the BSD-style license
(found in the
* LICENSE file in the root directory of this source tree) and the
GPLv2 (found
* in the COPYING file in the root directory of this source tree).
* You may select, at your option, one of the above-listed licenses.
https://github.com/facebook/zstd/blob/v1.5.7/contrib/linux-kernel/
decompress_sources.h. It's specified as later in the SPDX-License-
Identifier.
Here it should be https://github.com/facebook/zstd/blob/v1.5.2/LICENSE
instead. But same remarks apply.
Cheers,
Quentin
