Skip to content

Open Source

Violoop OS is built on free and open source software (FLOSS). The bootloader and the Linux kernel are licensed under the GNU General Public License, version 2 (GPL-2.0), and a large part of the userland (Debian 12) is under GPL-3.0 / LGPL-3.0 and other licenses.

This page tells you two things every owner is entitled to:

  1. Where to get the source for the GPL-2 bootloader and kernel.
  2. How to install your own modified versions of the GPL-3 software running on your device.

Baseline: Violoop OS on Rockchip RK3576, Debian 12 (arm64), BSP rk3576-VLA11/v0.1.4, Linux kernel 6.1.99. A full compliance notice (with the exact build commit of every component and a per-package license breakdown) also ships on the device at docs/OPEN-SOURCE-NOTICE.md, and the precise build SHAs are recorded in kernel/prebuilt/manifest.json.


Boot & Kernel source code (GPL-2.0)

The bootloader (U-Boot) and the Linux kernel are the two GPL-2 components at the heart of the system. Their complete corresponding source code, including every modification we made for the RK3576 platform, is published in public Git repositories, pinned to the exact commit used to build the shipped firmware:

ComponentLicenseSource repositoryBranchBuild commit
Linux kernel 6.1.99GPL-2.0https://github.com/BvioTech/kernelbsp/rk3576-VLA11d6d74b512b7fd8534fd8eed3f14d8cb919feb2bf
U-Boot (bootloader)GPL-2.0+https://github.com/BvioTech/u-bootbsp/rk3576-VLA11c0bec16b14a265e6abccf8244f8095ac17b26e97
AIC8800D40 Wi-Fi/BT driverGPL-2.0https://github.com/BvioTech/rkwifibtfeat/vla11-aic8800d40aab3ec6245e4e6df23b7aa68ed573eac86f669f5
Rockchip rkbin (blob sources)mixedhttps://github.com/BvioTech/rkbinbsp/rk3576-VLA11d8a9250436dfb90a2d1ff042e1d1b34cf3177816

Clone a repository and check out the matching commit to obtain the exact source used in this firmware:

sh
git clone https://github.com/BvioTech/kernel
cd kernel && git checkout d6d74b512b7fd8534fd8eed3f14d8cb919feb2bf

What we changed: the kernel carries an added touchscreen driver (sw42000_touchscreen), several device-tree (DTS) adaptations, and configuration changes (overlayfs / squashfs-zstd / board driver options); the AIC8800D40 wireless driver is a ported adaptation shipped as a .ko module. The PCIe host-side driver for the compute card, pcie-rkep (GPL-2.0 OR MIT), lives inside the kernel tree (drivers/misc/rockchip/pcie-rkep.c, CONFIG_PCIE_FUNC_RKEP=m) — checking out the kernel commit above gives you its complete corresponding source, nothing separate to fetch. U-Boot is built unmodified from the revision above. Each repository also ships the corresponding COPYING / LICENSE file; the GPL-2.0 text is at https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.

Compute-card runtime — proprietary prebuilt binaries

The compute card's userspace runtime and on-card firmware (librknn3_api*, rknn3_transfer_proxy, rknn-smi, pcie_upgrade_tool, rknn3_rk1820.img) are Rockchip's proprietary prebuilt binaries, redistributed under our vendor agreement. They come with no source code and carry no copyleft obligation; they are listed here only for completeness. This is distinct from the open pcie-rkep kernel driver above, whose source is fully published.

Boot logo — not covered by GPL-2

The logo shown on screen at power-on (the U-Boot splash logo.bmp and the kernel splash logo_kernel.bmp) is stored as a bitmap asset inside resource.img in the boot partition — packed alongside the kernel device tree, not compiled into the bootloader or kernel. These images are Violoop's own branding artwork: a proprietary asset, not part of the GPL-2.0 U-Boot or Linux source and not subject to its terms. Accordingly, the source-disclosure obligation above covers the bootloader and kernel code only; it does not extend to the logo artwork in resource.img.


Modifying the GPL-3 software on your device

The userland is Debian 12 (bookworm), which includes many components under GPL-3.0 and LGPL-3.0 (for example bash, coreutils, the GNU tools grep/sed/tar, and LGPL-3 libraries such as libgmp10 and libnettle8). GPL-3 grants you, as the owner of the device, the right to install and run your own modified versions of that software — the anti-tivoization guarantee in section 6 of the license.

Violoop OS honors that by handing root over to the owner: you enable SSH from the app, log in to the device as admin, and replace any GPL-3 / LGPL-3 component with sudo. This route is not limited by a path allowlist — whatever a root shell can change covers every component protected by that clause.

Step 1 — Build your modified version

On your own computer, fetch the source of the package you want to change, modify it, and build a binary for the device's architecture (arm64). On any arm64 Debian 12 machine (or by cross-compiling for arm64) you can get the exact source with apt-get source — or request it via the written offer below:

sh
# e.g. coreutils (GPL-3.0)
apt-get source coreutils

# ... make your changes in the unpacked source tree ...

cd coreutils-*/
dpkg-buildpackage -us -uc -b        # build the modified binaries (arm64)

This produces your modified binaries (for example bash from the bash source) or .deb packages.

Step 2 — Enable SSH and log in

  1. Enable SSH: turn on Remote Access in the device's app. The device opens inbound port 22 (the setting is persistent and is re-applied on every boot).

  2. Log in:

    sh
    ssh admin@<device-ip>

    The password is set by you, on first login: the factory placeholder password ships in an expired state, so the first login forces a password change — we do not hold your password and cannot log in on your behalf.

  3. Become root: admin is in the sudo group, so simply

    sh
    sudo -i

Password login for admin is always retained, at every security-hardening level the device offers — it is a channel reserved specifically for this clause and is never turned off by hardening.

Step 3 — Install your modified component

Copy the binary or .deb to the device and put it in place:

sh
# on your computer
scp bash admin@<device-ip>:/tmp/bash

# on the device (after sudo -i)
install -m 0755 /tmp/bash /bin/bash
# or install a package you built yourself
dpkg -i /tmp/bash_5.2-15_arm64.deb

The change takes effect immediately and persists across reboots.

Why it actually sticks

  • The root filesystem is deliberately not signature-verified. The boot chain (boot.img) is signed, but the root filesystem (squashfs) has no dm-verity / roothash — the verification chain ends at the initramfs. This is intentional: a modified userland has to keep running normally.
  • Writes land in the overlay's writable layer (the upper dir on the data partition), shadowing the same paths in the read-only base, which is why they survive a reboot.
  • Nothing degrades or refuses service because something was modified: the system does not check whether userland binaries have been replaced, and has no logic that changes behavior if they were.

Two things to know

  • A factory reset erases your modifications. Resetting is implemented by wiping the overlay's writable layer, so components you installed yourself disappear and the base returns to its factory state. This is an action you trigger yourself; it is not a block on modification.
  • This route does not depend on our authorization. The switch that opens SSH is an action you complete locally on the device — it is not conditioned on any permission from our servers, subscription status, or revocable credential.

Kernel note: the kernel and bootloader are GPL-2, which does not carry the anti-tivoization requirement, and production units use a verified (secure) boot chain. To run a modified kernel, rebuild from the kernel repository above; on secure-boot units a modified kernel image must be re-signed to boot. The GPL-3 anti-tivoization guarantee applies to the userland, which you install and run as shown above.


Debian userland source

The included Debian packages are unmodified. Their source is available per each package's license from the official Debian archive:


License texts

The component repositories and Debian packages also ship the corresponding COPYING / LICENSE / /usr/share/doc/<pkg>/copyright files.


Written offer

In addition to the public repositories above, for three (3) years from the date you received the product you may request the complete corresponding source code of the included GPL/LGPL components. We will provide it on physical media or via a download link for no more than the cost of media and shipping.

  • Email: [email protected]
  • Subject: Violoop OS source code request — version rk3576-VLA11/v0.1.4

This offer is valid to any third party in possession of a copy of the product, in accordance with GPL-2.0 section 3(b) and GPL-3.0 sections 6(b)/(c).