Skip to main content
p. 131

5.8 Boot Loader Details

Now we’ll look quickly at some boot loader internals. To understand how boot loaders like GRUB work, first we’ll survey how a PC boots when you turn it on. Because they must address the many inadequacies of traditional p. 133 PC boot mechanisms, boot loading schemes have several variations, but there are two main ones: MBR and UEFI.

5.8.1 MBR Boot​

In addition to the partition information described in Section 4.1, the MBR includes a small area of 441 bytes that the PC BIOS loads and executes after its Power-On Self-Test (POST). Unfortunately, this space is inadequate to house almost any boot loader, so additional space is necessary, resulting in what is sometimes called a multistage boot loader. In this case the initial piece of code in the MBR does nothing other than load the rest of the boot loader code. The remaining pieces of the boot loader are usually stuffed into the space between the MBR and the first partition on the disk. This isn’t terribly secure because anything can overwrite the code there, but most boot loaders do it, including most GRUB installations.

This scheme of shoving the boot loader code after the MBR doesn’t work with a GPT-partitioned disk using the BIOS to boot because the GPT information resides in the area after the MBR. (GPT leaves the traditional MBR alone for backward compatibility.) The workaround for GPT is to create a small partition called a BIOS boot partition with a special UUID (21686148-6449-6E6F-744E-656564454649) to give the full boot loader code a place to reside. However, this isn’t a common configuration, because GPT is normally used with UEFI, not the traditional BIOS. It’s usually found only in older systems that have very large disks (greater than 2TB); these are too large for MBR.

5.8.2 UEFI Boot​

PC manufacturers and software companies realized that the traditional PC BIOS is severely limited, so they decided to develop a replacement called Extensible Firmware Interface (EFI), which we’ve already discussed a bit in a few places in this chapter. EFI took a while to catch on for most PCs, but today it’s the most common, especially now that Microsoft requires secure boot for Windows. The current standard is Unified EFI (UEFI), which includes features such as a built-in shell and the ability to read partition tables and navigate filesystems. The GPT partitioning scheme is part of the UEFI standard.

Booting is radically different on UEFI systems compared to MBR. For the most part, it’s much easier to understand. Rather than executable boot code residing outside of a filesystem, there’s always a special VFAT filesystem called the EFI System Partition (ESP), which contains a directory named EFI. The ESP is usually mounted on your Linux system at /boot/efi, so you’ll probably find most of the EFI directory structure starting at /boot/efi/EFI. Each boot loader has its own identifier and a corresponding subdirectory, such as efi/microsoft, efi/apple, efi/ubuntu, or efi/grub. A boot loader file has a .efi extension and resides in one of these subdirectories, along with other supporting files. If you go exploring, you might find files such as grubx64.efi (the EFI version of GRUB) and shimx64.efi.

p. 134
note

The ESP differs from a BIOS boot partition, described in Section 5.8.1, and has a different UUID. You shouldn’t encounter a system with both.

There’s a wrinkle, though: you can’t just put old boot loader code into the ESP, because the old code was written for the BIOS interface. Instead, you must provide a boot loader written for UEFI. For example, when using GRUB, you must install the UEFI version of GRUB rather than the BIOS version. And, as explained earlier in “Installing GRUB with UEFI,” you must announce new boot loaders to the firmware.

Finally, as Section 5.6 noted, we have to contend with the “secure boot” issue.

5.8.3 How GRUB Works​

Let’s wrap up our discussion of GRUB by looking at how it does its work:

  1. The PC BIOS or firmware initializes the hardware and searches its boot-order storage devices for boot code.
  2. Upon finding the boot code, the BIOS/firmware loads and executes it. This is where GRUB begins.
  3. The GRUB core loads.
  4. The core initializes. At this point, GRUB can now access disks and filesystems.
  5. GRUB identifies its boot partition and loads a configuration there.
  6. GRUB gives the user a chance to change the configuration.
  7. After a timeout or user action, GRUB executes the configuration (the sequence of commands in the grub.cfg file, as outlined in Section 5.5.2).
  8. In the course of executing the configuration, GRUB may load additional code (modules) in the boot partition. Some of these modules may be preloaded.
  9. GRUB executes a boot command to load and execute the kernel as specified by the configuration’s linux command.

Steps 3 and 4 of this sequence, where the GRUB core loads, can be complicated due to the inadequacies of traditional PC boot mechanisms. The biggest question is “Where is the GRUB core?” There are three basic possibilities:

  • Partially stuffed between the MBR and the beginning of the first partition
  • In a regular partition
  • In a special boot partition: a GPT boot partition, ESP, or elsewhere

In all cases except where you have an UEFI/ESP, the PC BIOS loads 512 bytes from the MBR, and that’s where GRUB starts. This little piece (derived from boot.img in the GRUB directory) isn’t yet the core, but it contains the start location of the core and loads the core from this point.

p. 135

However, if you have an ESP, the GRUB core goes there as a file. The firmware can navigate the ESP and directly execute all of GRUB or any other operating system loader located there. (You might have a shim in the ESP that goes just before GRUB to handle secure boot, but the idea is the same.)

Still, on most systems, this isn’t the complete picture. The boot loader might also need to load an initial RAM filesystem image into memory before loading and executing the kernel. That’s what the initrd configuration parameter specifies, and we’ll cover it in Section 6.7. But before you learn about the initial RAM filesystem, you should learn about the user space start—that’s where the next chapter begins.