OverviewAbout this program
This advanced program is for engineers who already build embedded Linux and now need to own the board support package end to end — the layer where new silicon, secure boot, build automation and field hardening actually come together. It picks up where image-building leaves off and goes down to the metal.
You port U-Boot to three very different targets — NXP i.MX8M (Cortex-A53), STM32MP1 (Cortex-A7 + TF-A) and RISC-V (OpenSBI + S-mode) — then build a complete chain of trust: root of trust in fuses, FIT image signing, secure-boot enforcement and dm-verity rootfs integrity. From there you stand up CI/CD for multi-machine Yocto builds, debug bring-up failures at the JTAG and early-boot level, and finish with production-grade security — MAC policy, mTLS, OTA and CVE/SBOM compliance.
The methodology is learn-by-doing against real boards and QEMU targets. Every module pairs a focused theory session with a mandatory lab, mirroring how a working BSP team operates. It is the deep, board-level companion to TECH VEDA’s Embedded Linux / Yocto program.
OutcomesWhat you'll be able to do
- ✓ Port U-Boot to a new board on i.MX8M, STM32MP1 and RISC-V — from defconfig and DTS to a working UART prompt.
- ✓ Stand up the SPL → TF-A/OpenSBI → U-Boot → kernel boot flow and tune DRAM, clocks and PMIC bring-up.
- ✓ Build an end-to-end secure boot chain — root of trust in fuses, FIT signing, and U-Boot signature enforcement.
- ✓ Protect the root filesystem with dm-verity and embed the root hash inside the signed boot image.
- ✓ Design CI/CD pipelines for multi-machine BSP builds with Jenkins, shared sstate, and automated boot-tests.
- ✓ Debug board bring-up at the lowest level — earlycon, JTAG/OpenOCD, and live kernel inspection over GDB.
- ✓ Diagnose storage and flash issues with blktrace, debugfs and MTD/UBI tooling.
- ✓ Threat-model an embedded device and harden the kernel attack surface for production.
- ✓ Confine services with SELinux/AppArmor and secure device communication with TLS/mTLS.
- ✓ Ship secure OTA updates with A/B partitions and signing, and run CVE / SBOM release compliance.
