sprout: version 0.0.31 (#134)

Bumps the cargo-updates group with 1 update: [toml](https://github.com/toml-rs/toml).


Updates `toml` from 1.1.6+spec-1.1.0 to 1.1.8+spec-1.1.0
- [Commits](https://github.com/toml-rs/toml/compare/toml-v1.1.6...toml-v1.1.8)

---
updated-dependencies:
- dependency-name: toml
  dependency-version: 1.1.8+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-updates
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.claude/skills/update-config-docs/SKILL.md

@@ -0,0 +1,83 @@
+---
+name: update-config-docs
+description: Bring docs/config.md back in line with the code. Use after changing anything in crates/config, the command line options, loader.conf handling, strict mode, or autoconfiguration, or when asked to check that docs/config.md is accurate.
+---
+
+# Update docs/config.md
+
+`docs/config.md` is the reference for `sprout.toml`, the command line options, BLS support and strict mode.
+The README only links to it, so a setting that is missing from docs/config.md is undocumented.
+
+## 1. Find what changed
+
+Start from the diff, or from the whole config surface if there is none:
+
+```bash
+git diff main -- crates/config crates/boot/src/options.rs crates/boot/src/config crates/boot/src/autoconfigure crates/bls
+```
+
+The sources of truth, and the section of docs/config.md each one feeds:
+
+| Source                                                    | Section                                   |
+|-----------------------------------------------------------|-------------------------------------------|
+| `crates/config/src/lib.rs`                                | file at a glance, `options`               |
+| `crates/config/src/drivers.rs`                            | `drivers`                                 |
+| `crates/config/src/extractors*`                           | `extractors`                              |
+| `crates/config/src/actions*`                              | `actions`                                 |
+| `crates/config/src/entries.rs`                            | `entries`                                 |
+| `crates/config/src/generators*`                           | `generators`, `variants`, `exclude`       |
+| `crates/config/src/phases.rs`                             | `phases`                                  |
+| `crates/boot/src/options.rs`                              | command line options                      |
+| `crates/boot/src/main.rs`                                 | boot order, defaults, timeout and default entry order, strict mode |
+| `crates/boot/src/autoconfigure*`                          | autoconfiguration                         |
+| `crates/boot/src/generators/bls.rs`, `crates/bls`         | BLS values, boot counting, `loader.conf`  |
+
+## 2. Check each key
+
+For every struct field in `crates/config`, docs/config.md needs its TOML name (look at `#[serde(rename)]`, as
+most multi-word keys use dashes), its type, its default, and what it does. Read the code that uses it in
+`crates/boot`, not only the doc comment, because the behavior is what the reader depends on.
+
+Look for the usual drift:
+
+- a field added, renamed or removed
+- a default that changed (`#[serde(default = ...)]`, the `Default` impls, constants such as
+  `DEFAULT_MENU_TIMEOUT_SECONDS`)
+- a new BLS value set with `context.set`, or a new option in `SproutOptions`
+- a new row to add to, or remove from, the strict mode table
+- a changed order: the default entry sources, the menu timeout sources, or the phases
+- `LATEST_VERSION` changing, which the intro and `version` text must follow
+
+Don't document what you can't confirm in the code. If a behavior is unclear, read the function that
+implements it.
+
+## 3. Write the change
+
+- Keep each section's shape: a short explanation, a TOML example, then a table of keys.
+- Examples must parse. Check that every key in one exists and is spelled the way serde expects.
+- Update the table of contents if you add or rename a heading.
+- Keep README.md short. It gets the feature list and the minimal examples, and docs/config.md gets everything else.
+- Don't duplicate the strict mode table or the default entry order anywhere else.
+
+## 4. Write like a person
+
+Plain sentences, said once. Skip these:
+
+- filler like "robust", "seamless", "powerful", "leverage", "ensure", "note that", "it's important to"
+- groups of three added for rhythm, and a summary sentence at the end of every section
+- bullet lists for what a sentence says better, and bold used as decoration
+- em dashes (use a comma, colon or parentheses)
+
+Say what a setting does and what happens when it's unset or wrong. Name real things (`bootctl`, `PCR 12`,
+`\EFI\Linux`) instead of describing them.
+
+## 5. Verify
+
+```bash
+cargo build --target x86_64-unknown-uefi
+cargo build --target aarch64-unknown-uefi
+cargo fmt --all --check
+```
+
+Then re-read the diff of docs/config.md against the code once more for any key whose name or default you
+touched. If the change was only to docs, skip the builds.

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -3,8 +3,6 @@ description: File a bug report.
 title: "bug: "
 labels: ["bug", "triage"]
 type: bug
-assignees:
-- edera-dev/engineering
 body:
 - type: markdown
   attributes:

.github/ISSUE_TEMPLATE/feature-request.yml

@@ -3,8 +3,6 @@ description: Request a feature.
 title: "want: "
 labels: ["enhancement", "triage"]
 type: feature
-assignees:
-- edera-dev/engineering
 body:
 - type: markdown
   attributes:

.github/workflows/ci-actions.yml

@@ -1,17 +1,20 @@
 name: zizmor
 
 on:
-  push:
-    branches: ["main"]
   pull_request:
-    branches: ["**"]
+    branches:
+    - main
+  push:
+    branches:
+    - main
 
 permissions:
   contents: read # Needed to checkout the repository.
 
 concurrency:
-  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ github.sha }}"
-  cancel-in-progress: true
+  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"
+  # Only cancel superseded pull request runs, so every push to main is fully checked.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   zizmor:
@@ -23,17 +26,17 @@ jobs:
       actions: read # Needed to analyze action metadata.
     steps:
     - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
       with:
         egress-policy: audit
 
     - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
 
     - name: setup uv
-      uses: astral-sh/setup-uv@2ddd2b9cb38ad8efd50337e8ab201519a34c9f24 # v7.1.1
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
 
     - name: zizmor
       run: uvx zizmor --pedantic --format sarif . > results.sarif
@@ -41,7 +44,7 @@ jobs:
         GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
 
     - name: upload
-      uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
+      uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
       with:
         sarif_file: results.sarif
         category: zizmor

.github/workflows/ci-code.yml

@@ -12,8 +12,9 @@ permissions:
   contents: read # Needed to checkout the repository.
 
 concurrency:
-  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ github.sha }}"
-  cancel-in-progress: true
+  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"
+  # Only cancel superseded pull request runs, so every push to main is fully checked.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   rustfmt:
@@ -21,12 +22,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
       with:
         egress-policy: audit
 
     - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
 
@@ -51,12 +52,12 @@ jobs:
     name: 'build ${{ matrix.arch }}'
     steps:
     - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
       with:
         egress-policy: audit
 
     - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
 
@@ -80,12 +81,12 @@ jobs:
     name: 'clippy ${{ matrix.arch }}'
     steps:
     - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
       with:
         egress-policy: audit
 
     - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
 

.github/workflows/codeql.yml

@@ -1,10 +1,12 @@
 name: codeql
 
 on:
-  push:
-    branches: [ "main" ]
   pull_request:
-    branches: [ "main" ]
+    branches:
+    - main
+  push:
+    branches:
+    - main
   schedule:
   - cron: '33 16 * * 0'
 
@@ -12,8 +14,9 @@ permissions:
   contents: read # Needed to checkout the repository.
 
 concurrency:
-  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ github.sha }}"
-  cancel-in-progress: true
+  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"
+  # Only cancel superseded pull request runs, so every push to main is fully checked.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   analyze:
@@ -35,23 +38,23 @@ jobs:
           build-mode: none
     steps:
     - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
       with:
         egress-policy: audit
 
     - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
 
     - name: initialize codeql
-      uses: github/codeql-action/init@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
+      uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
         config-file: ./.github/codeql/codeql-config.yaml
 
     - name: perform codeql analysis
-      uses: github/codeql-action/analyze@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
+      uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/publish.yml

@@ -1,43 +1,37 @@
 name: publish
 
 on:
-  push:
-    branches:
-    - main
-
   pull_request:
     branches:
     - main
-    paths:
-    - bin/**
-    - src/**
-    - Cargo.*
-    - rust-toolchain.toml
-    - .github/workflows/publish.yaml
+  push:
+    branches:
+    - main
 
 permissions:
   contents: read # Needed to checkout the repository.
 
 concurrency:
-  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ github.sha }}"
-  cancel-in-progress: true
+  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"
+  # Only cancel superseded pull request runs, so every push to main is fully checked.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   artifacts:
     name: artifacts
     permissions:
-      contents: write # Needed to upload artifacts.
-      id-token: write # Needed for attestation.
-      attestations: write # Needed for attestations.
+      contents: read # Needed to checkout the repository.
     runs-on: ubuntu-latest
+    outputs:
+      artifact-digest: "${{ steps.upload.outputs.artifact-digest }}"
     steps:
     - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
       with:
         egress-policy: audit
 
     - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
 
@@ -48,28 +42,31 @@ jobs:
     - name: 'assemble artifacts'
       run: ./hack/assemble.sh
 
-    - name: 'upload sprout-x86_64.efi.zip artifact'
-      id: upload-sprout-x86_64-efi
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+    - name: 'upload artifacts'
+      id: upload
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
-        name: sprout-x86_64.efi.zip
-        path: target/assemble/sprout-x86_64.efi
+        name: artifacts
+        path: target/assemble/*
 
-    - name: 'upload sprout-aarch64.efi.zip artifact'
-      id: upload-sprout-aarch64-efi
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+  # Attestation runs in its own job so that pull requests, which run the build with
+  # code from the pull request, never get the permissions needed to attest.
+  attest:
+    name: attest
+    needs: artifacts
+    if: github.event_name != 'pull_request'
+    permissions:
+      id-token: write # Needed for attestation.
+      attestations: write # Needed for attestations.
+    runs-on: ubuntu-latest
+    steps:
+    - name: harden runner
+      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
       with:
-        name: sprout-aarch64.efi.zip
-        path: target/assemble/sprout-aarch64.efi
+        egress-policy: audit
 
-    - name: 'attest sprout-x86_64.efi.zip artifact'
-      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+    - name: 'attest artifacts'
+      uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
       with:
-        subject-name: sprout-x86_64.efi.zip
-        subject-digest: "sha256:${{ steps.upload-sprout-x86_64-efi.outputs.artifact-digest }}"
-
-    - name: 'attest sprout-aarch64.efi.zip artifact'
-      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
-      with:
-        subject-name: sprout-aarch64.efi.zip
-        subject-digest: "sha256:${{ steps.upload-sprout-aarch64-efi.outputs.artifact-digest }}"
+        subject-name: artifacts.zip
+        subject-digest: "sha256:${{ needs.artifacts.outputs.artifact-digest }}"

.github/workflows/release.yml

@@ -13,7 +13,8 @@ permissions:
 
 concurrency:
   group: "${{ github.workflow }}-${{ github.event.inputs.release-tag }}"
-  cancel-in-progress: true
+  # Let a running release finish, so its assets are never left partially uploaded.
+  cancel-in-progress: false
 
 jobs:
   release:
@@ -25,38 +26,38 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: harden runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
       with:
         egress-policy: audit
 
     - name: checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
+        # Build the tagged commit, not whichever ref the workflow was dispatched on.
+        ref: "refs/tags/${{ github.event.inputs.release-tag }}"
         persist-credentials: false
 
     - name: 'install rust toolchain'
       run: |
         cargo version
 
-    - name: 'assemble artifacts'
+    - name: 'assemble release artifacts'
       run: ./hack/assemble.sh
 
-    - name: 'attest sprout-x86_64.efi artifact'
-      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+    - name: 'attest release artifacts'
+      uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
       with:
-        subject-path: target/assemble/sprout-x86_64.efi
-
-    - name: 'attest sprout-aarch64.efi artifact'
-      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
-      with:
-        subject-path: target/assemble/sprout-aarch64.efi
+        subject-path: target/assemble/*
 
     - name: 'generate cultivator token'
-      uses: actions/create-github-app-token@bf559f85448f9380bcfa2899dbdc01eb5b37be3a # v3.0.0-beta.2
+      uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
       id: generate-token
       with:
         app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
         private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
+        # Scope to what uploading assets and `gh release edit` need: write to
+        # release contents.
+        permission-contents: write
       if: ${{ github.event.inputs.release-tag != '' }}
 
     - name: 'upload release artifacts'

AGENTS.md

@@ -0,0 +1 @@
+CLAUDE.md

CLAUDE.md

@@ -0,0 +1,58 @@
+# Sprout
+
+Sprout is a programmable UEFI bootloader written in Rust, for `x86_64` and `aarch64`. It is a `no_std` workspace
+built for the `*-unknown-uefi` targets, so it cannot be run or tested like a normal binary.
+See [README.md](README.md) for features and [docs/config.md](docs/config.md) for the configuration format.
+After changing configuration, run the `update-config-docs` skill to keep docs/config.md accurate.
+
+## Layout
+
+- `crates/boot`: the bootloader entrypoint (`edera-sprout-boot`).
+- `crates/bls`: Boot Loader Specification parsing and sorting.
+- `crates/build`: build logic.
+- `crates/config`: serialization structures for the Sprout configuration file.
+- `crates/eficore`: core EFI helpers.
+- `crates/parsing`: value stamping and other parsing helpers.
+- `hack/`: build and dev scripts; `hack/dev` boots QEMU, `hack/dev/run` drives it headless.
+- `docs/setup`: setup guides for signed and unsigned installs.
+
+The crate list and the scripts are described in [DEVELOPMENT.md](DEVELOPMENT.md).
+
+## Building and checking
+
+The toolchain and both UEFI targets are pinned in `rust-toolchain.toml`. Always pass a UEFI target, as the
+host target will not build.
+
+```bash
+cargo build --target x86_64-unknown-uefi
+cargo clippy --target x86_64-unknown-uefi
+cargo fmt --all
+./hack/assemble.sh
+```
+
+CI runs `cargo fmt --check`, `cargo build` and `cargo clippy` for both targets, so run these for both
+`x86_64` and `aarch64` before opening a PR. `./hack/autofix.sh` applies clippy and rustfmt fixes.
+
+To try a change in a real environment, use `./hack/dev/boot.sh [arch]`, or the scripts in `hack/dev/run`
+(for example `smoke.sh`) when there is no terminal or window to use.
+
+## Conventions
+
+- Write code that matches the surrounding code, including naming, idioms and comment style.
+- Dependencies are declared in the root `Cargo.toml` under `[workspace.dependencies]`.
+- GitHub Actions are pinned to a commit SHA with the version in a comment.
+
+## Commits and pull requests
+
+- Do not add coding agent attribution anywhere. No `Co-Authored-By` trailers, no "Generated with" lines, in
+  commits or in PR descriptions.
+- Commits use [Conventional Commits](https://www.conventionalcommits.org/), in the form `type(scope): subject`,
+  for example `fix(boot): count tries without using them`. Types in use are `feat`, `fix` and `docs`, and
+  scopes are usually a crate name such as `boot`, `bls` or `eficore`, or `ci`, `hack` and `readme`.
+- PR titles are also conventional commits, because PRs are squashed. The only exception is a release PR,
+  which is titled `sprout: version x.y.z`.
+- Keep PR descriptions short prose.
+
+## Releasing
+
+See [RELEASING.md](RELEASING.md). A release PR only bumps the version in `Cargo.toml` and `Cargo.lock`.

CONTRIBUTING.md

@@ -21,7 +21,7 @@ We encourage opening an issue on GitHub to report bugs.
 
 1. For anything more than simple bug/doc fixes, please open a GitHub issue for tracking purposes.
 2. Discuss the change with the teams to ensure we have consensus on the change being welcome.
-3. We encourage opening the PR sooner than later, and prefixing with `WIP:` so GitHub labels it as a Draft.
+3. We encourage opening the PR sooner than later, as a draft pull request.
 4. Please include a detailed list of changes that the PR makes.
 5. Once the PR is ready for review, remove the Draft status, and request a review from `edera-dev/engineering`.
 6. After the review cycle concludes, and we know you are ready for merging, a team member will submit the PR to the merge queue.

Cargo.lock

@@ -3,10 +3,16 @@
 version = 4
 
 [[package]]
-name = "anyhow"
-version = "1.0.100"
+name = "adler2"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "bit_field"
@@ -16,97 +22,142 @@ checksum = "1e4b40c7323adcfc0a41c4b88143ed58346ff65a288fc144329c5c45e05d70c6"
 
 [[package]]
 name = "bitflags"
-version = "2.10.0"
+version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 
 [[package]]
 name = "block-buffer"
-version = "0.10.4"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
 dependencies = [
- "generic-array",
+ "hybrid-array",
 ]
 
 [[package]]
 name = "cfg-if"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.17"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
 dependencies = [
  "libc",
 ]
 
 [[package]]
-name = "crypto-common"
-version = "0.1.6"
+name = "crc32fast"
+version = "1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
 dependencies = [
- "generic-array",
- "typenum",
+ "cfg-if",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "hybrid-array",
 ]
 
 [[package]]
 name = "digest"
-version = "0.10.7"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
  "block-buffer",
  "crypto-common",
 ]
 
 [[package]]
-name = "edera-sprout"
-version = "0.0.19"
+name = "edera-sprout-bls"
+version = "0.0.31"
 dependencies = [
  "anyhow",
- "bitflags",
+]
+
+[[package]]
+name = "edera-sprout-boot"
+version = "0.0.31"
+dependencies = [
+ "anyhow",
+ "edera-sprout-bls",
+ "edera-sprout-build",
  "edera-sprout-config",
+ "edera-sprout-eficore",
+ "edera-sprout-parsing",
  "hex",
+ "jaarg",
  "log",
+ "serde_ignored",
  "sha2",
  "toml",
  "uefi",
  "uefi-raw",
 ]
 
+[[package]]
+name = "edera-sprout-build"
+version = "0.0.31"
+dependencies = [
+ "png",
+]
+
 [[package]]
 name = "edera-sprout-config"
-version = "0.0.19"
+version = "0.0.31"
 dependencies = [
  "serde",
 ]
 
 [[package]]
-name = "equivalent"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
-
-[[package]]
-name = "generic-array"
-version = "0.14.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2"
+name = "edera-sprout-eficore"
+version = "0.0.31"
 dependencies = [
- "typenum",
- "version_check",
+ "anyhow",
+ "bitflags",
+ "log",
+ "spin",
+ "uefi",
+ "uefi-raw",
 ]
 
 [[package]]
-name = "hashbrown"
-version = "0.16.0"
+name = "edera-sprout-parsing"
+version = "0.0.31"
+dependencies = [
+ "hex",
+ "sha2",
+]
+
+[[package]]
+name = "fdeflate"
+version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5419bdc4f6a9207fbeba6d11b604d481addf78ecd10c11ad51e76c2f6482748d"
+checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
+dependencies = [
+ "simd-adler32",
+]
+
+[[package]]
+name = "flate2"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide 0.9.1",
+ "zlib-rs",
+]
 
 [[package]]
 name = "hex"
@@ -115,50 +166,97 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
-name = "indexmap"
-version = "2.12.0"
+name = "hybrid-array"
+version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6717a8d2a5a929a1a2eb43a12812498ed141a0bcfb7e8f7844fbdbe4303bba9f"
+checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
 dependencies = [
- "equivalent",
- "hashbrown",
+ "typenum",
 ]
 
 [[package]]
-name = "libc"
-version = "0.2.177"
+name = "jaarg"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
+checksum = "534d589df1ef528a238f4bc4b1db081a1280f3aedf2695fd8971e9853a7fa4f6"
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
 
 [[package]]
 name = "log"
-version = "0.4.28"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "png"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
+dependencies = [
+ "bitflags",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide 0.8.9",
+]
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.103"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "ptr_meta"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b9a0cf95a1196af61d4f1cbdab967179516d9a4a4312af1f31948f8f6224a79"
+checksum = "743da816b98c921cdbe8628ef7381b76f25ecf4da599fc80aca90eae7ef70cc0"
 dependencies = [
  "ptr_meta_derive",
 ]
 
 [[package]]
 name = "ptr_meta_derive"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7347867d0a7e1208d93b46767be83e2b8f978c3dad35f775ac8d8847551d6fe1"
+checksum = "1c8d9ca532f185d5d4db7a7c9d51420b452168ea1c2b913953281bd6fe1fcbd0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -167,18 +265,24 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.41"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce25767e7b499d1b604768e7cde645d14cc8584231ea6b295e9c9eb22c02e1d1"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
  "proc-macro2",
 ]
 
 [[package]]
-name = "serde"
-version = "1.0.228"
+name = "scopeguard"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
 dependencies = [
  "serde_core",
  "serde_derive",
@@ -186,18 +290,18 @@ dependencies = [
 
 [[package]]
 name = "serde_core"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -205,19 +309,29 @@ dependencies = [
 ]
 
 [[package]]
-name = "serde_spanned"
-version = "1.0.3"
+name = "serde_ignored"
+version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e24345aa0fe688594e73770a5f6d1b216508b4f93484c0026d521acd30134392"
+checksum = "115dffd5f3853e06e746965a20dcbae6ee747ae30b543d91b0e089668bb07798"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c"
 dependencies = [
  "serde_core",
 ]
 
 [[package]]
 name = "sha2"
-version = "0.10.9"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
 dependencies = [
  "cfg-if",
  "cpufeatures",
@@ -225,10 +339,25 @@ dependencies = [
 ]
 
 [[package]]
-name = "syn"
-version = "2.0.108"
+name = "simd-adler32"
+version = "0.3.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da58917d35242480a05c2897064da0a80589a2a0476c9a3f2fdc83b53502e917"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
+
+[[package]]
+name = "spin"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0134f9043ed38b087ac4f7d4af44c79e2c9e5094421fe3164f435ce585953b10"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -237,48 +366,40 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.9.8"
+version = "1.1.8+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0dc8b1fb61449e27716ec0e1bdf0f6b8f3e8f6b05391e8497b8b6d7804ea6d8"
+checksum = "20489e00e4d8741d6be680764cc12e270655e375a20d1011e844a9c3379e678d"
 dependencies = [
- "indexmap",
  "serde_core",
  "serde_spanned",
  "toml_datetime",
  "toml_parser",
- "toml_writer",
  "winnow",
 ]
 
 [[package]]
 name = "toml_datetime"
-version = "0.7.3"
+version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2cdb639ebbc97961c51720f858597f7f24c4fc295327923af55b74c3c724533"
+checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
 dependencies = [
  "serde_core",
 ]
 
 [[package]]
 name = "toml_parser"
-version = "1.0.4"
+version = "1.1.5+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0cbe268d35bdb4bb5a56a2de88d0ad0eb70af5384a99d648cd4b3d04039800e"
+checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
 dependencies = [
  "winnow",
 ]
 
-[[package]]
-name = "toml_writer"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df8b2b54733674ad286d16267dcfc7a71ed5c776e4ac7aa3c3e2561f7c637bf2"
-
 [[package]]
 name = "typenum"
-version = "1.19.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
 [[package]]
 name = "ucs2"
@@ -291,9 +412,9 @@ dependencies = [
 
 [[package]]
 name = "uefi"
-version = "0.36.0"
+version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f123e69767fc287c44d70ee19af3b39d1bfb735dbaff5090e95b5b13cd656d16"
+checksum = "368cef7d94514897e6dad4350945c7910a9f5bf9021191d1c58ee3ec09962697"
 dependencies = [
  "bitflags",
  "cfg-if",
@@ -307,9 +428,9 @@ dependencies = [
 
 [[package]]
 name = "uefi-macros"
-version = "0.19.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4687412b5ac74d245d5bfb1733ede50c31be19bf8a4b6a967a29b451bab49e67"
+checksum = "643efa8b64be89780bc498b290fab04337c7c4d171cc82cce2e133a74616dcc4"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -318,9 +439,9 @@ dependencies = [
 
 [[package]]
 name = "uefi-raw"
-version = "0.12.0"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8aff2f4f2b556a36a201d335a1e0a57754967a96857b1f47a52d5a23825cac84"
+checksum = "3636327a6d88a38c0f2567fb695ec7ba27b3483d1877730486605aa0866da201"
 dependencies = [
  "bitflags",
  "uguid",
@@ -334,18 +455,18 @@ checksum = "0c8352f8c05e47892e7eaf13b34abd76a7f4aeaf817b716e88789381927f199c"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.22"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
-
-[[package]]
-name = "version_check"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
 
 [[package]]
 name = "winnow"
-version = "0.7.13"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21a0236b59786fed61e2a80582dd500fe61f18b5dca67a4a067d0bc9039339cf"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
+
+[[package]]
+name = "zlib-rs"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112"

Cargo.toml

@@ -1,27 +1,64 @@
 [workspace]
 members = [
+  "crates/boot",
+  "crates/build",
   "crates/config",
-  "crates/sprout",
+  "crates/eficore",
+  "crates/bls",
+  "crates/parsing",
 ]
 resolver = "3"
 
 [workspace.package]
 license = "Apache-2.0"
-version = "0.0.19"
+version = "0.0.31"
 homepage = "https://sprout.edera.dev"
 repository = "https://github.com/edera-dev/sprout"
 edition = "2024"
 
 [workspace.dependencies]
-anyhow = "1.0.100"
-bitflags = "2.10.0"
-hex = "0.4.3"
-log = "0.4.28"
-serde = "1.0.228"
-sha2 = "0.10.9"
-toml = "0.9.8"
-uefi = "0.36.0"
-uefi-raw = "0.12.0"
+bitflags = "2.13.2"
+log = "0.4.34"
+png = "0.18.1"
+spin = "0.12.3"
+uefi-raw = "0.17.0"
+
+[workspace.dependencies.anyhow]
+version = "1.0.104"
+default-features = false
+
+[workspace.dependencies.hex]
+version = "0.4.3"
+default-features = false
+features = ["alloc"]
+
+[workspace.dependencies.jaarg]
+version = "0.2.2"
+default-features = false
+features = ["alloc"]
+
+[workspace.dependencies.serde]
+version = "1.0.229"
+default-features = false
+features = ["alloc", "derive"]
+
+[workspace.dependencies.serde_ignored]
+version = "0.1.14"
+default-features = false
+
+[workspace.dependencies.sha2]
+version = "0.11.0"
+default-features = false
+
+[workspace.dependencies.toml]
+version = "1.1.6"
+default-features = false
+features = ["serde", "parse"]
+
+[workspace.dependencies.uefi]
+version = "0.41.0"
+default-features = false
+features = ["alloc", "global_allocator", "panic_handler"]
 
 # Common build profiles
 # NOTE: We have to compile everything for opt-level = 2 due to optimization passes

DEVELOPMENT.md

@@ -5,16 +5,25 @@ This guide is a work in progress.
 ## Development Setup
 
 You can use any Rust development environment to develop Sprout.
-
 Rustup is recommended as the Rust toolchain manager to manage Rust versions and targets.
-
-Sprout currently requires Rust nightly to support uefi_std. See [uefi_std](https://doc.rust-lang.org/beta/rustc/platform-support/unknown-uefi.html) for more details.
-
 We currently only support `x86_64-unknown-uefi` and `aarch64-unknown-uefi` targets.
 
 To test your changes in QEMU, please run `./hack/dev/boot.sh`, you can specify `x86_64` or `aarch64`
 as an argument to boot.sh to boot the specified architecture.
 
+## Crate Structure
+
+Sprout is split into multiple crates:
+
+- `edera-sprout-boot` at `crates/boot`: Bootloader entrypoint for Sprout.
+- `edera-sprout-bls` at `crates/bls`: Parsing and sorting of Boot Loader Specification entries.
+- `edera-sprout-build` at `crates/build`: Build logic for Sprout.
+- `edera-sprout-config` at `crates/config`: Serialization structures for the Sprout configuration file.
+- `edera-sprout-eficore` at `crates/eficore`: Core library for Sprout EFI code.
+- `edera-sprout-parsing` at `crates/parsing`: Value stamping and other parsing helpers for Sprout.
+
+It is intended that overtime Sprout will be split into even more crates.
+
 ## Hack Scripts
 
 You can use the `./hack` scripts to run common development tasks:
@@ -49,3 +58,23 @@ Build Sprout as OCI images using Docker, including a kernel, initramfs, xen, and
 
 Boot Sprout's dev environment using QEMU for testing. This will let you test your changes in a real environment booting
 Alpine Linux with an initramfs.
+
+### ./hack/dev/run
+
+Scripts to drive the dev environment without a terminal or a window, which suits automation and
+coding agents. QEMU runs in the background with a QMP socket, and its consoles are written to
+`target/run/<arch>/`. Only one run per architecture at a time, and the scripts need `python3` or `socat`.
+
+- `start.sh [arch]`: Builds and starts QEMU headless. `SPROUT_CONFIG_NAME` defaults to `graphical`.
+- `screenshot.sh [out.png]`: Saves a PNG of the display (QEMU 7.1 or newer) and prints the path.
+- `key.sh <qcode>...`: Presses keys such as `down`, `up`, `ret` or `ctrl+alt+delete`.
+- `wait-serial.sh <regex> [seconds]`: Waits for text on the firmware or Linux console.
+- `qmp.sh <json>...`: Sends raw QMP commands.
+- `status.sh` and `stop.sh`: Show the state of QEMU, and stop it.
+- `smoke.sh [arch]`: Starts, drives the graphical menu, waits for the Linux shell and stops.
+
+`boot.sh` supports this with `QEMU_HEADLESS`, `QEMU_QMP`, `QEMU_SERIAL_FILE`, `QEMU_CONSOLE_FILE` and `QEMU_EXTRA_ARGS`.
+
+## Releasing
+
+Maintainers cut releases as described in [RELEASING.md](RELEASING.md).

Dockerfile

@@ -1,8 +1,7 @@
-# syntax=docker/dockerfile:1.7-labs
 ARG RUST_PROFILE=release
 ARG RUST_TARGET_SUBDIR=release
 
-FROM --platform=$BUILDPLATFORM rustlang/rust:nightly-alpine@sha256:34532121803db17008af0cdc4e2e1210466cb257cc9d3840dac42d706640fee5 AS build
+FROM --platform=$BUILDPLATFORM rust:1.99.1-alpine@sha256:557a94c82b485a14b569120e00867267108c734efe33f10cc31ca0cd5dd1eca9 AS build
 RUN apk --no-cache add musl-dev busybox-static
 ARG RUST_PROFILE
 RUN adduser -S -s /bin/sh build

README.md

@@ -47,8 +47,10 @@ We recommend running Sprout without Secure Boot for development, and with Secure
 
 | Operating System | Secure Boot Enabled | Link                                                  |
 |------------------|---------------------|-------------------------------------------------------|
-| Ubuntu           | ✅                   | [Setup Guide](./docs/setup/signed/ubuntu.md)          |
+| Fedora           | ✅                   | [Setup Guide](./docs/setup/signed/fedora.md)          |
 | Debian           | ✅                   | [Setup Guide](./docs/setup/signed/debian.md)          |
+| Ubuntu           | ✅                   | [Setup Guide](./docs/setup/signed/ubuntu.md)          |
+| openSUSE         | ✅                   | [Setup Guide](./docs/setup/signed/opensuse.md)        |
 | Fedora           | ❌                   | [Setup Guide](./docs/setup/unsigned/fedora.md)        |
 | Alpine Edge      | ❌                   | [Setup Guide](./docs/setup/unsigned/alpine-edge.md)   |
 | Generic Linux    | ❌                   | [Setup Guide](./docs/setup/unsigned/generic-linux.md) |
@@ -56,6 +58,7 @@ We recommend running Sprout without Secure Boot for development, and with Secure
 
 ### Project Documentation
 
+- [Configuration Reference]
 - [Development Guide]
 - [Contributing Guide]
 - [Sprout License]
@@ -67,23 +70,31 @@ We recommend running Sprout without Secure Boot for development, and with Secure
 ### Current
 
 - [x] Loadable driver support
-- [x] Basic [Bootloader specification (BLS)](https://uapi-group.org/specifications/specs/boot_loader_specification/) support
+- [x] [Bootloader specification (BLS)](https://uapi-group.org/specifications/specs/boot_loader_specification/) support:
+  Type #1 entries, Type #2 unified kernel images, and the extended boot loader partition
+- [x] [UKI support](https://github.com/edera-dev/sprout/issues/6): including images with multiple profiles
+- [x] Boot counting, so `systemd-bless-boot` can assess a boot
+- [x] `loader.conf` support
 - [x] Chainload support
 - [x] Linux boot support via EFI stub
 - [x] Windows boot support via chainload
 - [x] Load Linux initrd from disk
-- [x] Basic boot menu
+- [x] Devicetree support
+- [x] Basic, simple, and graphical boot menus
+- [x] A strict mode that follows the BLS specification and systemd-boot exactly
+- [x] Generators for BLS entries, lists, and matrices, with variants
 - [x] BLS autoconfiguration support
-- [x] [Secure Boot support](https://github.com/edera-dev/sprout/issues/20): beta
-- [x] [Bootloader interface support](https://github.com/edera-dev/sprout/issues/21): beta
-- [x] [BLS specification conformance](https://github.com/edera-dev/sprout/issues/2): beta
+- [x] [Secure Boot support](https://github.com/edera-dev/sprout/issues/20)
+- [x] [Bootloader interface support](https://github.com/edera-dev/sprout/issues/21)
+- [x] [BLS specification conformance](https://github.com/edera-dev/sprout/issues/2)
 
 ### Roadmap
 
 - [ ] [Full-featured boot menu](https://github.com/edera-dev/sprout/issues/1)
-- [ ] [UKI support](https://github.com/edera-dev/sprout/issues/6): partial
+- [ ] Network boot of unified kernel images (`uki-url`) and devicetree overlays
+- [ ] A random seed for the Linux kernel
 - [ ] [multiboot2 support](https://github.com/edera-dev/sprout/issues/7)
-- [ ] [Linux boot protocol (boot without EFI stub)](https://github.com/edera-dev/sprout/issues/7)
+- [ ] [Linux boot protocol (boot without EFI stub)](https://github.com/edera-dev/sprout/issues/8)
 
 ## Concepts
 
@@ -100,27 +111,9 @@ We recommend running Sprout without Secure Boot for development, and with Secure
 
 Sprout is provided as a single EFI binary called `sprout.efi`.
 It can be chainloaded from GRUB or other UEFI bootloaders or booted into directly.
-Sprout will look for \sprout.toml in the root of the EFI partition it was loaded from.
-See [Configuration](#configuration) for how to configure sprout.
+Sprout reads its configuration from `\sprout.toml` in the root of the EFI partition it was loaded from.
 
-## Configuration
-
-Sprout is configured using a TOML file at `\sprout.toml` on the root of the EFI partition sprout was booted from.
-
-### Command Line Options
-
-Sprout supports some command line options that can be combined to modify behavior without the configuration file.
-
-```bash
-# Boot Sprout with a specific configuration file.
-$ sprout.efi --config=\path\to\config.toml
-# Boot a specific entry, bypassing the menu.
-$ sprout.efi --boot="Boot Xen"
-# Autoconfigure Sprout, without loading a configuration file.
-$ sprout.efi --autoconfigure
-```
-
-### Boot Linux from ESP
+This is a configuration that boots a Linux kernel from the EFI partition:
 
 ```toml
 # sprout configuration: version 1
@@ -142,24 +135,24 @@ chainload.options = ["root=/dev/sda1"]
 chainload.linux-initrd = "\\initrd"
 ```
 
-### Bootloader Specification (BLS) Support
+On a system that follows the Boot Loader Specification, you may not need to write one. With an ext4 driver
+loaded, autoconfiguration finds the entries on its own:
 
 ```toml
-# sprout configuration: version 1
 version = 1
 
-# load an EFI driver for ext4.
 [drivers.ext4]
 path = "\\sprout\\drivers\\ext4.efi"
 
-# global options.
 [options]
-# enable autoconfiguration by detecting bls enabled
-# filesystems and generating boot entries for them.
 autoconfigure = true
 ```
 
+The full list of settings, the command line options, generators, and how Sprout treats BLS entries,
+`loader.conf` and strict mode are in [the configuration reference](./docs/config.md).
+
 [Edera]: https://edera.dev
+[Configuration Reference]: ./docs/config.md
 [Development Guide]: ./DEVELOPMENT.md
 [Contributing Guide]: ./CONTRIBUTING.md
 [Sprout License]: ./LICENSE

RELEASING.md

@@ -0,0 +1,36 @@
+# Releasing Sprout
+
+This describes how a maintainer cuts a release of Sprout. A release is a signed tag plus a GitHub release
+that holds the built EFI binaries and their attestations.
+
+The release is built and published by the `release` workflow, so the release is never visible
+until its artifacts are attached.
+
+## Steps
+
+1. Bump `version` in the `[workspace.package]` section of `Cargo.toml` to the new version, then run
+   `./hack/assemble.sh` to update `Cargo.lock`.
+
+2. Open a pull request with the result. The commit and the PR title are `sprout: version x.y.z`, which is the
+   one place we do not use a conventional commit. Once squashed, the commit on `main` is
+   `sprout: version x.y.z (#PR_NUMBER)`.
+
+3. Once the PR has merged, create a signed tag on the merged commit. The tag message is just the tag name.
+
+   ```bash
+   git tag -s v0.0.8 -m v0.0.8
+   git push origin v0.0.8
+   ```
+
+4. Draft a new release on GitHub for that tag, named after the tag, and click Generate Release Notes.
+   Add a blank line after every section header, as GitHub does not always do that. **Do not click Publish.**
+
+5. Run the `release` workflow from the Actions tab, selecting the tag as the ref to run from, and set the
+   `Release Tag` input to the tag name (for example `v0.0.8`). The workflow builds the tagged commit,
+   uploads the binaries to the draft release, attests them, and then publishes the release.
+
+## Notes
+
+- The release workflow builds the tag, not the branch it was dispatched on, so check the tag points at the
+  version bump commit before running it.
+- Re-running the workflow for the same tag replaces the uploaded assets, and runs for one tag never overlap.

crates/bls/Cargo.toml

@@ -0,0 +1,18 @@
+# This crate explicitly does not have uefi/uefi-raw dependencies,
+# so that the contents can be unit-testable on non-UEFI target hosts.
+# Do not add uefi or uefi-raw as dependencies.
+[package]
+name = "edera-sprout-bls"
+description = "Sprout BLS Utilities (UEFI-free)"
+license.workspace = true
+version.workspace = true
+homepage.workspace = true
+repository.workspace = true
+edition.workspace = true
+
+[dependencies]
+anyhow.workspace = true
+
+[lib]
+name = "edera_sprout_bls"
+path = "src/lib.rs"

crates/bls/src/loader_conf.rs

@@ -0,0 +1,148 @@
+use alloc::format;
+use alloc::string::{String, ToString};
+use alloc::vec::Vec;
+
+/// The menu timeout of a `loader.conf` file.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum LoaderTimeout {
+    /// Show the menu for this many seconds. Zero hides the menu.
+    Seconds(u64),
+    /// Hide the menu unless a key is held.
+    Hidden,
+    /// Never show the menu.
+    Disabled,
+    /// Always show the menu and wait for the user.
+    Force,
+}
+
+impl LoaderTimeout {
+    /// Parses a `timeout` value, which is a number of seconds or one of the menu words.
+    fn parse(value: &str) -> Option<Self> {
+        match value {
+            "menu-hidden" => Some(Self::Hidden),
+            "menu-disabled" => Some(Self::Disabled),
+            "menu-force" => Some(Self::Force),
+            _ if !value.is_empty() && value.bytes().all(|b| b.is_ascii_digit()) => {
+                value.parse().ok().map(Self::Seconds)
+            }
+            _ => None,
+        }
+    }
+}
+
+/// What to do when the selected entry fails to start, from the `reboot-on-error` setting.
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+pub enum RebootOnError {
+    /// Never reboot.
+    No,
+    /// Always reboot, which can loop forever if the entry never starts.
+    Yes,
+    /// Reboot only if a boot counter try was just used up and tries were left, so that the
+    /// entry eventually runs out of tries and is not booted any more.
+    #[default]
+    Auto,
+}
+
+impl RebootOnError {
+    /// Parses a `reboot-on-error` value, which is `auto` or a boolean. The words are case
+    /// sensitive, as in systemd-boot.
+    fn parse(value: &str) -> Option<Self> {
+        match value {
+            "auto" => Some(Self::Auto),
+            "1" | "yes" | "y" | "true" | "t" | "on" => Some(Self::Yes),
+            "0" | "no" | "n" | "false" | "f" | "off" => Some(Self::No),
+            _ => None,
+        }
+    }
+
+    /// Whether to reboot after the entry failed to start. `consumed_tries_left` is the number of
+    /// tries that were left before this boot used one up, or None if the entry has no boot
+    /// counter or the try could not be used up, as then a reboot would not make progress.
+    pub fn should_reboot(self, consumed_tries_left: Option<u32>) -> bool {
+        match self {
+            Self::Yes => true,
+            Self::No => false,
+            Self::Auto => consumed_tries_left.is_some_and(|left| left > 0),
+        }
+    }
+}
+
+/// The settings Sprout understands from a `loader.conf` file.
+/// Reference: <https://www.freedesktop.org/software/systemd/man/latest/loader.conf.html>
+#[derive(Debug, Default, Clone, PartialEq, Eq)]
+pub struct LoaderConf {
+    /// A glob pattern that selects the default entry, or `@saved`.
+    pub default: Option<String>,
+    /// A glob pattern that selects the preferred entry, or `@saved`. Unlike `default`, an entry
+    /// with no boot counter tries left is not used.
+    pub preferred: Option<String>,
+    /// How long to show the boot menu.
+    pub timeout: Option<LoaderTimeout>,
+    /// What to do when the selected entry fails to start.
+    pub reboot_on_error: RebootOnError,
+    /// Problems found while parsing, such as keys that are not supported.
+    pub warnings: Vec<String>,
+}
+
+/// Removes one pair of matching single or double quotes around `value`.
+fn unquote(value: &str) -> &str {
+    for quote in ['"', '\''] {
+        if let Some(inner) = value
+            .strip_prefix(quote)
+            .and_then(|rest| rest.strip_suffix(quote))
+        {
+            return inner;
+        }
+    }
+    value
+}
+
+impl LoaderConf {
+    /// Parses the `input` as a `loader.conf` file. Parsing never fails, as a bad setting
+    /// should not prevent booting. Anything that is ignored is described in `warnings`.
+    /// When a key appears more than once, the last value is used.
+    pub fn parse(input: &str) -> Self {
+        let mut conf = Self::default();
+
+        // Some editors write a UTF-8 byte order mark at the start of the file.
+        let input = input.strip_prefix('\u{feff}').unwrap_or(input);
+
+        for line in input.lines() {
+            let line = line.trim();
+            if line.is_empty() || line.starts_with('#') {
+                continue;
+            }
+
+            let (key, value) = match line.split_once(char::is_whitespace) {
+                Some((key, value)) => (key, unquote(value.trim())),
+                None => (line, ""),
+            };
+
+            match key {
+                "default" if !value.is_empty() => conf.default = Some(value.to_string()),
+                "preferred" if !value.is_empty() => conf.preferred = Some(value.to_string()),
+                "timeout" => match LoaderTimeout::parse(value) {
+                    Some(timeout) => conf.timeout = Some(timeout),
+                    None => conf
+                        .warnings
+                        .push(format!("ignoring invalid loader.conf timeout '{}'", value)),
+                },
+                "reboot-on-error" => match RebootOnError::parse(value) {
+                    Some(reboot_on_error) => conf.reboot_on_error = reboot_on_error,
+                    None => conf.warnings.push(format!(
+                        "ignoring invalid loader.conf reboot-on-error '{}'",
+                        value
+                    )),
+                },
+                "default" | "preferred" => conf
+                    .warnings
+                    .push(format!("ignoring loader.conf {} without a value", key)),
+                _ => conf
+                    .warnings
+                    .push(format!("ignoring unsupported loader.conf key '{}'", key)),
+            }
+        }
+
+        conf
+    }
+}

crates/bls/src/pe.rs

@@ -0,0 +1,159 @@
+use alloc::collections::BTreeMap;
+use alloc::string::{String, ToString};
+use alloc::vec;
+use alloc::vec::Vec;
+use anyhow::{Result, bail};
+
+/// The largest section that will be read. UKI metadata sections are small, and a limit
+/// keeps a corrupt image from causing a large allocation.
+pub const MAX_SECTION_SIZE: u64 = 64 * 1024;
+
+/// The machine type of an x86_64 PE image.
+pub const PE_MACHINE_X86_64: u16 = 0x8664;
+
+/// The machine type of an aarch64 PE image.
+pub const PE_MACHINE_AARCH64: u16 = 0xaa64;
+
+/// The most sections that are read from a PE image. A unified kernel image with many profiles
+/// has many more sections than the 96 that Windows allows, and the table is still small.
+const MAX_SECTIONS: usize = 1024;
+
+/// The size of a section table entry.
+const SECTION_ENTRY_SIZE: usize = 40;
+
+/// A source of bytes that can be read at an offset, such as a file.
+pub trait ReadAt {
+    /// Fills `buf` with the bytes at `offset`, failing if they can't all be read.
+    fn read_at(&mut self, offset: u64, buf: &mut [u8]) -> Result<()>;
+}
+
+/// Reads from a slice of bytes, which is useful for images that are already in memory.
+impl ReadAt for &[u8] {
+    fn read_at(&mut self, offset: u64, buf: &mut [u8]) -> Result<()> {
+        let start = usize::try_from(offset)?;
+        let end = start.checked_add(buf.len());
+        match end.and_then(|end| self.get(start..end)) {
+            Some(bytes) => {
+                buf.copy_from_slice(bytes);
+                Ok(())
+            }
+            None => bail!("read past the end of the image"),
+        }
+    }
+}
+
+fn u16_at(bytes: &[u8], offset: usize) -> u16 {
+    u16::from_le_bytes([bytes[offset], bytes[offset + 1]])
+}
+
+fn u32_at(bytes: &[u8], offset: usize) -> u32 {
+    u32::from_le_bytes([
+        bytes[offset],
+        bytes[offset + 1],
+        bytes[offset + 2],
+        bytes[offset + 3],
+    ])
+}
+
+/// The parts of a PE image that were read.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PeImage {
+    /// The machine type from the COFF header, such as [PE_MACHINE_X86_64].
+    pub machine: u16,
+    /// The wanted sections, in the order of the section table, including repeated names.
+    pub sections: Vec<PeSection>,
+}
+
+/// A wanted section of a PE image.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PeSection {
+    /// The name of the section, such as `.osrel`.
+    pub name: String,
+    /// The contents of the section, or None if it is larger than [MAX_SECTION_SIZE]. A section
+    /// without contents is still there, as it takes the place of a section with the same name.
+    pub data: Option<Vec<u8>>,
+}
+
+/// Reads the sections named in `wanted` from the PE image in `reader`, keeping the first
+/// section of each name. See [read_pe] for the details.
+pub fn read_sections<R: ReadAt>(
+    reader: &mut R,
+    wanted: &[&str],
+) -> Result<BTreeMap<String, Vec<u8>>> {
+    let mut sections = BTreeMap::new();
+    for section in read_pe(reader, wanted)?.sections {
+        sections.entry(section.name).or_insert(section.data);
+    }
+    // A section that was too large is not available.
+    Ok(sections
+        .into_iter()
+        .filter_map(|(name, data)| data.map(|data| (name, data)))
+        .collect())
+}
+
+/// Reads the machine type and the sections named in `wanted` from the PE image in `reader`.
+/// Only the headers and the wanted sections are read, so this is cheap on large images.
+/// A wanted section that is larger than [MAX_SECTION_SIZE] is listed without its contents.
+/// An image that isn't a valid PE file is an error.
+pub fn read_pe<R: ReadAt>(reader: &mut R, wanted: &[&str]) -> Result<PeImage> {
+    // The DOS header starts with "MZ" and holds the offset of the PE header at 0x3c.
+    let mut dos = [0u8; 0x40];
+    reader.read_at(0, &mut dos)?;
+    if &dos[..2] != b"MZ" {
+        bail!("not a PE image: missing the MZ signature");
+    }
+    let pe_offset = u64::from(u32_at(&dos, 0x3c));
+
+    // The PE header is the "PE\0\0" signature followed by the COFF header.
+    let mut coff = [0u8; 24];
+    reader.read_at(pe_offset, &mut coff)?;
+    if &coff[..4] != b"PE\0\0" {
+        bail!("not a PE image: missing the PE signature");
+    }
+    let machine = u16_at(&coff, 4);
+    let section_count = usize::from(u16_at(&coff, 6));
+    let optional_header_size = u64::from(u16_at(&coff, 20));
+    if section_count > MAX_SECTIONS {
+        bail!("PE image has too many sections: {}", section_count);
+    }
+
+    // The section table follows the optional header.
+    let mut table = vec![0u8; section_count * SECTION_ENTRY_SIZE];
+    reader.read_at(pe_offset + 24 + optional_header_size, &mut table)?;
+
+    let mut sections = Vec::new();
+    for entry in table.as_chunks::<SECTION_ENTRY_SIZE>().0 {
+        // The name is up to eight bytes, padded with NUL.
+        let name_len = entry[..8].iter().position(|b| *b == 0).unwrap_or(8);
+        let Ok(name) = core::str::from_utf8(&entry[..name_len]) else {
+            continue;
+        };
+        if !wanted.contains(&name) {
+            continue;
+        }
+
+        // The real size is the virtual size, as the raw size is padded to the file alignment.
+        let virtual_size = u64::from(u32_at(entry, 8));
+        let raw_size = u64::from(u32_at(entry, 16));
+        let raw_offset = u64::from(u32_at(entry, 20));
+        // A virtual size of zero makes the section empty, which is how a profile removes a section
+        // of the base image.
+        let size = virtual_size.min(raw_size);
+        if size > MAX_SECTION_SIZE {
+            sections.push(PeSection {
+                name: name.to_string(),
+                data: None,
+            });
+            continue;
+        }
+
+        let mut data = vec![0u8; size as usize];
+        reader.read_at(raw_offset, &mut data)?;
+        sections.push(PeSection {
+            name: name.to_string(),
+            data: Some(data),
+        });
+    }
+
+    Ok(PeImage { machine, sections })
+}

crates/bls/src/uki.rs

@@ -0,0 +1,273 @@
+use crate::{BlsEntry, PeSection};
+use alloc::collections::BTreeMap;
+use alloc::format;
+use alloc::string::{String, ToString};
+use alloc::vec::Vec;
+
+/// The PE sections of a unified kernel image that Sprout reads.
+pub const UKI_SECTIONS: [&str; 4] = [".osrel", ".cmdline", ".uname", ".profile"];
+
+/// The most profiles that are read from a unified kernel image.
+pub const MAX_PROFILES: usize = 256;
+
+/// A parsed os-release file, such as the `.osrel` section of a unified kernel image.
+#[derive(Debug, Default, Clone, PartialEq, Eq)]
+pub struct OsRelease {
+    fields: BTreeMap<String, String>,
+}
+
+impl OsRelease {
+    /// Parses the `input` as an os-release file, which has one `KEY=value` per line.
+    /// Lines that aren't a setting are ignored, and the last value of a key is used.
+    pub fn parse(input: &str) -> Self {
+        let mut fields = BTreeMap::new();
+        for line in input.lines() {
+            let line = line.trim();
+            if line.is_empty() || line.starts_with('#') {
+                continue;
+            }
+            let Some((key, value)) = line.split_once('=') else {
+                continue;
+            };
+            fields.insert(key.trim().to_string(), unquote(value.trim()));
+        }
+        Self { fields }
+    }
+
+    /// Fetches the value of `key`, if it is set.
+    pub fn get(&self, key: &str) -> Option<&str> {
+        self.fields.get(key).map(String::as_str)
+    }
+}
+
+/// Removes one pair of matching quotes from `value` and unescapes a double quoted value.
+fn unquote(value: &str) -> String {
+    if value.len() >= 2 && value.starts_with('\'') && value.ends_with('\'') {
+        return value[1..value.len() - 1].to_string();
+    }
+    if value.len() >= 2 && value.starts_with('"') && value.ends_with('"') {
+        let mut result = String::new();
+        let mut chars = value[1..value.len() - 1].chars();
+        while let Some(c) = chars.next() {
+            // Only these characters can be escaped. Any other backslash is kept as written.
+            match (c, chars.clone().next()) {
+                ('\\', Some(next @ ('"' | '\\' | '$' | '`'))) => {
+                    result.push(next);
+                    chars.next();
+                }
+                _ => result.push(c),
+            }
+        }
+        return result;
+    }
+    value.to_string()
+}
+
+/// Decodes a section as text, dropping the NUL and whitespace padding at the end.
+/// An empty section is treated as missing.
+fn section_text(sections: &BTreeMap<String, Vec<u8>>, name: &str) -> Option<String> {
+    let text = String::from_utf8_lossy(sections.get(name)?);
+    let text = text.trim_end_matches(|c: char| c == '\0' || c.is_whitespace());
+    (!text.is_empty()).then(|| text.to_string())
+}
+
+impl BlsEntry {
+    /// Produces an entry for one profile of the unified kernel image at `uki_path`.
+    /// A profile after the first is booted with `@<number>` in its load options.
+    pub fn from_uki_profile(profile: &UkiProfile, uki_path: &str) -> Self {
+        Self::from_uki_profile_with(profile, uki_path, false)
+    }
+
+    /// Like [BlsEntry::from_uki_profile], and `strict` follows systemd-boot exactly.
+    pub fn from_uki_profile_with(profile: &UkiProfile, uki_path: &str, strict: bool) -> Self {
+        let mut entry = Self::from_uki_with(&profile.sections, uki_path, strict);
+        if let Some(index) = profile.index {
+            entry.profile = (index > 0).then(|| index.to_string());
+            entry.title = entry
+                .title
+                .take()
+                .map(|title| profile_title(&title, index, &profile.info));
+        }
+        entry
+    }
+
+    /// Produces an entry for the unified kernel image at `uki_path`, from its PE `sections`.
+    pub fn from_uki(sections: &BTreeMap<String, Vec<u8>>, uki_path: &str) -> Self {
+        Self::from_uki_with(sections, uki_path, false)
+    }
+
+    /// Produces an entry for the unified kernel image at `uki_path`, from its PE `sections`.
+    /// With `strict`, the title comes from `PRETTY_NAME`, `IMAGE_ID`, `NAME`, then `ID`, and the
+    /// version from `IMAGE_VERSION`, `VERSION`, `VERSION_ID`, then `BUILD_ID`, as in systemd-boot.
+    /// Otherwise the title comes from `PRETTY_NAME`, then `ID`, and the version from
+    /// `IMAGE_VERSION`, `VERSION_ID`, `BUILD_ID`, then the `.uname` section. The sort key comes
+    /// from `IMAGE_ID`, then `ID`. The embedded command line is kept in `cmdline` and not in `options`, as the image
+    /// reads its own command line.
+    pub fn from_uki_with(
+        sections: &BTreeMap<String, Vec<u8>>,
+        uki_path: &str,
+        strict: bool,
+    ) -> Self {
+        let os_release = section_text(sections, ".osrel")
+            .map(|text| OsRelease::parse(&text))
+            .unwrap_or_default();
+        let first = |keys: &[&str]| {
+            keys.iter()
+                .filter_map(|key| os_release.get(key))
+                .find(|value| !value.is_empty())
+                .map(ToString::to_string)
+        };
+        let uname = section_text(sections, ".uname");
+        // systemd-boot looks at more fields. Outside of strict mode the version is not taken from
+        // VERSION, which is often a long name that would be added to the title.
+        let (title, version) = if strict {
+            (
+                first(&["PRETTY_NAME", "IMAGE_ID", "NAME", "ID"]),
+                first(&["IMAGE_VERSION", "VERSION", "VERSION_ID", "BUILD_ID"]),
+            )
+        } else {
+            (
+                first(&["PRETTY_NAME", "ID"]),
+                first(&["IMAGE_VERSION", "VERSION_ID", "BUILD_ID"]),
+            )
+        };
+
+        Self {
+            title,
+            version: version.or_else(|| uname.clone().filter(|_| !strict)),
+            sort_key: first(&["IMAGE_ID", "ID"]),
+            uki: Some(uki_path.to_string()),
+            cmdline: section_text(sections, ".cmdline"),
+            uname,
+            ..Self::default()
+        }
+    }
+}
+
+/// The metadata in the `.profile` section of a profile of a unified kernel image.
+#[derive(Debug, Default, Clone, PartialEq, Eq)]
+pub struct ProfileInfo {
+    /// A short identifier of the profile.
+    pub id: Option<String>,
+    /// A title for people to read.
+    pub title: Option<String>,
+}
+
+impl ProfileInfo {
+    /// Parses the text of a `.profile` section, which is in the format of an os-release file.
+    /// A key without a value is treated as missing.
+    pub fn parse(text: &str) -> Self {
+        let os_release = OsRelease::parse(text);
+        let get = |key: &str| {
+            os_release
+                .get(key)
+                .filter(|value| !value.is_empty())
+                .map(ToString::to_string)
+        };
+        Self {
+            id: get("ID"),
+            title: get("TITLE"),
+        }
+    }
+}
+
+/// The sections that one profile of a unified kernel image boots with.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct UkiProfile {
+    /// The number of the profile, or None if the image has no `.profile` sections.
+    pub index: Option<u32>,
+    /// The metadata of the profile.
+    pub info: ProfileInfo,
+    /// The sections of the profile on top of those of the base image. A section that is empty
+    /// or too large to read, which is how a profile removes a section, is not here.
+    pub sections: BTreeMap<String, Vec<u8>>,
+}
+
+/// Keeps the first section of each name in `range`.
+fn first_of_each(range: &[PeSection]) -> BTreeMap<String, Option<Vec<u8>>> {
+    let mut sections = BTreeMap::new();
+    for section in range {
+        sections
+            .entry(section.name.clone())
+            .or_insert_with(|| section.data.clone());
+    }
+    sections
+}
+
+/// Splits the `sections` of a unified kernel image, in the order of the section table, into the
+/// profiles of the image. Each `.profile` section starts a profile that goes on until the next
+/// one, and the sections before the first are the base that every profile starts from.
+/// A section of a profile takes the place of the section of the same name in the base.
+/// An image without `.profile` sections has one profile, which is the base.
+pub fn uki_profiles(sections: &[PeSection]) -> Vec<UkiProfile> {
+    // Sections that are empty or too large are not available.
+    let usable = |map: BTreeMap<String, Option<Vec<u8>>>| -> BTreeMap<String, Vec<u8>> {
+        map.into_iter()
+            .filter_map(|(name, data)| {
+                data.filter(|data| !data.is_empty())
+                    .map(|data| (name, data))
+            })
+            .collect()
+    };
+
+    let starts: Vec<usize> = sections
+        .iter()
+        .enumerate()
+        .filter(|(_, section)| section.name == ".profile")
+        .map(|(index, _)| index)
+        .collect();
+    let Some(&first) = starts.first() else {
+        return alloc::vec![UkiProfile {
+            index: None,
+            info: ProfileInfo::default(),
+            sections: usable(first_of_each(sections)),
+        }];
+    };
+
+    let base = first_of_each(&sections[..first]);
+    starts
+        .iter()
+        .take(MAX_PROFILES)
+        .enumerate()
+        .map(|(index, start)| {
+            let end = starts.get(index + 1).copied().unwrap_or(sections.len());
+            let range = &sections[*start..end];
+            let mut merged = base.clone();
+            merged.extend(first_of_each(range));
+            UkiProfile {
+                index: Some(index as u32),
+                info: range[0]
+                    .data
+                    .as_ref()
+                    .map(|data| ProfileInfo::parse(&String::from_utf8_lossy(data)))
+                    .unwrap_or_default(),
+                sections: usable(merged),
+            }
+        })
+        .collect()
+}
+
+/// The part of the id of an entry that comes after the `@`, which names the profile.
+/// The first profile has none, and the others have their identifier or their number.
+pub fn profile_id_suffix(index: u32, info: &ProfileInfo) -> Option<String> {
+    (index > 0).then(|| info.id.clone().unwrap_or_else(|| index.to_string()))
+}
+
+/// The title of the entry for a profile, given the `name` of the image.
+pub fn profile_title(name: &str, index: u32, info: &ProfileInfo) -> String {
+    match (&info.title, &info.id) {
+        (Some(title), _) => format!("{} ({})", name, title),
+        (None, Some(id)) if index > 0 => format!("{} ({})", name, id),
+        (None, None) if index > 0 => format!("{} (Profile #{})", name, index + 1),
+        _ => name.to_string(),
+    }
+}
+
+/// The id of the entry for a profile of the image with the file name `file_id`, such as
+/// `fedora.efi`. The file name is in lower case, as in systemd-boot, and the profile is not.
+pub fn profile_entry_id(file_id: &str, suffix: Option<&str>) -> String {
+    match suffix {
+        Some(suffix) => format!("{}@{}", file_id.to_lowercase(), suffix),
+        None => file_id.to_lowercase(),
+    }
+}

crates/boot/Cargo.toml

@@ -0,0 +1,31 @@
+[package]
+name = "edera-sprout-boot"
+description = "Sprout: Modern UEFI Bootloader"
+license.workspace = true
+version.workspace = true
+homepage.workspace = true
+repository.workspace = true
+edition.workspace = true
+
+[dependencies]
+anyhow.workspace = true
+edera-sprout-config.path = "../config"
+edera-sprout-eficore.path = "../eficore"
+edera-sprout-bls.path = "../bls"
+edera-sprout-parsing.path = "../parsing"
+hex.workspace = true
+jaarg.workspace = true
+serde_ignored.workspace = true
+sha2.workspace = true
+toml.workspace = true
+log.workspace = true
+uefi.workspace = true
+uefi-raw.workspace = true
+
+[build-dependencies]
+edera-sprout-build.path = "../build"
+
+[[bin]]
+name = "sprout"
+path = "src/main.rs"
+test = false

crates/boot/build.rs

@@ -0,0 +1,10 @@
+use edera_sprout_build::{generate_logo_module, generate_sbat_module};
+
+/// Build script entry point for Sprout.
+fn main() {
+    // Generate the sbat.generated.rs file.
+    generate_sbat_module();
+
+    // Generate the logo.generated.rs file.
+    generate_logo_module();
+}

crates/boot/src/actions.rs

@@ -1,6 +1,6 @@
 use crate::context::SproutContext;
+use alloc::rc::Rc;
 use anyhow::{Context, Result, bail};
-use std::rc::Rc;
 
 /// EFI chainloader action.
 pub mod chainload;

crates/boot/src/actions/chainload.rs

@@ -0,0 +1,269 @@
+use crate::context::SproutContext;
+use crate::generators::bls::BLS_INITRD_SLOTS;
+use crate::phases::before_handoff;
+use alloc::boxed::Box;
+use alloc::format;
+use alloc::rc::Rc;
+use alloc::vec::Vec;
+use anyhow::{Context, Result, bail};
+use edera_sprout_config::actions::chainload::ChainloadConfiguration;
+use edera_sprout_parsing::{append_initrd, combine_options, empty_is_none};
+use eficore::bootloader_interface::BootloaderInterface;
+use eficore::devicetree::DeviceTree;
+use eficore::loader::source::ImageSource;
+use eficore::loader::{ImageLoadRequest, ImageLoader};
+use eficore::media_loader::MediaLoaderHandle;
+use eficore::media_loader::constants::linux::LINUX_EFI_INITRD_MEDIA_GUID;
+use eficore::path::ResolvedPath;
+use eficore::secure::SecureBoot;
+use log::warn;
+use uefi::proto::loaded_image::LoadedImage;
+use uefi::{CString16, Handle};
+
+/// Read the initrd at the stamped `path` relative to the sprout image.
+/// Provides [None] if the path refers to the root of a filesystem rather than a file.
+pub fn read_initrd(context: &Rc<SproutContext>, path: &str) -> Result<Option<Vec<u8>>> {
+    read_optional_file(context, path, "initrd")
+}
+
+/// Read the `what` at the stamped `path` relative to the sprout image.
+/// Provides [None] if the path refers to the root of a filesystem rather than a file.
+fn read_optional_file(
+    context: &Rc<SproutContext>,
+    path: &str,
+    what: &str,
+) -> Result<Option<Vec<u8>>> {
+    let Some(resolved) = resolve_optional_file(context, path, what)? else {
+        return Ok(None);
+    };
+    let content = resolved
+        .read_file()
+        .with_context(|| format!("unable to read {}", what))?;
+    Ok(Some(content))
+}
+
+/// Resolve the `what` at the stamped `path` relative to the sprout image.
+/// Provides [None] if the path refers to the root of a filesystem rather than a file.
+fn resolve_optional_file(
+    context: &Rc<SproutContext>,
+    path: &str,
+    what: &str,
+) -> Result<Option<ResolvedPath>> {
+    let resolved = eficore::path::resolve_path(Some(context.root().loaded_image_path()?), path)
+        .with_context(|| format!("unable to resolve {} path", what))?;
+
+    // A path without a file component refers to the root of the filesystem, not a file.
+    // This happens when a path template like "$root\\$initrd-0" is stamped with an empty
+    // value, such as a BLS entry without an initrd or an unused BLS initrd slot.
+    let subpath = eficore::path::device_path_subpath(&resolved.full_path)
+        .with_context(|| format!("unable to get {} subpath", what))?;
+    if subpath.trim_matches('\\').is_empty() {
+        return Ok(None);
+    }
+    Ok(Some(resolved))
+}
+
+/// Install the devicetree at the stamped `path` for the image that is about to be started.
+/// Provides [None] if there is none to install, such as when the path refers to the root of a
+/// filesystem, or when Secure Boot is enabled, as a devicetree can't be verified.
+fn install_devicetree(context: &Rc<SproutContext>, path: &str) -> Result<Option<DeviceTree>> {
+    let Some(resolved) = resolve_optional_file(context, path, "devicetree")? else {
+        return Ok(None);
+    };
+    if SecureBoot::enabled().unwrap_or(true) {
+        warn!("ignoring the devicetree, as Secure Boot is enabled");
+        return Ok(None);
+    }
+    let content = resolved.read_file().context("unable to read devicetree")?;
+    let devicetree = DeviceTree::install(&content).context("unable to install the devicetree")?;
+    Ok(Some(devicetree))
+}
+
+/// Unloads the image with the contained handle when dropped, unless the handle is taken.
+/// This ensures that an image that is loaded but never started is not left in memory.
+struct UnloadGuard(Option<Handle>);
+
+impl Drop for UnloadGuard {
+    fn drop(&mut self) {
+        if let Some(handle) = self.0.take()
+            && let Err(error) = uefi::boot::unload_image(handle)
+        {
+            warn!("unable to unload image: {}", error);
+        }
+    }
+}
+
+/// Executes the chainload action using the specified `configuration` inside the provided `context`.
+pub fn chainload(context: Rc<SproutContext>, configuration: &ChainloadConfiguration) -> Result<()> {
+    // The initrd can be provided as either a single initrd or a chain, but not both.
+    if configuration.linux_initrd.is_some() && !configuration.linux_initrd_chain.is_empty() {
+        bail!("linux-initrd and linux-initrd-chain cannot be used together");
+    }
+
+    // Retrieve the current image handle of sprout.
+    let sprout_image = uefi::boot::image_handle();
+
+    // Resolve the path to the image to chainload.
+    let resolved = eficore::path::resolve_path(
+        Some(context.root().loaded_image_path()?),
+        context.stamp(&configuration.path),
+    )
+    .context("unable to resolve chainload path")?;
+
+    // Create a new image load request with the current image and the resolved path.
+    let request = ImageLoadRequest::new(sprout_image, ImageSource::ResolvedPath(&resolved));
+
+    // Load the image to chainload using the image loader support module.
+    // It will determine if the image needs to be loaded via the shim or can be loaded directly.
+    let image = ImageLoader::load(request)?;
+
+    // Unload the image if an error occurs before it is started.
+    let mut unload_guard = UnloadGuard(Some(*image.handle()));
+
+    // Stamp and combine the options to pass to the image.
+    let options = combine_options(context.stamp_iter(configuration.options.iter()));
+
+    // Pass the load options to the image.
+    // If no options are provided, the resulting string will be empty.
+    // The options are pinned and boxed to ensure that they are valid for the lifetime of this
+    // function, which ensures the lifetime of the options for the image runtime.
+    let options = Box::pin(
+        CString16::try_from(&options[..])
+            .context("unable to convert chainloader options to CString16")?,
+    );
+
+    // Ensure the chainloader options limit is not exceeded.
+    if options.num_bytes() > u32::MAX as usize {
+        bail!("chainloader options too large");
+    }
+
+    // Open the LoadedImage protocol of the image to chainload to pass the load options.
+    // This is done in a block to release the protocol before the image is started, as the
+    // image may itself need to open its LoadedImage protocol exclusively.
+    {
+        let mut loaded_image_protocol =
+            uefi::boot::open_protocol_exclusive::<LoadedImage>(*image.handle())
+                .context("unable to open loaded image protocol")?;
+
+        // SAFETY: option size is checked to validate it is safe to pass.
+        // Additionally, the pointer is allocated and retained on heap, which makes
+        // passing the `options` pointer safe to the next image.
+        unsafe {
+            loaded_image_protocol
+                .set_load_options(options.as_ptr() as *const u8, options.num_bytes() as u32);
+        }
+    }
+
+    // Stamp the initrd paths. A single linux-initrd is read the same way as a chain of one.
+    let initrd_paths = configuration
+        .linux_initrd
+        .iter()
+        .chain(configuration.linux_initrd_chain.iter())
+        .map(|item| context.stamp(item));
+
+    // A BLS entry can have more initrds than the chain lists. Those would be dropped without a
+    // word, and then the kernel may not find its root, so say so.
+    let chain_length = configuration.linux_initrd_chain.len();
+    if chain_length > 0 {
+        for slot in chain_length..BLS_INITRD_SLOTS {
+            let placeholder = format!("$initrd-{}", slot);
+            let value = context.stamp(&placeholder);
+            if !value.is_empty() && value != placeholder {
+                warn!(
+                    "the entry has an initrd for slot {}, but linux-initrd-chain only lists {}, \
+                     so it is not loaded",
+                    slot, chain_length
+                );
+                break;
+            }
+        }
+    }
+
+    // Read each initrd and concatenate the contents in order.
+    // Paths that are empty after stamping are skipped.
+    let mut initrd: Option<Vec<u8>> = None;
+    for path in initrd_paths {
+        let Some(path) = empty_is_none(Some(path)) else {
+            continue;
+        };
+        let Some(content) = read_initrd(&context, &path)? else {
+            continue;
+        };
+        match initrd.as_mut() {
+            Some(initrd) => append_initrd(initrd, &content),
+            None => initrd = Some(content),
+        }
+    }
+
+    // If an initrd was read, register it with the EFI stack.
+    // An empty initrd is not registered, as Linux fails to boot if the initrd it is
+    // given can't be loaded, instead of booting without one.
+    let mut initrd_handle = None;
+    if let Some(content) = initrd.filter(|content| !content.is_empty()) {
+        let handle =
+            MediaLoaderHandle::register(LINUX_EFI_INITRD_MEDIA_GUID, content.into_boxed_slice())
+                .context("unable to register linux initrd")?;
+        initrd_handle = Some(handle);
+    }
+
+    // Install the devicetree, if there is one, for the image to find. It is restored when it is
+    // dropped, which is once the image has returned or failed to start. A devicetree is not
+    // verified, so it is not used when Secure Boot is enabled, or when that can't be told.
+    let mut devicetree = None;
+    if let Some(path) = empty_is_none(
+        configuration
+            .devicetree
+            .as_ref()
+            .map(|path| context.stamp(path)),
+    ) {
+        match install_devicetree(&context, &path) {
+            Ok(installed) => devicetree = installed,
+            // systemd-boot does not boot an entry whose devicetree can't be installed. Outside
+            // of strict mode it is booted without it, as before the devicetree was supported.
+            Err(error) if !context.root().options().bls_strict_mode => warn!(
+                "booting without the devicetree {}, as it can't be installed: {:#} \
+                 (systemd-boot and strict mode do not boot the entry)",
+                path, error
+            ),
+            Err(error) => return Err(error),
+        }
+    }
+
+    // Mark execution of an entry in the bootloader interface.
+    // This is only informational, so it should not prevent booting.
+    if let Err(error) = BootloaderInterface::mark_exec(context.root().timer()) {
+        warn!(
+            "unable to mark execution of boot entry in bootloader interface: {:#}",
+            error
+        );
+    }
+
+    // Since we are about to hand off control to another image, we need to execute the handoff hook.
+    // This will perform operations like clearing the screen.
+    before_handoff(&context).context("unable to execute before handoff hook")?;
+
+    // The image is about to be started, so it is no longer ours to unload.
+    // Once started, the image is unloaded by the firmware when it exits.
+    unload_guard.0 = None;
+
+    // Start the loaded image.
+    // This call might return, or it may pass full control to another image that will never return.
+    // Capture the result to ensure we can return an error if the image fails to start, but only
+    // after the optional initrd has been unregistered.
+    let result = uefi::boot::start_image(*image.handle());
+
+    // Assert there was no error starting the image.
+    result.context("unable to start image")?;
+
+    // Explicitly drop the options to clarify the lifetime.
+    drop(options);
+
+    // Explicitly drop the initrd handle to clarify when it should be unregistered.
+    drop(initrd_handle);
+
+    // Explicitly drop the devicetree to clarify when the original is restored.
+    drop(devicetree);
+
+    // Return control to sprout.
+    Ok(())
+}

crates/boot/src/actions/edera.rs

@@ -0,0 +1,144 @@
+use crate::{actions, context::SproutContext};
+use alloc::rc::Rc;
+use alloc::vec::Vec;
+use alloc::{format, vec};
+use anyhow::{Context, Result, bail};
+use edera_sprout_config::actions::chainload::ChainloadConfiguration;
+use edera_sprout_config::actions::edera::EderaConfiguration;
+use edera_sprout_parsing::{append_initrd, build_xen_config, combine_options, empty_is_none};
+use eficore::media_loader::{
+    MediaLoaderHandle,
+    constants::xen::{
+        XEN_EFI_CONFIG_MEDIA_GUID, XEN_EFI_KERNEL_MEDIA_GUID, XEN_EFI_RAMDISK_MEDIA_GUID,
+    },
+};
+use eficore::platform::tpm::PlatformTpm;
+use uefi::Guid;
+
+/// Register a media loader for the provided `bytes` with the vendor `guid`.
+/// `what` should indicate some identifying value for error messages
+/// like `config` or `kernel`.
+/// Provides a [MediaLoaderHandle] that can be used to unregister the media loader.
+fn register_media_loader_bytes(
+    guid: Guid,
+    what: &str,
+    bytes: Vec<u8>,
+) -> Result<MediaLoaderHandle> {
+    MediaLoaderHandle::register(guid, bytes.into_boxed_slice())
+        .context(format!("unable to register {} media loader", what))
+}
+
+/// Read the contents of the loader payload at `path` relative to the sprout image.
+/// `what` should indicate some identifying value for error messages
+/// like `kernel` or `initrd`.
+fn read_loader_payload(context: &Rc<SproutContext>, what: &str, path: &str) -> Result<Vec<u8>> {
+    let path = context.stamp(path);
+    eficore::path::read_file_contents(Some(context.root().loaded_image_path()?), &path)
+        .context(format!("unable to read {} file", what))
+}
+
+/// Executes the edera action which will boot the Edera hypervisor with the specified
+/// `configuration` and `context`. This action uses Edera-specific Xen EFI stub functionality.
+pub fn edera(context: Rc<SproutContext>, configuration: &EderaConfiguration) -> Result<()> {
+    // The initrd can be provided as either a single initrd or a chain, but not both.
+    if configuration.initrd.is_some() && !configuration.initrd_chain.is_empty() {
+        bail!("initrd and initrd-chain cannot be used together");
+    }
+
+    // Only register the initrd media loader if the user actually configured one.
+    let xen_opts = combine_options(context.stamp_iter(configuration.xen_options.iter()));
+    let dom0_args = combine_options(context.stamp_iter(configuration.kernel_options.iter()));
+
+    // Measure xen options and dom0 cmdline into PCR 12 in a fixed order.
+    PlatformTpm::log_event(
+        PlatformTpm::PCR_KERNEL_PARAMETERS,
+        xen_opts.as_bytes(),
+        "sprout: xen options",
+    )
+    .context("unable to measure xen options into the TPM")?;
+    PlatformTpm::log_event(
+        PlatformTpm::PCR_KERNEL_PARAMETERS,
+        dom0_args.as_bytes(),
+        "sprout: dom0 cmdline",
+    )
+    .context("unable to measure dom0 cmdline into the TPM")?;
+
+    // Build the Xen config text and register it as the config media loader. The
+    // assembled text is a derived artifact, intentionally not measured.
+    let config_handle = register_media_loader_bytes(
+        XEN_EFI_CONFIG_MEDIA_GUID,
+        "config",
+        build_xen_config(&xen_opts, &dom0_args).into_bytes(),
+    )
+    .context("unable to register config media loader")?;
+
+    // Read the dom0 kernel, measure it into PCR 11, then register the kernel
+    // media loader.
+    let kernel_bytes = read_loader_payload(&context, "kernel", &configuration.kernel)?;
+    PlatformTpm::log_event(
+        PlatformTpm::PCR_KERNEL,
+        &kernel_bytes,
+        "sprout: dom0 kernel",
+    )
+    .context("unable to measure dom0 kernel into the TPM")?;
+    let kernel_handle =
+        register_media_loader_bytes(XEN_EFI_KERNEL_MEDIA_GUID, "kernel", kernel_bytes)
+            .context("unable to register kernel media loader")?;
+
+    // Read the initrd, or each initrd in the chain concatenated in order, then
+    // extend PCR 9 with the combined bytes (empty when no initrd is configured).
+    // Paths are stamped first, and paths that are empty after stamping or that refer
+    // to the root of a filesystem are skipped, the same as the chainload action.
+    let mut initrd_bytes = Vec::new();
+    let initrd_paths = configuration
+        .initrd
+        .iter()
+        .chain(configuration.initrd_chain.iter())
+        .map(|item| context.stamp(item));
+    for path in initrd_paths {
+        let Some(path) = empty_is_none(Some(path)) else {
+            continue;
+        };
+        let Some(content) = actions::chainload::read_initrd(&context, &path)
+            .context("unable to read initrd file")?
+        else {
+            continue;
+        };
+        append_initrd(&mut initrd_bytes, &content);
+    }
+    PlatformTpm::log_event(
+        PlatformTpm::PCR_INITRD,
+        &initrd_bytes,
+        "sprout: dom0 initrd",
+    )
+    .context("unable to measure dom0 initrd into the TPM")?;
+
+    // Create a vector of media loaders to drop them only after this function completes.
+    let mut media_loaders = vec![config_handle, kernel_handle];
+
+    // Register the initrd if it is provided.
+    if !initrd_bytes.is_empty() {
+        let initrd_handle =
+            register_media_loader_bytes(XEN_EFI_RAMDISK_MEDIA_GUID, "initrd", initrd_bytes)
+                .context("unable to register initrd media loader")?;
+        media_loaders.push(initrd_handle);
+    }
+
+    // Chainload to the Xen EFI stub.
+    let result = actions::chainload::chainload(
+        context.clone(),
+        &ChainloadConfiguration {
+            path: configuration.xen.clone(),
+            options: vec![],
+            linux_initrd: None,
+            linux_initrd_chain: vec![],
+            devicetree: None,
+        },
+    )
+    .context("unable to chainload to xen");
+
+    // Explicitly drop the media loaders to clarify when they should be unregistered.
+    drop(media_loaders);
+
+    result
+}

crates/boot/src/actions/print.rs

@@ -1,8 +1,8 @@
 use crate::context::SproutContext;
+use alloc::rc::Rc;
 use anyhow::Result;
 use edera_sprout_config::actions::print::PrintConfiguration;
 use log::info;
-use std::rc::Rc;
 
 /// Executes the print action with the specified `configuration` inside the provided `context`.
 pub fn print(context: Rc<SproutContext>, configuration: &PrintConfiguration) -> Result<()> {

crates/boot/src/autoconfigure.rs

@@ -0,0 +1,158 @@
+use alloc::boxed::Box;
+use anyhow::{Context, Result};
+use edera_sprout_config::RootConfiguration;
+use log::warn;
+use uefi::Handle;
+use uefi::fs::FileSystem;
+use uefi::proto::device_path::DevicePath;
+use uefi::proto::loaded_image::LoadedImage;
+use uefi::proto::media::fs::SimpleFileSystem;
+
+/// bls: autodetect and configure BLS-enabled filesystems.
+pub mod bls;
+
+/// linux: autodetect and configure Linux kernels.
+/// This autoconfiguration module should not be activated
+/// on BLS-enabled filesystems as it may make duplicate entries.
+pub mod linux;
+
+/// windows: autodetect and configure Windows boot configurations.
+pub mod windows;
+
+/// Find the filesystems that systemd-boot reads BLS entries from: the partition that Sprout
+/// was loaded from, and the extended boot loader partition of the same disk.
+fn strict_bls_sources(loaded_image_path: &DevicePath) -> (Option<Handle>, Option<Handle>) {
+    let own = eficore::handle::open_shared::<LoadedImage>(uefi::boot::image_handle())
+        .ok()
+        .and_then(|image| image.device());
+    let xbootldr = match eficore::xbootldr::find_xbootldr(loaded_image_path) {
+        Ok(Some(path)) => uefi::boot::locate_device_path::<SimpleFileSystem>(&mut &*path).ok(),
+        Ok(None) => None,
+        Err(error) => {
+            warn!("unable to find the xbootldr partition: {:#}", error);
+            None
+        }
+    };
+    (own, xbootldr)
+}
+
+/// Generate a [RootConfiguration] based on the environment.
+/// Intakes a `config` to use as the basis of the autoconfiguration.
+/// With `strict`, only the partition Sprout was loaded from and the extended boot loader
+/// partition of its disk are read for BLS entries, as one generator, like systemd-boot does.
+pub fn autoconfigure(
+    config: &mut RootConfiguration,
+    strict: bool,
+    loaded_image_path: &DevicePath,
+) -> Result<()> {
+    // Find all the filesystems that are on the system.
+    let filesystem_handles =
+        uefi::boot::find_handles::<SimpleFileSystem>().context("unable to scan filesystems")?;
+
+    // The partitions that BLS entries are read from in strict mode.
+    let (own_handle, xbootldr_handle) = if strict {
+        strict_bls_sources(loaded_image_path)
+    } else {
+        (None, None)
+    };
+    // The device path of the partition of Sprout, which names the strict generator.
+    let mut own_root: Option<Box<DevicePath>> = None;
+    // Whether either of the partitions has BLS entries, in strict mode.
+    let mut strict_found = false;
+
+    // For each filesystem that was detected, scan it for supported autoconfig mechanisms.
+    for handle in filesystem_handles {
+        // Acquire the device path root for the filesystem.
+        // A filesystem that can't be opened is skipped, as it should not prevent
+        // autoconfiguring the other filesystems.
+        let root = match uefi::boot::open_protocol_exclusive::<DevicePath>(handle) {
+            Ok(root) => root.to_boxed(),
+            Err(error) => {
+                warn!("skipping filesystem, unable to get its root: {}", error);
+                continue;
+            }
+        };
+
+        // Open the filesystem that was detected.
+        let filesystem = match uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(handle) {
+            Ok(filesystem) => filesystem,
+            Err(error) => {
+                warn!("skipping filesystem, unable to open it: {}", error);
+                continue;
+            }
+        };
+
+        // Trade the filesystem protocol for the uefi filesystem helper.
+        let mut filesystem = FileSystem::new(filesystem);
+
+        // A scan that fails is skipped, as a filesystem that can't be read should not
+        // prevent autoconfiguring the other filesystems.
+
+        // Scan the filesystem for BLS supported configurations. In strict mode, only the
+        // partitions that systemd-boot reads get entries, and they get a single generator.
+        // The other filesystems that have BLS are still not scanned for Linux configurations.
+        let is_source = Some(handle) == own_handle || Some(handle) == xbootldr_handle;
+        if strict && Some(handle) == own_handle {
+            own_root = Some(root.to_boxed());
+        }
+        let bls_found = if strict {
+            match bls::detect(&mut filesystem) {
+                Ok(found) => {
+                    strict_found |= found && is_source;
+                    found
+                }
+                Err(error) => {
+                    warn!(
+                        "unable to scan filesystem for bls configurations: {:#}",
+                        error
+                    );
+                    false
+                }
+            }
+        } else {
+            match bls::scan(&mut filesystem, &root, config) {
+                Ok(found) => found,
+                Err(error) => {
+                    warn!(
+                        "unable to scan filesystem for bls configurations: {:#}",
+                        error
+                    );
+                    false
+                }
+            }
+        };
+
+        // If BLS was not found, scan for Linux configurations.
+        if !bls_found && let Err(error) = linux::scan(&mut filesystem, &root, config) {
+            warn!(
+                "unable to scan filesystem for linux configurations: {:#}",
+                error
+            );
+        }
+
+        // Always look for Windows configurations.
+        if let Err(error) = windows::scan(&mut filesystem, &root, config) {
+            warn!(
+                "unable to scan filesystem for windows configurations: {:#}",
+                error
+            );
+        }
+    }
+
+    // In strict mode, one generator reads both partitions, with the root of Sprout's partition.
+    if strict && strict_found {
+        match own_root {
+            Some(root) => {
+                if let Err(error) = bls::add_generator(config, &root, true) {
+                    warn!("unable to add the bls generator: {:#}", error);
+                }
+            }
+            None => warn!(
+                "found BLS entries, but not the partition that Sprout was loaded from, \
+                 so none are used in strict mode"
+            ),
+        }
+    }
+
+    Ok(())
+}

crates/boot/src/autoconfigure/bls.rs

@@ -0,0 +1,164 @@
+use crate::generators::bls::BLS_INITRD_SLOTS;
+use alloc::string::ToString;
+use alloc::{format, vec};
+use anyhow::{Context, Result};
+use edera_sprout_config::RootConfiguration;
+use edera_sprout_config::actions::ActionDeclaration;
+use edera_sprout_config::actions::chainload::ChainloadConfiguration;
+use edera_sprout_config::entries::EntryDeclaration;
+use edera_sprout_config::generators::GeneratorDeclaration;
+use edera_sprout_config::generators::bls::BlsConfiguration;
+use edera_sprout_parsing::unique_hash;
+use uefi::cstr16;
+use uefi::fs::{FileSystem, Path};
+use uefi::proto::device_path::DevicePath;
+use uefi::proto::device_path::text::{AllowShortcuts, DisplayOnly};
+
+/// The name prefix of the BLS chainload action that will be used
+/// by the BLS generator to chainload entries.
+const BLS_CHAINLOAD_ACTION_PREFIX: &str = "bls-chainload-";
+
+/// Detect whether the `filesystem` has a BLS supported configuration.
+pub fn detect(filesystem: &mut FileSystem) -> Result<bool> {
+    // BLS has a loader.conf file that can specify its own auto-entries mechanism.
+    let bls_loader_conf_path = Path::new(cstr16!("\\loader\\loader.conf"));
+    // BLS also has an entries directory that can specify explicit entries.
+    let bls_entries_path = Path::new(cstr16!("\\loader\\entries"));
+    // BLS Type #2 entries are unified kernel images in the EFI/Linux directory.
+    let bls_uki_path = Path::new(cstr16!("\\EFI\\Linux"));
+
+    // Whether we have a loader.conf file.
+    let has_loader_conf = filesystem
+        .try_exists(bls_loader_conf_path)
+        .context("unable to check for BLS loader.conf file")?;
+
+    // Whether we have an entries directory.
+    // We actually iterate the entries to see if there are any entry files, as the
+    // directory itself always has the "." and ".." items, even when it is empty.
+    let has_entries_dir = filesystem
+        .read_dir(bls_entries_path)
+        .map(|mut iterator| {
+            iterator.any(|entry| {
+                entry.is_ok_and(|entry| {
+                    entry.is_regular_file()
+                        && entry
+                            .file_name()
+                            .to_string()
+                            .to_lowercase()
+                            .ends_with(".conf")
+                })
+            })
+        })
+        .unwrap_or(false);
+
+    // Whether we have any unified kernel images.
+    let has_ukis = filesystem
+        .read_dir(bls_uki_path)
+        .map(|mut iterator| {
+            iterator.any(|entry| {
+                entry.is_ok_and(|entry| {
+                    entry.is_regular_file()
+                        && entry
+                            .file_name()
+                            .to_string()
+                            .to_lowercase()
+                            .ends_with(".efi")
+                })
+            })
+        })
+        .unwrap_or(false);
+
+    // Detect if a BLS supported configuration is on this filesystem.
+    // We check loader.conf, the entries directory and unified kernel images, as only one of
+    // them is required.
+    Ok(has_loader_conf || has_entries_dir || has_ukis)
+}
+
+/// Add the BLS generator and its action for the partition with the device path `root`.
+/// In `strict` mode, the generator also reads the extended boot loader partition of the disk.
+pub fn add_generator(
+    config: &mut RootConfiguration,
+    root: &DevicePath,
+    strict: bool,
+) -> Result<()> {
+    // Convert the device path root to a string we can use in the configuration.
+    let mut root = root
+        .to_string16(DisplayOnly(false), AllowShortcuts(false))
+        .context("unable to convert device root to string")?
+        .to_string();
+    // Add a trailing forward-slash to the root to ensure the device root is completed.
+    root.push('/');
+
+    // Generate a unique hash of the root path.
+    let root_unique_hash = unique_hash(&root);
+
+    // Generate a unique name for the BLS chainload action.
+    let chainload_action_name = format!("{}{}", BLS_CHAINLOAD_ACTION_PREFIX, root_unique_hash,);
+
+    // BLS is now detected, generate a configuration for it.
+    let generator = BlsConfiguration {
+        entry: EntryDeclaration {
+            title: "$title".to_string(),
+            actions: vec![chainload_action_name.clone()],
+            ..Default::default()
+        },
+        path: format!("{}\\loader", root),
+        uki_path: None,
+        // Every filesystem is scanned, including the Extended Boot Loader Partition, which
+        // gets a generator of its own, unless strict mode reads it with the generator of the
+        // partition that Sprout was loaded from.
+        xbootldr: strict,
+        pin_names: true,
+    };
+
+    // Generate a unique name for the BLS generator and insert the generator into the configuration.
+    config.generators.insert(
+        format!("auto-bls-{}", root_unique_hash),
+        GeneratorDeclaration {
+            bls: Some(generator),
+            ..Default::default()
+        },
+    );
+
+    // Generate a chainload configuration for BLS.
+    // BLS will provide these values to us.
+    // Every initrd slot is chained in order. Unused slots stamp to the root of the
+    // filesystem, which the chainload action skips.
+    // The files of an entry are on the partition of the entry, which is the root of the
+    // generator for most entries, and the extended boot loader partition for some in strict mode.
+    let entry_root = if strict { "$entry-root" } else { &root };
+    let chainload = ChainloadConfiguration {
+        path: format!("{}\\$chainload", entry_root),
+        options: vec!["$options".to_string()],
+        linux_initrd: None,
+        linux_initrd_chain: (0..BLS_INITRD_SLOTS)
+            .map(|slot| format!("{}\\$initrd-{}", entry_root, slot))
+            .collect(),
+        // An unset devicetree stamps to the root of the filesystem, which the action skips.
+        devicetree: Some(format!("{}\\$devicetree", entry_root)),
+    };
+
+    // Insert the chainload action into the configuration.
+    config.actions.insert(
+        chainload_action_name,
+        ActionDeclaration {
+            chainload: Some(chainload),
+            ..Default::default()
+        },
+    );
+
+    Ok(())
+}
+
+/// Scan the specified `filesystem` for BLS configurations.
+pub fn scan(
+    filesystem: &mut FileSystem,
+    root: &DevicePath,
+    config: &mut RootConfiguration,
+) -> Result<bool> {
+    if !detect(filesystem)? {
+        return Ok(false);
+    }
+    add_generator(config, root, false)?;
+    Ok(true)
+}

crates/boot/src/autoconfigure/linux.rs

@@ -1,5 +1,7 @@
-use crate::utils;
-use crate::utils::vercmp;
+use alloc::collections::BTreeMap;
+use alloc::string::{String, ToString};
+use alloc::vec::Vec;
+use alloc::{format, vec};
 use anyhow::{Context, Result};
 use edera_sprout_config::RootConfiguration;
 use edera_sprout_config::actions::ActionDeclaration;
@@ -7,7 +9,11 @@ use edera_sprout_config::actions::chainload::ChainloadConfiguration;
 use edera_sprout_config::entries::EntryDeclaration;
 use edera_sprout_config::generators::GeneratorDeclaration;
 use edera_sprout_config::generators::list::ListConfiguration;
-use std::collections::BTreeMap;
+use edera_sprout_parsing::{
+    LINUX_INITRAMFS_PREFIXES, LINUX_KERNEL_PREFIXES, initramfs_candidates, match_kernel_prefix,
+    unique_hash,
+};
+use log::warn;
 use uefi::CString16;
 use uefi::fs::{FileSystem, Path, PathBuf};
 use uefi::proto::device_path::DevicePath;
@@ -17,16 +23,10 @@ use uefi::proto::device_path::text::{AllowShortcuts, DisplayOnly};
 const LINUX_CHAINLOAD_ACTION_PREFIX: &str = "linux-chainload-";
 
 /// The locations to scan for kernel pairs.
-/// We will check for symlinks and if this directory is a symlink, we will skip it.
-/// The empty string represents the root of the filesystem.
+/// A location that doesn't exist or can't be read is skipped.
+/// The "\\" location represents the root of the filesystem.
 const SCAN_LOCATIONS: &[&str] = &["\\boot", "\\"];
 
-/// Prefixes of kernel files to scan for.
-const KERNEL_PREFIXES: &[&str] = &["vmlinuz"];
-
-/// Prefixes of initramfs files to match to.
-const INITRAMFS_PREFIXES: &[&str] = &["initramfs", "initrd", "initrd.img"];
-
 /// This is really silly, but if what we are booting is the Canonical stubble stub,
 /// there is a chance it will assert that the load options are non-empty.
 /// Technically speaking, load options can be empty. However, it assumes load options
@@ -34,9 +34,9 @@ const INITRAMFS_PREFIXES: &[&str] = &["initramfs", "initrd", "initrd.img"];
 /// and then uses that code improperly by asserting that the pointer is non-null.
 /// To give a good user experience, we place a placeholder value here to ensure it's non-empty.
 /// For stubble, this code ensures the command line pointer becomes null:
-/// https://github.com/ubuntu/stubble/blob/e56643979addfb98982266018e08921c07424a0c/stub.c#L61-L64
+/// <https://github.com/ubuntu/stubble/blob/e56643979addfb98982266018e08921c07424a0c/stub.c#L61-L64>
 /// Then this code asserts on it, stopping the boot process:
-/// https://github.com/ubuntu/stubble/blob/e56643979addfb98982266018e08921c07424a0c/stub.c#L27
+/// <https://github.com/ubuntu/stubble/blob/e56643979addfb98982266018e08921c07424a0c/stub.c#L27>
 const DEFAULT_LINUX_OPTIONS: &str = "placeholder";
 
 /// Pair of kernel and initramfs.
@@ -106,9 +106,7 @@ fn scan_directory(filesystem: &mut FileSystem, path: &str) -> Result<Vec<KernelP
 
         // Find a kernel prefix that matches, if any.
         // This is case-insensitive to ensure we pick up all possibilities.
-        let Some(prefix) = KERNEL_PREFIXES.iter().find(|prefix| {
-            name_for_match == **prefix || name_for_match.starts_with(&format!("{}-", prefix))
-        }) else {
+        let Some(prefix) = match_kernel_prefix(&name_for_match, LINUX_KERNEL_PREFIXES) else {
             // Skip over anything that doesn't match a kernel prefix.
             continue;
         };
@@ -116,23 +114,23 @@ fn scan_directory(filesystem: &mut FileSystem, path: &str) -> Result<Vec<KernelP
         // Acquire the suffix of the name, this will be used to match an initramfs.
         let suffix = &name[prefix.len()..];
 
-        // Find a matching initramfs, if any.
-        let mut initramfs_prefix_iter = INITRAMFS_PREFIXES.iter();
+        // Find a matching initramfs by trying each candidate name, if any.
+        let mut candidates = initramfs_candidates(suffix, LINUX_INITRAMFS_PREFIXES);
         let matched_initramfs_path = loop {
-            let Some(prefix) = initramfs_prefix_iter.next() else {
+            let Some(candidate) = candidates.next() else {
                 break None;
             };
             // Construct an initramfs path.
-            let initramfs = format!("{}{}", prefix, suffix);
-            let initramfs = CString16::try_from(initramfs.as_str())
+            let initramfs = CString16::try_from(candidate.as_str())
                 .context("unable to convert initramfs name to CString16")?;
             let mut initramfs_path = path_for_join.clone();
             initramfs_path.push(Path::new(&initramfs));
 
-            // Check if the initramfs path exists, if it does, break out of the loop.
+            // Check if the initramfs path is a file, if it is, break out of the loop.
+            // A path that can't be checked is treated as not existing.
             if filesystem
-                .try_exists(&initramfs_path)
-                .context("unable to check if initramfs path exists")?
+                .metadata(&initramfs_path)
+                .is_ok_and(|metadata| metadata.is_regular_file())
             {
                 break Some(initramfs_path);
             }
@@ -162,20 +160,22 @@ pub fn scan(
 
     // Convert the device path root to a string we can use in the configuration.
     let mut root = root
-        .to_string(DisplayOnly(false), AllowShortcuts(false))
+        .to_string16(DisplayOnly(false), AllowShortcuts(false))
         .context("unable to convert device root to string")?
         .to_string();
     // Add a trailing forward-slash to the root to ensure the device root is completed.
     root.push('/');
 
     // Generate a unique hash of the root path.
-    let root_unique_hash = utils::unique_hash(&root);
+    let root_unique_hash = unique_hash(&root);
 
     // Scan all locations for kernel pairs, adding them to the list.
+    // A location that can't be scanned is skipped, so the other locations are still used.
     for location in SCAN_LOCATIONS {
-        let scanned = scan_directory(filesystem, location)
-            .with_context(|| format!("unable to scan directory {}", location))?;
-        pairs.extend(scanned);
+        match scan_directory(filesystem, location) {
+            Ok(scanned) => pairs.extend(scanned),
+            Err(error) => warn!("unable to scan directory {}: {:#}", location, error),
+        }
     }
 
     // If no kernel pairs were found, return false.
@@ -183,17 +183,15 @@ pub fn scan(
         return Ok(false);
     }
 
-    // Sort the kernel pairs by kernel version, if it has one, newer kernels first.
-    pairs.sort_by(|a, b| vercmp::compare_versions(&a.kernel, &b.kernel).reverse());
-
     // Generate a unique name for the linux chainload action.
-    let chainload_action_name = format!("{}{}", LINUX_CHAINLOAD_ACTION_PREFIX, root_unique_hash,);
+    let chainload_action_name = format!("{}{}", LINUX_CHAINLOAD_ACTION_PREFIX, root_unique_hash);
 
     // Kernel pairs are detected, generate a list configuration for it.
     let generator = ListConfiguration {
         entry: EntryDeclaration {
             title: "Boot Linux $name".to_string(),
             actions: vec![chainload_action_name.clone()],
+            sort_key: Some("$kernel".to_string()),
             ..Default::default()
         },
         values: pairs
@@ -238,6 +236,8 @@ pub fn scan(
         path: "$kernel".to_string(),
         options: vec!["$linux-options".to_string()],
         linux_initrd: Some("$initrd".to_string()),
+        linux_initrd_chain: vec![],
+        devicetree: None,
     };
 
     // Insert the chainload action into the configuration.

crates/boot/src/autoconfigure/windows.rs

@@ -1,9 +1,11 @@
-use crate::utils;
+use alloc::string::ToString;
+use alloc::{format, vec};
 use anyhow::{Context, Result};
 use edera_sprout_config::RootConfiguration;
 use edera_sprout_config::actions::ActionDeclaration;
 use edera_sprout_config::actions::chainload::ChainloadConfiguration;
 use edera_sprout_config::entries::EntryDeclaration;
+use edera_sprout_parsing::unique_hash;
 use uefi::CString16;
 use uefi::fs::{FileSystem, Path};
 use uefi::proto::device_path::DevicePath;
@@ -36,26 +38,27 @@ pub fn scan(
 
     // Convert the device path root to a string we can use in the configuration.
     let mut root = root
-        .to_string(DisplayOnly(false), AllowShortcuts(false))
+        .to_string16(DisplayOnly(false), AllowShortcuts(false))
         .context("unable to convert device root to string")?
         .to_string();
     // Add a trailing forward-slash to the root to ensure the device root is completed.
     root.push('/');
 
     // Generate a unique hash of the root path.
-    let root_unique_hash = utils::unique_hash(&root);
+    let root_unique_hash = unique_hash(&root);
 
     // Generate a unique name for the Windows chainload action.
     let chainload_action_name = format!("{}{}", WINDOWS_CHAINLOAD_ACTION_PREFIX, root_unique_hash,);
 
     // Generate an entry name for Windows.
-    let entry_name = format!("auto-windows-{}", root_unique_hash,);
+    let entry_name = format!("auto-windows-{}", root_unique_hash);
 
     // Create an entry for Windows and insert it into the configuration.
     let entry = EntryDeclaration {
         title: "Boot Windows".to_string(),
         actions: vec![chainload_action_name.clone()],
         values: Default::default(),
+        sort_key: None, // Use the default sort key.
     };
     config.entries.insert(entry_name, entry);
 

crates/boot/src/boot_counter.rs

@@ -0,0 +1,104 @@
+use alloc::{format, string::String};
+use anyhow::{Context, Result, anyhow, bail};
+use edera_sprout_bls::BootCounter;
+use uefi::{
+    CString16, Handle,
+    data_types::Align,
+    fs::PathBuf,
+    mem::AlignedBuffer,
+    proto::media::file::{File, FileAttribute, FileInfo, FileMode},
+    proto::media::fs::SimpleFileSystem,
+};
+
+/// The size of the fixed part of a file info: three sizes, three timestamps and the attributes.
+const FILE_INFO_HEADER_SIZE: usize = 3 * 8 + 3 * 16 + 8;
+
+/// Where the boot counter of an entry is stored, so that a try can be consumed when the
+/// entry is booted.
+#[derive(Clone)]
+pub struct BootCounterTarget {
+    /// The counter as it is currently encoded in the file name.
+    pub counter: BootCounter,
+    /// The handle of the filesystem that holds the entry file.
+    pub filesystem: Handle,
+    /// The directory that holds the entry file.
+    pub directory: PathBuf,
+    /// The entry id, which is the file name without the counter and extension.
+    pub id: String,
+    /// The current file name, including the counter and the extension.
+    pub file_name: String,
+    /// The extension of the file name, such as `.conf`, in its original case.
+    pub extension: String,
+    /// Whether booting the entry uses up a try. An entry whose tries are not used up still
+    /// has them, so it can be bad.
+    pub counting: bool,
+}
+
+impl BootCounterTarget {
+    /// Consumes one try by renaming the entry file, such as `foo+3.conf` to `foo+2-1.conf`.
+    /// The file is renamed in place without copying it, as unified kernel images are large and
+    /// a copy interrupted by a crash would leave a truncated image behind.
+    /// Returns the path of the renamed file.
+    pub fn consume(&self) -> Result<PathBuf> {
+        let new_name = format!(
+            "{}{}",
+            self.counter.decremented().render(&self.id),
+            self.extension
+        );
+        let new_name_16 =
+            CString16::try_from(new_name.as_str()).context("invalid new entry file name")?;
+
+        let mut fs = uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(self.filesystem)
+            .context("unable to open the entry filesystem")?;
+        let mut root = fs
+            .open_volume()
+            .context("unable to open the entry volume")?;
+
+        // Open the entry file for writing.
+        let mut from = self.directory.clone();
+        from.push(PathBuf::from(
+            CString16::try_from(self.file_name.as_str()).context("invalid entry file name")?,
+        ));
+        let from_name =
+            CString16::try_from(format!("{}", from).as_str()).context("invalid entry file path")?;
+        let handle = root
+            .open(&from_name, FileMode::ReadWrite, FileAttribute::empty())
+            .context("unable to open the entry file")?;
+        let mut file = handle
+            .into_regular_file()
+            .ok_or_else(|| anyhow!("the entry is not a regular file"))?;
+
+        // Renaming a file is done by setting its file info with a different name.
+        let info = file
+            .get_boxed_info::<FileInfo>()
+            .context("unable to get the entry file info")?;
+        // A read-only file is left as it is, as the counter is not meant to be changed.
+        if info.attribute().contains(FileAttribute::READ_ONLY) {
+            bail!("the entry file is read-only");
+        }
+        // The info is a fixed header followed by the null-terminated UCS-2 name.
+        let size =
+            FILE_INFO_HEADER_SIZE + 2 * (new_name.len() + 1) + <FileInfo as Align>::alignment();
+        let mut storage = AlignedBuffer::from_size_align(size, <FileInfo as Align>::alignment())
+            .context("unable to allocate the entry file info")?;
+        let renamed = FileInfo::new(
+            storage.as_slice_mut(),
+            info.file_size(),
+            info.physical_size(),
+            *info.create_time(),
+            *info.last_access_time(),
+            *info.modification_time(),
+            info.attribute(),
+            &new_name_16,
+        )
+        .map_err(|error| anyhow!("unable to build the renamed entry file info: {:?}", error))?;
+        file.set_info(renamed)
+            .context("unable to rename the entry file")?;
+        file.flush()
+            .context("unable to flush the renamed entry file")?;
+
+        let mut to = self.directory.clone();
+        to.push(PathBuf::from(new_name_16));
+        Ok(to)
+    }
+}

crates/boot/src/config/loader.rs

@@ -0,0 +1,131 @@
+use crate::options::SproutOptions;
+use alloc::format;
+use alloc::string::{String, ToString};
+use alloc::vec::Vec;
+use anyhow::{Context, Result, bail};
+use core::fmt::Display;
+use core::ops::Deref;
+use edera_sprout_config::{RootConfiguration, latest_version};
+use eficore::platform::tpm::PlatformTpm;
+use log::{info, warn};
+use serde_ignored::Path;
+use toml::Value;
+use uefi::proto::device_path::LoadedImageDevicePath;
+
+/// Loads the raw configuration from the sprout config file as data.
+fn load_raw_config(options: &SproutOptions) -> Result<Vec<u8>> {
+    // Open the LoadedImageDevicePath protocol to get the path to the current image.
+    let current_image_device_path_protocol =
+        uefi::boot::open_protocol_exclusive::<LoadedImageDevicePath>(uefi::boot::image_handle())
+            .context("unable to get loaded image device path")?;
+    // Acquire the device path as a boxed device path.
+    let path = current_image_device_path_protocol.deref().to_boxed();
+
+    info!("configuration file: {}", options.config);
+
+    // Read the contents of the sprout config file.
+    let content = eficore::path::read_file_contents(Some(&path), &options.config)
+        .context("unable to read sprout config file")?;
+
+    // Measure the sprout.toml into the TPM, if needed and possible.
+    PlatformTpm::log_event(
+        PlatformTpm::PCR_BOOT_LOADER_CONFIG,
+        &content,
+        "sprout: configuration file",
+    )
+    .context("unable to measure the sprout.toml file into the TPM")?;
+
+    // Return the contents of the sprout config file.
+    Ok(content)
+}
+
+/// Format the configuration key `path` with dots, like "actions.linux.chainload.path".
+fn key_path(path: &Path) -> String {
+    // Joins the `parent` path and the `key` with a dot, unless the parent is the root.
+    fn join(parent: &Path, key: impl Display) -> String {
+        match parent {
+            Path::Root => key.to_string(),
+            parent => format!("{}.{}", key_path(parent), key),
+        }
+    }
+
+    match path {
+        Path::Root => String::new(),
+        Path::Seq { parent, index } => join(parent, index),
+        Path::Map { parent, key } => join(parent, key),
+        // Optional values and wrapper types don't add a key of their own.
+        Path::Some { parent }
+        | Path::NewtypeStruct { parent }
+        | Path::NewtypeVariant { parent } => key_path(parent),
+    }
+}
+
+/// Warn about each declaration in `config` that configures more than one kind.
+/// For example, an action with both chainload and print configured only runs chainload.
+fn warn_multiple_kinds(config: &RootConfiguration) {
+    for (name, action) in &config.actions {
+        let kinds = [
+            action.chainload.is_some(),
+            action.print.is_some(),
+            action.edera.is_some(),
+        ];
+        if kinds.iter().filter(|kind| **kind).count() > 1 {
+            warn!(
+                "action {} configures more than one action, only one is used",
+                name
+            );
+        }
+    }
+
+    for (name, generator) in &config.generators {
+        let kinds = [
+            generator.matrix.is_some(),
+            generator.bls.is_some(),
+            generator.list.is_some(),
+        ];
+        if kinds.iter().filter(|kind| **kind).count() > 1 {
+            warn!(
+                "generator {} configures more than one generator, only one is used",
+                name
+            );
+        }
+    }
+}
+
+/// Loads the [RootConfiguration] for Sprout.
+pub fn load(options: &SproutOptions) -> Result<RootConfiguration> {
+    // Load the raw configuration from the sprout config file.
+    let content = load_raw_config(options)?;
+    // Parse the raw configuration into a toml::Value which can represent any TOML file.
+    let value: Value = toml::from_slice(&content).context("unable to parse sprout config file")?;
+
+    // Check the version of the configuration without parsing the full configuration.
+    let version = value
+        .get("version")
+        .cloned()
+        .unwrap_or_else(|| Value::Integer(latest_version() as i64));
+
+    // Parse the version into an u32.
+    let version: u32 = version
+        .try_into()
+        .context("unable to get configuration version")?;
+
+    // Check if the version is supported.
+    if version != latest_version() {
+        bail!("unsupported configuration version: {}", version);
+    }
+
+    // If the version is supported, parse the full configuration.
+    // Keys that aren't part of the configuration, such as misspelled keys, are ignored.
+    // Warn about each one, as the configuration may not do what was intended.
+    let config: RootConfiguration = serde_ignored::deserialize(value, |path| {
+        warn!("ignoring unknown configuration key: {}", key_path(&path));
+    })
+    .context("unable to parse sprout.toml file")?;
+
+    // Warn about declarations that configure more than one kind, as only one is used.
+    warn_multiple_kinds(&config);
+
+    // Return the parsed configuration.
+    Ok(config)
+}

crates/boot/src/context.rs

@@ -1,16 +1,24 @@
 use crate::options::SproutOptions;
-use crate::platform::timer::PlatformTimer;
+use alloc::boxed::Box;
+use alloc::collections::{BTreeMap, BTreeSet};
+use alloc::rc::Rc;
+use alloc::string::{String, ToString};
+use alloc::vec::Vec;
 use anyhow::anyhow;
 use anyhow::{Result, bail};
 use edera_sprout_config::actions::ActionDeclaration;
-use std::cmp::Reverse;
-use std::collections::{BTreeMap, BTreeSet};
-use std::rc::Rc;
+use edera_sprout_parsing::stamp_values;
+use eficore::platform::timer::PlatformTimer;
 use uefi::proto::device_path::DevicePath;
 
 /// The maximum number of iterations that can be performed in [SproutContext::finalize].
 const CONTEXT_FINALIZE_ITERATION_LIMIT: usize = 100;
 
+/// The maximum length of a value produced by [SproutContext::finalize].
+/// A value that refers to itself more than once doubles in length on every iteration,
+/// so this stops it from using up all memory before the iteration limit is reached.
+const CONTEXT_FINALIZE_VALUE_LENGTH_LIMIT: usize = 64 * 1024;
+
 /// Declares a root context for Sprout.
 /// This contains data that needs to be shared across Sprout.
 pub struct RootContext {
@@ -193,11 +201,15 @@ impl SproutContext {
             let mut did_change = false;
             let mut values = BTreeMap::new();
             for (key, value) in &current_values {
-                let (changed, result) = Self::stamp_values(&current_values, value);
+                let (changed, result) = stamp_values(&current_values, value);
                 if changed {
                     // If the value changed, we need to re-stamp it.
                     did_change = true;
                 }
+                // Ensure the value has not grown without bound.
+                if result.len() > CONTEXT_FINALIZE_VALUE_LENGTH_LIMIT {
+                    bail!("value {} is too long while finalizing context", key);
+                }
                 // Insert the new value into the value map.
                 values.insert(key.clone(), result);
             }
@@ -217,52 +229,32 @@ impl SproutContext {
         })
     }
 
-    /// Stamps the `text` value with the specified `values` map. The returned value indicates
-    /// whether the `text` has been changed and the value that was stamped and changed.
-    ///
-    /// Stamping works like this:
-    /// - Start with the input text.
-    /// - Sort all the keys in reverse length order (longest keys first)
-    /// - For each key, if the key is not empty, replace $KEY in the text.
-    /// - Each follow-up iteration acts upon the last iterations result.
-    /// - We keep track if the text changes during the replacement.
-    /// - We return both whether the text changed during any iteration and the final result.
-    fn stamp_values(values: &BTreeMap<String, String>, text: impl AsRef<str>) -> (bool, String) {
-        let mut result = text.as_ref().to_string();
-        let mut did_change = false;
-
-        // Sort the keys by length. This is to ensure that we stamp the longest keys first.
-        // If we did not do this, "$abc" could be stamped by "$a" into an invalid result.
-        let mut keys = values.keys().collect::<Vec<_>>();
-
-        // Sort by key length, reversed. This results in the longest keys appearing first.
-        keys.sort_by_key(|key| Reverse(key.len()));
-
-        for key in keys {
-            // Empty keys are not supported.
-            if key.is_empty() {
-                continue;
-            }
-
-            // We can fetch the value from the map. It is verifiable that the key exists.
-            let Some(value) = values.get(key) else {
-                unreachable!("keys iterated over is collected on a map that cannot be modified");
-            };
-
-            let next_result = result.replace(&format!("${key}"), value);
-            if result != next_result {
-                did_change = true;
-            }
-            result = next_result;
-        }
-        (did_change, result)
-    }
-
     /// Stamps the input `text` with all the values in this [SproutContext] and it's parents.
     /// For example, if this context contains {"a":"b"}, and the text "hello\\$a", it will produce
     /// "hello\\b" as an output string.
     pub fn stamp(&self, text: impl AsRef<str>) -> String {
-        Self::stamp_values(&self.all_values(), text.as_ref()).1
+        // A value can refer to other values, which a single pass leaves unresolved when the
+        // key it refers to was already handled. Stamp until the text settles, up to the same
+        // limit that finalizing a context uses.
+        let values = self.all_values();
+        let mut result = text.as_ref().to_string();
+        for _ in 0..CONTEXT_FINALIZE_ITERATION_LIMIT {
+            let (changed, stamped) = stamp_values(&values, &result);
+            result = stamped;
+            if !changed || result.len() > CONTEXT_FINALIZE_VALUE_LENGTH_LIMIT {
+                break;
+            }
+        }
+        result
+    }
+
+    /// Stamps all the items from the iterator `input` with all the values in this [SproutContext]
+    /// and it's parents. This calls [self.stamp] on each item.
+    pub fn stamp_iter(
+        &self,
+        input: impl Iterator<Item = impl AsRef<str>>,
+    ) -> impl Iterator<Item = String> {
+        input.map(|item| self.stamp(item))
     }
 
     /// Unloads a [SproutContext] back into an owned context. This

crates/boot/src/drivers.rs

@@ -0,0 +1,121 @@
+use crate::context::SproutContext;
+use alloc::collections::BTreeMap;
+use alloc::format;
+use alloc::rc::Rc;
+use alloc::string::String;
+use alloc::vec::Vec;
+use anyhow::{Context, Result};
+use edera_sprout_config::drivers::{DriverDeclaration, DriverProvides};
+use eficore::loader::source::ImageSource;
+use eficore::loader::{ImageLoadRequest, ImageLoader};
+use log::info;
+use uefi::boot::SearchType;
+use uefi::proto::media::block::BlockIO;
+use uefi::proto::media::disk::{DiskIo, DiskIo2};
+use uefi::{Handle, Identify};
+
+/// Loads the driver specified by the `driver` declaration.
+fn load_driver(context: Rc<SproutContext>, driver: &DriverDeclaration) -> Result<()> {
+    // Acquire the handle and device path of the loaded image.
+    let sprout_image = uefi::boot::image_handle();
+
+    // Resolve the path to the driver image.
+    let resolved = eficore::path::resolve_path(
+        Some(context.root().loaded_image_path()?),
+        context.stamp(&driver.path),
+    )
+    .context("unable to resolve path to driver")?;
+
+    // Create an image load request with the current image and the resolved path.
+    let request = ImageLoadRequest::new(sprout_image, ImageSource::ResolvedPath(&resolved));
+
+    // Load the driver image using the image loader support module.
+    // It will determine if the image needs to be loaded via the shim or can be loaded directly.
+    let image = ImageLoader::load(request)?;
+
+    // Start the driver image, this is expected to return control to sprout.
+    // There is no guarantee that the driver will actually return control as it is
+    // just a standard EFI image.
+    uefi::boot::start_image(*image.handle()).context("unable to start driver image")?;
+
+    Ok(())
+}
+
+/// Locates the handles that are disks or partitions.
+/// These are the only controllers that filesystem drivers can bind to.
+fn locate_storage_handles() -> Result<Vec<Handle>> {
+    let mut storage = Vec::new();
+    for guid in [&BlockIO::GUID, &DiskIo::GUID, &DiskIo2::GUID] {
+        // Not finding any handles for a protocol is not an error.
+        let Ok(handles) = uefi::boot::locate_handle_buffer(SearchType::ByProtocol(guid)) else {
+            continue;
+        };
+        for handle in handles.iter() {
+            if !storage.contains(handle) {
+                storage.push(*handle);
+            }
+        }
+    }
+    Ok(storage)
+}
+
+/// Reconnects handles to their controllers.
+/// This is effectively a UEFI stack reload in a sense.
+/// After we load all the drivers, we need to reconnect their handles
+/// so that filesystems are recognized again.
+/// When `provides` is [`DriverProvides::Filesystems`], only disk and partition handles are reconnected.
+fn reconnect(provides: DriverProvides) -> Result<()> {
+    // Locate the handles to reconnect in the UEFI stack.
+    let handles = match provides {
+        DriverProvides::Any => uefi::boot::locate_handle_buffer(SearchType::AllHandles)
+            .context("unable to locate handles buffer")?
+            .iter()
+            .copied()
+            .collect(),
+        DriverProvides::Filesystems => locate_storage_handles()?,
+    };
+
+    for handle in handles {
+        // Ignore the result as there is nothing we can do if reconnecting a controller fails.
+        // This is also likely to fail in some cases but should fail safely.
+        let _ = uefi::boot::connect_controller(handle, &[], None, true);
+    }
+
+    Ok(())
+}
+
+/// Load all the drivers specified in `drivers`.
+/// There is no driver order currently. This will reconnect the controllers
+/// if at least one driver was loaded. Every controller is reconnected unless all
+/// the drivers only provide filesystems, in which case only storage is reconnected.
+pub fn load(
+    context: Rc<SproutContext>,
+    drivers: &BTreeMap<String, DriverDeclaration>,
+) -> Result<()> {
+    // If there are no drivers, we don't need to do anything.
+    if drivers.is_empty() {
+        return Ok(());
+    }
+
+    info!("loading drivers");
+
+    // Load all the drivers in no particular order.
+    for (name, driver) in drivers {
+        load_driver(context.clone(), driver).context(format!("unable to load driver: {}", name))?;
+    }
+
+    // Reconnect everything if any driver can provide anything, otherwise only storage.
+    let provides = if drivers
+        .values()
+        .all(|driver| driver.provides == DriverProvides::Filesystems)
+    {
+        DriverProvides::Filesystems
+    } else {
+        DriverProvides::Any
+    };
+    reconnect(provides).context("unable to reconnect drivers")?;
+    info!("loaded drivers");
+
+    // We've now loaded all the drivers, so we can return.
+    Ok(())
+}

crates/boot/src/entries.rs

@@ -0,0 +1,249 @@
+use crate::boot_counter::BootCounterTarget;
+use crate::context::SproutContext;
+use alloc::format;
+use alloc::rc::Rc;
+use alloc::string::{String, ToString};
+use edera_sprout_bls::profile_entry_id;
+use edera_sprout_config::entries::EntryDeclaration;
+use edera_sprout_parsing::{fnmatch_ignore_case, glob_match};
+
+/// Represents an entry that is stamped and ready to be booted.
+#[derive(Clone)]
+pub struct BootableEntry {
+    name: String,
+    title: String,
+    context: Rc<SproutContext>,
+    declaration: EntryDeclaration,
+    default: bool,
+    pin_name: bool,
+    sort_key: Option<String>,
+    boot_counter: Option<BootCounterTarget>,
+    id_suffix: Option<String>,
+    id_profile: Option<String>,
+    extra_profile: bool,
+}
+
+impl BootableEntry {
+    /// Create a new bootable entry to represent the full context of an entry.
+    pub fn new(
+        name: String,
+        title: String,
+        context: Rc<SproutContext>,
+        declaration: EntryDeclaration,
+    ) -> Self {
+        Self {
+            name,
+            title,
+            context,
+            declaration,
+            default: false,
+            pin_name: false,
+            sort_key: None,
+            boot_counter: None,
+            id_suffix: None,
+            id_profile: None,
+            extra_profile: false,
+        }
+    }
+
+    /// Fetch the name of the entry. This is usually a machine-identifiable key.
+    pub fn name(&self) -> &str {
+        &self.name
+    }
+
+    /// Fetch the id of the entry, which is how the bootloader interface refers to it.
+    /// A BLS entry has the id systemd-boot gives it: the name with the file extension, such as
+    /// `fedora.conf`, in lower case. Any other entry has its name as the id.
+    pub fn id(&self) -> String {
+        match self.id_suffix {
+            Some(ref suffix) => {
+                let file = format!("{}{}", self.sort_name(), suffix);
+                profile_entry_id(&file, self.id_profile.as_deref())
+            }
+            None => self.name.clone(),
+        }
+    }
+
+    /// Fetch the name of the entry without the profile of a unified kernel image, which is
+    /// the same for every profile of the same image.
+    pub fn sort_name(&self) -> &str {
+        self.id_profile
+            .as_deref()
+            .and_then(|profile| {
+                self.name
+                    .strip_suffix(profile)
+                    .and_then(|name| name.strip_suffix('@'))
+            })
+            .unwrap_or(&self.name)
+    }
+
+    /// Fetch whether the entry is a profile of a unified kernel image after the first, which
+    /// is never picked as the default entry unless it was asked for.
+    pub fn is_extra_profile(&self) -> bool {
+        self.id_profile.is_some() || self.extra_profile
+    }
+
+    /// Mark this entry as booting a profile of a unified kernel image after the first.
+    pub fn mark_extra_profile(&mut self) {
+        self.extra_profile = true;
+    }
+
+    /// Set the profile of a unified kernel image that is part of the id of this entry.
+    pub fn set_id_profile(&mut self, profile: &str) {
+        self.id_profile = Some(profile.to_string());
+    }
+
+    /// Set the file extension that is part of the id of this entry, such as `.conf`.
+    pub fn set_id_suffix(&mut self, suffix: &str) {
+        self.id_suffix = Some(suffix.to_string());
+    }
+
+    /// Fetch the title of the entry. This is usually a human-readable key.
+    pub fn title(&self) -> &str {
+        &self.title
+    }
+
+    /// Fetch the full context of the entry.
+    pub fn context(&self) -> Rc<SproutContext> {
+        Rc::clone(&self.context)
+    }
+
+    /// Fetch the declaration of the entry.
+    pub fn declaration(&self) -> &EntryDeclaration {
+        &self.declaration
+    }
+
+    /// Fetch whether the entry is the default entry.
+    pub fn is_default(&self) -> bool {
+        self.default
+    }
+
+    /// Fetch whether the entry is pinned, which prevents prefixing.
+    pub fn is_pin_name(&self) -> bool {
+        self.pin_name
+    }
+
+    /// Swap out the context of the entry.
+    pub fn swap_context(&mut self, context: Rc<SproutContext>) {
+        self.context = context;
+    }
+
+    /// Restamp the title with the current context.
+    pub fn restamp_title(&mut self) {
+        self.title = self.context.stamp(&self.title);
+    }
+
+    /// Restamp the declared sort key with the current context.
+    /// A sort key that was set on this entry directly is left as is.
+    pub fn restamp_sort_key(&mut self) {
+        if self.sort_key.is_none()
+            && let Some(ref sort_key) = self.declaration.sort_key
+        {
+            self.sort_key = Some(self.context.stamp(sort_key));
+        }
+    }
+
+    /// Mark this entry as the default entry.
+    pub fn mark_default(&mut self) {
+        self.default = true;
+    }
+
+    // Unmark this entry as the default entry.
+    pub fn unmark_default(&mut self) {
+        self.default = false;
+    }
+
+    /// Mark this entry as being pinned, which prevents prefixing.
+    pub fn mark_pin_name(&mut self) {
+        self.pin_name = true;
+    }
+
+    /// Record where the boot counter of this entry is stored.
+    pub fn set_boot_counter(&mut self, target: BootCounterTarget) {
+        self.boot_counter = Some(target);
+    }
+
+    /// Fetch where the boot counter of this entry is stored, if it has one.
+    pub fn boot_counter(&self) -> Option<&BootCounterTarget> {
+        self.boot_counter.as_ref()
+    }
+
+    /// Fetch whether the entry has a boot counter with no tries left.
+    pub fn is_bad(&self) -> bool {
+        self.boot_counter
+            .as_ref()
+            .is_some_and(|target| target.counter.is_bad())
+    }
+
+    /// Prepend the name of the entry with `prefix`.
+    pub fn prepend_name_prefix(&mut self, prefix: &str) {
+        self.name.insert_str(0, prefix);
+    }
+
+    /// Determine if this entry matches `needle` by comparing to the name or title of the entry.
+    /// The `needle` is a glob pattern, where `*` matches any sequence of characters.
+    /// A `needle` without any `*` must equal the name or title exactly.
+    pub fn is_match(&self, needle: &str) -> bool {
+        glob_match(needle, &self.name) || glob_match(needle, &self.title)
+    }
+
+    /// Determine if this entry matches `needle` by comparing to the id or the name of the entry,
+    /// so that both `fedora.conf` and `fedora` select the entry. This is how loader.conf and the
+    /// bootloader interface select entries, so the `needle` is a pattern that is matched ignoring
+    /// case and supports `*`, `?` and `[a-z]`.
+    pub fn is_match_id(&self, needle: &str) -> bool {
+        fnmatch_ignore_case(needle, &self.id()) || fnmatch_ignore_case(needle, &self.name)
+    }
+
+    /// Create a variant of this entry, with the name suffixed by `suffix` and using `context`.
+    /// The actions of the entry are stamped with `context` when the entry is booted.
+    /// Variants of the same entry keep the sort key of this entry, so they stay grouped
+    /// together in the order they were created in.
+    pub fn variant(&self, suffix: &str, context: Rc<SproutContext>) -> Self {
+        let mut entry = self.clone();
+        entry.name.push_str(suffix);
+        // Without any sort key, the name is used to sort, which differs between variants.
+        // Pin the sort key to the name of this entry to keep the variants together.
+        if entry.sort_key.is_none() && entry.declaration.sort_key.is_none() {
+            entry.sort_key = Some(self.name.clone());
+        }
+        entry.context = context;
+        entry
+    }
+
+    /// Set the sort key of the entry. This is used to sort entries via version comparison.
+    pub fn set_sort_key(&mut self, sort_key: String) {
+        self.sort_key = Some(sort_key);
+    }
+
+    /// Retrieve a reference to the sort key of the entry. If one is not specified, we will use the
+    /// name of the entry.
+    pub fn sort_key(&self) -> &str {
+        // Use the sort key specified in the bootable entry, or use the declaration sort key,
+        // or use the name of the entry.
+        self.sort_key
+            .as_deref()
+            .or(self.declaration.sort_key.as_deref())
+            .unwrap_or(&self.name)
+    }
+
+    /// Find the first entry that matches `needle` by id inside the entry iterator `haystack`.
+    pub fn find_id<'a>(
+        needle: &str,
+        haystack: impl Iterator<Item = &'a BootableEntry>,
+    ) -> Option<&'a BootableEntry> {
+        haystack.into_iter().find(|entry| entry.is_match_id(needle))
+    }
+
+    /// Find an entry by `needle` inside the entry iterator `haystack`.
+    /// This will search for an entry by name, title, or index.
+    pub fn find<'a>(
+        needle: &str,
+        haystack: impl Iterator<Item = &'a BootableEntry>,
+    ) -> Option<&'a BootableEntry> {
+        haystack
+            .enumerate()
+            .find(|(index, entry)| entry.is_match(needle) || index.to_string() == needle)
+            .map(|(_index, entry)| entry)
+    }
+}

crates/boot/src/extractors.rs

@@ -1,7 +1,8 @@
 use crate::context::SproutContext;
+use alloc::rc::Rc;
+use alloc::string::String;
 use anyhow::{Result, bail};
 use edera_sprout_config::extractors::ExtractorDeclaration;
-use std::rc::Rc;
 
 /// The filesystem device match extractor.
 pub mod filesystem_device_match;

crates/boot/src/extractors/filesystem_device_match.rs

@@ -0,0 +1,178 @@
+use crate::context::SproutContext;
+use alloc::rc::Rc;
+use alloc::string::String;
+use anyhow::{Context, Result, anyhow, bail};
+use core::ops::Deref;
+use core::str::FromStr;
+use edera_sprout_config::extractors::filesystem_device_match::FilesystemDeviceMatchExtractor;
+use eficore::partition::PartitionGuidForm;
+use log::warn;
+use uefi::fs::{FileSystem, Path};
+use uefi::proto::device_path::DevicePath;
+use uefi::proto::media::file::{File, FileSystemVolumeLabel};
+use uefi::proto::media::fs::SimpleFileSystem;
+use uefi::{CString16, Guid, Handle};
+
+/// Check whether the filesystem at `handle` matches all the criteria of the `extractor`
+/// configuration inside the `context`. The partition UUIDs are parsed ahead of time into
+/// `partition_uuid` and `partition_type_uuid`.
+fn is_match(
+    context: &Rc<SproutContext>,
+    extractor: &FilesystemDeviceMatchExtractor,
+    handle: Handle,
+    partition_uuid: Option<Guid>,
+    partition_type_uuid: Option<Guid>,
+) -> Result<bool> {
+    // Check if the partition info matches partition uuid criteria.
+    if let Some(parsed_uuid) = partition_uuid {
+        // Fetch the root of the device.
+        let root = uefi::boot::open_protocol_exclusive::<DevicePath>(handle)
+            .context("unable to fetch the device path of the filesystem")?
+            .deref()
+            .to_boxed();
+
+        // Fetch the partition uuid for this filesystem.
+        let partition_uuid =
+            eficore::partition::partition_guid(&root, PartitionGuidForm::Partition)
+                .context("unable to fetch the partition uuid of the filesystem")?;
+
+        // Compare the partition uuid to the parsed uuid.
+        if partition_uuid != Some(parsed_uuid) {
+            return Ok(false);
+        }
+    }
+
+    // Check if the partition info matches partition type uuid criteria.
+    if let Some(parsed_uuid) = partition_type_uuid {
+        // Fetch the root of the device.
+        let root = uefi::boot::open_protocol_exclusive::<DevicePath>(handle)
+            .context("unable to fetch the device path of the filesystem")?
+            .deref()
+            .to_boxed();
+
+        // Fetch the partition type uuid for this filesystem.
+        let partition_type_uuid =
+            eficore::partition::partition_guid(&root, PartitionGuidForm::PartitionType)
+                .context("unable to fetch the partition uuid of the filesystem")?;
+
+        // Compare the partition type uuid to the parsed uuid.
+        if partition_type_uuid != Some(parsed_uuid) {
+            return Ok(false);
+        }
+    }
+
+    // The remaining criteria need the filesystem itself.
+    if extractor.has_label.is_none() && extractor.has_item.is_none() {
+        return Ok(true);
+    }
+
+    // Open the filesystem protocol for this handle.
+    let mut filesystem = uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(handle)
+        .context("unable to open filesystem protocol")?;
+
+    // Check if the filesystem matches label criteria.
+    if let Some(ref label) = extractor.has_label {
+        let want_label = CString16::try_from(context.stamp(label).as_str())
+            .context("unable to convert label to CString16")?;
+        let mut root = filesystem
+            .open_volume()
+            .context("unable to open filesystem volume")?;
+        let label = root
+            .get_boxed_info::<FileSystemVolumeLabel>()
+            .context("unable to get filesystem volume label")?;
+
+        if label.volume_label() != want_label {
+            return Ok(false);
+        }
+    }
+
+    // Check if the filesystem matches item criteria.
+    if let Some(ref item) = extractor.has_item {
+        let want_item = CString16::try_from(context.stamp(item).as_str())
+            .context("unable to convert item to CString16")?;
+        let mut filesystem = FileSystem::new(filesystem);
+
+        // Check the metadata of the item.
+        // Ignore filesystem errors as we can't do anything useful with the error.
+        let Some(metadata) = filesystem.metadata(Path::new(&want_item)).ok() else {
+            return Ok(false);
+        };
+
+        // Only check directories and files.
+        if !(metadata.is_directory() || metadata.is_regular_file()) {
+            return Ok(false);
+        }
+    }
+
+    Ok(true)
+}
+
+/// Extract a filesystem device path using the specified `context` and `extractor` configuration.
+pub fn extract(
+    context: Rc<SproutContext>,
+    extractor: &FilesystemDeviceMatchExtractor,
+) -> Result<String> {
+    // If no criteria are provided, bail with an error.
+    if extractor.has_label.is_none()
+        && extractor.has_item.is_none()
+        && extractor.has_partition_uuid.is_none()
+        && extractor.has_partition_type_uuid.is_none()
+    {
+        bail!("at least one criteria is required for filesystem-device-match");
+    }
+
+    // Parse the partition uuid from the extractor.
+    let partition_uuid = extractor
+        .has_partition_uuid
+        .as_deref()
+        .map(Guid::from_str)
+        .transpose()
+        .map_err(|e| anyhow!("unable to parse has-partition-uuid: {}", e))?;
+
+    // Parse the partition type uuid from the extractor.
+    let partition_type_uuid = extractor
+        .has_partition_type_uuid
+        .as_deref()
+        .map(Guid::from_str)
+        .transpose()
+        .map_err(|e| anyhow!("unable to parse has-partition-type-uuid: {}", e))?;
+
+    // Find all the filesystems inside the UEFI stack.
+    let handles = uefi::boot::find_handles::<SimpleFileSystem>()
+        .context("unable to find filesystem handles")?;
+
+    // Iterate over all the filesystems and check if they match the criteria.
+    for handle in handles {
+        // A filesystem that can't be checked is skipped, as it should not prevent
+        // finding a match on the other filesystems or using the fallback value.
+        match is_match(
+            &context,
+            extractor,
+            handle,
+            partition_uuid,
+            partition_type_uuid,
+        ) {
+            Ok(true) => {}
+            Ok(false) => continue,
+            Err(error) => {
+                warn!("skipping filesystem, unable to check it: {:#}", error);
+                continue;
+            }
+        }
+
+        // If we have a match, return the device root path.
+        let path = uefi::boot::open_protocol_exclusive::<DevicePath>(handle)
+            .context("unable to open filesystem device path")?;
+        let path = path.deref();
+        // Acquire the device path root as a string.
+        return eficore::path::device_path_root(path).context("unable to get device path root");
+    }
+
+    // If there is a fallback value, use it at this point.
+    if let Some(fallback) = &extractor.fallback {
+        return Ok(fallback.clone());
+    }
+
+    // Without a fallback, we can't continue, so bail.
+    bail!("unable to find matching filesystem")
+}

crates/boot/src/generators.rs

@@ -0,0 +1,125 @@
+use crate::context::SproutContext;
+use crate::entries::BootableEntry;
+use alloc::collections::BTreeSet;
+use alloc::format;
+use alloc::rc::Rc;
+use alloc::string::String;
+use alloc::vec::Vec;
+use anyhow::Result;
+use anyhow::bail;
+use edera_sprout_config::generators::GeneratorDeclaration;
+use edera_sprout_parsing::{build_variants, rule_matches};
+
+/// The BLS generator.
+pub mod bls;
+
+/// The list generator.
+pub mod list;
+
+/// The matrix generator.
+pub mod matrix;
+
+/// Runs the generator kind specified by the `generator` option.
+fn generate_base(
+    context: Rc<SproutContext>,
+    generator: &GeneratorDeclaration,
+) -> Result<Vec<BootableEntry>> {
+    if let Some(matrix) = &generator.matrix {
+        matrix::generate(context, matrix)
+    } else if let Some(bls) = &generator.bls {
+        bls::generate(context, bls)
+    } else if let Some(list) = &generator.list {
+        list::generate(context, list)
+    } else {
+        bail!("unknown generator configuration");
+    }
+}
+
+/// Multiplies `entries` by every combination of the variants in `generator`.
+fn apply_variants(
+    entries: Vec<BootableEntry>,
+    generator: &GeneratorDeclaration,
+) -> Result<Vec<BootableEntry>> {
+    // Without any variants, the entries are used as-is.
+    if generator.variants.is_empty() {
+        return Ok(entries);
+    }
+
+    // Validate the axes, as an axis without choices would silently produce no entries,
+    // and duplicate choice names would produce entries with the same name.
+    let mut axes = Vec::new();
+    for (axis, choices) in &generator.variants {
+        if choices.is_empty() {
+            bail!("variant axis '{}' has no choices", axis);
+        }
+        let mut seen = BTreeSet::new();
+        for choice in choices {
+            if !seen.insert(choice.name.as_str()) {
+                bail!(
+                    "variant axis '{}' has more than one choice named '{}'",
+                    axis,
+                    choice.name
+                );
+            }
+        }
+        axes.push((
+            axis.clone(),
+            choices
+                .iter()
+                .map(|choice| (choice.name.clone(), choice.values.clone()))
+                .collect(),
+        ));
+    }
+
+    let combinations = build_variants(&axes);
+    let mut result = Vec::with_capacity(entries.len() * combinations.len());
+    for entry in &entries {
+        for combination in &combinations {
+            let mut context = entry.context().fork();
+            context.insert(&combination.values);
+            let suffix: String = combination
+                .names
+                .iter()
+                .map(|name| format!("-{}", name))
+                .collect();
+            result.push(entry.variant(&suffix, context.freeze()));
+        }
+    }
+    Ok(result)
+}
+
+/// Runs the generator specified by the `generator` option, named `name`.
+/// It uses the specified `context` as the parent context for
+/// the generated entries, injecting more values if needed.
+/// Entry names are prefixed with the generator name unless pinned,
+/// then variants are applied, and then excluded entries are removed.
+pub fn generate(
+    name: &str,
+    context: Rc<SproutContext>,
+    generator: &GeneratorDeclaration,
+) -> Result<Vec<BootableEntry>> {
+    let mut entries = generate_base(context, generator)?;
+
+    // We will prefix all entries with [name]-, provided the name is not pinned.
+    let prefix = format!("{}-", name);
+    for entry in &mut entries {
+        if !entry.is_pin_name() {
+            entry.prepend_name_prefix(&prefix);
+        }
+    }
+
+    let mut entries = apply_variants(entries, generator)?;
+
+    // Remove any entries that match an exclusion rule.
+    if !generator.exclude.is_empty() {
+        entries.retain(|entry| {
+            let values = entry.context().all_values();
+            !generator
+                .exclude
+                .iter()
+                .any(|rule| rule_matches(rule, &values))
+        });
+    }
+
+    Ok(entries)
+}

crates/boot/src/generators/bls.rs

@@ -0,0 +1,589 @@
+use crate::boot_counter::BootCounterTarget;
+use crate::context::SproutContext;
+use crate::entries::BootableEntry;
+use alloc::{
+    format,
+    rc::Rc,
+    string::{String, ToString},
+    vec::Vec,
+};
+use anyhow::{Context, Result};
+use core::sync::atomic::{AtomicBool, Ordering as AtomicOrdering};
+use core::{cmp::Ordering, str::FromStr};
+use edera_sprout_bls::{
+    BlsEntry, BootCounter, is_reserved_entry_name, profile_id_suffix, sort_bls, strip_extension,
+};
+use edera_sprout_config::generators::bls::BlsConfiguration;
+use log::{info, warn};
+use uefi::{
+    CString16, cstr16,
+    fs::{FileSystem, PathBuf},
+    proto::device_path::text::{AllowShortcuts, DisplayOnly},
+    proto::media::fs::SimpleFileSystem,
+};
+
+mod uki;
+
+/// The PE machine type of the images that can boot on this machine.
+#[cfg(target_arch = "x86_64")]
+const PE_MACHINE: u16 = edera_sprout_bls::PE_MACHINE_X86_64;
+/// The PE machine type of the images that can boot on this machine.
+#[cfg(target_arch = "aarch64")]
+const PE_MACHINE: u16 = edera_sprout_bls::PE_MACHINE_AARCH64;
+
+/// The name of the architecture of this machine in BLS entries.
+#[cfg(target_arch = "x86_64")]
+const ARCHITECTURE: &str = "x64";
+/// The name of the architecture of this machine in BLS entries.
+#[cfg(target_arch = "aarch64")]
+const ARCHITECTURE: &str = "aa64";
+
+/// Whether the extended boot loader partition was added by a generator in strict mode, which
+/// does it once, so that more than one generator does not list its entries twice.
+static STRICT_XBOOTLDR_ADDED: AtomicBool = AtomicBool::new(false);
+
+/// The number of initrd slots set on each BLS entry.
+/// Entries set `initrd-0` through `initrd-31`, and slots without an initrd are empty.
+pub const BLS_INITRD_SLOTS: usize = 32;
+
+// TODO(azenla): remove this once variable substitution is implemented.
+/// This function is used to remove the `tuned_initrd` variable from the initrd paths.
+/// Fedora uses tuned which adds an initrd that shouldn't be used.
+fn quirk_initrd_remove_tuned(paths: Vec<String>) -> Vec<String> {
+    paths
+        .into_iter()
+        .filter(|path| path != "$tuned_initrd")
+        .collect()
+}
+
+/// Sorts two entries according to the BLS sort system.
+/// Reference: <https://uapi-group.org/specifications/specs/boot_loader_specification/#sorting>
+fn sort_entries(a: &(BlsEntry, BootableEntry), b: &(BlsEntry, BootableEntry)) -> Ordering {
+    let (a_bls, a_boot) = a;
+    let (b_bls, b_boot) = b;
+    sort_bls(a_bls, a_boot.sort_name(), b_bls, b_boot.sort_name())
+}
+
+/// Produces the bootable entry for the BLS `entry` with the id `name` and the `initrds`.
+fn bootable_entry(
+    context: &Rc<SproutContext>,
+    bls: &BlsConfiguration,
+    name: &str,
+    entry: &BlsEntry,
+    initrds: &[String],
+    entry_root: &str,
+) -> BootableEntry {
+    // Produce a new sprout context for the entry with the extracted values.
+    let mut context = context.fork();
+
+    let title_base = entry.title().unwrap_or_else(|| name.to_string());
+    let chainload = entry.chainload_path().unwrap_or_default();
+    let options = entry.chainload_options().unwrap_or_default();
+    let version = entry.version().unwrap_or_default();
+    let machine_id = entry.machine_id().unwrap_or_default();
+
+    // Combine the title with the version if a version is present, except if it already contains it.
+    // Sometimes BLS will have a version in the title already, and this makes it unique.
+    let title_full = if !version.is_empty() && !title_base.contains(&version) {
+        format!("{} {}", title_base, version)
+    } else {
+        title_base.clone()
+    };
+
+    // The device that the files of the entry are on, for a path like "$entry-root\\$chainload".
+    // It is empty for the partition that Sprout was loaded from.
+    context.set("entry-root", entry_root.to_string());
+    context.set("title-base", title_base);
+    context.set("title", title_full);
+    context.set("chainload", chainload);
+    context.set("options", options);
+    // The command line and kernel version embedded in a unified kernel image.
+    context.set("cmdline", entry.cmdline.clone().unwrap_or_default());
+    context.set("devicetree", entry.devicetree_path().unwrap_or_default());
+    context.set("uname", entry.uname.clone().unwrap_or_default());
+    // The initrd value keeps the last initrd, which is what it held before
+    // multiple initrds were supported.
+    context.set("initrd", initrds.last().cloned().unwrap_or_default());
+
+    // Set every initrd slot, even the unused ones. An unset slot would let "$initrd-1"
+    // match "$initrd" instead, producing the initrd value followed by "-1".
+    for slot in 0..BLS_INITRD_SLOTS {
+        context.set(
+            format!("initrd-{}", slot),
+            initrds.get(slot).cloned().unwrap_or_default(),
+        );
+    }
+
+    context.set("version", version);
+    context.set("machine-id", machine_id);
+
+    // Produce a new bootable entry.
+    let mut boot = BootableEntry::new(
+        name.to_string(),
+        bls.entry.title.clone(),
+        context.freeze(),
+        bls.entry.clone(),
+    );
+
+    // Pin the entry name to prevent prefixing.
+    // This is needed as the bootloader interface requires the name to be
+    // the same as the entry file name, minus the .conf extension.
+    if bls.pin_names {
+        boot.mark_pin_name();
+    }
+
+    boot
+}
+
+/// Generates the BLS Type #1 entries from the entries directory under `path`.
+/// The conversion is best-effort and will ignore any unsupported entries.
+fn generate_type1(
+    context: &Rc<SproutContext>,
+    bls: &BlsConfiguration,
+    path: &str,
+    entry_root: &str,
+) -> Result<Vec<(BlsEntry, BootableEntry)>> {
+    let strict = context.root().options().bls_strict_mode;
+    let mut entries = Vec::new();
+
+    // Resolve the path to the BLS directory.
+    let bls_resolved = eficore::path::resolve_path(Some(context.root().loaded_image_path()?), path)
+        .context("unable to resolve bls path")?;
+
+    // Construct a filesystem path to the BLS entries directory.
+    let mut entries_path = PathBuf::from(
+        bls_resolved
+            .sub_path
+            .to_string16(DisplayOnly(false), AllowShortcuts(false))
+            .context("unable to convert bls path to string")?,
+    );
+    entries_path.push(cstr16!("entries"));
+
+    // Open exclusive access to the BLS filesystem.
+    let fs =
+        uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(bls_resolved.filesystem_handle)
+            .context("unable to open bls filesystem")?;
+    let mut fs = FileSystem::new(fs);
+
+    // The entries directory is optional, as a BLS directory may only contain a loader.conf file.
+    // If it does not exist, there are no entries to generate.
+    if !fs
+        .try_exists(&entries_path)
+        .context("unable to check for bls entries directory")?
+    {
+        return Ok(Vec::new());
+    }
+
+    // Read the BLS entries directory.
+    let entries_iter = fs
+        .read_dir(&entries_path)
+        .context("unable to read bls entries")?;
+
+    // For each entry in the BLS entries directory, parse the entry and add it to the list.
+    for entry in entries_iter {
+        // Unwrap the entry file info.
+        let entry = entry.context("unable to read bls item entry")?;
+
+        // Skip items that are not regular files.
+        if !entry.is_regular_file() {
+            continue;
+        }
+
+        // Get the file name of the filesystem item.
+        let file_name = entry.file_name().to_string();
+
+        // Ignore hidden files, such as the AppleDouble files that macOS writes, and files that
+        // are not .conf files. Files named just ".conf" are not valid entry files.
+        let Some((stem, extension)) = strip_extension(&file_name, ".conf") else {
+            continue;
+        };
+        if file_name.starts_with('.') || stem.is_empty() {
+            continue;
+        }
+        // Names that start with auto- are reserved for entries the boot loader makes itself.
+        if is_reserved_entry_name(&file_name) {
+            continue;
+        }
+        let extension = extension.to_string();
+
+        // Split the boot counter off the file name. The entry id never includes the counter, so
+        // that it stays the same as tries are consumed.
+        let (id, boot_counter) = {
+            let (id, counter) = BootCounter::parse(stem);
+            (id.to_string(), counter)
+        };
+        let name = id;
+
+        // Create a mutable path so we can append the file name to produce the full path.
+        let mut full_entry_path = entries_path.to_path_buf();
+        full_entry_path.push(entry.file_name());
+
+        // Read the entry file.
+        // Entries that can't be read or parsed are skipped, as one broken entry
+        // should not prevent booting any of the other entries.
+        let content = match fs.read(full_entry_path) {
+            Ok(content) => content,
+            Err(error) => {
+                warn!("unable to read bls entry {}: {}", name, error);
+                continue;
+            }
+        };
+
+        // Parse the entry file as a UTF-8 string.
+        let content = match String::from_utf8(content) {
+            Ok(content) => content,
+            Err(error) => {
+                warn!("unable to read bls entry {} as utf8: {}", name, error);
+                continue;
+            }
+        };
+
+        // Parse the entry file as a BLS entry.
+        let mut entry = match BlsEntry::from_str(&content) {
+            Ok(entry) => entry,
+            Err(error) => {
+                warn!("unable to parse bls entry {}: {}", name, error);
+                continue;
+            }
+        };
+        entry.boot_counter = boot_counter;
+
+        // Ignore entries that are not valid for Sprout.
+        if !entry.is_valid() {
+            continue;
+        }
+
+        // Ignore entries that are for another architecture.
+        if !entry.matches_architecture(ARCHITECTURE) {
+            continue;
+        }
+
+        // An entry that names more than one of linux, efi and uki is broken, and systemd-boot
+        // does not show it. Outside of strict mode, the first of them in that order is booted.
+        if entry.mixes_boot_targets() {
+            if strict {
+                warn!(
+                    "hiding bls entry {} as it has more than one of linux, efi and uki",
+                    name
+                );
+                continue;
+            }
+            warn!(
+                "bls entry {} has more than one of linux, efi and uki, which systemd-boot hides; \
+                 using the first of linux, efi and uki (strict mode hides it)",
+                name
+            );
+        }
+
+        // The file that the entry boots has to exist. systemd-boot hides an entry that has
+        // none, while outside of strict mode it is shown and fails when it is booted.
+        if let Some(target) = entry.chainload_path()
+            && let Ok(target_path) = CString16::try_from(format!("\\{}", target).as_str())
+            && let Ok(false) = fs.try_exists(PathBuf::from(target_path))
+        {
+            if strict {
+                warn!(
+                    "hiding bls entry {} as its file '\\{}' does not exist",
+                    name, target
+                );
+                continue;
+            }
+            warn!(
+                "bls entry {} refers to the file '\\{}', which does not exist (strict mode hides it)",
+                name, target
+            );
+        }
+
+        // Put the initrds through a quirk modifier to support Fedora.
+        let initrds = quirk_initrd_remove_tuned(entry.initrd_paths());
+
+        // Skip entries with more initrds than there are slots, as they can't be fully loaded.
+        if initrds.len() > BLS_INITRD_SLOTS {
+            warn!(
+                "bls entry {} has more than {} initrds, skipping",
+                name, BLS_INITRD_SLOTS
+            );
+            continue;
+        }
+
+        let mut boot = bootable_entry(context, bls, &name, &entry, &initrds, entry_root);
+        boot.set_id_suffix(&extension);
+        if entry.profile_number() > 0 {
+            boot.mark_extra_profile();
+        }
+
+        // Record where the boot counter lives so a try can be consumed when this entry boots.
+        // systemd-boot only counts the tries of the entries it boots as a kernel or as a unified
+        // kernel image, and not those of a plain EFI program.
+        let counted = !(strict && entry.linux.is_none() && entry.uki.is_none());
+        if let Some(counter) = boot_counter {
+            boot.set_boot_counter(BootCounterTarget {
+                counter,
+                filesystem: bls_resolved.filesystem_handle,
+                directory: entries_path.clone(),
+                id: name.clone(),
+                file_name,
+                extension,
+                counting: counted,
+            });
+        }
+
+        // Add the BLS entry to the list, along with the bootable entry.
+        entries.push((entry, boot));
+    }
+
+    Ok(entries)
+}
+
+/// Generates the BLS Type #2 entries from the unified kernel images in the `uki_path` directory.
+/// An image with the same id as one of the Type #1 `entries` is skipped.
+fn generate_type2(
+    context: &Rc<SproutContext>,
+    bls: &BlsConfiguration,
+    uki_path: &str,
+    entry_root: &str,
+    entries: &[(BlsEntry, BootableEntry)],
+) -> Result<Vec<(BlsEntry, BootableEntry)>> {
+    let resolved = eficore::path::resolve_path(Some(context.root().loaded_image_path()?), uki_path)
+        .context("unable to resolve uki path")?;
+    let directory = resolved
+        .sub_path
+        .to_string16(DisplayOnly(false), AllowShortcuts(false))
+        .context("unable to convert uki path to string")?;
+    let directory_name = directory.to_string();
+
+    let mut found: Vec<(BlsEntry, BootableEntry)> = Vec::new();
+    let strict = context.root().options().bls_strict_mode;
+    for image in uki::scan(resolved.filesystem_handle, &directory_name, strict)? {
+        // Only unified kernel images that are built for this machine are entries.
+        if image.machine != PE_MACHINE {
+            info!(
+                "skipping {} as it is built for another architecture",
+                image.file_name
+            );
+            continue;
+        }
+
+        // The id is the file name without the extension and the boot counter.
+        let file_name = image.file_name;
+        if is_reserved_entry_name(&file_name) {
+            continue;
+        }
+        let Some((stem, extension)) = strip_extension(&file_name, ".efi") else {
+            continue;
+        };
+        let extension = extension.to_string();
+        let (id, boot_counter) = BootCounter::parse(stem);
+        if id.is_empty() {
+            continue;
+        }
+        let id = id.to_string();
+
+        // Every profile of the image is an entry. They share the file, and so the boot counter.
+        let mut suffixes: Vec<String> = Vec::new();
+        for profile in image.profiles {
+            // A profile without an os-release section is not a unified kernel image, such as
+            // other EFI programs.
+            if !profile.has_osrel {
+                info!(
+                    "skipping {} as it has no .osrel section, so it is not a unified kernel image",
+                    file_name
+                );
+                continue;
+            }
+
+            // The first profile has the id of the file, and the others name their profile.
+            // A profile that repeats the identifier of an earlier one is told apart by its number.
+            let index = profile.index.unwrap_or(0);
+            let mut suffix = profile_id_suffix(index, &profile.info);
+            if let Some(ref name) = suffix
+                && suffixes.contains(name)
+            {
+                suffix = Some(index.to_string());
+            }
+            if let Some(ref name) = suffix {
+                suffixes.push(name.clone());
+            }
+            let name = match suffix {
+                Some(ref suffix) => format!("{}@{}", id, suffix),
+                None => id.clone(),
+            };
+
+            // systemd-boot skips an image that has no name, while outside of strict mode the
+            // name of the file is used.
+            if strict && profile.entry.title.is_none() {
+                warn!(
+                    "hiding unified kernel image {} as it has no name in its os-release",
+                    file_name
+                );
+                continue;
+            }
+
+            let mut entry = profile.entry;
+            entry.boot_counter = boot_counter;
+
+            let mut boot = bootable_entry(context, bls, &name, &entry, &[], entry_root);
+            boot.set_id_suffix(&extension);
+            if let Some(ref suffix) = suffix {
+                boot.set_id_profile(suffix);
+            }
+
+            // An image with the same id as another entry, such as a leftover copy with another
+            // boot counter, would be ambiguous. Type 1 and type 2 entries have different ids.
+            if entries
+                .iter()
+                .chain(found.iter())
+                .any(|(_, other)| other.id() == boot.id())
+            {
+                warn!(
+                    "unified kernel image {} has the same id as another entry, skipping",
+                    file_name
+                );
+                continue;
+            }
+
+            if let Some(counter) = boot_counter {
+                boot.set_boot_counter(BootCounterTarget {
+                    counter,
+                    filesystem: resolved.filesystem_handle,
+                    directory: PathBuf::from(directory.clone()),
+                    id: id.clone(),
+                    file_name: file_name.clone(),
+                    extension: extension.clone(),
+                    counting: true,
+                });
+            }
+            found.push((entry, boot));
+        }
+    }
+    Ok(found)
+}
+
+/// Generates the entries of one partition, from the BLS entries directory at `bls_path` and the
+/// unified kernel image directory at `uki_path`, if there is one. The files of the entries are on
+/// the device `entry_root`.
+fn generate_partition(
+    context: &Rc<SproutContext>,
+    bls: &BlsConfiguration,
+    bls_path: &str,
+    uki_path: Option<&str>,
+    entry_root: &str,
+) -> Result<Vec<(BlsEntry, BootableEntry)>> {
+    // A problem reading the Type #1 entries only stops the unified kernel images when there
+    // are none to add, so that either kind of entry can still boot.
+    let mut entries = match generate_type1(context, bls, bls_path, entry_root) {
+        Ok(entries) => entries,
+        Err(error) if uki_path.is_some() => {
+            warn!("unable to generate bls entries: {:#}", error);
+            Vec::new()
+        }
+        Err(error) => return Err(error),
+    };
+
+    // Add the unified kernel images, unless that is disabled. A problem scanning them
+    // should not prevent booting the other entries.
+    if let Some(uki_path) = uki_path {
+        let uki_path = context.stamp(uki_path);
+        match generate_type2(context, bls, &uki_path, entry_root, &entries) {
+            Ok(found) => entries.extend(found),
+            Err(error) => warn!(
+                "unable to generate unified kernel image entries: {:#}",
+                error
+            ),
+        }
+    }
+    Ok(entries)
+}
+
+/// Finds the root of the Extended Boot Loader Partition on the disk that Sprout was loaded from,
+/// as the text of the device with a trailing slash. None if there is no such partition.
+fn xbootldr_root(context: &Rc<SproutContext>) -> Result<Option<String>> {
+    let Some(path) = eficore::xbootldr::find_xbootldr(context.root().loaded_image_path()?)? else {
+        return Ok(None);
+    };
+    let mut root = path
+        .to_string16(DisplayOnly(false), AllowShortcuts(false))
+        .context("unable to convert the xbootldr device path to a string")?
+        .to_string();
+    // Add a trailing forward-slash to the root to ensure the device root is completed.
+    root.push('/');
+    Ok(Some(root))
+}
+
+/// Generates entries from the BLS entries directory and the unified kernel image directory
+/// using the specified `bls` configuration and `context`, and from the Extended Boot Loader
+/// Partition if that is enabled. The BLS conversion is best-effort and will ignore any
+/// unsupported entries.
+pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Vec<BootableEntry>> {
+    // Stamp the path to the BLS directory.
+    let path = context.stamp(&bls.path);
+
+    let uki_path = bls.uki_path_for(&path);
+    // A problem with this partition only stops the generator when there is no other partition.
+    let mut entries = match generate_partition(
+        &context,
+        bls,
+        &path,
+        uki_path.as_deref(),
+        BlsConfiguration::root_of(&path),
+    ) {
+        Ok(entries) => entries,
+        Err(error) if bls.xbootldr || context.root().options().bls_strict_mode => {
+            warn!("unable to generate bls entries: {:#}", error);
+            Vec::new()
+        }
+        Err(error) => return Err(error),
+    };
+
+    // Add the entries of the Extended Boot Loader Partition, which are sorted together with the
+    // others. A problem with it should not prevent booting from the entries that are found.
+    let strict_xbootldr = context.root().options().bls_strict_mode
+        && !STRICT_XBOOTLDR_ADDED.swap(true, AtomicOrdering::Relaxed);
+    if bls.xbootldr || strict_xbootldr {
+        match xbootldr_root(&context) {
+            Ok(Some(root)) => {
+                let xbootldr_uki = uki_path.as_ref().map(|_| format!("{}\\EFI\\Linux", root));
+                match generate_partition(
+                    &context,
+                    bls,
+                    &format!("{}\\loader", root),
+                    xbootldr_uki.as_deref(),
+                    &root,
+                ) {
+                    Ok(found) => {
+                        for (entry, boot) in found {
+                            // An entry that is on both partitions would be ambiguous.
+                            if entries.iter().any(|(_, other)| other.id() == boot.id()) {
+                                warn!(
+                                    "xbootldr entry {} has the same id as another entry, skipping",
+                                    boot.id()
+                                );
+                            } else {
+                                entries.push((entry, boot));
+                            }
+                        }
+                    }
+                    Err(error) => warn!("unable to generate xbootldr entries: {:#}", error),
+                }
+            }
+            Ok(None) => info!("no xbootldr partition was found"),
+            Err(error) => warn!("unable to find the xbootldr partition: {:#}", error),
+        }
+    }
+
+    // Sort all the entries according to the BLS sort system.
+    entries.sort_by(sort_entries);
+
+    // Grab the number of entries that we have, so we can calculate a reverse index.
+    let entry_count = entries.len();
+
+    // Set the sort keys of all the bootable entries to a semi-unique prefix + the BLS sort order.
+    // The final comparison happens using version comparison, so this will sort
+    // things properly.
+    for (idx, (_bls, boot)) in entries.iter_mut().enumerate() {
+        boot.set_sort_key(format!("bls-{}-{}", path, entry_count - idx - 1));
+    }
+
+    // Collect all the bootable entries and return them.
+    Ok(entries.into_iter().map(|(_, boot)| boot).collect())
+}

crates/boot/src/generators/bls/uki.rs

@@ -0,0 +1,136 @@
+use alloc::{
+    format,
+    string::{String, ToString},
+    vec::Vec,
+};
+use anyhow::{Context, Result, anyhow, bail};
+use edera_sprout_bls::{
+    BlsEntry, PeImage, ProfileInfo, ReadAt, UKI_SECTIONS, read_pe, strip_extension, uki_profiles,
+};
+use log::warn;
+use uefi::{
+    CString16, Handle, Status,
+    proto::media::file::{File, FileAttribute, FileInfo, FileMode, FileType, RegularFile},
+    proto::media::fs::SimpleFileSystem,
+};
+
+/// A unified kernel image that was found, with the metadata Sprout reads.
+pub struct UkiFile {
+    /// The name of the file, such as `fedora+3.efi`.
+    pub file_name: String,
+    /// The machine type of the image.
+    pub machine: u16,
+    /// The profiles of the image. An image without profiles has one.
+    pub profiles: Vec<UkiProfileEntry>,
+}
+
+/// One profile of a unified kernel image.
+pub struct UkiProfileEntry {
+    /// The number of the profile, or None if the image has no profiles.
+    pub index: Option<u32>,
+    /// The metadata of the profile.
+    pub info: ProfileInfo,
+    /// Whether the profile has an `.osrel` section, which unified kernel images always have.
+    pub has_osrel: bool,
+    /// The entry made from the sections of the profile.
+    pub entry: BlsEntry,
+}
+
+/// Reads a file at arbitrary offsets, so that a large image isn't loaded to read its headers.
+struct FileReader(RegularFile);
+
+impl ReadAt for FileReader {
+    fn read_at(&mut self, offset: u64, buf: &mut [u8]) -> Result<()> {
+        self.0
+            .set_position(offset)
+            .map_err(|error| anyhow!("unable to seek: {}", error))?;
+        let mut done = 0;
+        while done < buf.len() {
+            let read = self
+                .0
+                .read(&mut buf[done..])
+                .map_err(|error| anyhow!("unable to read: {}", error))?;
+            if read == 0 {
+                bail!("unexpected end of file");
+            }
+            done += read;
+        }
+        Ok(())
+    }
+}
+
+/// Finds the `.efi` files in `directory` on `filesystem` and reads their sections.
+/// A missing directory has no images. Files that can't be read as a PE image are skipped,
+/// as one broken file should not prevent booting any of the other entries.
+pub fn scan(filesystem: Handle, directory: &str, strict: bool) -> Result<Vec<UkiFile>> {
+    let mut fs = uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(filesystem)
+        .context("unable to open the unified kernel image filesystem")?;
+    let mut root = fs
+        .open_volume()
+        .context("unable to open the unified kernel image volume")?;
+
+    let name = CString16::try_from(directory).context("invalid unified kernel image path")?;
+    let handle = match root.open(&name, FileMode::Read, FileAttribute::empty()) {
+        Ok(handle) => handle,
+        Err(error) if error.status() == Status::NOT_FOUND => return Ok(Vec::new()),
+        Err(error) => return Err(error).context("unable to open the unified kernel image path"),
+    };
+    let FileType::Dir(mut directory_file) = handle
+        .into_type()
+        .context("unable to inspect the unified kernel image path")?
+    else {
+        bail!("the unified kernel image path is not a directory");
+    };
+
+    // Collect the file names first, as files can't be opened while the directory is read.
+    let mut names = Vec::new();
+    while let Some(info) = directory_file
+        .read_entry_boxed()
+        .context("unable to read the unified kernel image directory")?
+    {
+        let info: &FileInfo = &info;
+        if info.attribute().contains(FileAttribute::DIRECTORY) {
+            continue;
+        }
+        let file_name = info.file_name().to_string();
+        // Hidden files, such as the AppleDouble files that macOS writes, are not images.
+        if !file_name.starts_with('.') && strip_extension(&file_name, ".efi").is_some() {
+            names.push(file_name);
+        }
+    }
+
+    let mut found = Vec::new();
+    for file_name in names {
+        let path = format!("{}\\{}", directory, file_name);
+        match read_image(&mut root, &path) {
+            Ok(image) => found.push(UkiFile {
+                file_name,
+                machine: image.machine,
+                // The sections are dropped here, so only the small entries are kept per image.
+                profiles: uki_profiles(&image.sections)
+                    .into_iter()
+                    .map(|profile| UkiProfileEntry {
+                        index: profile.index,
+                        has_osrel: profile.sections.contains_key(".osrel"),
+                        entry: BlsEntry::from_uki_profile_with(&profile, &path, strict),
+                        info: profile.info,
+                    })
+                    .collect(),
+            }),
+            Err(error) => warn!("unable to read unified kernel image {}: {:#}", path, error),
+        }
+    }
+    Ok(found)
+}
+
+/// Reads the sections of the PE image at `path`.
+fn read_image(root: &mut uefi::proto::media::file::Directory, path: &str) -> Result<PeImage> {
+    let name = CString16::try_from(path).context("invalid path")?;
+    let handle = root
+        .open(&name, FileMode::Read, FileAttribute::empty())
+        .context("unable to open")?;
+    let Some(file) = handle.into_regular_file() else {
+        bail!("not a regular file");
+    };
+    read_pe(&mut FileReader(file), &UKI_SECTIONS)
+}

crates/boot/src/generators/list.rs

@@ -1,8 +1,10 @@
 use crate::context::SproutContext;
 use crate::entries::BootableEntry;
+use alloc::rc::Rc;
+use alloc::string::ToString;
+use alloc::vec::Vec;
 use anyhow::Result;
 use edera_sprout_config::generators::list::ListConfiguration;
-use std::rc::Rc;
 
 /// Generates a set of entries using the specified `list` configuration in the `context`.
 pub fn generate(
@@ -18,13 +20,10 @@ pub fn generate(
         context.insert(combination);
         let context = context.freeze();
 
-        // Stamp the entry title and actions from the template.
-        let mut entry = list.entry.clone();
-        entry.actions = entry
-            .actions
-            .into_iter()
-            .map(|action| context.stamp(action))
-            .collect();
+        // The actions are stamped with the final context of the entry when it is booted,
+        // so that variants and the values of the entry can override the values of the generator.
+        let entry = list.entry.clone();
+
         // Push the entry into the list with the new context.
         entries.push(BootableEntry::new(
             index.to_string(),

crates/boot/src/generators/matrix.rs

@@ -0,0 +1,26 @@
+use crate::context::SproutContext;
+use crate::entries::BootableEntry;
+use crate::generators::list;
+use alloc::rc::Rc;
+use alloc::vec::Vec;
+use anyhow::Result;
+use edera_sprout_config::generators::list::ListConfiguration;
+use edera_sprout_config::generators::matrix::MatrixConfiguration;
+use edera_sprout_parsing::build_matrix;
+
+/// Generates a set of entries using the specified `matrix` configuration in the `context`.
+pub fn generate(
+    context: Rc<SproutContext>,
+    matrix: &MatrixConfiguration,
+) -> Result<Vec<BootableEntry>> {
+    // Produce all the combinations of the input values.
+    let combinations = build_matrix(&matrix.values);
+    // Use the list generator to generate entries for each combination.
+    list::generate(
+        context,
+        &ListConfiguration {
+            entry: matrix.entry.clone(),
+            values: combinations,
+        },
+    )
+}

crates/boot/src/main.rs

@@ -0,0 +1,834 @@
+#![doc = include_str!("../README.md")]
+#![no_std]
+#![no_main]
+extern crate alloc;
+
+use crate::{
+    context::{RootContext, SproutContext},
+    entries::BootableEntry,
+    options::SproutOptions,
+    phases::phase,
+};
+use alloc::{
+    collections::{BTreeMap, BTreeSet},
+    format,
+    string::{String, ToString},
+    vec::Vec,
+};
+use anyhow::{Context, Result, bail};
+use core::{ops::Deref, time::Duration};
+use edera_sprout_bls::{LoaderConf, LoaderTimeout, compare_versions};
+use edera_sprout_config::{DEFAULT_MENU_TIMEOUT_SECONDS, RootConfiguration};
+use eficore::{
+    bootloader_interface::{BootloaderInterface, BootloaderInterfaceTimeout},
+    partition::PartitionGuidForm,
+    platform::{timer::PlatformTimer, tpm::PlatformTpm},
+    setup,
+};
+use log::{error, info, warn};
+use uefi::{entry, proto::device_path::LoadedImageDevicePath, runtime::ResetType};
+use uefi_raw::Status;
+
+/// actions: Code that can be configured and executed by Sprout.
+pub mod actions;
+
+/// autoconfigure: Autoconfigure Sprout based on the detected environment.
+pub mod autoconfigure;
+
+/// boot_counter: Consume the boot counter tries of BLS entries.
+pub mod boot_counter;
+
+/// config: Sprout configuration mechanism.
+pub mod config;
+
+/// context: Stored values that can be cheaply forked and cloned.
+pub mod context;
+
+/// drivers: EFI drivers to load and provide extra functionality.
+pub mod drivers;
+
+/// entries: Boot menu entries that have a title and can execute actions.
+pub mod entries;
+
+/// extractors: Runtime code that can extract values into the Sprout context.
+pub mod extractors;
+
+/// generators: Runtime code that can generate entries with specific values.
+pub mod generators;
+
+/// menu: Display a boot menu to select an entry to boot.
+pub mod menu;
+
+/// options: Parse the options of the Sprout executable.
+pub mod options;
+
+/// phases: Hooks into specific parts of the boot process.
+pub mod phases;
+
+/// sbat: Secure Boot Attestation section.
+pub mod sbat;
+
+/// The delay to wait for when an error occurs in Sprout.
+const DELAY_ON_ERROR: Duration = Duration::from_secs(10);
+
+/// Unwraps the `result` of a bootloader interface operation, logging the error if one occurs.
+/// The bootloader interface only exchanges information with the operating system, so a
+/// firmware variable that can't be read or written should not prevent booting.
+/// If an error occurs, the default value is provided instead.
+fn advisory<T: Default>(result: Result<T>) -> T {
+    result.unwrap_or_else(|error| {
+        warn!("{:#}", error);
+        T::default()
+    })
+}
+
+/// Loads the loader.conf of the partition Sprout was loaded from.
+/// A missing loader.conf has no settings.
+fn load_loader_conf(context: &SproutContext) -> Result<LoaderConf> {
+    let Ok(content) = eficore::path::read_file_contents(
+        Some(context.root().loaded_image_path()?),
+        "\\loader\\loader.conf",
+    ) else {
+        return Ok(LoaderConf::default());
+    };
+
+    // Measure the loader.conf into the TPM, as it changes how Sprout boots.
+    // A failure to measure is only a warning, as it was not Sprout's own configuration.
+    if let Err(error) = PlatformTpm::log_event(
+        PlatformTpm::PCR_BOOT_LOADER_CONFIG,
+        &content,
+        "sprout: loader.conf",
+    ) {
+        warn!(
+            "unable to measure the loader.conf file into the TPM: {:#}",
+            error
+        );
+    }
+
+    // Read what is valid, as a stray byte should not discard the whole file.
+    let content = String::from_utf8_lossy(&content);
+    Ok(LoaderConf::parse(&content))
+}
+
+/// Run Sprout, returning an error if one occurs.
+fn run(reboot_on_error: &mut bool) -> Result<()> {
+    // Start the platform timer.
+    let timer = PlatformTimer::start();
+
+    // Mark the initialization of Sprout in the bootloader interface.
+    advisory(
+        BootloaderInterface::mark_init(&timer)
+            .context("unable to mark initialization in bootloader interface"),
+    );
+
+    // Tell the bootloader interface what firmware we are running on.
+    advisory(
+        BootloaderInterface::set_firmware_info()
+            .context("unable to set firmware info in bootloader interface"),
+    );
+
+    // Tell the bootloader interface what loader is being used.
+    advisory(
+        BootloaderInterface::set_loader_info()
+            .context("unable to set loader info in bootloader interface"),
+    );
+
+    // Acquire the number of active PCR banks on the TPM.
+    // If no TPM is available, this will return zero.
+    // This is only reported to the bootloader interface, so a TPM that fails to report its
+    // PCR banks is treated as having none, rather than preventing boot.
+    let active_pcr_banks = PlatformTpm::active_pcr_banks().unwrap_or_else(|error| {
+        warn!("unable to determine the active TPM PCR banks: {}", error);
+        0
+    });
+    // Tell the bootloader interface what the number of active PCR banks is.
+    advisory(
+        BootloaderInterface::set_tpm2_active_pcr_banks(active_pcr_banks)
+            .context("unable to set tpm2 active PCR banks in bootloader interface"),
+    );
+
+    // Parse the options to the sprout executable.
+    let options = SproutOptions::parse().context("unable to parse options")?;
+
+    // If --autoconfigure is specified, we use a stub configuration.
+    let mut config = if options.autoconfigure {
+        info!("autoconfiguration enabled, configuration file will be ignored");
+        RootConfiguration::default()
+    } else {
+        // Load the configuration of sprout.
+        // At this point, the configuration has been validated and the specified
+        // version is checked to ensure compatibility.
+        config::loader::load(&options)?
+    };
+
+    // Grab the sprout.efi loaded image path.
+    // This is done in a block to ensure the release of the LoadedImageDevicePath protocol.
+    let loaded_image_path = {
+        let current_image_device_path_protocol = uefi::boot::open_protocol_exclusive::<
+            LoadedImageDevicePath,
+        >(uefi::boot::image_handle())
+        .context("unable to get loaded image device path")?;
+        current_image_device_path_protocol.deref().to_boxed()
+    };
+
+    // Grab the partition GUID of the ESP that sprout was loaded from.
+    // This is only reported to the bootloader interface.
+    let loaded_image_partition_guid = advisory(
+        eficore::partition::partition_guid(&loaded_image_path, PartitionGuidForm::Partition)
+            .context("unable to retrieve loaded image partition guid"),
+    );
+
+    // Set the partition GUID of the ESP that sprout was loaded from in the bootloader interface.
+    if let Some(loaded_image_partition_guid) = loaded_image_partition_guid {
+        // Tell the system about the partition GUID.
+        advisory(
+            BootloaderInterface::set_partition_guid(&loaded_image_partition_guid)
+                .context("unable to set partition guid in bootloader interface"),
+        );
+    }
+
+    // Tell the bootloader interface what the loaded image path is.
+    advisory(
+        BootloaderInterface::set_loader_path(&loaded_image_path)
+            .context("unable to set loader path in bootloader interface"),
+    );
+
+    // Strict mode can be asked for on the command line or in the configuration.
+    let mut options = options;
+    options.bls_strict_mode |= config.options.bls_strict_mode;
+    if options.bls_strict_mode {
+        info!("BLS strict mode is enabled");
+    }
+
+    // Create the root context.
+    let mut root = RootContext::new(loaded_image_path, timer, options);
+
+    // Insert the configuration actions into the root context.
+    root.actions_mut().extend(config.actions.clone());
+
+    // Create a new sprout context with the root context.
+    let mut context = SproutContext::new(root);
+
+    // Insert the configuration values into the sprout context.
+    context.insert(&config.values);
+
+    // Freeze the sprout context so it can be shared and cheaply cloned.
+    let context = context.freeze();
+
+    // Execute the early phase.
+    phase(context.clone(), &config.phases.early).context("unable to execute early phase")?;
+
+    // Load all configured drivers.
+    drivers::load(context.clone(), &config.drivers).context("unable to load drivers")?;
+
+    // If --autoconfigure is specified or the loaded configuration has autoconfigure enabled,
+    // trigger the autoconfiguration mechanism.
+    if context.root().options().autoconfigure || config.options.autoconfigure {
+        autoconfigure::autoconfigure(
+            &mut config,
+            context.root().options().bls_strict_mode,
+            context.root().loaded_image_path()?,
+        )
+        .context("unable to autoconfigure")?;
+    }
+
+    // Unload the context so that it can be modified.
+    let Some(mut context) = context.unload() else {
+        bail!("context safety violation while trying to unload context");
+    };
+
+    // Perform root context modification in a block to release the modification when complete.
+    {
+        // Modify the root context to include the autoconfigured actions.
+        let Some(root) = context.root_mut() else {
+            bail!("context safety violation while trying to modify root context");
+        };
+
+        // Extend the root context with the autoconfigured actions.
+        root.actions_mut().extend(config.actions);
+
+        // Insert any modified root values.
+        context.insert(&config.values);
+    }
+
+    // Refreeze the context to ensure that further operations can share the context.
+    let context = context.freeze();
+
+    // Run all the extractors declared in the configuration.
+    let mut extracted = BTreeMap::new();
+    for (name, extractor) in &config.extractors {
+        let value = extractors::extract(context.clone(), extractor)
+            .context(format!("unable to extract value {}", name))?;
+        info!("extracted value {}: {}", name, value);
+        extracted.insert(name.clone(), value);
+    }
+    let mut context = context.fork();
+    // Insert the extracted values into the sprout context.
+    context.insert(&extracted);
+    let context = context.freeze();
+
+    // Execute the startup phase.
+    phase(context.clone(), &config.phases.startup).context("unable to execute startup phase")?;
+
+    let mut entries = Vec::new();
+
+    // Insert all the static entries from the configuration into the entry list.
+    for (name, entry) in config.entries {
+        // Associate the main context with the static entry.
+        entries.push(BootableEntry::new(
+            name,
+            entry.title.clone(),
+            context.clone(),
+            entry,
+        ));
+    }
+
+    // Run all the generators declared in the configuration.
+    for (name, generator) in config.generators {
+        let context = context.fork().freeze();
+
+        // Add all the entries generated by the generator to the entry list.
+        // The generator specifies the context associated with the entry.
+        entries.extend(generators::generate(&name, context, &generator)?);
+    }
+
+    // Entry names are used to select entries, so duplicates make the selection ambiguous.
+    // This can happen when two generators pin names, like two BLS generators reading the
+    // same BLS directory.
+    let mut seen_names = BTreeSet::new();
+    for entry in &entries {
+        if !seen_names.insert(entry.name()) {
+            warn!(
+                "more than one entry is named {}, selecting it by name is ambiguous",
+                entry.name()
+            );
+        }
+    }
+
+    // Entries whose context can't be finalized are skipped, as one broken entry
+    // should not prevent booting any of the other entries.
+    entries.retain_mut(|entry| {
+        let mut context = entry.context().fork();
+        // Insert the values from the entry configuration into the
+        // sprout context to use with the entry itself.
+        context.insert(&entry.declaration().values);
+        let context = match context.finalize() {
+            Ok(context) => context.freeze(),
+            Err(error) => {
+                warn!(
+                    "skipping entry {}, unable to finalize context: {:#}",
+                    entry.name(),
+                    error
+                );
+                return false;
+            }
+        };
+        // Provide the new context to the bootable entry.
+        entry.swap_context(context);
+        // Restamp the title and sort key with any values.
+        entry.restamp_title();
+        entry.restamp_sort_key();
+
+        true
+    });
+
+    // Sort the entries by their sort key, finalizing the order to show entries. This happens
+    // in reverse order so that entries that would come last show up first in the menu.
+    entries.sort_by(|a, b| compare_versions(a.sort_key(), b.sort_key()).reverse());
+
+    // Tell the bootloader interface what entries are available.
+    advisory(
+        BootloaderInterface::set_entries(entries.iter().map(|entry| entry.id()))
+            .context("unable to set entries in bootloader interface"),
+    );
+
+    // Load the loader.conf of the partition Sprout was loaded from.
+    let loader_conf = load_loader_conf(&context).context("unable to load loader.conf")?;
+    for warning in &loader_conf.warnings {
+        warn!("{}", warning);
+    }
+
+    // Acquire the timeouts from the bootloader interface.
+    let bootloader_interface_timeouts = advisory(
+        BootloaderInterface::get_timeouts().context("unable to get bootloader interface timeouts"),
+    );
+
+    // Acquire the default entry from the bootloader interface.
+    let bootloader_interface_default_entry = advisory(
+        BootloaderInterface::get_default_entry()
+            .context("unable to get bootloader interface default entry"),
+    );
+
+    // Acquire the preferred entry from the bootloader interface.
+    let bootloader_interface_preferred_entry = advisory(
+        BootloaderInterface::get_preferred_entry()
+            .context("unable to get bootloader interface preferred entry"),
+    );
+
+    // Acquire the entry that was saved by the previous boot.
+    let mut last_booted_entry = advisory(
+        BootloaderInterface::get_last_booted_entry()
+            .context("unable to get last booted entry from bootloader interface"),
+    );
+
+    // Whether to follow the specification and systemd-boot exactly.
+    let strict = context.root().options().bls_strict_mode;
+
+    // Acquire the oneshot entry from the bootloader interface.
+    let bootloader_interface_oneshot_entry = advisory(
+        BootloaderInterface::get_oneshot_entry()
+            .context("unable to get bootloader interface oneshot entry"),
+    );
+
+    // If --boot is specified, boot that entry immediately.
+    let force_boot_entry = context.root().options().boot.clone();
+    // If --force-menu is specified, show the boot menu regardless of the value of --boot.
+    let mut force_boot_menu = context.root().options().force_menu;
+
+    // Pick the menu timeout from the first source that specifies one, in this order:
+    // the one-shot timeout, --menu-timeout, LoaderConfigTimeout, the configuration, loader.conf.
+    // The bootloader interface is what tools like bootctl set, so it outranks the configuration.
+    let seconds = |seconds: Option<u64>| {
+        seconds.map_or(
+            BootloaderInterfaceTimeout::Unspecified,
+            BootloaderInterfaceTimeout::Timeout,
+        )
+    };
+    let loader_conf_timeout = match loader_conf.timeout {
+        None => BootloaderInterfaceTimeout::Unspecified,
+        Some(LoaderTimeout::Seconds(0)) | Some(LoaderTimeout::Hidden) => {
+            BootloaderInterfaceTimeout::MenuHidden
+        }
+        Some(LoaderTimeout::Seconds(timeout)) => BootloaderInterfaceTimeout::Timeout(timeout),
+        Some(LoaderTimeout::Disabled) => BootloaderInterfaceTimeout::MenuDisabled,
+        Some(LoaderTimeout::Force) => BootloaderInterfaceTimeout::MenuForce,
+    };
+    let timeout = [
+        bootloader_interface_timeouts.oneshot,
+        seconds(context.root().options().menu_timeout),
+        bootloader_interface_timeouts.direct,
+        seconds(config.options.menu_timeout),
+        loader_conf_timeout,
+    ]
+    .into_iter()
+    .find(|timeout| !matches!(timeout, BootloaderInterfaceTimeout::Unspecified))
+    .unwrap_or_default();
+
+    // The menu timeout in seconds, if no source specified one. systemd-boot does not show the
+    // menu by default, while outside of strict mode it is shown for a while.
+    let mut menu_timeout = if strict {
+        0
+    } else {
+        DEFAULT_MENU_TIMEOUT_SECONDS
+    };
+
+    // Whether the boot menu should wait for the user, instead of counting down.
+    let mut wait_for_user = false;
+
+    // Whether the menu is disabled, so that a key press can't bring it up.
+    let mut menu_disabled = false;
+
+    // Apply the chosen timeout.
+    match timeout {
+        BootloaderInterfaceTimeout::MenuForce => {
+            // Force the boot menu, and wait for the user to choose an entry.
+            force_boot_menu = true;
+            wait_for_user = true;
+        }
+
+        BootloaderInterfaceTimeout::MenuForceTimeout(timeout) => {
+            // Force the boot menu with the specified timeout.
+            force_boot_menu = true;
+            menu_timeout = timeout;
+        }
+
+        BootloaderInterfaceTimeout::MenuHidden => {
+            // Hide the boot menu by setting the timeout to zero.
+            menu_timeout = 0;
+        }
+
+        BootloaderInterfaceTimeout::MenuDisabled => {
+            // Hide the boot menu, and don't let a key press show it.
+            menu_timeout = 0;
+            menu_disabled = true;
+        }
+
+        BootloaderInterfaceTimeout::Timeout(timeout) => {
+            // Configure the timeout to the specified value.
+            menu_timeout = timeout;
+        }
+
+        BootloaderInterfaceTimeout::Unspecified => {
+            if !strict {
+                info!(
+                    "no menu timeout is set, so the menu is shown for {} seconds \
+                     (systemd-boot and strict mode do not show it)",
+                    DEFAULT_MENU_TIMEOUT_SECONDS
+                );
+            }
+        }
+    }
+
+    // Whether the default entry is saved on every boot, which is what `@saved` asks for.
+    // The saved entry is selected by `@saved` from the bootloader interface, or from loader.conf
+    // when the bootloader interface does not set an entry.
+    let is_saved = |value: &Option<String>| {
+        value
+            .as_deref()
+            .is_some_and(|v| v.eq_ignore_ascii_case("@saved"))
+    };
+    let use_saved_entry = is_saved(&bootloader_interface_default_entry)
+        || (bootloader_interface_default_entry.is_none() && is_saved(&loader_conf.default));
+
+    // Turns the value of an entry setting into a pattern. `@saved` is the entry that was saved
+    // by the previous boot, and any other value that starts with `@` is not supported.
+    let entry_pattern = |value: Option<String>| -> Option<String> {
+        let value = value?;
+        if value.eq_ignore_ascii_case("@saved") {
+            return last_booted_entry.clone();
+        }
+        if value.starts_with('@') {
+            warn!("ignoring unsupported entry setting '{}'", value);
+            return None;
+        }
+        Some(value)
+    };
+
+    // Pick the default entry from the first source that matches an entry, where the bootloader
+    // interface, which is what tools like bootctl set, outranks the configuration. A source that matches
+    // no entry, such as when the entry was removed, is ignored so that the next source is used.
+    // The preferred entry sources never use an entry with no boot counter tries left.
+    // Each source has whether it matches by id, and whether it skips bad entries.
+    // In strict mode, the one-shot entry is the default entry for this boot, like in
+    // systemd-boot, and the menu or its timeout still decides what is booted. This also holds
+    // when the menu is forced, as the one-shot entry is then not booted at once.
+    let oneshot_source = if strict || force_boot_menu {
+        bootloader_interface_oneshot_entry.clone()
+    } else {
+        None
+    };
+    for (source, value, by_id, skip_bad) in [
+        ("bootloader interface one-shot", oneshot_source, true, false),
+        (
+            "bootloader interface preferred",
+            bootloader_interface_preferred_entry.clone(),
+            true,
+            true,
+        ),
+        (
+            "loader.conf preferred",
+            loader_conf.preferred.clone(),
+            true,
+            true,
+        ),
+        (
+            "bootloader interface default",
+            bootloader_interface_default_entry.clone(),
+            true,
+            false,
+        ),
+        (
+            "configuration",
+            config.options.default_entry.clone(),
+            false,
+            false,
+        ),
+        (
+            "loader.conf default",
+            loader_conf.default.clone(),
+            true,
+            false,
+        ),
+    ] {
+        // The configuration is a pattern as it is. The other sources can be `@saved`.
+        let pattern = if by_id { entry_pattern(value) } else { value };
+        let Some(pattern) = pattern else {
+            continue;
+        };
+        let pattern_matches = |entry: &BootableEntry| {
+            if by_id {
+                entry.is_match_id(&pattern)
+            } else {
+                entry.is_match(&pattern)
+            }
+        };
+        let matches =
+            |entry: &BootableEntry| pattern_matches(entry) && !(skip_bad && entry.is_bad());
+        // A source that only matches entries with no boot counter tries left is skipped while
+        // another source could pick a usable entry, unless every entry is bad. systemd-boot
+        // does not look at the tries for the default entry, so strict mode does not either.
+        let any_usable = entries.iter().any(|entry| !entry.is_bad());
+        if entries
+            .iter()
+            .any(|entry| matches(entry) && (strict || !any_usable || !entry.is_bad()))
+        {
+            // Mark the matching entries as the default and unmark all the others.
+            for entry in &mut entries {
+                if matches(entry) {
+                    entry.mark_default();
+                } else {
+                    entry.unmark_default();
+                }
+            }
+            break;
+        }
+        if !skip_bad
+            && entries
+                .iter()
+                .any(|entry| pattern_matches(entry) && entry.is_bad())
+        {
+            warn!(
+                "the {} entry '{}' has no boot counter tries left, so it is not the default \
+                 (systemd-boot and strict mode use it)",
+                source, pattern
+            );
+            continue;
+        }
+        warn!("ignoring {} entry '{}': no matching entry", source, pattern);
+    }
+
+    // Entries that have no boot counter tries left are never picked automatically.
+    // If no entries are the default, pick the first usable entry as the default entry.
+    let default_flags = edera_sprout_bls::resolve_default_flags(
+        &entries
+            .iter()
+            .map(|entry| {
+                // In strict mode, an entry that was asked for stays the default even without tries.
+                let bad = entry.is_bad() && !(strict && entry.is_default());
+                (entry.is_default(), bad, entry.is_extra_profile())
+            })
+            .collect::<Vec<_>>(),
+    );
+    for (entry, default) in entries.iter_mut().zip(default_flags) {
+        if default {
+            entry.mark_default();
+        } else {
+            entry.unmark_default();
+        }
+    }
+
+    loop {
+        // Convert the menu timeout to a duration.
+        // A zero timeout boots without showing the menu, so a forced menu with a zero timeout
+        // waits for the user instead.
+        let menu_timeout = if wait_for_user || (force_boot_menu && menu_timeout == 0) {
+            None
+        } else {
+            Some(Duration::from_secs(menu_timeout))
+        };
+
+        // Determine the menu style based on the options or configuration.
+        // We prefer the options over the configuration to allow for overriding.
+        let menu_style = context
+            .root()
+            .options()
+            .menu_style
+            .unwrap_or(config.options.menu_style);
+
+        // The settings of the graphical menu, which only uses the mouse when it is enabled.
+        let graphical = &config.menu_styles.graphical;
+
+        // Find the forced boot entry, unless the boot menu is forced.
+        // The oneshot entry from the bootloader interface is forced by id, and it is used instead of
+        // --boot. If the forced boot entry can't be found, such as when it was removed,
+        // the boot menu is used instead.
+        let forced_entry = if force_boot_menu {
+            None
+        } else if !strict && let Some(ref oneshot) = bootloader_interface_oneshot_entry {
+            let entry = BootableEntry::find_id(oneshot, entries.iter());
+            match entry {
+                Some(entry) => info!(
+                    "booting the one-shot entry {} without showing the menu \
+                     (systemd-boot and strict mode only make it the default)",
+                    entry.id()
+                ),
+                None => warn!("unable to find entry '{}', using the boot menu", oneshot),
+            }
+            entry
+        } else {
+            force_boot_entry.as_ref().and_then(|force_boot_entry| {
+                let entry = BootableEntry::find(force_boot_entry, entries.iter());
+                if entry.is_none() {
+                    warn!(
+                        "unable to find entry '{}', using the boot menu",
+                        force_boot_entry
+                    );
+                }
+                entry
+            })
+        };
+
+        // Use the forced boot entry if possible, otherwise pick an entry using a boot menu.
+        let entry = match forced_entry {
+            Some(entry) => entry,
+            // Delegate to the menu to select an entry to boot.
+            None => menu::select(
+                &timer,
+                menu_timeout,
+                menu_disabled,
+                menu_style,
+                graphical,
+                &entries,
+            )
+            .context("unable to select entry via boot menu")?,
+        };
+
+        // Tell the bootloader interface what the selected entry is.
+        advisory(
+            BootloaderInterface::set_selected_entry(entry.id())
+                .context("unable to set selected entry in bootloader interface"),
+        );
+
+        // Save the selected entry for the next boot when `@saved` asks for it, and forget a saved
+        // entry that is no longer used. A forced boot, such as a one-shot entry, changes nothing,
+        // and neither does an unchanged value.
+        let oneshot_selected = strict
+            && bootloader_interface_oneshot_entry
+                .as_deref()
+                .is_some_and(|oneshot| entry.is_match_id(oneshot));
+        if forced_entry.is_none() && !oneshot_selected {
+            let id = entry.id();
+            if use_saved_entry {
+                if !last_booted_entry
+                    .as_deref()
+                    .is_some_and(|saved| saved.eq_ignore_ascii_case(&id))
+                {
+                    advisory(
+                        BootloaderInterface::set_last_booted_entry(&id)
+                            .context("unable to save last booted entry in bootloader interface"),
+                    );
+                    last_booted_entry = Some(id.clone());
+                }
+            } else if last_booted_entry.is_some() {
+                advisory(
+                    BootloaderInterface::remove_last_booted_entry()
+                        .context("unable to remove last booted entry in bootloader interface"),
+                );
+                last_booted_entry = None;
+            }
+        }
+
+        // Execute the late phase, now that the entry is chosen but before its actions are executed.
+        phase(context.clone(), &config.phases.late).context("unable to execute late phase")?;
+
+        // Consume a try from the boot counter of the selected entry.
+        // Failing to do so must not prevent the entry from booting.
+        // An entry with no tries left, which was picked by hand, is counted too, so that it can
+        // still be marked as good.
+        // The tries that were left before this boot used one up, if it did.
+        let mut consumed_tries_left = None;
+        let mut entry_context = entry.context();
+        if let Some(target) = entry.boot_counter()
+            && target.counting
+        {
+            match target.consume() {
+                Ok(path) => {
+                    info!("updated boot counter of entry {}: {}", entry.name(), path);
+                    consumed_tries_left = Some(target.counter.tries_left);
+                    // A unified kernel image is the entry file itself, so it has to be booted by
+                    // its new name.
+                    if let Some(chainload) = entry_context.get("chainload")
+                        && let Some(directory) = chainload.len().checked_sub(target.file_name.len())
+                        && chainload
+                            .get(directory..)
+                            .is_some_and(|name| name.eq_ignore_ascii_case(&target.file_name))
+                        && let Some(renamed) =
+                            path.to_string().rsplit('\\').next().map(String::from)
+                    {
+                        let renamed = format!("{}{}", &chainload[..directory], renamed);
+                        let mut context = entry_context.fork();
+                        context.set("chainload", renamed);
+                        entry_context = context.freeze();
+                    }
+                    // Tell the system where the counter is, so it can mark the boot as good.
+                    let path = edera_sprout_bls::boot_path(&path.to_string());
+                    advisory(
+                        BootloaderInterface::set_boot_count_path(&path)
+                            .context("unable to set boot count path in bootloader interface"),
+                    );
+                }
+                Err(error) => warn!(
+                    "unable to update boot counter of entry {}: {:#}",
+                    entry.name(),
+                    error
+                ),
+            }
+        }
+
+        // Decide whether a failure to start the entry reboots the machine. This is only decided now,
+        // as an earlier failure did not use up a try, so a reboot would not make any progress.
+        *reboot_on_error = loader_conf
+            .reboot_on_error
+            .should_reboot(consumed_tries_left);
+
+        // Execute all the actions for the selected entry.
+        for action in &entry.declaration().actions {
+            let action = entry_context.stamp(action);
+            actions::execute(entry_context.clone(), &action)
+                .context(format!("unable to execute action '{}'", action))?;
+        }
+
+        // Once the image returns, which is not usual, systemd-boot shows the menu again and waits,
+        // while outside of strict mode Sprout goes on to exit to the firmware.
+        if strict {
+            info!("the boot entry returned, showing the menu again");
+            force_boot_menu = true;
+            wait_for_user = true;
+            menu_disabled = false;
+            continue;
+        }
+        info!(
+            "the boot entry returned, so Sprout exits to the firmware \
+             (systemd-boot and strict mode show the menu again)"
+        );
+        break;
+    }
+
+    Ok(())
+}
+
+/// The main entrypoint of sprout.
+/// It is possible this function will not return if actions that are executed
+/// exit boot services or do not return control to sprout.
+#[entry]
+fn efi_main() -> Status {
+    // Initialize the basic UEFI environment.
+    // If initialization fails, we will return ABORTED.
+    // NOTE: This function will also initialize the logger.
+    // The logger will panic if it is unable to initialize.
+    // It is guaranteed that if this returns, the logger is initialized.
+    if let Err(error) = setup::init() {
+        error!("unable to initialize environment: {}", error);
+        return Status::ABORTED;
+    }
+
+    // Run Sprout, then handle the error.
+    let mut reboot_on_error = false;
+    let result = run(&mut reboot_on_error);
+    if let Err(ref error) = result {
+        // Print an error trace.
+        error!("sprout encountered an error: {}", error);
+        for (index, stack) in error.chain().enumerate() {
+            error!("[{}]: {}", index, stack);
+        }
+        // Sleep to allow the user to read the error. A reboot is announced first, so it is
+        // known why the machine is about to reset.
+        if reboot_on_error {
+            error!(
+                "rebooting in {} seconds after a failure to start the boot entry",
+                DELAY_ON_ERROR.as_secs()
+            );
+        }
+        uefi::boot::stall(DELAY_ON_ERROR);
+
+        // Reboot when asked to, so that the next boot can use the next try or entry.
+        if reboot_on_error {
+            uefi::runtime::reset(ResetType::COLD, Status::SUCCESS, None);
+        }
+        return Status::ABORTED;
+    }
+
+    // Sprout doesn't necessarily guarantee anything was booted.
+    // If we reach here, we will exit back to whoever called us.
+    Status::SUCCESS
+}

crates/boot/src/menu.rs

@@ -0,0 +1,242 @@
+use crate::entries::BootableEntry;
+use crate::menu::basic::BasicMenu;
+use crate::menu::graphical::GraphicalMenu;
+use crate::menu::simple::SimpleMenu;
+use alloc::vec;
+use alloc::vec::Vec;
+use anyhow::{Context, Result};
+use core::time::Duration;
+use edera_sprout_config::{GraphicalMenuConfiguration, MenuStyle};
+use eficore::bootloader_interface::BootloaderInterface;
+use eficore::platform::timer::PlatformTimer;
+use log::warn;
+use uefi::Event;
+use uefi::ResultExt;
+use uefi::boot::TimerTrigger;
+use uefi::proto::console::text::{Input, Key};
+use uefi_raw::table::boot::{EventType, Tpl};
+
+/// basic: A menu that prints the entries and selects them by number.
+pub mod basic;
+
+/// font: The bitmap font that the graphical menu draws text with.
+mod font;
+
+/// graphical: A menu drawn on the graphics output that is used with the keyboard, or the mouse if enabled.
+pub mod graphical;
+
+/// logo: The Sprout logo that the graphical menu draws in a corner.
+mod logo;
+
+/// simple: A full-screen menu that selects entries with the arrow keys.
+pub mod simple;
+
+/// How long a hidden menu waits for a key press before the default entry is booted.
+const HIDDEN_MENU_KEY_WAIT: Duration = Duration::from_millis(100);
+
+/// The longest duration a single timer is set for. This is well within the range of
+/// the 100ns units that timers are set in, and still over a century long.
+const MAX_TIMER_DURATION: Duration = Duration::from_secs(u32::MAX as u64);
+
+/// A boot menu that can be shown to select an entry to boot.
+pub trait BootMenu {
+    /// Select an entry from `entries` to boot. If no entry is chosen before `timeout` passes,
+    /// the default entry is selected. If `timeout` is zero, the default entry is selected
+    /// without showing the menu. If `timeout` is [None], the menu waits for the user.
+    fn select<'a>(
+        &self,
+        timeout: Option<Duration>,
+        entries: &'a [BootableEntry],
+    ) -> Result<&'a BootableEntry>;
+}
+
+/// Read a key from `input`, giving up once `timeout` passes.
+/// If `timeout` is [None], this waits for a key indefinitely.
+/// Returns the key that was pressed, or [None] if the timeout passed.
+pub fn read_key(input: &mut Input, timeout: Option<Duration>) -> Result<Option<Key>> {
+    // The event to wait for a key press.
+    let key_event = input
+        .wait_for_key_event()
+        .context("unable to acquire key event")?;
+
+    // Timer event for timeout.
+    // SAFETY: The timer event creation allocated a timer pointer on the UEFI heap.
+    // This is validated safe as long as we are in boot services.
+    let timer_event = unsafe {
+        uefi::boot::create_event_ex(EventType::TIMER, Tpl::CALLBACK, None, None, None)
+            .context("unable to create timer event")?
+    };
+
+    let events = vec![timer_event, key_event];
+
+    // Wait for a key until the timer triggers.
+    // Store the result so that we can free the timer event.
+    let result = (|| {
+        // Set a timer to trigger after the specified duration.
+        // The timer is limited to what the firmware can represent, as a longer timeout
+        // can't be converted into a timer trigger.
+        // Without a timeout, the timer is never set, so it never triggers.
+        if let Some(timeout) = timeout {
+            let trigger = TimerTrigger::Relative(timeout.min(MAX_TIMER_DURATION));
+            uefi::boot::set_timer(&events[0], trigger).context("unable to set timeout timer")?;
+        }
+
+        loop {
+            // Wait for either the timer event or the key event to trigger.
+            let event = uefi::boot::wait_for_event(&events)
+                .discard_errdata()
+                .context("unable to wait for event")?;
+
+            // The first event is the timer event, so the timeout has passed.
+            if event == 0 {
+                return Ok(None);
+            }
+
+            // Some firmware signals the key event without a key being available.
+            // In that case, keep waiting on the same timer so the timeout is not extended.
+            if let Some(key) = input.read_key().context("unable to read key")? {
+                return Ok(Some(key));
+            }
+        }
+    })();
+
+    // Close the timer event that we acquired.
+    // We don't need to close the key event because it is owned globally.
+    // This should always be called in practice as events are not modified by wait_for_event.
+    if let Some(timer_event) = events.into_iter().next() {
+        // Store the result of the close event so we can determine if we can safely assert it.
+        let close_event_result =
+            uefi::boot::close_event(timer_event).context("unable to close timer event");
+        if result.is_err()
+            && let Err(ref close_event_error) = close_event_result
+        {
+            // Log a warning if we failed to close the timer event.
+            // This is done to ensure we don't mask the error from reading the key.
+            warn!("unable to close timer event: {}", close_event_error);
+        } else {
+            // If we reach here, we can safely assert that the close event succeeded without
+            // masking the error from reading the key.
+            close_event_result?;
+        }
+    }
+
+    result
+}
+
+/// Wait until one of `events` is signaled, giving up once `timeout` passes.
+/// If `timeout` is [None], this waits for an event indefinitely.
+/// Returns the index of the event that was signaled, or [None] if the timeout passed.
+pub fn wait_for_events(events: &[Event], timeout: Option<Duration>) -> Result<Option<usize>> {
+    // Timer event for timeout.
+    // SAFETY: The timer event creation allocated a timer pointer on the UEFI heap.
+    // This is validated safe as long as we are in boot services.
+    let timer_event = unsafe {
+        uefi::boot::create_event_ex(EventType::TIMER, Tpl::CALLBACK, None, None, None)
+            .context("unable to create timer event")?
+    };
+
+    // The timer is the last event so the indexes of the events that were passed are kept.
+    // The events are only borrowed, so the timer is the only one that is closed.
+    // SAFETY: The cloned event is only used to wait, and is not closed.
+    let mut all: Vec<Event> = events
+        .iter()
+        .map(|event| unsafe { event.unsafe_clone() })
+        .collect();
+    all.push(unsafe { timer_event.unsafe_clone() });
+
+    let result = (|| {
+        // Without a timeout, the timer is never set, so it never triggers.
+        if let Some(timeout) = timeout {
+            let trigger = TimerTrigger::Relative(timeout.min(MAX_TIMER_DURATION));
+            uefi::boot::set_timer(&timer_event, trigger).context("unable to set timeout timer")?;
+        }
+
+        let index = uefi::boot::wait_for_event(&all)
+            .discard_errdata()
+            .context("unable to wait for event")?;
+        Ok((index != events.len()).then_some(index))
+    })();
+
+    // Close the timer event that we acquired, without masking an error from waiting.
+    if let Err(error) = uefi::boot::close_event(timer_event) {
+        if result.is_err() {
+            warn!("unable to close timer event: {}", error);
+        } else {
+            return Err(error).context("unable to close timer event");
+        }
+    }
+
+    result
+}
+
+/// Shows a boot menu of the specified `style` to select a bootable entry to boot.
+/// See [BootMenu::select] for how `timeout` is handled. A zero `timeout` hides the menu, but
+/// the menu is still shown if a key is pressed right away, unless `menu_disabled` is set.
+pub fn select<'live>(
+    timer: &'live PlatformTimer,
+    timeout: Option<Duration>,
+    menu_disabled: bool,
+    style: MenuStyle,
+    graphical: &GraphicalMenuConfiguration,
+    entries: &'live [BootableEntry],
+) -> Result<&'live BootableEntry> {
+    // A hidden menu gives the user a moment to ask for the menu with a key press.
+    let timeout = if timeout.is_some_and(|timeout| timeout.is_zero()) && !menu_disabled {
+        match uefi::system::with_stdin(|input| read_key(input, Some(HIDDEN_MENU_KEY_WAIT))) {
+            Ok(Some(_)) => None,
+            Ok(None) => timeout,
+            Err(error) => {
+                warn!("unable to check for a key press: {:#}", error);
+                timeout
+            }
+        }
+    } else {
+        timeout
+    };
+
+    // Notify the bootloader interface that we are about to display the menu.
+    // This is only informational, so it should not prevent booting.
+    if let Err(error) = BootloaderInterface::mark_menu(timer) {
+        warn!(
+            "unable to mark menu display in bootloader interface: {:#}",
+            error
+        );
+    }
+
+    // Pick the menu that implements the requested style.
+    match style {
+        MenuStyle::Basic => BasicMenu.select(timeout, entries),
+
+        // The graphical menu needs a graphics output, which not every machine has.
+        // If it fails, the simple menu is used instead, which falls back to the basic menu.
+        MenuStyle::Graphical => GraphicalMenu {
+            enable_mouse: graphical.enable_mouse,
+            enable_logo: graphical.enable_logo,
+            enable_animation: graphical.enable_animation,
+        }
+        .select(timeout, entries)
+        .or_else(|error| {
+            warn!(
+                "unable to show the graphical boot menu, using the simple menu: {:#}",
+                error
+            );
+            select_simple(timeout, entries)
+        }),
+
+        // The simple menu needs a console that can move the cursor and set colors, which
+        // not every console supports. If it fails, the basic menu is used instead.
+        MenuStyle::Simple => select_simple(timeout, entries),
+    }
+}
+
+/// Shows the simple boot menu, or the basic boot menu if the console does not support it.
+/// See [BootMenu::select] for how `timeout` is handled.
+fn select_simple(timeout: Option<Duration>, entries: &[BootableEntry]) -> Result<&BootableEntry> {
+    SimpleMenu.select(timeout, entries).or_else(|error| {
+        warn!(
+            "unable to show the simple boot menu, using the basic menu: {:#}",
+            error
+        );
+        BasicMenu.select(timeout, entries)
+    })
+}

crates/boot/src/menu/basic.rs

@@ -0,0 +1,184 @@
+use crate::entries::BootableEntry;
+use crate::menu::{BootMenu, read_key};
+use anyhow::{Context, Result};
+use core::time::Duration;
+use log::info;
+use uefi::proto::console::text::{Input, Key, ScanCode};
+
+/// The characters that can be used to select an entry from keys.
+const ENTRY_NUMBER_TABLE: &[char] = &['0', '1', '2', '3', '4', '5', '6', '7', '8', '9'];
+
+/// A boot menu that prints the entries and selects them by number.
+pub struct BasicMenu;
+
+/// Represents the operation that can be performed by the boot menu.
+#[derive(PartialEq, Eq)]
+enum MenuOperation {
+    /// The user typed a digit of an entry number.
+    Digit(usize),
+    /// The user selected the escape key to exit the boot menu.
+    Exit,
+    /// The user selected the enter key to boot the typed entry number,
+    /// or to display the entries again if no number was typed.
+    Enter,
+    /// The user selected some other key to display the entries again.
+    Continue,
+    /// Timeout occurred.
+    Timeout,
+    /// No operation should be performed.
+    Nop,
+}
+
+/// Read a key from the input device with an optional timeout, returning the [MenuOperation]
+/// that was performed. Without a timeout, this waits for a key indefinitely.
+fn read(input: &mut Input, timeout: Option<Duration>) -> Result<MenuOperation> {
+    // If the timer triggered, the user did not select a numbered entry.
+    let Some(key) = read_key(input, timeout)? else {
+        return Ok(MenuOperation::Timeout);
+    };
+
+    match key {
+        Key::Printable(c) => {
+            // If the key is not ascii, we can't process it.
+            if !c.is_ascii() {
+                return Ok(MenuOperation::Continue);
+            }
+            // Convert the key to a char.
+            let c: char = c.into();
+            // Serial consoles may send a line feed instead of a carriage return.
+            if matches!(c, '\r' | '\n') {
+                return Ok(MenuOperation::Enter);
+            }
+            // Find the key pressed in the entry number table or continue.
+            Ok(ENTRY_NUMBER_TABLE
+                .iter()
+                .position(|&x| x == c)
+                .map(MenuOperation::Digit)
+                .unwrap_or(MenuOperation::Continue))
+        }
+
+        // The escape key is used to exit the boot menu.
+        Key::Special(ScanCode::ESCAPE) => Ok(MenuOperation::Exit),
+
+        // If the special key is unknown, do nothing.
+        Key::Special(_) => Ok(MenuOperation::Nop),
+    }
+}
+
+/// Find the default entry in `entries`.
+fn default_entry(entries: &[BootableEntry]) -> Result<&BootableEntry> {
+    entries
+        .iter()
+        .find(|item| item.is_default())
+        .context("no default entry available")
+}
+
+/// Selects an entry from the list of entries using the boot menu.
+fn select_with_input<'a>(
+    input: &mut Input,
+    timeout: Option<Duration>,
+    entries: &'a [BootableEntry],
+) -> Result<&'a BootableEntry> {
+    // If the timeout is zero, boot the default entry without showing the menu.
+    if timeout.is_some_and(|timeout| timeout.is_zero()) {
+        return default_entry(entries);
+    }
+
+    // The time to wait for a key, or None once a key stops the countdown.
+    let mut countdown = timeout;
+
+    // The entry number typed so far, while more digits could still select another entry.
+    let mut typed: Option<usize> = None;
+    // Whether to print the entries before reading the next key.
+    let mut display = true;
+
+    loop {
+        if display {
+            // Print all the entries with the number used to select them.
+            info!("Boot Menu:");
+            for (index, entry) in entries.iter().enumerate() {
+                let title = entry.context().stamp(&entry.declaration().title);
+                info!("  [{}] {}", index, title);
+            }
+
+            info!("Select a boot entry using the number keys.");
+            if entries.len() > ENTRY_NUMBER_TABLE.len() {
+                info!("Press enter after the number if the entry does not boot right away.");
+            }
+            info!("Press Escape to exit and enter to display the entries again.");
+            display = false;
+        }
+
+        let operation = read(input, countdown)?;
+
+        // Any key stops the countdown, so the menu waits for the user from now on.
+        if operation != MenuOperation::Timeout {
+            countdown = None;
+        }
+
+        match operation {
+            // A digit of the entry number was typed.
+            MenuOperation::Digit(digit) => {
+                let number = typed
+                    .take()
+                    .unwrap_or(0)
+                    .saturating_mul(10)
+                    .saturating_add(digit);
+
+                // If another digit could select a different entry, wait for it or for enter.
+                if number != 0 && number.saturating_mul(10) < entries.len() {
+                    typed = Some(number);
+                    continue;
+                }
+
+                // Otherwise, boot the entry. If the number is invalid, we continue.
+                let Some(entry) = entries.get(number) else {
+                    info!("invalid entry number");
+                    continue;
+                };
+                return Ok(entry);
+            }
+
+            // Enter boots the typed entry number, or displays the entries again.
+            MenuOperation::Enter => {
+                let Some(number) = typed.take() else {
+                    display = true;
+                    continue;
+                };
+                let Some(entry) = entries.get(number) else {
+                    info!("invalid entry number");
+                    continue;
+                };
+                return Ok(entry);
+            }
+
+            // When the user exits the boot menu or a timeout occurs, we should
+            // boot the default entry, if any.
+            MenuOperation::Exit | MenuOperation::Timeout => {
+                return default_entry(entries);
+            }
+
+            // Any other key clears the typed number and displays the entries again.
+            MenuOperation::Continue => {
+                typed = None;
+                display = true;
+            }
+
+            // If the operation is nop, there is nothing to do.
+            MenuOperation::Nop => {}
+        }
+    }
+}
+
+impl BootMenu for BasicMenu {
+    /// Selects an entry using the basic menu.
+    /// The actual work is done internally in [select_with_input] which is called
+    /// within the context of the standard input device.
+    fn select<'a>(
+        &self,
+        timeout: Option<Duration>,
+        entries: &'a [BootableEntry],
+    ) -> Result<&'a BootableEntry> {
+        uefi::system::with_stdin(move |input| select_with_input(input, timeout, entries))
+    }
+}

crates/boot/src/menu/font.rs

@@ -0,0 +1,118 @@
+/// The width and height of a glyph in pixels.
+pub const GLYPH_SIZE: usize = 8;
+
+/// A glyph as eight rows from top to bottom, where the lowest bit of a row is its leftmost pixel.
+pub type Glyph = [u8; GLYPH_SIZE];
+
+/// Three dots, which are drawn where a title is cut off.
+pub const ELLIPSIS: Glyph = [0x00, 0x00, 0x00, 0x00, 0x00, 0xDB, 0xDB, 0x00];
+
+/// The glyphs for the printable ASCII characters from space to tilde.
+/// This is the public domain 8x8 font that is commonly used by hobby operating systems.
+const GLYPHS: [Glyph; 95] = [
+    [0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00],
+    [0x18, 0x3C, 0x3C, 0x18, 0x18, 0x00, 0x18, 0x00],
+    [0x36, 0x36, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00],
+    [0x36, 0x36, 0x7F, 0x36, 0x7F, 0x36, 0x36, 0x00],
+    [0x0C, 0x3E, 0x03, 0x1E, 0x30, 0x1F, 0x0C, 0x00],
+    [0x00, 0x63, 0x33, 0x18, 0x0C, 0x66, 0x63, 0x00],
+    [0x1C, 0x36, 0x1C, 0x6E, 0x3B, 0x33, 0x6E, 0x00],
+    [0x06, 0x06, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00],
+    [0x18, 0x0C, 0x06, 0x06, 0x06, 0x0C, 0x18, 0x00],
+    [0x06, 0x0C, 0x18, 0x18, 0x18, 0x0C, 0x06, 0x00],
+    [0x00, 0x66, 0x3C, 0xFF, 0x3C, 0x66, 0x00, 0x00],
+    [0x00, 0x0C, 0x0C, 0x3F, 0x0C, 0x0C, 0x00, 0x00],
+    [0x00, 0x00, 0x00, 0x00, 0x00, 0x0C, 0x0C, 0x06],
+    [0x00, 0x00, 0x00, 0x3F, 0x00, 0x00, 0x00, 0x00],
+    [0x00, 0x00, 0x00, 0x00, 0x00, 0x0C, 0x0C, 0x00],
+    [0x60, 0x30, 0x18, 0x0C, 0x06, 0x03, 0x01, 0x00],
+    [0x3E, 0x63, 0x73, 0x7B, 0x6F, 0x67, 0x3E, 0x00],
+    [0x0C, 0x0E, 0x0C, 0x0C, 0x0C, 0x0C, 0x3F, 0x00],
+    [0x1E, 0x33, 0x30, 0x1C, 0x06, 0x33, 0x3F, 0x00],
+    [0x1E, 0x33, 0x30, 0x1C, 0x30, 0x33, 0x1E, 0x00],
+    [0x38, 0x3C, 0x36, 0x33, 0x7F, 0x30, 0x78, 0x00],
+    [0x3F, 0x03, 0x1F, 0x30, 0x30, 0x33, 0x1E, 0x00],
+    [0x1C, 0x06, 0x03, 0x1F, 0x33, 0x33, 0x1E, 0x00],
+    [0x3F, 0x33, 0x30, 0x18, 0x0C, 0x0C, 0x0C, 0x00],
+    [0x1E, 0x33, 0x33, 0x1E, 0x33, 0x33, 0x1E, 0x00],
+    [0x1E, 0x33, 0x33, 0x3E, 0x30, 0x18, 0x0E, 0x00],
+    [0x00, 0x0C, 0x0C, 0x00, 0x00, 0x0C, 0x0C, 0x00],
+    [0x00, 0x0C, 0x0C, 0x00, 0x00, 0x0C, 0x0C, 0x06],
+    [0x18, 0x0C, 0x06, 0x03, 0x06, 0x0C, 0x18, 0x00],
+    [0x00, 0x00, 0x3F, 0x00, 0x00, 0x3F, 0x00, 0x00],
+    [0x06, 0x0C, 0x18, 0x30, 0x18, 0x0C, 0x06, 0x00],
+    [0x1E, 0x33, 0x30, 0x18, 0x0C, 0x00, 0x0C, 0x00],
+    [0x3E, 0x63, 0x7B, 0x7B, 0x7B, 0x03, 0x1E, 0x00],
+    [0x0C, 0x1E, 0x33, 0x33, 0x3F, 0x33, 0x33, 0x00],
+    [0x3F, 0x66, 0x66, 0x3E, 0x66, 0x66, 0x3F, 0x00],
+    [0x3C, 0x66, 0x03, 0x03, 0x03, 0x66, 0x3C, 0x00],
+    [0x1F, 0x36, 0x66, 0x66, 0x66, 0x36, 0x1F, 0x00],
+    [0x7F, 0x46, 0x16, 0x1E, 0x16, 0x46, 0x7F, 0x00],
+    [0x7F, 0x46, 0x16, 0x1E, 0x16, 0x06, 0x0F, 0x00],
+    [0x3C, 0x66, 0x03, 0x03, 0x73, 0x66, 0x7C, 0x00],
+    [0x33, 0x33, 0x33, 0x3F, 0x33, 0x33, 0x33, 0x00],
+    [0x1E, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x1E, 0x00],
+    [0x78, 0x30, 0x30, 0x30, 0x33, 0x33, 0x1E, 0x00],
+    [0x67, 0x66, 0x36, 0x1E, 0x36, 0x66, 0x67, 0x00],
+    [0x0F, 0x06, 0x06, 0x06, 0x46, 0x66, 0x7F, 0x00],
+    [0x63, 0x77, 0x7F, 0x7F, 0x6B, 0x63, 0x63, 0x00],
+    [0x63, 0x67, 0x6F, 0x7B, 0x73, 0x63, 0x63, 0x00],
+    [0x1C, 0x36, 0x63, 0x63, 0x63, 0x36, 0x1C, 0x00],
+    [0x3F, 0x66, 0x66, 0x3E, 0x06, 0x06, 0x0F, 0x00],
+    [0x1E, 0x33, 0x33, 0x33, 0x3B, 0x1E, 0x38, 0x00],
+    [0x3F, 0x66, 0x66, 0x3E, 0x36, 0x66, 0x67, 0x00],
+    [0x1E, 0x33, 0x07, 0x0E, 0x38, 0x33, 0x1E, 0x00],
+    [0x3F, 0x2D, 0x0C, 0x0C, 0x0C, 0x0C, 0x1E, 0x00],
+    [0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x3F, 0x00],
+    [0x33, 0x33, 0x33, 0x33, 0x33, 0x1E, 0x0C, 0x00],
+    [0x63, 0x63, 0x63, 0x6B, 0x7F, 0x77, 0x63, 0x00],
+    [0x63, 0x63, 0x36, 0x1C, 0x1C, 0x36, 0x63, 0x00],
+    [0x33, 0x33, 0x33, 0x1E, 0x0C, 0x0C, 0x1E, 0x00],
+    [0x7F, 0x63, 0x31, 0x18, 0x4C, 0x66, 0x7F, 0x00],
+    [0x1E, 0x06, 0x06, 0x06, 0x06, 0x06, 0x1E, 0x00],
+    [0x03, 0x06, 0x0C, 0x18, 0x30, 0x60, 0x40, 0x00],
+    [0x1E, 0x18, 0x18, 0x18, 0x18, 0x18, 0x1E, 0x00],
+    [0x08, 0x1C, 0x36, 0x63, 0x00, 0x00, 0x00, 0x00],
+    [0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF],
+    [0x0C, 0x0C, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00],
+    [0x00, 0x00, 0x1E, 0x30, 0x3E, 0x33, 0x6E, 0x00],
+    [0x07, 0x06, 0x06, 0x3E, 0x66, 0x66, 0x3B, 0x00],
+    [0x00, 0x00, 0x1E, 0x33, 0x03, 0x33, 0x1E, 0x00],
+    [0x38, 0x30, 0x30, 0x3E, 0x33, 0x33, 0x6E, 0x00],
+    [0x00, 0x00, 0x1E, 0x33, 0x3F, 0x03, 0x1E, 0x00],
+    [0x1C, 0x36, 0x06, 0x0F, 0x06, 0x06, 0x0F, 0x00],
+    [0x00, 0x00, 0x6E, 0x33, 0x33, 0x3E, 0x30, 0x1F],
+    [0x07, 0x06, 0x36, 0x6E, 0x66, 0x66, 0x67, 0x00],
+    [0x0C, 0x00, 0x0E, 0x0C, 0x0C, 0x0C, 0x1E, 0x00],
+    [0x30, 0x00, 0x30, 0x30, 0x30, 0x33, 0x33, 0x1E],
+    [0x07, 0x06, 0x66, 0x36, 0x1E, 0x36, 0x67, 0x00],
+    [0x0E, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x1E, 0x00],
+    [0x00, 0x00, 0x33, 0x7F, 0x7F, 0x6B, 0x63, 0x00],
+    [0x00, 0x00, 0x1F, 0x33, 0x33, 0x33, 0x33, 0x00],
+    [0x00, 0x00, 0x1E, 0x33, 0x33, 0x33, 0x1E, 0x00],
+    [0x00, 0x00, 0x3B, 0x66, 0x66, 0x3E, 0x06, 0x0F],
+    [0x00, 0x00, 0x6E, 0x33, 0x33, 0x3E, 0x30, 0x78],
+    [0x00, 0x00, 0x3B, 0x6E, 0x66, 0x06, 0x0F, 0x00],
+    [0x00, 0x00, 0x3E, 0x03, 0x1E, 0x30, 0x1F, 0x00],
+    [0x08, 0x0C, 0x3E, 0x0C, 0x0C, 0x2C, 0x18, 0x00],
+    [0x00, 0x00, 0x33, 0x33, 0x33, 0x33, 0x6E, 0x00],
+    [0x00, 0x00, 0x33, 0x33, 0x33, 0x1E, 0x0C, 0x00],
+    [0x00, 0x00, 0x63, 0x6B, 0x7F, 0x7F, 0x36, 0x00],
+    [0x00, 0x00, 0x63, 0x36, 0x1C, 0x36, 0x63, 0x00],
+    [0x00, 0x00, 0x33, 0x33, 0x33, 0x3E, 0x30, 0x1F],
+    [0x00, 0x00, 0x3F, 0x19, 0x0C, 0x26, 0x3F, 0x00],
+    [0x38, 0x0C, 0x0C, 0x07, 0x0C, 0x0C, 0x38, 0x00],
+    [0x18, 0x18, 0x18, 0x00, 0x18, 0x18, 0x18, 0x00],
+    [0x07, 0x0C, 0x0C, 0x38, 0x0C, 0x0C, 0x07, 0x00],
+    [0x6E, 0x3B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00],
+];
+
+/// Get the glyph for `c`, or a question mark for anything that isn't printable ASCII.
+pub fn glyph(c: char) -> &'static Glyph {
+    let index = if c.is_ascii() && (' '..='~').contains(&c) {
+        c as usize - ' ' as usize
+    } else {
+        '?' as usize - ' ' as usize
+    };
+    &GLYPHS[index]
+}

crates/boot/src/menu/graphical.rs

@@ -0,0 +1,957 @@
+use crate::entries::BootableEntry;
+use crate::menu::font::{self, ELLIPSIS, GLYPH_SIZE, Glyph};
+use crate::menu::logo::{LOGO, LOGO_HEIGHT, LOGO_WIDTH};
+use crate::menu::{BootMenu, wait_for_events};
+use alloc::format;
+use alloc::string::String;
+use alloc::vec::Vec;
+use anyhow::{Context, Result, bail};
+use core::time::Duration;
+use eficore::framebuffer::Framebuffer;
+use uefi::boot::{OpenProtocolParams, ScopedProtocol};
+use uefi::proto::ProtocolPointer;
+use uefi::proto::console::gop::{BltPixel, GraphicsOutput};
+use uefi::proto::console::pointer::{AbsolutePointer, Pointer};
+use uefi::proto::console::text::{Input, Key, ScanCode};
+use uefi::proto::device_path::DevicePath;
+use uefi::{Event, Handle};
+
+/// How often the countdown and the logo are updated.
+const TICK: Duration = Duration::from_millis(125);
+
+/// The number of ticks in one bounce of the logo.
+const BOUNCE_TICKS: usize = 16;
+
+/// How many pixels the cursor moves for each millimeter that a relative pointer reports.
+const PIXELS_PER_MILLIMETER: i64 = 8;
+
+/// The title shown above the entries.
+const TITLE: &str = "sprout";
+
+/// The hint shown once the countdown has been stopped.
+const HINT: &str = "Pick an entry with the arrow keys.";
+
+/// The hint shown instead of [HINT] when the mouse is in use.
+const HINT_MOUSE: &str = "Pick an entry with the arrow keys or the mouse.";
+
+/// The color of the top of the background, which fades into [BACKGROUND_BOTTOM].
+const BACKGROUND_TOP: (u8, u8, u8) = (0x3a, 0x1c, 0x4e);
+
+/// The color of the bottom of the background.
+const BACKGROUND_BOTTOM: (u8, u8, u8) = (0x16, 0x0c, 0x24);
+
+/// The widest that the status line gets, which the panel has room for.
+const STATUS_WIDEST: &str = "Boot in 999 s.";
+
+/// The color of the panel behind the entries.
+const PANEL: BltPixel = BltPixel::new(0x22, 0x12, 0x34);
+
+/// The color of the edge of the panel, the line below the entries and the scrollbar track.
+const PANEL_EDGE: BltPixel = BltPixel::new(0x4a, 0x2e, 0x66);
+
+/// The color of the pill behind the selected entry, taken from the Sprout logo.
+const PILL_SELECTED: BltPixel = BltPixel::new(0xff, 0x7a, 0xb8);
+
+/// The color of the title.
+const ACCENT: BltPixel = BltPixel::new(0xff, 0xa6, 0xd0);
+
+/// The color of entries that aren't selected.
+const TEXT: BltPixel = BltPixel::new(0xf3, 0xd9, 0xea);
+
+/// The color of the selected entry.
+const TEXT_SELECTED: BltPixel = BltPixel::new(0x3a, 0x10, 0x2c);
+
+/// The color of the status line.
+const TEXT_MUTED: BltPixel = BltPixel::new(0xb9, 0x9a, 0xc9);
+
+/// The color that the cursor is filled with.
+const CURSOR_FILL: BltPixel = BltPixel::new(0xff, 0xff, 0xff);
+
+/// The color of the outline of the cursor.
+const CURSOR_OUTLINE: BltPixel = BltPixel::new(0x3a, 0x10, 0x2c);
+
+/// The shape of the cursor, where `X` is the outline and `.` is the fill.
+const CURSOR: [&str; 16] = [
+    "X          ",
+    "XX         ",
+    "X.X        ",
+    "X..X       ",
+    "X...X      ",
+    "X....X     ",
+    "X.....X    ",
+    "X......X   ",
+    "X.......X  ",
+    "X........X ",
+    "X.....XXXXX",
+    "X..X..X    ",
+    "X.X X..X   ",
+    "XX  X..X   ",
+    "X    X..X  ",
+    "     XXXX  ",
+];
+
+/// A graphical boot menu that selects entries with the keyboard, or the mouse if enabled.
+pub struct GraphicalMenu {
+    /// Whether the mouse is used when the firmware has a pointing device.
+    pub enable_mouse: bool,
+    /// Whether the logo is drawn next to the name.
+    pub enable_logo: bool,
+    /// Whether the logo bounces.
+    pub enable_animation: bool,
+}
+
+/// The pointing devices of the firmware.
+/// Firmware commonly has both kinds of protocol, even if one has no device behind it.
+struct Mouse {
+    /// A device that reports how far it has moved, like a mouse.
+    relative: Option<ScopedProtocol<Pointer>>,
+    /// A device that reports where it is, like a touch screen or the tablet of a virtual machine.
+    absolute: Option<ScopedProtocol<AbsolutePointer>>,
+}
+
+/// Open the pointer protocol `P`, preferring the one on the console input handle.
+/// That one belongs to the console splitter, which combines every device and is never removed.
+/// Otherwise, the first device that has the protocol is used.
+fn open_pointer<P: ProtocolPointer + ?Sized>() -> Option<ScopedProtocol<P>> {
+    // SAFETY: The handle in the system table is either null or a valid handle.
+    let console = uefi::table::system_table_raw()
+        .and_then(|table| unsafe { Handle::from_ptr(table.as_ref().stdin_handle) });
+    console
+        .and_then(|handle| eficore::handle::open_shared::<P>(handle).ok())
+        .or_else(|| {
+            uefi::boot::get_handle_for_protocol::<P>()
+                .and_then(eficore::handle::open_shared::<P>)
+                .ok()
+        })
+}
+
+impl Mouse {
+    /// Open the pointing devices, if the firmware has any.
+    fn open() -> Option<Self> {
+        let relative = open_pointer::<Pointer>();
+        let absolute = open_pointer::<AbsolutePointer>();
+        (relative.is_some() || absolute.is_some()).then_some(Self { relative, absolute })
+    }
+
+    /// The events that are signaled when a device has input.
+    fn events(&self) -> Result<Vec<Event>> {
+        let mut events = Vec::new();
+        if let Some(pointer) = &self.relative {
+            events.push(pointer.wait_for_input_event());
+        }
+        if let Some(pointer) = &self.absolute {
+            events.push(pointer.wait_for_input_event());
+        }
+        events
+            .into_iter()
+            .collect::<uefi::Result<_>>()
+            .context("unable to acquire pointer event")
+    }
+
+    /// Move `cursor` within `bounds` to where the devices say it is.
+    /// Returns whether the button is held, or [None] if the devices have no new input.
+    fn poll(
+        &mut self,
+        cursor: &mut (usize, usize),
+        bounds: (usize, usize),
+    ) -> Result<Option<bool>> {
+        let mut button = None;
+        let max = (
+            bounds.0.saturating_sub(1) as i64,
+            bounds.1.saturating_sub(1) as i64,
+        );
+
+        if let Some(pointer) = &mut self.relative {
+            // The movement is in counts, and the device reports how many are in a millimeter.
+            let mode = *pointer.mode();
+            if let Some(state) = pointer.read_state().context("unable to read pointer")? {
+                let step = |movement: i32, resolution: u64| {
+                    movement as i64 * PIXELS_PER_MILLIMETER / resolution.max(1) as i64
+                };
+                let x = cursor.0 as i64 + step(state.relative_movement_x, mode.resolution_x);
+                let y = cursor.1 as i64 + step(state.relative_movement_y, mode.resolution_y);
+                *cursor = (x.clamp(0, max.0) as usize, y.clamp(0, max.1) as usize);
+                button = Some(state.left_button.into());
+            }
+        }
+
+        if let Some(pointer) = &mut self.absolute {
+            // The position is somewhere between the minimum and maximum of the device.
+            let mode = *pointer.mode();
+            if let Some(state) = pointer.read_state().context("unable to read pointer")? {
+                let scale = |value: u64, min: u64, device_max: u64, bound: i64| {
+                    let span = device_max.saturating_sub(min).max(1) as i128;
+                    (value.saturating_sub(min) as i128 * bound as i128 / span).min(bound as i128)
+                        as usize
+                };
+                *cursor = (
+                    scale(
+                        state.current_x,
+                        mode.absolute_min_x,
+                        mode.absolute_max_x,
+                        max.0,
+                    ),
+                    scale(
+                        state.current_y,
+                        mode.absolute_min_y,
+                        mode.absolute_max_y,
+                        max.1,
+                    ),
+                );
+                button = Some(state.active_buttons & 1 != 0);
+            }
+        }
+
+        Ok(button)
+    }
+}
+
+/// The position and size of everything on the framebuffer.
+/// The logo and the name are in a header, with a panel below it that holds the entries.
+struct Layout {
+    /// How many pixels each pixel of the font is drawn as.
+    scale: usize,
+    /// The size of a character in pixels.
+    cell: usize,
+    /// The column that entries start at.
+    x: usize,
+    /// The row that the first entry starts at.
+    y: usize,
+    /// The width of each entry.
+    width: usize,
+    /// The height of each entry.
+    height: usize,
+    /// The space between entries.
+    gap: usize,
+    /// The number of entries that fit on the framebuffer.
+    visible: usize,
+    /// The column, row, width and height of the panel behind the entries.
+    panel: (usize, usize, usize, usize),
+    /// How round the corners of the panel are.
+    radius: usize,
+    /// The column that the text of an entry starts at.
+    text_x: usize,
+    /// How many characters of a title fit in an entry.
+    columns: usize,
+    /// The row of the line between the entries and the status line.
+    footer: usize,
+    /// The column, row, width and height of the logo when it is on the ground, if it is shown.
+    logo: Option<(usize, usize, usize, usize)>,
+    /// How many pixels the logo rises while it bounces.
+    bounce: usize,
+    /// The column, row and scale of the name, if there is room for it.
+    title: Option<(usize, usize, usize)>,
+    /// Whether there are more entries than fit, which adds a scrollbar.
+    scrolls: bool,
+}
+
+impl Layout {
+    /// Calculate the layout of `entries` on a framebuffer of `screen` width and height.
+    fn new(screen: (usize, usize), entries: &[BootableEntry], logo: bool, animate: bool) -> Self {
+        let (width, height) = screen;
+
+        // Large screens get larger text so that it stays readable, but not so large that the
+        // titles take up the whole screen.
+        let scale = (height / 540).min(width / 640).clamp(1, 3);
+        let cell = GLYPH_SIZE * scale;
+        let margin = (cell * 2).max(height / 20).min(width / 8);
+        let padding = cell * 3 / 2;
+        let (row, gap) = (cell * 2, scale * 2);
+        let header_gap = cell * 2;
+
+        // The line between the entries and the status, and the status below it.
+        let footer_height = cell + scale + cell / 2 + cell;
+
+        // The panel is the width of the longest title, but never most of the screen.
+        let longest = entries
+            .iter()
+            .map(|entry| entry.title().chars().count())
+            .max()
+            .unwrap_or(0);
+        let status = HINT.len().max(HINT_MOUSE.len()).max(STATUS_WIDEST.len());
+        let panel_width = ((longest + 3) * cell + padding * 2)
+            .max(40 * cell)
+            .max((status + 8) * cell)
+            .min(width.saturating_sub(margin * 2).min(width * 4 / 5));
+
+        // The header is as tall as the logo, and the logo needs room to bounce.
+        let fit = |logo: usize| {
+            let header = logo + logo / 16;
+            let space = height
+                .saturating_sub(margin * 2 + header + header_gap + padding * 2 + footer_height);
+            let visible = ((space + gap) / (row + gap)).clamp(1, entries.len().max(1));
+            (header, visible)
+        };
+        let mut logo_height = (LOGO_HEIGHT * 2).min(height / 7).max(32);
+        let (mut header, mut visible) = fit(logo_height);
+        // A short screen gets a smaller logo before it loses entries.
+        if visible < entries.len().min(3) {
+            logo_height = (logo_height / 2).max(32);
+            (header, visible) = fit(logo_height);
+        }
+        let logo_width = logo_height * LOGO_WIDTH / LOGO_HEIGHT;
+        let bounce = if animate { logo_height / 16 } else { 0 };
+
+        // The name is next to the logo, if the two fit together.
+        let title_scale = (logo_height / 32).clamp(scale, scale * 3);
+        let title_width = TITLE.len() * GLYPH_SIZE * title_scale;
+        // Without the logo, the name is alone and takes the place of the group.
+        let shown = if logo { logo_width + cell } else { 0 };
+        let fits = shown + title_width <= width.saturating_sub(margin * 2);
+        let group = match (logo, fits) {
+            (true, true) => shown + title_width,
+            (true, false) => logo_width,
+            (false, _) => title_width,
+        };
+        let group_x = width.saturating_sub(group) / 2;
+
+        let list = visible * (row + gap) - gap;
+        let panel_height = padding * 2 + list + footer_height;
+        let top = (height.saturating_sub(header + header_gap + panel_height) / 2).max(margin);
+        let panel_x = width.saturating_sub(panel_width) / 2;
+        let panel_y = top + header + header_gap;
+
+        // The scrollbar is in a column next to the entries.
+        let scrolls = visible < entries.len();
+        let gutter = if scrolls { cell } else { 0 };
+        let list_width = panel_width.saturating_sub(padding * 2 + gutter);
+        let list_y = panel_y + padding;
+
+        Self {
+            scale,
+            cell,
+            x: panel_x + padding,
+            y: list_y,
+            width: list_width,
+            height: row,
+            gap,
+            visible,
+            panel: (panel_x, panel_y, panel_width, panel_height),
+            radius: cell,
+            text_x: panel_x + padding + cell,
+            columns: list_width.saturating_sub(cell * 2) / cell,
+            footer: list_y + list + cell,
+            logo: logo.then_some((group_x, top + bounce, logo_width, logo_height)),
+            bounce,
+            title: fits.then_some((
+                group_x + shown,
+                top + bounce + logo_height.saturating_sub(GLYPH_SIZE * title_scale) / 2,
+                title_scale,
+            )),
+            scrolls,
+        }
+    }
+
+    /// The row that the entry at `slot` on the screen starts at.
+    fn row(&self, slot: usize) -> usize {
+        self.y + slot * (self.height + self.gap)
+    }
+
+    /// The slot of the entry that is at `position`, if there is one.
+    fn slot_at(&self, position: (usize, usize)) -> Option<usize> {
+        let (x, y) = (
+            position.0.checked_sub(self.x)?,
+            position.1.checked_sub(self.y)?,
+        );
+        let slot = y / (self.height + self.gap);
+        (x < self.width && y % (self.height + self.gap) < self.height && slot < self.visible)
+            .then_some(slot)
+    }
+}
+
+/// A display that the menu is drawn to.
+struct Screen {
+    /// The graphics output of the display.
+    gop: ScopedProtocol<GraphicsOutput>,
+    /// What is drawn before it is blitted to the display.
+    fb: Framebuffer,
+    /// What was last blitted to the display, which only has to be updated where it differs.
+    shown: Framebuffer,
+    /// The parts of the menu that never change, which each frame starts from.
+    base: Framebuffer,
+    /// Whether the display has had a frame blitted to it.
+    drawn: bool,
+    /// Where the entries are on this display.
+    layout: Layout,
+    /// The index of the first entry that is on this display.
+    offset: usize,
+}
+
+impl Screen {
+    /// Open every display that the firmware has, or fail if it has none.
+    /// The console splitter has a graphics output that draws to every display. It has no device
+    /// path, so it is only used if there are no outputs for the displays themselves.
+    fn open_all(
+        entries: &[BootableEntry],
+        enable_logo: bool,
+        enable_animation: bool,
+    ) -> Result<Vec<Self>> {
+        let handles = uefi::boot::find_handles::<GraphicsOutput>()
+            .context("unable to find a graphics output")?;
+        let has_device_path = |handle: &Handle| {
+            uefi::boot::test_protocol::<DevicePath>(OpenProtocolParams {
+                handle: *handle,
+                agent: uefi::boot::image_handle(),
+                controller: None,
+            })
+            .unwrap_or(false)
+        };
+        let displays = handles
+            .iter()
+            .copied()
+            .filter(has_device_path)
+            .collect::<Vec<_>>();
+        let handles = if displays.is_empty() {
+            handles
+        } else {
+            displays
+        };
+
+        let mut screens = Vec::new();
+        for handle in handles {
+            // Opening it exclusively would disconnect the firmware's text console from the
+            // display, and anything printed after the menu may not show up.
+            let Ok(gop) = eficore::handle::open_shared::<GraphicsOutput>(handle) else {
+                continue;
+            };
+            let (width, height) = gop.current_mode_info().resolution();
+            let (Ok(fb), Ok(shown), Ok(mut base)) = (
+                Framebuffer::new(width, height),
+                Framebuffer::new(width, height),
+                Framebuffer::new(width, height),
+            ) else {
+                continue;
+            };
+            let layout = Layout::new((width, height), entries, enable_logo, enable_animation);
+            render_base(&mut base, &layout);
+            screens.push(Self {
+                gop,
+                fb,
+                shown,
+                base,
+                drawn: false,
+                layout,
+                offset: 0,
+            });
+        }
+
+        if screens.is_empty() {
+            bail!("unable to open a graphics output");
+        }
+        Ok(screens)
+    }
+
+    /// The size of the display in pixels.
+    fn size(&self) -> (usize, usize) {
+        (self.fb.width(), self.fb.height())
+    }
+
+    /// Where `position` on a display of size `from` is on this display, keeping its place
+    /// relative to the edges.
+    fn locate(&self, position: (usize, usize), from: (usize, usize)) -> (usize, usize) {
+        let scale = |value: usize, to: usize, from: usize| {
+            (value * to / from.max(1)).min(to.saturating_sub(1))
+        };
+        (
+            scale(position.0, self.fb.width(), from.0),
+            scale(position.1, self.fb.height(), from.1),
+        )
+    }
+
+    /// Scroll so that the `selected` entry is visible.
+    fn scroll_to(&mut self, selected: usize) {
+        if selected < self.offset {
+            self.offset = selected;
+        } else if selected >= self.offset + self.layout.visible {
+            self.offset = selected + 1 - self.layout.visible;
+        }
+    }
+}
+
+/// What is shown on the framebuffer.
+struct Scene<'a> {
+    /// The entries that can be chosen.
+    entries: &'a [BootableEntry],
+    /// The index of the selected entry.
+    selected: usize,
+    /// The status line at the bottom of the screen.
+    status: String,
+    /// The number of ticks since the menu was shown, which moves the logo.
+    ticks: usize,
+}
+
+/// Fill `rows` with a gradient from `top` to `bottom`.
+fn draw_background(fb: &mut Framebuffer, top: (u8, u8, u8), bottom: (u8, u8, u8)) {
+    let (width, height) = (fb.width(), fb.height());
+    let mix = |from: u8, to: u8, row: usize| {
+        (from as i64 + (to as i64 - from as i64) * row as i64 / height.max(1) as i64) as u8
+    };
+    for row in 0..height {
+        let color = BltPixel::new(
+            mix(top.0, bottom.0, row),
+            mix(top.1, bottom.1, row),
+            mix(top.2, bottom.2, row),
+        );
+        fb.fill_rect(0, row, width, 1, color);
+    }
+}
+
+/// Fill a rectangle that has rounded corners of `radius`.
+fn draw_rounded(
+    fb: &mut Framebuffer,
+    x: usize,
+    y: usize,
+    width: usize,
+    height: usize,
+    radius: usize,
+    color: BltPixel,
+) {
+    if width == 0 || height == 0 {
+        return;
+    }
+    let radius = radius.min(height / 2).min(width / 2);
+    for row in 0..height {
+        // How far the row is from the edge, where the corners curve in.
+        let edge = row.min(height - 1 - row);
+        let inset = if edge >= radius {
+            0
+        } else {
+            let rise = radius - edge;
+            (0..radius)
+                .find(|inset| (radius - inset).pow(2) + rise.pow(2) <= radius.pow(2))
+                .unwrap_or(radius)
+        };
+        fb.fill_rect(
+            x + inset,
+            y + row,
+            width.saturating_sub(inset * 2),
+            1,
+            color,
+        );
+    }
+}
+
+/// Fill a rectangle with the shape of a pill, which has fully rounded ends.
+fn draw_pill(
+    fb: &mut Framebuffer,
+    x: usize,
+    y: usize,
+    width: usize,
+    height: usize,
+    color: BltPixel,
+) {
+    draw_rounded(fb, x, y, width, height, height / 2, color);
+}
+
+/// Draw `glyph` at `x` and `y`, with each pixel of it drawn as `scale` by `scale` pixels.
+fn draw_glyph(
+    fb: &mut Framebuffer,
+    x: usize,
+    y: usize,
+    scale: usize,
+    glyph: &Glyph,
+    color: BltPixel,
+) {
+    for (row, bits) in glyph.iter().enumerate() {
+        for column in (0..GLYPH_SIZE).filter(|column| bits >> column & 1 != 0) {
+            fb.fill_rect(x + column * scale, y + row * scale, scale, scale, color);
+        }
+    }
+}
+
+/// Draw `text` starting at `x` and `y`, cut off with an ellipsis if it is over `columns` characters.
+fn draw_text(
+    fb: &mut Framebuffer,
+    x: usize,
+    y: usize,
+    scale: usize,
+    columns: usize,
+    text: &str,
+    color: BltPixel,
+) {
+    let cut = text.chars().count() > columns;
+    let shown = if cut {
+        columns.saturating_sub(1)
+    } else {
+        columns
+    };
+    for (index, c) in text.chars().take(shown).enumerate() {
+        draw_glyph(
+            fb,
+            x + index * GLYPH_SIZE * scale,
+            y,
+            scale,
+            font::glyph(c),
+            color,
+        );
+    }
+    if cut && columns > 0 {
+        draw_glyph(
+            fb,
+            x + shown * GLYPH_SIZE * scale,
+            y,
+            scale,
+            &ELLIPSIS,
+            color,
+        );
+    }
+}
+
+/// Draw `text` in the middle of `x` and `width` at `y`.
+fn draw_centered(
+    fb: &mut Framebuffer,
+    x: usize,
+    width: usize,
+    y: usize,
+    scale: usize,
+    text: &str,
+    color: BltPixel,
+) {
+    let columns = width / (GLYPH_SIZE * scale);
+    let used = text.chars().count().min(columns) * GLYPH_SIZE * scale;
+    draw_text(fb, x + (width - used) / 2, y, scale, columns, text, color);
+}
+
+/// Draw the logo above the entries, bouncing a little with each of `ticks`.
+fn draw_logo(fb: &mut Framebuffer, layout: &Layout, ticks: usize) {
+    let Some((x, floor, width, height)) = layout.logo else {
+        return;
+    };
+
+    // The logo rises and falls by up to `bounce` pixels.
+    let phase = ticks % BOUNCE_TICKS;
+    let rise = phase.min(BOUNCE_TICKS - phase) * layout.bounce / (BOUNCE_TICKS / 2);
+    let y = floor - rise;
+
+    for row in 0..height {
+        let source_row = row * LOGO_HEIGHT / height * LOGO_WIDTH;
+        for column in 0..width {
+            let source = (source_row + column * LOGO_WIDTH / width) * 4;
+            let [red, green, blue, alpha] = LOGO[source..source + 4] else {
+                continue;
+            };
+            if alpha == 0 {
+                continue;
+            }
+            // The channels are premultiplied, so the color is the logo plus what shows through.
+            if let Some(pixel) = fb.pixel(x + column, y + row) {
+                let through = 255 - alpha as u32;
+                let blend =
+                    |logo: u8, behind: u8| (logo as u32 + behind as u32 * through / 255) as u8;
+                *pixel = BltPixel::new(
+                    blend(red, pixel.red),
+                    blend(green, pixel.green),
+                    blend(blue, pixel.blue),
+                );
+            }
+        }
+    }
+}
+
+/// Draw the track and the thumb of the scrollbar, which shows where `offset` is in `total`.
+fn draw_scrollbar(fb: &mut Framebuffer, layout: &Layout, offset: usize, total: usize) {
+    let height = layout.visible * (layout.height + layout.gap) - layout.gap;
+    let x = layout.x + layout.width + layout.cell / 2 - layout.scale;
+    let width = layout.scale * 2;
+    fb.fill_rect(x, layout.y, width, height, PANEL_EDGE);
+
+    let thumb = (height * layout.visible / total)
+        .max(layout.cell)
+        .min(height);
+    let travel = total.saturating_sub(layout.visible).max(1);
+    let y = layout.y + (height - thumb) * offset.min(travel) / travel;
+    draw_rounded(fb, x, y, width, thumb, width / 2, ACCENT);
+}
+
+/// Draw the cursor with its tip at `position`.
+fn draw_cursor(fb: &mut Framebuffer, scale: usize, position: (usize, usize)) {
+    for (row, line) in CURSOR.iter().enumerate() {
+        for (column, shape) in line.bytes().enumerate() {
+            let color = match shape {
+                b'X' => CURSOR_OUTLINE,
+                b'.' => CURSOR_FILL,
+                _ => continue,
+            };
+            fb.fill_rect(
+                position.0 + column * scale,
+                position.1 + row * scale,
+                scale,
+                scale,
+                color,
+            );
+        }
+    }
+}
+
+/// Draw the parts of the menu that never change to the framebuffer.
+fn render_base(fb: &mut Framebuffer, layout: &Layout) {
+    draw_background(fb, BACKGROUND_TOP, BACKGROUND_BOTTOM);
+    if let Some((x, y, scale)) = layout.title {
+        draw_text(fb, x, y, scale, TITLE.len(), TITLE, ACCENT);
+    }
+
+    let (panel_x, panel_y, panel_width, panel_height) = layout.panel;
+    let edge = layout.scale;
+    draw_rounded(
+        fb,
+        panel_x,
+        panel_y,
+        panel_width,
+        panel_height,
+        layout.radius,
+        PANEL_EDGE,
+    );
+    draw_rounded(
+        fb,
+        panel_x + edge,
+        panel_y + edge,
+        panel_width.saturating_sub(edge * 2),
+        panel_height.saturating_sub(edge * 2),
+        layout.radius.saturating_sub(edge),
+        PANEL,
+    );
+
+    // The line between the entries and the status line.
+    let inner = panel_width.saturating_sub(layout.cell * 3);
+    let inner_x = panel_x + layout.cell * 3 / 2;
+    fb.fill_rect(inner_x, layout.footer, inner, layout.scale, PANEL_EDGE);
+}
+
+/// Draw the whole menu to the framebuffer, which already has the [render_base] drawn.
+fn render(
+    fb: &mut Framebuffer,
+    layout: &Layout,
+    scene: &Scene,
+    offset: usize,
+    cursor: Option<(usize, usize)>,
+) {
+    draw_logo(fb, layout, scene.ticks);
+
+    let (panel_x, _, panel_width, _) = layout.panel;
+    for (slot, (index, entry)) in scene
+        .entries
+        .iter()
+        .enumerate()
+        .skip(offset)
+        .take(layout.visible)
+        .enumerate()
+    {
+        let row = layout.row(slot);
+        let text_row = row + (layout.height - layout.cell) / 2;
+        // Only the selected entry has a pill, which keeps the list calm.
+        let text = if index == scene.selected {
+            draw_pill(
+                fb,
+                layout.x,
+                row,
+                layout.width,
+                layout.height,
+                PILL_SELECTED,
+            );
+            TEXT_SELECTED
+        } else {
+            TEXT
+        };
+        draw_text(
+            fb,
+            layout.text_x,
+            text_row,
+            layout.scale,
+            layout.columns,
+            entry.title(),
+            text,
+        );
+    }
+
+    if layout.scrolls {
+        draw_scrollbar(fb, layout, offset, scene.entries.len());
+    }
+
+    // The status line is below the line across the panel, with the position when it scrolls.
+    let inner = panel_width.saturating_sub(layout.cell * 3);
+    let inner_x = panel_x + layout.cell * 3 / 2;
+    let status_row = layout.footer + layout.scale + layout.cell / 2;
+    // The position is at the right edge, so the status keeps clear of it on both sides.
+    let keep_clear = if layout.scrolls { layout.cell * 8 } else { 0 };
+    draw_centered(
+        fb,
+        inner_x + keep_clear,
+        inner.saturating_sub(keep_clear * 2),
+        status_row,
+        layout.scale,
+        &scene.status,
+        TEXT_MUTED,
+    );
+    if layout.scrolls {
+        let position = format!("{}/{}", scene.selected + 1, scene.entries.len());
+        let width = position.len() * layout.cell;
+        draw_text(
+            fb,
+            (inner_x + inner).saturating_sub(width),
+            status_row,
+            layout.scale,
+            position.len(),
+            &position,
+            TEXT_MUTED,
+        );
+    }
+
+    if let Some(position) = cursor {
+        draw_cursor(fb, layout.scale, position);
+    }
+}
+
+/// Run the menu until an entry is chosen, returning the index of that entry.
+/// The `selected` entry is booted if there is no input before `timeout` passes.
+/// Without a timeout, the menu waits for the user.
+fn run(
+    input: &mut Input,
+    mut mouse: Option<Mouse>,
+    screens: &mut [Screen],
+    timeout: Option<Duration>,
+    entries: &[BootableEntry],
+    selected: usize,
+) -> Result<usize> {
+    // The cursor moves within the first screen, and is shown at the same place on the others.
+    let bounds = screens[0].size();
+    let page = screens[0].layout.visible;
+    let last = entries.len() - 1;
+
+    // The events that wake the menu up, which are keys and pointer input.
+    let mut events = Vec::from([input
+        .wait_for_key_event()
+        .context("unable to acquire key event")?]);
+    if let Some(mouse) = &mouse {
+        events.extend(mouse.events()?);
+    }
+
+    let mut scene = Scene {
+        entries,
+        selected,
+        status: String::new(),
+        ticks: 0,
+    };
+    let mut cursor = mouse.as_ref().map(|_| (bounds.0 / 2, bounds.1 / 2));
+    // The time left before booting, or None once input stops the countdown.
+    let mut remaining = timeout;
+    let mut button_down = false;
+
+    loop {
+        scene.status = match remaining {
+            Some(remaining) => format!("Boot in {} s.", remaining.as_millis().div_ceil(1000)),
+            None if mouse.is_some() => String::from(HINT_MOUSE),
+            None => String::from(HINT),
+        };
+        for screen in screens.iter_mut() {
+            screen.scroll_to(scene.selected);
+            let cursor = cursor.map(|position| screen.locate(position, bounds));
+            screen.fb.copy_from(&screen.base);
+            render(
+                &mut screen.fb,
+                &screen.layout,
+                &scene,
+                screen.offset,
+                cursor,
+            );
+            // Only the first frame has to fill the display, the rest only change parts of it.
+            if screen.drawn {
+                screen.fb.blit_changes(&screen.shown, &mut screen.gop)?;
+            } else {
+                screen.fb.blit(&mut screen.gop)?;
+                screen.drawn = true;
+            }
+            core::mem::swap(&mut screen.fb, &mut screen.shown);
+        }
+
+        // Wake up every tick to move the logo and update the countdown.
+        if wait_for_events(&events, Some(TICK))?.is_none() {
+            scene.ticks += 1;
+            if let Some(left) = remaining {
+                let left = left.saturating_sub(TICK);
+                if left.is_zero() {
+                    return Ok(scene.selected);
+                }
+                remaining = Some(left);
+            }
+            continue;
+        }
+
+        // Some firmware signals an event without any input being available.
+        if let Some(key) = input.read_key().context("unable to read key")? {
+            remaining = None;
+            match key {
+                Key::Special(ScanCode::UP) => scene.selected = scene.selected.saturating_sub(1),
+                Key::Special(ScanCode::DOWN) => scene.selected = (scene.selected + 1).min(last),
+                Key::Special(ScanCode::HOME) => scene.selected = 0,
+                Key::Special(ScanCode::END) => scene.selected = last,
+                Key::Special(ScanCode::PAGE_UP) => {
+                    scene.selected = scene.selected.saturating_sub(page)
+                }
+                Key::Special(ScanCode::PAGE_DOWN) => {
+                    scene.selected = (scene.selected + page).min(last)
+                }
+
+                // Serial consoles may send a line feed instead of a carriage return.
+                Key::Printable(c) if matches!(char::from(c), '\r' | '\n') => {
+                    return Ok(scene.selected);
+                }
+
+                _ => {}
+            }
+        }
+
+        if let (Some(mouse), Some(cursor)) = (mouse.as_mut(), cursor.as_mut())
+            && let Some(down) = mouse.poll(cursor, bounds)?
+        {
+            remaining = None;
+
+            // Hovering over an entry selects it, and pressing the button boots it.
+            let hovered = screens.iter().find_map(|screen| {
+                let position = screen.locate(*cursor, bounds);
+                screen
+                    .layout
+                    .slot_at(position)
+                    .map(|slot| screen.offset + slot)
+            });
+            if let Some(entry) = hovered {
+                scene.selected = entry;
+                if down && !button_down {
+                    return Ok(scene.selected);
+                }
+            }
+            button_down = down;
+        }
+    }
+}
+
+impl BootMenu for GraphicalMenu {
+    /// Selects an entry using the graphical menu.
+    /// The menu is drawn to every display, and fails if the firmware has none.
+    fn select<'a>(
+        &self,
+        timeout: Option<Duration>,
+        entries: &'a [BootableEntry],
+    ) -> Result<&'a BootableEntry> {
+        let default = entries
+            .iter()
+            .position(|entry| entry.is_default())
+            .context("no default entry available")?;
+
+        // If the timeout is zero, boot the default entry without showing the menu.
+        if timeout.is_some_and(|timeout| timeout.is_zero()) {
+            return Ok(&entries[default]);
+        }
+
+        let mut screens = Screen::open_all(entries, self.enable_logo, self.enable_animation)?;
+        let mut mouse = self.enable_mouse.then(Mouse::open).flatten();
+
+        let result = uefi::system::with_stdin(|input| {
+            run(input, mouse.take(), &mut screens, timeout, entries, default)
+        });
+
+        // Clear the console so that anything printed after the menu is readable.
+        let _ = uefi::system::with_stdout(|output| output.clear());
+
+        Ok(&entries[result?])
+    }
+}

crates/boot/src/menu/logo.rs

@@ -0,0 +1,2 @@
+// Include the generated logo in this file.
+include!(concat!(env!("OUT_DIR"), "/logo.generated.rs"));

crates/boot/src/menu/simple.rs

@@ -0,0 +1,280 @@
+use crate::entries::BootableEntry;
+use crate::menu::{BootMenu, read_key};
+use alloc::format;
+use alloc::string::String;
+use anyhow::{Context, Result, anyhow};
+use core::fmt::Write;
+use core::iter::repeat;
+use core::time::Duration;
+use uefi::proto::console::text::{Color, Input, Key, Output, ScanCode};
+
+/// The number of columns to assume if the console does not report its mode.
+const FALLBACK_COLUMNS: usize = 80;
+
+/// The number of rows to assume if the console does not report its mode.
+const FALLBACK_ROWS: usize = 25;
+
+/// How often the countdown is updated.
+const TICK: Duration = Duration::from_secs(1);
+
+/// The number of spaces on either side of an entry title.
+const ENTRY_PADDING: usize = 2;
+
+/// The hint shown once the countdown has been stopped.
+const HINT: &str = "Use the arrow keys to select an entry and press enter to boot.";
+
+/// A full-screen boot menu that selects entries with the arrow keys, similar to systemd-boot.
+pub struct SimpleMenu;
+
+/// The position and size of the menu on the console.
+struct Layout {
+    /// The number of rows on the console.
+    rows: usize,
+    /// The number of columns that can be drawn to.
+    columns: usize,
+    /// The column that entries start at.
+    x: usize,
+    /// The row that entries start at.
+    y: usize,
+    /// The width of each entry, including padding.
+    width: usize,
+    /// The number of entries that fit on the console.
+    visible: usize,
+}
+
+impl Layout {
+    /// Calculate the layout of `entries` on the console `output`.
+    fn new(output: &Output, entries: &[BootableEntry]) -> Self {
+        // Some consoles do not report a mode, so we assume a standard size for them.
+        let (columns, rows) = output
+            .current_mode()
+            .ok()
+            .flatten()
+            .map(|mode| (mode.columns(), mode.rows()))
+            .unwrap_or((FALLBACK_COLUMNS, FALLBACK_ROWS));
+
+        // Leave the last column empty, as writing to it makes some consoles scroll.
+        let columns = columns.saturating_sub(1);
+
+        // All entries are the width of the longest title so the highlight lines up.
+        let longest = entries
+            .iter()
+            .map(|entry| entry.title().chars().count())
+            .max()
+            .unwrap_or(0);
+        let width = (longest + ENTRY_PADDING * 2).min(columns);
+
+        // Keep the last two rows for the status line and a blank row above it.
+        let space = rows.saturating_sub(2).max(1);
+        let visible = entries.len().min(space);
+
+        Self {
+            rows,
+            columns,
+            x: (columns - width) / 2,
+            y: (space - visible) / 2,
+            width,
+            visible,
+        }
+    }
+}
+
+/// Draw `text` at `column` and `row`, padded with spaces or cut to fit `width`.
+fn draw(
+    output: &mut Output,
+    column: usize,
+    row: usize,
+    width: usize,
+    text: &str,
+    colors: (Color, Color),
+) -> Result<()> {
+    // Replace anything that isn't printable ASCII, as not all consoles can draw it.
+    let line: String = text
+        .chars()
+        .map(|c| {
+            if c == ' ' || c.is_ascii_graphic() {
+                c
+            } else {
+                '?'
+            }
+        })
+        .chain(repeat(' '))
+        .take(width)
+        .collect();
+
+    output
+        .set_color(colors.0, colors.1)
+        .context("unable to set console color")?;
+    output
+        .set_cursor_position(column, row)
+        .context("unable to set console cursor position")?;
+    output
+        .write_str(&line)
+        .map_err(|_| anyhow!("unable to write to console"))?;
+    Ok(())
+}
+
+/// Draw the visible `entries` starting at `offset` with `selected` highlighted,
+/// and the `status` line at the bottom of the console.
+fn render(
+    output: &mut Output,
+    layout: &Layout,
+    entries: &[BootableEntry],
+    selected: usize,
+    offset: usize,
+    status: &str,
+) -> Result<()> {
+    for (row, (index, entry)) in entries
+        .iter()
+        .enumerate()
+        .skip(offset)
+        .take(layout.visible)
+        .enumerate()
+    {
+        // The selected entry is drawn in inverted colors.
+        let colors = if index == selected {
+            (Color::Black, Color::LightGray)
+        } else {
+            (Color::LightGray, Color::Black)
+        };
+        let text = format!("{:padding$}{}", "", entry.title(), padding = ENTRY_PADDING);
+        draw(
+            output,
+            layout.x,
+            layout.y + row,
+            layout.width,
+            &text,
+            colors,
+        )?;
+    }
+
+    // Center the status line across the console.
+    let padding = layout.columns.saturating_sub(status.len()) / 2;
+    let text = format!("{:padding$}{}", "", status);
+    draw(
+        output,
+        0,
+        layout.rows.saturating_sub(1),
+        layout.columns,
+        &text,
+        (Color::LightGray, Color::Black),
+    )
+}
+
+/// Run the menu until an entry is chosen, returning the index of that entry.
+/// The `selected` entry is booted if no key is pressed before `timeout` passes.
+/// Without a timeout, the menu waits for the user.
+fn run(
+    input: &mut Input,
+    output: &mut Output,
+    layout: &Layout,
+    timeout: Option<Duration>,
+    entries: &[BootableEntry],
+    mut selected: usize,
+) -> Result<usize> {
+    let last = entries.len() - 1;
+    // The first visible entry, which changes when scrolling through a long list.
+    let mut offset = 0;
+    // The time left before booting, or None once a key stops the countdown.
+    let mut remaining = timeout;
+
+    loop {
+        // Scroll so that the selected entry is visible.
+        if selected < offset {
+            offset = selected;
+        } else if selected >= offset + layout.visible {
+            offset = selected + 1 - layout.visible;
+        }
+
+        let status = match remaining {
+            Some(remaining) => format!("Boot in {} s.", remaining.as_secs()),
+            None => String::from(HINT),
+        };
+        render(output, layout, entries, selected, offset, &status)?;
+
+        // Wait for a key, waking up every tick to update the countdown.
+        let tick = remaining.map_or(TICK, |remaining| remaining.min(TICK));
+        let Some(key) = read_key(input, Some(tick))? else {
+            // Without a countdown there's nothing to do until a key is pressed.
+            let Some(left) = remaining else {
+                continue;
+            };
+
+            let left = left.saturating_sub(tick);
+            if left.is_zero() {
+                return Ok(selected);
+            }
+            remaining = Some(left);
+            continue;
+        };
+
+        // Any key stops the countdown, which leaves escape with nothing else to do.
+        remaining = None;
+
+        match key {
+            Key::Special(ScanCode::UP) => selected = selected.saturating_sub(1),
+            Key::Special(ScanCode::DOWN) => selected = (selected + 1).min(last),
+            Key::Special(ScanCode::HOME) => selected = 0,
+            Key::Special(ScanCode::END) => selected = last,
+            Key::Special(ScanCode::PAGE_UP) => selected = selected.saturating_sub(layout.visible),
+            Key::Special(ScanCode::PAGE_DOWN) => selected = (selected + layout.visible).min(last),
+
+            // Serial consoles may send a line feed instead of a carriage return.
+            Key::Printable(c) if matches!(char::from(c), '\r' | '\n') => return Ok(selected),
+
+            _ => {}
+        }
+    }
+}
+
+/// Selects an entry from `entries` using the console `input` and `output`.
+fn select_with_console<'a>(
+    input: &mut Input,
+    output: &mut Output,
+    timeout: Option<Duration>,
+    entries: &'a [BootableEntry],
+) -> Result<&'a BootableEntry> {
+    let default = entries
+        .iter()
+        .position(|entry| entry.is_default())
+        .context("no default entry available")?;
+
+    // If the timeout is zero, boot the default entry without showing the menu.
+    if timeout.is_some_and(|timeout| timeout.is_zero()) {
+        return Ok(&entries[default]);
+    }
+
+    let layout = Layout::new(output, entries);
+    let cursor_visible = output.cursor_visible();
+
+    output
+        .set_color(Color::LightGray, Color::Black)
+        .context("unable to set console color")?;
+    output.clear().context("unable to clear console")?;
+    // Not all consoles can hide the cursor, so this is allowed to fail.
+    let _ = output.enable_cursor(false);
+
+    let result = run(input, output, &layout, timeout, entries, default);
+
+    // Put the console back so that anything printed after the menu is readable.
+    let _ = output.set_color(Color::LightGray, Color::Black);
+    let _ = output.clear();
+    let _ = output.enable_cursor(cursor_visible);
+
+    Ok(&entries[result?])
+}
+
+impl BootMenu for SimpleMenu {
+    /// Selects an entry using the simple menu.
+    /// The actual work is done internally in [select_with_console] which is called
+    /// within the context of the standard input and output devices.
+    fn select<'a>(
+        &self,
+        timeout: Option<Duration>,
+        entries: &'a [BootableEntry],
+    ) -> Result<&'a BootableEntry> {
+        uefi::system::with_stdin(|input| {
+            uefi::system::with_stdout(|output| select_with_console(input, output, timeout, entries))
+        })
+    }
+}

crates/boot/src/options.rs

@@ -0,0 +1,196 @@
+use alloc::string::{String, ToString};
+use anyhow::{Context, Result, anyhow, bail};
+use core::cell::Cell;
+use core::ptr::null_mut;
+use edera_sprout_config::MenuStyle;
+use jaarg::{
+    HelpWriter, HelpWriterContext, Opt, Opts, ParseControl, ParseResult, StandardFullHelpWriter,
+};
+use log::{info, warn};
+use uefi_raw::Status;
+
+/// Default configuration file path.
+const DEFAULT_CONFIG_PATH: &str = "\\sprout.toml";
+
+/// The parsed options of sprout.
+#[derive(Debug)]
+pub struct SproutOptions {
+    /// Configures Sprout automatically based on the environment.
+    pub autoconfigure: bool,
+    /// Path to a configuration file to load.
+    pub config: String,
+    /// Entry to boot without showing the boot menu.
+    pub boot: Option<String>,
+    /// Force display of the boot menu.
+    pub force_menu: bool,
+    /// The timeout for the boot menu in seconds.
+    pub menu_timeout: Option<u64>,
+    /// The style of boot menu to display.
+    pub menu_style: Option<MenuStyle>,
+    /// Retains the boot console before boot.
+    pub retain_boot_console: bool,
+    /// Makes Sprout follow the Boot Loader Specification and systemd-boot exactly.
+    pub bls_strict_mode: bool,
+}
+
+/// The default Sprout options.
+impl Default for SproutOptions {
+    fn default() -> Self {
+        Self {
+            autoconfigure: false,
+            config: DEFAULT_CONFIG_PATH.to_string(),
+            boot: None,
+            force_menu: false,
+            menu_timeout: None,
+            menu_style: None,
+            retain_boot_console: false,
+            bls_strict_mode: false,
+        }
+    }
+}
+
+/// The options parser mechanism for Sprout.
+impl SproutOptions {
+    /// Produces [SproutOptions] from the arguments provided by the UEFI core.
+    /// Internally, we use the `jaarg` argument parser which has excellent no_std support.
+    pub fn parse() -> Result<Self> {
+        enum ArgID {
+            Help,
+            AutoConfigure,
+            Config,
+            Boot,
+            ForceMenu,
+            MenuTimeout,
+            MenuStyle,
+            RetainBootConsole,
+            BlsStrictMode,
+        }
+
+        // All the options for the Sprout executable.
+        const OPTIONS: Opts<ArgID> = Opts::new(&[
+            Opt::help_flag(ArgID::Help, &["--help"]).help_text("Display Sprout Help"),
+            Opt::flag(ArgID::AutoConfigure, &["--autoconfigure"])
+                .help_text("Enable Sprout autoconfiguration"),
+            Opt::value(ArgID::Config, &["--config"], "PATH")
+                .help_text("Path to Sprout configuration file"),
+            Opt::value(ArgID::Boot, &["--boot"], "ENTRY")
+                .help_text("Entry to boot, bypassing the menu"),
+            Opt::flag(ArgID::ForceMenu, &["--force-menu"]).help_text("Force showing the boot menu"),
+            Opt::value(ArgID::MenuTimeout, &["--menu-timeout"], "TIMEOUT")
+                .help_text("Boot menu timeout, in seconds"),
+            Opt::value(ArgID::MenuStyle, &["--menu-style"], "STYLE")
+                .help_text("Boot menu style, basic, simple or graphical"),
+            Opt::flag(ArgID::RetainBootConsole, &["--retain-boot-console"])
+                .help_text("Retain boot console before boot"),
+            Opt::flag(ArgID::BlsStrictMode, &["--bls-strict-mode"])
+                .help_text("Follow the BLS specification and systemd-boot exactly"),
+        ]);
+
+        // Acquire the arguments as determined by the UEFI core.
+        let mut args = eficore::env::args()?;
+
+        // Parse the arguments, dropping any argument that can't be parsed and parsing again.
+        // A typo in a boot entry or junk from the firmware should not prevent booting.
+        loop {
+            // Use the default value of sprout options and have the raw options be parsed into it.
+            let mut result = Self::default();
+
+            // The number of arguments handed to the parser, used to find the one it rejected.
+            let consumed = Cell::new(0usize);
+            // The reason the parser rejected an argument, if it did.
+            let mut rejection = None;
+
+            // Parse the OPTIONS into a map using jaarg.
+            let parsed = OPTIONS.parse(
+                "sprout",
+                args.iter().inspect(|_| consumed.set(consumed.get() + 1)),
+                |program_name, id, _opt, name, value| {
+                    match id {
+                        ArgID::AutoConfigure => {
+                            // Enable autoconfiguration.
+                            result.autoconfigure = true;
+                        }
+                        ArgID::Config => {
+                            // The configuration file to load.
+                            result.config = value.into();
+                        }
+                        ArgID::Boot => {
+                            // The entry to boot.
+                            result.boot = Some(value.into());
+                        }
+                        ArgID::ForceMenu => {
+                            // Force showing of the boot menu.
+                            result.force_menu = true;
+                        }
+                        ArgID::MenuTimeout => {
+                            // The timeout for the boot menu in seconds.
+                            match value.parse::<u64>() {
+                                Ok(timeout) => result.menu_timeout = Some(timeout),
+                                Err(error) => {
+                                    warn!("ignoring invalid {} value '{}': {}", name, value, error)
+                                }
+                            }
+                        }
+                        ArgID::MenuStyle => {
+                            // The style of boot menu to display.
+                            match value {
+                                "basic" => result.menu_style = Some(MenuStyle::Basic),
+                                "simple" => result.menu_style = Some(MenuStyle::Simple),
+                                "graphical" => result.menu_style = Some(MenuStyle::Graphical),
+                                _ => warn!(
+                                    "ignoring invalid {} value '{}': expected basic, simple or graphical",
+                                    name, value
+                                ),
+                            }
+                        }
+                        ArgID::RetainBootConsole => {
+                            // Retain the boot console before booting.
+                            result.retain_boot_console = true;
+                        }
+                        ArgID::BlsStrictMode => {
+                            // Follow the BLS specification and systemd-boot exactly.
+                            result.bls_strict_mode = true;
+                        }
+                        ArgID::Help => {
+                            let ctx = HelpWriterContext {
+                                options: &OPTIONS,
+                                program_name,
+                            };
+                            info!("{}", StandardFullHelpWriter::new(ctx));
+                            return Ok(ParseControl::Quit);
+                        }
+                    }
+                    Ok(ParseControl::Continue)
+                },
+                |_program_name, error| {
+                    rejection = Some(error.to_string());
+                },
+            );
+
+            match parsed {
+                ParseResult::ContinueSuccess => return Ok(result),
+                ParseResult::ExitSuccess => unsafe {
+                    uefi::boot::exit(uefi::boot::image_handle(), Status::SUCCESS, 0, null_mut())
+                        .context("unable to exit")?;
+                    return Err(anyhow!("unable to exit"));
+                },
+
+                ParseResult::ExitError => {
+                    // The parser stops at the argument it rejected, which makes it the last
+                    // argument it was handed. This is also true of an option missing its value,
+                    // which is only detected once the arguments run out.
+                    let Some(index) = consumed.get().checked_sub(1).filter(|i| *i < args.len())
+                    else {
+                        bail!("unable to parse options: {}", rejection.unwrap_or_default());
+                    };
+                    let arg = args.remove(index);
+                    warn!(
+                        "ignoring argument '{}': {}",
+                        arg,
+                        rejection.unwrap_or_default()
+                    );
+                }
+            }
+        }
+    }
+}

crates/boot/src/phases.rs

@@ -1,11 +1,12 @@
 use crate::actions;
 use crate::context::SproutContext;
+use alloc::format;
+use alloc::rc::Rc;
 use anyhow::{Context, Result};
 use edera_sprout_config::phases::PhaseConfiguration;
-use std::rc::Rc;
 
 /// Executes the specified [phase] of the boot process.
-/// The value [phase] should be a reference of a specific phase in the [PhasesConfiguration].
+/// The value [phase] should be a reference of a specific phase in the `PhasesConfiguration`.
 /// Any error from the actions is propagated into the [Result] and will interrupt further
 /// execution of phase actions.
 pub fn phase(context: Rc<SproutContext>, phase: &[PhaseConfiguration]) -> Result<()> {
@@ -23,3 +24,18 @@ pub fn phase(context: Rc<SproutContext>, phase: &[PhaseConfiguration]) -> Result
     }
     Ok(())
 }
+
+/// Manual hook called by code in the bootloader that hands off to another image.
+/// This is used to perform actions like clearing the screen.
+pub fn before_handoff(context: &SproutContext) -> Result<()> {
+    // If we have not been asked to retain the boot console, then we should clear the screen.
+    if !context.root().options().retain_boot_console {
+        // Clear the screen. We use clear here instead of reset because some firmware,
+        // particularly Dell firmware, does not clear the screen on reset.
+        // We clear both stdout and stderr because it's not guaranteed that they are the same
+        // text output.
+        uefi::system::with_stdout(|stdout| stdout.clear()).context("unable to clear screen")?;
+        uefi::system::with_stderr(|stderr| stderr.clear()).context("unable to clear screen")?;
+    }
+    Ok(())
+}