Boot Process in details for (X86) Computers Hello,,, Let's discuss what happens between the time that you power up your PC and when the desktop appears. In fact we should know that the boot process differs from an OS to other but I will try to explain the boot process in more details. Before speaking about the boot process I would like to explain some important definitions:
Boot sector: -It is the 1st sector "512 bytes" of (hard disk, floppy disk, or similar data storage device) that contains code for booting operating systems or programs. -To be a valid boot sector, the two-byte hex word 0xAA55 "boot signature" must exist at the end of the sector, otherwise the BIOS or MBR code will search for another bootable device or give you an error message. -Kinds of boot sectors: 1- Master boot record (MBR) 1) It is the first sector "512 bytes" of a data storage device that has been partitioned. 2) The MBR is not located in a partition, it is located at a Main Boot Record area in front of the first partition at cylinder 0, head 0, and sector 1. 3) The MBR contains: >> partition table: It contains the primary partitions entries but the partition table entries for other secondary partitions are stored in extended boot records "EBRs". >> Master boot code: This code normally scans the partition table to find the one that is marked with the active flag. It then loads and runs the Volume Boot Record for that partition. But there is boot loaders and operating systems that replace this code with there own code as it may hold the 1st stage boot loader code that activates the 2nd stage boot loader.
2- Volume boot record (VBR) 1) It is the first sector of a data storage device that has not been partitioned, or the first sector of an individual partition on a data storage device that has been partitioned. 2) It may contain a code to load and call an operating system (or other standalone program) installed on that device or within that partition. 3) The VBR contains : >> Disk Parameter Block: Also it is called the media parameter block, this is a data table that contains specific information about the volume, such as its specifications, (size, number of sectors it contains, etc.), label name, and number of sectors per cluster used on the partition also the information contained in the disk parameter block is used by the operating system to determine where other internal structures of the partition are located, such as the file allocation tables. >> Volume Boot Code: This is a code that is used to start the load of the operating system. This code is called by the master boot code that is stored in the master boot record, but only for the primary partition that is set as active. For other partitions, this code sits unused. Note -It is not necessary for the code stored in the first sector of a bootable storage device to immediately load any boot code for an OS. As the BIOS passes control to whatever exists there, as long as the sector meets the qualification of having the boot record signature in its last two bytes. So it's easy to replace the usual boot code found in an MBR with more complex boot loaders. Boot Loader: -It is the program that loads the main operating system for the computer. -The boot loader is splitted to 2 stages as BIOS can only hold a small amount of data. -Boot loaders are usually configured in one of two ways: 1. Primary boot loaders " Installed to MBR" It is boot loaders that its first stage boot loader is installed on the MBR. 2. Secondary boot loaders "Installed to bootable partition" It is boot loaders that its first stage boot loader is installed onto a bootable partition. A separate boot loader must then be installed into the MBR and configured to pass control to the secondary boot loader.
-The boot loader typically consists of three programs: 1. Boot sector program: -The boot sector program size is only about 446 bytes or less. As the boot sector is 512 byte and the last two bytes must contain the boot signature, and the Master Boot Record on a hard disk contains the partition table of 64 bytes, so only the first 446 bytes can be used. -Because of these size restrictions, boot sector programs are truly optimized for size and have to be written in assembly for this reason. Further, a boot sector program cannot do everything you want a boot loader to do. -Boot sector program does one of the following (not all three in one program): o Load another boot sector. This is typical for a boot sector program that lives in the master boot record "MBR" of a hard disk. It can find the first sector of the active partition and chain load that sector. o Load a second stage boot loader. It is generally not possible for a boot sector program to look into the directory for a file with a specific name and load that into memory, but exceptions exist, at least for DOS file systems. Most boot sector programs find the second stage by sector number rather than by name. The sector numbers have to be put into the boot sector by the boot loader installer. o Load the kernel directly. It will load it using the same way of loading the 2nd stage loader. For example the boot sector program in the Linux kernel can load the kernel directly into memory without the need for a second stage boot loader. As the kernel is located in contiguous sectors on a diskette, also the boot sector for DOS loads the MS- DOS kernel files IO.SYS and MSDOS.SYS directly, as the structure of an MSDOS file system is simple enough to find a file with a specific name in the root directory and load it into memory.
2. Second stage of boot loader: This is the real boot program. It contains the user interface and the kernel loader. It can load the operating system into memory and runs it. Alternatively it can load another boot loader specific to another operating system and let it run (This is called chain loading). 3. Boot loader installer: It is only run when the boot loader is installed on a disk. It performs the following tasks: o Install the boot sector. If the boot sector will be installed in the MBR of a hard disk or on a DOS file system "Partition", not all 512 bytes may be overwritten, but the partition table or the DOS parameter block must be preserved. o Tell the boot sector where the second stage boot loader is. Usually it writes one or more sector addresses into the boot loader. o Tell the second stage boot loader where all relevant information is (configuration, kernels). If you want examples for boot loaders here see below: o GRUB " Grand Unified Boot loader" : this is the best loader in my opinion and it has a lot of advantages and is used with linux widely. It has two editions : - Gnu GRUB: It is a GRUB loader used as default with linux. - GRUB4dos: It is a GRUB loader that supports NT kernels. o LILO "linux loader": it is a linux boot loader but not so well as gnu GRUB o Syslinux : another linux boot loader o ISOlinux : linux boot loader designed for boot from CD/DVD file system. o NTLDR: It it the boot loader for NT based systems like windows xp and windows server 2003 o BOOTMGR: It is a different boot loader that is used in windows vista and windows server 2008
Note Many boot loaders (like GRUB, BOOTMGR, LILO, and NTLDR) can be configured to give the user multiple booting choices. These choices can include different operating systems (for dual or multi-booting from different partitions or drives), different kernel versions of the same operating system (e.g., when a newer Linux kernel is installed, this gives one the option of using a known good kernel if problems arise), different kernel options (e.g., booting into a rescue or safe mode) or some standalone program that can function without an operating system, such as memory testers (e.g., memtest86+) or even games. Boot signature: It is the two bytes hexadecimal word 0xAA55 that is written at the end of a boot sector so that the BIOS identify it as a valid boot sector. Boot Process: It is a process that starts operating systems when the user turns on a computer. Boot sequence: It is the initial set of operations that the PC performs when it is switched on.
Let me now tell you the story of boot process in details: When you turn on your PC, the processor attempts to begin the process of processing data. But, since the system memory is empty, the processor doesn't really have anything to execute as computer's processor can only execute program code found in Read-Only Memory (ROM) and Random Access Memory (RAM). Modern operating systems and applications and data are stored on nonvolatile data storage devices, such as hard disc drives, CD, DVD, USB flash drive, and floppy disk. 1. BIOS "Basic Input/Output System" When a computer is first powered on CPU must initially execute a small program stored in ROM with some small data needed to access the nonvolatile devices and search for valid boot media so the processor looks at the end of system memory for the Basic Input/Output System or BIOS program and runs it. >>Now the BIOS has some jobs to do : 1) It will load and run POST "Power on self test" to check and initialize required devices. Simply it sends [OUT] signal to any attached device then if the device is working it will reply with [IN] signal or the CPU gives you error message. Note The BIOS starts the test by the video card test. If there is a problem with it the CPU can't give you an error message (as you can't see any thing) so it will use sound and will give you tones "Beep codes" 2) It will search for valid boot sector in a list that you can configure at the bios setup. The bios will jump to the list and checks the 1st sector of every device in it (in order) until it finds a boot sector contains (boot signature). If it is searching a hard disk, it looks for MBR " master boot record" at the first sector on the disk, if it is searching a floppy disk, it looks for VBR "volume boot record" at the same address on the floppy disk.
Once the BIOS has found a bootable device it loads the boot sector to ram at address 0x7C00 and execute it In the case of a hard disk, this is the master boot record (MBR) o We will assume it will boot from hard disk or (formatted USB drive) and it will load the MBR code to RAM. 2. Master Boot Record "MBR" Now at this point the boot process varies to many ways as the boot code in the MBR can be modified be boot loaders of each OS MBR boot code normally scans the list of (primary) partition entries in its partition table to find the only one that is marked active. It then loads and runs the Volume Boot Record for that partition and The Volume Boot Record in most operating systems its main function is to load and execute the operating system kernel, which continues startup. This happens with DOS Operating Systems "MS-DOS, Win9x". In other operating systems the VBR loads an OS loader which loads the required operating system kernel, which continues startup. This happens with boot loaders like NTLDR for XP and BOOTMGR for VISTA. The MBR boot code may load a second stage of boot loader which will select a partition (often via user input) and load its boot sector, which usually loads the corresponding operating system kernel. This happens with Boot loaders like GRUB, GRUB4DOS, LiLo. Note: -NTLDR and BOOTMGR are always installed in VBR and the MBR boot code is set points to the VBR to load them. But GRUB and GRUB4dos by default installs their boot code in the MBR that loads the 2nd stage loader and then you can load the VBR where NTLDR is installed or you can load other kernels directly. This is why some people suffer when they install linux then install XP after it as XP will modify the MBR boot code to the dos code that loads the VBR directly so it won't see GRUB loader!! unlike GRUB which is more smart as it modifies MBR boot code to load GRUB then GRUB can let you choose between linux kernel or NTLDR.
3. The OS kernel: Now the final stage is the kernel that will take control and the system will initialize itself, and may load device drivers and other programs that are needed for the normal operation of the OS. Finally the boot process is considered complete when the computer is ready to interact with the user. 2nd Stage Loader MBR BIOS Power ON VBR Kernel Load the system Note: Many embedded systems must boot immediately. For example, waiting a minute for a digital television to start is generally unacceptable. Therefore such devices have their complete operating system in ROM or flash memory so the device can begin functioning immediately.
Now I will give you the boot sequence for some operating systems briefly and you will notice it is similar to my illustration but with little difference. Linux Boot process: o BIOS. -Performs power on self test to check all attached devices. -Loads boot sector from one of the devices in the list made by BIOS setup program. o MBR. Loads the 1st stage of Boot loader "boot code" which activates the 2nd stage of boot loader. o Boot Loader. Once the boot loader take control it will let the user specify which kernel to boot or it will boot the default kernel automatically. o Kernel. -It initializes and configures the computer's memory and various hardware attached to the system, then looks for initrd image in a predetermined location in memory, decompresses it, mounts it, and loads all necessary drivers. -Next, it initializes virtual devices related to the file system, such as LVM or software RAID before unmounting the initrd disk image and freeing up all the memory the disk image once occupied. -The kernel then creates a root device, mounts the root partition read-only, and frees any unused memory. At this point, the kernel is loaded into memory and operational. -The kernel now runs init process
o Init process. It coordinates the rest of the boot process and configures the environment for the user as it becomes the parent or grandparent of all of the processes that start up automatically on the system. Note: -The method used to boot Red Hat Enterprise Linux is called direct loading because the boot loader loads the operating system directly. There is no intermediary between the boot loader and the kernel. -But the boot process used by other operating systems may differ. For example, the Microsoft Windows operating system, as well as other operating systems, are loaded using chain loading. In this method, the MBR points to the first sector of the partition holding the operating system (VBR), where it finds the files necessary to actually boot that operating system. -GRUB Loader supports both direct and chain loading boot methods, allowing it to boot almost any operating system.
DOS Boot Process: o BIOS. -Performs power on self test to check all attached devices. -Loads boot sector from one of the devices in the list made by BIOS setup program. o MBR. -Standard DOS MBR scans Partition table to locate active partition and its boot sector "VBR" is loaded into memory. -VBR code loads DOS kernel files (IO.SYS and MSDOS.SYS). NT Boot Process: o BIOS. -Performs power on self test to check all attached devices. -Loads boot sector from one of the devices in the list made by BIOS setup program. o MBR. -MBR scans Partition table to locate active partition and its boot sector and load it into memory. - ThenVBR code loads the NTLDR to RAM and initialize it. o NTLDR. -NTLDR starts the appropriate minifile system drivers. Minifile system drivers are built into NTLDR and can read FAT or NTFS. -NTLDR reads the Boot.ini file -NTLDR loads the operating system selected, on of two things happen * If Windows NT is selected, NTLDR runs Ntdetect.com * For other operating system, NTLDR loads and runs Bootsect.dos and passes control to it. -Ntdetect.com scans the computer hardware and sends the list to NTLDR for inclusion in HKEY_LOCAL_MACHINE\HARDWARE -NTLDR then loads Ntoskrnl.exe, Hal.dll and the system hive -NTLDR scans the System hive and loads the device drivers configured to start at boot time. -NTLDR passes control to Ntoskrnl.exe, at which point the boot process ends and the load phases begin.
The vista boot process: o BIOS. -Performs power on self test to check all attached devices. -Loads boot sector from one of the devices in the list made by BIOS setup program. o MBR. -MBR scans Partition table to locate active partition and its boot sector and load it into memory. - ThenVBR code loads the BOOTMGR to RAM and initialize it o BOOTMGR. -BOOTMGR looks for active partition -BOOTMGR reads the BCD file from the \boot directory on the active partition -The BCD (boot configuration database) contains various configuration parameters (this information was previously stored in the boot.ini) -When windows vista is selected, BOOTMGR transfer control to the Windows Loader (winload.exe) or winresume.exe in case the system was hibernated. -Winloader loads drivers that are set to start at boot and then transfers the control to the windows kernel. -There is not msgina.dll in windows vista (the shell draws the login screen). Prepared By Ahmed Ragab "Nour El2mar".