eBootloader — Multi-Architecture Bootloader
10 Architectures · 24 Reference Boards · A/B Update Slots
A portable, secure, fail-safe bootloader for 24 boards across 10 architectures. Supports A/B update slots, measured boot, TPM 2.0, and a unified board-support package model.
How It Works
Step-by-step flow — from initialization to output.
ROM Bootstrap
The chip's immutable ROM code runs first. It reads the eBoot primary image from flash, verifies its Ed25519 signature against the public key burned into OTP, and jumps to eBoot if the signature is valid.
# ROM verifies eBoot signature against OTP public key # If valid: jump to eBoot primary slot # If invalid: enter recovery mode (USB/UART DFU)
eBoot Initializes Hardware
eBoot initializes the minimum hardware needed for boot: clocks, DRAM controller, watchdog, and the storage interface (eMMC/QSPI/SD). It then reads the firmware slot manifest to decide which slot (A or B) to boot.
// eBoot hardware init sequence eBoot_clocks_init(); // PLL, dividers eBoot_dram_init(); // DDR4/LPDDR4 training eBoot_storage_init(); // eMMC / QSPI eBoot_wdt_arm(30000); // 30 s watchdog
Verify Firmware Slot
eBoot reads the active firmware slot (A or B), verifies its ECDSA-256 signature, checks the anti-rollback counter in OTP, and optionally decrypts the payload with AES-256-GCM if the image is encrypted.
// Slot verification
if (eBoot_slot_verify(SLOT_A) == EBOOT_OK) {
eBoot_slot_boot(SLOT_A);
} else if (eBoot_slot_verify(SLOT_B) == EBOOT_OK) {
eBoot_slot_boot(SLOT_B);
} else {
eBoot_recovery_enter(); // Both slots invalid
}Hand Off to EoS Kernel
eBoot passes a boot descriptor (memory map, device tree, boot reason) to the EoS kernel entry point and jumps to it. The watchdog is armed — if EoS doesn't check in within 30 s, eBoot rolls back to the other slot.
// Hand-off structure
eBoot_descriptor_t desc = {
.dtb_addr = 0x80000000,
.boot_reason = EBOOT_REASON_NORMAL,
.slot = SLOT_A,
};
eBoot_jump_to_kernel(&desc);OTA Update Flow
When a new firmware image arrives (over HTTPS, MQTT, or USB), the application writes it to the inactive slot and marks it as pending. On next reboot, eBoot verifies and activates the new slot. If the new firmware fails to mark itself healthy, eBoot rolls back automatically.
// Application triggers OTA ota_download_to_slot(SLOT_B, url, &progress_cb); eBoot_slot_mark_pending(SLOT_B); eos_reboot(); // eBoot will verify + activate SLOT_B
Usage Examples
Real-world scenarios showing eBootloader in action.
A fleet of 10,000 industrial sensors receives a firmware update over MQTT with automatic rollback on failure.
// Application-side OTA trigger
#include <eboot/ota.h>
void ota_task(void *arg) {
// Download signed firmware to inactive slot
eboot_ota_result_t r = eboot_ota_download(
SLOT_B,
"https://updates.embeddedos.org/fw/v1.2.0.eos",
&verify_cb
);
if (r == EBOOT_OTA_OK) {
eboot_slot_mark_pending(SLOT_B);
eos_reboot(); // eBoot activates SLOT_B on next boot
}
}
// In EoS application — mark firmware healthy
void app_startup_check(void) {
if (eboot_slot_is_pending()) {
run_self_test();
eboot_slot_mark_healthy(); // Prevent rollback
}
}Features
The shape of eBootloader at a glance.
10 Architectures
ARMv7-M, ARMv8-A, RISC-V (RV32, RV64), x86_64, AArch64, MIPS, PowerPC, Xtensa, AVR.
24 Reference Boards
STM32, NXP i.MX, Raspberry Pi, BeagleBone, ESP32, RISC-V SiFive, NVIDIA Jetson, and more.
A/B Update Slots
Two firmware slots with automatic fallback if a new image fails to mark itself healthy.
Signed Images
Ed25519 / ECDSA signature verification rooted in immutable boot ROM.
Encrypted Updates
Optional AES-GCM payload encryption for over-the-air delivery.
Recovery Mode
Standalone recovery slot with USB / UART / TFTP firmware upload.
Fast Boot
Sub-second cold boot on Cortex-M, sub-3-second on Cortex-A SoCs.
Watchdog Hand-Off
Hard watchdog armed before kernel runs; rolls back if kernel doesn't check in.
Role in the EoS Ecosystem
Why eBootloader matters — and what breaks without it.
eBootloader is the first piece of EmbeddedOS software that runs on every device. It establishes the chain of trust that every other component depends on. Without a verified boot chain, an attacker could replace the EoS kernel or any application with malicious code. eBoot's A/B update slots make zero-downtime OTA updates possible across the entire EoS fleet — from 256 KB microcontrollers to 64-core edge servers. Every EoS device ships with eBoot; it is non-optional.
Depends On
Enables / Powers
Open source on GitHub
MIT licensed and developed in the open. Issues, discussions, and pull requests welcome.
In the EoS stack
eBootloader is highlighted in the layer below.
Pairs well with
Sibling components that eBootloader commonly works alongside.
Technical Specifications
| Signature Algorithm | ECDSA-256 (NIST P-256 curve) |
| Hash Algorithm | SHA-256 |
| Encryption | AES-256-GCM for encrypted firmware images |
| Anti-Rollback | Monotonic counter in OTP / eFuse; configurable policy |
| Update Protocol | OTA-ready; dual-bank A/B update with atomic swap |
| Debug Security | JTAG/SWD lock-out in production mode; debug unlock via signed token |
| Boot Time (Cortex-M) | < 500 ms cold boot to kernel handoff |
| Boot Time (Cortex-A) | < 3 s cold boot to kernel handoff |
| Supported Architectures | ARMv7-M, ARMv8-A/R, RISC-V RV32/RV64, x86_64, AArch64, MIPS, PowerPC, Xtensa, AVR |
| License | MIT |