man/systemd-boot.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
   5
   6 <refentry id="systemd-boot" conditional='HAVE_GNU_EFI'
   7     xmlns:xi="http://www.w3.org/2001/XInclude">
   8   <refentryinfo>
   9     <title>systemd-boot</title>
  10     <productname>systemd</productname>
  11   </refentryinfo>
  12
  13   <refmeta>
  14     <refentrytitle>systemd-boot</refentrytitle>
  15     <manvolnum>7</manvolnum>
  16   </refmeta>
  17
  18   <refnamediv>
  19     <refname>systemd-boot</refname>
  20     <refname>sd-boot</refname>
  21     <refpurpose>A simple UEFI boot manager</refpurpose>
  22   </refnamediv>
  23
  24   <refsect1>
  25     <title>Description</title>
  26
  27     <para><command>systemd-boot</command> (short: <command>sd-boot</command>) is a simple UEFI boot
  28     manager. It provides a textual menu to select the entry to boot and an editor for the kernel command
  29     line. <command>systemd-boot</command> supports systems with UEFI firmware only.</para>
  30
  31     <para><command>systemd-boot</command> loads boot entry information from the EFI system partition (ESP),
  32     usually mounted at <filename>/efi/</filename>, <filename>/boot/</filename>, or
  33     <filename>/boot/efi/</filename> during OS runtime, as well as from the Extended Boot Loader partition
  34     (XBOOTLDR) if it exists (usually mounted to <filename>/boot/</filename>). Configuration file fragments,
  35     kernels, initrds and other EFI images to boot generally need to reside on the ESP or the Extended Boot
  36     Loader partition. Linux kernels must be built with <option>CONFIG_EFI_STUB</option> to be able to be
  37     directly executed as an EFI image. During boot <command>systemd-boot</command> automatically assembles a
  38     list of boot entries from the following sources:</para>
  39
  40     <itemizedlist>
  41       <listitem><para>Boot entries defined with <ulink
  42       url="https://uapi-group.org/specifications/specs/boot_loader_specification">Boot Loader Specification</ulink> Type #1
  43       description files located in <filename>/loader/entries/</filename> on the ESP and the Extended Boot
  44       Loader Partition. These usually describe Linux kernel images with associated initrd images, but
  45       alternatively may also describe other arbitrary EFI executables.</para></listitem>
  46
  47       <listitem><para>Unified kernel images, <ulink url="https://uapi-group.org/specifications/specs/boot_loader_specification">Boot
  48       Loader Specification</ulink> Type #2, which are executable EFI binaries in
  49       <filename>/EFI/Linux/</filename> on the ESP and the Extended Boot Loader Partition.</para></listitem>
  50
  51       <listitem><para>The Microsoft Windows EFI boot manager, if installed.</para></listitem>
  52
  53       <listitem><para>The Apple macOS boot manager, if installed.</para></listitem>
  54
  55       <listitem><para>The EFI Shell binary, if installed.</para></listitem>
  56
  57       <listitem><para>A reboot into the UEFI firmware setup option, if supported by the firmware.</para></listitem>
  58
  59       <listitem><para>Secure Boot variables enrollment if the UEFI firmware is in setup-mode and files are provided
  60       on the ESP.</para></listitem>
  61     </itemizedlist>
  62
  63     <para><command>systemd-boot</command> supports the following features:</para>
  64
  65     <itemizedlist>
  66       <listitem><para>Basic boot manager configuration changes (such as timeout
  67       configuration, default boot entry selection, …) may be made directly from the boot loader UI at
  68       boot-time, as well as during system runtime with EFI variables.</para></listitem>
  69
  70       <listitem><para>The boot manager integrates with the <command>systemctl</command> command to implement
  71       features such as <command>systemctl reboot --boot-loader-entry=…</command> (for rebooting into a
  72       specific boot menu entry, i.e. "reboot into Windows") and <command>systemctl reboot
  73       --boot-loader-menu=…</command> (for rebooting into the boot loader menu), by implementing the <ulink
  74       url="https://systemd.io/BOOT_LOADER_INTERFACE">Boot Loader Interface</ulink>. See
  75       <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
  76       details.</para></listitem>
  77
  78       <listitem><para>An EFI variable set by the boot loader informs the OS about the EFI System Partition used
  79       during boot. This is then used to automatically mount the correct EFI System Partition to
  80       <filename>/efi/</filename> or <filename>/boot/</filename> during OS runtime. See
  81       <citerefentry><refentrytitle>systemd-gpt-auto-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>
  82       for details.</para></listitem>
  83
  84       <listitem><para>The boot manager provides information about the boot time spent in UEFI firmware using
  85       the <ulink url="https://systemd.io/BOOT_LOADER_INTERFACE">Boot Loader Interface</ulink>. This
  86       information can be displayed using
  87       <citerefentry><refentrytitle>systemd-analyze</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
  88       </para></listitem>
  89
  90       <listitem><para>The boot manager implements boot counting and automatic fallback to older, working boot
  91       entries on failure. See <ulink url="https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT">Automatic Boot
  92       Assessment</ulink>.</para></listitem>
  93
  94       <listitem><para>The boot manager optionally reads a random seed from the ESP partition, combines it
  95       with a 'system token' stored in a persistent EFI variable and derives a random seed to use by the OS as
  96       entropy pool initialization, providing a full entropy pool during early boot.</para></listitem>
  97
  98       <listitem><para>The boot manager allows for Secure Boot variables to be enrolled if the UEFI firmware is
  99       in setup-mode. Additionally, variables can be automatically enrolled if configured.</para></listitem>
 100     </itemizedlist>
 101
 102     <para><citerefentry><refentrytitle>bootctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 103     may be used from a running system to locate the ESP and the Extended Boot Loader Partition, list
 104     available entries, and install <command>systemd-boot</command> itself.</para>
 105
 106     <para><citerefentry><refentrytitle>kernel-install</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 107     may be used to copy kernel images onto the ESP or the Extended Boot Loader Partition and to generate
 108     description files compliant with the Boot Loader
 109     Specification.</para>
 110
 111     <para><citerefentry><refentrytitle>systemd-stub</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 112     may be used as UEFI boot stub for executed kernels, which is useful to show graphical boot splashes
 113     before transitioning into the Linux world. It is also capable of automatically picking up auxiliary
 114     credential files (for boot parameterization) and system extension images, as companion files to the
 115     booted kernel images.</para>
 116   </refsect1>
 117
 118   <refsect1>
 119     <title>Key bindings</title>
 120     <para>The following keys may be used in the boot menu:</para>
 121
 122     <!-- Developer commands Q/v/Ctrl+l deliberately not advertised. -->
 123
 124     <variablelist>
 125       <varlistentry>
 126         <term><keycap>↑</keycap> (Up)</term>
 127         <term><keycap>↓</keycap> (Down)</term>
 128         <term><keycap>j</keycap></term>
 129         <term><keycap>k</keycap></term>
 130         <term><keycap>PageUp</keycap></term>
 131         <term><keycap>PageDown</keycap></term>
 132         <term><keycap>Home</keycap></term>
 133         <term><keycap>End</keycap></term>
 134         <listitem><para>Navigate up/down in the entry list</para></listitem>
 135       </varlistentry>
 136
 137       <varlistentry>
 138         <term><keycap>↵</keycap> (Enter)</term>
 139         <term><keycap>→</keycap> (Right)</term>
 140         <listitem><para>Boot selected entry</para></listitem>
 141       </varlistentry>
 142
 143       <varlistentry>
 144         <term><keycap>d</keycap></term>
 145         <listitem><para>Make selected entry the default</para></listitem>
 146       </varlistentry>
 147
 148       <varlistentry>
 149         <term><keycap>e</keycap></term>
 150         <listitem><para>Edit the kernel command line for selected entry</para></listitem>
 151       </varlistentry>
 152
 153       <varlistentry>
 154         <term><keycap>+</keycap></term>
 155         <term><keycap>t</keycap></term>
 156         <listitem><para>Increase the timeout before default entry is booted</para></listitem>
 157       </varlistentry>
 158
 159       <varlistentry>
 160         <term><keycap>-</keycap></term>
 161         <term><keycap>T</keycap></term>
 162         <listitem><para>Decrease the timeout</para></listitem>
 163       </varlistentry>
 164
 165       <varlistentry>
 166         <term><keycap>r</keycap></term>
 167         <listitem><para>Change screen resolution, skipping any unsupported modes.</para></listitem>
 168       </varlistentry>
 169
 170       <varlistentry>
 171         <term><keycap>R</keycap></term>
 172         <listitem><para>Reset screen resolution to firmware or configuration file default.</para></listitem>
 173       </varlistentry>
 174
 175       <varlistentry>
 176         <term><keycap>p</keycap></term>
 177         <listitem><para>Print status</para></listitem>
 178       </varlistentry>
 179
 180       <varlistentry>
 181         <term><keycap>h</keycap></term>
 182         <term><keycap>?</keycap></term>
 183         <term><keycap>F1</keycap></term>
 184         <listitem><para>Show a help screen</para></listitem>
 185       </varlistentry>
 186
 187       <varlistentry>
 188         <term><keycap>f</keycap></term>
 189         <listitem><para>Reboot into firmware interface.</para>
 190
 191         <para>For compatibility with the keybindings of several firmware implementations this operation
 192         may also be reached with <keycap>F2</keycap>, <keycap>F10</keycap>, <keycap>Del</keycap> and
 193         <keycap>Esc</keycap>.</para></listitem>
 194       </varlistentry>
 195     </variablelist>
 196
 197     <para>The following keys may be pressed during bootup or in the boot menu to directly boot a specific
 198     entry:</para>
 199
 200     <variablelist>
 201       <varlistentry>
 202         <term><keycap>l</keycap></term>
 203         <listitem><para>Linux</para></listitem>
 204       </varlistentry>
 205
 206       <varlistentry>
 207         <term><keycap>w</keycap></term>
 208         <listitem><para>Windows</para></listitem>
 209       </varlistentry>
 210
 211       <varlistentry>
 212         <term><keycap>a</keycap></term>
 213         <listitem><para>macOS</para></listitem>
 214       </varlistentry>
 215
 216       <varlistentry>
 217         <term><keycap>s</keycap></term>
 218         <listitem><para>EFI shell</para></listitem>
 219       </varlistentry>
 220
 221       <varlistentry>
 222         <term><keycap>1</keycap></term>
 223         <term><keycap>2</keycap></term>
 224         <term><keycap>3</keycap></term>
 225         <term><keycap>4</keycap></term>
 226         <term><keycap>5</keycap></term>
 227         <term><keycap>6</keycap></term>
 228         <term><keycap>7</keycap></term>
 229         <term><keycap>8</keycap></term>
 230         <term><keycap>9</keycap></term>
 231         <listitem><para>Boot entry number 1 … 9</para></listitem>
 232       </varlistentry>
 233     </variablelist>
 234
 235     <para>The boot menu is shown when a non-zero menu timeout has been configured. If the menu timeout has
 236     been set to zero, it is sufficient to press any key — before the boot loader initializes — to bring up
 237     the boot menu, except for the keys listed immediately above as they directly boot into the selected boot
 238     menu item. Note that depending on the firmware implementation the time window where key presses are
 239     accepted before the boot loader initializes might be short. If the window is missed, reboot and try
 240     again, possibly pressing a suitable key (e.g. the space bar) continuously; on most systems it should be
 241     possible to hit the time window after a few attempts. To avoid this problem, consider setting a non-zero
 242     timeout, thus showing the boot menu unconditionally. Some desktop environments might offer an option to
 243     directly boot into the boot menu, to avoid the problem altogether. Alternatively, use the command line
 244     <command>systemctl reboot --boot-loader-menu=0</command> from the shell.</para>
 245
 246     <para>In the editor, most keys simply insert themselves, but the following keys
 247     may be used to perform additional actions:</para>
 248
 249     <variablelist>
 250       <varlistentry>
 251         <term><keycap>←</keycap> (Left)</term>
 252         <term><keycap>→</keycap> (Right)</term>
 253         <term><keycap>Home</keycap></term>
 254         <term><keycap>End</keycap></term>
 255         <listitem><para>Navigate left/right</para></listitem>
 256       </varlistentry>
 257
 258       <varlistentry>
 259         <term><keycap>Esc</keycap></term>
 260         <term><keycombo><keycap>Ctrl</keycap><keycap>c</keycap></keycombo></term>
 261         <listitem><para>Abort the edit and quit the editor</para></listitem>
 262       </varlistentry>
 263
 264       <varlistentry>
 265         <term><keycombo><keycap>Ctrl</keycap><keycap>k</keycap></keycombo></term>
 266         <listitem><para>Clear the command line forwards</para></listitem>
 267       </varlistentry>
 268
 269       <varlistentry>
 270         <term><keycombo><keycap>Ctrl</keycap><keycap>w</keycap></keycombo></term>
 271         <term><keycombo><keycap>Alt</keycap><keycap>Backspace</keycap></keycombo></term>
 272         <listitem><para>Delete word backwards</para></listitem>
 273       </varlistentry>
 274
 275       <varlistentry>
 276         <term><keycombo><keycap>Ctrl</keycap><keycap>Del</keycap></keycombo></term>
 277         <term><keycombo><keycap>Alt</keycap><keycap>d</keycap></keycombo></term>
 278         <listitem><para>Delete word forwards</para></listitem>
 279       </varlistentry>
 280
 281       <varlistentry>
 282         <term><keycap>↵</keycap> (Enter)</term>
 283         <listitem><para>Boot entry with the edited command line</para></listitem>
 284       </varlistentry>
 285     </variablelist>
 286
 287     <para>Note that unless configured otherwise in the UEFI firmware, systemd-boot will
 288     use the US keyboard layout, so key labels might not match for keys like +/-.
 289     </para>
 290   </refsect1>
 291
 292   <refsect1>
 293     <title>Files</title>
 294
 295     <para>The files <command>systemd-boot</command> processes generally reside on the UEFI ESP which is
 296     usually mounted to <filename>/efi/</filename>, <filename>/boot/</filename> or
 297     <filename>/boot/efi/</filename> during OS runtime. It also processes files on the Extended Boot Loader
 298     partition which is typically mounted to <filename>/boot/</filename>, if it
 299     exists.</para>
 300
 301     <para><command>systemd-boot</command> reads runtime configuration such as the boot timeout and default
 302     entry from <filename>/loader/loader.conf</filename> on the ESP (in combination with data read from EFI
 303     variables). See
 304     <citerefentry><refentrytitle>loader.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
 305
 306     <para>Boot entry description files following the <ulink
 307     url="https://uapi-group.org/specifications/specs/boot_loader_specification">Boot Loader Specification</ulink> are read from
 308     <filename>/loader/entries/</filename> on the ESP and the Extended Boot Loader partition.</para>
 309
 310     <para>Unified kernel boot entries following the <ulink
 311     url="https://uapi-group.org/specifications/specs/boot_loader_specification">Boot Loader Specification</ulink> are read from
 312     <filename>/EFI/Linux/</filename> on the ESP and the Extended Boot Loader partition.</para>
 313
 314     <para>Optionally, a random seed for early boot entropy pool provisioning is stored in
 315     <filename>/loader/random-seed</filename> in the ESP.</para>
 316
 317     <para>During initialization, <command>sd-boot</command> automatically loads all driver files placed in
 318     the <filename>/EFI/systemd/drivers/</filename> directory of the ESP. The files placed there must have an
 319     extension of the EFI architecture ID followed by <filename>.efi</filename> (e.g. for x86-64 this means a
 320     suffix of <filename>x64.efi</filename>). This may be used to automatically load file system drivers and
 321     similar, to extend the native firmware support.</para>
 322
 323     <para>Enrollment of Secure Boot variables can be performed manually or automatically if files are available
 324     under <filename>/loader/keys/<replaceable>NAME</replaceable>/{db,KEK,PK}.auth</filename>, <replaceable>NAME</replaceable>
 325     being the display name for the set of variables in the menu. If one of the sets is named <filename>auto</filename>
 326     then it might be enrolled automatically depending on whether <literal>secure-boot-enroll</literal> is set
 327     to force or not.</para>
 328   </refsect1>
 329
 330   <refsect1>
 331     <title>EFI Variables</title>
 332
 333     <para>The following EFI variables are defined, set and read by <command>systemd-boot</command>, under the
 334     vendor UUID <literal>4a67b082-0a4c-41cf-b6c7-440b29bb8c4f</literal>, for communication between the boot
 335     loader and the OS:</para>
 336
 337     <variablelist class='efi-variables'>
 338       <varlistentry>
 339         <term><varname>LoaderBootCountPath</varname></term>
 340         <listitem><para>If boot counting is enabled, contains the path to the file in whose name the boot counters are
 341         encoded. Set by the boot
 342         loader. <citerefentry><refentrytitle>systemd-bless-boot.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 343         uses this information to mark a boot as successful as determined by the successful activation of the
 344         <filename>boot-complete.target</filename> target unit.</para></listitem>
 345       </varlistentry>
 346
 347       <varlistentry>
 348         <term><varname>LoaderConfigTimeout</varname></term>
 349         <term><varname>LoaderConfigTimeoutOneShot</varname></term>
 350         <listitem><para>The menu timeout in seconds. Read by the boot loader. <varname>LoaderConfigTimeout</varname>
 351         is maintained persistently, while <varname>LoaderConfigTimeoutOneShot</varname> is a one-time override which is
 352         read once (in which case it takes precedence over <varname>LoaderConfigTimeout</varname>) and then
 353         removed. <varname>LoaderConfigTimeout</varname> may be manipulated with the
 354         <keycap>t</keycap>/<keycap>T</keycap> keys, see above.</para></listitem>
 355       </varlistentry>
 356
 357       <varlistentry>
 358         <term><varname>LoaderDevicePartUUID</varname></term>
 359
 360         <listitem><para>Contains the partition UUID of the EFI System Partition the boot loader was run from. Set by
 361         the boot
 362         loader. <citerefentry><refentrytitle>systemd-gpt-auto-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 363         uses this information to automatically find the disk booted from, in order to discover various other partitions
 364         on the same disk automatically.</para></listitem>
 365       </varlistentry>
 366
 367       <varlistentry>
 368         <term><varname>LoaderEntries</varname></term>
 369
 370         <listitem><para>A list of the identifiers of all discovered boot loader entries. Set by the boot
 371         loader.</para></listitem>
 372       </varlistentry>
 373
 374       <varlistentry>
 375         <term><varname>LoaderEntryDefault</varname></term>
 376         <term><varname>LoaderEntryOneShot</varname></term>
 377
 378         <listitem><para>The identifier of the default boot loader entry. Set primarily by the OS and read by the boot
 379         loader. <varname>LoaderEntryOneShot</varname> sets the default entry for the next boot only, while
 380         <varname>LoaderEntryDefault</varname> sets it persistently for all future
 381         boots. <citerefentry><refentrytitle>bootctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s
 382         <option>set-default</option> and <option>set-oneshot</option> commands make use of these variables. The boot
 383         loader modifies <varname>LoaderEntryDefault</varname> on request, when the <keycap>d</keycap> key is used, see
 384         above.</para></listitem>
 385       </varlistentry>
 386
 387       <varlistentry>
 388         <term><varname>LoaderEntrySelected</varname></term>
 389
 390         <listitem><para>The identifier of the boot loader entry currently being booted. Set by the boot
 391         loader.</para></listitem>
 392       </varlistentry>
 393
 394       <varlistentry>
 395         <term><varname>LoaderFeatures</varname></term>
 396
 397         <listitem><para>A set of flags indicating the features the boot loader supports. Set by the boot loader. Use
 398         <citerefentry><refentrytitle>bootctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> to view this
 399         data.</para></listitem>
 400       </varlistentry>
 401
 402       <varlistentry>
 403         <term><varname>LoaderFirmwareInfo</varname></term>
 404         <term><varname>LoaderFirmwareType</varname></term>
 405
 406         <listitem><para>Brief firmware information. Set by the boot loader. Use
 407         <citerefentry><refentrytitle>bootctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> to view this
 408         data.</para></listitem>
 409       </varlistentry>
 410
 411       <varlistentry>
 412         <term><varname>LoaderImageIdentifier</varname></term>
 413
 414         <listitem><para>The path of executable of the boot loader used for the current boot, relative to the EFI System
 415         Partition's root directory. Set by the boot loader. Use
 416         <citerefentry><refentrytitle>bootctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> to view this
 417         data.</para></listitem>
 418       </varlistentry>
 419
 420       <varlistentry>
 421         <term><varname>LoaderInfo</varname></term>
 422
 423         <listitem><para>Brief information about the boot loader. Set by the boot loader. Use
 424         <citerefentry><refentrytitle>bootctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> to view this
 425         data.</para></listitem>
 426       </varlistentry>
 427
 428       <varlistentry>
 429         <term><varname>LoaderTimeExecUSec</varname></term>
 430         <term><varname>LoaderTimeInitUSec</varname></term>
 431         <term><varname>LoaderTimeMenuUsec</varname></term>
 432
 433         <listitem><para>Information about the time spent in various parts of the boot loader. Set by the boot
 434         loader. Use <citerefentry><refentrytitle>systemd-analyze</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 435         to view this data. </para></listitem>
 436       </varlistentry>
 437
 438       <varlistentry>
 439         <term><varname>LoaderSystemToken</varname></term>
 440
 441         <listitem><para>A binary random data field, that is used for generating the random seed to pass to
 442         the OS (see above). Note that this random data is generally only generated once, during OS
 443         installation, and is then never updated again.</para></listitem>
 444       </varlistentry>
 445     </variablelist>
 446
 447     <para>Many of these variables are defined by the <ulink
 448     url="https://systemd.io/BOOT_LOADER_INTERFACE">Boot Loader Interface</ulink>.</para>
 449   </refsect1>
 450
 451   <refsect1>
 452     <title>Boot Counting</title>
 453
 454     <para><command>systemd-boot</command> implements a simple boot counting mechanism on top of the <ulink
 455     url="https://uapi-group.org/specifications/specs/boot_loader_specification">Boot Loader Specification</ulink>, for automatic and unattended
 456     fallback to older kernel versions/boot loader entries when a specific entry continuously fails. Any boot loader
 457     entry file and unified kernel image file that contains a <literal>+</literal> followed by one or two numbers (if
 458     two they need to be separated by a <literal>-</literal>), before the <filename>.conf</filename> or
 459     <filename>.efi</filename> suffix is subject to boot counting: the first of the two numbers ('tries left') is
 460     decreased by one on every boot attempt, the second of the two numbers ('tries done') is increased by one (if 'tries
 461     done' is absent it is considered equivalent to 0). Depending on the current value of these two counters the boot
 462     entry is considered to be in one of three states:</para>
 463
 464     <orderedlist>
 465       <listitem><para>If the 'tries left' counter of an entry is greater than zero the entry is considered to be in
 466       'indeterminate' state. This means the entry has not completed booting successfully yet, but also hasn't been
 467       determined not to work.</para></listitem>
 468
 469       <listitem><para>If the 'tries left' counter of an entry is zero it is considered to be in 'bad' state. This means
 470       no further attempts to boot this item will be made (that is, unless all other boot entries are also in 'bad'
 471       state), as all attempts to boot this entry have not completed successfully.</para></listitem>
 472
 473       <listitem><para>If the 'tries left' and 'tries done' counters of an entry are absent it is considered to be in
 474       'good' state. This means further boot counting for the entry is turned off, as it successfully booted at least
 475       once. The
 476       <citerefentry><refentrytitle>systemd-bless-boot.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 477       service moves the currently booted entry from 'indeterminate' into 'good' state when a boot attempt completed
 478       successfully.</para></listitem>
 479     </orderedlist>
 480
 481     <para>Generally, when new entries are added to the boot loader, they first start out in 'indeterminate' state,
 482     i.e. with a 'tries left' counter greater than zero. The boot entry remains in this state until either it managed to
 483     complete a full boot successfully at least once (in which case it will be in 'good' state) — or the 'tries left'
 484     counter reaches zero (in which case it will be in 'bad' state).</para>
 485
 486     <para>Example: let's say a boot loader entry file <filename>foo.conf</filename> is set up for 3 boot tries. The
 487     installer will hence create it under the name <filename>foo+3.conf</filename>. On first boot, the boot loader will
 488     rename it to <filename>foo+2-1.conf</filename>. If that boot does not complete successfully, the boot loader will
 489     rename it to <filename>foo+1-2.conf</filename> on the following boot. If that fails too, it will finally be renamed
 490     <filename>foo+0-3.conf</filename> by the boot loader on next boot, after which it will be considered 'bad'. If the
 491     boot succeeds however the entry file will be renamed to <filename>foo.conf</filename> by the OS, so that it is
 492     considered 'good' from then on.</para>
 493
 494     <para>The boot menu takes the 'tries left' counter into account when sorting the menu entries: entries in 'bad'
 495     state are ordered at the beginning of the list, and entries in 'good' or 'indeterminate' at the end. The user can
 496     freely choose to boot any entry of the menu, including those already marked 'bad'. If the menu entry to boot is
 497     automatically determined, this means that 'good' or 'indeterminate' entries are generally preferred (as the bottom
 498     item of the menu is the one booted by default), and 'bad' entries will only be considered if there are no 'good' or
 499     'indeterminate' entries left.</para>
 500
 501     <para>The <citerefentry><refentrytitle>kernel-install</refentrytitle><manvolnum>8</manvolnum></citerefentry> kernel
 502     install framework optionally sets the initial 'tries left' counter to the value specified in
 503     <filename>/etc/kernel/tries</filename> when a boot loader entry is first created.</para>
 504   </refsect1>
 505
 506   <refsect1>
 507     <title>Using systemd-boot in virtual machines.</title>
 508
 509     <para>When using qemu with OVMF (UEFI Firmware for virtual machines) the <option>-kernel</option> switch
 510     works not only for linux kernels, but for any EFI binary, including sd-boot and unified linux
 511     kernels.  Example command line for loading sd-boot on x64:</para>
 512
 513     <para>
 514       <command>qemu-system-x86_64 <replaceable>[ ... ]</replaceable>
 515       -kernel /usr/lib/systemd/boot/efi/systemd-bootx64.efi</command>
 516     </para>
 517
 518     <para>systemd-boot will detect that it was started directly instead of being loaded from ESP and will
 519     search for the ESP in that case, taking into account boot order information from the hypervisor (if
 520     available).</para>
 521   </refsect1>
 522
 523   <refsect1>
 524     <title>See Also</title>
 525     <para>
 526       <citerefentry><refentrytitle>bootctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 527       <citerefentry><refentrytitle>loader.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 528       <citerefentry><refentrytitle>systemd-bless-boot.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 529       <citerefentry><refentrytitle>systemd-boot-random-seed.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 530       <citerefentry><refentrytitle>kernel-install</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 531       <citerefentry><refentrytitle>systemd-stub</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 532       <ulink url="https://uapi-group.org/specifications/specs/boot_loader_specification">Boot Loader Specification</ulink>,
 533       <ulink url="https://systemd.io/BOOT_LOADER_INTERFACE">Boot Loader Interface</ulink>
 534     </para>
 535   </refsect1>
 536 </refentry>