Search: in
Master boot record
Master boot record in Encyclopedia Encyclopedia
  Tutorials     Encyclopedia     Videos     Books     Software     DVDs  
       





Master boot record

A master boot record (MBR) is a type of boot sector, a data sector at the beginning of many types of computer mass storage. It is most common on disk drives large enough to be partitioned, hence it is not usually present on floppy disks or small thumbdrives.

The master boot record was popularized by the IBM Personal Computer.[1] It consists of 512 bytes located at the first sector of a data storage device such as a hard disk. MBRs are usually placed on storage devices intended for use with IBM PC-compatible systems.

The MBR may contain one or more of:

  • A partition table describing the partitions of a storage device. In this context the boot sector may also be called a partition sector.
  • Bootstrap code: instructions to identify the configured bootable partition then load and execute its volume boot record
Structure of a master boot record
Address Description Size in bytes
Hex Oct Dec
0000 0000 0 code area 440
(max. 446)
01B8 0670 440 disk signature (optional) 4
01BC 0674 444 Usually nulls; 0x0000 2
01BE 0676 446 Table of primary partitions
(Four 16-byte entries, IBM partition table scheme)
64
01FE 0776 510 55h MBR signature 2
01FF 0777 511 AAh
MBR, total size: 446 + 64 + 2 = 512
  • Unique 32-bit disk signature, even though it may never be used by the operating system.[2][3][4][5]

Because of the broad popularity of PC-compatible computers, the MBR format is widely used, to the extent of being supported by computer operating systems in addition to other pre-existing or cross-platform standards for bootstrapping and partitioning.[6]

Contents


Disk partitioning

Layout of one 16-byte partition record (all multi-byte fields are little-endian)
Offset Field
length
(bytes)
Description
0x00 1 status (0x80 = bootable (active), 0x00 = non-bootable, other = invalid )
0x01 3 CHS address of first absolute sector in partition. The format is described by 3 bytes, see the next 3 rows.
0x01 1
h7-0 head
x x x x x x x x
0x02 1
c9 8 s5 0 sector in bits 5 0; bits 7 6 are high bits of cylinder
x x x x x x x x
0x03 1
c7-0 bits 7 0 of cylinder
x x x x x x x x
0x04 1 Partition type[7]
0x05 3 CHS address of last absolute sector in partition. The format is described by 3 bytes, see the next 3 rows.
0x05 1
h7-0 head
x x x x x x x x
0x06 1
c9 8 s5 0 sector in bits 5 0; bits 7 6 are high bits of cylinder
x x x x x x x x
0x07 1
c7-0 bits 7 0 of cylinder
x x x x x x x x
0x08 4 LBA of first absolute sector in the partition
0x0C 4 Number of sectors in partition
Notes: a Formally, status values other than 0x00 and 0x80 are undefined. b Starting Sector fields are limited to 1023+1 cylinders, 255+1 heads, and 63 sectors; Ending Sector fields have the same limitations. c The range for sector is 1 through 63; the range for cylinder is 0 through 1023; the range for head is 0 through 255 inclusive.[8] d Used by OSes in certain circumstances; in such cases the CHS addresses are ignored.[9]

IBM PC-DOS introduced the conventional IBM PC (fdisk) partitioning scheme, which took advantage of the space reserved for the master boot record. When a storage device has been partitioned with this scheme, its MBR contains a partition table describing the locations, sizes, and other attributes of linear regions referred to as partitions.

The partitions themselves may also contain data to describe more complex partitioning schemes, such as extended boot records (EBRs), BSD disklabels, or Logical Disk Manager metadata partitions.[10]

The MBR is not located in a partition; it is located at a first sector of the device (physical offset 0), preceding the first partition. The boot sector present on a non-partitioned device or within an individual partition is called a volume boot record. In cases where the computer is running a BIOS overlay or boot manager, the partition table may be moved to some other physical location on the device; e.g., Ontrack Disk Manager often placed a copy of the original MBR contents in the second sector, then hid itself from any subsequently booted OS or application, so the MBR copy was treated as if it were still residing in the first sector.

By convention, there are exactly four primary partition table entries in the MBR partition table scheme, although some operating systems extended this to five (PTS-DOS with Advanced Active Partitions),[11] eight (AST and NEC MS-DOS)[12][13] or even sixteen (DISKMAN) entries.

An artifact of hard disk technology from the era of the IBM PC, the partition table subdivides a storage medium using units of cylinders, heads, and sectors (CHS addressing). These values no longer correspond to their namesakes in modern disk drives, and other devices such as solid-state drives do not physically have cylinders or heads.

Sector indices have always begun with a 1, not a zero, and due to an early error in MS-DOS, the heads are generally limited to 255 instead of 256. Both the partition length and partition start address are sector values stored as 32-bit quantities. The sector size is fixed at 512 (29) bytes, which implies that either the maximum size of a partition or the maximum start address (both in bytes) cannot exceed 2 TiB 512 bytes (2,199,023,255,040 bytes or 4,294,967,295 (232 1) sectors 512 (29) bytes per sector). Alleviating this capacity limitation was one of the prime motivations for the development of the GUID partition table (GPT).

When a CHS address is too large to fit into these fields, the tuple (1023, 254, 63) is used (if the situation involves a "protective" MBR on a disk with a GPT, Intel's Extensible Firmware Interface specification requires that the tuple (1023, 255, 63) be used). The 10-bit cylinder value is recorded within two bytes in order to facilitate making calls to the original/legacy INT 13h BIOS disk access routines, where 16 bits were divided into sector and cylinder parts, and not on byte boundaries.[8]

Where a data storage device has been partitioned with the GUID partition table (GPT) scheme, the master boot record will still contain a partition table, but its only purpose is to indicate the existence of the GPT and to prevent utility programs which understand only the MBR partition table scheme from creating any partitions in what they would otherwise see as free space on the disk, thereby accidentally erasing the GPT.

System bootstrapping

On IBM PC-compatible computers, the bootstrapping firmware contained within the ROM BIOS loads and executes the master boot record.[14] The original IBM PC used an Intel 8088 microprocessor. In order to remain compatible with the 8088, all x86 architecture systems start with the microprocessor in an operating mode referred to as real mode. Thus, the beginning of the MBR is expected to contain real mode machine language instructions.[14] The BIOS reads the MBR from the storage device into physical memory, and then directs the microprocessor to the start of the boot code.

Due to the restricted size of the MBR's code section, it typically contains only a small program that copies additional code (such as a boot loader) from the storage device into memory. Control is then passed to this code, which is responsible for loading the actual operating system. This process is known as chain loading.

Popular MBR code programs were created for booting PC DOS and MS-DOS, and similar boot code remains in wide use. These boot sectors expect the fdisk partition table scheme to be in use, and scans the list of partitions in the MBR's embedded partition table to find the only one that is marked with the active flag.[15] It then loads and runs the volume boot record (VBR) of the active partition.

There are alternative boot code implementations, some of which are installed by boot managers, which operate in a variety of ways. Some MBR code loads additional code for a boot manager from the first track of the disk, which it assumes to be "free" space that is not allocated to any disk partition, and executes it. A MBR program may interact with the user to determine which partition on which drive should boot, and may transfer control to the MBR of a different drive. Other MBR code contains a list of disk locations (often corresponding to the contents of files in a filesystem) of the remainder of the boot manager code to load and to execute. (The first relies on behavior that is not universal across all disk partitioning utilities, most notably those which read and write GPTs. The last requires that the embedded list of disk locations be updated when changes are made that would relocate the remainder of the code.)

On machines that do not use x86 processors, or on x86 machines with non-BIOS firmware such as Open Firmware or Extensible Firmware Interface (EFI) firmware, this design is unsuitable, and the MBR is not used as part of the system bootstrap.[16] EFI firmware is instead capable of directly understanding the GPT partitioning scheme and the FAT filesystem format, and loads and runs programs held as files in the EFI System partition.[17] The MBR will be involved only insofar as it might contain a partition table for compatibility purposes if the GPT partition table scheme has been used.

There is some MBR replacement code that emulates EFI firmware's bootstrap, which makes non-EFI machines capable of booting from disks using the GPT partitioning scheme. It detects a GPT, places the processor in the correct operating mode, and loads the EFI compatible code from disk to complete this task.

Disk identity

Information contained in the Partition Table of an external hard drive as it appears in the utility program QtParted, running under Linux. In addition to the bootstrap code and a partition table, master boot records may contain a Windows NT disk signature. This is a 32-bit value that is intended to identify uniquely the disk medium (as opposed to the disk unit — the two not necessarily being the same for removable hard disks).

The disk signature was introduced by Windows NT version 3.5, but is now used by several operating systems, including the Linux kernel version 2.6 and later. Linux tools can use the NT disk signature to determine which disk the machine booted from.[18]

Windows NT (and later Microsoft operating systems) uses the disk signature as an index to all the partitions on any disk ever connected to the computer under that OS; these signatures are kept in registry keys, primarily for storing the persistent mappings between disk partitions and drive letters. It may also be used in boot.ini files (though most do not), to describe the location of bootable Windows NT (or later) partitions.[19] One key (among many) where NT disk signatures appear in a Windows 2000/XP registry is:

HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\ 

If a disk's signature stored in the MBR was A8 E1 B9 D2 (in that order) and its first partition corresponded with logical drive C: under Windows, then the REG_BINARY data under the key value DosDevices\C: would be:

A8 E1 B9 D2 00 7E 00 00 00 00 00 00 

The first four bytes are said disk signature. (Note: In other keys, these bytes may appear in reverse order from that found in the MBR sector.) These are followed by eight more bytes, forming a 64-bit integer, in little endian notation, which are used to locate the byte offset of this partition. In this case, 00 7E corresponds to the hexadecimal value 0x7E00 (32,256dec). Dividing this byte offset by 512 (the size of a hard disk's physical sector in bytes) results in 63, which is the physical sector number (or LBA) containing the first sector of the partition (unlike the sector count used in the sectors value of CHS tuples, which counts from one, the absolute or LBA sector value starts counting from zero).

If this disk had another partition with the values 00 F8 93 71 02 following the disk signature (under, e.g., the key value \DosDevices\D:), it would begin at byte offset 0x27193f800 (10,495,457,280dec), which is also the first byte of physical sector 20,498,940.

Starting with Windows Vista, the disk signature is also stored in the Boot Configuration Data (BCD) store and the boot process depends on it.[20] If the disk signature changes, cannot be found or has a conflict, Windows is unable to boot.[21]

Programming considerations

The MBR originated in the original IBM PC.[1] IBM PC-compatible computers are little-endian, which means numeric values spanning two or more bytes are stored by the processor in reverse order in memory. The format of the MBR on media reflects this convention. Thus, the MBR signature will appear in a disk editor as the sequence 55 AA. Interpreting this "magic number" as little endian number 0xAA55 would be different from 0xAA550000 as used for FAT32 signatures; arguably it is simpler to consider these signatures as strings (sequences of bytes).

The bootstrap sequence in the BIOS will load the first valid MBR that it finds into the computer's physical memory at address 0x7C00. The last instruction executed in the BIOS code will be a "jump" to that address, to direct execution to the beginning of the MBR copy. The primary validation for most BIOSes is the 0xAA55 signature on the end, although a BIOS implementor may choose to include other checks, such verifying that the MBR contains a valid partition table without entries referring to sectors beyond the reported capacity of the disk.

While the MBR boot sector code expects to be loaded at physical address 0x7C00, all the memory from physical address 0x501 (address 0x500 is the last one used by a Phoenix BIOS)[8] to somewhere short of 0x9FFFF (below any EBDA) is typically available in real mode (a total of up to 640 kiB minus the first 1281 bytes of memory); very old machines may have less than 640 KB (0xA0000 or 655,360 bytes) of memory, and newer machines may allocate significant amounts of memory for use by the BIOS. The INT 12h BIOS interrupt call may help in determining how much memory can be allocated safely (it simply reads the base memory size in KiB from segment:offset location 0040h:0013h). In theory, only 64255 bytes are guaranteed (beginning at 0x501 and ending at 0x0FFFF); in practice it is safe to assume at least 391935 bytes (ending at 0x5FFFF) are available on modern hardware.

The last 72 bytes of the 512 byte MBR are reserved for the partition table and other information, so the MBR boot sector program must be small enough to fit within 440 bytes of memory. The MBR code may communicate with the user, examine the partition table, or perform some housekeeping tasks such as enabling the A20 line, or changing the processor's operating mode from real mode to unreal mode. Eventually, the MBR will need to perform its main task, and load the program that will perform the next stage of the boot process, usually by making use of INT 13h BIOS calls.

As stated above, the conventional MBR bootstrap code loads and runs (boot loader or operating system dependent) volume boot record code that is located at the beginning of the "active" partition. A conventional volume boot record is only one sector long, but it is safe for MBR code to load additional sectors to accommodate boot loaders longer than one sector. Like the MBR, a volume boot record often expects to be loaded at address 0x7C00. Since this is the same location where the MBR is loaded, one of the first tasks of an MBR is usually to relocate itself somewhere else in memory —most often at 0x600 (for MS-DOS MBR code).

The Status field in a non-extended partition table record is used to indicate an active partition. The status field in an extended partition table record may also be used by boot manager programs to determine which partitions are bootable, although values other than 0x00 and 0x80 are undefined and the bootstrap program may display an error message upon encountering unrecognized values. In practice, their parsing depends upon what the actual bootstrap code within the MBR has been coded to accept: some MBR bootstrap programs specifically look for the value 0x80 to indicate the bootable partition, others simply look for a non-zero value, and yet others look for any value with the highest bit set.

Editing/replacing MBR contents

Though it is possible to manipulate the bytes in the MBR sector directly using various disk editors, there are tools to write fixed sets of functioning code to the MBR. Since MS-DOS 5.0, the program fdisk has included the switch /mbr, which will rewrite the MBR code.[22] Under Windows 2000 and Windows XP, the Recovery Console can be used to write new MBR code to a storage device using its fixmbr command. Under Windows Vista and Windows 7, the Recovery Environment can be used to write new MBR code using the bootrec /FixMbr command. Some third-party utilities may also be used for directly editing the contents of partition tables (without requiring any knowledge of hexadecimal or disk/sector editors), such as MBRWizard.[23]

dd is also a commonly used POSIX command to read or write to any location on a storage device, MBR included. In Linux, ms-sys may be used to install a standard MBR. The GRUB and LILO projects have tools for writing code to the MBR sector, namely grub-install and lilo -mbr. The GRUB Legacy interactive console can write to the MBR, using the setup and embed commands, but GRUB2 currently requires grub-install to be run from within an operating system.

Various programs are able to create a "backup" of both the primary partition table and the logical partitions in the extended partition.

Linux sfdisk (on a SystemRescueCD) is able to save a backup of the primary and extended partition table. It creates a file that can be read in a text editor, or this file can be used by sfdisk to restore the primary/extended partition table. An example command to back up the partition table is sfdisk -d /dev/hda > hda.out and to restore is sfdisk /dev/hda < hda.out . It is possible to copy the partition table from one disk to another this way, useful for setting up mirroring, but it should be noted that sfdisk executes the command without prompting/warnings using sfdisk -d /dev/sda | sfdisk /dev/sdb[24].

See also

References

Further reading

External links

bg: ca:Master boot record cs:Master boot record da:Master boot record de:Master Boot Record es:Registro de arranque principal eu:MBR fa: fr:Master boot record ko: id:Master boot record it:Master boot record he:Master boot record hu:Master Boot Record nl:Master boot record ja: no:Master boot record pl:Master Boot Record pt:Master Boot Record ru: sv:Master Boot Record uk: vi:Boot record zh:






Source: Wikipedia | The above article is available under the GNU FDL. | Edit this article



Search for Master boot record in Tutorials
Search for Master boot record in Encyclopedia
Search for Master boot record in Videos
Search for Master boot record in Books
Search for Master boot record in Software
Search for Master boot record in DVDs
Search for Master boot record in Store




Advertisement




Master boot record in Encyclopedia
Master_boot_record top Master_boot_record

Home - Add TutorGig to Your Site - Disclaimer

©2011-2013 TutorGig.info All Rights Reserved. Privacy Statement