chore(deps): bump sha2 from 0.11.0 to 0.11.1 in the cargo-updates group

Bumps the cargo-updates group with 1 update: [sha2](https://github.com/RustCrypto/hashes). Updates `sha2` from 0.11.0 to 0.11.1 - [Commits](https://github.com/RustCrypto/hashes/compare/sha2-v0.11.0...sha2-v0.11.1) --- updated-dependencies: - dependency-name: sha2 dependency-version: 0.11.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-updates ... Signed-off-by: dependabot[bot] <[email protected]>
sprout: version 0.0.31 (#134 )
2026-11-04 17:42:20 +00:00 · 2026-10-26 09:09:50 +00:00 · 2026-10-24 23:23:05 -07:00 · 2026-10-24 23:13:30 -07:00 · 2026-10-24 23:13:12 -07:00 · 2026-10-16 12:33:35 -07:00
71 changed files with 7191 additions and 409 deletions
@@ -0,0 +1,83 @@
+---
+name: update-config-docs
+description: Bring docs/config.md back in line with the code. Use after changing anything in crates/config, the command line options, loader.conf handling, strict mode, or autoconfiguration, or when asked to check that docs/config.md is accurate.
+---
+
+# Update docs/config.md
+
+`docs/config.md` is the reference for `sprout.toml`, the command line options, BLS support and strict mode.
+The README only links to it, so a setting that is missing from docs/config.md is undocumented.
+
+## 1. Find what changed
+
+Start from the diff, or from the whole config surface if there is none:
+
+```bash
+git diff main -- crates/config crates/boot/src/options.rs crates/boot/src/config crates/boot/src/autoconfigure crates/bls
+```
+
+The sources of truth, and the section of docs/config.md each one feeds:
+
+| Source                                                    | Section                                   |
+|-----------------------------------------------------------|-------------------------------------------|
+| `crates/config/src/lib.rs`                                | file at a glance, `options`               |
+| `crates/config/src/drivers.rs`                            | `drivers`                                 |
+| `crates/config/src/extractors*`                           | `extractors`                              |
+| `crates/config/src/actions*`                              | `actions`                                 |
+| `crates/config/src/entries.rs`                            | `entries`                                 |
+| `crates/config/src/generators*`                           | `generators`, `variants`, `exclude`       |
+| `crates/config/src/phases.rs`                             | `phases`                                  |
+| `crates/boot/src/options.rs`                              | command line options                      |
+| `crates/boot/src/main.rs`                                 | boot order, defaults, timeout and default entry order, strict mode |
+| `crates/boot/src/autoconfigure*`                          | autoconfiguration                         |
+| `crates/boot/src/generators/bls.rs`, `crates/bls`         | BLS values, boot counting, `loader.conf`  |
+
+## 2. Check each key
+
+For every struct field in `crates/config`, docs/config.md needs its TOML name (look at `#[serde(rename)]`, as
+most multi-word keys use dashes), its type, its default, and what it does. Read the code that uses it in
+`crates/boot`, not only the doc comment, because the behavior is what the reader depends on.
+
+Look for the usual drift:
+
+- a field added, renamed or removed
+- a default that changed (`#[serde(default = ...)]`, the `Default` impls, constants such as
+  `DEFAULT_MENU_TIMEOUT_SECONDS`)
+- a new BLS value set with `context.set`, or a new option in `SproutOptions`
+- a new row to add to, or remove from, the strict mode table
+- a changed order: the default entry sources, the menu timeout sources, or the phases
+- `LATEST_VERSION` changing, which the intro and `version` text must follow
+
+Don't document what you can't confirm in the code. If a behavior is unclear, read the function that
+implements it.
+
+## 3. Write the change
+
+- Keep each section's shape: a short explanation, a TOML example, then a table of keys.
+- Examples must parse. Check that every key in one exists and is spelled the way serde expects.
+- Update the table of contents if you add or rename a heading.
+- Keep README.md short. It gets the feature list and the minimal examples, and docs/config.md gets everything else.
+- Don't duplicate the strict mode table or the default entry order anywhere else.
+
+## 4. Write like a person
+
+Plain sentences, said once. Skip these:
+
+- filler like "robust", "seamless", "powerful", "leverage", "ensure", "note that", "it's important to"
+- groups of three added for rhythm, and a summary sentence at the end of every section
+- bullet lists for what a sentence says better, and bold used as decoration
+- em dashes (use a comma, colon or parentheses)
+
+Say what a setting does and what happens when it's unset or wrong. Name real things (`bootctl`, `PCR 12`,
+`\EFI\Linux`) instead of describing them.
+
+## 5. Verify
+
+```bash
+cargo build --target x86_64-unknown-uefi
+cargo build --target aarch64-unknown-uefi
+cargo fmt --all --check
+```
+
+Then re-read the diff of docs/config.md against the code once more for any key whose name or default you
+touched. If the change was only to docs, skip the builds.
@@ -26,7 +26,7 @@ jobs:
      actions: read # Needed to analyze action metadata.
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
      with:
        egress-policy: audit

@@ -36,7 +36,7 @@ jobs:
        persist-credentials: false

    - name: setup uv
-      uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0

    - name: zizmor
      run: uvx zizmor --pedantic --format sarif . > results.sarif
@@ -44,7 +44,7 @@ jobs:
        GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

    - name: upload
-      uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+      uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
      with:
        sarif_file: results.sarif
        category: zizmor
@@ -22,7 +22,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
      with:
        egress-policy: audit

@@ -52,7 +52,7 @@ jobs:
    name: 'build ${{ matrix.arch }}'
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
      with:
        egress-policy: audit

@@ -81,7 +81,7 @@ jobs:
    name: 'clippy ${{ matrix.arch }}'
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
      with:
        egress-policy: audit

@@ -38,7 +38,7 @@ jobs:
          build-mode: none
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
      with:
        egress-policy: audit

@@ -48,13 +48,13 @@ jobs:
        persist-credentials: false

    - name: initialize codeql
-      uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+      uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}
        config-file: ./.github/codeql/codeql-config.yaml

    - name: perform codeql analysis
-      uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+      uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
      with:
        category: "/language:${{matrix.language}}"
@@ -26,7 +26,7 @@ jobs:
      artifact-digest: "${{ steps.upload.outputs.artifact-digest }}"
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
      with:
        egress-policy: audit

@@ -44,7 +44,7 @@ jobs:

    - name: 'upload artifacts'
      id: upload
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
      with:
        name: artifacts
        path: target/assemble/*
@@ -61,7 +61,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
      with:
        egress-policy: audit

@@ -26,7 +26,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: harden runner
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
      with:
        egress-policy: audit

@@ -50,7 +50,7 @@ jobs:
        subject-path: target/assemble/*

    - name: 'generate cultivator token'
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.0.0-beta.2
+      uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
      id: generate-token
      with:
        app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
@@ -0,0 +1 @@
+CLAUDE.md
@@ -0,0 +1,58 @@
+# Sprout
+
+Sprout is a programmable UEFI bootloader written in Rust, for `x86_64` and `aarch64`. It is a `no_std` workspace
+built for the `*-unknown-uefi` targets, so it cannot be run or tested like a normal binary.
+See [README.md](README.md) for features and [docs/config.md](docs/config.md) for the configuration format.
+After changing configuration, run the `update-config-docs` skill to keep docs/config.md accurate.
+
+## Layout
+
+- `crates/boot`: the bootloader entrypoint (`edera-sprout-boot`).
+- `crates/bls`: Boot Loader Specification parsing and sorting.
+- `crates/build`: build logic.
+- `crates/config`: serialization structures for the Sprout configuration file.
+- `crates/eficore`: core EFI helpers.
+- `crates/parsing`: value stamping and other parsing helpers.
+- `hack/`: build and dev scripts; `hack/dev` boots QEMU, `hack/dev/run` drives it headless.
+- `docs/setup`: setup guides for signed and unsigned installs.
+
+The crate list and the scripts are described in [DEVELOPMENT.md](DEVELOPMENT.md).
+
+## Building and checking
+
+The toolchain and both UEFI targets are pinned in `rust-toolchain.toml`. Always pass a UEFI target, as the
+host target will not build.
+
+```bash
+cargo build --target x86_64-unknown-uefi
+cargo clippy --target x86_64-unknown-uefi
+cargo fmt --all
+./hack/assemble.sh
+```
+
+CI runs `cargo fmt --check`, `cargo build` and `cargo clippy` for both targets, so run these for both
+`x86_64` and `aarch64` before opening a PR. `./hack/autofix.sh` applies clippy and rustfmt fixes.
+
+To try a change in a real environment, use `./hack/dev/boot.sh [arch]`, or the scripts in `hack/dev/run`
+(for example `smoke.sh`) when there is no terminal or window to use.
+
+## Conventions
+
+- Write code that matches the surrounding code, including naming, idioms and comment style.
+- Dependencies are declared in the root `Cargo.toml` under `[workspace.dependencies]`.
+- GitHub Actions are pinned to a commit SHA with the version in a comment.
+
+## Commits and pull requests
+
+- Do not add coding agent attribution anywhere. No `Co-Authored-By` trailers, no "Generated with" lines, in
+  commits or in PR descriptions.
+- Commits use [Conventional Commits](https://www.conventionalcommits.org/), in the form `type(scope): subject`,
+  for example `fix(boot): count tries without using them`. Types in use are `feat`, `fix` and `docs`, and
+  scopes are usually a crate name such as `boot`, `bls` or `eficore`, or `ci`, `hack` and `readme`.
+- PR titles are also conventional commits, because PRs are squashed. The only exception is a release PR,
+  which is titled `sprout: version x.y.z`.
+- Keep PR descriptions short prose.
+
+## Releasing
+
+See [RELEASING.md](RELEASING.md). A release PR only bumps the version in `Cargo.toml` and `Cargo.lock`.
@@ -2,6 +2,12 @@
 # It is not intended for manual editing.
 version = 4

+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
 [[package]]
 name = "anyhow"
 version = "1.0.104"
@@ -44,6 +50,15 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "crc32fast"
+version = "1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "crypto-common"
 version = "0.2.2"
@@ -65,14 +80,14 @@ dependencies = [

 [[package]]
 name = "edera-sprout-bls"
-version = "0.0.30"
+version = "0.0.31"
 dependencies = [
 "anyhow",
 ]

 [[package]]
 name = "edera-sprout-boot"
-version = "0.0.30"
+version = "0.0.31"
 dependencies = [
 "anyhow",
 "edera-sprout-bls",
@@ -92,23 +107,25 @@ dependencies = [

 [[package]]
 name = "edera-sprout-build"
-version = "0.0.30"
+version = "0.0.31"
+dependencies = [
+ "png",
+]

 [[package]]
 name = "edera-sprout-config"
-version = "0.0.30"
+version = "0.0.31"
 dependencies = [
 "serde",
 ]

 [[package]]
 name = "edera-sprout-eficore"
-version = "0.0.30"
+version = "0.0.31"
 dependencies = [
 "anyhow",
 "bitflags",
 "log",
- "shlex",
 "spin",
 "uefi",
 "uefi-raw",
@@ -116,12 +133,32 @@ dependencies = [

 [[package]]
 name = "edera-sprout-parsing"
-version = "0.0.30"
+version = "0.0.31"
 dependencies = [
 "hex",
 "sha2",
 ]

+[[package]]
+name = "fdeflate"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
+dependencies = [
+ "simd-adler32",
+]
+
+[[package]]
+name = "flate2"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide 0.9.1",
+ "zlib-rs",
+]
+
 [[package]]
 name = "hex"
 version = "0.4.3"
@@ -164,6 +201,39 @@ version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"

+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "png"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
+dependencies = [
+ "bitflags",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide 0.8.9",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.107"
@@ -250,18 +320,18 @@ dependencies = [

 [[package]]
 name = "serde_spanned"
-version = "1.1.1"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
+checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c"
 dependencies = [
 "serde_core",
 ]

 [[package]]
 name = "sha2"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+checksum = "47d7069beb7d6ac7b9acd1039986e73443f24234f41074da099d6f994ac9ad19"
 dependencies = [
 "cfg-if",
 "cpufeatures",
@@ -269,10 +339,10 @@ dependencies = [
 ]

 [[package]]
-name = "shlex"
-version = "2.0.1"
+name = "simd-adler32"
+version = "0.3.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"

 [[package]]
 name = "spin"
@@ -296,9 +366,9 @@ dependencies = [

 [[package]]
 name = "toml"
-version = "1.1.6+spec-1.1.0"
+version = "1.1.8+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "920602543f0911ab71da12c50d59701da54c196d1a2bf5cb4b75667f137a406a"
+checksum = "20489e00e4d8741d6be680764cc12e270655e375a20d1011e844a9c3379e678d"
 dependencies = [
 "serde_core",
 "serde_spanned",
@@ -309,18 +379,18 @@ dependencies = [

 [[package]]
 name = "toml_datetime"
-version = "1.1.1+spec-1.1.0"
+version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
 dependencies = [
 "serde_core",
 ]

 [[package]]
 name = "toml_parser"
-version = "1.1.3+spec-1.1.0"
+version = "1.1.5+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
+checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
 dependencies = [
 "winnow",
 ]
@@ -394,3 +464,9 @@ name = "winnow"
 version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
+
+[[package]]
+name = "zlib-rs"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112"
@@ -11,7 +11,7 @@ resolver = "3"

 [workspace.package]
 license = "Apache-2.0"
-version = "0.0.30"
+version = "0.0.31"
 homepage = "https://sprout.edera.dev"
 repository = "https://github.com/edera-dev/sprout"
 edition = "2024"
@@ -19,6 +19,7 @@ edition = "2024"
 [workspace.dependencies]
 bitflags = "2.13.2"
 log = "0.4.34"
+png = "0.18.1"
 spin = "0.12.3"
 uefi-raw = "0.17.0"

@@ -49,10 +50,6 @@ default-features = false
 version = "0.11.0"
 default-features = false

-[workspace.dependencies.shlex]
-version = "2.0.1"
-default-features = false
-
 [workspace.dependencies.toml]
 version = "1.1.6"
 default-features = false
@@ -58,3 +58,23 @@ Build Sprout as OCI images using Docker, including a kernel, initramfs, xen, and

 Boot Sprout's dev environment using QEMU for testing. This will let you test your changes in a real environment booting
 Alpine Linux with an initramfs.
+
+### ./hack/dev/run
+
+Scripts to drive the dev environment without a terminal or a window, which suits automation and
+coding agents. QEMU runs in the background with a QMP socket, and its consoles are written to
+`target/run/<arch>/`. Only one run per architecture at a time, and the scripts need `python3` or `socat`.
+
+- `start.sh [arch]`: Builds and starts QEMU headless. `SPROUT_CONFIG_NAME` defaults to `graphical`.
+- `screenshot.sh [out.png]`: Saves a PNG of the display (QEMU 7.1 or newer) and prints the path.
+- `key.sh <qcode>...`: Presses keys such as `down`, `up`, `ret` or `ctrl+alt+delete`.
+- `wait-serial.sh <regex> [seconds]`: Waits for text on the firmware or Linux console.
+- `qmp.sh <json>...`: Sends raw QMP commands.
+- `status.sh` and `stop.sh`: Show the state of QEMU, and stop it.
+- `smoke.sh [arch]`: Starts, drives the graphical menu, waits for the Linux shell and stops.
+
+`boot.sh` supports this with `QEMU_HEADLESS`, `QEMU_QMP`, `QEMU_SERIAL_FILE`, `QEMU_CONSOLE_FILE` and `QEMU_EXTRA_ARGS`.
+
+## Releasing
+
+Maintainers cut releases as described in [RELEASING.md](RELEASING.md).
@@ -1,7 +1,7 @@
 ARG RUST_PROFILE=release
 ARG RUST_TARGET_SUBDIR=release

-FROM --platform=$BUILDPLATFORM rust:1.98.1-alpine@sha256:7cc1c22d77d9432f7fe012a70e6d3e555af54c2a6832700ed7d553f1769ae89f AS build
+FROM --platform=$BUILDPLATFORM rust:1.99.1-alpine@sha256:557a94c82b485a14b569120e00867267108c734efe33f10cc31ca0cd5dd1eca9 AS build
 RUN apk --no-cache add musl-dev busybox-static
 ARG RUST_PROFILE
 RUN adduser -S -s /bin/sh build
@@ -58,6 +58,7 @@ We recommend running Sprout without Secure Boot for development, and with Secure

 ### Project Documentation

+- [Configuration Reference]
 - [Development Guide]
 - [Contributing Guide]
 - [Sprout License]
@@ -69,21 +70,29 @@ We recommend running Sprout without Secure Boot for development, and with Secure
 ### Current

 - [x] Loadable driver support
- [x] Basic [Bootloader specification (BLS)](https://uapi-group.org/specifications/specs/boot_loader_specification/) support
+- [x] [Bootloader specification (BLS)](https://uapi-group.org/specifications/specs/boot_loader_specification/) support:
+  Type #1 entries, Type #2 unified kernel images, and the extended boot loader partition
+- [x] [UKI support](https://github.com/edera-dev/sprout/issues/6): including images with multiple profiles
+- [x] Boot counting, so `systemd-bless-boot` can assess a boot
+- [x] `loader.conf` support
 - [x] Chainload support
 - [x] Linux boot support via EFI stub
 - [x] Windows boot support via chainload
 - [x] Load Linux initrd from disk
- [x] Basic boot menu
+- [x] Devicetree support
+- [x] Basic, simple, and graphical boot menus
+- [x] A strict mode that follows the BLS specification and systemd-boot exactly
+- [x] Generators for BLS entries, lists, and matrices, with variants
 - [x] BLS autoconfiguration support
- [x] [Secure Boot support](https://github.com/edera-dev/sprout/issues/20): beta
- [x] [Bootloader interface support](https://github.com/edera-dev/sprout/issues/21): beta
- [x] [BLS specification conformance](https://github.com/edera-dev/sprout/issues/2): beta
+- [x] [Secure Boot support](https://github.com/edera-dev/sprout/issues/20)
+- [x] [Bootloader interface support](https://github.com/edera-dev/sprout/issues/21)
+- [x] [BLS specification conformance](https://github.com/edera-dev/sprout/issues/2)

 ### Roadmap

 - [ ] [Full-featured boot menu](https://github.com/edera-dev/sprout/issues/1)
- [ ] [UKI support](https://github.com/edera-dev/sprout/issues/6): partial
+- [ ] Network boot of unified kernel images (`uki-url`) and devicetree overlays
+- [ ] A random seed for the Linux kernel
 - [ ] [multiboot2 support](https://github.com/edera-dev/sprout/issues/7)
 - [ ] [Linux boot protocol (boot without EFI stub)](https://github.com/edera-dev/sprout/issues/8)

@@ -102,29 +111,9 @@ We recommend running Sprout without Secure Boot for development, and with Secure

 Sprout is provided as a single EFI binary called `sprout.efi`.
 It can be chainloaded from GRUB or other UEFI bootloaders or booted into directly.
-Sprout will look for \sprout.toml in the root of the EFI partition it was loaded from.
-See [Configuration](#configuration) for how to configure sprout.
+Sprout reads its configuration from `\sprout.toml` in the root of the EFI partition it was loaded from.

-## Configuration
-
-Sprout is configured using a TOML file at `\sprout.toml` on the root of the EFI partition sprout was booted from.
-
-### Command Line Options
-
-Sprout supports some command line options that can be combined to modify behavior without the configuration file.
-
-```bash
-# Boot Sprout with a specific configuration file.
-$ sprout.efi --config=\path\to\config.toml
-# Boot a specific entry, bypassing the menu.
-$ sprout.efi --boot="Boot Xen"
-# Autoconfigure Sprout, without loading a configuration file.
-$ sprout.efi --autoconfigure
-# Use the basic boot menu instead of the simple one.
-$ sprout.efi --menu-style=basic
-```
-
-### Boot Linux from ESP
+This is a configuration that boots a Linux kernel from the EFI partition:

 ```toml
 # sprout configuration: version 1
@@ -146,24 +135,24 @@ chainload.options = ["root=/dev/sda1"]
 chainload.linux-initrd = "\\initrd"
 ```

-### Bootloader Specification (BLS) Support
+On a system that follows the Boot Loader Specification, you may not need to write one. With an ext4 driver
+loaded, autoconfiguration finds the entries on its own:

 ```toml
-# sprout configuration: version 1
 version = 1

-# load an EFI driver for ext4.
 [drivers.ext4]
 path = "\\sprout\\drivers\\ext4.efi"

-# global options.
 [options]
-# enable autoconfiguration by detecting bls enabled
-# filesystems and generating boot entries for them.
 autoconfigure = true
 ```

+The full list of settings, the command line options, generators, and how Sprout treats BLS entries,
+`loader.conf` and strict mode are in [the configuration reference](./docs/config.md).
+
 [Edera]: https://edera.dev
+[Configuration Reference]: ./docs/config.md
 [Development Guide]: ./DEVELOPMENT.md
 [Contributing Guide]: ./CONTRIBUTING.md
 [Sprout License]: ./LICENSE
@@ -0,0 +1,36 @@
+# Releasing Sprout
+
+This describes how a maintainer cuts a release of Sprout. A release is a signed tag plus a GitHub release
+that holds the built EFI binaries and their attestations.
+
+The release is built and published by the `release` workflow, so the release is never visible
+until its artifacts are attached.
+
+## Steps
+
+1. Bump `version` in the `[workspace.package]` section of `Cargo.toml` to the new version, then run
+   `./hack/assemble.sh` to update `Cargo.lock`.
+
+2. Open a pull request with the result. The commit and the PR title are `sprout: version x.y.z`, which is the
+   one place we do not use a conventional commit. Once squashed, the commit on `main` is
+   `sprout: version x.y.z (#PR_NUMBER)`.
+
+3. Once the PR has merged, create a signed tag on the merged commit. The tag message is just the tag name.
+
+   ```bash
+   git tag -s v0.0.8 -m v0.0.8
+   git push origin v0.0.8
+   ```
+
+4. Draft a new release on GitHub for that tag, named after the tag, and click Generate Release Notes.
+   Add a blank line after every section header, as GitHub does not always do that. **Do not click Publish.**
+
+5. Run the `release` workflow from the Actions tab, selecting the tag as the ref to run from, and set the
+   `Release Tag` input to the tag name (for example `v0.0.8`). The workflow builds the tagged commit,
+   uploads the binaries to the draft release, attests them, and then publishes the release.
+
+## Notes
+
+- The release workflow builds the tag, not the branch it was dispatched on, so check the tag points at the
+  version bump commit before running it.
+- Re-running the workflow for the same tag replaces the uploaded assets, and runs for one tag never overlap.
@@ -0,0 +1,148 @@
+use alloc::format;
+use alloc::string::{String, ToString};
+use alloc::vec::Vec;
+
+/// The menu timeout of a `loader.conf` file.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum LoaderTimeout {
+    /// Show the menu for this many seconds. Zero hides the menu.
+    Seconds(u64),
+    /// Hide the menu unless a key is held.
+    Hidden,
+    /// Never show the menu.
+    Disabled,
+    /// Always show the menu and wait for the user.
+    Force,
+}
+
+impl LoaderTimeout {
+    /// Parses a `timeout` value, which is a number of seconds or one of the menu words.
+    fn parse(value: &str) -> Option<Self> {
+        match value {
+            "menu-hidden" => Some(Self::Hidden),
+            "menu-disabled" => Some(Self::Disabled),
+            "menu-force" => Some(Self::Force),
+            _ if !value.is_empty() && value.bytes().all(|b| b.is_ascii_digit()) => {
+                value.parse().ok().map(Self::Seconds)
+            }
+            _ => None,
+        }
+    }
+}
+
+/// What to do when the selected entry fails to start, from the `reboot-on-error` setting.
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+pub enum RebootOnError {
+    /// Never reboot.
+    No,
+    /// Always reboot, which can loop forever if the entry never starts.
+    Yes,
+    /// Reboot only if a boot counter try was just used up and tries were left, so that the
+    /// entry eventually runs out of tries and is not booted any more.
+    #[default]
+    Auto,
+}
+
+impl RebootOnError {
+    /// Parses a `reboot-on-error` value, which is `auto` or a boolean. The words are case
+    /// sensitive, as in systemd-boot.
+    fn parse(value: &str) -> Option<Self> {
+        match value {
+            "auto" => Some(Self::Auto),
+            "1" | "yes" | "y" | "true" | "t" | "on" => Some(Self::Yes),
+            "0" | "no" | "n" | "false" | "f" | "off" => Some(Self::No),
+            _ => None,
+        }
+    }
+
+    /// Whether to reboot after the entry failed to start. `consumed_tries_left` is the number of
+    /// tries that were left before this boot used one up, or None if the entry has no boot
+    /// counter or the try could not be used up, as then a reboot would not make progress.
+    pub fn should_reboot(self, consumed_tries_left: Option<u32>) -> bool {
+        match self {
+            Self::Yes => true,
+            Self::No => false,
+            Self::Auto => consumed_tries_left.is_some_and(|left| left > 0),
+        }
+    }
+}
+
+/// The settings Sprout understands from a `loader.conf` file.
+/// Reference: <https://www.freedesktop.org/software/systemd/man/latest/loader.conf.html>
+#[derive(Debug, Default, Clone, PartialEq, Eq)]
+pub struct LoaderConf {
+    /// A glob pattern that selects the default entry, or `@saved`.
+    pub default: Option<String>,
+    /// A glob pattern that selects the preferred entry, or `@saved`. Unlike `default`, an entry
+    /// with no boot counter tries left is not used.
+    pub preferred: Option<String>,
+    /// How long to show the boot menu.
+    pub timeout: Option<LoaderTimeout>,
+    /// What to do when the selected entry fails to start.
+    pub reboot_on_error: RebootOnError,
+    /// Problems found while parsing, such as keys that are not supported.
+    pub warnings: Vec<String>,
+}
+
+/// Removes one pair of matching single or double quotes around `value`.
+fn unquote(value: &str) -> &str {
+    for quote in ['"', '\''] {
+        if let Some(inner) = value
+            .strip_prefix(quote)
+            .and_then(|rest| rest.strip_suffix(quote))
+        {
+            return inner;
+        }
+    }
+    value
+}
+
+impl LoaderConf {
+    /// Parses the `input` as a `loader.conf` file. Parsing never fails, as a bad setting
+    /// should not prevent booting. Anything that is ignored is described in `warnings`.
+    /// When a key appears more than once, the last value is used.
+    pub fn parse(input: &str) -> Self {
+        let mut conf = Self::default();
+
+        // Some editors write a UTF-8 byte order mark at the start of the file.
+        let input = input.strip_prefix('\u{feff}').unwrap_or(input);
+
+        for line in input.lines() {
+            let line = line.trim();
+            if line.is_empty() || line.starts_with('#') {
+                continue;
+            }
+
+            let (key, value) = match line.split_once(char::is_whitespace) {
+                Some((key, value)) => (key, unquote(value.trim())),
+                None => (line, ""),
+            };
+
+            match key {
+                "default" if !value.is_empty() => conf.default = Some(value.to_string()),
+                "preferred" if !value.is_empty() => conf.preferred = Some(value.to_string()),
+                "timeout" => match LoaderTimeout::parse(value) {
+                    Some(timeout) => conf.timeout = Some(timeout),
+                    None => conf
+                        .warnings
+                        .push(format!("ignoring invalid loader.conf timeout '{}'", value)),
+                },
+                "reboot-on-error" => match RebootOnError::parse(value) {
+                    Some(reboot_on_error) => conf.reboot_on_error = reboot_on_error,
+                    None => conf.warnings.push(format!(
+                        "ignoring invalid loader.conf reboot-on-error '{}'",
+                        value
+                    )),
+                },
+                "default" | "preferred" => conf
+                    .warnings
+                    .push(format!("ignoring loader.conf {} without a value", key)),
+                _ => conf
+                    .warnings
+                    .push(format!("ignoring unsupported loader.conf key '{}'", key)),
+            }
+        }
+
+        conf
+    }
+}
@@ -0,0 +1,159 @@
+use alloc::collections::BTreeMap;
+use alloc::string::{String, ToString};
+use alloc::vec;
+use alloc::vec::Vec;
+use anyhow::{Result, bail};
+
+/// The largest section that will be read. UKI metadata sections are small, and a limit
+/// keeps a corrupt image from causing a large allocation.
+pub const MAX_SECTION_SIZE: u64 = 64 * 1024;
+
+/// The machine type of an x86_64 PE image.
+pub const PE_MACHINE_X86_64: u16 = 0x8664;
+
+/// The machine type of an aarch64 PE image.
+pub const PE_MACHINE_AARCH64: u16 = 0xaa64;
+
+/// The most sections that are read from a PE image. A unified kernel image with many profiles
+/// has many more sections than the 96 that Windows allows, and the table is still small.
+const MAX_SECTIONS: usize = 1024;
+
+/// The size of a section table entry.
+const SECTION_ENTRY_SIZE: usize = 40;
+
+/// A source of bytes that can be read at an offset, such as a file.
+pub trait ReadAt {
+    /// Fills `buf` with the bytes at `offset`, failing if they can't all be read.
+    fn read_at(&mut self, offset: u64, buf: &mut [u8]) -> Result<()>;
+}
+
+/// Reads from a slice of bytes, which is useful for images that are already in memory.
+impl ReadAt for &[u8] {
+    fn read_at(&mut self, offset: u64, buf: &mut [u8]) -> Result<()> {
+        let start = usize::try_from(offset)?;
+        let end = start.checked_add(buf.len());
+        match end.and_then(|end| self.get(start..end)) {
+            Some(bytes) => {
+                buf.copy_from_slice(bytes);
+                Ok(())
+            }
+            None => bail!("read past the end of the image"),
+        }
+    }
+}
+
+fn u16_at(bytes: &[u8], offset: usize) -> u16 {
+    u16::from_le_bytes([bytes[offset], bytes[offset + 1]])
+}
+
+fn u32_at(bytes: &[u8], offset: usize) -> u32 {
+    u32::from_le_bytes([
+        bytes[offset],
+        bytes[offset + 1],
+        bytes[offset + 2],
+        bytes[offset + 3],
+    ])
+}
+
+/// The parts of a PE image that were read.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PeImage {
+    /// The machine type from the COFF header, such as [PE_MACHINE_X86_64].
+    pub machine: u16,
+    /// The wanted sections, in the order of the section table, including repeated names.
+    pub sections: Vec<PeSection>,
+}
+
+/// A wanted section of a PE image.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PeSection {
+    /// The name of the section, such as `.osrel`.
+    pub name: String,
+    /// The contents of the section, or None if it is larger than [MAX_SECTION_SIZE]. A section
+    /// without contents is still there, as it takes the place of a section with the same name.
+    pub data: Option<Vec<u8>>,
+}
+
+/// Reads the sections named in `wanted` from the PE image in `reader`, keeping the first
+/// section of each name. See [read_pe] for the details.
+pub fn read_sections<R: ReadAt>(
+    reader: &mut R,
+    wanted: &[&str],
+) -> Result<BTreeMap<String, Vec<u8>>> {
+    let mut sections = BTreeMap::new();
+    for section in read_pe(reader, wanted)?.sections {
+        sections.entry(section.name).or_insert(section.data);
+    }
+    // A section that was too large is not available.
+    Ok(sections
+        .into_iter()
+        .filter_map(|(name, data)| data.map(|data| (name, data)))
+        .collect())
+}
+
+/// Reads the machine type and the sections named in `wanted` from the PE image in `reader`.
+/// Only the headers and the wanted sections are read, so this is cheap on large images.
+/// A wanted section that is larger than [MAX_SECTION_SIZE] is listed without its contents.
+/// An image that isn't a valid PE file is an error.
+pub fn read_pe<R: ReadAt>(reader: &mut R, wanted: &[&str]) -> Result<PeImage> {
+    // The DOS header starts with "MZ" and holds the offset of the PE header at 0x3c.
+    let mut dos = [0u8; 0x40];
+    reader.read_at(0, &mut dos)?;
+    if &dos[..2] != b"MZ" {
+        bail!("not a PE image: missing the MZ signature");
+    }
+    let pe_offset = u64::from(u32_at(&dos, 0x3c));
+
+    // The PE header is the "PE\0\0" signature followed by the COFF header.
+    let mut coff = [0u8; 24];
+    reader.read_at(pe_offset, &mut coff)?;
+    if &coff[..4] != b"PE\0\0" {
+        bail!("not a PE image: missing the PE signature");
+    }
+    let machine = u16_at(&coff, 4);
+    let section_count = usize::from(u16_at(&coff, 6));
+    let optional_header_size = u64::from(u16_at(&coff, 20));
+    if section_count > MAX_SECTIONS {
+        bail!("PE image has too many sections: {}", section_count);
+    }
+
+    // The section table follows the optional header.
+    let mut table = vec![0u8; section_count * SECTION_ENTRY_SIZE];
+    reader.read_at(pe_offset + 24 + optional_header_size, &mut table)?;
+
+    let mut sections = Vec::new();
+    for entry in table.as_chunks::<SECTION_ENTRY_SIZE>().0 {
+        // The name is up to eight bytes, padded with NUL.
+        let name_len = entry[..8].iter().position(|b| *b == 0).unwrap_or(8);
+        let Ok(name) = core::str::from_utf8(&entry[..name_len]) else {
+            continue;
+        };
+        if !wanted.contains(&name) {
+            continue;
+        }
+
+        // The real size is the virtual size, as the raw size is padded to the file alignment.
+        let virtual_size = u64::from(u32_at(entry, 8));
+        let raw_size = u64::from(u32_at(entry, 16));
+        let raw_offset = u64::from(u32_at(entry, 20));
+        // A virtual size of zero makes the section empty, which is how a profile removes a section
+        // of the base image.
+        let size = virtual_size.min(raw_size);
+        if size > MAX_SECTION_SIZE {
+            sections.push(PeSection {
+                name: name.to_string(),
+                data: None,
+            });
+            continue;
+        }
+
+        let mut data = vec![0u8; size as usize];
+        reader.read_at(raw_offset, &mut data)?;
+        sections.push(PeSection {
+            name: name.to_string(),
+            data: Some(data),
+        });
+    }
+
+    Ok(PeImage { machine, sections })
+}
@@ -0,0 +1,273 @@
+use crate::{BlsEntry, PeSection};
+use alloc::collections::BTreeMap;
+use alloc::format;
+use alloc::string::{String, ToString};
+use alloc::vec::Vec;
+
+/// The PE sections of a unified kernel image that Sprout reads.
+pub const UKI_SECTIONS: [&str; 4] = [".osrel", ".cmdline", ".uname", ".profile"];
+
+/// The most profiles that are read from a unified kernel image.
+pub const MAX_PROFILES: usize = 256;
+
+/// A parsed os-release file, such as the `.osrel` section of a unified kernel image.
+#[derive(Debug, Default, Clone, PartialEq, Eq)]
+pub struct OsRelease {
+    fields: BTreeMap<String, String>,
+}
+
+impl OsRelease {
+    /// Parses the `input` as an os-release file, which has one `KEY=value` per line.
+    /// Lines that aren't a setting are ignored, and the last value of a key is used.
+    pub fn parse(input: &str) -> Self {
+        let mut fields = BTreeMap::new();
+        for line in input.lines() {
+            let line = line.trim();
+            if line.is_empty() || line.starts_with('#') {
+                continue;
+            }
+            let Some((key, value)) = line.split_once('=') else {
+                continue;
+            };
+            fields.insert(key.trim().to_string(), unquote(value.trim()));
+        }
+        Self { fields }
+    }
+
+    /// Fetches the value of `key`, if it is set.
+    pub fn get(&self, key: &str) -> Option<&str> {
+        self.fields.get(key).map(String::as_str)
+    }
+}
+
+/// Removes one pair of matching quotes from `value` and unescapes a double quoted value.
+fn unquote(value: &str) -> String {
+    if value.len() >= 2 && value.starts_with('\'') && value.ends_with('\'') {
+        return value[1..value.len() - 1].to_string();
+    }
+    if value.len() >= 2 && value.starts_with('"') && value.ends_with('"') {
+        let mut result = String::new();
+        let mut chars = value[1..value.len() - 1].chars();
+        while let Some(c) = chars.next() {
+            // Only these characters can be escaped. Any other backslash is kept as written.
+            match (c, chars.clone().next()) {
+                ('\\', Some(next @ ('"' | '\\' | '$' | '`'))) => {
+                    result.push(next);
+                    chars.next();
+                }
+                _ => result.push(c),
+            }
+        }
+        return result;
+    }
+    value.to_string()
+}
+
+/// Decodes a section as text, dropping the NUL and whitespace padding at the end.
+/// An empty section is treated as missing.
+fn section_text(sections: &BTreeMap<String, Vec<u8>>, name: &str) -> Option<String> {
+    let text = String::from_utf8_lossy(sections.get(name)?);
+    let text = text.trim_end_matches(|c: char| c == '\0' || c.is_whitespace());
+    (!text.is_empty()).then(|| text.to_string())
+}
+
+impl BlsEntry {
+    /// Produces an entry for one profile of the unified kernel image at `uki_path`.
+    /// A profile after the first is booted with `@<number>` in its load options.
+    pub fn from_uki_profile(profile: &UkiProfile, uki_path: &str) -> Self {
+        Self::from_uki_profile_with(profile, uki_path, false)
+    }
+
+    /// Like [BlsEntry::from_uki_profile], and `strict` follows systemd-boot exactly.
+    pub fn from_uki_profile_with(profile: &UkiProfile, uki_path: &str, strict: bool) -> Self {
+        let mut entry = Self::from_uki_with(&profile.sections, uki_path, strict);
+        if let Some(index) = profile.index {
+            entry.profile = (index > 0).then(|| index.to_string());
+            entry.title = entry
+                .title
+                .take()
+                .map(|title| profile_title(&title, index, &profile.info));
+        }
+        entry
+    }
+
+    /// Produces an entry for the unified kernel image at `uki_path`, from its PE `sections`.
+    pub fn from_uki(sections: &BTreeMap<String, Vec<u8>>, uki_path: &str) -> Self {
+        Self::from_uki_with(sections, uki_path, false)
+    }
+
+    /// Produces an entry for the unified kernel image at `uki_path`, from its PE `sections`.
+    /// With `strict`, the title comes from `PRETTY_NAME`, `IMAGE_ID`, `NAME`, then `ID`, and the
+    /// version from `IMAGE_VERSION`, `VERSION`, `VERSION_ID`, then `BUILD_ID`, as in systemd-boot.
+    /// Otherwise the title comes from `PRETTY_NAME`, then `ID`, and the version from
+    /// `IMAGE_VERSION`, `VERSION_ID`, `BUILD_ID`, then the `.uname` section. The sort key comes
+    /// from `IMAGE_ID`, then `ID`. The embedded command line is kept in `cmdline` and not in `options`, as the image
+    /// reads its own command line.
+    pub fn from_uki_with(
+        sections: &BTreeMap<String, Vec<u8>>,
+        uki_path: &str,
+        strict: bool,
+    ) -> Self {
+        let os_release = section_text(sections, ".osrel")
+            .map(|text| OsRelease::parse(&text))
+            .unwrap_or_default();
+        let first = |keys: &[&str]| {
+            keys.iter()
+                .filter_map(|key| os_release.get(key))
+                .find(|value| !value.is_empty())
+                .map(ToString::to_string)
+        };
+        let uname = section_text(sections, ".uname");
+        // systemd-boot looks at more fields. Outside of strict mode the version is not taken from
+        // VERSION, which is often a long name that would be added to the title.
+        let (title, version) = if strict {
+            (
+                first(&["PRETTY_NAME", "IMAGE_ID", "NAME", "ID"]),
+                first(&["IMAGE_VERSION", "VERSION", "VERSION_ID", "BUILD_ID"]),
+            )
+        } else {
+            (
+                first(&["PRETTY_NAME", "ID"]),
+                first(&["IMAGE_VERSION", "VERSION_ID", "BUILD_ID"]),
+            )
+        };
+
+        Self {
+            title,
+            version: version.or_else(|| uname.clone().filter(|_| !strict)),
+            sort_key: first(&["IMAGE_ID", "ID"]),
+            uki: Some(uki_path.to_string()),
+            cmdline: section_text(sections, ".cmdline"),
+            uname,
+            ..Self::default()
+        }
+    }
+}
+
+/// The metadata in the `.profile` section of a profile of a unified kernel image.
+#[derive(Debug, Default, Clone, PartialEq, Eq)]
+pub struct ProfileInfo {
+    /// A short identifier of the profile.
+    pub id: Option<String>,
+    /// A title for people to read.
+    pub title: Option<String>,
+}
+
+impl ProfileInfo {
+    /// Parses the text of a `.profile` section, which is in the format of an os-release file.
+    /// A key without a value is treated as missing.
+    pub fn parse(text: &str) -> Self {
+        let os_release = OsRelease::parse(text);
+        let get = |key: &str| {
+            os_release
+                .get(key)
+                .filter(|value| !value.is_empty())
+                .map(ToString::to_string)
+        };
+        Self {
+            id: get("ID"),
+            title: get("TITLE"),
+        }
+    }
+}
+
+/// The sections that one profile of a unified kernel image boots with.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct UkiProfile {
+    /// The number of the profile, or None if the image has no `.profile` sections.
+    pub index: Option<u32>,
+    /// The metadata of the profile.
+    pub info: ProfileInfo,
+    /// The sections of the profile on top of those of the base image. A section that is empty
+    /// or too large to read, which is how a profile removes a section, is not here.
+    pub sections: BTreeMap<String, Vec<u8>>,
+}
+
+/// Keeps the first section of each name in `range`.
+fn first_of_each(range: &[PeSection]) -> BTreeMap<String, Option<Vec<u8>>> {
+    let mut sections = BTreeMap::new();
+    for section in range {
+        sections
+            .entry(section.name.clone())
+            .or_insert_with(|| section.data.clone());
+    }
+    sections
+}
+
+/// Splits the `sections` of a unified kernel image, in the order of the section table, into the
+/// profiles of the image. Each `.profile` section starts a profile that goes on until the next
+/// one, and the sections before the first are the base that every profile starts from.
+/// A section of a profile takes the place of the section of the same name in the base.
+/// An image without `.profile` sections has one profile, which is the base.
+pub fn uki_profiles(sections: &[PeSection]) -> Vec<UkiProfile> {
+    // Sections that are empty or too large are not available.
+    let usable = |map: BTreeMap<String, Option<Vec<u8>>>| -> BTreeMap<String, Vec<u8>> {
+        map.into_iter()
+            .filter_map(|(name, data)| {
+                data.filter(|data| !data.is_empty())
+                    .map(|data| (name, data))
+            })
+            .collect()
+    };
+
+    let starts: Vec<usize> = sections
+        .iter()
+        .enumerate()
+        .filter(|(_, section)| section.name == ".profile")
+        .map(|(index, _)| index)
+        .collect();
+    let Some(&first) = starts.first() else {
+        return alloc::vec![UkiProfile {
+            index: None,
+            info: ProfileInfo::default(),
+            sections: usable(first_of_each(sections)),
+        }];
+    };
+
+    let base = first_of_each(&sections[..first]);
+    starts
+        .iter()
+        .take(MAX_PROFILES)
+        .enumerate()
+        .map(|(index, start)| {
+            let end = starts.get(index + 1).copied().unwrap_or(sections.len());
+            let range = &sections[*start..end];
+            let mut merged = base.clone();
+            merged.extend(first_of_each(range));
+            UkiProfile {
+                index: Some(index as u32),
+                info: range[0]
+                    .data
+                    .as_ref()
+                    .map(|data| ProfileInfo::parse(&String::from_utf8_lossy(data)))
+                    .unwrap_or_default(),
+                sections: usable(merged),
+            }
+        })
+        .collect()
+}
+
+/// The part of the id of an entry that comes after the `@`, which names the profile.
+/// The first profile has none, and the others have their identifier or their number.
+pub fn profile_id_suffix(index: u32, info: &ProfileInfo) -> Option<String> {
+    (index > 0).then(|| info.id.clone().unwrap_or_else(|| index.to_string()))
+}
+
+/// The title of the entry for a profile, given the `name` of the image.
+pub fn profile_title(name: &str, index: u32, info: &ProfileInfo) -> String {
+    match (&info.title, &info.id) {
+        (Some(title), _) => format!("{} ({})", name, title),
+        (None, Some(id)) if index > 0 => format!("{} ({})", name, id),
+        (None, None) if index > 0 => format!("{} (Profile #{})", name, index + 1),
+        _ => name.to_string(),
+    }
+}
+
+/// The id of the entry for a profile of the image with the file name `file_id`, such as
+/// `fedora.efi`. The file name is in lower case, as in systemd-boot, and the profile is not.
+pub fn profile_entry_id(file_id: &str, suffix: Option<&str>) -> String {
+    match suffix {
+        Some(suffix) => format!("{}@{}", file_id.to_lowercase(), suffix),
+        None => file_id.to_lowercase(),
+    }
+}
@@ -1,7 +1,10 @@
-use edera_sprout_build::generate_sbat_module;
+use edera_sprout_build::{generate_logo_module, generate_sbat_module};

 /// Build script entry point for Sprout.
 fn main() {
    // Generate the sbat.generated.rs file.
    generate_sbat_module();
+
+    // Generate the logo.generated.rs file.
+    generate_logo_module();
 }
@@ -1,16 +1,21 @@
 use crate::context::SproutContext;
+use crate::generators::bls::BLS_INITRD_SLOTS;
 use crate::phases::before_handoff;
 use alloc::boxed::Box;
+use alloc::format;
 use alloc::rc::Rc;
 use alloc::vec::Vec;
 use anyhow::{Context, Result, bail};
 use edera_sprout_config::actions::chainload::ChainloadConfiguration;
 use edera_sprout_parsing::{append_initrd, combine_options, empty_is_none};
 use eficore::bootloader_interface::BootloaderInterface;
+use eficore::devicetree::DeviceTree;
 use eficore::loader::source::ImageSource;
 use eficore::loader::{ImageLoadRequest, ImageLoader};
 use eficore::media_loader::MediaLoaderHandle;
 use eficore::media_loader::constants::linux::LINUX_EFI_INITRD_MEDIA_GUID;
+use eficore::path::ResolvedPath;
+use eficore::secure::SecureBoot;
 use log::warn;
 use uefi::proto::loaded_image::LoadedImage;
 use uefi::{CString16, Handle};
@@ -18,20 +23,60 @@ use uefi::{CString16, Handle};
 /// Read the initrd at the stamped `path` relative to the sprout image.
 /// Provides [None] if the path refers to the root of a filesystem rather than a file.
 pub fn read_initrd(context: &Rc<SproutContext>, path: &str) -> Result<Option<Vec<u8>>> {
-    let resolved = eficore::path::resolve_path(Some(context.root().loaded_image_path()?), path)
-        .context("unable to resolve initrd path")?;
+    read_optional_file(context, path, "initrd")
+}

-    // A path without a file component refers to the root of the filesystem, not an initrd.
+/// Read the `what` at the stamped `path` relative to the sprout image.
+/// Provides [None] if the path refers to the root of a filesystem rather than a file.
+fn read_optional_file(
+    context: &Rc<SproutContext>,
+    path: &str,
+    what: &str,
+) -> Result<Option<Vec<u8>>> {
+    let Some(resolved) = resolve_optional_file(context, path, what)? else {
+        return Ok(None);
+    };
+    let content = resolved
+        .read_file()
+        .with_context(|| format!("unable to read {}", what))?;
+    Ok(Some(content))
+}
+
+/// Resolve the `what` at the stamped `path` relative to the sprout image.
+/// Provides [None] if the path refers to the root of a filesystem rather than a file.
+fn resolve_optional_file(
+    context: &Rc<SproutContext>,
+    path: &str,
+    what: &str,
+) -> Result<Option<ResolvedPath>> {
+    let resolved = eficore::path::resolve_path(Some(context.root().loaded_image_path()?), path)
+        .with_context(|| format!("unable to resolve {} path", what))?;
+
+    // A path without a file component refers to the root of the filesystem, not a file.
    // This happens when a path template like "$root\\$initrd-0" is stamped with an empty
-    // initrd value, such as a BLS entry without an initrd or an unused BLS initrd slot.
+    // value, such as a BLS entry without an initrd or an unused BLS initrd slot.
    let subpath = eficore::path::device_path_subpath(&resolved.full_path)
-        .context("unable to get initrd subpath")?;
+        .with_context(|| format!("unable to get {} subpath", what))?;
    if subpath.trim_matches('\\').is_empty() {
        return Ok(None);
    }
+    Ok(Some(resolved))
+}

-    let content = resolved.read_file().context("unable to read initrd")?;
-    Ok(Some(content))
+/// Install the devicetree at the stamped `path` for the image that is about to be started.
+/// Provides [None] if there is none to install, such as when the path refers to the root of a
+/// filesystem, or when Secure Boot is enabled, as a devicetree can't be verified.
+fn install_devicetree(context: &Rc<SproutContext>, path: &str) -> Result<Option<DeviceTree>> {
+    let Some(resolved) = resolve_optional_file(context, path, "devicetree")? else {
+        return Ok(None);
+    };
+    if SecureBoot::enabled().unwrap_or(true) {
+        warn!("ignoring the devicetree, as Secure Boot is enabled");
+        return Ok(None);
+    }
+    let content = resolved.read_file().context("unable to read devicetree")?;
+    let devicetree = DeviceTree::install(&content).context("unable to install the devicetree")?;
+    Ok(Some(devicetree))
 }

 /// Unloads the image with the contained handle when dropped, unless the handle is taken.
@@ -116,6 +161,24 @@ pub fn chainload(context: Rc<SproutContext>, configuration: &ChainloadConfigurat
        .chain(configuration.linux_initrd_chain.iter())
        .map(|item| context.stamp(item));

+    // A BLS entry can have more initrds than the chain lists. Those would be dropped without a
+    // word, and then the kernel may not find its root, so say so.
+    let chain_length = configuration.linux_initrd_chain.len();
+    if chain_length > 0 {
+        for slot in chain_length..BLS_INITRD_SLOTS {
+            let placeholder = format!("$initrd-{}", slot);
+            let value = context.stamp(&placeholder);
+            if !value.is_empty() && value != placeholder {
+                warn!(
+                    "the entry has an initrd for slot {}, but linux-initrd-chain only lists {}, \
+                     so it is not loaded",
+                    slot, chain_length
+                );
+                break;
+            }
+        }
+    }
+
    // Read each initrd and concatenate the contents in order.
    // Paths that are empty after stamping are skipped.
    let mut initrd: Option<Vec<u8>> = None;
@@ -143,6 +206,29 @@ pub fn chainload(context: Rc<SproutContext>, configuration: &ChainloadConfigurat
        initrd_handle = Some(handle);
    }

+    // Install the devicetree, if there is one, for the image to find. It is restored when it is
+    // dropped, which is once the image has returned or failed to start. A devicetree is not
+    // verified, so it is not used when Secure Boot is enabled, or when that can't be told.
+    let mut devicetree = None;
+    if let Some(path) = empty_is_none(
+        configuration
+            .devicetree
+            .as_ref()
+            .map(|path| context.stamp(path)),
+    ) {
+        match install_devicetree(&context, &path) {
+            Ok(installed) => devicetree = installed,
+            // systemd-boot does not boot an entry whose devicetree can't be installed. Outside
+            // of strict mode it is booted without it, as before the devicetree was supported.
+            Err(error) if !context.root().options().bls_strict_mode => warn!(
+                "booting without the devicetree {}, as it can't be installed: {:#} \
+                 (systemd-boot and strict mode do not boot the entry)",
+                path, error
+            ),
+            Err(error) => return Err(error),
+        }
+    }
+
    // Mark execution of an entry in the bootloader interface.
    // This is only informational, so it should not prevent booting.
    if let Err(error) = BootloaderInterface::mark_exec(context.root().timer()) {
@@ -175,6 +261,9 @@ pub fn chainload(context: Rc<SproutContext>, configuration: &ChainloadConfigurat
    // Explicitly drop the initrd handle to clarify when it should be unregistered.
    drop(initrd_handle);

+    // Explicitly drop the devicetree to clarify when the original is restored.
+    drop(devicetree);
+
    // Return control to sprout.
    Ok(())
 }
@@ -132,6 +132,7 @@ pub fn edera(context: Rc<SproutContext>, configuration: &EderaConfiguration) ->
            options: vec![],
            linux_initrd: None,
            linux_initrd_chain: vec![],
+            devicetree: None,
        },
    )
    .context("unable to chainload to xen");
@@ -1,8 +1,11 @@
+use alloc::boxed::Box;
 use anyhow::{Context, Result};
 use edera_sprout_config::RootConfiguration;
 use log::warn;
+use uefi::Handle;
 use uefi::fs::FileSystem;
 use uefi::proto::device_path::DevicePath;
+use uefi::proto::loaded_image::LoadedImage;
 use uefi::proto::media::fs::SimpleFileSystem;

 /// bls: autodetect and configure BLS-enabled filesystems.
@@ -16,13 +19,47 @@ pub mod linux;
 /// windows: autodetect and configure Windows boot configurations.
 pub mod windows;

+/// Find the filesystems that systemd-boot reads BLS entries from: the partition that Sprout
+/// was loaded from, and the extended boot loader partition of the same disk.
+fn strict_bls_sources(loaded_image_path: &DevicePath) -> (Option<Handle>, Option<Handle>) {
+    let own = eficore::handle::open_shared::<LoadedImage>(uefi::boot::image_handle())
+        .ok()
+        .and_then(|image| image.device());
+    let xbootldr = match eficore::xbootldr::find_xbootldr(loaded_image_path) {
+        Ok(Some(path)) => uefi::boot::locate_device_path::<SimpleFileSystem>(&mut &*path).ok(),
+        Ok(None) => None,
+        Err(error) => {
+            warn!("unable to find the xbootldr partition: {:#}", error);
+            None
+        }
+    };
+    (own, xbootldr)
+}
+
 /// Generate a [RootConfiguration] based on the environment.
 /// Intakes a `config` to use as the basis of the autoconfiguration.
-pub fn autoconfigure(config: &mut RootConfiguration) -> Result<()> {
+/// With `strict`, only the partition Sprout was loaded from and the extended boot loader
+/// partition of its disk are read for BLS entries, as one generator, like systemd-boot does.
+pub fn autoconfigure(
+    config: &mut RootConfiguration,
+    strict: bool,
+    loaded_image_path: &DevicePath,
+) -> Result<()> {
    // Find all the filesystems that are on the system.
    let filesystem_handles =
        uefi::boot::find_handles::<SimpleFileSystem>().context("unable to scan filesystems")?;

+    // The partitions that BLS entries are read from in strict mode.
+    let (own_handle, xbootldr_handle) = if strict {
+        strict_bls_sources(loaded_image_path)
+    } else {
+        (None, None)
+    };
+    // The device path of the partition of Sprout, which names the strict generator.
+    let mut own_root: Option<Box<DevicePath>> = None;
+    // Whether either of the partitions has BLS entries, in strict mode.
+    let mut strict_found = false;
+
    // For each filesystem that was detected, scan it for supported autoconfig mechanisms.
    for handle in filesystem_handles {
        // Acquire the device path root for the filesystem.
@@ -51,15 +88,37 @@ pub fn autoconfigure(config: &mut RootConfiguration) -> Result<()> {
        // A scan that fails is skipped, as a filesystem that can't be read should not
        // prevent autoconfiguring the other filesystems.

-        // Scan the filesystem for BLS supported configurations.
-        let bls_found = match bls::scan(&mut filesystem, &root, config) {
-            Ok(found) => found,
-            Err(error) => {
-                warn!(
-                    "unable to scan filesystem for bls configurations: {:#}",
-                    error
-                );
-                false
+        // Scan the filesystem for BLS supported configurations. In strict mode, only the
+        // partitions that systemd-boot reads get entries, and they get a single generator.
+        // The other filesystems that have BLS are still not scanned for Linux configurations.
+        let is_source = Some(handle) == own_handle || Some(handle) == xbootldr_handle;
+        if strict && Some(handle) == own_handle {
+            own_root = Some(root.to_boxed());
+        }
+        let bls_found = if strict {
+            match bls::detect(&mut filesystem) {
+                Ok(found) => {
+                    strict_found |= found && is_source;
+                    found
+                }
+                Err(error) => {
+                    warn!(
+                        "unable to scan filesystem for bls configurations: {:#}",
+                        error
+                    );
+                    false
+                }
+            }
+        } else {
+            match bls::scan(&mut filesystem, &root, config) {
+                Ok(found) => found,
+                Err(error) => {
+                    warn!(
+                        "unable to scan filesystem for bls configurations: {:#}",
+                        error
+                    );
+                    false
+                }
            }
        };

@@ -80,5 +139,20 @@ pub fn autoconfigure(config: &mut RootConfiguration) -> Result<()> {
        }
    }

+    // In strict mode, one generator reads both partitions, with the root of Sprout's partition.
+    if strict && strict_found {
+        match own_root {
+            Some(root) => {
+                if let Err(error) = bls::add_generator(config, &root, true) {
+                    warn!("unable to add the bls generator: {:#}", error);
+                }
+            }
+            None => warn!(
+                "found BLS entries, but not the partition that Sprout was loaded from, \
+                 so none are used in strict mode"
+            ),
+        }
+    }
+
    Ok(())
 }
@@ -18,27 +18,14 @@ use uefi::proto::device_path::text::{AllowShortcuts, DisplayOnly};
 /// by the BLS generator to chainload entries.
 const BLS_CHAINLOAD_ACTION_PREFIX: &str = "bls-chainload-";

-/// Scan the specified `filesystem` for BLS configurations.
-pub fn scan(
-    filesystem: &mut FileSystem,
-    root: &DevicePath,
-    config: &mut RootConfiguration,
-) -> Result<bool> {
+/// Detect whether the `filesystem` has a BLS supported configuration.
+pub fn detect(filesystem: &mut FileSystem) -> Result<bool> {
    // BLS has a loader.conf file that can specify its own auto-entries mechanism.
    let bls_loader_conf_path = Path::new(cstr16!("\\loader\\loader.conf"));
    // BLS also has an entries directory that can specify explicit entries.
    let bls_entries_path = Path::new(cstr16!("\\loader\\entries"));
-
-    // Convert the device path root to a string we can use in the configuration.
-    let mut root = root
-        .to_string16(DisplayOnly(false), AllowShortcuts(false))
-        .context("unable to convert device root to string")?
-        .to_string();
-    // Add a trailing forward-slash to the root to ensure the device root is completed.
-    root.push('/');
-
-    // Generate a unique hash of the root path.
-    let root_unique_hash = unique_hash(&root);
+    // BLS Type #2 entries are unified kernel images in the EFI/Linux directory.
+    let bls_uki_path = Path::new(cstr16!("\\EFI\\Linux"));

    // Whether we have a loader.conf file.
    let has_loader_conf = filesystem
@@ -64,11 +51,46 @@ pub fn scan(
        })
        .unwrap_or(false);

+    // Whether we have any unified kernel images.
+    let has_ukis = filesystem
+        .read_dir(bls_uki_path)
+        .map(|mut iterator| {
+            iterator.any(|entry| {
+                entry.is_ok_and(|entry| {
+                    entry.is_regular_file()
+                        && entry
+                            .file_name()
+                            .to_string()
+                            .to_lowercase()
+                            .ends_with(".efi")
+                })
+            })
+        })
+        .unwrap_or(false);
+
    // Detect if a BLS supported configuration is on this filesystem.
-    // We check both loader.conf and entries directory as only one of them is required.
-    if !(has_loader_conf || has_entries_dir) {
-        return Ok(false);
-    }
+    // We check loader.conf, the entries directory and unified kernel images, as only one of
+    // them is required.
+    Ok(has_loader_conf || has_entries_dir || has_ukis)
+}
+
+/// Add the BLS generator and its action for the partition with the device path `root`.
+/// In `strict` mode, the generator also reads the extended boot loader partition of the disk.
+pub fn add_generator(
+    config: &mut RootConfiguration,
+    root: &DevicePath,
+    strict: bool,
+) -> Result<()> {
+    // Convert the device path root to a string we can use in the configuration.
+    let mut root = root
+        .to_string16(DisplayOnly(false), AllowShortcuts(false))
+        .context("unable to convert device root to string")?
+        .to_string();
+    // Add a trailing forward-slash to the root to ensure the device root is completed.
+    root.push('/');
+
+    // Generate a unique hash of the root path.
+    let root_unique_hash = unique_hash(&root);

    // Generate a unique name for the BLS chainload action.
    let chainload_action_name = format!("{}{}", BLS_CHAINLOAD_ACTION_PREFIX, root_unique_hash,);
@@ -81,6 +103,12 @@ pub fn scan(
            ..Default::default()
        },
        path: format!("{}\\loader", root),
+        uki_path: None,
+        // Every filesystem is scanned, including the Extended Boot Loader Partition, which
+        // gets a generator of its own, unless strict mode reads it with the generator of the
+        // partition that Sprout was loaded from.
+        xbootldr: strict,
+        pin_names: true,
    };

    // Generate a unique name for the BLS generator and insert the generator into the configuration.
@@ -96,13 +124,18 @@ pub fn scan(
    // BLS will provide these values to us.
    // Every initrd slot is chained in order. Unused slots stamp to the root of the
    // filesystem, which the chainload action skips.
+    // The files of an entry are on the partition of the entry, which is the root of the
+    // generator for most entries, and the extended boot loader partition for some in strict mode.
+    let entry_root = if strict { "$entry-root" } else { &root };
    let chainload = ChainloadConfiguration {
-        path: format!("{}\\$chainload", root),
+        path: format!("{}\\$chainload", entry_root),
        options: vec!["$options".to_string()],
        linux_initrd: None,
        linux_initrd_chain: (0..BLS_INITRD_SLOTS)
-            .map(|slot| format!("{}\\$initrd-{}", root, slot))
+            .map(|slot| format!("{}\\$initrd-{}", entry_root, slot))
            .collect(),
+        // An unset devicetree stamps to the root of the filesystem, which the action skips.
+        devicetree: Some(format!("{}\\$devicetree", entry_root)),
    };

    // Insert the chainload action into the configuration.
@@ -114,6 +147,18 @@ pub fn scan(
        },
    );

-    // We had a BLS supported configuration, so return true.
+    Ok(())
+}
+
+/// Scan the specified `filesystem` for BLS configurations.
+pub fn scan(
+    filesystem: &mut FileSystem,
+    root: &DevicePath,
+    config: &mut RootConfiguration,
+) -> Result<bool> {
+    if !detect(filesystem)? {
+        return Ok(false);
+    }
+    add_generator(config, root, false)?;
    Ok(true)
 }
@@ -237,6 +237,7 @@ pub fn scan(
        options: vec!["$linux-options".to_string()],
        linux_initrd: Some("$initrd".to_string()),
        linux_initrd_chain: vec![],
+        devicetree: None,
    };

    // Insert the chainload action into the configuration.
@@ -0,0 +1,104 @@
+use alloc::{format, string::String};
+use anyhow::{Context, Result, anyhow, bail};
+use edera_sprout_bls::BootCounter;
+use uefi::{
+    CString16, Handle,
+    data_types::Align,
+    fs::PathBuf,
+    mem::AlignedBuffer,
+    proto::media::file::{File, FileAttribute, FileInfo, FileMode},
+    proto::media::fs::SimpleFileSystem,
+};
+
+/// The size of the fixed part of a file info: three sizes, three timestamps and the attributes.
+const FILE_INFO_HEADER_SIZE: usize = 3 * 8 + 3 * 16 + 8;
+
+/// Where the boot counter of an entry is stored, so that a try can be consumed when the
+/// entry is booted.
+#[derive(Clone)]
+pub struct BootCounterTarget {
+    /// The counter as it is currently encoded in the file name.
+    pub counter: BootCounter,
+    /// The handle of the filesystem that holds the entry file.
+    pub filesystem: Handle,
+    /// The directory that holds the entry file.
+    pub directory: PathBuf,
+    /// The entry id, which is the file name without the counter and extension.
+    pub id: String,
+    /// The current file name, including the counter and the extension.
+    pub file_name: String,
+    /// The extension of the file name, such as `.conf`, in its original case.
+    pub extension: String,
+    /// Whether booting the entry uses up a try. An entry whose tries are not used up still
+    /// has them, so it can be bad.
+    pub counting: bool,
+}
+
+impl BootCounterTarget {
+    /// Consumes one try by renaming the entry file, such as `foo+3.conf` to `foo+2-1.conf`.
+    /// The file is renamed in place without copying it, as unified kernel images are large and
+    /// a copy interrupted by a crash would leave a truncated image behind.
+    /// Returns the path of the renamed file.
+    pub fn consume(&self) -> Result<PathBuf> {
+        let new_name = format!(
+            "{}{}",
+            self.counter.decremented().render(&self.id),
+            self.extension
+        );
+        let new_name_16 =
+            CString16::try_from(new_name.as_str()).context("invalid new entry file name")?;
+
+        let mut fs = uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(self.filesystem)
+            .context("unable to open the entry filesystem")?;
+        let mut root = fs
+            .open_volume()
+            .context("unable to open the entry volume")?;
+
+        // Open the entry file for writing.
+        let mut from = self.directory.clone();
+        from.push(PathBuf::from(
+            CString16::try_from(self.file_name.as_str()).context("invalid entry file name")?,
+        ));
+        let from_name =
+            CString16::try_from(format!("{}", from).as_str()).context("invalid entry file path")?;
+        let handle = root
+            .open(&from_name, FileMode::ReadWrite, FileAttribute::empty())
+            .context("unable to open the entry file")?;
+        let mut file = handle
+            .into_regular_file()
+            .ok_or_else(|| anyhow!("the entry is not a regular file"))?;
+
+        // Renaming a file is done by setting its file info with a different name.
+        let info = file
+            .get_boxed_info::<FileInfo>()
+            .context("unable to get the entry file info")?;
+        // A read-only file is left as it is, as the counter is not meant to be changed.
+        if info.attribute().contains(FileAttribute::READ_ONLY) {
+            bail!("the entry file is read-only");
+        }
+        // The info is a fixed header followed by the null-terminated UCS-2 name.
+        let size =
+            FILE_INFO_HEADER_SIZE + 2 * (new_name.len() + 1) + <FileInfo as Align>::alignment();
+        let mut storage = AlignedBuffer::from_size_align(size, <FileInfo as Align>::alignment())
+            .context("unable to allocate the entry file info")?;
+        let renamed = FileInfo::new(
+            storage.as_slice_mut(),
+            info.file_size(),
+            info.physical_size(),
+            *info.create_time(),
+            *info.last_access_time(),
+            *info.modification_time(),
+            info.attribute(),
+            &new_name_16,
+        )
+        .map_err(|error| anyhow!("unable to build the renamed entry file info: {:?}", error))?;
+        file.set_info(renamed)
+            .context("unable to rename the entry file")?;
+        file.flush()
+            .context("unable to flush the renamed entry file")?;
+
+        let mut to = self.directory.clone();
+        to.push(PathBuf::from(new_name_16));
+        Ok(to)
+    }
+}
@@ -233,7 +233,19 @@ impl SproutContext {
    /// For example, if this context contains {"a":"b"}, and the text "hello\\$a", it will produce
    /// "hello\\b" as an output string.
    pub fn stamp(&self, text: impl AsRef<str>) -> String {
-        stamp_values(&self.all_values(), text.as_ref()).1
+        // A value can refer to other values, which a single pass leaves unresolved when the
+        // key it refers to was already handled. Stamp until the text settles, up to the same
+        // limit that finalizing a context uses.
+        let values = self.all_values();
+        let mut result = text.as_ref().to_string();
+        for _ in 0..CONTEXT_FINALIZE_ITERATION_LIMIT {
+            let (changed, stamped) = stamp_values(&values, &result);
+            result = stamped;
+            if !changed || result.len() > CONTEXT_FINALIZE_VALUE_LENGTH_LIMIT {
+                break;
+            }
+        }
+        result
    }

    /// Stamps all the items from the iterator `input` with all the values in this [SproutContext]
@@ -3,12 +3,16 @@ use alloc::collections::BTreeMap;
 use alloc::format;
 use alloc::rc::Rc;
 use alloc::string::String;
+use alloc::vec::Vec;
 use anyhow::{Context, Result};
-use edera_sprout_config::drivers::DriverDeclaration;
+use edera_sprout_config::drivers::{DriverDeclaration, DriverProvides};
 use eficore::loader::source::ImageSource;
 use eficore::loader::{ImageLoadRequest, ImageLoader};
 use log::info;
 use uefi::boot::SearchType;
+use uefi::proto::media::block::BlockIO;
+use uefi::proto::media::disk::{DiskIo, DiskIo2};
+use uefi::{Handle, Identify};

 /// Loads the driver specified by the `driver` declaration.
 fn load_driver(context: Rc<SproutContext>, driver: &DriverDeclaration) -> Result<()> {
@@ -37,27 +41,53 @@ fn load_driver(context: Rc<SproutContext>, driver: &DriverDeclaration) -> Result
    Ok(())
 }

-/// Reconnects all handles to their controllers.
-/// This is effectively a UEFI stack reload in a sense.
-/// After we load all the drivers, we need to reconnect all of their handles
-/// so that filesystems are recognized again.
-fn reconnect() -> Result<()> {
-    // Locate all of the handles in the UEFI stack.
-    let handles = uefi::boot::locate_handle_buffer(SearchType::AllHandles)
-        .context("unable to locate handles buffer")?;
+/// Locates the handles that are disks or partitions.
+/// These are the only controllers that filesystem drivers can bind to.
+fn locate_storage_handles() -> Result<Vec<Handle>> {
+    let mut storage = Vec::new();
+    for guid in [&BlockIO::GUID, &DiskIo::GUID, &DiskIo2::GUID] {
+        // Not finding any handles for a protocol is not an error.
+        let Ok(handles) = uefi::boot::locate_handle_buffer(SearchType::ByProtocol(guid)) else {
+            continue;
+        };
+        for handle in handles.iter() {
+            if !storage.contains(handle) {
+                storage.push(*handle);
+            }
+        }
+    }
+    Ok(storage)
+}

-    for handle in handles.iter() {
+/// Reconnects handles to their controllers.
+/// This is effectively a UEFI stack reload in a sense.
+/// After we load all the drivers, we need to reconnect their handles
+/// so that filesystems are recognized again.
+/// When `provides` is [`DriverProvides::Filesystems`], only disk and partition handles are reconnected.
+fn reconnect(provides: DriverProvides) -> Result<()> {
+    // Locate the handles to reconnect in the UEFI stack.
+    let handles = match provides {
+        DriverProvides::Any => uefi::boot::locate_handle_buffer(SearchType::AllHandles)
+            .context("unable to locate handles buffer")?
+            .iter()
+            .copied()
+            .collect(),
+        DriverProvides::Filesystems => locate_storage_handles()?,
+    };
+
+    for handle in handles {
        // Ignore the result as there is nothing we can do if reconnecting a controller fails.
        // This is also likely to fail in some cases but should fail safely.
-        let _ = uefi::boot::connect_controller(*handle, &[], None, true);
+        let _ = uefi::boot::connect_controller(handle, &[], None, true);
    }

    Ok(())
 }

 /// Load all the drivers specified in `drivers`.
-/// There is no driver order currently. This will reconnect all the controllers
-/// to all handles if at least one driver was loaded.
+/// There is no driver order currently. This will reconnect the controllers
+/// if at least one driver was loaded. Every controller is reconnected unless all
+/// the drivers only provide filesystems, in which case only storage is reconnected.
 pub fn load(
    context: Rc<SproutContext>,
    drivers: &BTreeMap<String, DriverDeclaration>,
@@ -74,8 +104,16 @@ pub fn load(
        load_driver(context.clone(), driver).context(format!("unable to load driver: {}", name))?;
    }

-    // Reconnect all the controllers to all handles.
-    reconnect().context("unable to reconnect drivers")?;
+    // Reconnect everything if any driver can provide anything, otherwise only storage.
+    let provides = if drivers
+        .values()
+        .all(|driver| driver.provides == DriverProvides::Filesystems)
+    {
+        DriverProvides::Filesystems
+    } else {
+        DriverProvides::Any
+    };
+    reconnect(provides).context("unable to reconnect drivers")?;
    info!("loaded drivers");

    // We've now loaded all the drivers, so we can return.
@@ -1,7 +1,11 @@
+use crate::boot_counter::BootCounterTarget;
 use crate::context::SproutContext;
+use alloc::format;
 use alloc::rc::Rc;
 use alloc::string::{String, ToString};
+use edera_sprout_bls::profile_entry_id;
 use edera_sprout_config::entries::EntryDeclaration;
+use edera_sprout_parsing::{fnmatch_ignore_case, glob_match};

 /// Represents an entry that is stamped and ready to be booted.
 #[derive(Clone)]
@@ -13,6 +17,10 @@ pub struct BootableEntry {
    default: bool,
    pin_name: bool,
    sort_key: Option<String>,
+    boot_counter: Option<BootCounterTarget>,
+    id_suffix: Option<String>,
+    id_profile: Option<String>,
+    extra_profile: bool,
 }

 impl BootableEntry {
@@ -31,6 +39,10 @@ impl BootableEntry {
            default: false,
            pin_name: false,
            sort_key: None,
+            boot_counter: None,
+            id_suffix: None,
+            id_profile: None,
+            extra_profile: false,
        }
    }

@@ -39,6 +51,53 @@ impl BootableEntry {
        &self.name
    }

+    /// Fetch the id of the entry, which is how the bootloader interface refers to it.
+    /// A BLS entry has the id systemd-boot gives it: the name with the file extension, such as
+    /// `fedora.conf`, in lower case. Any other entry has its name as the id.
+    pub fn id(&self) -> String {
+        match self.id_suffix {
+            Some(ref suffix) => {
+                let file = format!("{}{}", self.sort_name(), suffix);
+                profile_entry_id(&file, self.id_profile.as_deref())
+            }
+            None => self.name.clone(),
+        }
+    }
+
+    /// Fetch the name of the entry without the profile of a unified kernel image, which is
+    /// the same for every profile of the same image.
+    pub fn sort_name(&self) -> &str {
+        self.id_profile
+            .as_deref()
+            .and_then(|profile| {
+                self.name
+                    .strip_suffix(profile)
+                    .and_then(|name| name.strip_suffix('@'))
+            })
+            .unwrap_or(&self.name)
+    }
+
+    /// Fetch whether the entry is a profile of a unified kernel image after the first, which
+    /// is never picked as the default entry unless it was asked for.
+    pub fn is_extra_profile(&self) -> bool {
+        self.id_profile.is_some() || self.extra_profile
+    }
+
+    /// Mark this entry as booting a profile of a unified kernel image after the first.
+    pub fn mark_extra_profile(&mut self) {
+        self.extra_profile = true;
+    }
+
+    /// Set the profile of a unified kernel image that is part of the id of this entry.
+    pub fn set_id_profile(&mut self, profile: &str) {
+        self.id_profile = Some(profile.to_string());
+    }
+
+    /// Set the file extension that is part of the id of this entry, such as `.conf`.
+    pub fn set_id_suffix(&mut self, suffix: &str) {
+        self.id_suffix = Some(suffix.to_string());
+    }
+
    /// Fetch the title of the entry. This is usually a human-readable key.
    pub fn title(&self) -> &str {
        &self.title
@@ -99,24 +158,57 @@ impl BootableEntry {
        self.pin_name = true;
    }

+    /// Record where the boot counter of this entry is stored.
+    pub fn set_boot_counter(&mut self, target: BootCounterTarget) {
+        self.boot_counter = Some(target);
+    }
+
+    /// Fetch where the boot counter of this entry is stored, if it has one.
+    pub fn boot_counter(&self) -> Option<&BootCounterTarget> {
+        self.boot_counter.as_ref()
+    }
+
+    /// Fetch whether the entry has a boot counter with no tries left.
+    pub fn is_bad(&self) -> bool {
+        self.boot_counter
+            .as_ref()
+            .is_some_and(|target| target.counter.is_bad())
+    }
+
    /// Prepend the name of the entry with `prefix`.
    pub fn prepend_name_prefix(&mut self, prefix: &str) {
        self.name.insert_str(0, prefix);
    }

    /// Determine if this entry matches `needle` by comparing to the name or title of the entry.
-    /// If `needle` ends with *, we will match a partial match.
+    /// The `needle` is a glob pattern, where `*` matches any sequence of characters.
+    /// A `needle` without any `*` must equal the name or title exactly.
    pub fn is_match(&self, needle: &str) -> bool {
-        // If the needle ends with '*', we will accept a partial match.
-        if needle.ends_with("*") {
-            // Strip off any '*' at the end.
-            let partial = needle.trim_end_matches("*");
-            // Check if the name or title start with the partial match.
-            return self.name.starts_with(partial) || self.title.starts_with(partial);
-        }
+        glob_match(needle, &self.name) || glob_match(needle, &self.title)
+    }

-        // Standard quality matching rules.
-        self.name == needle || self.title == needle
+    /// Determine if this entry matches `needle` by comparing to the id or the name of the entry,
+    /// so that both `fedora.conf` and `fedora` select the entry. This is how loader.conf and the
+    /// bootloader interface select entries, so the `needle` is a pattern that is matched ignoring
+    /// case and supports `*`, `?` and `[a-z]`.
+    pub fn is_match_id(&self, needle: &str) -> bool {
+        fnmatch_ignore_case(needle, &self.id()) || fnmatch_ignore_case(needle, &self.name)
+    }
+
+    /// Create a variant of this entry, with the name suffixed by `suffix` and using `context`.
+    /// The actions of the entry are stamped with `context` when the entry is booted.
+    /// Variants of the same entry keep the sort key of this entry, so they stay grouped
+    /// together in the order they were created in.
+    pub fn variant(&self, suffix: &str, context: Rc<SproutContext>) -> Self {
+        let mut entry = self.clone();
+        entry.name.push_str(suffix);
+        // Without any sort key, the name is used to sort, which differs between variants.
+        // Pin the sort key to the name of this entry to keep the variants together.
+        if entry.sort_key.is_none() && entry.declaration.sort_key.is_none() {
+            entry.sort_key = Some(self.name.clone());
+        }
+        entry.context = context;
+        entry
    }

    /// Set the sort key of the entry. This is used to sort entries via version comparison.
@@ -135,6 +227,14 @@ impl BootableEntry {
            .unwrap_or(&self.name)
    }

+    /// Find the first entry that matches `needle` by id inside the entry iterator `haystack`.
+    pub fn find_id<'a>(
+        needle: &str,
+        haystack: impl Iterator<Item = &'a BootableEntry>,
+    ) -> Option<&'a BootableEntry> {
+        haystack.into_iter().find(|entry| entry.is_match_id(needle))
+    }
+
    /// Find an entry by `needle` inside the entry iterator `haystack`.
    /// This will search for an entry by name, title, or index.
    pub fn find<'a>(
@@ -1,10 +1,14 @@
 use crate::context::SproutContext;
 use crate::entries::BootableEntry;
+use alloc::collections::BTreeSet;
+use alloc::format;
 use alloc::rc::Rc;
+use alloc::string::String;
 use alloc::vec::Vec;
 use anyhow::Result;
 use anyhow::bail;
 use edera_sprout_config::generators::GeneratorDeclaration;
+use edera_sprout_parsing::{build_variants, rule_matches};

 /// The BLS generator.
 pub mod bls;
@@ -15,10 +19,8 @@ pub mod list;
 /// The matrix generator.
 pub mod matrix;

-/// Runs the generator specified by the `generator` option.
-/// It uses the specified `context` as the parent context for
-/// the generated entries, injecting more values if needed.
-pub fn generate(
+/// Runs the generator kind specified by the `generator` option.
+fn generate_base(
    context: Rc<SproutContext>,
    generator: &GeneratorDeclaration,
 ) -> Result<Vec<BootableEntry>> {
@@ -32,3 +34,92 @@ pub fn generate(
        bail!("unknown generator configuration");
    }
 }
+
+/// Multiplies `entries` by every combination of the variants in `generator`.
+fn apply_variants(
+    entries: Vec<BootableEntry>,
+    generator: &GeneratorDeclaration,
+) -> Result<Vec<BootableEntry>> {
+    // Without any variants, the entries are used as-is.
+    if generator.variants.is_empty() {
+        return Ok(entries);
+    }
+
+    // Validate the axes, as an axis without choices would silently produce no entries,
+    // and duplicate choice names would produce entries with the same name.
+    let mut axes = Vec::new();
+    for (axis, choices) in &generator.variants {
+        if choices.is_empty() {
+            bail!("variant axis '{}' has no choices", axis);
+        }
+        let mut seen = BTreeSet::new();
+        for choice in choices {
+            if !seen.insert(choice.name.as_str()) {
+                bail!(
+                    "variant axis '{}' has more than one choice named '{}'",
+                    axis,
+                    choice.name
+                );
+            }
+        }
+        axes.push((
+            axis.clone(),
+            choices
+                .iter()
+                .map(|choice| (choice.name.clone(), choice.values.clone()))
+                .collect(),
+        ));
+    }
+
+    let combinations = build_variants(&axes);
+    let mut result = Vec::with_capacity(entries.len() * combinations.len());
+    for entry in &entries {
+        for combination in &combinations {
+            let mut context = entry.context().fork();
+            context.insert(&combination.values);
+            let suffix: String = combination
+                .names
+                .iter()
+                .map(|name| format!("-{}", name))
+                .collect();
+            result.push(entry.variant(&suffix, context.freeze()));
+        }
+    }
+    Ok(result)
+}
+
+/// Runs the generator specified by the `generator` option, named `name`.
+/// It uses the specified `context` as the parent context for
+/// the generated entries, injecting more values if needed.
+/// Entry names are prefixed with the generator name unless pinned,
+/// then variants are applied, and then excluded entries are removed.
+pub fn generate(
+    name: &str,
+    context: Rc<SproutContext>,
+    generator: &GeneratorDeclaration,
+) -> Result<Vec<BootableEntry>> {
+    let mut entries = generate_base(context, generator)?;
+
+    // We will prefix all entries with [name]-, provided the name is not pinned.
+    let prefix = format!("{}-", name);
+    for entry in &mut entries {
+        if !entry.is_pin_name() {
+            entry.prepend_name_prefix(&prefix);
+        }
+    }
+
+    let mut entries = apply_variants(entries, generator)?;
+
+    // Remove any entries that match an exclusion rule.
+    if !generator.exclude.is_empty() {
+        entries.retain(|entry| {
+            let values = entry.context().all_values();
+            !generator
+                .exclude
+                .iter()
+                .any(|rule| rule_matches(rule, &values))
+        });
+    }
+
+    Ok(entries)
+}
@@ -1,3 +1,4 @@
+use crate::boot_counter::BootCounterTarget;
 use crate::context::SproutContext;
 use crate::entries::BootableEntry;
 use alloc::{
@@ -7,20 +8,43 @@ use alloc::{
    vec::Vec,
 };
 use anyhow::{Context, Result};
+use core::sync::atomic::{AtomicBool, Ordering as AtomicOrdering};
 use core::{cmp::Ordering, str::FromStr};
-use edera_sprout_bls::{BlsEntry, sort_bls};
+use edera_sprout_bls::{
+    BlsEntry, BootCounter, is_reserved_entry_name, profile_id_suffix, sort_bls, strip_extension,
+};
 use edera_sprout_config::generators::bls::BlsConfiguration;
-use log::warn;
+use log::{info, warn};
 use uefi::{
-    cstr16,
+    CString16, cstr16,
    fs::{FileSystem, PathBuf},
    proto::device_path::text::{AllowShortcuts, DisplayOnly},
    proto::media::fs::SimpleFileSystem,
 };

+mod uki;
+
+/// The PE machine type of the images that can boot on this machine.
+#[cfg(target_arch = "x86_64")]
+const PE_MACHINE: u16 = edera_sprout_bls::PE_MACHINE_X86_64;
+/// The PE machine type of the images that can boot on this machine.
+#[cfg(target_arch = "aarch64")]
+const PE_MACHINE: u16 = edera_sprout_bls::PE_MACHINE_AARCH64;
+
+/// The name of the architecture of this machine in BLS entries.
+#[cfg(target_arch = "x86_64")]
+const ARCHITECTURE: &str = "x64";
+/// The name of the architecture of this machine in BLS entries.
+#[cfg(target_arch = "aarch64")]
+const ARCHITECTURE: &str = "aa64";
+
+/// Whether the extended boot loader partition was added by a generator in strict mode, which
+/// does it once, so that more than one generator does not list its entries twice.
+static STRICT_XBOOTLDR_ADDED: AtomicBool = AtomicBool::new(false);
+
 /// The number of initrd slots set on each BLS entry.
-/// Entries set `initrd-0` through `initrd-7`, and slots without an initrd are empty.
-pub const BLS_INITRD_SLOTS: usize = 8;
+/// Entries set `initrd-0` through `initrd-31`, and slots without an initrd are empty.
+pub const BLS_INITRD_SLOTS: usize = 32;

 // TODO(azenla): remove this once variable substitution is implemented.
 /// This function is used to remove the `tuned_initrd` variable from the initrd paths.
@@ -37,21 +61,94 @@ fn quirk_initrd_remove_tuned(paths: Vec<String>) -> Vec<String> {
 fn sort_entries(a: &(BlsEntry, BootableEntry), b: &(BlsEntry, BootableEntry)) -> Ordering {
    let (a_bls, a_boot) = a;
    let (b_bls, b_boot) = b;
-    sort_bls(a_bls, a_boot.name(), b_bls, b_boot.name())
+    sort_bls(a_bls, a_boot.sort_name(), b_bls, b_boot.sort_name())
 }

-/// Generates entries from the BLS entries directory using the specified `bls` configuration and
-/// `context`. The BLS conversion is best-effort and will ignore any unsupported entries.
-pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Vec<BootableEntry>> {
+/// Produces the bootable entry for the BLS `entry` with the id `name` and the `initrds`.
+fn bootable_entry(
+    context: &Rc<SproutContext>,
+    bls: &BlsConfiguration,
+    name: &str,
+    entry: &BlsEntry,
+    initrds: &[String],
+    entry_root: &str,
+) -> BootableEntry {
+    // Produce a new sprout context for the entry with the extracted values.
+    let mut context = context.fork();
+
+    let title_base = entry.title().unwrap_or_else(|| name.to_string());
+    let chainload = entry.chainload_path().unwrap_or_default();
+    let options = entry.chainload_options().unwrap_or_default();
+    let version = entry.version().unwrap_or_default();
+    let machine_id = entry.machine_id().unwrap_or_default();
+
+    // Combine the title with the version if a version is present, except if it already contains it.
+    // Sometimes BLS will have a version in the title already, and this makes it unique.
+    let title_full = if !version.is_empty() && !title_base.contains(&version) {
+        format!("{} {}", title_base, version)
+    } else {
+        title_base.clone()
+    };
+
+    // The device that the files of the entry are on, for a path like "$entry-root\\$chainload".
+    // It is empty for the partition that Sprout was loaded from.
+    context.set("entry-root", entry_root.to_string());
+    context.set("title-base", title_base);
+    context.set("title", title_full);
+    context.set("chainload", chainload);
+    context.set("options", options);
+    // The command line and kernel version embedded in a unified kernel image.
+    context.set("cmdline", entry.cmdline.clone().unwrap_or_default());
+    context.set("devicetree", entry.devicetree_path().unwrap_or_default());
+    context.set("uname", entry.uname.clone().unwrap_or_default());
+    // The initrd value keeps the last initrd, which is what it held before
+    // multiple initrds were supported.
+    context.set("initrd", initrds.last().cloned().unwrap_or_default());
+
+    // Set every initrd slot, even the unused ones. An unset slot would let "$initrd-1"
+    // match "$initrd" instead, producing the initrd value followed by "-1".
+    for slot in 0..BLS_INITRD_SLOTS {
+        context.set(
+            format!("initrd-{}", slot),
+            initrds.get(slot).cloned().unwrap_or_default(),
+        );
+    }
+
+    context.set("version", version);
+    context.set("machine-id", machine_id);
+
+    // Produce a new bootable entry.
+    let mut boot = BootableEntry::new(
+        name.to_string(),
+        bls.entry.title.clone(),
+        context.freeze(),
+        bls.entry.clone(),
+    );
+
+    // Pin the entry name to prevent prefixing.
+    // This is needed as the bootloader interface requires the name to be
+    // the same as the entry file name, minus the .conf extension.
+    if bls.pin_names {
+        boot.mark_pin_name();
+    }
+
+    boot
+}
+
+/// Generates the BLS Type #1 entries from the entries directory under `path`.
+/// The conversion is best-effort and will ignore any unsupported entries.
+fn generate_type1(
+    context: &Rc<SproutContext>,
+    bls: &BlsConfiguration,
+    path: &str,
+    entry_root: &str,
+) -> Result<Vec<(BlsEntry, BootableEntry)>> {
+    let strict = context.root().options().bls_strict_mode;
    let mut entries = Vec::new();

-    // Stamp the path to the BLS directory.
-    let path = context.stamp(&bls.path);
-
    // Resolve the path to the BLS directory.
-    let bls_resolved =
-        eficore::path::resolve_path(Some(context.root().loaded_image_path()?), &path)
-            .context("unable to resolve bls path")?;
+    let bls_resolved = eficore::path::resolve_path(Some(context.root().loaded_image_path()?), path)
+        .context("unable to resolve bls path")?;

    // Construct a filesystem path to the BLS entries directory.
    let mut entries_path = PathBuf::from(
@@ -93,20 +190,29 @@ pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Ve
        }

        // Get the file name of the filesystem item.
-        let mut name = entry.file_name().to_string();
+        let file_name = entry.file_name().to_string();

-        // Ignore files that are not .conf files.
-        if !name.to_lowercase().ends_with(".conf") {
+        // Ignore hidden files, such as the AppleDouble files that macOS writes, and files that
+        // are not .conf files. Files named just ".conf" are not valid entry files.
+        let Some((stem, extension)) = strip_extension(&file_name, ".conf") else {
+            continue;
+        };
+        if file_name.starts_with('.') || stem.is_empty() {
            continue;
        }
-
-        // Remove the .conf extension.
-        name.truncate(name.len() - 5);
-
-        // Skip over files that are named just ".conf" as they are not valid entry files.
-        if name.is_empty() {
+        // Names that start with auto- are reserved for entries the boot loader makes itself.
+        if is_reserved_entry_name(&file_name) {
            continue;
        }
+        let extension = extension.to_string();
+
+        // Split the boot counter off the file name. The entry id never includes the counter, so
+        // that it stays the same as tries are consumed.
+        let (id, boot_counter) = {
+            let (id, counter) = BootCounter::parse(stem);
+            (id.to_string(), counter)
+        };
+        let name = id;

        // Create a mutable path so we can append the file name to produce the full path.
        let mut full_entry_path = entries_path.to_path_buf();
@@ -133,19 +239,61 @@ pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Ve
        };

        // Parse the entry file as a BLS entry.
-        let entry = match BlsEntry::from_str(&content) {
+        let mut entry = match BlsEntry::from_str(&content) {
            Ok(entry) => entry,
            Err(error) => {
                warn!("unable to parse bls entry {}: {}", name, error);
                continue;
            }
        };
+        entry.boot_counter = boot_counter;

        // Ignore entries that are not valid for Sprout.
        if !entry.is_valid() {
            continue;
        }

+        // Ignore entries that are for another architecture.
+        if !entry.matches_architecture(ARCHITECTURE) {
+            continue;
+        }
+
+        // An entry that names more than one of linux, efi and uki is broken, and systemd-boot
+        // does not show it. Outside of strict mode, the first of them in that order is booted.
+        if entry.mixes_boot_targets() {
+            if strict {
+                warn!(
+                    "hiding bls entry {} as it has more than one of linux, efi and uki",
+                    name
+                );
+                continue;
+            }
+            warn!(
+                "bls entry {} has more than one of linux, efi and uki, which systemd-boot hides; \
+                 using the first of linux, efi and uki (strict mode hides it)",
+                name
+            );
+        }
+
+        // The file that the entry boots has to exist. systemd-boot hides an entry that has
+        // none, while outside of strict mode it is shown and fails when it is booted.
+        if let Some(target) = entry.chainload_path()
+            && let Ok(target_path) = CString16::try_from(format!("\\{}", target).as_str())
+            && let Ok(false) = fs.try_exists(PathBuf::from(target_path))
+        {
+            if strict {
+                warn!(
+                    "hiding bls entry {} as its file '\\{}' does not exist",
+                    name, target
+                );
+                continue;
+            }
+            warn!(
+                "bls entry {} refers to the file '\\{}', which does not exist (strict mode hides it)",
+                name, target
+            );
+        }
+
        // Put the initrds through a quirk modifier to support Fedora.
        let initrds = quirk_initrd_remove_tuned(entry.initrd_paths());

@@ -158,60 +306,271 @@ pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Ve
            continue;
        }

-        // Produce a new sprout context for the entry with the extracted values.
-        let mut context = context.fork();
-
-        let title_base = entry.title().unwrap_or_else(|| name.clone());
-        let chainload = entry.chainload_path().unwrap_or_default();
-        let options = entry.options().unwrap_or_default();
-        let version = entry.version().unwrap_or_default();
-        let machine_id = entry.machine_id().unwrap_or_default();
-
-        // Combine the title with the version if a version is present, except if it already contains it.
-        // Sometimes BLS will have a version in the title already, and this makes it unique.
-        let title_full = if !version.is_empty() && !title_base.contains(&version) {
-            format!("{} {}", title_base, version)
-        } else {
-            title_base.clone()
-        };
-
-        context.set("title-base", title_base);
-        context.set("title", title_full);
-        context.set("chainload", chainload);
-        context.set("options", options);
-        // The initrd value keeps the last initrd, which is what it held before
-        // multiple initrds were supported.
-        context.set("initrd", initrds.last().cloned().unwrap_or_default());
-
-        // Set every initrd slot, even the unused ones. An unset slot would let "$initrd-1"
-        // match "$initrd" instead, producing the initrd value followed by "-1".
-        for slot in 0..BLS_INITRD_SLOTS {
-            context.set(
-                format!("initrd-{}", slot),
-                initrds.get(slot).cloned().unwrap_or_default(),
-            );
+        let mut boot = bootable_entry(context, bls, &name, &entry, &initrds, entry_root);
+        boot.set_id_suffix(&extension);
+        if entry.profile_number() > 0 {
+            boot.mark_extra_profile();
        }

-        context.set("version", version);
-        context.set("machine-id", machine_id);
-
-        // Produce a new bootable entry.
-        let mut boot = BootableEntry::new(
-            name,
-            bls.entry.title.clone(),
-            context.freeze(),
-            bls.entry.clone(),
-        );
-
-        // Pin the entry name to prevent prefixing.
-        // This is needed as the bootloader interface requires the name to be
-        // the same as the entry file name, minus the .conf extension.
-        boot.mark_pin_name();
+        // Record where the boot counter lives so a try can be consumed when this entry boots.
+        // systemd-boot only counts the tries of the entries it boots as a kernel or as a unified
+        // kernel image, and not those of a plain EFI program.
+        let counted = !(strict && entry.linux.is_none() && entry.uki.is_none());
+        if let Some(counter) = boot_counter {
+            boot.set_boot_counter(BootCounterTarget {
+                counter,
+                filesystem: bls_resolved.filesystem_handle,
+                directory: entries_path.clone(),
+                id: name.clone(),
+                file_name,
+                extension,
+                counting: counted,
+            });
+        }

        // Add the BLS entry to the list, along with the bootable entry.
        entries.push((entry, boot));
    }

+    Ok(entries)
+}
+
+/// Generates the BLS Type #2 entries from the unified kernel images in the `uki_path` directory.
+/// An image with the same id as one of the Type #1 `entries` is skipped.
+fn generate_type2(
+    context: &Rc<SproutContext>,
+    bls: &BlsConfiguration,
+    uki_path: &str,
+    entry_root: &str,
+    entries: &[(BlsEntry, BootableEntry)],
+) -> Result<Vec<(BlsEntry, BootableEntry)>> {
+    let resolved = eficore::path::resolve_path(Some(context.root().loaded_image_path()?), uki_path)
+        .context("unable to resolve uki path")?;
+    let directory = resolved
+        .sub_path
+        .to_string16(DisplayOnly(false), AllowShortcuts(false))
+        .context("unable to convert uki path to string")?;
+    let directory_name = directory.to_string();
+
+    let mut found: Vec<(BlsEntry, BootableEntry)> = Vec::new();
+    let strict = context.root().options().bls_strict_mode;
+    for image in uki::scan(resolved.filesystem_handle, &directory_name, strict)? {
+        // Only unified kernel images that are built for this machine are entries.
+        if image.machine != PE_MACHINE {
+            info!(
+                "skipping {} as it is built for another architecture",
+                image.file_name
+            );
+            continue;
+        }
+
+        // The id is the file name without the extension and the boot counter.
+        let file_name = image.file_name;
+        if is_reserved_entry_name(&file_name) {
+            continue;
+        }
+        let Some((stem, extension)) = strip_extension(&file_name, ".efi") else {
+            continue;
+        };
+        let extension = extension.to_string();
+        let (id, boot_counter) = BootCounter::parse(stem);
+        if id.is_empty() {
+            continue;
+        }
+        let id = id.to_string();
+
+        // Every profile of the image is an entry. They share the file, and so the boot counter.
+        let mut suffixes: Vec<String> = Vec::new();
+        for profile in image.profiles {
+            // A profile without an os-release section is not a unified kernel image, such as
+            // other EFI programs.
+            if !profile.has_osrel {
+                info!(
+                    "skipping {} as it has no .osrel section, so it is not a unified kernel image",
+                    file_name
+                );
+                continue;
+            }
+
+            // The first profile has the id of the file, and the others name their profile.
+            // A profile that repeats the identifier of an earlier one is told apart by its number.
+            let index = profile.index.unwrap_or(0);
+            let mut suffix = profile_id_suffix(index, &profile.info);
+            if let Some(ref name) = suffix
+                && suffixes.contains(name)
+            {
+                suffix = Some(index.to_string());
+            }
+            if let Some(ref name) = suffix {
+                suffixes.push(name.clone());
+            }
+            let name = match suffix {
+                Some(ref suffix) => format!("{}@{}", id, suffix),
+                None => id.clone(),
+            };
+
+            // systemd-boot skips an image that has no name, while outside of strict mode the
+            // name of the file is used.
+            if strict && profile.entry.title.is_none() {
+                warn!(
+                    "hiding unified kernel image {} as it has no name in its os-release",
+                    file_name
+                );
+                continue;
+            }
+
+            let mut entry = profile.entry;
+            entry.boot_counter = boot_counter;
+
+            let mut boot = bootable_entry(context, bls, &name, &entry, &[], entry_root);
+            boot.set_id_suffix(&extension);
+            if let Some(ref suffix) = suffix {
+                boot.set_id_profile(suffix);
+            }
+
+            // An image with the same id as another entry, such as a leftover copy with another
+            // boot counter, would be ambiguous. Type 1 and type 2 entries have different ids.
+            if entries
+                .iter()
+                .chain(found.iter())
+                .any(|(_, other)| other.id() == boot.id())
+            {
+                warn!(
+                    "unified kernel image {} has the same id as another entry, skipping",
+                    file_name
+                );
+                continue;
+            }
+
+            if let Some(counter) = boot_counter {
+                boot.set_boot_counter(BootCounterTarget {
+                    counter,
+                    filesystem: resolved.filesystem_handle,
+                    directory: PathBuf::from(directory.clone()),
+                    id: id.clone(),
+                    file_name: file_name.clone(),
+                    extension: extension.clone(),
+                    counting: true,
+                });
+            }
+            found.push((entry, boot));
+        }
+    }
+    Ok(found)
+}
+
+/// Generates the entries of one partition, from the BLS entries directory at `bls_path` and the
+/// unified kernel image directory at `uki_path`, if there is one. The files of the entries are on
+/// the device `entry_root`.
+fn generate_partition(
+    context: &Rc<SproutContext>,
+    bls: &BlsConfiguration,
+    bls_path: &str,
+    uki_path: Option<&str>,
+    entry_root: &str,
+) -> Result<Vec<(BlsEntry, BootableEntry)>> {
+    // A problem reading the Type #1 entries only stops the unified kernel images when there
+    // are none to add, so that either kind of entry can still boot.
+    let mut entries = match generate_type1(context, bls, bls_path, entry_root) {
+        Ok(entries) => entries,
+        Err(error) if uki_path.is_some() => {
+            warn!("unable to generate bls entries: {:#}", error);
+            Vec::new()
+        }
+        Err(error) => return Err(error),
+    };
+
+    // Add the unified kernel images, unless that is disabled. A problem scanning them
+    // should not prevent booting the other entries.
+    if let Some(uki_path) = uki_path {
+        let uki_path = context.stamp(uki_path);
+        match generate_type2(context, bls, &uki_path, entry_root, &entries) {
+            Ok(found) => entries.extend(found),
+            Err(error) => warn!(
+                "unable to generate unified kernel image entries: {:#}",
+                error
+            ),
+        }
+    }
+    Ok(entries)
+}
+
+/// Finds the root of the Extended Boot Loader Partition on the disk that Sprout was loaded from,
+/// as the text of the device with a trailing slash. None if there is no such partition.
+fn xbootldr_root(context: &Rc<SproutContext>) -> Result<Option<String>> {
+    let Some(path) = eficore::xbootldr::find_xbootldr(context.root().loaded_image_path()?)? else {
+        return Ok(None);
+    };
+    let mut root = path
+        .to_string16(DisplayOnly(false), AllowShortcuts(false))
+        .context("unable to convert the xbootldr device path to a string")?
+        .to_string();
+    // Add a trailing forward-slash to the root to ensure the device root is completed.
+    root.push('/');
+    Ok(Some(root))
+}
+
+/// Generates entries from the BLS entries directory and the unified kernel image directory
+/// using the specified `bls` configuration and `context`, and from the Extended Boot Loader
+/// Partition if that is enabled. The BLS conversion is best-effort and will ignore any
+/// unsupported entries.
+pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Vec<BootableEntry>> {
+    // Stamp the path to the BLS directory.
+    let path = context.stamp(&bls.path);
+
+    let uki_path = bls.uki_path_for(&path);
+    // A problem with this partition only stops the generator when there is no other partition.
+    let mut entries = match generate_partition(
+        &context,
+        bls,
+        &path,
+        uki_path.as_deref(),
+        BlsConfiguration::root_of(&path),
+    ) {
+        Ok(entries) => entries,
+        Err(error) if bls.xbootldr || context.root().options().bls_strict_mode => {
+            warn!("unable to generate bls entries: {:#}", error);
+            Vec::new()
+        }
+        Err(error) => return Err(error),
+    };
+
+    // Add the entries of the Extended Boot Loader Partition, which are sorted together with the
+    // others. A problem with it should not prevent booting from the entries that are found.
+    let strict_xbootldr = context.root().options().bls_strict_mode
+        && !STRICT_XBOOTLDR_ADDED.swap(true, AtomicOrdering::Relaxed);
+    if bls.xbootldr || strict_xbootldr {
+        match xbootldr_root(&context) {
+            Ok(Some(root)) => {
+                let xbootldr_uki = uki_path.as_ref().map(|_| format!("{}\\EFI\\Linux", root));
+                match generate_partition(
+                    &context,
+                    bls,
+                    &format!("{}\\loader", root),
+                    xbootldr_uki.as_deref(),
+                    &root,
+                ) {
+                    Ok(found) => {
+                        for (entry, boot) in found {
+                            // An entry that is on both partitions would be ambiguous.
+                            if entries.iter().any(|(_, other)| other.id() == boot.id()) {
+                                warn!(
+                                    "xbootldr entry {} has the same id as another entry, skipping",
+                                    boot.id()
+                                );
+                            } else {
+                                entries.push((entry, boot));
+                            }
+                        }
+                    }
+                    Err(error) => warn!("unable to generate xbootldr entries: {:#}", error),
+                }
+            }
+            Ok(None) => info!("no xbootldr partition was found"),
+            Err(error) => warn!("unable to find the xbootldr partition: {:#}", error),
+        }
+    }
+
    // Sort all the entries according to the BLS sort system.
    entries.sort_by(sort_entries);

@@ -0,0 +1,136 @@
+use alloc::{
+    format,
+    string::{String, ToString},
+    vec::Vec,
+};
+use anyhow::{Context, Result, anyhow, bail};
+use edera_sprout_bls::{
+    BlsEntry, PeImage, ProfileInfo, ReadAt, UKI_SECTIONS, read_pe, strip_extension, uki_profiles,
+};
+use log::warn;
+use uefi::{
+    CString16, Handle, Status,
+    proto::media::file::{File, FileAttribute, FileInfo, FileMode, FileType, RegularFile},
+    proto::media::fs::SimpleFileSystem,
+};
+
+/// A unified kernel image that was found, with the metadata Sprout reads.
+pub struct UkiFile {
+    /// The name of the file, such as `fedora+3.efi`.
+    pub file_name: String,
+    /// The machine type of the image.
+    pub machine: u16,
+    /// The profiles of the image. An image without profiles has one.
+    pub profiles: Vec<UkiProfileEntry>,
+}
+
+/// One profile of a unified kernel image.
+pub struct UkiProfileEntry {
+    /// The number of the profile, or None if the image has no profiles.
+    pub index: Option<u32>,
+    /// The metadata of the profile.
+    pub info: ProfileInfo,
+    /// Whether the profile has an `.osrel` section, which unified kernel images always have.
+    pub has_osrel: bool,
+    /// The entry made from the sections of the profile.
+    pub entry: BlsEntry,
+}
+
+/// Reads a file at arbitrary offsets, so that a large image isn't loaded to read its headers.
+struct FileReader(RegularFile);
+
+impl ReadAt for FileReader {
+    fn read_at(&mut self, offset: u64, buf: &mut [u8]) -> Result<()> {
+        self.0
+            .set_position(offset)
+            .map_err(|error| anyhow!("unable to seek: {}", error))?;
+        let mut done = 0;
+        while done < buf.len() {
+            let read = self
+                .0
+                .read(&mut buf[done..])
+                .map_err(|error| anyhow!("unable to read: {}", error))?;
+            if read == 0 {
+                bail!("unexpected end of file");
+            }
+            done += read;
+        }
+        Ok(())
+    }
+}
+
+/// Finds the `.efi` files in `directory` on `filesystem` and reads their sections.
+/// A missing directory has no images. Files that can't be read as a PE image are skipped,
+/// as one broken file should not prevent booting any of the other entries.
+pub fn scan(filesystem: Handle, directory: &str, strict: bool) -> Result<Vec<UkiFile>> {
+    let mut fs = uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(filesystem)
+        .context("unable to open the unified kernel image filesystem")?;
+    let mut root = fs
+        .open_volume()
+        .context("unable to open the unified kernel image volume")?;
+
+    let name = CString16::try_from(directory).context("invalid unified kernel image path")?;
+    let handle = match root.open(&name, FileMode::Read, FileAttribute::empty()) {
+        Ok(handle) => handle,
+        Err(error) if error.status() == Status::NOT_FOUND => return Ok(Vec::new()),
+        Err(error) => return Err(error).context("unable to open the unified kernel image path"),
+    };
+    let FileType::Dir(mut directory_file) = handle
+        .into_type()
+        .context("unable to inspect the unified kernel image path")?
+    else {
+        bail!("the unified kernel image path is not a directory");
+    };
+
+    // Collect the file names first, as files can't be opened while the directory is read.
+    let mut names = Vec::new();
+    while let Some(info) = directory_file
+        .read_entry_boxed()
+        .context("unable to read the unified kernel image directory")?
+    {
+        let info: &FileInfo = &info;
+        if info.attribute().contains(FileAttribute::DIRECTORY) {
+            continue;
+        }
+        let file_name = info.file_name().to_string();
+        // Hidden files, such as the AppleDouble files that macOS writes, are not images.
+        if !file_name.starts_with('.') && strip_extension(&file_name, ".efi").is_some() {
+            names.push(file_name);
+        }
+    }
+
+    let mut found = Vec::new();
+    for file_name in names {
+        let path = format!("{}\\{}", directory, file_name);
+        match read_image(&mut root, &path) {
+            Ok(image) => found.push(UkiFile {
+                file_name,
+                machine: image.machine,
+                // The sections are dropped here, so only the small entries are kept per image.
+                profiles: uki_profiles(&image.sections)
+                    .into_iter()
+                    .map(|profile| UkiProfileEntry {
+                        index: profile.index,
+                        has_osrel: profile.sections.contains_key(".osrel"),
+                        entry: BlsEntry::from_uki_profile_with(&profile, &path, strict),
+                        info: profile.info,
+                    })
+                    .collect(),
+            }),
+            Err(error) => warn!("unable to read unified kernel image {}: {:#}", path, error),
+        }
+    }
+    Ok(found)
+}
+
+/// Reads the sections of the PE image at `path`.
+fn read_image(root: &mut uefi::proto::media::file::Directory, path: &str) -> Result<PeImage> {
+    let name = CString16::try_from(path).context("invalid path")?;
+    let handle = root
+        .open(&name, FileMode::Read, FileAttribute::empty())
+        .context("unable to open")?;
+    let Some(file) = handle.into_regular_file() else {
+        bail!("not a regular file");
+    };
+    read_pe(&mut FileReader(file), &UKI_SECTIONS)
+}
@@ -20,11 +20,9 @@ pub fn generate(
        context.insert(combination);
        let context = context.freeze();

-        // Stamp the entry title and actions from the template.
-        let mut entry = list.entry.clone();
-
-        // Stamp all the actions this entry references.
-        entry.actions = context.stamp_iter(entry.actions.into_iter()).collect();
+        // The actions are stamped with the final context of the entry when it is booted,
+        // so that variants and the values of the entry can override the values of the generator.
+        let entry = list.entry.clone();

        // Push the entry into the list with the new context.
        entries.push(BootableEntry::new(
@@ -9,20 +9,24 @@ use crate::{
    options::SproutOptions,
    phases::phase,
 };
-use alloc::{collections::BTreeMap, format, string::ToString, vec::Vec};
+use alloc::{
+    collections::{BTreeMap, BTreeSet},
+    format,
+    string::{String, ToString},
+    vec::Vec,
+};
 use anyhow::{Context, Result, bail};
 use core::{ops::Deref, time::Duration};
-use edera_sprout_bls::compare_versions;
-use edera_sprout_config::RootConfiguration;
+use edera_sprout_bls::{LoaderConf, LoaderTimeout, compare_versions};
+use edera_sprout_config::{DEFAULT_MENU_TIMEOUT_SECONDS, RootConfiguration};
 use eficore::{
    bootloader_interface::{BootloaderInterface, BootloaderInterfaceTimeout},
    partition::PartitionGuidForm,
    platform::{timer::PlatformTimer, tpm::PlatformTpm},
-    secure::SecureBoot,
    setup,
 };
 use log::{error, info, warn};
-use uefi::{entry, proto::device_path::LoadedImageDevicePath};
+use uefi::{entry, proto::device_path::LoadedImageDevicePath, runtime::ResetType};
 use uefi_raw::Status;

 /// actions: Code that can be configured and executed by Sprout.
@@ -31,6 +35,9 @@ pub mod actions;
 /// autoconfigure: Autoconfigure Sprout based on the detected environment.
 pub mod autoconfigure;

+/// boot_counter: Consume the boot counter tries of BLS entries.
+pub mod boot_counter;
+
 /// config: Sprout configuration mechanism.
 pub mod config;

@@ -75,13 +82,36 @@ fn advisory<T: Default>(result: Result<T>) -> T {
    })
 }

-/// Run Sprout, returning an error if one occurs.
-fn run() -> Result<()> {
-    // For safety reasons, we will note that Secure Boot is in beta on Sprout.
-    if SecureBoot::enabled().context("unable to determine Secure Boot status")? {
-        warn!("Sprout Secure Boot is in beta. Some functionality may not work as expected.");
+/// Loads the loader.conf of the partition Sprout was loaded from.
+/// A missing loader.conf has no settings.
+fn load_loader_conf(context: &SproutContext) -> Result<LoaderConf> {
+    let Ok(content) = eficore::path::read_file_contents(
+        Some(context.root().loaded_image_path()?),
+        "\\loader\\loader.conf",
+    ) else {
+        return Ok(LoaderConf::default());
+    };
+
+    // Measure the loader.conf into the TPM, as it changes how Sprout boots.
+    // A failure to measure is only a warning, as it was not Sprout's own configuration.
+    if let Err(error) = PlatformTpm::log_event(
+        PlatformTpm::PCR_BOOT_LOADER_CONFIG,
+        &content,
+        "sprout: loader.conf",
+    ) {
+        warn!(
+            "unable to measure the loader.conf file into the TPM: {:#}",
+            error
+        );
    }

+    // Read what is valid, as a stray byte should not discard the whole file.
+    let content = String::from_utf8_lossy(&content);
+    Ok(LoaderConf::parse(&content))
+}
+
+/// Run Sprout, returning an error if one occurs.
+fn run(reboot_on_error: &mut bool) -> Result<()> {
    // Start the platform timer.
    let timer = PlatformTimer::start();

@@ -163,6 +193,13 @@ fn run() -> Result<()> {
            .context("unable to set loader path in bootloader interface"),
    );

+    // Strict mode can be asked for on the command line or in the configuration.
+    let mut options = options;
+    options.bls_strict_mode |= config.options.bls_strict_mode;
+    if options.bls_strict_mode {
+        info!("BLS strict mode is enabled");
+    }
+
    // Create the root context.
    let mut root = RootContext::new(loaded_image_path, timer, options);

@@ -187,7 +224,12 @@ fn run() -> Result<()> {
    // If --autoconfigure is specified or the loaded configuration has autoconfigure enabled,
    // trigger the autoconfiguration mechanism.
    if context.root().options().autoconfigure || config.options.autoconfigure {
-        autoconfigure::autoconfigure(&mut config).context("unable to autoconfigure")?;
+        autoconfigure::autoconfigure(
+            &mut config,
+            context.root().options().bls_strict_mode,
+            context.root().loaded_image_path()?,
+        )
+        .context("unable to autoconfigure")?;
    }

    // Unload the context so that it can be modified.
@@ -245,18 +287,21 @@ fn run() -> Result<()> {
    for (name, generator) in config.generators {
        let context = context.fork().freeze();

-        // We will prefix all entries with [name]-, provided the name is not pinned.
-        let prefix = format!("{}-", name);
-
        // Add all the entries generated by the generator to the entry list.
        // The generator specifies the context associated with the entry.
-        for mut entry in generators::generate(context.clone(), &generator)? {
-            // If the entry name is not pinned, prepend the name prefix.
-            if !entry.is_pin_name() {
-                entry.prepend_name_prefix(&prefix);
-            }
+        entries.extend(generators::generate(&name, context, &generator)?);
+    }

-            entries.push(entry);
+    // Entry names are used to select entries, so duplicates make the selection ambiguous.
+    // This can happen when two generators pin names, like two BLS generators reading the
+    // same BLS directory.
+    let mut seen_names = BTreeSet::new();
+    for entry in &entries {
+        if !seen_names.insert(entry.name()) {
+            warn!(
+                "more than one entry is named {}, selecting it by name is ambiguous",
+                entry.name()
+            );
        }
    }

@@ -284,14 +329,6 @@ fn run() -> Result<()> {
        entry.restamp_title();
        entry.restamp_sort_key();

-        // Mark this entry as the default entry if it is declared as such.
-        if let Some(ref default_entry) = config.options.default_entry {
-            // If the entry matches the default entry, mark it as the default entry.
-            if entry.is_match(default_entry) {
-                entry.mark_default();
-            }
-        }
-
        true
    });

@@ -301,13 +338,19 @@ fn run() -> Result<()> {

    // Tell the bootloader interface what entries are available.
    advisory(
-        BootloaderInterface::set_entries(entries.iter().map(|entry| entry.name()))
+        BootloaderInterface::set_entries(entries.iter().map(|entry| entry.id()))
            .context("unable to set entries in bootloader interface"),
    );

-    // Acquire the timeout setting from the bootloader interface.
-    let bootloader_interface_timeout = advisory(
-        BootloaderInterface::get_timeout().context("unable to get bootloader interface timeout"),
+    // Load the loader.conf of the partition Sprout was loaded from.
+    let loader_conf = load_loader_conf(&context).context("unable to load loader.conf")?;
+    for warning in &loader_conf.warnings {
+        warn!("{}", warning);
+    }
+
+    // Acquire the timeouts from the bootloader interface.
+    let bootloader_interface_timeouts = advisory(
+        BootloaderInterface::get_timeouts().context("unable to get bootloader interface timeouts"),
    );

    // Acquire the default entry from the bootloader interface.
@@ -316,6 +359,21 @@ fn run() -> Result<()> {
            .context("unable to get bootloader interface default entry"),
    );

+    // Acquire the preferred entry from the bootloader interface.
+    let bootloader_interface_preferred_entry = advisory(
+        BootloaderInterface::get_preferred_entry()
+            .context("unable to get bootloader interface preferred entry"),
+    );
+
+    // Acquire the entry that was saved by the previous boot.
+    let mut last_booted_entry = advisory(
+        BootloaderInterface::get_last_booted_entry()
+            .context("unable to get last booted entry from bootloader interface"),
+    );
+
+    // Whether to follow the specification and systemd-boot exactly.
+    let strict = context.root().options().bls_strict_mode;
+
    // Acquire the oneshot entry from the bootloader interface.
    let bootloader_interface_oneshot_entry = advisory(
        BootloaderInterface::get_oneshot_entry()
@@ -323,23 +381,55 @@ fn run() -> Result<()> {
    );

    // If --boot is specified, boot that entry immediately.
-    let mut force_boot_entry = context.root().options().boot.clone();
+    let force_boot_entry = context.root().options().boot.clone();
    // If --force-menu is specified, show the boot menu regardless of the value of --boot.
    let mut force_boot_menu = context.root().options().force_menu;

-    // Determine the menu timeout in seconds based on the options or configuration.
-    // We prefer the options over the configuration to allow for overriding.
-    let mut menu_timeout = context
-        .root()
-        .options()
-        .menu_timeout
-        .unwrap_or(config.options.menu_timeout);
+    // Pick the menu timeout from the first source that specifies one, in this order:
+    // the one-shot timeout, --menu-timeout, LoaderConfigTimeout, the configuration, loader.conf.
+    // The bootloader interface is what tools like bootctl set, so it outranks the configuration.
+    let seconds = |seconds: Option<u64>| {
+        seconds.map_or(
+            BootloaderInterfaceTimeout::Unspecified,
+            BootloaderInterfaceTimeout::Timeout,
+        )
+    };
+    let loader_conf_timeout = match loader_conf.timeout {
+        None => BootloaderInterfaceTimeout::Unspecified,
+        Some(LoaderTimeout::Seconds(0)) | Some(LoaderTimeout::Hidden) => {
+            BootloaderInterfaceTimeout::MenuHidden
+        }
+        Some(LoaderTimeout::Seconds(timeout)) => BootloaderInterfaceTimeout::Timeout(timeout),
+        Some(LoaderTimeout::Disabled) => BootloaderInterfaceTimeout::MenuDisabled,
+        Some(LoaderTimeout::Force) => BootloaderInterfaceTimeout::MenuForce,
+    };
+    let timeout = [
+        bootloader_interface_timeouts.oneshot,
+        seconds(context.root().options().menu_timeout),
+        bootloader_interface_timeouts.direct,
+        seconds(config.options.menu_timeout),
+        loader_conf_timeout,
+    ]
+    .into_iter()
+    .find(|timeout| !matches!(timeout, BootloaderInterfaceTimeout::Unspecified))
+    .unwrap_or_default();
+
+    // The menu timeout in seconds, if no source specified one. systemd-boot does not show the
+    // menu by default, while outside of strict mode it is shown for a while.
+    let mut menu_timeout = if strict {
+        0
+    } else {
+        DEFAULT_MENU_TIMEOUT_SECONDS
+    };

    // Whether the boot menu should wait for the user, instead of counting down.
    let mut wait_for_user = false;

-    // Apply bootloader interface timeout settings.
-    match bootloader_interface_timeout {
+    // Whether the menu is disabled, so that a key press can't bring it up.
+    let mut menu_disabled = false;
+
+    // Apply the chosen timeout.
+    match timeout {
        BootloaderInterfaceTimeout::MenuForce => {
            // Force the boot menu, and wait for the user to choose an entry.
            force_boot_menu = true;
@@ -352,116 +442,346 @@ fn run() -> Result<()> {
            menu_timeout = timeout;
        }

-        BootloaderInterfaceTimeout::MenuHidden | BootloaderInterfaceTimeout::MenuDisabled => {
+        BootloaderInterfaceTimeout::MenuHidden => {
            // Hide the boot menu by setting the timeout to zero.
            menu_timeout = 0;
        }

+        BootloaderInterfaceTimeout::MenuDisabled => {
+            // Hide the boot menu, and don't let a key press show it.
+            menu_timeout = 0;
+            menu_disabled = true;
+        }
+
        BootloaderInterfaceTimeout::Timeout(timeout) => {
            // Configure the timeout to the specified value.
            menu_timeout = timeout;
        }

        BootloaderInterfaceTimeout::Unspecified => {
-            // Do nothing.
+            if !strict {
+                info!(
+                    "no menu timeout is set, so the menu is shown for {} seconds \
+                     (systemd-boot and strict mode do not show it)",
+                    DEFAULT_MENU_TIMEOUT_SECONDS
+                );
+            }
        }
    }

-    // Apply bootloader interface default entry settings.
-    if let Some(ref bootloader_interface_default_entry) = bootloader_interface_default_entry {
+    // Whether the default entry is saved on every boot, which is what `@saved` asks for.
+    // The saved entry is selected by `@saved` from the bootloader interface, or from loader.conf
+    // when the bootloader interface does not set an entry.
+    let is_saved = |value: &Option<String>| {
+        value
+            .as_deref()
+            .is_some_and(|v| v.eq_ignore_ascii_case("@saved"))
+    };
+    let use_saved_entry = is_saved(&bootloader_interface_default_entry)
+        || (bootloader_interface_default_entry.is_none() && is_saved(&loader_conf.default));
+
+    // Turns the value of an entry setting into a pattern. `@saved` is the entry that was saved
+    // by the previous boot, and any other value that starts with `@` is not supported.
+    let entry_pattern = |value: Option<String>| -> Option<String> {
+        let value = value?;
+        if value.eq_ignore_ascii_case("@saved") {
+            return last_booted_entry.clone();
+        }
+        if value.starts_with('@') {
+            warn!("ignoring unsupported entry setting '{}'", value);
+            return None;
+        }
+        Some(value)
+    };
+
+    // Pick the default entry from the first source that matches an entry, where the bootloader
+    // interface, which is what tools like bootctl set, outranks the configuration. A source that matches
+    // no entry, such as when the entry was removed, is ignored so that the next source is used.
+    // The preferred entry sources never use an entry with no boot counter tries left.
+    // Each source has whether it matches by id, and whether it skips bad entries.
+    // In strict mode, the one-shot entry is the default entry for this boot, like in
+    // systemd-boot, and the menu or its timeout still decides what is booted. This also holds
+    // when the menu is forced, as the one-shot entry is then not booted at once.
+    let oneshot_source = if strict || force_boot_menu {
+        bootloader_interface_oneshot_entry.clone()
+    } else {
+        None
+    };
+    for (source, value, by_id, skip_bad) in [
+        ("bootloader interface one-shot", oneshot_source, true, false),
+        (
+            "bootloader interface preferred",
+            bootloader_interface_preferred_entry.clone(),
+            true,
+            true,
+        ),
+        (
+            "loader.conf preferred",
+            loader_conf.preferred.clone(),
+            true,
+            true,
+        ),
+        (
+            "bootloader interface default",
+            bootloader_interface_default_entry.clone(),
+            true,
+            false,
+        ),
+        (
+            "configuration",
+            config.options.default_entry.clone(),
+            false,
+            false,
+        ),
+        (
+            "loader.conf default",
+            loader_conf.default.clone(),
+            true,
+            false,
+        ),
+    ] {
+        // The configuration is a pattern as it is. The other sources can be `@saved`.
+        let pattern = if by_id { entry_pattern(value) } else { value };
+        let Some(pattern) = pattern else {
+            continue;
+        };
+        let pattern_matches = |entry: &BootableEntry| {
+            if by_id {
+                entry.is_match_id(&pattern)
+            } else {
+                entry.is_match(&pattern)
+            }
+        };
+        let matches =
+            |entry: &BootableEntry| pattern_matches(entry) && !(skip_bad && entry.is_bad());
+        // A source that only matches entries with no boot counter tries left is skipped while
+        // another source could pick a usable entry, unless every entry is bad. systemd-boot
+        // does not look at the tries for the default entry, so strict mode does not either.
+        let any_usable = entries.iter().any(|entry| !entry.is_bad());
        if entries
            .iter()
-            .any(|entry| entry.is_match(bootloader_interface_default_entry))
+            .any(|entry| matches(entry) && (strict || !any_usable || !entry.is_bad()))
        {
-            // Iterate over all the entries and mark the default entry as the one specified.
+            // Mark the matching entries as the default and unmark all the others.
            for entry in &mut entries {
-                // Mark the entry as the default entry if it matches the specified entry.
-                // If the entry does not match the specified entry, unmark it as the default entry.
-                if entry.is_match(bootloader_interface_default_entry) {
+                if matches(entry) {
                    entry.mark_default();
                } else {
                    entry.unmark_default();
                }
            }
-        } else {
-            // If no entry matches, such as when the entry was removed, the setting is ignored
-            // so that the configured default entry is still used.
+            break;
+        }
+        if !skip_bad
+            && entries
+                .iter()
+                .any(|entry| pattern_matches(entry) && entry.is_bad())
+        {
            warn!(
-                "ignoring bootloader interface default entry '{}': no matching entry",
-                bootloader_interface_default_entry
+                "the {} entry '{}' has no boot counter tries left, so it is not the default \
+                 (systemd-boot and strict mode use it)",
+                source, pattern
            );
+            continue;
+        }
+        warn!("ignoring {} entry '{}': no matching entry", source, pattern);
+    }
+
+    // Entries that have no boot counter tries left are never picked automatically.
+    // If no entries are the default, pick the first usable entry as the default entry.
+    let default_flags = edera_sprout_bls::resolve_default_flags(
+        &entries
+            .iter()
+            .map(|entry| {
+                // In strict mode, an entry that was asked for stays the default even without tries.
+                let bad = entry.is_bad() && !(strict && entry.is_default());
+                (entry.is_default(), bad, entry.is_extra_profile())
+            })
+            .collect::<Vec<_>>(),
+    );
+    for (entry, default) in entries.iter_mut().zip(default_flags) {
+        if default {
+            entry.mark_default();
+        } else {
+            entry.unmark_default();
        }
    }

-    // Apply bootloader interface oneshot entry settings.
-    // If set, we will force booting the oneshot entry.
-    if let Some(ref bootloader_interface_oneshot_entry) = bootloader_interface_oneshot_entry {
-        force_boot_entry = Some(bootloader_interface_oneshot_entry.clone());
-    }
+    loop {
+        // Convert the menu timeout to a duration.
+        // A zero timeout boots without showing the menu, so a forced menu with a zero timeout
+        // waits for the user instead.
+        let menu_timeout = if wait_for_user || (force_boot_menu && menu_timeout == 0) {
+            None
+        } else {
+            Some(Duration::from_secs(menu_timeout))
+        };

-    // If no entries were the default, pick the first entry as the default entry.
-    if entries.iter().all(|entry| !entry.is_default())
-        && let Some(entry) = entries.first_mut()
-    {
-        entry.mark_default();
-    }
+        // Determine the menu style based on the options or configuration.
+        // We prefer the options over the configuration to allow for overriding.
+        let menu_style = context
+            .root()
+            .options()
+            .menu_style
+            .unwrap_or(config.options.menu_style);

-    // Convert the menu timeout to a duration.
-    // A zero timeout boots without showing the menu, so a forced menu with a zero timeout
-    // waits for the user instead.
-    let menu_timeout = if wait_for_user || (force_boot_menu && menu_timeout == 0) {
-        None
-    } else {
-        Some(Duration::from_secs(menu_timeout))
-    };
+        // The settings of the graphical menu, which only uses the mouse when it is enabled.
+        let graphical = &config.menu_styles.graphical;

-    // Determine the menu style based on the options or configuration.
-    // We prefer the options over the configuration to allow for overriding.
-    let menu_style = context
-        .root()
-        .options()
-        .menu_style
-        .unwrap_or(config.options.menu_style);
-
-    // Find the forced boot entry, unless the boot menu is forced.
-    // If the forced boot entry can't be found, such as when it was removed,
-    // the boot menu is used instead.
-    let forced_entry = force_boot_entry
-        .as_ref()
-        .filter(|_| !force_boot_menu)
-        .and_then(|force_boot_entry| {
-            let entry = BootableEntry::find(force_boot_entry, entries.iter());
-            if entry.is_none() {
-                warn!(
-                    "unable to find entry '{}', using the boot menu",
-                    force_boot_entry
-                );
+        // Find the forced boot entry, unless the boot menu is forced.
+        // The oneshot entry from the bootloader interface is forced by id, and it is used instead of
+        // --boot. If the forced boot entry can't be found, such as when it was removed,
+        // the boot menu is used instead.
+        let forced_entry = if force_boot_menu {
+            None
+        } else if !strict && let Some(ref oneshot) = bootloader_interface_oneshot_entry {
+            let entry = BootableEntry::find_id(oneshot, entries.iter());
+            match entry {
+                Some(entry) => info!(
+                    "booting the one-shot entry {} without showing the menu \
+                     (systemd-boot and strict mode only make it the default)",
+                    entry.id()
+                ),
+                None => warn!("unable to find entry '{}', using the boot menu", oneshot),
            }
            entry
-        });
+        } else {
+            force_boot_entry.as_ref().and_then(|force_boot_entry| {
+                let entry = BootableEntry::find(force_boot_entry, entries.iter());
+                if entry.is_none() {
+                    warn!(
+                        "unable to find entry '{}', using the boot menu",
+                        force_boot_entry
+                    );
+                }
+                entry
+            })
+        };

-    // Use the forced boot entry if possible, otherwise pick an entry using a boot menu.
-    let entry = match forced_entry {
-        Some(entry) => entry,
-        // Delegate to the menu to select an entry to boot.
-        None => menu::select(&timer, menu_timeout, menu_style, &entries)
+        // Use the forced boot entry if possible, otherwise pick an entry using a boot menu.
+        let entry = match forced_entry {
+            Some(entry) => entry,
+            // Delegate to the menu to select an entry to boot.
+            None => menu::select(
+                &timer,
+                menu_timeout,
+                menu_disabled,
+                menu_style,
+                graphical,
+                &entries,
+            )
            .context("unable to select entry via boot menu")?,
-    };
+        };

-    // Tell the bootloader interface what the selected entry is.
-    advisory(
-        BootloaderInterface::set_selected_entry(entry.name().to_string())
-            .context("unable to set selected entry in bootloader interface"),
-    );
+        // Tell the bootloader interface what the selected entry is.
+        advisory(
+            BootloaderInterface::set_selected_entry(entry.id())
+                .context("unable to set selected entry in bootloader interface"),
+        );

-    // Execute the late phase, now that the entry is chosen but before its actions are executed.
-    phase(context.clone(), &config.phases.late).context("unable to execute late phase")?;
+        // Save the selected entry for the next boot when `@saved` asks for it, and forget a saved
+        // entry that is no longer used. A forced boot, such as a one-shot entry, changes nothing,
+        // and neither does an unchanged value.
+        let oneshot_selected = strict
+            && bootloader_interface_oneshot_entry
+                .as_deref()
+                .is_some_and(|oneshot| entry.is_match_id(oneshot));
+        if forced_entry.is_none() && !oneshot_selected {
+            let id = entry.id();
+            if use_saved_entry {
+                if !last_booted_entry
+                    .as_deref()
+                    .is_some_and(|saved| saved.eq_ignore_ascii_case(&id))
+                {
+                    advisory(
+                        BootloaderInterface::set_last_booted_entry(&id)
+                            .context("unable to save last booted entry in bootloader interface"),
+                    );
+                    last_booted_entry = Some(id.clone());
+                }
+            } else if last_booted_entry.is_some() {
+                advisory(
+                    BootloaderInterface::remove_last_booted_entry()
+                        .context("unable to remove last booted entry in bootloader interface"),
+                );
+                last_booted_entry = None;
+            }
+        }

-    // Execute all the actions for the selected entry.
-    for action in &entry.declaration().actions {
-        let action = entry.context().stamp(action);
-        actions::execute(entry.context().clone(), &action)
-            .context(format!("unable to execute action '{}'", action))?;
+        // Execute the late phase, now that the entry is chosen but before its actions are executed.
+        phase(context.clone(), &config.phases.late).context("unable to execute late phase")?;
+
+        // Consume a try from the boot counter of the selected entry.
+        // Failing to do so must not prevent the entry from booting.
+        // An entry with no tries left, which was picked by hand, is counted too, so that it can
+        // still be marked as good.
+        // The tries that were left before this boot used one up, if it did.
+        let mut consumed_tries_left = None;
+        let mut entry_context = entry.context();
+        if let Some(target) = entry.boot_counter()
+            && target.counting
+        {
+            match target.consume() {
+                Ok(path) => {
+                    info!("updated boot counter of entry {}: {}", entry.name(), path);
+                    consumed_tries_left = Some(target.counter.tries_left);
+                    // A unified kernel image is the entry file itself, so it has to be booted by
+                    // its new name.
+                    if let Some(chainload) = entry_context.get("chainload")
+                        && let Some(directory) = chainload.len().checked_sub(target.file_name.len())
+                        && chainload
+                            .get(directory..)
+                            .is_some_and(|name| name.eq_ignore_ascii_case(&target.file_name))
+                        && let Some(renamed) =
+                            path.to_string().rsplit('\\').next().map(String::from)
+                    {
+                        let renamed = format!("{}{}", &chainload[..directory], renamed);
+                        let mut context = entry_context.fork();
+                        context.set("chainload", renamed);
+                        entry_context = context.freeze();
+                    }
+                    // Tell the system where the counter is, so it can mark the boot as good.
+                    let path = edera_sprout_bls::boot_path(&path.to_string());
+                    advisory(
+                        BootloaderInterface::set_boot_count_path(&path)
+                            .context("unable to set boot count path in bootloader interface"),
+                    );
+                }
+                Err(error) => warn!(
+                    "unable to update boot counter of entry {}: {:#}",
+                    entry.name(),
+                    error
+                ),
+            }
+        }
+
+        // Decide whether a failure to start the entry reboots the machine. This is only decided now,
+        // as an earlier failure did not use up a try, so a reboot would not make any progress.
+        *reboot_on_error = loader_conf
+            .reboot_on_error
+            .should_reboot(consumed_tries_left);
+
+        // Execute all the actions for the selected entry.
+        for action in &entry.declaration().actions {
+            let action = entry_context.stamp(action);
+            actions::execute(entry_context.clone(), &action)
+                .context(format!("unable to execute action '{}'", action))?;
+        }
+
+        // Once the image returns, which is not usual, systemd-boot shows the menu again and waits,
+        // while outside of strict mode Sprout goes on to exit to the firmware.
+        if strict {
+            info!("the boot entry returned, showing the menu again");
+            force_boot_menu = true;
+            wait_for_user = true;
+            menu_disabled = false;
+            continue;
+        }
+        info!(
+            "the boot entry returned, so Sprout exits to the firmware \
+             (systemd-boot and strict mode show the menu again)"
+        );
+        break;
    }

    Ok(())
@@ -483,15 +803,28 @@ fn efi_main() -> Status {
    }

    // Run Sprout, then handle the error.
-    let result = run();
+    let mut reboot_on_error = false;
+    let result = run(&mut reboot_on_error);
    if let Err(ref error) = result {
        // Print an error trace.
        error!("sprout encountered an error: {}", error);
        for (index, stack) in error.chain().enumerate() {
            error!("[{}]: {}", index, stack);
        }
-        // Sleep to allow the user to read the error.
+        // Sleep to allow the user to read the error. A reboot is announced first, so it is
+        // known why the machine is about to reset.
+        if reboot_on_error {
+            error!(
+                "rebooting in {} seconds after a failure to start the boot entry",
+                DELAY_ON_ERROR.as_secs()
+            );
+        }
        uefi::boot::stall(DELAY_ON_ERROR);
+
+        // Reboot when asked to, so that the next boot can use the next try or entry.
+        if reboot_on_error {
+            uefi::runtime::reset(ResetType::COLD, Status::SUCCESS, None);
+        }
        return Status::ABORTED;
    }

@@ -1,13 +1,16 @@
 use crate::entries::BootableEntry;
 use crate::menu::basic::BasicMenu;
+use crate::menu::graphical::GraphicalMenu;
 use crate::menu::simple::SimpleMenu;
 use alloc::vec;
+use alloc::vec::Vec;
 use anyhow::{Context, Result};
 use core::time::Duration;
-use edera_sprout_config::MenuStyle;
+use edera_sprout_config::{GraphicalMenuConfiguration, MenuStyle};
 use eficore::bootloader_interface::BootloaderInterface;
 use eficore::platform::timer::PlatformTimer;
 use log::warn;
+use uefi::Event;
 use uefi::ResultExt;
 use uefi::boot::TimerTrigger;
 use uefi::proto::console::text::{Input, Key};
@@ -16,9 +19,21 @@ use uefi_raw::table::boot::{EventType, Tpl};
 /// basic: A menu that prints the entries and selects them by number.
 pub mod basic;

+/// font: The bitmap font that the graphical menu draws text with.
+mod font;
+
+/// graphical: A menu drawn on the graphics output that is used with the keyboard, or the mouse if enabled.
+pub mod graphical;
+
+/// logo: The Sprout logo that the graphical menu draws in a corner.
+mod logo;
+
 /// simple: A full-screen menu that selects entries with the arrow keys.
 pub mod simple;

+/// How long a hidden menu waits for a key press before the default entry is booted.
+const HIDDEN_MENU_KEY_WAIT: Duration = Duration::from_millis(100);
+
 /// The longest duration a single timer is set for. This is well within the range of
 /// the 100ns units that timers are set in, and still over a century long.
 const MAX_TIMER_DURATION: Duration = Duration::from_secs(u32::MAX as u64);
@@ -108,14 +123,77 @@ pub fn read_key(input: &mut Input, timeout: Option<Duration>) -> Result<Option<K
    result
 }

+/// Wait until one of `events` is signaled, giving up once `timeout` passes.
+/// If `timeout` is [None], this waits for an event indefinitely.
+/// Returns the index of the event that was signaled, or [None] if the timeout passed.
+pub fn wait_for_events(events: &[Event], timeout: Option<Duration>) -> Result<Option<usize>> {
+    // Timer event for timeout.
+    // SAFETY: The timer event creation allocated a timer pointer on the UEFI heap.
+    // This is validated safe as long as we are in boot services.
+    let timer_event = unsafe {
+        uefi::boot::create_event_ex(EventType::TIMER, Tpl::CALLBACK, None, None, None)
+            .context("unable to create timer event")?
+    };
+
+    // The timer is the last event so the indexes of the events that were passed are kept.
+    // The events are only borrowed, so the timer is the only one that is closed.
+    // SAFETY: The cloned event is only used to wait, and is not closed.
+    let mut all: Vec<Event> = events
+        .iter()
+        .map(|event| unsafe { event.unsafe_clone() })
+        .collect();
+    all.push(unsafe { timer_event.unsafe_clone() });
+
+    let result = (|| {
+        // Without a timeout, the timer is never set, so it never triggers.
+        if let Some(timeout) = timeout {
+            let trigger = TimerTrigger::Relative(timeout.min(MAX_TIMER_DURATION));
+            uefi::boot::set_timer(&timer_event, trigger).context("unable to set timeout timer")?;
+        }
+
+        let index = uefi::boot::wait_for_event(&all)
+            .discard_errdata()
+            .context("unable to wait for event")?;
+        Ok((index != events.len()).then_some(index))
+    })();
+
+    // Close the timer event that we acquired, without masking an error from waiting.
+    if let Err(error) = uefi::boot::close_event(timer_event) {
+        if result.is_err() {
+            warn!("unable to close timer event: {}", error);
+        } else {
+            return Err(error).context("unable to close timer event");
+        }
+    }
+
+    result
+}
+
 /// Shows a boot menu of the specified `style` to select a bootable entry to boot.
-/// See [BootMenu::select] for how `timeout` is handled.
+/// See [BootMenu::select] for how `timeout` is handled. A zero `timeout` hides the menu, but
+/// the menu is still shown if a key is pressed right away, unless `menu_disabled` is set.
 pub fn select<'live>(
    timer: &'live PlatformTimer,
    timeout: Option<Duration>,
+    menu_disabled: bool,
    style: MenuStyle,
+    graphical: &GraphicalMenuConfiguration,
    entries: &'live [BootableEntry],
 ) -> Result<&'live BootableEntry> {
+    // A hidden menu gives the user a moment to ask for the menu with a key press.
+    let timeout = if timeout.is_some_and(|timeout| timeout.is_zero()) && !menu_disabled {
+        match uefi::system::with_stdin(|input| read_key(input, Some(HIDDEN_MENU_KEY_WAIT))) {
+            Ok(Some(_)) => None,
+            Ok(None) => timeout,
+            Err(error) => {
+                warn!("unable to check for a key press: {:#}", error);
+                timeout
+            }
+        }
+    } else {
+        timeout
+    };
+
    // Notify the bootloader interface that we are about to display the menu.
    // This is only informational, so it should not prevent booting.
    if let Err(error) = BootloaderInterface::mark_menu(timer) {
@@ -129,14 +207,36 @@ pub fn select<'live>(
    match style {
        MenuStyle::Basic => BasicMenu.select(timeout, entries),

-        // The simple menu needs a console that can move the cursor and set colors, which
-        // not every console supports. If it fails, the basic menu is used instead.
-        MenuStyle::Simple => SimpleMenu.select(timeout, entries).or_else(|error| {
+        // The graphical menu needs a graphics output, which not every machine has.
+        // If it fails, the simple menu is used instead, which falls back to the basic menu.
+        MenuStyle::Graphical => GraphicalMenu {
+            enable_mouse: graphical.enable_mouse,
+            enable_logo: graphical.enable_logo,
+            enable_animation: graphical.enable_animation,
+        }
+        .select(timeout, entries)
+        .or_else(|error| {
            warn!(
-                "unable to show the simple boot menu, using the basic menu: {:#}",
+                "unable to show the graphical boot menu, using the simple menu: {:#}",
                error
            );
-            BasicMenu.select(timeout, entries)
+            select_simple(timeout, entries)
        }),
+
+        // The simple menu needs a console that can move the cursor and set colors, which
+        // not every console supports. If it fails, the basic menu is used instead.
+        MenuStyle::Simple => select_simple(timeout, entries),
    }
 }
+
+/// Shows the simple boot menu, or the basic boot menu if the console does not support it.
+/// See [BootMenu::select] for how `timeout` is handled.
+fn select_simple(timeout: Option<Duration>, entries: &[BootableEntry]) -> Result<&BootableEntry> {
+    SimpleMenu.select(timeout, entries).or_else(|error| {
+        warn!(
+            "unable to show the simple boot menu, using the basic menu: {:#}",
+            error
+        );
+        BasicMenu.select(timeout, entries)
+    })
+}
@@ -0,0 +1,118 @@
+/// The width and height of a glyph in pixels.
+pub const GLYPH_SIZE: usize = 8;
+
+/// A glyph as eight rows from top to bottom, where the lowest bit of a row is its leftmost pixel.
+pub type Glyph = [u8; GLYPH_SIZE];
+
+/// Three dots, which are drawn where a title is cut off.
+pub const ELLIPSIS: Glyph = [0x00, 0x00, 0x00, 0x00, 0x00, 0xDB, 0xDB, 0x00];
+
+/// The glyphs for the printable ASCII characters from space to tilde.
+/// This is the public domain 8x8 font that is commonly used by hobby operating systems.
+const GLYPHS: [Glyph; 95] = [
+    [0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00],
+    [0x18, 0x3C, 0x3C, 0x18, 0x18, 0x00, 0x18, 0x00],
+    [0x36, 0x36, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00],
+    [0x36, 0x36, 0x7F, 0x36, 0x7F, 0x36, 0x36, 0x00],
+    [0x0C, 0x3E, 0x03, 0x1E, 0x30, 0x1F, 0x0C, 0x00],
+    [0x00, 0x63, 0x33, 0x18, 0x0C, 0x66, 0x63, 0x00],
+    [0x1C, 0x36, 0x1C, 0x6E, 0x3B, 0x33, 0x6E, 0x00],
+    [0x06, 0x06, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00],
+    [0x18, 0x0C, 0x06, 0x06, 0x06, 0x0C, 0x18, 0x00],
+    [0x06, 0x0C, 0x18, 0x18, 0x18, 0x0C, 0x06, 0x00],
+    [0x00, 0x66, 0x3C, 0xFF, 0x3C, 0x66, 0x00, 0x00],
+    [0x00, 0x0C, 0x0C, 0x3F, 0x0C, 0x0C, 0x00, 0x00],
+    [0x00, 0x00, 0x00, 0x00, 0x00, 0x0C, 0x0C, 0x06],
+    [0x00, 0x00, 0x00, 0x3F, 0x00, 0x00, 0x00, 0x00],
+    [0x00, 0x00, 0x00, 0x00, 0x00, 0x0C, 0x0C, 0x00],
+    [0x60, 0x30, 0x18, 0x0C, 0x06, 0x03, 0x01, 0x00],
+    [0x3E, 0x63, 0x73, 0x7B, 0x6F, 0x67, 0x3E, 0x00],
+    [0x0C, 0x0E, 0x0C, 0x0C, 0x0C, 0x0C, 0x3F, 0x00],
+    [0x1E, 0x33, 0x30, 0x1C, 0x06, 0x33, 0x3F, 0x00],
+    [0x1E, 0x33, 0x30, 0x1C, 0x30, 0x33, 0x1E, 0x00],
+    [0x38, 0x3C, 0x36, 0x33, 0x7F, 0x30, 0x78, 0x00],
+    [0x3F, 0x03, 0x1F, 0x30, 0x30, 0x33, 0x1E, 0x00],
+    [0x1C, 0x06, 0x03, 0x1F, 0x33, 0x33, 0x1E, 0x00],
+    [0x3F, 0x33, 0x30, 0x18, 0x0C, 0x0C, 0x0C, 0x00],
+    [0x1E, 0x33, 0x33, 0x1E, 0x33, 0x33, 0x1E, 0x00],
+    [0x1E, 0x33, 0x33, 0x3E, 0x30, 0x18, 0x0E, 0x00],
+    [0x00, 0x0C, 0x0C, 0x00, 0x00, 0x0C, 0x0C, 0x00],
+    [0x00, 0x0C, 0x0C, 0x00, 0x00, 0x0C, 0x0C, 0x06],
+    [0x18, 0x0C, 0x06, 0x03, 0x06, 0x0C, 0x18, 0x00],
+    [0x00, 0x00, 0x3F, 0x00, 0x00, 0x3F, 0x00, 0x00],
+    [0x06, 0x0C, 0x18, 0x30, 0x18, 0x0C, 0x06, 0x00],
+    [0x1E, 0x33, 0x30, 0x18, 0x0C, 0x00, 0x0C, 0x00],
+    [0x3E, 0x63, 0x7B, 0x7B, 0x7B, 0x03, 0x1E, 0x00],
+    [0x0C, 0x1E, 0x33, 0x33, 0x3F, 0x33, 0x33, 0x00],
+    [0x3F, 0x66, 0x66, 0x3E, 0x66, 0x66, 0x3F, 0x00],
+    [0x3C, 0x66, 0x03, 0x03, 0x03, 0x66, 0x3C, 0x00],
+    [0x1F, 0x36, 0x66, 0x66, 0x66, 0x36, 0x1F, 0x00],
+    [0x7F, 0x46, 0x16, 0x1E, 0x16, 0x46, 0x7F, 0x00],
+    [0x7F, 0x46, 0x16, 0x1E, 0x16, 0x06, 0x0F, 0x00],
+    [0x3C, 0x66, 0x03, 0x03, 0x73, 0x66, 0x7C, 0x00],
+    [0x33, 0x33, 0x33, 0x3F, 0x33, 0x33, 0x33, 0x00],
+    [0x1E, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x1E, 0x00],
+    [0x78, 0x30, 0x30, 0x30, 0x33, 0x33, 0x1E, 0x00],
+    [0x67, 0x66, 0x36, 0x1E, 0x36, 0x66, 0x67, 0x00],
+    [0x0F, 0x06, 0x06, 0x06, 0x46, 0x66, 0x7F, 0x00],
+    [0x63, 0x77, 0x7F, 0x7F, 0x6B, 0x63, 0x63, 0x00],
+    [0x63, 0x67, 0x6F, 0x7B, 0x73, 0x63, 0x63, 0x00],
+    [0x1C, 0x36, 0x63, 0x63, 0x63, 0x36, 0x1C, 0x00],
+    [0x3F, 0x66, 0x66, 0x3E, 0x06, 0x06, 0x0F, 0x00],
+    [0x1E, 0x33, 0x33, 0x33, 0x3B, 0x1E, 0x38, 0x00],
+    [0x3F, 0x66, 0x66, 0x3E, 0x36, 0x66, 0x67, 0x00],
+    [0x1E, 0x33, 0x07, 0x0E, 0x38, 0x33, 0x1E, 0x00],
+    [0x3F, 0x2D, 0x0C, 0x0C, 0x0C, 0x0C, 0x1E, 0x00],
+    [0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x3F, 0x00],
+    [0x33, 0x33, 0x33, 0x33, 0x33, 0x1E, 0x0C, 0x00],
+    [0x63, 0x63, 0x63, 0x6B, 0x7F, 0x77, 0x63, 0x00],
+    [0x63, 0x63, 0x36, 0x1C, 0x1C, 0x36, 0x63, 0x00],
+    [0x33, 0x33, 0x33, 0x1E, 0x0C, 0x0C, 0x1E, 0x00],
+    [0x7F, 0x63, 0x31, 0x18, 0x4C, 0x66, 0x7F, 0x00],
+    [0x1E, 0x06, 0x06, 0x06, 0x06, 0x06, 0x1E, 0x00],
+    [0x03, 0x06, 0x0C, 0x18, 0x30, 0x60, 0x40, 0x00],
+    [0x1E, 0x18, 0x18, 0x18, 0x18, 0x18, 0x1E, 0x00],
+    [0x08, 0x1C, 0x36, 0x63, 0x00, 0x00, 0x00, 0x00],
+    [0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF],
+    [0x0C, 0x0C, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00],
+    [0x00, 0x00, 0x1E, 0x30, 0x3E, 0x33, 0x6E, 0x00],
+    [0x07, 0x06, 0x06, 0x3E, 0x66, 0x66, 0x3B, 0x00],
+    [0x00, 0x00, 0x1E, 0x33, 0x03, 0x33, 0x1E, 0x00],
+    [0x38, 0x30, 0x30, 0x3E, 0x33, 0x33, 0x6E, 0x00],
+    [0x00, 0x00, 0x1E, 0x33, 0x3F, 0x03, 0x1E, 0x00],
+    [0x1C, 0x36, 0x06, 0x0F, 0x06, 0x06, 0x0F, 0x00],
+    [0x00, 0x00, 0x6E, 0x33, 0x33, 0x3E, 0x30, 0x1F],
+    [0x07, 0x06, 0x36, 0x6E, 0x66, 0x66, 0x67, 0x00],
+    [0x0C, 0x00, 0x0E, 0x0C, 0x0C, 0x0C, 0x1E, 0x00],
+    [0x30, 0x00, 0x30, 0x30, 0x30, 0x33, 0x33, 0x1E],
+    [0x07, 0x06, 0x66, 0x36, 0x1E, 0x36, 0x67, 0x00],
+    [0x0E, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x1E, 0x00],
+    [0x00, 0x00, 0x33, 0x7F, 0x7F, 0x6B, 0x63, 0x00],
+    [0x00, 0x00, 0x1F, 0x33, 0x33, 0x33, 0x33, 0x00],
+    [0x00, 0x00, 0x1E, 0x33, 0x33, 0x33, 0x1E, 0x00],
+    [0x00, 0x00, 0x3B, 0x66, 0x66, 0x3E, 0x06, 0x0F],
+    [0x00, 0x00, 0x6E, 0x33, 0x33, 0x3E, 0x30, 0x78],
+    [0x00, 0x00, 0x3B, 0x6E, 0x66, 0x06, 0x0F, 0x00],
+    [0x00, 0x00, 0x3E, 0x03, 0x1E, 0x30, 0x1F, 0x00],
+    [0x08, 0x0C, 0x3E, 0x0C, 0x0C, 0x2C, 0x18, 0x00],
+    [0x00, 0x00, 0x33, 0x33, 0x33, 0x33, 0x6E, 0x00],
+    [0x00, 0x00, 0x33, 0x33, 0x33, 0x1E, 0x0C, 0x00],
+    [0x00, 0x00, 0x63, 0x6B, 0x7F, 0x7F, 0x36, 0x00],
+    [0x00, 0x00, 0x63, 0x36, 0x1C, 0x36, 0x63, 0x00],
+    [0x00, 0x00, 0x33, 0x33, 0x33, 0x3E, 0x30, 0x1F],
+    [0x00, 0x00, 0x3F, 0x19, 0x0C, 0x26, 0x3F, 0x00],
+    [0x38, 0x0C, 0x0C, 0x07, 0x0C, 0x0C, 0x38, 0x00],
+    [0x18, 0x18, 0x18, 0x00, 0x18, 0x18, 0x18, 0x00],
+    [0x07, 0x0C, 0x0C, 0x38, 0x0C, 0x0C, 0x07, 0x00],
+    [0x6E, 0x3B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00],
+];
+
+/// Get the glyph for `c`, or a question mark for anything that isn't printable ASCII.
+pub fn glyph(c: char) -> &'static Glyph {
+    let index = if c.is_ascii() && (' '..='~').contains(&c) {
+        c as usize - ' ' as usize
+    } else {
+        '?' as usize - ' ' as usize
+    };
+    &GLYPHS[index]
+}
@@ -0,0 +1,957 @@
+use crate::entries::BootableEntry;
+use crate::menu::font::{self, ELLIPSIS, GLYPH_SIZE, Glyph};
+use crate::menu::logo::{LOGO, LOGO_HEIGHT, LOGO_WIDTH};
+use crate::menu::{BootMenu, wait_for_events};
+use alloc::format;
+use alloc::string::String;
+use alloc::vec::Vec;
+use anyhow::{Context, Result, bail};
+use core::time::Duration;
+use eficore::framebuffer::Framebuffer;
+use uefi::boot::{OpenProtocolParams, ScopedProtocol};
+use uefi::proto::ProtocolPointer;
+use uefi::proto::console::gop::{BltPixel, GraphicsOutput};
+use uefi::proto::console::pointer::{AbsolutePointer, Pointer};
+use uefi::proto::console::text::{Input, Key, ScanCode};
+use uefi::proto::device_path::DevicePath;
+use uefi::{Event, Handle};
+
+/// How often the countdown and the logo are updated.
+const TICK: Duration = Duration::from_millis(125);
+
+/// The number of ticks in one bounce of the logo.
+const BOUNCE_TICKS: usize = 16;
+
+/// How many pixels the cursor moves for each millimeter that a relative pointer reports.
+const PIXELS_PER_MILLIMETER: i64 = 8;
+
+/// The title shown above the entries.
+const TITLE: &str = "sprout";
+
+/// The hint shown once the countdown has been stopped.
+const HINT: &str = "Pick an entry with the arrow keys.";
+
+/// The hint shown instead of [HINT] when the mouse is in use.
+const HINT_MOUSE: &str = "Pick an entry with the arrow keys or the mouse.";
+
+/// The color of the top of the background, which fades into [BACKGROUND_BOTTOM].
+const BACKGROUND_TOP: (u8, u8, u8) = (0x3a, 0x1c, 0x4e);
+
+/// The color of the bottom of the background.
+const BACKGROUND_BOTTOM: (u8, u8, u8) = (0x16, 0x0c, 0x24);
+
+/// The widest that the status line gets, which the panel has room for.
+const STATUS_WIDEST: &str = "Boot in 999 s.";
+
+/// The color of the panel behind the entries.
+const PANEL: BltPixel = BltPixel::new(0x22, 0x12, 0x34);
+
+/// The color of the edge of the panel, the line below the entries and the scrollbar track.
+const PANEL_EDGE: BltPixel = BltPixel::new(0x4a, 0x2e, 0x66);
+
+/// The color of the pill behind the selected entry, taken from the Sprout logo.
+const PILL_SELECTED: BltPixel = BltPixel::new(0xff, 0x7a, 0xb8);
+
+/// The color of the title.
+const ACCENT: BltPixel = BltPixel::new(0xff, 0xa6, 0xd0);
+
+/// The color of entries that aren't selected.
+const TEXT: BltPixel = BltPixel::new(0xf3, 0xd9, 0xea);
+
+/// The color of the selected entry.
+const TEXT_SELECTED: BltPixel = BltPixel::new(0x3a, 0x10, 0x2c);
+
+/// The color of the status line.
+const TEXT_MUTED: BltPixel = BltPixel::new(0xb9, 0x9a, 0xc9);
+
+/// The color that the cursor is filled with.
+const CURSOR_FILL: BltPixel = BltPixel::new(0xff, 0xff, 0xff);
+
+/// The color of the outline of the cursor.
+const CURSOR_OUTLINE: BltPixel = BltPixel::new(0x3a, 0x10, 0x2c);
+
+/// The shape of the cursor, where `X` is the outline and `.` is the fill.
+const CURSOR: [&str; 16] = [
+    "X          ",
+    "XX         ",
+    "X.X        ",
+    "X..X       ",
+    "X...X      ",
+    "X....X     ",
+    "X.....X    ",
+    "X......X   ",
+    "X.......X  ",
+    "X........X ",
+    "X.....XXXXX",
+    "X..X..X    ",
+    "X.X X..X   ",
+    "XX  X..X   ",
+    "X    X..X  ",
+    "     XXXX  ",
+];
+
+/// A graphical boot menu that selects entries with the keyboard, or the mouse if enabled.
+pub struct GraphicalMenu {
+    /// Whether the mouse is used when the firmware has a pointing device.
+    pub enable_mouse: bool,
+    /// Whether the logo is drawn next to the name.
+    pub enable_logo: bool,
+    /// Whether the logo bounces.
+    pub enable_animation: bool,
+}
+
+/// The pointing devices of the firmware.
+/// Firmware commonly has both kinds of protocol, even if one has no device behind it.
+struct Mouse {
+    /// A device that reports how far it has moved, like a mouse.
+    relative: Option<ScopedProtocol<Pointer>>,
+    /// A device that reports where it is, like a touch screen or the tablet of a virtual machine.
+    absolute: Option<ScopedProtocol<AbsolutePointer>>,
+}
+
+/// Open the pointer protocol `P`, preferring the one on the console input handle.
+/// That one belongs to the console splitter, which combines every device and is never removed.
+/// Otherwise, the first device that has the protocol is used.
+fn open_pointer<P: ProtocolPointer + ?Sized>() -> Option<ScopedProtocol<P>> {
+    // SAFETY: The handle in the system table is either null or a valid handle.
+    let console = uefi::table::system_table_raw()
+        .and_then(|table| unsafe { Handle::from_ptr(table.as_ref().stdin_handle) });
+    console
+        .and_then(|handle| eficore::handle::open_shared::<P>(handle).ok())
+        .or_else(|| {
+            uefi::boot::get_handle_for_protocol::<P>()
+                .and_then(eficore::handle::open_shared::<P>)
+                .ok()
+        })
+}
+
+impl Mouse {
+    /// Open the pointing devices, if the firmware has any.
+    fn open() -> Option<Self> {
+        let relative = open_pointer::<Pointer>();
+        let absolute = open_pointer::<AbsolutePointer>();
+        (relative.is_some() || absolute.is_some()).then_some(Self { relative, absolute })
+    }
+
+    /// The events that are signaled when a device has input.
+    fn events(&self) -> Result<Vec<Event>> {
+        let mut events = Vec::new();
+        if let Some(pointer) = &self.relative {
+            events.push(pointer.wait_for_input_event());
+        }
+        if let Some(pointer) = &self.absolute {
+            events.push(pointer.wait_for_input_event());
+        }
+        events
+            .into_iter()
+            .collect::<uefi::Result<_>>()
+            .context("unable to acquire pointer event")
+    }
+
+    /// Move `cursor` within `bounds` to where the devices say it is.
+    /// Returns whether the button is held, or [None] if the devices have no new input.
+    fn poll(
+        &mut self,
+        cursor: &mut (usize, usize),
+        bounds: (usize, usize),
+    ) -> Result<Option<bool>> {
+        let mut button = None;
+        let max = (
+            bounds.0.saturating_sub(1) as i64,
+            bounds.1.saturating_sub(1) as i64,
+        );
+
+        if let Some(pointer) = &mut self.relative {
+            // The movement is in counts, and the device reports how many are in a millimeter.
+            let mode = *pointer.mode();
+            if let Some(state) = pointer.read_state().context("unable to read pointer")? {
+                let step = |movement: i32, resolution: u64| {
+                    movement as i64 * PIXELS_PER_MILLIMETER / resolution.max(1) as i64
+                };
+                let x = cursor.0 as i64 + step(state.relative_movement_x, mode.resolution_x);
+                let y = cursor.1 as i64 + step(state.relative_movement_y, mode.resolution_y);
+                *cursor = (x.clamp(0, max.0) as usize, y.clamp(0, max.1) as usize);
+                button = Some(state.left_button.into());
+            }
+        }
+
+        if let Some(pointer) = &mut self.absolute {
+            // The position is somewhere between the minimum and maximum of the device.
+            let mode = *pointer.mode();
+            if let Some(state) = pointer.read_state().context("unable to read pointer")? {
+                let scale = |value: u64, min: u64, device_max: u64, bound: i64| {
+                    let span = device_max.saturating_sub(min).max(1) as i128;
+                    (value.saturating_sub(min) as i128 * bound as i128 / span).min(bound as i128)
+                        as usize
+                };
+                *cursor = (
+                    scale(
+                        state.current_x,
+                        mode.absolute_min_x,
+                        mode.absolute_max_x,
+                        max.0,
+                    ),
+                    scale(
+                        state.current_y,
+                        mode.absolute_min_y,
+                        mode.absolute_max_y,
+                        max.1,
+                    ),
+                );
+                button = Some(state.active_buttons & 1 != 0);
+            }
+        }
+
+        Ok(button)
+    }
+}
+
+/// The position and size of everything on the framebuffer.
+/// The logo and the name are in a header, with a panel below it that holds the entries.
+struct Layout {
+    /// How many pixels each pixel of the font is drawn as.
+    scale: usize,
+    /// The size of a character in pixels.
+    cell: usize,
+    /// The column that entries start at.
+    x: usize,
+    /// The row that the first entry starts at.
+    y: usize,
+    /// The width of each entry.
+    width: usize,
+    /// The height of each entry.
+    height: usize,
+    /// The space between entries.
+    gap: usize,
+    /// The number of entries that fit on the framebuffer.
+    visible: usize,
+    /// The column, row, width and height of the panel behind the entries.
+    panel: (usize, usize, usize, usize),
+    /// How round the corners of the panel are.
+    radius: usize,
+    /// The column that the text of an entry starts at.
+    text_x: usize,
+    /// How many characters of a title fit in an entry.
+    columns: usize,
+    /// The row of the line between the entries and the status line.
+    footer: usize,
+    /// The column, row, width and height of the logo when it is on the ground, if it is shown.
+    logo: Option<(usize, usize, usize, usize)>,
+    /// How many pixels the logo rises while it bounces.
+    bounce: usize,
+    /// The column, row and scale of the name, if there is room for it.
+    title: Option<(usize, usize, usize)>,
+    /// Whether there are more entries than fit, which adds a scrollbar.
+    scrolls: bool,
+}
+
+impl Layout {
+    /// Calculate the layout of `entries` on a framebuffer of `screen` width and height.
+    fn new(screen: (usize, usize), entries: &[BootableEntry], logo: bool, animate: bool) -> Self {
+        let (width, height) = screen;
+
+        // Large screens get larger text so that it stays readable, but not so large that the
+        // titles take up the whole screen.
+        let scale = (height / 540).min(width / 640).clamp(1, 3);
+        let cell = GLYPH_SIZE * scale;
+        let margin = (cell * 2).max(height / 20).min(width / 8);
+        let padding = cell * 3 / 2;
+        let (row, gap) = (cell * 2, scale * 2);
+        let header_gap = cell * 2;
+
+        // The line between the entries and the status, and the status below it.
+        let footer_height = cell + scale + cell / 2 + cell;
+
+        // The panel is the width of the longest title, but never most of the screen.
+        let longest = entries
+            .iter()
+            .map(|entry| entry.title().chars().count())
+            .max()
+            .unwrap_or(0);
+        let status = HINT.len().max(HINT_MOUSE.len()).max(STATUS_WIDEST.len());
+        let panel_width = ((longest + 3) * cell + padding * 2)
+            .max(40 * cell)
+            .max((status + 8) * cell)
+            .min(width.saturating_sub(margin * 2).min(width * 4 / 5));
+
+        // The header is as tall as the logo, and the logo needs room to bounce.
+        let fit = |logo: usize| {
+            let header = logo + logo / 16;
+            let space = height
+                .saturating_sub(margin * 2 + header + header_gap + padding * 2 + footer_height);
+            let visible = ((space + gap) / (row + gap)).clamp(1, entries.len().max(1));
+            (header, visible)
+        };
+        let mut logo_height = (LOGO_HEIGHT * 2).min(height / 7).max(32);
+        let (mut header, mut visible) = fit(logo_height);
+        // A short screen gets a smaller logo before it loses entries.
+        if visible < entries.len().min(3) {
+            logo_height = (logo_height / 2).max(32);
+            (header, visible) = fit(logo_height);
+        }
+        let logo_width = logo_height * LOGO_WIDTH / LOGO_HEIGHT;
+        let bounce = if animate { logo_height / 16 } else { 0 };
+
+        // The name is next to the logo, if the two fit together.
+        let title_scale = (logo_height / 32).clamp(scale, scale * 3);
+        let title_width = TITLE.len() * GLYPH_SIZE * title_scale;
+        // Without the logo, the name is alone and takes the place of the group.
+        let shown = if logo { logo_width + cell } else { 0 };
+        let fits = shown + title_width <= width.saturating_sub(margin * 2);
+        let group = match (logo, fits) {
+            (true, true) => shown + title_width,
+            (true, false) => logo_width,
+            (false, _) => title_width,
+        };
+        let group_x = width.saturating_sub(group) / 2;
+
+        let list = visible * (row + gap) - gap;
+        let panel_height = padding * 2 + list + footer_height;
+        let top = (height.saturating_sub(header + header_gap + panel_height) / 2).max(margin);
+        let panel_x = width.saturating_sub(panel_width) / 2;
+        let panel_y = top + header + header_gap;
+
+        // The scrollbar is in a column next to the entries.
+        let scrolls = visible < entries.len();
+        let gutter = if scrolls { cell } else { 0 };
+        let list_width = panel_width.saturating_sub(padding * 2 + gutter);
+        let list_y = panel_y + padding;
+
+        Self {
+            scale,
+            cell,
+            x: panel_x + padding,
+            y: list_y,
+            width: list_width,
+            height: row,
+            gap,
+            visible,
+            panel: (panel_x, panel_y, panel_width, panel_height),
+            radius: cell,
+            text_x: panel_x + padding + cell,
+            columns: list_width.saturating_sub(cell * 2) / cell,
+            footer: list_y + list + cell,
+            logo: logo.then_some((group_x, top + bounce, logo_width, logo_height)),
+            bounce,
+            title: fits.then_some((
+                group_x + shown,
+                top + bounce + logo_height.saturating_sub(GLYPH_SIZE * title_scale) / 2,
+                title_scale,
+            )),
+            scrolls,
+        }
+    }
+
+    /// The row that the entry at `slot` on the screen starts at.
+    fn row(&self, slot: usize) -> usize {
+        self.y + slot * (self.height + self.gap)
+    }
+
+    /// The slot of the entry that is at `position`, if there is one.
+    fn slot_at(&self, position: (usize, usize)) -> Option<usize> {
+        let (x, y) = (
+            position.0.checked_sub(self.x)?,
+            position.1.checked_sub(self.y)?,
+        );
+        let slot = y / (self.height + self.gap);
+        (x < self.width && y % (self.height + self.gap) < self.height && slot < self.visible)
+            .then_some(slot)
+    }
+}
+
+/// A display that the menu is drawn to.
+struct Screen {
+    /// The graphics output of the display.
+    gop: ScopedProtocol<GraphicsOutput>,
+    /// What is drawn before it is blitted to the display.
+    fb: Framebuffer,
+    /// What was last blitted to the display, which only has to be updated where it differs.
+    shown: Framebuffer,
+    /// The parts of the menu that never change, which each frame starts from.
+    base: Framebuffer,
+    /// Whether the display has had a frame blitted to it.
+    drawn: bool,
+    /// Where the entries are on this display.
+    layout: Layout,
+    /// The index of the first entry that is on this display.
+    offset: usize,
+}
+
+impl Screen {
+    /// Open every display that the firmware has, or fail if it has none.
+    /// The console splitter has a graphics output that draws to every display. It has no device
+    /// path, so it is only used if there are no outputs for the displays themselves.
+    fn open_all(
+        entries: &[BootableEntry],
+        enable_logo: bool,
+        enable_animation: bool,
+    ) -> Result<Vec<Self>> {
+        let handles = uefi::boot::find_handles::<GraphicsOutput>()
+            .context("unable to find a graphics output")?;
+        let has_device_path = |handle: &Handle| {
+            uefi::boot::test_protocol::<DevicePath>(OpenProtocolParams {
+                handle: *handle,
+                agent: uefi::boot::image_handle(),
+                controller: None,
+            })
+            .unwrap_or(false)
+        };
+        let displays = handles
+            .iter()
+            .copied()
+            .filter(has_device_path)
+            .collect::<Vec<_>>();
+        let handles = if displays.is_empty() {
+            handles
+        } else {
+            displays
+        };
+
+        let mut screens = Vec::new();
+        for handle in handles {
+            // Opening it exclusively would disconnect the firmware's text console from the
+            // display, and anything printed after the menu may not show up.
+            let Ok(gop) = eficore::handle::open_shared::<GraphicsOutput>(handle) else {
+                continue;
+            };
+            let (width, height) = gop.current_mode_info().resolution();
+            let (Ok(fb), Ok(shown), Ok(mut base)) = (
+                Framebuffer::new(width, height),
+                Framebuffer::new(width, height),
+                Framebuffer::new(width, height),
+            ) else {
+                continue;
+            };
+            let layout = Layout::new((width, height), entries, enable_logo, enable_animation);
+            render_base(&mut base, &layout);
+            screens.push(Self {
+                gop,
+                fb,
+                shown,
+                base,
+                drawn: false,
+                layout,
+                offset: 0,
+            });
+        }
+
+        if screens.is_empty() {
+            bail!("unable to open a graphics output");
+        }
+        Ok(screens)
+    }
+
+    /// The size of the display in pixels.
+    fn size(&self) -> (usize, usize) {
+        (self.fb.width(), self.fb.height())
+    }
+
+    /// Where `position` on a display of size `from` is on this display, keeping its place
+    /// relative to the edges.
+    fn locate(&self, position: (usize, usize), from: (usize, usize)) -> (usize, usize) {
+        let scale = |value: usize, to: usize, from: usize| {
+            (value * to / from.max(1)).min(to.saturating_sub(1))
+        };
+        (
+            scale(position.0, self.fb.width(), from.0),
+            scale(position.1, self.fb.height(), from.1),
+        )
+    }
+
+    /// Scroll so that the `selected` entry is visible.
+    fn scroll_to(&mut self, selected: usize) {
+        if selected < self.offset {
+            self.offset = selected;
+        } else if selected >= self.offset + self.layout.visible {
+            self.offset = selected + 1 - self.layout.visible;
+        }
+    }
+}
+
+/// What is shown on the framebuffer.
+struct Scene<'a> {
+    /// The entries that can be chosen.
+    entries: &'a [BootableEntry],
+    /// The index of the selected entry.
+    selected: usize,
+    /// The status line at the bottom of the screen.
+    status: String,
+    /// The number of ticks since the menu was shown, which moves the logo.
+    ticks: usize,
+}
+
+/// Fill `rows` with a gradient from `top` to `bottom`.
+fn draw_background(fb: &mut Framebuffer, top: (u8, u8, u8), bottom: (u8, u8, u8)) {
+    let (width, height) = (fb.width(), fb.height());
+    let mix = |from: u8, to: u8, row: usize| {
+        (from as i64 + (to as i64 - from as i64) * row as i64 / height.max(1) as i64) as u8
+    };
+    for row in 0..height {
+        let color = BltPixel::new(
+            mix(top.0, bottom.0, row),
+            mix(top.1, bottom.1, row),
+            mix(top.2, bottom.2, row),
+        );
+        fb.fill_rect(0, row, width, 1, color);
+    }
+}
+
+/// Fill a rectangle that has rounded corners of `radius`.
+fn draw_rounded(
+    fb: &mut Framebuffer,
+    x: usize,
+    y: usize,
+    width: usize,
+    height: usize,
+    radius: usize,
+    color: BltPixel,
+) {
+    if width == 0 || height == 0 {
+        return;
+    }
+    let radius = radius.min(height / 2).min(width / 2);
+    for row in 0..height {
+        // How far the row is from the edge, where the corners curve in.
+        let edge = row.min(height - 1 - row);
+        let inset = if edge >= radius {
+            0
+        } else {
+            let rise = radius - edge;
+            (0..radius)
+                .find(|inset| (radius - inset).pow(2) + rise.pow(2) <= radius.pow(2))
+                .unwrap_or(radius)
+        };
+        fb.fill_rect(
+            x + inset,
+            y + row,
+            width.saturating_sub(inset * 2),
+            1,
+            color,
+        );
+    }
+}
+
+/// Fill a rectangle with the shape of a pill, which has fully rounded ends.
+fn draw_pill(
+    fb: &mut Framebuffer,
+    x: usize,
+    y: usize,
+    width: usize,
+    height: usize,
+    color: BltPixel,
+) {
+    draw_rounded(fb, x, y, width, height, height / 2, color);
+}
+
+/// Draw `glyph` at `x` and `y`, with each pixel of it drawn as `scale` by `scale` pixels.
+fn draw_glyph(
+    fb: &mut Framebuffer,
+    x: usize,
+    y: usize,
+    scale: usize,
+    glyph: &Glyph,
+    color: BltPixel,
+) {
+    for (row, bits) in glyph.iter().enumerate() {
+        for column in (0..GLYPH_SIZE).filter(|column| bits >> column & 1 != 0) {
+            fb.fill_rect(x + column * scale, y + row * scale, scale, scale, color);
+        }
+    }
+}
+
+/// Draw `text` starting at `x` and `y`, cut off with an ellipsis if it is over `columns` characters.
+fn draw_text(
+    fb: &mut Framebuffer,
+    x: usize,
+    y: usize,
+    scale: usize,
+    columns: usize,
+    text: &str,
+    color: BltPixel,
+) {
+    let cut = text.chars().count() > columns;
+    let shown = if cut {
+        columns.saturating_sub(1)
+    } else {
+        columns
+    };
+    for (index, c) in text.chars().take(shown).enumerate() {
+        draw_glyph(
+            fb,
+            x + index * GLYPH_SIZE * scale,
+            y,
+            scale,
+            font::glyph(c),
+            color,
+        );
+    }
+    if cut && columns > 0 {
+        draw_glyph(
+            fb,
+            x + shown * GLYPH_SIZE * scale,
+            y,
+            scale,
+            &ELLIPSIS,
+            color,
+        );
+    }
+}
+
+/// Draw `text` in the middle of `x` and `width` at `y`.
+fn draw_centered(
+    fb: &mut Framebuffer,
+    x: usize,
+    width: usize,
+    y: usize,
+    scale: usize,
+    text: &str,
+    color: BltPixel,
+) {
+    let columns = width / (GLYPH_SIZE * scale);
+    let used = text.chars().count().min(columns) * GLYPH_SIZE * scale;
+    draw_text(fb, x + (width - used) / 2, y, scale, columns, text, color);
+}
+
+/// Draw the logo above the entries, bouncing a little with each of `ticks`.
+fn draw_logo(fb: &mut Framebuffer, layout: &Layout, ticks: usize) {
+    let Some((x, floor, width, height)) = layout.logo else {
+        return;
+    };
+
+    // The logo rises and falls by up to `bounce` pixels.
+    let phase = ticks % BOUNCE_TICKS;
+    let rise = phase.min(BOUNCE_TICKS - phase) * layout.bounce / (BOUNCE_TICKS / 2);
+    let y = floor - rise;
+
+    for row in 0..height {
+        let source_row = row * LOGO_HEIGHT / height * LOGO_WIDTH;
+        for column in 0..width {
+            let source = (source_row + column * LOGO_WIDTH / width) * 4;
+            let [red, green, blue, alpha] = LOGO[source..source + 4] else {
+                continue;
+            };
+            if alpha == 0 {
+                continue;
+            }
+            // The channels are premultiplied, so the color is the logo plus what shows through.
+            if let Some(pixel) = fb.pixel(x + column, y + row) {
+                let through = 255 - alpha as u32;
+                let blend =
+                    |logo: u8, behind: u8| (logo as u32 + behind as u32 * through / 255) as u8;
+                *pixel = BltPixel::new(
+                    blend(red, pixel.red),
+                    blend(green, pixel.green),
+                    blend(blue, pixel.blue),
+                );
+            }
+        }
+    }
+}
+
+/// Draw the track and the thumb of the scrollbar, which shows where `offset` is in `total`.
+fn draw_scrollbar(fb: &mut Framebuffer, layout: &Layout, offset: usize, total: usize) {
+    let height = layout.visible * (layout.height + layout.gap) - layout.gap;
+    let x = layout.x + layout.width + layout.cell / 2 - layout.scale;
+    let width = layout.scale * 2;
+    fb.fill_rect(x, layout.y, width, height, PANEL_EDGE);
+
+    let thumb = (height * layout.visible / total)
+        .max(layout.cell)
+        .min(height);
+    let travel = total.saturating_sub(layout.visible).max(1);
+    let y = layout.y + (height - thumb) * offset.min(travel) / travel;
+    draw_rounded(fb, x, y, width, thumb, width / 2, ACCENT);
+}
+
+/// Draw the cursor with its tip at `position`.
+fn draw_cursor(fb: &mut Framebuffer, scale: usize, position: (usize, usize)) {
+    for (row, line) in CURSOR.iter().enumerate() {
+        for (column, shape) in line.bytes().enumerate() {
+            let color = match shape {
+                b'X' => CURSOR_OUTLINE,
+                b'.' => CURSOR_FILL,
+                _ => continue,
+            };
+            fb.fill_rect(
+                position.0 + column * scale,
+                position.1 + row * scale,
+                scale,
+                scale,
+                color,
+            );
+        }
+    }
+}
+
+/// Draw the parts of the menu that never change to the framebuffer.
+fn render_base(fb: &mut Framebuffer, layout: &Layout) {
+    draw_background(fb, BACKGROUND_TOP, BACKGROUND_BOTTOM);
+    if let Some((x, y, scale)) = layout.title {
+        draw_text(fb, x, y, scale, TITLE.len(), TITLE, ACCENT);
+    }
+
+    let (panel_x, panel_y, panel_width, panel_height) = layout.panel;
+    let edge = layout.scale;
+    draw_rounded(
+        fb,
+        panel_x,
+        panel_y,
+        panel_width,
+        panel_height,
+        layout.radius,
+        PANEL_EDGE,
+    );
+    draw_rounded(
+        fb,
+        panel_x + edge,
+        panel_y + edge,
+        panel_width.saturating_sub(edge * 2),
+        panel_height.saturating_sub(edge * 2),
+        layout.radius.saturating_sub(edge),
+        PANEL,
+    );
+
+    // The line between the entries and the status line.
+    let inner = panel_width.saturating_sub(layout.cell * 3);
+    let inner_x = panel_x + layout.cell * 3 / 2;
+    fb.fill_rect(inner_x, layout.footer, inner, layout.scale, PANEL_EDGE);
+}
+
+/// Draw the whole menu to the framebuffer, which already has the [render_base] drawn.
+fn render(
+    fb: &mut Framebuffer,
+    layout: &Layout,
+    scene: &Scene,
+    offset: usize,
+    cursor: Option<(usize, usize)>,
+) {
+    draw_logo(fb, layout, scene.ticks);
+
+    let (panel_x, _, panel_width, _) = layout.panel;
+    for (slot, (index, entry)) in scene
+        .entries
+        .iter()
+        .enumerate()
+        .skip(offset)
+        .take(layout.visible)
+        .enumerate()
+    {
+        let row = layout.row(slot);
+        let text_row = row + (layout.height - layout.cell) / 2;
+        // Only the selected entry has a pill, which keeps the list calm.
+        let text = if index == scene.selected {
+            draw_pill(
+                fb,
+                layout.x,
+                row,
+                layout.width,
+                layout.height,
+                PILL_SELECTED,
+            );
+            TEXT_SELECTED
+        } else {
+            TEXT
+        };
+        draw_text(
+            fb,
+            layout.text_x,
+            text_row,
+            layout.scale,
+            layout.columns,
+            entry.title(),
+            text,
+        );
+    }
+
+    if layout.scrolls {
+        draw_scrollbar(fb, layout, offset, scene.entries.len());
+    }
+
+    // The status line is below the line across the panel, with the position when it scrolls.
+    let inner = panel_width.saturating_sub(layout.cell * 3);
+    let inner_x = panel_x + layout.cell * 3 / 2;
+    let status_row = layout.footer + layout.scale + layout.cell / 2;
+    // The position is at the right edge, so the status keeps clear of it on both sides.
+    let keep_clear = if layout.scrolls { layout.cell * 8 } else { 0 };
+    draw_centered(
+        fb,
+        inner_x + keep_clear,
+        inner.saturating_sub(keep_clear * 2),
+        status_row,
+        layout.scale,
+        &scene.status,
+        TEXT_MUTED,
+    );
+    if layout.scrolls {
+        let position = format!("{}/{}", scene.selected + 1, scene.entries.len());
+        let width = position.len() * layout.cell;
+        draw_text(
+            fb,
+            (inner_x + inner).saturating_sub(width),
+            status_row,
+            layout.scale,
+            position.len(),
+            &position,
+            TEXT_MUTED,
+        );
+    }
+
+    if let Some(position) = cursor {
+        draw_cursor(fb, layout.scale, position);
+    }
+}
+
+/// Run the menu until an entry is chosen, returning the index of that entry.
+/// The `selected` entry is booted if there is no input before `timeout` passes.
+/// Without a timeout, the menu waits for the user.
+fn run(
+    input: &mut Input,
+    mut mouse: Option<Mouse>,
+    screens: &mut [Screen],
+    timeout: Option<Duration>,
+    entries: &[BootableEntry],
+    selected: usize,
+) -> Result<usize> {
+    // The cursor moves within the first screen, and is shown at the same place on the others.
+    let bounds = screens[0].size();
+    let page = screens[0].layout.visible;
+    let last = entries.len() - 1;
+
+    // The events that wake the menu up, which are keys and pointer input.
+    let mut events = Vec::from([input
+        .wait_for_key_event()
+        .context("unable to acquire key event")?]);
+    if let Some(mouse) = &mouse {
+        events.extend(mouse.events()?);
+    }
+
+    let mut scene = Scene {
+        entries,
+        selected,
+        status: String::new(),
+        ticks: 0,
+    };
+    let mut cursor = mouse.as_ref().map(|_| (bounds.0 / 2, bounds.1 / 2));
+    // The time left before booting, or None once input stops the countdown.
+    let mut remaining = timeout;
+    let mut button_down = false;
+
+    loop {
+        scene.status = match remaining {
+            Some(remaining) => format!("Boot in {} s.", remaining.as_millis().div_ceil(1000)),
+            None if mouse.is_some() => String::from(HINT_MOUSE),
+            None => String::from(HINT),
+        };
+        for screen in screens.iter_mut() {
+            screen.scroll_to(scene.selected);
+            let cursor = cursor.map(|position| screen.locate(position, bounds));
+            screen.fb.copy_from(&screen.base);
+            render(
+                &mut screen.fb,
+                &screen.layout,
+                &scene,
+                screen.offset,
+                cursor,
+            );
+            // Only the first frame has to fill the display, the rest only change parts of it.
+            if screen.drawn {
+                screen.fb.blit_changes(&screen.shown, &mut screen.gop)?;
+            } else {
+                screen.fb.blit(&mut screen.gop)?;
+                screen.drawn = true;
+            }
+            core::mem::swap(&mut screen.fb, &mut screen.shown);
+        }
+
+        // Wake up every tick to move the logo and update the countdown.
+        if wait_for_events(&events, Some(TICK))?.is_none() {
+            scene.ticks += 1;
+            if let Some(left) = remaining {
+                let left = left.saturating_sub(TICK);
+                if left.is_zero() {
+                    return Ok(scene.selected);
+                }
+                remaining = Some(left);
+            }
+            continue;
+        }
+
+        // Some firmware signals an event without any input being available.
+        if let Some(key) = input.read_key().context("unable to read key")? {
+            remaining = None;
+            match key {
+                Key::Special(ScanCode::UP) => scene.selected = scene.selected.saturating_sub(1),
+                Key::Special(ScanCode::DOWN) => scene.selected = (scene.selected + 1).min(last),
+                Key::Special(ScanCode::HOME) => scene.selected = 0,
+                Key::Special(ScanCode::END) => scene.selected = last,
+                Key::Special(ScanCode::PAGE_UP) => {
+                    scene.selected = scene.selected.saturating_sub(page)
+                }
+                Key::Special(ScanCode::PAGE_DOWN) => {
+                    scene.selected = (scene.selected + page).min(last)
+                }
+
+                // Serial consoles may send a line feed instead of a carriage return.
+                Key::Printable(c) if matches!(char::from(c), '\r' | '\n') => {
+                    return Ok(scene.selected);
+                }
+
+                _ => {}
+            }
+        }
+
+        if let (Some(mouse), Some(cursor)) = (mouse.as_mut(), cursor.as_mut())
+            && let Some(down) = mouse.poll(cursor, bounds)?
+        {
+            remaining = None;
+
+            // Hovering over an entry selects it, and pressing the button boots it.
+            let hovered = screens.iter().find_map(|screen| {
+                let position = screen.locate(*cursor, bounds);
+                screen
+                    .layout
+                    .slot_at(position)
+                    .map(|slot| screen.offset + slot)
+            });
+            if let Some(entry) = hovered {
+                scene.selected = entry;
+                if down && !button_down {
+                    return Ok(scene.selected);
+                }
+            }
+            button_down = down;
+        }
+    }
+}
+
+impl BootMenu for GraphicalMenu {
+    /// Selects an entry using the graphical menu.
+    /// The menu is drawn to every display, and fails if the firmware has none.
+    fn select<'a>(
+        &self,
+        timeout: Option<Duration>,
+        entries: &'a [BootableEntry],
+    ) -> Result<&'a BootableEntry> {
+        let default = entries
+            .iter()
+            .position(|entry| entry.is_default())
+            .context("no default entry available")?;
+
+        // If the timeout is zero, boot the default entry without showing the menu.
+        if timeout.is_some_and(|timeout| timeout.is_zero()) {
+            return Ok(&entries[default]);
+        }
+
+        let mut screens = Screen::open_all(entries, self.enable_logo, self.enable_animation)?;
+        let mut mouse = self.enable_mouse.then(Mouse::open).flatten();
+
+        let result = uefi::system::with_stdin(|input| {
+            run(input, mouse.take(), &mut screens, timeout, entries, default)
+        });
+
+        // Clear the console so that anything printed after the menu is readable.
+        let _ = uefi::system::with_stdout(|output| output.clear());
+
+        Ok(&entries[result?])
+    }
+}
@@ -0,0 +1,2 @@
+// Include the generated logo in this file.
+include!(concat!(env!("OUT_DIR"), "/logo.generated.rs"));
@@ -29,6 +29,8 @@ pub struct SproutOptions {
    pub menu_style: Option<MenuStyle>,
    /// Retains the boot console before boot.
    pub retain_boot_console: bool,
+    /// Makes Sprout follow the Boot Loader Specification and systemd-boot exactly.
+    pub bls_strict_mode: bool,
 }

 /// The default Sprout options.
@@ -42,6 +44,7 @@ impl Default for SproutOptions {
            menu_timeout: None,
            menu_style: None,
            retain_boot_console: false,
+            bls_strict_mode: false,
        }
    }
 }
@@ -60,6 +63,7 @@ impl SproutOptions {
            MenuTimeout,
            MenuStyle,
            RetainBootConsole,
+            BlsStrictMode,
        }

        // All the options for the Sprout executable.
@@ -75,9 +79,11 @@ impl SproutOptions {
            Opt::value(ArgID::MenuTimeout, &["--menu-timeout"], "TIMEOUT")
                .help_text("Boot menu timeout, in seconds"),
            Opt::value(ArgID::MenuStyle, &["--menu-style"], "STYLE")
-                .help_text("Boot menu style, basic or simple"),
+                .help_text("Boot menu style, basic, simple or graphical"),
            Opt::flag(ArgID::RetainBootConsole, &["--retain-boot-console"])
                .help_text("Retain boot console before boot"),
+            Opt::flag(ArgID::BlsStrictMode, &["--bls-strict-mode"])
+                .help_text("Follow the BLS specification and systemd-boot exactly"),
        ]);

        // Acquire the arguments as determined by the UEFI core.
@@ -130,8 +136,9 @@ impl SproutOptions {
                            match value {
                                "basic" => result.menu_style = Some(MenuStyle::Basic),
                                "simple" => result.menu_style = Some(MenuStyle::Simple),
+                                "graphical" => result.menu_style = Some(MenuStyle::Graphical),
                                _ => warn!(
-                                    "ignoring invalid {} value '{}': expected basic or simple",
+                                    "ignoring invalid {} value '{}': expected basic, simple or graphical",
                                    name, value
                                ),
                            }
@@ -140,6 +147,10 @@ impl SproutOptions {
                            // Retain the boot console before booting.
                            result.retain_boot_console = true;
                        }
+                        ArgID::BlsStrictMode => {
+                            // Follow the BLS specification and systemd-boot exactly.
+                            result.bls_strict_mode = true;
+                        }
                        ArgID::Help => {
                            let ctx = HelpWriterContext {
                                options: &OPTIONS,
@@ -10,3 +10,7 @@ edition.workspace = true
 [lib]
 name = "edera_sprout_build"
 path = "src/lib.rs"
+
+# The logo is only converted on the host, and png does not build for UEFI.
+[target.'cfg(not(target_os = "uefi"))'.dependencies]
+png.workspace = true
@@ -7,6 +7,14 @@ const SBAT_BLOCK_SIZE: usize = 512;
 /// Template contents for the sbat.generated.rs file.
 const SBAT_RS_TEMPLATE: &str = include_str!("sbat.template.rs");

+/// Template contents for the logo.generated.rs file.
+#[cfg(not(target_os = "uefi"))]
+const LOGO_RS_TEMPLATE: &str = include_str!("logo.template.rs");
+
+/// The factor that the logo is shrunk by, as the source image is larger than the menu needs.
+#[cfg(not(target_os = "uefi"))]
+const LOGO_DOWNSCALE: usize = 2;
+
 /// Pad with zeros the given `data` to a multiple of `block_size`.
 fn block_pad(data: &mut Vec<u8>, block_size: usize) {
    let needed = data.len().div_ceil(block_size).max(1) * block_size;
@@ -74,3 +82,81 @@ pub fn generate_sbat_module() {
    // Write the sbat.generated.rs file to the output directory.
    fs::write(&rs_file, sbat_rs).expect("unable to write sbat.generated.rs");
 }
+
+/// Generate a logo module from the Sprout logo in the assets directory of the workspace.
+/// The logo is shrunk by averaging blocks of pixels and is stored as RGBA with premultiplied
+/// alpha, which keeps the work done at boot to blending the pixels onto the framebuffer.
+/// The output is included by a generated logo.generated.rs file.
+#[cfg(not(target_os = "uefi"))]
+pub fn generate_logo_module() {
+    use std::fs::File;
+    use std::io::BufReader;
+
+    // The output directory to place the logo files into.
+    let output_dir = PathBuf::from(env::var("OUT_DIR").expect("OUT_DIR not set"));
+
+    // The path to the root of the crate.
+    let crate_root =
+        PathBuf::from(env::var("CARGO_MANIFEST_DIR").expect("CARGO_MANIFEST_DIR not set"));
+
+    // The logo is in the assets directory at the root of the workspace.
+    let logo_file = crate_root.join("../../assets/logo-small.png");
+
+    // Notify Cargo that if the logo changes, we need to regenerate the logo files.
+    println!(
+        "cargo:rerun-if-changed={}",
+        logo_file
+            .to_str()
+            .expect("unable to convert logo path file to a string")
+    );
+
+    // Decode the logo as 8-bit RGBA, which is how the logo is stored.
+    let decoder = png::Decoder::new(BufReader::new(
+        File::open(&logo_file).expect("unable to open logo"),
+    ));
+    let mut reader = decoder.read_info().expect("unable to read logo");
+    let mut source = vec![0; reader.output_buffer_size().expect("logo is too large")];
+    let info = reader
+        .next_frame(&mut source)
+        .expect("unable to decode logo");
+    assert_eq!(info.color_type, png::ColorType::Rgba, "logo is not RGBA");
+    assert_eq!(info.bit_depth, png::BitDepth::Eight, "logo is not 8-bit");
+
+    // Any pixels on the right and bottom that don't fill a block are dropped.
+    let width = info.width as usize / LOGO_DOWNSCALE;
+    let height = info.height as usize / LOGO_DOWNSCALE;
+    let block = (LOGO_DOWNSCALE * LOGO_DOWNSCALE) as u32;
+
+    let mut pixels = Vec::with_capacity(width * height * 4);
+    for y in 0..height {
+        for x in 0..width {
+            // Sum the premultiplied channels of every pixel in the block.
+            let mut sum = [0u32; 4];
+            for by in 0..LOGO_DOWNSCALE {
+                for bx in 0..LOGO_DOWNSCALE {
+                    let index =
+                        ((y * LOGO_DOWNSCALE + by) * info.width as usize + x * LOGO_DOWNSCALE + bx)
+                            * 4;
+                    let alpha = source[index + 3] as u32;
+                    for channel in 0..3 {
+                        sum[channel] += source[index + channel] as u32 * alpha / 255;
+                    }
+                    sum[3] += alpha;
+                }
+            }
+            pixels.extend(sum.map(|channel| (channel / block) as u8));
+        }
+    }
+
+    // Write the logo.rgba file to the output directory.
+    fs::write(output_dir.join("logo.rgba"), &pixels).expect("unable to write logo.rgba");
+
+    // Generate the contents of the logo.generated.rs file.
+    let logo_rs = LOGO_RS_TEMPLATE
+        .replace("{width}", &width.to_string())
+        .replace("{height}", &height.to_string());
+
+    // Write the logo.generated.rs file to the output directory.
+    fs::write(output_dir.join("logo.generated.rs"), logo_rs)
+        .expect("unable to write logo.generated.rs");
+}
@@ -0,0 +1,8 @@
+/// The width of the Sprout logo in pixels.
+pub const LOGO_WIDTH: usize = {width};
+
+/// The height of the Sprout logo in pixels.
+pub const LOGO_HEIGHT: usize = {height};
+
+/// The pixels of the Sprout logo as rows of RGBA bytes with premultiplied alpha.
+pub static LOGO: &[u8] = include_bytes!(concat!(env!("OUT_DIR"), "/logo.rgba"));
@@ -23,4 +23,9 @@ pub struct ChainloadConfiguration {
    /// using the same mechanism as `linux-initrd`. This cannot be used with `linux-initrd`.
    #[serde(default, rename = "linux-initrd-chain")]
    pub linux_initrd_chain: Vec<String>,
+    /// An optional path to a flattened devicetree to give to the image.
+    /// It is installed as the devicetree of the machine until the image returns. It is not
+    /// used when Secure Boot is enabled, as it can't be verified.
+    #[serde(default)]
+    pub devicetree: Option<String>,
 }
@@ -10,4 +10,21 @@ pub struct DriverDeclaration {
    /// The filesystem path to the driver.
    /// This file should be an EFI executable that can be located and executed.
    pub path: String,
+    /// What the driver provides.
+    /// This decides which controllers are reconnected after the drivers are loaded.
+    #[serde(default)]
+    pub provides: DriverProvides,
+}
+
+/// What a driver provides to the firmware.
+#[derive(Serialize, Deserialize, Debug, Default, Clone, Copy, PartialEq, Eq)]
+pub enum DriverProvides {
+    /// The driver can provide anything, so every controller is reconnected.
+    #[default]
+    #[serde(rename = "any")]
+    Any,
+    /// The driver only provides filesystem or disk support,
+    /// so only the controllers that are disks or partitions are reconnected.
+    #[serde(rename = "filesystems")]
+    Filesystems,
 }
@@ -1,6 +1,10 @@
 use crate::generators::bls::BlsConfiguration;
 use crate::generators::list::ListConfiguration;
 use crate::generators::matrix::MatrixConfiguration;
+use crate::generators::variants::VariantChoice;
+use alloc::collections::BTreeMap;
+use alloc::string::String;
+use alloc::vec::Vec;
 use serde::{Deserialize, Serialize};

 /// Configuration for the BLS generator.
@@ -12,6 +16,9 @@ pub mod list;
 /// Configuration for the matrix generator.
 pub mod matrix;

+/// Configuration for generator variants.
+pub mod variants;
+
 /// Declares a generator configuration.
 /// Generators allow generating entries at runtime based on a set of data.
 #[derive(Serialize, Deserialize, Debug, Default, Clone)]
@@ -37,4 +44,29 @@ pub struct GeneratorDeclaration {
    /// List generator configuration.
    /// Allows you to specify a list of values to generate an entry from.
    pub list: Option<ListConfiguration>,
+    /// Variants to apply to every entry produced by the generator.
+    /// Each key is an axis, and each axis has a list of choices. Every generated entry
+    /// is multiplied by every combination of choices, one choice from each axis.
+    /// For example,
+    /// variants.console = [{ name = "serial" }, { name = "graphics" }]
+    /// variants.mode = [{ name = "normal" }, { name = "debug", values.mode-options = "loglevel=7" }]
+    /// would turn each generated entry into four entries:
+    /// console = serial, mode = normal
+    /// console = serial, mode = debug
+    /// console = graphics, mode = normal
+    /// console = graphics, mode = debug
+    /// The axis name is set to the name of the chosen choice, and then the values of the
+    /// chosen choice are inserted, so `$console` and `$mode-options` can be used by the entry.
+    /// The entry name is suffixed with the choice names, like `-graphics-debug`.
+    /// Axes are applied in alphabetical order. Choices are applied in the declared order.
+    #[serde(default)]
+    pub variants: BTreeMap<String, Vec<VariantChoice>>,
+    /// Rules that exclude generated entries, applied after variants.
+    /// Each rule is a map of value names to glob patterns, where `*` matches anything.
+    /// An entry is excluded if every value named in any one rule matches its pattern.
+    /// Values are matched before they are stamped. For example,
+    /// exclude = [{ version = "0-rescue-*" }, { console = "graphics", mode = "debug" }]
+    /// excludes BLS rescue entries and the combination of the graphics and debug variants.
+    #[serde(default)]
+    pub exclude: Vec<BTreeMap<String, String>>,
 }
@@ -1,22 +1,144 @@
 use crate::entries::EntryDeclaration;
+use alloc::format;
 use alloc::string::{String, ToString};
 use serde::{Deserialize, Serialize};

 /// The default path to the BLS directory.
 const BLS_TEMPLATE_PATH: &str = "\\loader";

+/// The directory of unified kernel images, relative to the root of the filesystem.
+const BLS_UKI_DIRECTORY: &str = "\\EFI\\Linux";
+
 /// The configuration of the BLS generator.
 /// The BLS uses the Bootloader Specification to produce
 /// entries from an input template.
-#[derive(Serialize, Deserialize, Debug, Default, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct BlsConfiguration {
    /// The entry to use for as a template.
    pub entry: EntryDeclaration,
    /// The path to the BLS directory.
    #[serde(default = "default_bls_path")]
    pub path: String,
+    /// The path to the directory of unified kernel images, which are BLS Type #2 entries.
+    /// Every `.efi` file in the directory becomes an entry. When this is not set, the
+    /// directory is `\EFI\Linux` on the same device as `path`. An empty path disables
+    /// unified kernel images. Two generators that read the same directory produce entries
+    /// with the same names, so they should not both scan it.
+    #[serde(default, rename = "uki-path")]
+    pub uki_path: Option<String>,
+    /// Whether to also read the Extended Boot Loader Partition, which is the partition with the
+    /// XBOOTLDR type on the same disk as the partition Sprout was loaded from. Its entries are
+    /// sorted with the others, and their paths are on that partition, so an action has to use
+    /// the `$entry-root` value to find them, such as `$entry-root\\$chainload`. Its unified kernel
+    /// images are always in `\\EFI\\Linux`.
+    #[serde(default)]
+    pub xbootldr: bool,
+    /// Whether generated entries keep the name of the BLS entry file as-is.
+    /// When enabled, the generator name is not prepended, so the entry names match
+    /// the BLS entry ids used by tools like `bootctl set-default`. Variants still append
+    /// their choice names, so entries of a generator with variants never match the ids
+    /// exactly, and are best selected with a pattern like `<id>-*`. Two BLS generators
+    /// that read the same BLS directory will produce entries with the same names, so
+    /// generators that reuse a BLS directory should disable this.
+    #[serde(default = "default_pin_names", rename = "pin-names")]
+    pub pin_names: bool,
+}
+
+impl BlsConfiguration {
+    /// The device of the stamped BLS path `bls_path`, which is everything up to the last slash,
+    /// and which is empty for a path on the partition Sprout was loaded from.
+    pub fn root_of(bls_path: &str) -> &str {
+        bls_path.rfind('/').map_or("", |index| &bls_path[..=index])
+    }
+
+    /// The directory of unified kernel images for the stamped BLS path `bls_path`,
+    /// or None if unified kernel images are disabled.
+    pub fn uki_path_for(&self, bls_path: &str) -> Option<String> {
+        match self.uki_path.as_deref() {
+            Some("") => None,
+            Some(path) => Some(path.to_string()),
+            // Keep the device of the BLS path, which is everything up to the last slash.
+            None => Some(format!("{}{}", Self::root_of(bls_path), BLS_UKI_DIRECTORY)),
+        }
+    }
+}
+
+/// The default configuration, which matches an empty BLS generator section.
+impl Default for BlsConfiguration {
+    fn default() -> Self {
+        Self {
+            entry: Default::default(),
+            path: default_bls_path(),
+            uki_path: None,
+            xbootldr: false,
+            pin_names: default_pin_names(),
+        }
+    }
+}
+
+fn default_pin_names() -> bool {
+    true
 }

 fn default_bls_path() -> String {
    BLS_TEMPLATE_PATH.to_string()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn root_is_the_device_of_the_bls_path() {
+        assert_eq!(BlsConfiguration::root_of("\\loader"), "");
+        assert_eq!(
+            BlsConfiguration::root_of("PciRoot(0x0)/HD(2,GPT,abc)/\\loader"),
+            "PciRoot(0x0)/HD(2,GPT,abc)/"
+        );
+    }
+
+    #[test]
+    fn xbootldr_is_off_by_default() {
+        assert!(!BlsConfiguration::default().xbootldr);
+    }
+
+    #[test]
+    fn uki_path_is_next_to_the_default_bls_path() {
+        let bls = BlsConfiguration::default();
+        assert_eq!(
+            bls.uki_path_for("\\loader").as_deref(),
+            Some("\\EFI\\Linux")
+        );
+    }
+
+    #[test]
+    fn uki_path_follows_the_device_of_the_bls_path() {
+        let bls = BlsConfiguration::default();
+        assert_eq!(
+            bls.uki_path_for("PciRoot(0x0)/HD(2,GPT,abc)/\\loader")
+                .as_deref(),
+            Some("PciRoot(0x0)/HD(2,GPT,abc)/\\EFI\\Linux")
+        );
+    }
+
+    #[test]
+    fn explicit_uki_path_is_used_as_is() {
+        let bls = BlsConfiguration {
+            uki_path: Some("\\uki".to_string()),
+            ..Default::default()
+        };
+        assert_eq!(
+            bls.uki_path_for("HD(2,GPT,abc)/\\loader").as_deref(),
+            Some("\\uki")
+        );
+    }
+
+    #[test]
+    fn empty_uki_path_disables_unified_kernel_images() {
+        let bls = BlsConfiguration {
+            uki_path: Some(String::new()),
+            ..Default::default()
+        };
+        assert_eq!(bls.uki_path_for("\\loader"), None);
+    }
+}
@@ -0,0 +1,15 @@
+use alloc::collections::BTreeMap;
+use alloc::string::String;
+use serde::{Deserialize, Serialize};
+
+/// A single choice of a variant axis.
+/// See [crate::generators::GeneratorDeclaration::variants] for how variants are applied.
+#[derive(Serialize, Deserialize, Debug, Default, Clone)]
+pub struct VariantChoice {
+    /// The name of the choice. This is set as the value of the axis name,
+    /// and is appended to the name of each entry the choice applies to.
+    pub name: String,
+    /// The values to insert into the context of each entry the choice applies to.
+    #[serde(default)]
+    pub values: BTreeMap<String, String>,
+}
@@ -38,6 +38,9 @@ pub struct RootConfiguration {
    /// Default options for Sprout.
    #[serde(default)]
    pub options: OptionsConfiguration,
+    /// Settings for each style of boot menu.
+    #[serde(rename = "menu-styles", default)]
+    pub menu_styles: MenuStylesConfiguration,
    /// Values to be inserted into the root sprout context.
    #[serde(default)]
    pub values: BTreeMap<String, String>,
@@ -81,15 +84,64 @@ pub struct OptionsConfiguration {
    /// The entry to mark as the default entry, instead of the first entry.
    #[serde(rename = "default-entry", default)]
    pub default_entry: Option<String>,
-    /// The timeout of the boot menu.
-    #[serde(rename = "menu-timeout", default = "default_menu_timeout")]
-    pub menu_timeout: u64,
+    /// The timeout of the boot menu in seconds. When unset, the timeout comes from the
+    /// bootloader interface or `loader.conf`, falling back to [DEFAULT_MENU_TIMEOUT_SECONDS].
+    #[serde(rename = "menu-timeout", default)]
+    pub menu_timeout: Option<u64>,
    /// The style of boot menu to display.
    #[serde(rename = "menu-style", default)]
    pub menu_style: MenuStyle,
    /// Enables autoconfiguration of Sprout based on the environment.
    #[serde(default)]
    pub autoconfigure: bool,
+    /// Makes Sprout follow the Boot Loader Specification and systemd-boot exactly where it
+    /// otherwise differs for convenience or safety. For example, the extended boot loader
+    /// partition is always read, a one-shot entry only sets the default entry, and entries with
+    /// missing files are hidden. See docs/config.md for everything it changes.
+    #[serde(rename = "bls-strict-mode", default)]
+    pub bls_strict_mode: bool,
+}
+
+/// Settings for each style of boot menu.
+#[derive(Serialize, Deserialize, Debug, Default, Clone)]
+pub struct MenuStylesConfiguration {
+    /// Settings for the graphical boot menu.
+    #[serde(default)]
+    pub graphical: GraphicalMenuConfiguration,
+}
+
+/// Settings for the graphical boot menu.
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct GraphicalMenuConfiguration {
+    /// Enables selecting entries with the mouse, and shows the cursor. When disabled, or when
+    /// the firmware has no pointing device, entries are selected with the keyboard only.
+    #[serde(rename = "enable-mouse", default)]
+    pub enable_mouse: bool,
+
+    /// Shows the Sprout logo next to the name above the entries. When disabled, only the name is
+    /// shown.
+    #[serde(rename = "enable-logo", default = "default_true")]
+    pub enable_logo: bool,
+
+    /// Animates the logo, which bounces. When disabled, the logo stays still.
+    #[serde(rename = "enable-animation", default = "default_true")]
+    pub enable_animation: bool,
+}
+
+/// The default graphical menu settings, which match an empty graphical section.
+impl Default for GraphicalMenuConfiguration {
+    fn default() -> Self {
+        Self {
+            enable_mouse: false,
+            enable_logo: true,
+            enable_animation: true,
+        }
+    }
+}
+
+/// The default for settings that are on unless they are turned off.
+fn default_true() -> bool {
+    true
 }

 /// The default configuration, which matches an empty configuration file.
@@ -98,6 +150,7 @@ impl Default for RootConfiguration {
        Self {
            version: latest_version(),
            options: Default::default(),
+            menu_styles: Default::default(),
            values: Default::default(),
            drivers: Default::default(),
            extractors: Default::default(),
@@ -114,9 +167,10 @@ impl Default for OptionsConfiguration {
    fn default() -> Self {
        Self {
            default_entry: None,
-            menu_timeout: default_menu_timeout(),
+            menu_timeout: None,
            menu_style: Default::default(),
            autoconfigure: false,
+            bls_strict_mode: false,
        }
    }
 }
@@ -131,6 +185,9 @@ pub enum MenuStyle {
    #[default]
    #[serde(rename = "simple")]
    Simple,
+    /// A graphical menu that selects entries with the keyboard or the mouse.
+    #[serde(rename = "graphical")]
+    Graphical,
 }

 /// Get the latest version of the Sprout configuration format.
@@ -138,10 +195,6 @@ pub fn latest_version() -> u32 {
    LATEST_VERSION
 }

-fn default_menu_timeout() -> u64 {
-    DEFAULT_MENU_TIMEOUT_SECONDS
-}
-
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -165,10 +218,40 @@ mod tests {
    }

    #[test]
-    fn default_menu_timeout_is_not_zero() {
-        assert_eq!(
-            RootConfiguration::default().options.menu_timeout,
-            DEFAULT_MENU_TIMEOUT_SECONDS
+    fn graphical_mouse_is_off_by_default() {
+        assert!(
+            !RootConfiguration::default()
+                .menu_styles
+                .graphical
+                .enable_mouse
        );
+        assert!(!empty().menu_styles.graphical.enable_mouse);
+    }
+
+    #[test]
+    fn graphical_logo_and_animation_are_on_by_default() {
+        let graphical = RootConfiguration::default().menu_styles.graphical;
+        assert!(graphical.enable_logo);
+        assert!(graphical.enable_animation);
+        let graphical = empty().menu_styles.graphical;
+        assert!(graphical.enable_logo);
+        assert!(graphical.enable_animation);
+    }
+
+    #[test]
+    fn bls_strict_mode_is_off_by_default() {
+        assert!(!RootConfiguration::default().options.bls_strict_mode);
+        assert!(!empty().options.bls_strict_mode);
+    }
+
+    #[test]
+    fn menu_timeout_is_unset_by_default() {
+        assert_eq!(RootConfiguration::default().options.menu_timeout, None);
+        assert_eq!(empty().options.menu_timeout, None);
+    }
+
+    #[test]
+    fn default_menu_timeout_is_not_zero() {
+        assert_ne!(DEFAULT_MENU_TIMEOUT_SECONDS, 0);
    }
 }
@@ -11,7 +11,6 @@ edition.workspace = true
 anyhow.workspace = true
 bitflags.workspace = true
 log.workspace = true
-shlex.workspace = true
 spin.workspace = true
 uefi.workspace = true
 uefi-raw.workspace = true
@@ -13,8 +13,8 @@ use uefi_raw::table::runtime::VariableVendor;
 /// bitflags: LoaderFeatures bitflags.
 mod bitflags;

-/// The name of the bootloader to tell the system.
-const LOADER_NAME: &str = "Sprout";
+/// The name and version of the bootloader to tell the system.
+const LOADER_NAME: &str = concat!("Sprout ", env!("CARGO_PKG_VERSION"));

 /// Represents the configured timeout for the bootloader interface.
 #[derive(Default)]
@@ -34,6 +34,16 @@ pub enum BootloaderInterfaceTimeout {
    Unspecified,
 }

+/// The timeouts set in the bootloader interface.
+/// The one-shot timeout only applies to this boot, so it ranks above everything else.
+#[derive(Default)]
+pub struct BootloaderInterfaceTimeouts {
+    /// The timeout from LoaderConfigTimeoutOneShot.
+    pub oneshot: BootloaderInterfaceTimeout,
+    /// The timeout from LoaderConfigTimeout.
+    pub direct: BootloaderInterfaceTimeout,
+}
+
 /// Bootloader Interface support.
 pub struct BootloaderInterface;

@@ -46,7 +56,6 @@ impl BootloaderInterface {
    /// The feature we support in Sprout.
    fn features() -> LoaderFeatures {
        LoaderFeatures::Xbootldr
-            | LoaderFeatures::LoadDriver
            | LoaderFeatures::Tpm2ActivePcrBanks
            | LoaderFeatures::RetainShim
            | LoaderFeatures::ConfigTimeout
@@ -54,6 +63,12 @@ impl BootloaderInterface {
            | LoaderFeatures::MenuDisable
            | LoaderFeatures::EntryDefault
            | LoaderFeatures::EntryOneShot
+            | LoaderFeatures::BootCounting
+            | LoaderFeatures::SavedEntry
+            | LoaderFeatures::EntryPreferred
+            | LoaderFeatures::SortKey
+            | LoaderFeatures::DeviceTree
+            | LoaderFeatures::MultiProfileUki
    }

    /// Tell the system that Sprout was initialized at the current time.
@@ -263,45 +278,67 @@ impl BootloaderInterface {
        Ok(Some(BootloaderInterfaceTimeout::Timeout(value)))
    }

-    /// Get the timeout from the bootloader interface.
+    /// Get the timeouts from the bootloader interface.
    /// This indicates how the menu should behave.
-    /// If no values are set, Unspecified is returned.
-    pub fn get_timeout() -> Result<BootloaderInterfaceTimeout> {
+    /// A timeout that is not set is Unspecified.
+    pub fn get_timeouts() -> Result<BootloaderInterfaceTimeouts> {
        // Attempt to acquire the value of the LoaderConfigTimeoutOneShot variable.
-        // This should take precedence over the LoaderConfigTimeout variable.
-        let oneshot = Self::get_timeout_value("LoaderConfigTimeoutOneShot", true)
-            .context("unable to check for LoaderConfigTimeoutOneShot variable")?;
-
-        // If oneshot was found, return it.
        // The specification says the one-shot timeout shows the menu on this boot,
        // and a value of 0 means the menu waits for the user.
-        if let Some(oneshot) = oneshot {
-            return Ok(match oneshot {
+        let oneshot = Self::get_timeout_value("LoaderConfigTimeoutOneShot", true)
+            .context("unable to check for LoaderConfigTimeoutOneShot variable")?
+            .map(|oneshot| match oneshot {
                BootloaderInterfaceTimeout::Timeout(0) => BootloaderInterfaceTimeout::MenuForce,
                BootloaderInterfaceTimeout::Timeout(value) => {
                    BootloaderInterfaceTimeout::MenuForceTimeout(value)
                }
                other => other,
-            });
-        }
+            })
+            .unwrap_or_default();

        // Attempt to acquire the value of the LoaderConfigTimeout variable.
-        // This will be used if the LoaderConfigTimeoutOneShot variable is not set.
-        let direct = Self::get_timeout_value("LoaderConfigTimeout", false)
-            .context("unable to check for LoaderConfigTimeout variable")?;
-
-        // If direct was found, return it.
        // The specification says that a value of 0 means that the menu should be hidden.
-        if let Some(direct) = direct {
-            return Ok(match direct {
+        // A failure to read it is only a warning, as the one-shot variable is already consumed.
+        let direct = Self::get_timeout_value("LoaderConfigTimeout", false)
+            .context("unable to check for LoaderConfigTimeout variable")
+            .unwrap_or_else(|error| {
+                warn!("{:#}", error);
+                None
+            })
+            .map(|direct| match direct {
                BootloaderInterfaceTimeout::Timeout(0) => BootloaderInterfaceTimeout::MenuHidden,
                other => other,
-            });
-        }
+            })
+            .unwrap_or_default();

-        // If we reach here, we know that neither variable was set.
-        // We provide the unspecified value instead.
-        Ok(BootloaderInterfaceTimeout::Unspecified)
+        Ok(BootloaderInterfaceTimeouts { oneshot, direct })
+    }
+
+    /// Tell the system the path of the entry file whose boot counter was updated, relative
+    /// to the partition root, so that it can be marked as good once the boot succeeds.
+    pub fn set_boot_count_path(path: &str) -> Result<()> {
+        Self::VENDOR.set_cstr16(
+            "LoaderBootCountPath",
+            path,
+            VariableClass::BootAndRuntimeTemporary,
+        )
+    }
+
+    /// Get the entry that was saved by the previous boot, if any.
+    pub fn get_last_booted_entry() -> Result<Option<String>> {
+        Ok(Self::VENDOR
+            .get_cstr16("LoaderEntryLastBooted")
+            .context("unable to get last booted entry from bootloader interface")?
+            .filter(|value| !value.is_empty()))
+    }
+
+    /// Save the entry that is booting, so a later boot can select it again.
+    pub fn set_last_booted_entry(entry: &str) -> Result<()> {
+        Self::VENDOR.set_cstr16(
+            "LoaderEntryLastBooted",
+            entry,
+            VariableClass::BootAndRuntimePersistent,
+        )
    }

    /// Get the default entry set by the bootloader interface.
@@ -313,6 +350,21 @@ impl BootloaderInterface {
            .filter(|value| !value.is_empty()))
    }

+    /// Get the preferred entry set by the bootloader interface.
+    /// Unlike the default entry, an entry with no boot counter tries left is not used.
+    pub fn get_preferred_entry() -> Result<Option<String>> {
+        // An empty value is treated as if the preferred entry was not set.
+        Ok(Self::VENDOR
+            .get_cstr16("LoaderEntryPreferred")
+            .context("unable to get preferred entry from bootloader interface")?
+            .filter(|value| !value.is_empty()))
+    }
+
+    /// Remove the entry that was saved by a previous boot.
+    pub fn remove_last_booted_entry() -> Result<()> {
+        Self::VENDOR.remove("LoaderEntryLastBooted")
+    }
+
    /// Get the oneshot entry set by the bootloader interface.
    /// This should be the entry we boot.
    pub fn get_oneshot_entry() -> Result<Option<String>> {
@@ -42,5 +42,11 @@ bitflags! {
        const Type1UkiUrl = 1 << 17;
        /// Bootloader indicates TPM2 active PCR banks.
        const Tpm2ActivePcrBanks = 1 << 18;
+        /// Bootloader supports LoaderEntryPreferred.
+        const EntryPreferred = 1 << 19;
+        /// Bootloader supports the keyboard layout.
+        const KeyboardLayout = 1 << 20;
+        /// Bootloader measures SMBIOS data.
+        const SmbiosMeasured = 1 << 21;
    }
 }
@@ -0,0 +1,192 @@
+use crate::handle::find_handle;
+use anyhow::{Context, Result, anyhow, bail};
+use core::ffi::c_void;
+use core::ptr::{self, NonNull};
+use log::{info, warn};
+use uefi::boot::{AllocateType, MemoryType, PAGE_SIZE};
+use uefi::proto::unsafe_protocol;
+use uefi_raw::{Guid, Status, guid};
+
+/// The configuration table that holds the flattened devicetree.
+const DTB_TABLE_GUID: Guid = guid!("b1b621d5-f19c-41a5-830b-d9152c69aae0");
+
+/// The protocol that firmware such as U-Boot provides to patch a devicetree for the machine.
+const DT_FIXUP_GUID: Guid = guid!("e617d64c-fe08-46da-f4dc-bbd5870c7300");
+
+/// The magic number at the start of a flattened devicetree.
+const FDT_MAGIC: u32 = 0xd00d_feed;
+
+/// The size of the fixed header of a flattened devicetree.
+const FDT_HEADER_SIZE: usize = 7 * 4;
+
+/// The largest devicetree that is accepted. The Linux stub copies it into a smaller buffer.
+const MAX_DTB_SIZE: usize = 32 * 1024 * 1024;
+
+/// Apply the fixups for the machine to the devicetree.
+const DT_APPLY_FIXUPS: u32 = 0x1;
+
+/// Reserve the memory that the devicetree says to reserve.
+const DT_RESERVE_MEMORY: u32 = 0x2;
+
+/// The protocol that patches a devicetree for the machine.
+#[unsafe_protocol(DT_FIXUP_GUID)]
+#[repr(C)]
+struct DtFixupProtocol {
+    revision: u64,
+    fixup: unsafe extern "efiapi" fn(
+        this: *mut DtFixupProtocol,
+        fdt: *mut c_void,
+        buffer_size: *mut usize,
+        flags: u32,
+    ) -> Status,
+}
+
+/// A devicetree that is installed for the image that is about to start. When this is dropped,
+/// which is when the image returned or failed to start, the devicetree of the firmware is
+/// put back and the memory is freed.
+pub struct DeviceTree {
+    /// The pages that hold the devicetree.
+    pages: NonNull<u8>,
+    /// The number of pages.
+    count: usize,
+    /// The devicetree table of the firmware, which is null if there was none.
+    original: *const c_void,
+    /// Whether the table points to the pages.
+    installed: bool,
+}
+
+impl DeviceTree {
+    /// Check that `dtb` looks like a flattened devicetree that can be installed.
+    fn validate(dtb: &[u8]) -> Result<()> {
+        if dtb.len() < FDT_HEADER_SIZE || dtb.len() > MAX_DTB_SIZE {
+            bail!("the devicetree is {} bytes, which is not valid", dtb.len());
+        }
+        // The header is big endian: the magic number, then the total size.
+        let magic = u32::from_be_bytes([dtb[0], dtb[1], dtb[2], dtb[3]]);
+        let total = u32::from_be_bytes([dtb[4], dtb[5], dtb[6], dtb[7]]) as usize;
+        if magic != FDT_MAGIC {
+            bail!("the file is not a flattened devicetree");
+        }
+        if total < FDT_HEADER_SIZE || total > dtb.len() {
+            bail!("the devicetree has an invalid size");
+        }
+        Ok(())
+    }
+
+    /// Allocate `count` pages of memory that belongs to the firmware tables, as a devicetree
+    /// has to be in memory of the type that ACPI tables are in.
+    fn allocate(count: usize) -> Result<NonNull<u8>> {
+        uefi::boot::allocate_pages(AllocateType::AnyPages, MemoryType::ACPI_RECLAIM, count)
+            .context("unable to allocate memory for the devicetree")
+    }
+
+    /// Install `dtb` as the devicetree of the machine until the returned value is dropped.
+    pub fn install(dtb: &[u8]) -> Result<Self> {
+        Self::validate(dtb)?;
+
+        // Remember the table of the firmware so it can be put back.
+        let original = uefi::system::with_config_table(|tables| {
+            tables
+                .iter()
+                .find(|entry| entry.guid == DTB_TABLE_GUID)
+                .map(|entry| entry.address)
+                .unwrap_or(ptr::null())
+        });
+
+        let count = dtb.len().div_ceil(PAGE_SIZE);
+        let pages = Self::allocate(count)?;
+        // SAFETY: The pages are at least as large as the devicetree, and don't overlap it.
+        unsafe { ptr::copy_nonoverlapping(dtb.as_ptr(), pages.as_ptr(), dtb.len()) };
+        let mut tree = Self {
+            pages,
+            count,
+            original,
+            installed: false,
+        };
+
+        tree.fixup(dtb)?;
+
+        // SAFETY: The table points to pages that stay allocated until this is dropped, which
+        // puts the original table back before the pages are freed.
+        unsafe {
+            uefi::boot::install_configuration_table(&DTB_TABLE_GUID, tree.pages.as_ptr().cast())
+        }
+        .context("unable to install the devicetree")?;
+        tree.installed = true;
+
+        info!(
+            "installed the devicetree at {:p} ({} bytes)",
+            tree.pages.as_ptr(),
+            dtb.len()
+        );
+        Ok(tree)
+    }
+
+    /// Let the firmware patch the devicetree for the machine, if it can.
+    fn fixup(&mut self, dtb: &[u8]) -> Result<()> {
+        let Some(handle) = find_handle(&DT_FIXUP_GUID)? else {
+            return Ok(());
+        };
+        // Without the protocol the devicetree is used as it is, as in systemd-boot.
+        let Ok(mut protocol) = crate::handle::open_shared::<DtFixupProtocol>(handle) else {
+            warn!("unable to open the devicetree fixup protocol, skipping the fixup");
+            return Ok(());
+        };
+        let fixup = protocol.fixup;
+        let this: *mut DtFixupProtocol = &mut *protocol;
+        let flags = DT_APPLY_FIXUPS | DT_RESERVE_MEMORY;
+
+        // The firmware gets all the memory that was allocated. If that is not enough, it says
+        // how much it needs, and it is given a copy of the original in a larger allocation.
+        let mut size = self.count * PAGE_SIZE;
+        // SAFETY: The pages are valid for the size that is passed.
+        let mut status = unsafe { fixup(this, self.pages.as_ptr().cast(), &mut size, flags) };
+        if status == Status::BUFFER_TOO_SMALL {
+            let count = size.div_ceil(PAGE_SIZE);
+            let pages = Self::allocate(count)?;
+            // SAFETY: The new pages are larger than the devicetree, and don't overlap it.
+            unsafe { ptr::copy_nonoverlapping(dtb.as_ptr(), pages.as_ptr(), dtb.len()) };
+            // SAFETY: The old pages came from the same allocator and nothing refers to them yet.
+            if let Err(error) = unsafe { uefi::boot::free_pages(self.pages, self.count) } {
+                warn!("unable to free the devicetree memory: {}", error);
+            }
+            self.pages = pages;
+            self.count = count;
+            size = count * PAGE_SIZE;
+            // SAFETY: The new pages are valid for the size that is passed.
+            status = unsafe { fixup(this, self.pages.as_ptr().cast(), &mut size, flags) };
+        }
+        if status != Status::SUCCESS {
+            return Err(anyhow!("the devicetree fixup failed: {:?}", status));
+        }
+        Ok(())
+    }
+}
+
+impl Drop for DeviceTree {
+    fn drop(&mut self) {
+        if self.installed {
+            // SAFETY: This puts back the table that the firmware had, which is null if it had
+            // none, and which removes the table.
+            let result =
+                unsafe { uefi::boot::install_configuration_table(&DTB_TABLE_GUID, self.original) };
+            if let Err(error) = result {
+                // The table can still point to the pages, so they must not be freed.
+                if !(error.status() == Status::NOT_FOUND && self.original.is_null()) {
+                    warn!("unable to restore the devicetree: {}", error);
+                    return;
+                }
+            }
+        }
+        if self.installed {
+            info!(
+                "restored the devicetree table of the firmware ({:p})",
+                self.original
+            );
+        }
+        // SAFETY: Nothing refers to the pages any more.
+        if let Err(error) = unsafe { uefi::boot::free_pages(self.pages, self.count) } {
+            warn!("unable to free the devicetree memory: {}", error);
+        }
+    }
+}
@@ -1,4 +1,4 @@
-use alloc::string::{String, ToString};
+use alloc::string::String;
 use alloc::vec::Vec;
 use anyhow::{Context, Result};
 use uefi::proto::loaded_image::LoadedImage;
@@ -33,14 +33,9 @@ pub fn args() -> Result<Vec<String>> {
        .collect::<Vec<u16>>();
    let options = String::from_utf16_lossy(&options);

-    // Use shlex to parse the options.
-    // If shlex fails, we will perform a simple whitespace split.
-    let mut args = shlex::split(&options).unwrap_or_else(|| {
-        options
-            .split_ascii_whitespace()
-            .map(|string| string.to_string())
-            .collect::<Vec<_>>()
-    });
+    // Split the options on whitespace, keeping quoted text together.
+    // Backslashes are kept as they are, since UEFI paths use them as separators.
+    let mut args = split_options(&options);

    // Correct firmware that may add invalid arguments at the start.
    // Witnessed this on a Dell Precision 5690 when direct booting.
@@ -66,3 +61,38 @@ pub fn args() -> Result<Vec<String>> {

    Ok(args)
 }
+
+/// Splits `options` into arguments on whitespace. Text in single or double quotes is kept together.
+fn split_options(options: &str) -> Vec<String> {
+    let mut args = Vec::new();
+    let mut current = String::new();
+    let mut in_arg = false;
+    let mut quote = None;
+
+    for c in options.chars() {
+        match quote {
+            Some(q) if c == q => quote = None,
+            Some(_) => current.push(c),
+            None if c == '"' || c == '\'' => {
+                quote = Some(c);
+                in_arg = true;
+            }
+            None if c.is_whitespace() => {
+                if in_arg {
+                    args.push(core::mem::take(&mut current));
+                    in_arg = false;
+                }
+            }
+            None => {
+                current.push(c);
+                in_arg = true;
+            }
+        }
+    }
+
+    if in_arg {
+        args.push(current);
+    }
+
+    args
+}
@@ -1,8 +1,11 @@
 use alloc::vec;
 use alloc::vec::Vec;
-use anyhow::{Context, Result};
+use anyhow::{Context, Result, bail};
 use uefi::proto::console::gop::{BltOp, BltPixel, BltRegion, GraphicsOutput};

+/// How many unchanged rows may sit between changed rows before they are blitted separately.
+const BAND_GAP: usize = 8;
+
 /// Represents the EFI framebuffer.
 pub struct Framebuffer {
    /// The width of the framebuffer in pixels.
@@ -31,6 +34,30 @@ impl Framebuffer {
        })
    }

+    /// The width of the framebuffer in pixels.
+    pub fn width(&self) -> usize {
+        self.width
+    }
+
+    /// The height of the framebuffer in pixels.
+    pub fn height(&self) -> usize {
+        self.height
+    }
+
+    /// Fill the rectangle at `x` and `y` of `width` and `height` with `color`.
+    /// The parts of the rectangle outside of the framebuffer are not drawn.
+    pub fn fill_rect(&mut self, x: usize, y: usize, width: usize, height: usize, color: BltPixel) {
+        let end_x = x.saturating_add(width).min(self.width);
+        let end_y = y.saturating_add(height).min(self.height);
+        if x >= end_x {
+            return;
+        }
+        for row in y..end_y {
+            // The row and columns are in bounds, so its range is within the pixels.
+            self.pixels[row * self.width + x..row * self.width + end_x].fill(color);
+        }
+    }
+
    /// Mutably acquires a pixel of the framebuffer at the specified `x` and `y` coordinate.
    pub fn pixel(&mut self, x: usize, y: usize) -> Option<&mut BltPixel> {
        // Verify that the coordinates are within the bounds of the framebuffer.
@@ -44,6 +71,11 @@ impl Framebuffer {
        self.pixels.get_mut(index)
    }

+    /// Replace the pixels of the framebuffer with those of `other`, which must be the same size.
+    pub fn copy_from(&mut self, other: &Framebuffer) {
+        self.pixels.copy_from_slice(&other.pixels);
+    }
+
    /// Blit the framebuffer to the specified `gop` [GraphicsOutput].
    pub fn blit(&self, gop: &mut GraphicsOutput) -> Result<()> {
        gop.blt(BltOp::BufferToVideo {
@@ -55,4 +87,63 @@ impl Framebuffer {
        .context("unable to blit framebuffer")?;
        Ok(())
    }
+
+    /// Blit only what is different from `previous`, which must be the same size, to the specified
+    /// `gop` [GraphicsOutput]. Changes that are far apart vertically are blitted separately, so
+    /// that the pixels between them are not sent to the display.
+    pub fn blit_changes(&self, previous: &Framebuffer, gop: &mut GraphicsOutput) -> Result<()> {
+        if self.width != previous.width || self.height != previous.height {
+            bail!("framebuffer sizes differ");
+        }
+
+        // The top, bottom, left and right of the changed rows that haven't been blitted yet.
+        let mut band: Option<(usize, usize, usize, usize)> = None;
+        let mut quiet = 0;
+        for row in 0..self.height {
+            let range = row * self.width..(row + 1) * self.width;
+            let (now, before) = (&self.pixels[range.clone()], &previous.pixels[range]);
+            let differs = |(now, before): (&BltPixel, &BltPixel)| {
+                (now.red, now.green, now.blue) != (before.red, before.green, before.blue)
+            };
+            let first = now.iter().zip(before).position(differs);
+            let Some(first) = first else {
+                quiet += 1;
+                if quiet > BAND_GAP
+                    && let Some(band) = band.take()
+                {
+                    self.blit_region(gop, band)?;
+                }
+                continue;
+            };
+            let last = now.iter().zip(before).rposition(differs).unwrap_or(first);
+            quiet = 0;
+            band = Some(match band {
+                Some((top, _, left, right)) => (top, row + 1, left.min(first), right.max(last + 1)),
+                None => (row, row + 1, first, last + 1),
+            });
+        }
+        if let Some(band) = band {
+            self.blit_region(gop, band)?;
+        }
+        Ok(())
+    }
+
+    /// Blit the region of the `top`, `bottom`, `left` and `right` to the specified `gop`.
+    fn blit_region(
+        &self,
+        gop: &mut GraphicsOutput,
+        (top, bottom, left, right): (usize, usize, usize, usize),
+    ) -> Result<()> {
+        gop.blt(BltOp::BufferToVideo {
+            buffer: &self.pixels,
+            src: BltRegion::SubRectangle {
+                coords: (left, top),
+                px_stride: self.width,
+            },
+            dest: (left, top),
+            dims: (right - left, bottom - top),
+        })
+        .context("unable to blit framebuffer region")?;
+        Ok(())
+    }
 }
@@ -1,5 +1,6 @@
 use anyhow::{Context, Result};
-use uefi::boot::SearchType;
+use uefi::boot::{OpenProtocolAttributes, OpenProtocolParams, ScopedProtocol, SearchType};
+use uefi::proto::ProtocolPointer;
 use uefi::{Guid, Handle};
 use uefi_raw::Status;

@@ -24,3 +25,21 @@ pub fn find_handle(protocol: &Guid) -> Result<Option<Handle>> {
        }
    }
 }
+
+/// Open the protocol `P` on `handle` without taking it from the firmware.
+/// An exclusive open makes the firmware disconnect every driver that is using the protocol,
+/// which for a disk or a partition would remove the filesystem Sprout is running from.
+pub fn open_shared<P: ProtocolPointer + ?Sized>(handle: Handle) -> uefi::Result<ScopedProtocol<P>> {
+    // SAFETY: The protocols opened this way are only used from this thread, and the firmware
+    // keeps them installed for as long as they are open.
+    unsafe {
+        uefi::boot::open_protocol::<P>(
+            OpenProtocolParams {
+                handle,
+                agent: uefi::boot::image_handle(),
+                controller: None,
+            },
+            OpenProtocolAttributes::GetProtocol,
+        )
+    }
+}
@@ -6,6 +6,9 @@
 #![no_std]
 extern crate alloc;

+/// Installing a devicetree for the image that is started.
+pub mod devicetree;
+
 /// EFI handle helpers.
 pub mod handle;

@@ -27,6 +30,9 @@ pub mod platform;
 /// Secure Boot support.
 pub mod secure;

+/// Finding the Extended Boot Loader Partition.
+pub mod xbootldr;
+
 /// Support for the shim loader application that enables Secure Boot.
 pub mod shim;

@@ -14,6 +14,8 @@ use uefi_raw::table::runtime::{VariableAttributes, VariableVendor};
 pub enum VariableClass {
    /// The variable is available in Boot Services and Runtime Services and is not persistent.
    BootAndRuntimeTemporary,
+    /// The variable is available in Boot Services and Runtime Services and is persistent.
+    BootAndRuntimePersistent,
 }

 impl VariableClass {
@@ -23,6 +25,11 @@ impl VariableClass {
            VariableClass::BootAndRuntimeTemporary => {
                VariableAttributes::BOOTSERVICE_ACCESS | VariableAttributes::RUNTIME_ACCESS
            }
+            VariableClass::BootAndRuntimePersistent => {
+                VariableAttributes::BOOTSERVICE_ACCESS
+                    | VariableAttributes::RUNTIME_ACCESS
+                    | VariableAttributes::NON_VOLATILE
+            }
        }
    }
 }
@@ -0,0 +1,82 @@
+use crate::handle::open_shared;
+use alloc::boxed::Box;
+use alloc::vec::Vec;
+use anyhow::{Context, Result};
+use uefi::proto::device_path::{DevicePath, DevicePathNode, DeviceSubType, DeviceType};
+use uefi::proto::media::fs::SimpleFileSystem;
+use uefi::proto::media::partition::PartitionInfo;
+use uefi::{Guid, guid};
+
+/// The GPT partition type of the Extended Boot Loader Partition.
+/// Reference: <https://uapi-group.org/specifications/specs/boot_loader_specification/>
+pub const XBOOTLDR_PARTITION_TYPE: Guid = guid!("bc13c2ff-59e6-4262-a352-b275fd6f7172");
+
+/// Whether `node` is the node of a partition on a hard drive.
+fn is_hard_drive_node(node: &DevicePathNode) -> bool {
+    node.full_type() == (DeviceType::MEDIA, DeviceSubType::MEDIA_HARD_DRIVE)
+}
+
+/// The device nodes of `path`, without the file path nodes that follow the device.
+fn device_nodes(path: &DevicePath) -> Vec<&DevicePathNode> {
+    path.node_iter()
+        .filter(|node| node.full_type() != (DeviceType::MEDIA, DeviceSubType::MEDIA_FILE_PATH))
+        .collect()
+}
+
+/// Find the Extended Boot Loader Partition on the same disk as the partition at `path`,
+/// which is usually the EFI system partition that Sprout was loaded from. Only a partition
+/// that has a filesystem the firmware can read is found. Returns the device path of its
+/// filesystem, or None if there is no such partition, such as on a disk without a GPT.
+pub fn find_xbootldr(path: &DevicePath) -> Result<Option<Box<DevicePath>>> {
+    // The partition is the last hard drive node. The disk is everything before it.
+    let own = device_nodes(path);
+    let Some(partition_index) = own.iter().rposition(|node| is_hard_drive_node(node)) else {
+        // There is no partition, such as when booting from an optical disc or the network.
+        return Ok(None);
+    };
+    let disk = &own[..partition_index];
+    let own_partition = own[partition_index];
+
+    let handles =
+        uefi::boot::find_handles::<SimpleFileSystem>().context("unable to find the filesystems")?;
+
+    let mut found: Option<(u32, Box<DevicePath>)> = None;
+    for handle in handles {
+        let Ok(candidate_path) = open_shared::<DevicePath>(handle) else {
+            continue;
+        };
+        let nodes = device_nodes(&candidate_path);
+
+        // The candidate must be a partition of the same disk, and not the partition itself.
+        if nodes.len() != disk.len() + 1
+            || nodes[..disk.len()] != *disk
+            || !is_hard_drive_node(nodes[disk.len()])
+            || nodes[disk.len()] == own_partition
+        {
+            continue;
+        }
+
+        // The partition type is only available for a GPT partition.
+        let Ok(info) = open_shared::<PartitionInfo>(handle) else {
+            continue;
+        };
+        let Some(entry) = info.gpt_partition_entry() else {
+            continue;
+        };
+        // The entry is packed, so the field is copied before it is compared.
+        let partition_type = entry.partition_type_guid.0;
+        if partition_type != XBOOTLDR_PARTITION_TYPE {
+            continue;
+        }
+
+        // There should only be one, but if there are several, use the first partition.
+        let number = <&uefi::proto::device_path::media::HardDrive>::try_from(nodes[disk.len()])
+            .map(|drive| drive.partition_number())
+            .unwrap_or(u32::MAX);
+        if found.as_ref().is_none_or(|(best, _)| number < *best) {
+            found = Some((number, candidate_path.to_boxed()));
+        }
+    }
+
+    Ok(found.map(|(_, path)| path))
+}
@@ -172,6 +172,196 @@ pub fn initramfs_candidates(
    candidates.into_iter()
 }

+/// Matches `text` against a glob `pattern` where `*` matches any sequence of characters,
+/// including an empty one. Every other character matches itself exactly.
+/// A pattern without any `*` only matches `text` when they are equal.
+pub fn glob_match(pattern: &str, text: &str) -> bool {
+    let pattern = pattern.as_bytes();
+    let text = text.as_bytes();
+
+    // The current position in the pattern and the text.
+    let (mut p, mut t) = (0, 0);
+    // The position of the last `*` in the pattern and the text position it was tried at.
+    let mut backtrack: Option<(usize, usize)> = None;
+
+    while t < text.len() {
+        if p < pattern.len() && pattern[p] == b'*' {
+            // Try matching the `*` against nothing first, remembering where to resume.
+            backtrack = Some((p, t));
+            p += 1;
+        } else if p < pattern.len() && pattern[p] == text[t] {
+            p += 1;
+            t += 1;
+        } else if let Some((star, star_text)) = backtrack {
+            // Let the last `*` consume one more character and try again.
+            p = star + 1;
+            t = star_text + 1;
+            backtrack = Some((star, star_text + 1));
+        } else {
+            return false;
+        }
+    }
+
+    // Any remaining pattern must be made of `*` only.
+    pattern[p..].iter().all(|item| *item == b'*')
+}
+
+/// One piece of a pattern for [fnmatch_ignore_case].
+enum FnmatchToken {
+    /// A byte that matches itself, already lowercased.
+    Literal(u8),
+    /// `?`, which matches any one byte.
+    Any,
+    /// `*`, which matches any sequence of bytes.
+    Star,
+    /// `[...]`, which matches a byte in any of the inclusive ranges, already lowercased.
+    Class(Vec<(u8, u8)>),
+    /// A pattern that can't match anything, such as one with an unterminated `[`.
+    Never,
+}
+
+/// Splits `pattern` into tokens. An unterminated `[` never matches, as in systemd-boot.
+fn fnmatch_tokens(pattern: &[u8]) -> Vec<FnmatchToken> {
+    let mut tokens = Vec::new();
+    let mut index = 0;
+    while index < pattern.len() {
+        let byte = pattern[index];
+        index += 1;
+        match byte {
+            b'*' => tokens.push(FnmatchToken::Star),
+            b'?' => tokens.push(FnmatchToken::Any),
+            b'\\' if index < pattern.len() => {
+                tokens.push(FnmatchToken::Literal(pattern[index].to_ascii_lowercase()));
+                index += 1;
+            }
+            b'[' => match pattern[index..].iter().position(|item| *item == b']') {
+                Some(length) if length > 0 => {
+                    let class = &pattern[index..index + length];
+                    let mut ranges = Vec::new();
+                    let mut position = 0;
+                    while position < class.len() {
+                        let low = class[position].to_ascii_lowercase();
+                        if position + 2 < class.len() && class[position + 1] == b'-' {
+                            ranges.push((low, class[position + 2].to_ascii_lowercase()));
+                            position += 3;
+                        } else {
+                            ranges.push((low, low));
+                            position += 1;
+                        }
+                    }
+                    tokens.push(FnmatchToken::Class(ranges));
+                    index += length + 1;
+                }
+                _ => tokens.push(FnmatchToken::Never),
+            },
+            other => tokens.push(FnmatchToken::Literal(other.to_ascii_lowercase())),
+        }
+    }
+    tokens
+}
+
+/// Matches `text` against `pattern` the way systemd-boot matches entry ids: ignoring ASCII case,
+/// with `*` for any sequence, `?` for any one character, `[a-z]` sets and ranges, and `\` to
+/// escape the next character. Unlike [glob_match], this is for names that come from outside of
+/// the Sprout configuration, such as EFI variables and loader.conf.
+pub fn fnmatch_ignore_case(pattern: &str, text: &str) -> bool {
+    let tokens = fnmatch_tokens(pattern.as_bytes());
+    let text = text.as_bytes();
+
+    let (mut t, mut p) = (0, 0);
+    let mut backtrack: Option<(usize, usize)> = None;
+    while t < text.len() {
+        let byte = text[t].to_ascii_lowercase();
+        let matched = match tokens.get(p) {
+            Some(FnmatchToken::Literal(literal)) => *literal == byte,
+            Some(FnmatchToken::Any) => true,
+            Some(FnmatchToken::Class(ranges)) => ranges
+                .iter()
+                .any(|(low, high)| (*low..=*high).contains(&byte)),
+            Some(FnmatchToken::Star) => {
+                // Try matching the `*` against nothing first, remembering where to resume.
+                backtrack = Some((p, t));
+                p += 1;
+                continue;
+            }
+            Some(FnmatchToken::Never) | None => false,
+        };
+        if matched {
+            p += 1;
+            t += 1;
+        } else if let Some((star, star_text)) = backtrack {
+            // Let the last `*` consume one more character and try again.
+            p = star + 1;
+            t = star_text + 1;
+            backtrack = Some((star, star_text + 1));
+        } else {
+            return false;
+        }
+    }
+
+    // Any remaining pattern must be made of `*` only.
+    tokens[p..]
+        .iter()
+        .all(|token| matches!(token, FnmatchToken::Star))
+}
+
+/// Determines whether every key in `rule` is present in `values` with a value
+/// that matches the glob pattern from `rule`. An empty rule never matches,
+/// so that an empty rule cannot accidentally match everything.
+pub fn rule_matches(rule: &BTreeMap<String, String>, values: &BTreeMap<String, String>) -> bool {
+    !rule.is_empty()
+        && rule.iter().all(|(key, pattern)| {
+            values
+                .get(key)
+                .is_some_and(|value| glob_match(pattern, value))
+        })
+}
+
+/// A single combination of variant choices produced by [build_variants].
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct VariantCombination {
+    /// The names of the chosen choices, in axis order.
+    pub names: Vec<String>,
+    /// The values to insert into the context for this combination.
+    /// Each axis name is set to the name of its chosen choice, and then
+    /// the values of each chosen choice are inserted.
+    pub values: BTreeMap<String, String>,
+}
+
+/// A variant axis, which is a name and a list of choices.
+/// Each choice is a name and the values it inserts.
+pub type VariantAxis = (String, Vec<(String, BTreeMap<String, String>)>);
+
+/// Builds every combination of the variant `axes`.
+/// Each axis is a name and a list of choices, where each choice is a name and a set of values.
+/// Combinations are produced in axis order, with the last axis varying fastest, and the
+/// choices of each axis in the order they are declared.
+/// No axes produce a single empty combination. An axis without any choices produces nothing.
+pub fn build_variants(axes: &[VariantAxis]) -> Vec<VariantCombination> {
+    let mut result = alloc::vec![VariantCombination {
+        names: Vec::new(),
+        values: BTreeMap::new(),
+    }];
+
+    for (axis, choices) in axes {
+        let mut next = Vec::new();
+        for combination in &result {
+            for (name, values) in choices {
+                let mut combination = combination.clone();
+                combination.names.push(name.clone());
+                combination.values.insert(axis.clone(), name.clone());
+                combination
+                    .values
+                    .extend(values.iter().map(|(k, v)| (k.clone(), v.clone())));
+                next.push(combination);
+            }
+        }
+        result = next;
+    }
+
+    result
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -484,4 +674,171 @@ mod tests {
        let candidates: Vec<_> = initramfs_candidates("-6.1.0", &[]).collect();
        assert!(candidates.is_empty());
    }
+
+    #[test]
+    fn fnmatch_ignores_ascii_case() {
+        assert!(fnmatch_ignore_case("Foo.CONF", "foo.conf"));
+        assert!(fnmatch_ignore_case("fedora-*", "Fedora-6.5.conf"));
+        assert!(!fnmatch_ignore_case("fedora", "fedora.conf"));
+    }
+
+    #[test]
+    fn fnmatch_question_mark_matches_one_character() {
+        assert!(fnmatch_ignore_case("a?c", "abc"));
+        assert!(!fnmatch_ignore_case("a?c", "ac"));
+        assert!(!fnmatch_ignore_case("a?c", "abbc"));
+    }
+
+    #[test]
+    fn fnmatch_brackets_match_sets_and_ranges() {
+        assert!(fnmatch_ignore_case("linux-[0-9].conf", "linux-7.conf"));
+        assert!(!fnmatch_ignore_case("linux-[0-9].conf", "linux-x.conf"));
+        assert!(fnmatch_ignore_case("[ab]c", "bc"));
+        assert!(!fnmatch_ignore_case("[ab]c", "cc"));
+        assert!(fnmatch_ignore_case("[A-C]x", "bx"));
+    }
+
+    #[test]
+    fn fnmatch_backslash_escapes_the_next_character() {
+        assert!(fnmatch_ignore_case("a\\*b", "a*b"));
+        assert!(!fnmatch_ignore_case("a\\*b", "aXb"));
+        assert!(fnmatch_ignore_case("a\\?", "a?"));
+    }
+
+    #[test]
+    fn fnmatch_star_backtracks() {
+        assert!(fnmatch_ignore_case("*-*-1.conf", "a-b-c-1.conf"));
+        assert!(fnmatch_ignore_case("*", ""));
+        assert!(!fnmatch_ignore_case("*x", "abc"));
+    }
+
+    #[test]
+    fn fnmatch_unterminated_bracket_matches_nothing() {
+        assert!(!fnmatch_ignore_case("a[b", "a[b"));
+        assert!(!fnmatch_ignore_case("a[b", "ab"));
+        assert!(!fnmatch_ignore_case("a[", "a["));
+    }
+
+    #[test]
+    fn fnmatch_empty_pattern_only_matches_empty_text() {
+        assert!(fnmatch_ignore_case("", ""));
+        assert!(!fnmatch_ignore_case("", "a"));
+    }
+
+    #[test]
+    fn glob_without_star_is_exact() {
+        assert!(glob_match("abc", "abc"));
+        assert!(!glob_match("abc", "abcd"));
+        assert!(!glob_match("abc", "ab"));
+        assert!(glob_match("", ""));
+        assert!(!glob_match("", "a"));
+    }
+
+    #[test]
+    fn glob_trailing_star_is_prefix() {
+        assert!(glob_match("fedora-*", "fedora-6.1"));
+        assert!(glob_match("fedora-*", "fedora-"));
+        assert!(!glob_match("fedora-*", "linux-fedora-6.1"));
+    }
+
+    #[test]
+    fn glob_star_anywhere() {
+        assert!(glob_match(
+            "linux-*-graphics-debug",
+            "linux-abc-6.1-graphics-debug"
+        ));
+        assert!(!glob_match(
+            "linux-*-graphics-debug",
+            "linux-abc-6.1-serial-debug"
+        ));
+        assert!(glob_match("*rescue*", "0-rescue-abc"));
+        assert!(glob_match("*", ""));
+        assert!(glob_match("a**b", "ab"));
+        assert!(glob_match("*a*a*", "banana"));
+        assert!(!glob_match("*a*a*a*a*", "banana"));
+    }
+
+    #[test]
+    fn rule_requires_all_keys() {
+        let values = map(&[("console", "graphics"), ("mode", "debug")]);
+        assert!(rule_matches(
+            &map(&[("console", "graphics"), ("mode", "deb*")]),
+            &values
+        ));
+        assert!(!rule_matches(
+            &map(&[("console", "graphics"), ("mode", "normal")]),
+            &values
+        ));
+        assert!(!rule_matches(&map(&[("missing", "*")]), &values));
+        assert!(!rule_matches(&BTreeMap::new(), &values));
+    }
+
+    fn axis(name: &str, choices: &[(&str, &[(&str, &str)])]) -> VariantAxis {
+        (
+            name.to_string(),
+            choices
+                .iter()
+                .map(|(choice, values)| (choice.to_string(), map(values)))
+                .collect(),
+        )
+    }
+
+    #[test]
+    fn variants_without_axes_produce_one_empty_combination() {
+        let result = build_variants(&[]);
+        assert_eq!(result.len(), 1);
+        assert!(result[0].names.is_empty());
+        assert!(result[0].values.is_empty());
+    }
+
+    #[test]
+    fn variants_with_empty_axis_produce_nothing() {
+        let result = build_variants(&[axis("a", &[("x", &[])]), axis("b", &[])]);
+        assert!(result.is_empty());
+    }
+
+    #[test]
+    fn variants_are_ordered_and_set_values() {
+        let result = build_variants(&[
+            axis(
+                "console",
+                &[
+                    ("serial", &[("console-title", "Serial")]),
+                    ("graphics", &[("console-title", "Graphics")]),
+                ],
+            ),
+            axis(
+                "mode",
+                &[("normal", &[]), ("debug", &[("mode-title", " Debug")])],
+            ),
+        ]);
+        let names: Vec<String> = result.iter().map(|c| c.names.join("-")).collect();
+        assert_eq!(
+            names,
+            [
+                "serial-normal",
+                "serial-debug",
+                "graphics-normal",
+                "graphics-debug"
+            ]
+        );
+        assert_eq!(
+            result[3].values,
+            map(&[
+                ("console", "graphics"),
+                ("console-title", "Graphics"),
+                ("mode", "debug"),
+                ("mode-title", " Debug")
+            ])
+        );
+    }
+
+    #[test]
+    fn variant_choice_values_override_axis_name() {
+        let result = build_variants(&[axis("console", &[("serial", &[("console", "custom")])])]);
+        assert_eq!(
+            result[0].values.get("console").map(String::as_str),
+            Some("custom")
+        );
+    }
 }
@@ -0,0 +1,586 @@
+# Configuring Sprout
+
+Sprout reads a TOML file, `\sprout.toml`, from the root of the EFI partition it was loaded from. This page
+covers everything that file can hold, the command line options that override it, and the BLS behavior that
+sits next to it. For installing Sprout, see the [setup guides](./setup).
+
+- [Command line options](#command-line-options)
+- [The file at a glance](#the-file-at-a-glance)
+- [Values](#values)
+- [`options`](#options)
+- [`menu-styles`](#menu-styles)
+- [`drivers`](#drivers)
+- [`extractors`](#extractors)
+- [`actions`](#actions)
+- [`entries`](#entries)
+- [`generators`](#generators)
+- [`phases`](#phases)
+- [Autoconfiguration](#autoconfiguration)
+- [Bootloader Specification support](#bootloader-specification-support)
+- [Strict mode](#strict-mode)
+
+Sprout reads the file once at startup. A key it doesn't know is ignored with a warning that names the key, so
+a typo shows up in the boot log instead of silently doing nothing. A `version` other than `1` stops Sprout.
+
+## Command line options
+
+These are passed to `sprout.efi` as load options, which is how GRUB or `efibootmgr` hand them over. They
+override the matching setting in the file.
+
+| Option                    | What it does                                                                |
+|---------------------------|-----------------------------------------------------------------------------|
+| `--config=PATH`           | Load a configuration file other than `\sprout.toml`.                        |
+| `--autoconfigure`         | Skip the configuration file and build one from what Sprout finds.           |
+| `--boot=ENTRY`            | Boot an entry without showing the menu. See [entries](#entries) for matching. |
+| `--force-menu`            | Show the menu even when `--boot` picked an entry.                           |
+| `--menu-style=STYLE`      | `basic`, `simple` or `graphical`.                                           |
+| `--menu-timeout=SECONDS`  | How long the menu waits before booting the default entry.                   |
+| `--retain-boot-console`   | Don't clear the screen before handing off to the entry.                     |
+| `--bls-strict-mode`       | Turn on [strict mode](#strict-mode).                                        |
+| `--help`                  | Print the options.                                                          |
+
+```bash
+# Boot a specific configuration file.
+$ sprout.efi --config=\path\to\config.toml
+# Boot "Boot Xen" at once, but only show the menu if it can't be found.
+$ sprout.efi --boot="Boot Xen"
+# Show the graphical menu for 10 seconds.
+$ sprout.efi --menu-style=graphical --menu-timeout=10
+```
+
+An argument Sprout can't parse is dropped with a warning and the rest are used, since a typo in a boot
+entry shouldn't leave a machine unbootable.
+
+## The file at a glance
+
+Every section is optional. An empty file is a valid configuration that has no entries.
+
+```toml
+version = 1
+
+[options]       # settings for Sprout itself
+[menu-styles.x] # settings for a style of menu
+[values]        # named strings for use anywhere with $name
+[drivers.x]     # EFI drivers to load
+[extractors.x]  # values worked out at boot
+[actions.x]     # things Sprout can do
+[entries.x]     # items in the boot menu
+[generators.x]  # makes entries from data
+[[phases.early]]    # actions to run at set points
+```
+
+The pieces fit together like this: an **entry** is a menu item that runs **actions**; an action is configured
+with strings that can contain **values**; values come from the `[values]` table, from **extractors**, and
+from **generators**. **Drivers** run first so the filesystems the rest of the file points at exist.
+
+Order at boot:
+
+1. `phases.early`
+2. drivers load
+3. autoconfiguration, if enabled
+4. extractors run
+5. `phases.startup`
+6. entries and generators produce the menu
+7. an entry is chosen
+8. `phases.late`, then the entry's actions
+
+## Values
+
+A value is a named string. Anywhere a string is accepted in an entry, action, driver path or phase, `$name`
+is replaced with the value called `name`.
+
+```toml
+[values]
+root-options = "root=/dev/sda2 ro"
+kernel = "\\vmlinuz"
+
+[actions.boot]
+chainload.path = "$kernel"
+chainload.options = ["$root-options", "quiet"]
+```
+
+Some details that matter in practice:
+
+- Values can refer to other values. Sprout keeps substituting until nothing changes, so
+  `a = "$b"`, `b = "x"` gives `x` for both. A value that never settles, such as one that contains itself,
+  is an error once it hits an iteration or length limit.
+- When two keys share a prefix, the longer one wins, so `$kernel-options` is never read as `$kernel` plus
+  `-options`.
+- A `$name` that has no value is left in the string as written.
+- Values are layered. A key in a generator or entry overrides the same key set globally, and only for that
+  entry. From weakest to strongest: `[values]`, extractor results, generator values (and `variants`), then the
+  `values` of the entry itself.
+- Windows-style paths need doubled backslashes in TOML strings: `"\\EFI\\Linux"`. Literal strings
+  (`'\EFI\Linux'`) work too.
+
+## `options`
+
+```toml
+[options]
+default-entry = "boot-linux"
+menu-timeout = 5
+menu-style = "graphical"
+autoconfigure = false
+bls-strict-mode = false
+```
+
+| Key               | Type    | Default  | Meaning                                                                 |
+|-------------------|---------|----------|-------------------------------------------------------------------------|
+| `default-entry`   | string  | none     | The entry that is selected first, and booted when the timeout ends. Without it, the first entry in the menu is. |
+| `menu-timeout`    | integer | see below | Seconds to show the menu before booting the default entry.             |
+| `menu-style`      | string  | `simple` | `basic` prints entries and takes a number. `simple` is a full-screen list moved with the arrow keys. `graphical` is a menu drawn on the screen (the mouse is off unless you enable it, see [`menu-styles`](#menu-styles)). |
+| `autoconfigure`   | boolean | `false`  | Add entries for what Sprout finds. See [autoconfiguration](#autoconfiguration). |
+| `bls-strict-mode` | boolean | `false`  | See [strict mode](#strict-mode).                                        |
+
+When `menu-timeout` is not set anywhere, the menu shows for 10 seconds, or is hidden in strict mode. The
+sources are ranked in [The bootloader interface](#the-bootloader-interface).
+
+## `menu-styles`
+
+Settings for a particular menu style. Only the graphical menu has any.
+
+```toml
+[menu-styles.graphical]
+enable-mouse = true
+enable-logo = false
+enable-animation = false
+```
+
+| Key                | Type    | Default | Meaning                                                          |
+|--------------------|---------|---------|------------------------------------------------------------------|
+| `enable-mouse`     | boolean | `false` | Select entries with the mouse and show the cursor. Without it, or when the firmware has no pointing device, the menu takes the keyboard only. |
+| `enable-logo`      | boolean | `true`  | Show the Sprout logo next to the name. Without it, only the name is shown. |
+| `enable-animation` | boolean | `true`  | Bounce the logo. Without it, the logo stays still.               |
+
+## `drivers`
+
+Drivers are EFI executables that add features, most often a filesystem driver for something the firmware
+can't read, such as ext4. Each is started once and expected to return. Afterwards Sprout reconnects every
+controller so the new filesystems appear. Drivers have no defined load order.
+
+```toml
+[drivers.ext4]
+path = "\\sprout\\drivers\\ext4.efi"
+provides = "filesystems"
+```
+
+| Key        | Default | Meaning                                                                 |
+|------------|---------|-------------------------------------------------------------------------|
+| `path`     |         | Path to the driver image. Required. Can use values.                     |
+| `provides` | `any`   | What the driver provides: `any` or `filesystems`.                       |
+
+With `filesystems`, the driver only adds filesystem or disk support. When every driver says so, Sprout
+reconnects only the disk and partition controllers instead of all of them. A single `any` driver makes
+Sprout reconnect every controller.
+
+The name (`ext4` above) is only for error messages and doesn't have to match the file.
+
+## `extractors`
+
+An extractor works out a value when Sprout boots, so a configuration doesn't need to hardcode where things
+are. The name of the extractor is the name of the value it sets.
+
+There is one kind, `filesystem-device-match`, which finds a filesystem and returns its device root. The
+result has a trailing slash, so you append a path to it directly: `$boot\\vmlinuz`.
+
+```toml
+[extractors.boot]
+filesystem-device-match.has-label = "BOOT"
+filesystem-device-match.fallback = "PciRoot(0x0)/Pci(0x1,0x1)/Sata(0,0,0)/HD(1,GPT,c2a4f1b6-0000-0000-0000-000000000000)/"
+```
+
+| Key                      | Meaning                                                              |
+|--------------------------|----------------------------------------------------------------------|
+| `has-label`              | The filesystem volume label equals this.                             |
+| `has-item`               | This file or directory exists on the filesystem.                     |
+| `has-partition-uuid`     | The unique GUID of the partition.                                    |
+| `has-partition-type-uuid`| The partition type GUID, such as the one for XBOOTLDR.               |
+| `fallback`               | What to use when no filesystem matches. Without it, no match is an error. |
+
+Every criterion you give must match, and you must give at least one. The first matching filesystem wins.
+`has-label` and `has-item` can use values.
+
+## `actions`
+
+An action is a named, configured piece of work. Entries and phases refer to actions by name, and an action
+can be used by as many of them as you like.
+
+Each action sets exactly one of `chainload`, `print` or `edera`. If you set more than one Sprout warns and
+uses the first of them in that order.
+
+### `chainload`
+
+Loads and starts another EFI image. That covers Linux through its EFI stub, Windows, and any other EFI
+application. If the image returns, Sprout returns to its own flow.
+
+```toml
+[actions.boot-linux]
+chainload.path = "\\vmlinuz"
+chainload.options = ["root=/dev/sda1", "quiet"]
+chainload.linux-initrd = "\\initrd"
+```
+
+| Key                  | Type            | Meaning                                                              |
+|----------------------|-----------------|----------------------------------------------------------------------|
+| `path`               | string          | The image to start. Required.                                        |
+| `options`            | list of strings | Joined with spaces and given to the image as its command line.       |
+| `linux-initrd`       | string          | One initrd, handed to the Linux EFI stub through the initrd media loader. |
+| `linux-initrd-chain` | list of strings | Several initrds, concatenated in order into one. Can't be used together with `linux-initrd`. |
+| `devicetree`         | string          | A flattened devicetree to install until the image returns.           |
+
+Notes:
+
+- `linux-initrd` is better than an `initrd=` option, because it doesn't depend on the stub resolving a path.
+- Entries in `linux-initrd-chain` that are empty after substitution are skipped, which is what makes a
+  chain with spare slots safe.
+- The devicetree is ignored with a warning when Secure Boot is on, as Sprout can't verify it. If it can't be
+  installed, Sprout warns and boots without it, unless [strict mode](#strict-mode) is on.
+- When the image is a Windows boot manager or another non-Linux image, leave the initrd keys out.
+
+### `print`
+
+Writes a line to the console. It's mostly for phases, such as a message while drivers load.
+
+```toml
+[actions.hello]
+print.text = "Booting $version"
+```
+
+### `edera`
+
+Boots the Edera hypervisor and its root operating system, as an extension of the Xen EFI stub. Sprout hands
+the Xen config, dom0 kernel and optional initrd to Xen as media loaders, then starts Xen.
+
+```toml
+[actions.edera]
+edera.xen = "\\EFI\\edera\\xen.efi"
+edera.kernel = "\\EFI\\edera\\kernel"
+edera.initrd = "\\EFI\\edera\\initrd"
+edera.xen-options = ["dom0_mem=512M"]
+edera.kernel-options = ["console=hvc0"]
+```
+
+| Key              | Type            | Meaning                                                     |
+|------------------|-----------------|-------------------------------------------------------------|
+| `xen`            | string          | The Xen EFI image. Required.                                |
+| `kernel`         | string          | The dom0 kernel. Required.                                  |
+| `initrd`         | string          | The dom0 initrd.                                            |
+| `initrd-chain`   | list of strings | Several initrds, concatenated in order. Can't be used with `initrd`. |
+| `kernel-options` | list of strings | Command line of the dom0 kernel.                            |
+| `xen-options`    | list of strings | Command line of Xen.                                        |
+
+When a TPM is present, the Xen options and dom0 command line are measured into PCR 12, the kernel into
+PCR 11, and the initrd into PCR 9.
+
+## `entries`
+
+An entry is something the user can pick from the menu. The table name identifies it.
+
+```toml
+[entries.boot-linux]
+title = "Boot Linux"
+actions = ["boot-linux"]
+values.kernel = "\\vmlinuz"
+sort-key = "10"
+```
+
+| Key        | Type            | Meaning                                                                |
+|------------|-----------------|------------------------------------------------------------------------|
+| `title`    | string          | The text in the menu. Required, and can use values.                    |
+| `actions`  | list of strings | Actions to run, in order, when the entry is chosen.                    |
+| `values`   | table           | Values that exist only for this entry.                                 |
+| `sort-key` | string          | Orders the entry in the menu. Compared as versions, not as text, so `10` sorts after `9`. Defaults to the entry's name. |
+
+The menu lists entries in reverse sort order, newest first. That is what you want for kernel versions and
+is why `sort-key = "$version"` gives a sensible menu.
+
+`--boot` and the bootloader interface find an entry by its name, by its title, or by its position in the
+menu counted from 0. A `*` in the pattern matches anything.
+
+If an entry fails Sprout reports the error and waits ten seconds. Then it exits to the firmware, or resets the
+machine when `reboot-on-error` applies (see [boot counting](#boot-counting)).
+
+## `generators`
+
+A generator makes entries from data when Sprout starts. Each has a kind (`matrix`, `list` or `bls`), and
+optionally `variants` and `exclude`, which work on the result of any kind. Set only one kind per generator.
+
+The entries a generator makes are named `<generator>-<n>`, with `n` counting from 0, and a BLS generator
+uses the name of the entry file instead. Every one of them is built from the `entry` template you give,
+which takes the same keys as an [entry](#entries).
+
+### `matrix`
+
+Makes an entry for every combination of the lists you give.
+
+```toml
+[generators.kernels]
+matrix.entry.title = "Boot $kernel with $console"
+matrix.entry.actions = ["boot-kernel"]
+matrix.values.kernel = ["\\vmlinuz", "\\vmlinuz-lts"]
+matrix.values.console = ["ttyS0", "tty0"]
+```
+
+That is four entries. A list of two and a list of three give six.
+
+### `list`
+
+Makes one entry per item. Each item is a table of values. Use it when the combinations aren't a clean grid.
+
+```toml
+[generators.systems]
+list.entry.title = "Boot $name"
+list.entry.actions = ["boot-system"]
+list.values = [
+  { name = "Alpine", kernel = "\\alpine\\vmlinuz" },
+  { name = "Debian", kernel = "\\debian\\vmlinuz" },
+]
+```
+
+### `bls`
+
+Makes entries from the files of the [Bootloader Specification](#bootloader-specification-support).
+
+```toml
+[generators.bls]
+bls.path = "\\loader"
+bls.entry.title = "$title"
+bls.entry.actions = ["boot-bls"]
+```
+
+| Key          | Type    | Default           | Meaning                                                           |
+|--------------|---------|-------------------|-------------------------------------------------------------------|
+| `entry`      | table   |                   | The template entry. Required.                                     |
+| `path`       | string  | `\loader`         | The directory that holds the `entries` directory. Can include a device, like `$boot\\loader`. |
+| `uki-path`   | string  | `\EFI\Linux` on the device of `path` | Where to look for unified kernel images. An empty string turns them off. |
+| `xbootldr`   | boolean | `false`           | Also read the extended boot loader partition of the same disk.    |
+| `pin-names`  | boolean | `true`            | Keep the entry file's name as the entry name, instead of prefixing the generator name. |
+
+Two generators reading the same directory produce entries with the same name. Sprout warns about it, since
+picking by name becomes ambiguous. `pin-names` is what makes names match the ids that `bootctl` uses.
+
+The values each BLS entry provides are listed under [BLS values](#bls-values).
+
+### `variants`
+
+Variants multiply the entries of a generator. Each key is an axis, and each axis is a list of choices.
+Every entry is made once for each combination of choices, taking one from each axis.
+
+```toml
+[generators.kernels]
+matrix.entry.title = "Boot $kernel ($console)"
+matrix.entry.actions = ["boot-kernel"]
+matrix.values.kernel = ["\\vmlinuz", "\\vmlinuz-lts"]
+variants.console = [
+  { name = "serial", values.console-options = "console=ttyS0" },
+  { name = "graphics", values.console-options = "console=tty0" },
+]
+```
+
+This makes "Boot \vmlinuz (serial)", "Boot \vmlinuz (graphics)" and the same two for `\vmlinuz-lts`. Four
+entries from a matrix of two kernels and two choices.
+
+A choice has a `name` and optional `values`. The axis name becomes a value holding the choice's name
+(`$console` is `serial` here), and the choice's own values are added next to it. Names are appended to the
+entry name, so the entries above are called `kernels-0-serial`, `kernels-0-graphics` and so on. Axes apply in
+alphabetical order, choices in the order written. An axis with no choices, or two choices that share a name,
+is an error.
+
+### `exclude`
+
+Drops generated entries. It's a list of rules, and a rule is a table of value names to patterns, where `*`
+matches anything. An entry is dropped if every value in at least one rule matches. It runs after variants,
+and compares values before they are substituted.
+
+```toml
+[generators.bls]
+# ...
+exclude = [
+  { version = "0-rescue-*" },
+  { console = "graphics", mode = "debug" },
+]
+```
+
+The first rule drops BLS rescue entries. The second drops only the one combination.
+
+## `phases`
+
+Phases run actions at fixed points in the boot. Each phase is a list, and each item names actions and can
+add values for them.
+
+| Phase     | Runs                                                       |
+|-----------|------------------------------------------------------------|
+| `early`   | Before drivers load.                                       |
+| `startup` | After drivers, autoconfiguration and extractors, before the menu is built. |
+| `late`    | After an entry is chosen, before its actions run.          |
+
+```toml
+[[phases.early]]
+actions = ["splash"]
+
+[[phases.startup]]
+actions = ["announce"]
+values.message = "drivers are loaded"
+```
+
+Items run in order, and an action that fails stops the boot with an error. Note the double brackets: each
+item is one element of a list.
+
+## Autoconfiguration
+
+With `autoconfigure = true`, or `--autoconfigure`, Sprout looks at every filesystem it can read and adds
+configuration for what it finds. With the option, the result is added to your file. With the flag, your file
+is not read at all, which makes it a good way to get a machine booting before you've written one.
+
+For each filesystem:
+
+- **BLS**: if it has `\loader\loader.conf`, a `\loader\entries` directory with `.conf` files, or `.efi` files
+  in `\EFI\Linux`, Sprout adds a `bls` generator and the action that boots its entries. These are named
+  `auto-bls-<hash>`.
+- **Linux**: if there was no BLS, kernels in `\boot` and `\` are found by name (`vmlinuz` or `Image`,
+  optionally followed by `-` and a version), paired with an `initramfs`, `initrd` or `initrd.img` of the same
+  suffix. The entries are named `auto-linux-<hash>` and titled "Boot Linux" plus the path. Command line
+  options come from the value `linux-options`, which you can set in `[values]` and which otherwise is the
+  placeholder `placeholder`.
+- **Windows**: if `\EFI\Microsoft\Boot\bootmgfw.efi` exists, an entry "Boot Windows" named
+  `auto-windows-<hash>` chainloads it.
+
+`<hash>` is a short hash of the filesystem's device path, so two disks never collide. [Strict
+mode](#strict-mode) narrows which filesystems the BLS part reads.
+
+## Bootloader Specification support
+
+Sprout implements the [Boot Loader Specification](https://uapi-group.org/specifications/specs/boot_loader_specification/)
+to read the entries that distributions install, and sorts them as the specification says.
+
+It reads Type #1 entries from `\loader\entries` and Type #2 unified kernel images (UKIs) from `\EFI\Linux`. A
+UKI with several profiles is one entry per profile. Entries for another architecture than the machine's are
+hidden. In a Type #1 entry Sprout uses the keys `title`, `version`, `machine-id`, `sort-key`, `linux`, `efi`,
+`uki`, `initrd`, `options`, `devicetree`, `architecture` and `profile`.
+
+The simplest way to get this is `autoconfigure = true`. To write it out by hand, you need a `bls` generator
+and an action that boots what it makes:
+
+```toml
+[generators.bls]
+bls.entry.title = "$title"
+bls.entry.actions = ["boot-bls"]
+bls.xbootldr = true
+
+[actions.boot-bls]
+chainload.path = "$entry-root\\$chainload"
+chainload.options = ["$options"]
+chainload.devicetree = "$entry-root\\$devicetree"
+chainload.linux-initrd-chain = [
+  "$entry-root\\$initrd-0",
+  "$entry-root\\$initrd-1",
+  "$entry-root\\$initrd-2",
+  "$entry-root\\$initrd-3",
+]
+```
+
+An entry can have up to 32 initrds, and Sprout warns when it has one that the chain doesn't list, because
+the kernel likely can't then find its root. Autoconfiguration lists all 32. Unused slots are empty and
+skipped, so listing more than you need costs nothing.
+
+### BLS values
+
+| Value                | Holds                                                                      |
+|----------------------|----------------------------------------------------------------------------|
+| `$title`             | The title, with the version added unless it already contains it.           |
+| `$title-base`        | The title as written in the entry.                                         |
+| `$version`           | The `version` field.                                                       |
+| `$machine-id`        | The `machine-id` field.                                                    |
+| `$chainload`         | The path of the `linux`, `efi` or `uki` file.                              |
+| `$options`           | The `options` field, with the profile prepended for a UKI profile.         |
+| `$cmdline`           | The command line embedded in a UKI.                                        |
+| `$uname`             | The kernel version embedded in a UKI.                                      |
+| `$devicetree`        | The `devicetree` path.                                                     |
+| `$initrd-0` to `$initrd-31` | The initrds, in order. A slot with none is empty.                   |
+| `$initrd`            | The last initrd.                                                           |
+| `$entry-root`        | The device the entry's files are on. Empty for Sprout's own partition.     |
+
+`$entry-root` matters once `xbootldr` is on, since an entry on the XBOOTLDR partition has its files there,
+not next to Sprout. Always write BLS paths as `$entry-root\\$chainload`.
+
+### Boot counting
+
+A file named like `fedora+3.conf` or `fedora+3.efi` has three tries. Each boot renames it, say to
+`fedora+2-1.conf`, and tells the system the new path in `LoaderBootCountPath` so `systemd-bless-boot` can
+remove the counter once the boot works.
+
+Entries with no tries left sort last and are never the default, but can still be booted by hand. If an entry
+fails to start after it used a try, and it had tries left, the machine resets so the next boot can use the
+next try or pick another entry. This is the `reboot-on-error` setting of `loader.conf`. Without boot counting
+a failure to start goes back to the firmware.
+
+### `loader.conf`
+
+Sprout reads `\loader\loader.conf` from the partition it was loaded from, as systemd-boot does. It is
+measured into the TPM, since it changes how Sprout boots.
+
+| Key               | Value                                                              |
+|-------------------|--------------------------------------------------------------------|
+| `default`         | A pattern for the id of the default entry, or `@saved`.            |
+| `preferred`       | Like `default`, but entries with no boot counter tries are skipped. |
+| `timeout`         | Seconds, `menu-hidden`, `menu-disabled` or `menu-force`.           |
+| `reboot-on-error` | `auto` (the default), `yes` or `no`.                               |
+
+The id of an entry is its file name without the boot counter, like `fedora.conf` or `fedora.efi`. Patterns
+ignore case and can use `*`, `?` and `[a-z]`. With `@saved` the entry booted last is the default.
+
+`reboot-on-error = yes` resets after every failed start, which can loop forever. `auto` only resets when a
+try was used up and some were left. Other keys are ignored with a warning.
+
+A hidden menu, from a timeout of zero or `menu-hidden`, still opens when a key is pressed. `menu-disabled`
+does not.
+
+### The bootloader interface
+
+Sprout uses the same firmware variables as systemd-boot, so `bootctl`, `systemctl reboot --boot-loader-entry`
+and `systemd-bless-boot` work with it. It publishes `LoaderEntries`, `LoaderEntrySelected`,
+`LoaderBootCountPath`, `LoaderFeatures` and `LoaderInfo`, and reads `LoaderEntryDefault`,
+`LoaderEntryPreferred`, `LoaderEntryOneShot`, `LoaderEntryLastBooted`, `LoaderConfigTimeout` and
+`LoaderConfigTimeoutOneShot`.
+
+What `bootctl` sets outranks `sprout.toml`, which outranks `loader.conf`. The default entry is the first of
+these that matches an entry:
+
+1. `LoaderEntryPreferred`, then `preferred` in `loader.conf`
+2. `LoaderEntryDefault`
+3. `default-entry` in `sprout.toml`
+4. `default` in `loader.conf`
+
+The menu timeout is the first of these that is set:
+
+1. the one-shot timeout, `LoaderConfigTimeoutOneShot`
+2. `--menu-timeout`
+3. `LoaderConfigTimeout`
+4. `menu-timeout` in `sprout.toml`
+5. `timeout` in `loader.conf`
+
+A one-shot entry (`LoaderEntryOneShot`) is booted at once and without the menu, unless strict mode is on.
+
+## Strict mode
+
+By default Sprout departs from systemd-boot in a few places, where it is friendlier or safer for a
+bootloader that reads the same files. Each departure is logged when it applies. `--bls-strict-mode`, or
+`bls-strict-mode = true` under `[options]`, turns all of them off.
+
+| Behavior                                          | By default                                              | In strict mode                                          |
+|---------------------------------------------------|---------------------------------------------------------|---------------------------------------------------------|
+| One-shot entry (`LoaderEntryOneShot`)             | Booted at once, without the menu.                       | Only the default for this boot. The menu and its timeout still apply. |
+| Menu timeout that nothing sets                    | The menu is shown for 10 seconds.                       | The menu is hidden.                                     |
+| Default entry with no boot counter tries          | Skipped for another entry.                              | Used, as `default` ignores the tries.                   |
+| Entry with more than one of `linux`, `efi`, `uki` | Boots the first of them.                                | Hidden.                                                 |
+| Entry whose file does not exist                   | Shown, and it fails when booted.                        | Hidden.                                                 |
+| UKI without a name                                | Named after its file.                                   | Hidden.                                                 |
+| Name and version of a UKI                         | Name is `PRETTY_NAME` or `ID`. Version is `IMAGE_VERSION`, `VERSION_ID`, `BUILD_ID`, then `.uname`. | What systemd-boot uses. Name is `PRETTY_NAME`, `IMAGE_ID`, `NAME` or `ID`. Version is `IMAGE_VERSION`, `VERSION`, `VERSION_ID` or `BUILD_ID`. |
+| Boot counter of a plain `efi` entry               | Counted.                                                | Not counted, but its tries still make it bad.           |
+| Extended boot loader partition                    | Read when `xbootldr` is set on the generator.           | Always read.                                            |
+| Autoconfiguration                                 | Reads BLS entries from every disk, one generator each.  | Reads BLS entries from Sprout's partition and the XBOOTLDR of its disk, as one generator. Windows and Linux entries are found as before. |
+| Boot entry that returns                           | Sprout exits to the firmware.                           | The menu is shown again.                                |
+| Devicetree that can't be installed                | Warns and boots without it.                             | The entry fails.                                        |
+
+In strict mode the actions of a hand-written generator have to use `$entry-root` for the files of an entry,
+as entries can come from the extended boot loader partition.
@@ -9,7 +9,7 @@ if [ "${SKIP_BUILD}" != "1" ]; then
 	./hack/dev/build.sh "${TARGET_ARCH}" "${RUST_PROFILE}"
 fi

-clear
+[ -t 1 ] && clear

 set --
 if [ "${TARGET_ARCH}" = "x86_64" ]; then
@@ -40,7 +40,7 @@ set -- "${@}" -nodefaults -smp 2 -m 4096
 if [ "${NO_GRAPHICAL}" = "1" ]; then
 	set -- "${@}" -nographic
 else
-	if [ "${GRAPHICAL_ONLY}" != "1" ]; then
+	if [ "${GRAPHICAL_ONLY}" != "1" ] && [ "${QEMU_HEADLESS}" != "1" ]; then
 		if [ "${QEMU_LEGACY_SERIAL}" = "1" ]; then
 			set -- "${@}" -serial stdio
 		else
@@ -51,6 +51,17 @@ else
 		fi
 	fi

+	# Headless keeps the virtual GPU, so screenshots still work, but shows no window. The firmware
+	# console and the Linux console go to files, as there is no terminal to attach to.
+	if [ "${QEMU_HEADLESS}" = "1" ]; then
+		set -- "${@}" \
+			-display none \
+			-serial "file:${QEMU_SERIAL_FILE:-/dev/null}" \
+			-device 'virtio-serial-pci,id=vs0' \
+			-chardev "file,id=file0,path=${QEMU_CONSOLE_FILE:-/dev/null}" \
+			-device 'virtconsole,chardev=file0,id=console0,name=alpine'
+	fi
+
 	if [ "${QEMU_LEGACY_VGA}" = "1" ]; then
 		set -- "${@}" -vga std
 	else
@@ -73,8 +84,16 @@ if [ "${NO_NETWORK}" != "1" ]; then
 		-device 'virtio-net-pci,netdev=network0'
 fi

+# The firmware in the dev image hangs before it starts Sprout when accelerated on Apple Silicon,
+# so use the firmware that comes with Homebrew's QEMU there. QEMU_FIRMWARE overrides the choice.
+if [ -z "${QEMU_FIRMWARE}" ] && [ "${TARGET_ARCH}" = "aarch64" ] && [ "${QEMU_ACCEL}" = "hvf" ] &&
+	command -v brew >/dev/null 2>&1; then
+	BREW_FIRMWARE="$(brew --prefix qemu 2>/dev/null)/share/qemu/edk2-aarch64-code.fd"
+	[ -f "${BREW_FIRMWARE}" ] && QEMU_FIRMWARE="${BREW_FIRMWARE}"
+fi
+
 rm -f "${FINAL_DIR}/ovmf-boot.fd"
-cp "${FINAL_DIR}/ovmf.fd" "${FINAL_DIR}/ovmf-boot.fd"
+cp "${QEMU_FIRMWARE:-${FINAL_DIR}/ovmf.fd}" "${FINAL_DIR}/ovmf-boot.fd"
 if [ "${TARGET_ARCH}" = "aarch64" ]; then
 	dd if=/dev/zero of="${FINAL_DIR}/ovmf-boot.fd" bs=1 count=1 seek=67108863 >/dev/null 2>&1
 fi
@@ -88,4 +107,11 @@ set -- "${@}" \

 set -- "${@}" -name "sprout ${TARGET_ARCH}"

+if [ -n "${QEMU_QMP}" ]; then
+	set -- "${@}" -qmp "unix:${QEMU_QMP},server=on,wait=off"
+fi
+
+# shellcheck disable=SC2086
+set -- "${@}" ${QEMU_EXTRA_ARGS}
+
 exec "${@}"
@@ -0,0 +1,32 @@
+version = 1
+
+[options]
+default-entry = "kernel"
+menu-style = "graphical"
+menu-timeout = 120
+
+[extractors.boot.filesystem-device-match]
+has-item = "\\vmlinuz"
+
+[actions.chainload-kernel]
+chainload.path = "$boot\\vmlinuz"
+chainload.options = ["console=hvc0", "overlaytmpfs=yes"]
+chainload.linux-initrd = "$boot\\initramfs"
+
+[entries.kernel]
+title = "Boot Linux"
+actions = ["chainload-kernel"]
+
+[actions.chainload-shell]
+chainload.path = "$boot\\EFI\\BOOT\\shell.efi"
+
+[entries.shell]
+title = "Boot Shell"
+actions = ["chainload-shell"]
+
+[actions.chainload-xen]
+chainload.path = "$boot\\EFI\\BOOT\\xen.efi"
+
+[entries.xen]
+title = "Boot Xen"
+actions = ["chainload-xen"]
@@ -0,0 +1,26 @@
+#!/bin/sh
+# Presses keys in the guest, one after another. Join keys with + to press them together.
+# Usage: key.sh <qcode>...   for example: key.sh down down ret   or: key.sh ctrl+alt+delete
+# Environment: KEY_DELAY is seconds between keys (default 0.3).
+set -e
+
+cd "$(dirname "${0}")/../../.." || exit 1
+
+. "hack/dev/run/lib.sh"
+require_running
+
+[ "${#}" -gt 0 ] || die "usage: key.sh <qcode>..."
+
+FIRST=1
+for CHORD in "${@}"; do
+	[ "${FIRST}" = "1" ] || sleep "${KEY_DELAY:-0.3}"
+	FIRST=0
+	KEYS=""
+	OLD_IFS="${IFS}"
+	IFS="+"
+	for KEY in ${CHORD}; do
+		KEYS="${KEYS}${KEYS:+,}{\"type\":\"qcode\",\"data\":\"${KEY}\"}"
+	done
+	IFS="${OLD_IFS}"
+	./hack/dev/run/qmp.sh "{\"execute\":\"send-key\",\"arguments\":{\"keys\":[${KEYS}]}}" >/dev/null
+done
@@ -0,0 +1,34 @@
+#!/bin/sh
+# Shared by the other scripts in this directory: source it after changing to the repository root.
+# shellcheck disable=SC2034
+
+# common.sh reads the architecture from the first argument, which belongs to the calling script here.
+load_common() {
+	set --
+	. "hack/common.sh"
+}
+load_common
+
+RUN_DIR="$(pwd)/target/run/${TARGET_ARCH}"
+SHOT_DIR="${RUN_DIR}/shots"
+SERIAL_LOG="${RUN_DIR}/serial.log"
+CONSOLE_LOG="${RUN_DIR}/console.log"
+QEMU_LOG="${RUN_DIR}/qemu.log"
+PID_FILE="${RUN_DIR}/qemu.pid"
+
+# Unix socket paths are limited to about 104 bytes on macOS, which a deep worktree exceeds.
+QMP_SOCK="${TMPDIR:-/tmp}"
+QMP_SOCK="${QMP_SOCK%/}/sprout-${TARGET_ARCH}.qmp"
+
+die() {
+	echo "ERROR: ${*}" >/dev/stderr
+	exit 1
+}
+
+is_running() {
+	[ -f "${PID_FILE}" ] && kill -0 "$(cat "${PID_FILE}")" 2>/dev/null
+}
+
+require_running() {
+	is_running || die "no ${TARGET_ARCH} QEMU is running, start one with hack/dev/run/start.sh"
+}
@@ -0,0 +1,64 @@
+#!/bin/sh
+# Sends QMP commands to the running QEMU and prints each reply as a line of JSON.
+# Usage: qmp.sh '{"execute":"query-status"}' ...
+# Exits 1 if QEMU answers with an error. Environment: QMP_TIMEOUT is seconds per reply (default 30).
+set -e
+
+cd "$(dirname "${0}")/../../.." || exit 1
+
+. "hack/dev/run/lib.sh"
+require_running
+
+[ "${#}" -gt 0 ] || die "usage: qmp.sh <json-command>..."
+
+if command -v python3 >/dev/null 2>&1; then
+	exec python3 - "${QMP_SOCK}" "${@}" <<'PY'
+import json, os, socket, sys
+
+path, *commands = sys.argv[1:]
+sock = socket.socket(socket.AF_UNIX)
+sock.settimeout(float(os.environ.get("QMP_TIMEOUT", "30")))
+sock.connect(path)
+stream = sock.makefile("rw")
+
+
+def call(command):
+    stream.write(command + "\n")
+    stream.flush()
+    while True:
+        line = stream.readline()
+        if not line:
+            sys.exit("qmp: connection closed")
+        message = json.loads(line)
+        if "return" in message or "error" in message:
+            return message
+
+
+json.loads(stream.readline())
+call('{"execute":"qmp_capabilities"}')
+status = 0
+for command in commands:
+    reply = call(command)
+    print(json.dumps(reply))
+    if "error" in reply:
+        status = 1
+sys.exit(status)
+PY
+fi
+
+command -v socat >/dev/null 2>&1 || die "python3 or socat is required"
+
+# socat can't tell when a reply is complete, so it gets a fixed time to receive them.
+OUTPUT="$(
+	{
+		printf '%s\n' '{"execute":"qmp_capabilities"}'
+		for COMMAND in "${@}"; do
+			printf '%s\n' "${COMMAND}"
+		done
+		sleep "${QMP_SETTLE:-1}"
+	} | socat -t1 - "UNIX-CONNECT:${QMP_SOCK}"
+)"
+echo "${OUTPUT}"
+case "${OUTPUT}" in
+*'"error"'*) exit 1 ;;
+esac
@@ -0,0 +1,21 @@
+#!/bin/sh
+# Saves a screenshot of the guest display as a PNG and prints its path, ready to be read as an image.
+# Usage: screenshot.sh [out.png]
+# Requires QEMU 7.1 or newer for PNG screendumps.
+set -e
+
+cd "$(dirname "${0}")/../../.." || exit 1
+
+. "hack/dev/run/lib.sh"
+require_running
+
+OUT="${1:-${SHOT_DIR}/$(date +%H%M%S).png}"
+case "${OUT}" in
+/*) ;;
+*) OUT="$(pwd)/${OUT}" ;;
+esac
+mkdir -p "$(dirname "${OUT}")"
+
+./hack/dev/run/qmp.sh "{\"execute\":\"screendump\",\"arguments\":{\"filename\":\"${OUT}\",\"format\":\"png\"}}" >/dev/null
+[ -s "${OUT}" ] || die "QEMU did not write ${OUT}"
+echo "${OUT}"
@@ -0,0 +1,27 @@
+#!/bin/sh
+# Boots the graphical menu, moves the selection up and down, boots Linux and waits for its shell prompt.
+# Usage: smoke.sh [arch]
+# Screenshots land in target/run/<arch>/shots. The exit code is the result.
+# Environment: SMOKE_MENU_DELAY is seconds to let the menu draw (default 10), SMOKE_BOOT_TIMEOUT is
+# seconds to wait for the shell (default 180). The start.sh variables apply too.
+set -e
+
+cd "$(dirname "${0}")/../../.." || exit 1
+
+[ -n "${1}" ] && TARGET_ARCH="${1}"
+. "hack/dev/run/lib.sh"
+export TARGET_ARCH
+
+trap './hack/dev/run/stop.sh' EXIT
+
+./hack/dev/run/start.sh "${TARGET_ARCH}"
+sleep "${SMOKE_MENU_DELAY:-10}"
+
+echo "menu: $(./hack/dev/run/screenshot.sh "${SHOT_DIR}/menu.png")"
+# The default entry is the last one, so up is the key that visibly moves the selection.
+./hack/dev/run/key.sh up
+echo "up: $(./hack/dev/run/screenshot.sh "${SHOT_DIR}/menu-up.png")"
+./hack/dev/run/key.sh down ret
+
+./hack/dev/run/wait-serial.sh 'sprout:.*# ' "${SMOKE_BOOT_TIMEOUT:-180}"
+echo "ok: reached a shell on ${TARGET_ARCH}"
@@ -0,0 +1,39 @@
+#!/bin/sh
+# Starts the dev environment in the background with no window, a QMP socket and serial logs.
+# Usage: start.sh [arch]
+# Environment: SKIP_BUILD=1 reuses target/final, SPROUT_CONFIG_NAME picks the config (default
+# graphical), START_TIMEOUT is the seconds to wait for QEMU (default 900 to allow for a build).
+set -e
+
+cd "$(dirname "${0}")/../../.." || exit 1
+
+[ -n "${1}" ] && TARGET_ARCH="${1}"
+. "hack/dev/run/lib.sh"
+
+is_running && die "a ${TARGET_ARCH} QEMU is already running, stop it with hack/dev/run/stop.sh"
+
+rm -rf "${RUN_DIR}"
+mkdir -p "${SHOT_DIR}"
+rm -f "${QMP_SOCK}"
+
+export SPROUT_CONFIG_NAME="${SPROUT_CONFIG_NAME:-graphical}"
+export QEMU_HEADLESS=1
+export QEMU_QMP="${QMP_SOCK}"
+export QEMU_SERIAL_FILE="${SERIAL_LOG}"
+export QEMU_CONSOLE_FILE="${CONSOLE_LOG}"
+
+nohup ./hack/dev/boot.sh "${TARGET_ARCH}" </dev/null >"${QEMU_LOG}" 2>&1 &
+echo "${!}" >"${PID_FILE}"
+
+# boot.sh builds first and then execs QEMU, so the pid stays the same.
+DEADLINE=$(($(date +%s) + ${START_TIMEOUT:-900}))
+while [ ! -S "${QMP_SOCK}" ]; do
+	if ! is_running; then
+		tail -n 20 "${QEMU_LOG}" >/dev/stderr
+		die "QEMU exited before it was ready, see ${QEMU_LOG}"
+	fi
+	[ "$(date +%s)" -ge "${DEADLINE}" ] && die "timed out waiting for QEMU, see ${QEMU_LOG}"
+	sleep 1
+done
+
+echo "${RUN_DIR}"
@@ -0,0 +1,15 @@
+#!/bin/sh
+# Prints the state of QEMU: stopped, or the pid and the VM status such as running.
+# Exits 1 when QEMU isn't running.
+set -e
+
+cd "$(dirname "${0}")/../../.." || exit 1
+
+. "hack/dev/run/lib.sh"
+
+if ! is_running; then
+	echo "stopped"
+	exit 1
+fi
+
+echo "pid $(cat "${PID_FILE}") $(./hack/dev/run/qmp.sh '{"execute":"query-status"}' 2>/dev/null || echo "no qmp")"
@@ -0,0 +1,19 @@
+#!/bin/sh
+# Stops QEMU and removes its socket. Safe to run when nothing is running.
+set -e
+
+cd "$(dirname "${0}")/../../.." || exit 1
+
+. "hack/dev/run/lib.sh"
+
+if is_running; then
+	PID="$(cat "${PID_FILE}")"
+	./hack/dev/run/qmp.sh '{"execute":"quit"}' >/dev/null 2>&1 || true
+	for _ in 1 2 3 4 5 6 7 8 9 10; do
+		is_running || break
+		sleep 0.5
+	done
+	is_running && kill "${PID}" 2>/dev/null || true
+fi
+
+rm -f "${QMP_SOCK}" "${PID_FILE}"
@@ -0,0 +1,29 @@
+#!/bin/sh
+# Waits for a regex to show up on the firmware or Linux console. Exits 1 on timeout or if QEMU exits.
+# Usage: wait-serial.sh <regex> [timeout-seconds]
+set -e
+
+cd "$(dirname "${0}")/../../.." || exit 1
+
+. "hack/dev/run/lib.sh"
+
+[ -n "${1}" ] || die "usage: wait-serial.sh <regex> [timeout-seconds]"
+
+DEADLINE=$(($(date +%s) + ${2:-60}))
+while :; do
+	if cat "${SERIAL_LOG}" "${CONSOLE_LOG}" 2>/dev/null | grep -aEq -- "${1}"; then
+		exit 0
+	fi
+	if ! is_running; then
+		echo "QEMU exited while waiting for: ${1}" >/dev/stderr
+		break
+	fi
+	if [ "$(date +%s)" -ge "${DEADLINE}" ]; then
+		echo "timed out waiting for: ${1}" >/dev/stderr
+		break
+	fi
+	sleep 0.5
+done
+
+tail -n 15 "${SERIAL_LOG}" "${CONSOLE_LOG}" 2>/dev/null >/dev/stderr || true
+exit 1
@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.98.1"
+channel = "1.99.1"
 components = ["rustfmt", "clippy"]
 targets = ["x86_64-unknown-uefi", "aarch64-unknown-uefi"]