BSP Tracker / BSP Status / Rockchip
Rockchip RK3588 / RK3588S
Mainline is now AHEAD of the vendor tree on security: you would trade a 6.1 BSP for a 6.12+ mainline. Ships on mainline for display, compute and AI-light products. Not for camera or video-recording products: hardware encode and the ISP are both BSP-only.
Mainline instead of the vendor BSP
Can you ship mainline instead, and what exactly do you lose if you do?
Mainline, with named losses
| Block | IP | Upstream | Detail |
|---|---|---|---|
| GPU | Mali-G610 MP4 (Valhall CSF) | upstream | drivers/gpu/drm/panthor; binding lists rockchip,rk3588-mali. Userspace is Mesa, not the Rockchip blob. |
| VPU decode | rkvdec + Hantro | upstream | H.264 and VP9 in rkvdec; AV1 via Hantro rockchip_vpu981. HEVC decode status unresolved. |
| VPU encode | RKVENC / VEPU | missing | There is no Rockchip encoder driver in mainline at all. |
| ISP | RK3588 ISP3 + VICAP | missing | The rockchip-isp1 binding lists px30, rk3399 and imx8mp. RK3588 is absent. |
| NPU | RKNN / RKNPU (6 TOPS) | upstream | drivers/accel/rocket names the RK3588 explicitly. BUT userspace is Mesa rocket, NOT Rockchip's RKNN SDK — existing RKNN pipelines will not run on it. |
Vendor BSP
Repository. https://github.com/rockchip-linux/kernel
Newest branch that actually exists. develop-6.1, tracking Linux 6.1. Last commit 2025-12-26.
Cadence. develop-6.6 EXISTS but its HEAD is ~10 months stale. The repo's DEFAULT branch is develop-6.1, which is fresher. The newest branch is not the maintained one.
Silicon longevity
The vendor publishes no commitment. Rockchip publishes NO availability commitment at all. Every 10-year claim you will find comes from a SoM vendor and covers the module, not the silicon.
Yocto
Layer. meta-rockchip. A branch for the current LTS exists: wrynose.
Hardware you can buy
Evaluate on. Radxa ROCK 5B, Firefly ITX-3588J, Forlinx OK3588-C
Production modules.
- FET3588-C SoM — Forlinx
- Core-3588J — Firefly
- Core-3588L (LGA) — Firefly
Notes
The 'Rockchip has no mainline' folklore is out of date. The commercial risk is the total absence of a silicon-longevity commitment, not the software.
What to do about it
Rockchip RK3588 / RK3588S: upstream fixes stop December 2027. That leaves 17 months. After that date the kernel this BSP is based on receives no further security fixes from upstream, and maintaining it becomes your team’s responsibility.
There are three options:
- Backport the fixes yourself. Your team maintains a kernel that nobody else maintains: tracking each CVE, applying the patch to a tree that has diverged from upstream, and testing the result, for as long as the product ships.
- Move to the vendor’s newer BSP. This gives you a few more years of upstream fixes, and it costs a second bring-up: a new kernel, your patches forward-ported, drivers re-validated, and the product re-tested.
- Move to mainline. Mainline supports part of this SoC. The blocks marked above are the ones a migration has to solve or replace. It is the only option that does not have to be repeated when the next vendor kernel reaches end of life.
All three are engineering work, and all three are work we do: reading vendor kernel trees, checking what mainline actually supports, and moving products from one to the other. This page is built from the same work.
Get the updates
An email when a kernel series reaches end of life, a board row changes, or a layer picks up a release branch. Nothing else.
RSS