A Detailed Look at the Boot Process

The beginning of the boot process varies depending on the hardware platform being used. However, once the kernel is found and loaded by the boot loader, the default boot process is identical across all architectures. This chapter focuses on the x86 architecture.

The BIOS

When an x86 computer is booted, the processor looks at the end of system memory for the Basic Input/Output System or BIOS program and runs it. The BIOS controls not only the first step of the boot process, but also provides the lowest level interface to peripheral devices. For this reason it is written into read-only, permanent memory and is always available for use.

Once loaded, the BIOS tests the system, looks for and checks peripherals, and then locates a valid device with which to boot the system. Usually, it checks any diskette drives and CD-ROM drives present for bootable media, then, failing that, looks to the system's hard drives. In most cases, the order of the drives searched while booting is controlled with a setting in BIOS, and it looks on the master IDE device on the primary IDE bus. The BIOS then loads into memory whatever program is residing in the first sector of this device, called the Master Boot Record or MBR. The MBR is only 512 bytes in size and contains machine code instructions for booting the machine, called a boot loader (or primary boot loader), along with the partition table. Once the BIOS finds and loads the boot loader program into memory, it yields control of the boot process to it.

The Master Boot Record (MBR)

Master Boot Record - An area of the outermost cylinder of a PC hard disk which contains the partition table. This contains four entries identifying the types, starting cylinder and sizes of up to four partitions on the hard disk. One of the entries is flagged as 'active'; this marks the partition from which the machine will boot. (Floppy disks don't have an MBR, since they don't have a partition table. Instead, they just have a boot sector (same as a logical disk), which contains a Media Descriptor Table (MDT) and bootstrap loader. The MDT describes the format of a floppy disk or logical disk).

Master Boot Record – The first physical sector on a bootable disk drive. The place where the system BIOS looks when the computer is first booted, to determine which partition is currently active (bootable), before reading that partition’s first (boot) sector and booting from the partition.

Master Boot Record - A reserved space on a hard drive where information on what to do when booting is stored. LILO or other boot managers can be written here.

The Linux MBR

In Linux, this MBR contains instructions on how to load the boot loader, GRUB or LILO (LInux LOader), depending on the boot loader that was installed during the Linux install phase. The MBR then loads the boot loader, which takes over the process (if the boot loader is installed in the MBR). In the default Linux configuration, GRUB or LILO uses the settings in the MBR to display boot options and allow for user input on which operating system to actually start up.

To answer the question: How does the boot loader in the MBR know what to do when the MBR is read? LILO actually has already written the instructions there through the use of lilo with the /etc/lilo.conf configuration file. GRUB has also written the instructions in the /boot/grub/grub.conf configuration file.

Windows MBR

In Windows, the MBR contains instructions on how to load Windows.

In Windows NT/2k/XP, this process is automated, as NT/2k/XP automatically writes the boot sector data to all disks being formatted.

In MS-DOS and Windows 95/98/ME, you must request that the boot sector be written during formatting process using the /s switch as in FORMAT C:/S or if within the Windows GUI (Graphical User Interface) using the "Write system files" option. You can also write or re-write the boot sector using the SYS.COM utility in MS-DOS or in Windows 95/98/ME at an MS-DOS prompt by typing SYS C:.

Boot Process continued - Linux

Linux Boot Process

The Linux Boot Loaders

Under Linux two boot loaders are available: GRUB or LILO.

Both boot loaders for the x86 platform are broken into at least two stages. The first stage is a small machine code binary on the MBR. Its sole job is to locate the second stage boot loader and load the first part of it into memory.

GRUB is the newer boot loader and has the advantage of being able read ext2 and ext3 partitions and load its configuration file (/boot/grub/grub.conf) at boot time.

With LILO, the second stage boot loader uses information on the MBR to determine the boot options available to the user. This means that any time a configuration change is made or kernel is manually upgraded, the /sbin/lilo -v -v command must be executed to write the appropriate information to the MBR.

Once the second stage boot loader is in memory, it presents the user with the Linux initial, graphical screen showing the different operating systems or kernels it has been configured to boot. On this screen a user can use the arrow keys to choose which operating system or kernel they wish to boot and press [Enter]. If no key is pressed, the boot loader will load the default selection after a configurable period of time has passed.

Once the second stage boot loader has determined which kernel to boot, it locates the corresponding kernel binary in the /boot/ directory. The kernel binary is named using the format /boot/vmlinuz- file (where corresponds to the kernel version specified in the boot loader's settings).

The boot loader then places the appropriate initial RAM disk image, called an initrd, into memory. The initrd is used by the kernel to load drivers necessary to boot the system. This is particularly important if SCSI hard drives are present or if the systems uses the ext3 file system.

Once the kernel and the initrd image are loaded into memory, the boot loader hands control of the boot process to the kernel.

GRUB

GNU GRand Unified Boot loader or GRUB is a program which enables the user to select which installed operating system or kernel to load at system boot time. It also allows the user to pass arguments to the kernel.

GRUB and the x86 Boot Process

This section discusses in more detail the specific role GRUB plays when booting an x86 system.

GRUB loads itself into memory in the following stages:

The Stage 1 or primary boot loader is read into memory by the BIOS from the MBR. The primary boot loader exists on less than 512 bytes of disk space within the MBR and is capable of loading either the Stage 1.5 or Stage 2 boot loader.

The Stage 1.5 boot loader is read into memory by the Stage 1 boot loader, if necessary. Some hardware requires an intermediate step to get to the Stage 2 boot loader. This is sometimes true when the /boot partition is above the 1024 cylinder head of the hard drive or when using LBA mode. The Stage 1.5 boot loader is found either on the /boot partition or on a small part of the MBR and the /boot partition.

The Stage 2 or secondary boot loader is read into memory. The secondary boot loader displays the GRUB menu and command environment. This interface allows you to select which operating system or Linux kernel to boot, pass arguments to the kernel, or look at system parameters, such as available RAM.

The secondary boot loader reads the operating system or kernel and initrd into memory. Once GRUB determines which operating system to start, it loads it into memory and transfers control of the machine to that operating system.

The boot method used to boot Linux is called the direct loading method because the boot loader loads the operating system directly. There is no intermediary between the boot loader and the kernel.

The boot process used by other operating systems may differ. For example, Microsoft's DOS and Windows operating systems, as well as various other proprietary operating systems, are loaded using a chain loading boot method. Under this method, the MBR points to the first sector of the partition holding the operating system. There it finds the files necessary to actually boot that operating system.

GRUB supports both direct and chain-loading boot methods, allowing it to boot almost any operating system.

LILO

LILO is an acronym for the LInux LOader and has been used to boot Linux on x86 systems for many years. Although GRUB is now the default boot loader, some users prefer to use LILO because it is more familiar to them and others use it out of necessity, since GRUB may have trouble booting some hardware.

LILO and the x86 Boot Process

This section discusses in detail the specific role LILO plays when booting an x86 system.

LILO loads itself into memory almost identically to GRUB, except it is only a two stage loader.

The Stage 1 or primary boot loader is read into memory by the BIOS from the MBR. The primary boot loader exists on less than 512 bytes of disk space within the MBR. It only loads the Stage 2 boot loader and passes disk geometry information to it.

The Stage 2 or secondary boot loader is read into memory. The secondary boot loader displays the Linux initial screen. This screen allows you to select which operating system or Linux kernel to boot.

The Stage 2 boot loader reads the operating system or kernel and initrd into memory. Once LILO determines which operating system to start, it loads it into memory and hands control of the machine to that operating system.

Once the Stage 2 boot loader is in memory, LILO displays the initial Linux screen with the different operating systems or kernels it has been configured to boot. By default, if Linux is the only operating system installed, linux will be the only available option. If the system has multiple processors there will be a linux-up option for the single processor kernel and a linux option for the multiple processor (SMP) kernel. If LILO is configured to boot other operating systems, those boot entries also appear on this screen.

The arrow keys allow a user to highlight the desired operating system and the [Enter] key begins the boot process.

If the selection is for Linux, the kernel is loaded. If the selection is for "other" (e.g. Windows), the first 512 bytes of the partition is loaded (i.e. the first sector of the partition holding that operating system).

LILO versus GRUB

In general, LILO works similarly to GRUB except for three major differences:

It has no interactive command interface.

It stores information about the location of the kernel or other operating system it is to load on the MBR.

It cannot read ext2 partitions.

The first point means the command prompt for LILO is not interactive and only allows one command with arguments.

The last two points mean that if you change LILO's configuration file or install a new kernel, you must rewrite the Stage 1 LILO boot loader to the MBR by using the following command:

/sbin/lilo -v -v

This method is more risky than the method used by GRUB because a misconfigured MBR leaves the system unbootable. With GRUB, if the configuration file is erroneously configured, it will default to its command line interface where the user can boot the system manually.

Uninstalling LILO and GRUB

Linux distributions, by default, install their own boot managers.

Using a DOS or Windows 9x/ME Boot Floppy

In case you have DOS or Windows 9x/ME on your system, you can use fdisk for this purpose.

Using Windows XP

In Windows XP, you can uninstall GRUB as follows:

1. Boot from the Windows XP CD and press the "R" key during the setup in order to start the Recovery Console.



2. Select your Windows XP installation from the list and enter the administrator password.


3. At the input prompt, enter the command "FIXMBR" and confirm the query with "y".


4. The MBR will be rewritten and GRUB will be uninstalled. Press "exit" to reboot the computer.

Using Windows 2000

In Windows 2000, you can uninstall GRUB as follows:

1. Boot from the Windows 2000 CD and press the "R" key during the setup and then the "K" key in the following menu in order to start the Recovery Console.



2. Select your Windows 2000 installation from the list and enter the administrator password.


3. At the input prompt, enter the command "FIXMBR" and confirm the query with "y".


4. The MBR will be rewritten and GRUB will be uninstalled. Press "exit" to reboot the computer.

When Lilo overwrites a boot sector, it saves a backup copy in /boot/boot.xxyy, where xxyy are the major and minor numbers of the device, in hex. You can see the major and minor numbers of your disk or partition by running ls -l /dev/device. For example, the first sector of /dev/hda (major 3, minor 0) will be saved in /boot/boot.0300, installing Lilo on /dev/fd0 creates /boot/boot.0200 and installing on /dev/sdb3> (major 8, minor 19) creates /boot/boot.0813. Note that Lilo won't create the file if there is already one so you don't need to care about the backup copy whenever you reinstall Lilo (for example, after recompiling your kernel). The backup copies found in /boot/ are always the snapshot of the situation before installing any Lilo.

Thus when during the Linux install process you select to install LILO to the MBR, then a backup copy of the pre LILO MBR will be saved as explained above. LILO has an uninstall feature which restores this backed up copy of the Master Boot Record to the MBR. This can be done as follows:

1. Log in to Linux and open up a terminal session.



2. su as root


3. type in:

"lilo -u" or "/sbin/lilo -u" - This format will result in A time-stamp being checked.
OR
"lilo -U" or "/sbin/lilo -U" - This format will result in the time-stamp NOT being checked.

OR use the more general form which allow you to select a specific hard drive.

"lilo -u /dev/hd[x]" or "/sbin/lilo -u /dev/hd[x]" - Where [x] is the hard disk you installed LILO to.


OR
"lilo -U /dev/hd[x]" or "/sbin/lilo -U /dev/hd[x]" - Where [x] is the hard disk you installed LILO to.

Another less formal but risky way of uninstalling LILO:

If Lilo is installed in /dev/hda, just do dd if=/boot/boot.0300 of=/dev/hda bs=446 count=1

This could be useful if you installed LILO elsewhere other than the MBR.

NOTE - The DOS / Windows based procedures outlined above for uninstalling GRUB can also be used just as effectively to remove LILO.

You can uninstall LILO by using the lilo -u command, or, if LILO is not installed on the MBR, you can disable it by using fdisk under either Linux or MS-DOS to make another partition active. If LILO has been installed as the MBR, you can restore the original MBR by booting under MS-DOS and using the command fdisk /MBR.

Windows Boot Process

After the POST completes successfully, the BIOS loads the Master Boot Record (MBR) from the hard disk or a 3.5" disk and runs the program that the MBR contains (i.e., the boot program). How much this program does depends largely upon the operating system you intend to load, MS-DOS, Windows 95/98/ME or Windows NT/2k/XP.

If the operating system is DOS, or any variant of Windows that starts out by booting the equivalent of DOS (which is all of them other than Windows NT/2k/XP) then a specific operating system load sequence, called the DOS Boot Process, commences.

If the operating system is Windows NT/2k/XP then a specific operating system load sequence, called the NT Boot Process, commences.

The DOS Boot Process

The MBR code will pass control to the code contained in the Boot Sector of the active primary partition. The code searches the root directory of the device being booted for the operating system files that contain the operating system. For a system running MS-DOS these are the files "IO.SYS", "MSDOS.SYS" and "COMMAND.COM".

If the operating system files are found, the boot program will load them into memory and transfer control to them. First, IO.SYS is loaded and its code executed. IO.SYS will then executed MSDOS.SYS (in pure DOS systems, MSDOS.SYS is just a text file in Windows 95 and later). Then the more complete operating system code loads and initializes the rest of the operating system structures. For MS-DOS, this means loading the command interpreter (COMMAND.COM) and then reading and interpreting the contents of the CONFIG.SYS and AUTOEXEC.BAT system control files. This initial DOS operating system files then controls the loading and execution of many more routines as the boot progresses and eventually this results in the graphical Windows environment that we see.

The NT Boot Process

The Master Boot Record then finds the active partition's starting location on the disk and loads an image of its first sector, called the Boot Sector, into memory. The Master Boot Record then transfers execution to that Boot Sector image. In the case of Windows NT, the Boot Sector is responsible for locating the executable file, NTLDR, which continues the boot process. When NTLDR loads, it then reads another file called the BOOT.INI, which must be located in the root of the drive "C".

The only disk services available to the Boot Sector code at this stage of system boot up are provided by the BIOS INT 13 interface. The Boot Sector code must be able to find NTLDR and file system data structures such as the root directory, the File Allocation Table (FAT) in the case of an MS-DOS FAT volume or the Master File Table in the case of an NTFS volume. These must be present within the area of the disk addressable by the 24-bit side, cylinder, sector structure used by the BIOS INT 13 interface and the partition table.

NT Boot Loader

NT Boot Loader is a special program that allow you to boot to multiple operating systems. Microsoft included it in Windows NT/2k/XP to allow users to dual boot Windows NT/2k/XP with DOS, Windows 95/98 and OS/2. Even if not supported, it also works with Linux. So when you start your computer, NT Boot Loader displays all available operating systems and lets you choose one. The following paragraphs details how this works.

When you start your computer it goes through POST (Power On Self Test). Then the BIOS reads the first sector on you primary master hard drive. This sector is called the MBR (Master Boot Record) and contains the partition table. These are four tables that describe up to four primary partitions. They identify the types, starting cylinder and sizes of up to four partitions on the hard disk. One of the entries is flagged as 'active', which marks the partition from which the machine will boot. When the BIOS transfers the control to the MBR, it first scans all tables to find an active partition. Operating systems can start only from an active partition and only one partition can be flagged as active at one time. When the MBR finds an active partition it transfers control to its first sector called the Partition Boot Sector, which continues the boot process.

The boot sector of Windows NT/2k/XP contains a small portion of code that understands the partitions file system. This is not the whole driver for the file system, but just small code that understands the structure of underlying file system and that can read the NTLDR file. The boot sector then calls NTLDR. NTLDR then switches the system to Protected Mode and enables Paging. Now, NTLDR reads the BOOT.INI file and displays the NT loader menu, from where a user can select the operating system to boot. If a user selects to boot to Windows 95/98, NTLDR opens bootsect.dos, which contains the previous boot sector that runs Windows 95/98.

When removing Windows NT/2k/XP and it’s associated NT boot loader we have to replace the Windows NT/2k/XP boot sector with the Windows 95/98 boot sector. To do this, users have to use sys (sys c:) command from Windows 95/98. This will overwrite Windows NT/2k/XP boot sector, and will make the system bootable directly to Windows 95/98.

Boot Files

Windows NT/2k/XP places some important files on its system partition. This partition is an active partition from where the operating system is being loaded. As you have read before, Windows NT/2k/XP needs the files – NTLDR, BOOT.INI and bootsect.dos to run the system. Apart from these files, another two files are located on the system partition. These files are ntdetect.com and sometimes ntbootdd.sys. Ntdetect.com collect system information during the boot, and ntbootdd.sys contains SCSI driver. If you want to completely remove Windows NT/2k/XP you have to remove all these files.

Have you seen your boot.ini file? Have you wondered at what it all means ? Do you want to be able to add/delete OS options to/from the boot menu ? Do you want to be able to temporarily hide OS options so that they are not selectable ? You can read all about it here (also includes working examples of boot.ini files).

All you ever wanted to know about boot.ini files