Final-year high school student, but most of my real work happens upstream. I live in the low-level guts of ARM and RISC-V platforms: firmware, TEEs, embedded Linux, and silicon bring-up, across Cortex-A, Cortex-M, and RISC-V.
I brought the Rockchip RK3576 up the entire stack myself: TF-A, OP-TEE, U-Boot, EDK2/UEFI, Linux device trees, NPU. I landed a fix in Trusted Firmware-A (reviewed by Arm, ST and Rockchip engineers, merged to mainline) and shipped RK3576 platform support in OP-TEE (PR #7821).
On the NPU I worked both stacks. The vendor runtime (RKNPU/RKLLM) I got running real LLMs and vision on a mainline kernel (Llama-3.2-1B ~13 tok/s, Qwen2.5-1.5B ~9, MobileNet ~169 fps). On the fully open stack (mainline rocket driver) I reverse-engineered the undocumented compute registers, got a single int8 convolution byte-exact against a CPU reference, then localized why chained layers stall to fixed-function hardware below the driver under a falsification-first method (cross-confirmed on RK3568 and RK3588). Written up as a preprint (DOI above).
I've also extended this isolation work across ISAs on the RP2350: SWD-verified TrustZone-M on Cortex-M33 (proven by a caught SecureFault) and a sibling RISC-V PMP example on the Hazard3 cores.
Works & Refs: kiln · edk2-rk3576 · bl32-rk3576 · linux-rk3576-npu · preprint (DOI) · rp2350-tz-tee · SoC-Consistency · RKDevelopTool-GUI · OP-TEE #7821 · OP-TEE #7841 · TF-A #51089 · gahingwoo.github.io