bootloader

The EriX bootloader is a minimal, security-focused bootloader that currently targets UEFI on x86_64 and loads/verifies boot.img artifacts.

---

Goals

• load EriX boot.img v1 from the EFI System Partition
• verify signatures and section hashes before execution
• parse/load ELF64 kernel and early service sections
• load required boot-config section and include it in handoff modules
• map required non-executable blob sections into handoff module descriptors
• build/publish handoff data for kernel entry
• publish framebuffer continuity metadata when console-font is present
• support profile-gated early console sinks (bootloader-dev-console in dev profile)
• keep deterministic, fail-closed boot behavior
• maintain portability boundaries between core/platform/arch code

---

Non-goals

• multi-boot menu / boot manager UX
• support for non-EriX operating systems
• legacy BIOS/MBR boot path

---

Dependencies

• lib-bootimg for boot.img parsing/verification
• lib-elf for ELF64 parsing
• lib-handoff for handoff schema types

No external Rust crates are used.

---

Build and Test

make build-uefi
make build-kernel-stub
make package-esp

ERIX_RUN_QEMU_TESTS=1 cargo test --test qemu_integration

Integration harness behavior:

• runs bootloader.efi in qemu-system-x86_64 with OVMF
• emits ERIX_BOOTLOADER:* markers over serial in debug/test paths
• uses isa-debug-exit on 0xF4 for deterministic VM exit status

---

Repository Structure (Current)

bootloader/
├── Cargo.toml
├── Makefile
├── scripts/
│   ├── build-uefi.sh
│   ├── build-kernel-stub.sh
│   ├── package-esp.sh
│   ├── run-qemu-test.sh
│   └── run-qemu-negative-tests.sh
├── src/
│   ├── main.rs
│   ├── allocator.rs
│   ├── handoff_builder.rs
│   ├── memory_map.rs
│   ├── paging.rs
│   ├── test_support.rs
│   └── uefi.rs
├── tests/
│   ├── qemu_integration.rs
│   └── keys/
└── ROADMAP.md

---

Status

Implemented baseline:

• boot.img load/parse/verify path
• ELF extraction and load-plan path
• handoff build and kernel-transfer path in current harness profile
• non-executable blob module loading (including console-font)
• boot-config module loading (SectionType::BootConfig) and handoff inclusion
• GOP framebuffer mode capture + continuity metadata in handoff
• dev-profile early console rendering via lib-console with cursor/generation continuity export
• release-profile quiet early boot (no bootloader serial/framebuffer trace emission)
• QEMU smoke and negative integration suites

Remaining work is focused on contract freeze (kernel/rootd alignment), portability hardening, and expanded adversarial coverage.

---

License

ISC. See LICENSE.