Mindspeed is a seriously fucked up company in Newport Beach, California. It used to be part of Conexant, but has been spun off as a separate company. They are the current owners of the Brooktree HDSL chipset including the RS8973 bitpump chip, and they make and sell their M289xx ZipWirePlus chipset, which is a rather unrecognizable derivative of the former.

The problem with Mindspeed is that they are zealously hostile toward anything free or open source. They are not in the business of selling chips to anyone who would buy them, they are in the business of barring members of the free software and open source community from the world of telecommunications engineering, and they are perfectly happy to lose chip sales just so that they don't fall into the hands of open source Lightworkers.

Mindspeed has declared the good old RS8973 ZipWire bitpump obsolete, not recommended for new designs and other derogatory labels, and is touting their new ZipWirePlus chipset instead. Care to know why?

The new chipset's main advantage over the old is that it's closed source. Whereas in the old chipset (bitpump + channel unit) each chip had a datasheet clearly documenting its hardware structure and all control registers and the controlling software was provided (or at least intended to be provided, see below) in source code form, the new chipset is a black box. The main chip in the new chipset contains a built-in 8051 core, and the registers of all internal functional units (which do all the work) are accessible only to this core, not to an external microprocessor. The chip's only external control interface is a dual-port RAM mailbox through which an external microprocessor loads Mindspeed's firmware image and then sends commands to it. Closed source firmware for the 8051 core controls completely undocumented hardware in the chip which does all the work. You can read more about it here.

Our group's stand-off with Mindspeed took place when we had requested the software package for the RS8973 bitpump. The datasheet for the part was readily downloadable from their website and lo and behold, this datasheet says on the first page:

Startup and performance monitoring operations are controlled through the microprocessor interface. C-language source code supporting these operations is supplied under a no-fee license agreement from Conexant.

Interested in building SDSL connectivity devices, Harhan Engineering Co. had called Mindspeed and asked them for the advertised software package. I was directed to their support engineer Fred Mohajer. He told me that the RS8973 chip was old and recommended that I use their M28975 ZipWirePlus chipset instead. I responded that I couldn't evaluate whether or not their new chipset would be suitable for my design because there was no datasheet or any other real technical information about it on their website.

Fred told me that the datasheets were available under an NDA (non-disclosure agreement). I responded that I wasn't interested in their cutting edge secret product, the old RS8973 chip with an open public datasheet suited my needs just fine, and I simply needed its associated software package. Fred's response was something like the NDA is easy, don't worry, and I agreed to give it a try. After all, I didn't know anything about the new chipset he was pitching, and I was willing to give it an open-minded look. It was pitched as supporting both legacy SDSL and the new G.shdsl standard with a single hardware configuration, which certainly sounded attractive.

So I patiently went through the NDA process, dealt with Fred giving me attitude about me having a PO box address, and went through a song and dance to show the incompetent morons how to upload the files to me by FTP instead of E-mailing multiple megabytes through SMTP in base64 encoding. But finally I had the datasheets for the chipset that Mindspeed was pitching, and had a chance to see for myself what kind of beast it was. I've learned what the plus in ZipWirePlus is all about.

After reviewing the M289xx documentation and determining that it wasn't what I was looking for, I had politely told Mindspeed's Fred Mohajer that I wasn't interested in their new chipset and that I still needed the software package for RS8973. He said OK, no problem, I'll give you the materials for the old chip.

He gave me a file named bp44cu62.exe. The name stands for bitpump version 4.4, channel unit version 6.2, and it was a ZIP with a prepended DOS self-extractor. Using a real operating system, I checked its contents with Info-ZIP's zipinfo utility, and saw the list of C source files that I was looking for. I joyfully proceeded to unzip the file...

OOPS! All source files were encrypted, and only the compiled 8051 images and release notes could be extracted. I immediately E-mailed Fred and his boss Neel Patel whom he had been Cc'ing on his every E-mail to me, and asked for the decryption key for the source code. I pointed them to statements in their documents saying that source code in C was available.

After another two weeks of delay, Fred E-mailed me the following piece of shit:

 I have found out the 8973 bit pump is no longer recommended for new 
designs and I am not authorized to give the password, or provide any 
technical support  to  new customers.  As we mentioned before, it is a 
very old device . You may want to consider 8945+8927 chip set for your new 
project. 

Subsequent attempts to reason with Fred and Neel, to talk to other people at Mindspeed, and to work through their authorized representatives and distributors were equally fruitless. Mindspeed would not release the decryption key for the source code. One of their people had even told me almost directly that they weren't willing to give it to me because I was a member of the open source community! The only available resort was war.

Going to war

Work on the brute force cracking of Mindspeed's encrypted ZIP started immediately as soon as the encrypted ZIP was in our possession. The ZIP encryption algorithm was understood and a brute force ZIP cracker was written. Expecting to be up against a very large key space to cover, our cracker was specifically designed to keep track of covered key space and to support restart after interruption and division of key space among multiple crackers.

IFCTF's parent organisation Interplanetary Internationale was involved, and our Armed Forces of Light went into battle.

Victory

Finally 5 months of dedicated effort have paid off. On the full moon night of Messidor 22, SE 45 the encrypted ZIP was cracked, and on the following beautiful morning SDSL liberation campaign leader Space Falcon received a call from an II officer reporting the victory: our izipcrack program had reported tsedud7 as a possible match. Within an hour or so the source code was decrypted and extracted, then rezipped without encryption and posted on the IFCTF FTP site.

Long live freedom and open source!