I live in the low-level guts of ARM and RISC-V platforms: firmware, TEEs, embedded Linux, and silicon bring-up, across Cortex-A, Cortex-M, and RISC-V.
I brought the Rockchip RK3576 up the entire stack myself: TF-A, OP-TEE, U-Boot, EDK2/UEFI, Linux device trees, NPU. Merged fixes in Trusted Firmware-A and OP-TEE (PR #7821), plus two IOMMU fixes and a devicetree series applied directly by the IOMMU and Rockchip SoC maintainers (the IOMMU pair is now in linux-next).
On the NPU I worked both stacks: the vendor runtime (RKNPU/RKLLM) running real LLMs and vision on a mainline kernel (Llama-3.2-1B ~13 tok/s, MobileNet ~169 fps), and the fully open rocket driver, where I reverse-engineered the compute registers to a byte-exact int8 convolution, then localized why chained layers stall to hardware below the driver under a falsification-first method (cross-confirmed on RK3568 and RK3588; preprint above). I also review other contributors' patches in that driver — caught a real bug in one, and got a Tested-by back on my own series from hardware I don't own.
I've also extended this isolation work across ISAs on the RP2350: SWD-verified TrustZone-M on its Cortex-M33, and a sibling PMP example on its Hazard3 RISC-V cores, same repo.
Works & Refs: evidence · kiln · edk2-rk3576 · bl32-rk3576 · linux-rk3576-npu · preprint (DOI) · vepu510-rk3576 · rp2350-tz-tee · SoC-Consistency · RKDevelopTool-GUI · OP-TEE #7821 · OP-TEE #7841 (pending) · TF-A #51089 · gahingwoo.github.io