Recent from talks
Nothing was collected or created yet.
Master boot record
View on Wikipedia
A master boot record (MBR) is a type of boot sector in the first block of partitioned computer mass storage devices like fixed disks or removable drives intended for use with IBM PC-compatible systems and beyond. The concept of MBRs was publicly introduced in 1983 with PC DOS 2.0.
The MBR holds the information on how the disc's sectors (A.K.A. "blocks") are divided into partitions, each partition notionally containing a file system. The MBR also contains executable code to function as a loader for the installed operating system—usually by passing control over to the loader's second stage, or in conjunction with each partition's volume boot record (VBR). This MBR code is usually referred to as a boot loader.
The organization of the partition table in the MBR limits the maximum addressable storage space of a partitioned disk to 2 TiB (232 × 512 bytes).[1] Approaches to slightly raise this limit utilizing 32-bit arithmetic or 4096-byte sectors are not officially supported, as they fatally break compatibility with existing boot loaders, most MBR-compliant operating systems and associated system tools, and may cause serious data corruption when used outside of narrowly controlled system environments. Therefore, the MBR-based partitioning scheme has been superseded by the GUID Partition Table (GPT) scheme in almost all new computers. A GPT can coexist with an MBR in order to provide some limited form of backward compatibility for older systems.
MBRs are not present on non-partitioned media such as floppies, superfloppies or other storage devices configured to behave as such, nor are they necessarily present on drives used in non-PC platforms.
Overview
[edit]Support for partitioned media, and thereby the master boot record (MBR), was introduced with IBM PC DOS 2.0 in March 1983 in order to support the 10 MB hard disk of the then-new IBM Personal Computer XT, still using the FAT12 file system. The original version of the MBR was written by David Litton of IBM in June 1982. The partition table supported up to four primary partitions. This did not change when FAT16 was introduced as a new file system with DOS 3.0. Support for an extended partition, a special primary partition type used as a container to hold other partitions, was added with DOS 3.2, and nested logical drives inside an extended partition came with DOS 3.30. Since MS-DOS, PC DOS, OS/2 and Windows were never enabled to boot off them, the MBR format and boot code remained almost unchanged in functionality (except some third-party implementations) throughout the eras of DOS and OS/2 up to 1996.
In 1996, support for logical block addressing (LBA) was introduced in Windows 95B and MS-DOS 7.10 (Not to be confused with IBM PC-DOS 7.1) in order to support disks larger than 8 GB. Disk timestamps were also introduced.[2] This also reflected the idea that the MBR is meant to be operating system and file system independent. However, this design rule was partially compromised in more recent Microsoft implementations of the MBR, which enforce CHS access for FAT16B and FAT32 partition types 0x06/0x0B, whereas LBA is used for 0x0E/0x0C.
Despite sometimes poor documentation of certain intrinsic details of the MBR format (which occasionally caused compatibility problems), it has been widely adopted as a de facto industry standard, due to the broad popularity of PC-compatible computers and its semi-static nature over decades. This was even to the extent of being supported by computer operating systems for other platforms. Sometimes this was in addition to other pre-existing or cross-platform standards for bootstrapping and partitioning.[3]
MBR partition entries and the MBR boot code used in commercial operating systems, however, are limited to 32 bits.[1] Therefore, the maximum disk size supported on disks using 512-byte sectors (whether real or emulated) by the MBR partitioning scheme (without 32-bit arithmetic) is limited to 2 TiB.[1] Consequently, a different partitioning scheme must be used for larger disks, as they have become widely available since 2010. The MBR partitioning scheme is therefore in the process of being superseded by the GUID Partition Table (GPT). The official approach does little more than ensuring data integrity by employing a protective MBR. Specifically, it does not provide backward compatibility with operating systems that do not support the GPT scheme as well. Meanwhile, multiple forms of hybrid MBRs have been designed and implemented by third parties in order to maintain partitions located in the first physical 2 TiB of a disk in both partitioning schemes "in parallel" and/or to allow older operating systems to boot off GPT partitions as well. The present non-standard nature of these solutions causes various compatibility problems in certain scenarios.
The MBR consists of 512 or more bytes located in the first sector of the drive.
It may contain one or more of:
- A partition table describing the partitions of a storage device. In this context the boot sector may also be called a partition sector.
- Bootstrap code: Instructions to identify the configured bootable partition, then load and execute its volume boot record (VBR) as a chain loader.
- Optional 32-bit disk timestamp.[2]
- Optional 32-bit disk signature.[4][5][6][7]
Disk partitioning
[edit]IBM PC DOS 2.0 introduced the FDISK utility to set up and maintain MBR partitions. When a storage device has been partitioned according to this scheme, its MBR contains a partition table describing the locations, sizes, and other attributes of linear regions referred to as partitions.
The partitions themselves may also contain data to describe more complex partitioning schemes, such as extended boot records (EBRs), BSD disklabels, or Logical Disk Manager metadata partitions.[8]
The MBR is not located in a partition; it is located at a first sector of the device (physical offset 0), preceding the first partition. (The boot sector present on a non-partitioned device or within an individual partition is called a volume boot record instead.) In cases where the computer is running a DDO BIOS overlay or boot manager, the partition table may be moved to some other physical location on the device; e.g., Ontrack Disk Manager often placed a copy of the original MBR contents in the second sector, then hid itself from any subsequently booted OS or application, so the MBR copy was treated as if it were still residing in the first sector.
Sector layout
[edit]By convention, there are exactly four primary partition table entries in the MBR partition table scheme, although some operating systems and system tools extended this to five (Advanced Active Partitions (AAP) with PTS-DOS 6.60[9] and DR-DOS 7.07), eight (AST and NEC MS-DOS 3.x[10][11] as well as Storage Dimensions SpeedStor), or even sixteen entries (with Ontrack Disk Manager).
| Address | Description | Size (bytes) | |
|---|---|---|---|
0x0000 (0)
|
Bootstrap code area | 446 | |
0x01BE (446)
|
Partition entry №1 | Partition table (for primary partitions) |
16 |
0x01CE (462)
|
Partition entry №2 | 16 | |
0x01DE (478)
|
Partition entry №3 | 16 | |
0x01EE (494)
|
Partition entry №4 | 16 | |
0x01FE (510)
|
0x55
|
Boot signature[a] | 2 |
0x01FF (511)
|
0xAA
| ||
| Total size: 446 + 4×16 + 2 | 512 | ||
| Address | Description | Size (bytes) | |
|---|---|---|---|
0x0000 (0) |
Bootstrap code area (part 1) | 218 | |
0x00DA (218)
|
0x0000
|
Disk timestamp[2][b] (optional; Windows 95B/98/98SE/ME (MS-DOS 7.1–8.0). Alternatively, can serve as OEM loader signature with NEWLDR) | 2 |
0x00DC (220)
|
Original physical drive (0x80–0xFF)
|
1 | |
0x00DD (221)
|
Seconds (0–59) | 1 | |
0x00DE (222)
|
Minutes (0–59) | 1 | |
0x00DF (223)
|
Hours (0–23) | 1 | |
0x00E0 (224) |
Bootstrap code area (part 2, code entry at 0x0000)
|
216 (or 222) | |
0x01B8 (440)
|
32-bit disk signature | Disk signature (optional; UEFI, Linux, Windows NT family and other OSes) | 4 |
0x01BC (444)
|
0x0000 (0x5A5A if copy-protected)
|
2 | |
0x01BE (446)
|
Partition entry №1 | Partition table (for primary partitions) |
16 |
0x01CE (462)
|
Partition entry №2 | 16 | |
0x01DE (478)
|
Partition entry №3 | 16 | |
0x01EE (494)
|
Partition entry №4 | 16 | |
0x01FE (510)
|
0x55
|
Boot signature[a] | 2 |
0x01FF (511)
|
0xAA
| ||
| Total size: 218 + 6 + 216 + 6 + 4×16 + 2 | 512 | ||
| Address | Description | Size (bytes) | |
|---|---|---|---|
0x0000 (0) |
Bootstrap code area | 428 | |
0x01AC (428)
|
0x78
|
AAP signature (optional) | 2 |
0x01AD (429)
|
0x56
| ||
0x01AE (430)
|
AAP physical drive (0x80–0xFE; 0x00: not used; 0x01–0x7F, 0xFF: reserved)
|
AAP record (optional) (AAP partition entry #0 with special semantics) | 1 |
0x01AF (431)
|
CHS (start) address of AAP partition/image file or VBR/EBR | 3 | |
0x01B2 (434)
|
Reserved for AAP partition type (0x00 if not used) (optional)
|
1 | |
0x01B3 (435)
|
Reserved for CHS end address in AAP (optional; byte at offset 0x01B5 is also used for MBR checksum (PTS DE, BootWizard); 0x000000 if not used)
|
3 | |
0x01B6 (438)
|
Start LBA of AAP image file or VBR/EBR or relative sectors of AAP partition (copied to offset +01Chex in the loaded sector over the "hidden sectors" entry of a DOS 3.31 BPB (or emulation thereof) to also support EBR booting)
|
4 | |
0x01BA (442)
|
Reserved for sectors in AAP (optional; 0x00000000 if not used)
|
4 | |
0x01BE (446)
|
Partition entry №1 | Partition table (for primary partitions) |
16 |
0x01CE (462)
|
Partition entry №2 | 16 | |
0x01DE (478)
|
Partition entry №3 | 16 | |
0x01EE (494)
|
Partition entry №4 | 16 | |
0x01FE (510)
|
0x55
|
Boot signature[a] | 2 |
0x01FF (511)
|
0xAA
| ||
| Total size: 428 + 2 + 16 + 4×16 + 2 | 512 | ||
| Address | Description | Size (bytes) | |
|---|---|---|---|
0x0000 (0)
|
JMPS (EBhex) / NEWLDR record size (often 0x0A/0x16/0x1C for code start at 0x000C/0x0018/0x001E)
|
NEWLDR record (optional) | 2 |
0x0002 (2)
|
"NEWLDR" signature
|
6 | |
0x0008 (8)
|
LOADER physical drive and boot flag (0x80–0xFE, 0x00–0x7E, 0xFF, 0x7F) (if not used, this and following 3 bytes must be all 0)
|
1 | |
0x0009 (9)
|
CHS address of LOADER boot sector or image file (f.e. IBMBIO.LDR) (0x000000 if not used)
|
3 | |
0x000C (12)
|
Allowed DL minimum, else take from partition table (0x80: default; 0x00: always use DL; 0xFF: always use table entry)
|
1 | |
0x000D (13)
|
Reserved (default: 0x000000)
|
3 | |
0x0010 (16)
|
LBA of LOADER boot sector or image file (optional; 0x00000000 if not used)
|
4 | |
0x0014 (20)
|
Patch offset of VBR boot unit (default 0x0000 if not used, else 0024hex or 01FDhex)
|
2 | |
0x0016 (22)
|
Checksum (0x0000 if not used)
|
2 | |
0x0018 (24)
|
OEM loader signature ("MSWIN4" for REAL/32, see also offset +0DAhex, corresponds with OEM label at offset +003hex in VBRs (optional)
|
6 | |
| Varies | Bootstrap code area (code entry at 0x0000)
|
Varies | |
0x01AC (428)
|
0x78
|
AAP signature (optional) | 2 |
0x01AD (429)
|
0x56
| ||
0x01AE (430)
|
AAP partition entry №0 with special semantics | AAP record (optional) | 16 |
0x01BE (446)
|
Partition entry №1 | Partition table (for primary partitions) |
16 |
0x01CE (462)
|
Partition entry №2 | 16 | |
0x01DE (478)
|
Partition entry №3 | 16 | |
0x01EE (494)
|
Partition entry №4 | 16 | |
0x01FE (510)
|
0x55
|
Boot signature[a] | 2 |
0x01FF (511)
|
0xAA
| ||
| Total size: 30 + 398 + 2 + 16 + 4×16 + 2 | 512 | ||
| Address | Description | Size (bytes) | |
|---|---|---|---|
0x0000 (0) |
Bootstrap code area | 380 | |
0x017C (380)
|
0x5A
|
AST/NEC signature (optional; not for SpeedStor) | 2 |
0x017D (381)
|
0xA5
| ||
0x017E (382)
|
Partition entry №8 | AST/NEC expanded partition table (optional; also for SpeedStor) |
16 |
0x018E (398)
|
Partition entry №7 | 16 | |
0x019E (414)
|
Partition entry №6 | 16 | |
0x01AE (430)
|
Partition entry №5 | 16 | |
0x01BE (446)
|
Partition entry №4 | Partition table (for primary partitions) |
16 |
0x01CE (462)
|
Partition entry №3 | 16 | |
0x01DE (478)
|
Partition entry №2 | 16 | |
0x01EE (494)
|
Partition entry №1 | 16 | |
0x01FE (510)
|
0x55
|
Boot signature[a] | 2 |
0x01FF (511)
|
0xAA
| ||
| Total size: 380 + 2 + 4×16 + 4×16 + 2 | 512 | ||
| Address | Description | Size (bytes) | |
|---|---|---|---|
0x0000 (0) |
Bootstrap code area | 252 | |
0x00FC (252)
|
0xAA
|
DM signature (optional) | 2 |
0x00FD (253)
|
0x55
| ||
0x00FE (254)
|
Partition entry | DM expanded partition table (optional) |
16 |
0x010E (270)
|
Partition entry | 16 | |
0x011E (286)
|
Partition entry | 16 | |
0x012E (302)
|
Partition entry | 16 | |
0x013E (318)
|
Partition entry | 16 | |
0x014E (334)
|
Partition entry | 16 | |
0x015E (350)
|
Partition entry | 16 | |
0x016E (366)
|
Partition entry | 16 | |
0x017E (382)
|
Partition entry | 16 | |
0x018E (398)
|
Partition entry | 16 | |
0x019E (414)
|
Partition entry | 16 | |
0x01AE (430)
|
Partition entry | 16 | |
0x01BE (446)
|
Partition entry №1 | Partition table (for primary partitions) |
16 |
0x01CE (462)
|
Partition entry №2 | 16 | |
0x01DE (478)
|
Partition entry №3 | 16 | |
0x01EE (494)
|
Partition entry №4 | 16 | |
0x01FE (510)
|
0x55
|
Boot signature[a] | 2 |
0x01FF (511)
|
0xAA
| ||
| Total size: 252 + 2 + 12×16 + 4×16 + 2 | 512 | ||
Partition table entries
[edit]| Offset (bytes) |
Field length |
Description | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 0x00 | 1 byte | Status or physical drive (bit 7 set is for active or bootable, old MBRs only accept 0x80, 0x00 means inactive, and 0x01–0x7F stand for invalid)[c] | ||||||||||||||||||
| 0x01 | 3 bytes | CHS address of first absolute sector in partition.[d] The format is described by three bytes, see the next three rows. | ||||||||||||||||||
| 0x01 | 1 byte |
| ||||||||||||||||||
| 0x02 | 1 byte |
| ||||||||||||||||||
| 0x03 | 1 byte |
| ||||||||||||||||||
| 0x04 | 1 byte | Partition type[14] | ||||||||||||||||||
| 0x05 | 3 bytes | CHS address of last absolute sector in partition.[d] The format is described by 3 bytes, see the next 3 rows. | ||||||||||||||||||
| 0x05 | 1 byte |
| ||||||||||||||||||
| 0x06 | 1 byte |
| ||||||||||||||||||
| 0x07 | 1 byte |
| ||||||||||||||||||
| 0x08 | 4 bytes | LBA of first absolute sector in the partition[f] | ||||||||||||||||||
| 0x0C | 4 bytes | Number of sectors in partition[g] | ||||||||||||||||||
An artifact of hard disk technology from the era of the PC XT, the partition table subdivides a storage medium using units of cylinders, heads, and sectors (CHS addressing). These values no longer correspond to their namesakes in modern disk drives, as well as being irrelevant in other devices such as solid-state drives, which do not physically have cylinders or heads.
In the CHS scheme, sector indices have (almost) always begun with sector 1 rather than sector 0 by convention, and due to an error in all versions of MS-DOS/PC DOS up to including 7.10, the number of heads is generally limited to 255[h] instead of 256. When a CHS address is too large to fit into these fields, the tuple (1023, 254, 63) is typically used today, although on older systems, and with older disk tools, the cylinder value often wrapped around modulo the CHS barrier near 8 GB, causing ambiguity and risks of data corruption. (If the situation involves a "protective" MBR on a disk with a GPT, Intel's Extensible Firmware Interface specification requires that the tuple (1023, 255, 63) be used.) The 10-bit cylinder value is recorded within two bytes in order to facilitate making calls to the original/legacy INT 13h BIOS disk access routines, where 16 bits were divided into sector and cylinder parts, and not on byte boundaries.[13]
Due to the limits of CHS addressing,[16][17] a transition was made to using LBA, or logical block addressing. Both the partition length and partition start address are sector values stored in the partition table entries as 32-bit quantities. The sector size used to be considered fixed at 512 (29) bytes, and a broad range of important components including chipsets, boot sectors, operating systems, database engines, partitioning tools, backup and file system utilities and other software had this value hard-coded. Since the end of 2009, disk drives employing 4096-byte sectors (4Kn or Advanced Format) have been available, although the size of the sector for some of these drives was still reported as 512 bytes to the host system through conversion in the hard-drive firmware and referred to as 512 emulation drives (512e).
Since block addresses and sizes are stored in the partition table of an MBR using 32 bits, the maximum size, as well as the highest start address, of a partition using drives that have 512-byte sectors (actual or emulated) cannot exceed 2 TiB−512 bytes (2199023255040 bytes or 4294967295 (232−1) sectors × 512 (29) bytes per sector).[1] Alleviating this capacity limitation was one of the prime motivations for the development of the GPT.
Since partitioning information is stored in the MBR partition table using a beginning block address and a length, it may in theory be possible to define partitions in such a way that the allocated space for a disk with 512-byte sectors gives a total size approaching 4 TiB, if all but one partition are located below the 2 TiB limit and the last one is assigned as starting at or close to block 232−1 and specify the size as up to 232−1, thereby defining a partition that requires 33 rather than 32 bits for the sector address to be accessed. However, in practice, only certain LBA-48-enabled operating systems, including Linux, FreeBSD and Windows 7[18] that use 64-bit sector addresses internally actually support this. Due to code space constraints and the nature of the MBR partition table to only support 32 bits, boot sectors, even if enabled to support LBA-48 rather than LBA-28, often use 32-bit calculations, unless they are specifically designed to support the full address range of LBA-48 or are intended to run on 64-bit platforms only. Any boot code or operating system using 32-bit sector addresses internally would cause addresses to wrap around accessing this partition and thereby result in serious data corruption over all partitions.
For disks that present a sector size other than 512 bytes, such as USB external drives, there are limitations as well. A sector size of 4096 results in an eight-fold increase in the size of a partition that can be defined using MBR, allowing partitions up to 16 TiB (232 × 4096 bytes) in size.[19] Versions of Windows more recent than Windows XP support the larger sector sizes, as well as Mac OS X, and Linux has supported larger sector sizes since 2.6.31[20] or 2.6.32,[21] but issues with boot loaders, partitioning tools and computer BIOS implementations present certain limitations,[22] since they are often hard-wired to reserve only 512 bytes for sector buffers, causing memory to become overwritten for larger sector sizes. This may cause unpredictable behaviour as well, and therefore should be avoided when compatibility and standard conformity is an issue.
Where a data storage device has been partitioned with the GPT scheme, the master boot record will still contain a partition table, but its only purpose is to indicate the existence of the GPT and to prevent utility programs that understand only the MBR partition table scheme from creating any partitions in what they would otherwise see as free space on the disk, thereby accidentally erasing the GPT.
System bootstrapping
[edit]On IBM PC-compatible computers, the bootstrapping firmware (contained within the ROM BIOS) loads and executes the master boot record.[23] The PC/XT (type 5160) used an Intel 8088 microprocessor. In order to remain compatible, all x86 BIOS architecture systems start with the microprocessor in an operating mode referred to as real mode. The BIOS reads the MBR from the storage device into physical memory, and then it directs the microprocessor to the start of the boot code. The BIOS will switch the processor to real mode, then begin to execute the MBR program, and so the beginning of the MBR is expected to contain real-mode machine code.[23]
Since the BIOS bootstrap routine loads and runs exactly one sector from the physical disk, having the partition table in the MBR with the boot code simplifies the design of the MBR program. It contains a small program that loads the Volume Boot Record (VBR) of the targeted partition. Control is then passed to this code, which is responsible for loading the actual operating system. This process is known as chain loading.
Popular MBR code programs were created for booting PC DOS and MS-DOS, and similar boot code remains in wide use. These boot sectors expect the FDISK partition table scheme to be in use and scans the list of partitions in the MBR's embedded partition table to find the only one that is marked with the active flag.[24] It then loads and runs the volume boot record (VBR) of the active partition.
There are alternative boot code implementations, some of which are installed by boot managers, which operate in a variety of ways. Some MBR code loads additional code for a boot manager from the first track of the disk, which it assumes to be "free" space that is not allocated to any disk partition, and executes it. A MBR program may interact with the user to determine which partition on which drive should boot, and may transfer control to the MBR of a different drive. Other MBR code contains a list of disk locations (often corresponding to the contents of files in a filesystem) of the remainder of the boot manager code to load and to execute. (The first relies on behavior that is not universal across all disk partitioning utilities, most notably those that read and write GPTs. The last requires that the embedded list of disk locations be updated when changes are made that would relocate the remainder of the code.)
On machines that do not use x86 processors, or on x86 machines with non-BIOS firmware such as Open Firmware or Extensible Firmware Interface (EFI) firmware, this design is unsuitable, and the MBR is not used as part of the system bootstrap.[25] EFI firmware is instead capable of directly understanding the GPT partitioning scheme and the FAT filesystem format, and loads and runs programs held as files in the EFI System partition.[26] The MBR will be involved only insofar as it might contain a partition table for compatibility purposes if the GPT partition table scheme has been used.
There is some MBR replacement code that emulates EFI firmware's bootstrap, which makes non-EFI machines capable of booting from disks using the GPT partitioning scheme. It detects a GPT, places the processor in the correct operating mode, and loads the EFI compatible code from disk to complete this task.
Disk identity
[edit]
In addition to the bootstrap code and a partition table, master boot records may contain a disk signature. This is a 32-bit value that is intended to identify uniquely the disk medium (as opposed to the disk unit—the two not necessarily being the same for removable hard disks).
The disk signature was introduced by Windows NT version 3.5, but it is now used by several operating systems, including the Linux kernel version 2.6 and later. Linux tools can use the NT disk signature to determine which disk the machine booted from.[27]
Windows NT (and later Microsoft operating systems) uses the disk signature as an index to all the partitions on any disk ever connected to the computer under that OS; these signatures are kept in Windows Registry keys, primarily for storing the persistent mappings between disk partitions and drive letters. It may also be used in Windows NT BOOT.INI files (though most do not), to describe the location of bootable Windows NT (or later) partitions.[28] One key (among many), where NT disk signatures appear in a Windows 2000/XP registry, is:
HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\
If a disk's signature stored in the MBR was A8 E1 B9 D2 (in that order) and its first partition corresponded with logical drive C: under Windows, then the REG_BINARY data under the key value \DosDevices\C: would be:
A8 E1 B9 D2 00 7E 00 00 00 00 00 00
The first four bytes are said disk signature. (In other keys, these bytes may appear in reverse order from that found in the MBR sector.) These are followed by eight more bytes, forming a 64-bit integer, in little-endian notation, which are used to locate the byte offset of this partition. In this case, 00 7E corresponds to the hexadecimal value 0x7E00 (32,256). Under the assumption that the drive in question reports a sector size of 512 bytes, then dividing this byte offset by 512 results in 63, which is the physical sector number (or LBA) containing the first sector of the partition (unlike the sector count used in the sectors value of CHS tuples, which counts from one, the absolute or LBA sector value starts counting from zero).
If this disk had another partition with the values 00 F8 93 71 02 following the disk signature (under, e.g., the key value \DosDevices\D:), it would begin at byte offset 0x00027193F800 (10,495,457,280), which is also the first byte of physical sector 20,498,940.
Starting with Windows Vista, the disk signature is also stored in the Boot Configuration Data (BCD) store, and the boot process depends on it.[29] If the disk signature changes, cannot be found or has a conflict, Windows is unable to boot.[30] Unless Windows is forced to use the overlapping part of the LBA address of the Advanced Active Partition entry as pseudo-disk signature, Windows' usage is conflictive with the Advanced Active Partition feature of PTS-DOS 7 and DR-DOS 7.07, in particular if their boot code is located outside the first 8 GB of the disk, so that LBA addressing must be used.
Programming considerations
[edit]The MBR originated in the PC XT.[31] IBM PC-compatible computers are little-endian, which means the processor stores numeric values spanning two or more bytes in memory least significant byte first. The format of the MBR on media reflects this convention. Thus, the MBR signature will appear in a disk editor as the sequence 55 AA.[a]
The bootstrap sequence in the BIOS will load the first valid MBR that it finds into the computer's physical memory at address 0x7C00 to 0x7DFF.[31] The last instruction executed in the BIOS code will be a "jump" to that address in order to direct execution to the beginning of the MBR copy. The primary validation for most BIOSes is the signature at offset 0x01FE, although a BIOS implementer may choose to include other checks, such as verifying that the MBR contains a valid partition table without entries referring to sectors beyond the reported capacity of the disk.
To the BIOS, removable (e.g. floppy) and fixed disks are essentially the same. For either, the BIOS reads the first physical sector of the media into RAM at absolute address 0x7C00, checks the signature in the last two bytes of the loaded sector, and then, if the correct signature is found, transfers control to the first byte of the sector with a jump (JMP) instruction. The only real distinction that the BIOS makes is that (by default, or if the boot order is not configurable) it attempts to boot from the first removable disk before trying to boot from the first fixed disk. From the perspective of the BIOS, the action of the MBR loading a volume boot record into RAM is exactly the same as the action of a floppy disk volume boot record loading the object code of an operating system loader into RAM. In either case, the program that the BIOS loaded is going about the work of chain loading an operating system.
While the MBR boot sector code expects to be loaded at physical address 0x0000:0x7C00,[i] all the memory from physical address 0x0000:0x0501 (address 0x0000:0x0500 is the last one used by a Phoenix BIOS)[13] to 0x0000:0x7FFF,[31] later relaxed to 0x0000:0xFFFF[32] (and sometimes[j] up to 0x9000:0xFFFF)—the end of the first 640 KB—is available in real mode.[k] The INT 12h BIOS interrupt call may help in determining how much memory can be allocated safely (by default, it simply reads the base memory size in KB from segment:offset location 0x0040:0x0013, but it may be hooked by other resident pre-boot software like BIOS overlays, RPL code or viruses to reduce the reported amount of available memory in order to keep other boot stage software like boot sectors from overwriting them).
The last 66 bytes of the 512-byte MBR are reserved for the partition table and other information, so the MBR boot sector program must be small enough to fit within 446 bytes of memory or less.
The MBR code examines the partition table, selects a suitable partition and loads the program that will perform the next stage of the boot process, usually by making use of INT 13h BIOS calls. The MBR bootstrap code loads and runs (a boot loader- or operating system-dependent) volume boot record code that is located at the beginning of the "active" partition. The volume boot record will fit within a 512-byte sector, but it is safe for the MBR code to load additional sectors to accommodate boot loaders longer than one sector, provided they do not make any assumptions on what the sector size is. In fact, at least 1 KB of RAM is available at address 0x7C00 in every IBM XT- and AT-class machine, so a 1 KB sector could be used with no problem. Like the MBR, a volume boot record normally expects to be loaded at address 0x0000:0x7C00. This derives from the fact that the volume boot record design originated on unpartitioned media, where a volume boot record would be directly loaded by the BIOS boot procedure; as mentioned above, the BIOS treats MBRs and volume boot records (VBRs)[l] exactly alike. Since this is the same location where the MBR is loaded, one of the first tasks of an MBR is to relocate itself somewhere else in memory. The relocation address is determined by the MBR, but it is most often 0x0000:0x0600 (for MS-DOS/PC DOS, OS/2 and Windows MBR code) or 0x0060:0x0000 (most DR-DOS MBRs). (Even though both of these segmented addresses resolve to the same physical memory address in real mode, for Apple Darwin to boot, the MBR must be relocated to 0x0000:0x0600 instead of 0x0060:0x0000, since the code depends on the DS:SI pointer to the partition entry provided by the MBR, but it erroneously refers to it via 0x0000:SI only.[33]) It is important not to relocate to other addresses in memory because many VBRs will assume a certain standard memory layout when loading their boot file.
The Status field in a partition table record is used to indicate an active partition. Standard-conformant MBRs will allow only one partition marked active and use this as part of a sanity-check to determine the existence of a valid partition table. They will display an error message, if more than one partition has been marked active. Some non-standard MBRs will not treat this as an error condition and just use the first marked partition in the row.
Traditionally, values other than 0x00 (not active) and 0x80 (active) were invalid and the bootstrap program would display an error message upon encountering them. However, the Plug and Play BIOS Specification and BIOS Boot Specification (BBS) allowed other devices to become bootable as well since 1994.[32][34] Consequently, with the introduction of MS-DOS 7.10 (Windows 95B) and higher, the MBR started to treat a set bit 7 as active flag and showed an error message for values 0x01..0x7F only. It continued to treat the entry as physical drive unit to be used when loading the corresponding partition's VBR later on, thereby now also accepting other boot drives than 0x80 as valid, however, MS-DOS did not make use of this extension by itself. Storing the actual physical drive number in the partition table does not normally cause backward compatibility problems, since the value will differ from 0x80 only on drives other than the first one (which have not been bootable before, anyway). However, even with systems enabled to boot off other drives, the extension may still not work universally, for example, after the BIOS assignment of physical drives has changed when drives are removed, added or swapped. Therefore, per the BIOS Boot Specification (BBS),[32] it is best practice for a modern MBR accepting bit 7 as active flag to pass on the DL value originally provided by the BIOS instead of using the entry in the partition table.
BIOS to MBR interface
[edit]The MBR is loaded at memory location 0x0000:0x7C00 and with the following CPU registers set up when the prior bootstrap loader (normally the IPL in the BIOS) passes execution to it by jumping to 0x0000:0x7C00 in the CPU's real mode.
- Some Compaq BIOSes erroneously use 0x07C0:0x0000 instead. While this resolves to the same location in real mode memory, it is non-standard and should be avoided, since MBR code assuming certain register values or not written to be relocatable may not work otherwise.
- DL = boot drive unit (fixed disks / removable drives: 0x80 = first, 0x81 = second, ..., 0xFE; floppies / superfloppies: 0x00 = first, 0x01 = second, ..., 0x7E; values 0x7F and 0xFF are reserved for ROM / remote drives and must not be used on disk).[35][36]
- DL is supported by IBM BIOSes as well as most other BIOSes. The Toshiba T1000 BIOS is known not to support this properly, and some old Wyse 286 BIOSes use DL values greater or equal to 2 for fixed disks (thereby reflecting the logical drive numbers under DOS rather than the physical drive numbers of the BIOS). USB sticks configured as removable drives typically get an assignment of DL = 0x80, 0x81, etc. However, some rare BIOSes erroneously presented them under DL = 0x01, just as if they were configured as superfloppies.
- A standard conformant BIOS assigns numbers greater or equal to 0x80 exclusively to fixed disk / removable drives, and traditionally only values 0x80 and 0x00 were passed on as physical drive units during boot. By convention, only fixed disks / removable drives are partitioned, therefore, the only DL value a MBR could see traditionally was 0x80. Many MBRs were written to ignore the DL value and work with a hard-wired value (normally 0x80), anyway.
- The Plug and Play BIOS Specification and BIOS Boot Specification (BBS) allow other devices to become bootable as well since 1994.[32][34] The later recommends that MBR and VBR code should use DL rather than internally hardwired defaults.[32] This will also ensure compatibility with various non-standard assignments (see examples above), as far as the MBR code is concerned.
- Bootable CD-ROMs following the El Torito specification may contain disk images mounted by the BIOS to occur as floppy or superfloppies on this interface. DL values of 0x00 and 0x01 may also be used by Protected Area Run Time Interface Extension Services (PARTIES) and Trusted Computing Group (TCG) BIOS extensions in Trusted mode to access otherwise invisible PARTIES partitions, disk image files located via the Boot Engineering Extension Record (BEER) in the last physical sector of a hard disk's Host Protected Area (HPA). While designed to emulate floppies or superfloppies, MBR code accepting these non-standard DL values allows to use images of partitioned media at least in the boot stage of operating systems.
- DH bit 5 = 0: device supported through INT 13h; else: don't care (should be zero). DH is supported by some IBM BIOSes.
- Some of the other registers may typically also hold certain register values (DS, ES, SS = 0x0000; SP = 0x0400) with original IBM ROM BIOSes, but this is nothing to rely on, as other BIOSes may use other values. For this reason, MBR code by IBM, Microsoft, Digital Research, etc. never did take any advantage of it. Relying on these register values in boot sectors may also cause problems in chain-boot scenarios.
Systems with Plug-and-Play BIOS or BBS support will provide a pointer to PnP data in addition to DL:[32][34]
- This information allows the boot loader in the MBR (or VBR, if passed on) to actively interact with the BIOS or a resident PnP / BBS BIOS overlay in memory in order to configure the boot order, etc., however, this information is ignored by most standard MBRs and VBRs. Ideally, ES:DI is passed on to the VBR for later use by the loaded operating system, but PnP-enabled operating systems typically also have fallback methods to retrieve the PnP BIOS entry point later on so that most operating systems do not rely on this.
MBR to VBR interface
[edit]By convention, a standard conformant MBR passes execution to a successfully loaded VBR, loaded at memory location 0x0000:0x7C00, by jumping to 0x0000:0x7C00 in the CPU's real mode with the following registers maintained or specifically set up:
- CS:IP = 0x0000:0x7C00[m] (constant)
- DL = boot drive unit (see above)
- MS-DOS 2.0–7.0 / PC DOS 2.0–6.3 MBRs do not pass on the DL value received on entry, but they rather use the boot status entry in the partition table entry of the selected primary partition as physical boot drive unit. Since this is, by convention, 0x80 in most MBR partition tables, it won't change things unless the BIOS attempted to boot off a physical device other than the first fixed disk / removable drive in the row. This is also the reason why these operating systems cannot boot off a second hard disk, etc. Some FDISK tools allow to mark partitions on secondary disks as "active" as well. In this situation, knowing that these operating systems cannot boot off other drives anyway, some of them continue to use the traditionally fixed value of 0x80 as active marker, whereas others use values corresponding with the currently assigned physical drive unit (0x81, 0x82), thereby allowing booting from other drives, at least in theory. In fact, this will work with many MBR codes, which take a set bit 7 of the boot status entry as active flag rather than insisting on 0x80, however, MS-DOS/PC DOS MBRs are hard-wired to accept the fixed value of 0x80 only. Storing the actual physical drive number in the partition table will also cause problems, when the BIOS assignment of physical drives changes, for example when drives are removed, added or swapped. Therefore, for a normal MBR accepting bit 7 as active flag and otherwise just using and passing on to the VBR the DL value originally provided by the BIOS allows for maximum flexibility. MS-DOS 7.1–8.0 MBRs have changed to treat bit 7 as active flag and any values 0x01..0x7F as invalid, but they still take the physical drive unit from the partition table rather than using the DL value provided by the BIOS. DR-DOS 7.07 extended MBRs treat bit 7 as active flag and use and pass on the BIOS DL value by default (including non-standard values 0x00..0x01 used by some BIOSes also for partitioned media), but they also provide a special NEWLDR configuration block in order to support alternative boot methods in conjunction with LOADER and REAL/32 as well as to change the detail behaviour of the MBR, so that it can also work with drive values retrieved from the partition table (important in conjunction with LOADER and AAPs, see NEWLDR offset
0x000C), translate Wyse non-standard drive units 0x02..0x7F to 0x80..0xFD, and optionally fix up the drive value (stored at offset0x019in the Extended BIOS Parameter Block (EBPB) or at sector offset0x01FD) in loaded VBRs before passing execution to them (see NEWLDR offset0x0014)—this also allows other boot loaders to use NEWLDR as a chain-loader, configure its in-memory image on the fly and "tunnel" the loading of VBRs, EBRs, or AAPs through NEWLDR.
- The contents of DH and ES:DI should be preserved by the MBR for full Plug-and-Play support (see above), however, many MBRs, including those of MS-DOS 2.0–8.0 / PC DOS 2.0–6.3 and Windows NT/2000/XP, do not. (This is unsurprising, since those versions of DOS predate the Plug-and-Play BIOS standard, and previous standards and conventions indicated no requirements to preserve any register other than DL.) Some MBRs set DH to 0.
The MBR code passes additional information to the VBR in many implementations:
- DS:SI = points to the 16-byte MBR partition table entry (in the relocated MBR) corresponding with the activated VBR. PC-MOS 5.1 depends on this to boot if no partition in the partition table is flagged as bootable. In conjunction with LOADER, Multiuser DOS and REAL/32 boot sectors use this to locate the boot sector of the active partition (or another bootstrap loader like IBMBIO.LDR at a fixed position on disk) if the boot file (LOADER.SYS) could not be found. PTS-DOS 6.6 and S/DOS 1.0 use this in conjunction with their Advanced Active Partition (AAP) feature. In addition to support for LOADER and AAPs, DR-DOS 7.07 can use this to determine the necessary INT 13h access method when using its dual CHS/LBA VBR code and it will update the boot drive / status flag field in the partition entry according to the effectively used DL value. Darwin bootloaders (Apple's
boot1h,boot1u, and David Elliott'sboot1fat32) depend on this pointer as well, but additionally they don't use DS, but assume it to be set to 0x0000 instead.[33] This will cause problems if this assumption is incorrect. The MBR code of OS/2, MS-DOS 2.0 to 8.0, PC DOS 2.0 to 7.10 and Windows NT/2000/XP provides this same interface as well, although these systems do not use it. The Windows Vista/7 MBRs no longer provide this DS:SI pointer. While some extensions only depend on the 16-byte partition table entry itself, other extensions may require the whole 4 (or 5 entry) partition table to be present as well. - DS:BP = optionally points to the 16-byte MBR partition table entry (in the relocated MBR) corresponding with the activated VBR. This is identical to the pointer provided by DS:SI (see above) and is provided by MS-DOS 2.0–8.0, PC DOS 2.0–7.10, Windows NT/2000/XP/Vista/7 MBRs. It is, however, not supported by most third-party MBRs.
Under DR-DOS 7.07 an extended interface may be optionally provided by the extended MBR and in conjunction with LOADER:
- AX = magic signature indicating the presence of this NEWLDR extension (0x0EDC)
- DL = boot drive unit (see above)
- DS:SI = points to the 16-byte MBR partition table entry used (see above)
- ES:BX = start of boot sector or NEWLDR sector image (typically 0x7C00)
- CX = reserved
In conjunction with GPT, an Enhanced Disk Drive Specification (EDD) 4 Hybrid MBR proposal recommends another extension to the interface:[37]
- EAX = 0x54504721 ("
!GPT") - DL = boot drive unit (see above)
- DS:SI = points to a Hybrid MBR handover structure, consisting of a 16-byte dummy MBR partition table entry (with all bits set except for the boot flag at offset 0x00 and the partition type at offset 0x04) followed by additional data. This is partially compatible with the older DS:SI extension discussed above, if only the 16-byte partition entry, not the whole partition table is required by these older extensions.
- Since older operating systems (including their VBRs) do not support this extension nor are they able to address sectors beyond the 2 TiB barrier, a GPT-enabled hybrid boot loader should still emulate the 16-byte dummy MBR partition table entry if the boot partition is located within the first 2 TiB.[n]
- ES:DI = points to "
$PnP" installation check structure (see above)
Editing and replacing contents
[edit]Though it is possible to manipulate the bytes in the MBR sector directly using various disk editors, there are tools to write fixed sets of functioning code to the MBR. Since MS-DOS 5.0, the program FDISK has included the switch /MBR, which will rewrite the MBR code.[38] Under Windows 2000 and Windows XP, the Recovery Console can be used to write new MBR code to a storage device using its fixmbr command. Under Windows Vista and Windows 7, the Recovery Environment can be used to write new MBR code using the BOOTREC /FIXMBR command.
Some third-party utilities may also be used for directly editing the contents of partition tables (without requiring any knowledge of hexadecimal or disk/sector editors), such as MBRWizard.[o]
dd is a POSIX command commonly used to read or write any location on a storage device, MBR included. In Linux, ms-sys may be used to install a Windows MBR. The GRUB and LILO projects have tools for writing code to the MBR sector, namely grub-install and lilo -mbr. The GRUB Legacy interactive console can write to the MBR, using the setup and embed commands, but GRUB2 currently requires grub-install to be run from within an operating system.
Various programs are able to create a "backup" of both the primary partition table and the logical partitions in the extended partition.
Linux sfdisk (on a SystemRescueCD) is able to save a backup of the primary and extended partition table. It creates a file that can be read in a text editor, or this file can be used by sfdisk to restore the primary/extended partition table. An example command to back up the partition table is sfdisk -d /dev/hda > hda.out and to restore is sfdisk /dev/hda < hda.out. It is possible to copy the partition table from one disk to another this way, useful for setting up mirroring, but sfdisk executes the command without prompting/warnings using sfdisk -d /dev/sda | sfdisk /dev/sdb.[39]
See also
[edit]- Extended boot record (EBR)
- Volume boot record (VBR)
- GUID Partition Table (GPT)
- BIOS Boot partition
- EFI System partition
- Boot engineering extension record (BEER)
- Host protected area (HPA)
- Device configuration overlay (DCO)
- Apple partition map (APM)
- Amiga rigid disk block (RDB)
- Volume Table of Contents (VTOC)
- BSD disklabel
- Boot loader
- Disk cloning
- Recovery disc
- GNU Parted
- Partition alignment
Notes
[edit]- ^ a b c d e f g The signature at offset 0x01FE in boot sectors is
55hex AAhex, that is 0x55 at offset 0x01FE andAAhexat offset 0x01FF. Since little-endian representation must be assumed in the context of IBM PC compatible machines, this can be written as 16-bit wordAA55hexin programs for x86 processors (note the swapped order), whereas it would have to be written as55AAhexin programs for other CPU architectures using a big-endian representation. Since this has been mixed up numerous times in books and even in original Microsoft reference documents, this article uses the offset-based byte-wise on-disk representation to avoid any possible misinterpretation. - ^ In order to ensure the integrity of the MBR boot loader code, it is important that the bytes at 0x00DA to 0x00DF are never changed, unless either all six bytes represent a value of 0 or the whole MBR bootstrap loader code (except for the (extended) partition table) is replaced at the same time as well. This includes resetting these values to
00 00 00 00 00 00hexunless the code stored in the MBR is known. Windows adheres to this rule. - ^ Originally, status values other than 0x00 and 0x80 were invalid, but modern MBRs treat the bit 7 as active flag and use this entry to store the physical boot unit.
- ^ a b The starting sector fields are limited to 1023+1 cylinders, 255+1 heads, and 63 sectors; ending sector fields have the same limitations.
- ^ a b c d e The range for sector is 1 through 63; the range for cylinder is 0 through 1023; the range for head is 0 through 255 inclusive.[13]
- ^ This entry is used by operating systems in certain circumstances; in such cases the CHS addresses are ignored.[15]
- ^ Zero is reserved and must not be used in normal partition entries. This entry is used by operating systems in certain circumstances; in such cases the CHS addresses are ignored.[15]
- ^ "Quote: [Most] versions of MS-DOS (including MS-DOS 7 [Windows 95]) have a bug which prevents booting on hard disks with 256 heads (FFh), so many modern BIOSes provide mappings with at most 255 (FEh) heads." RBIL[40][41]
- ^ The address
0000hex:7C00hexis the first byte of the 32nd KB of RAM. The loading of the boot program at this address historically was the reason why, while the minimum RAM size of an original IBM PC (type 5150) was 16 KB, 32 KB were required for the disk option in the IBM XT. - ^ If there is an EBDA, the available memory ends below it.
- ^ Very old machines may have less than 640 KB (
A0000hexor 655,360 bytes) of memory. In theory, only 32 KB (up to0000hex:7FFFhex) or 64 KB (up to0000hex:FFFFhex) are guaranteed to exist; this would be the case on an IBM XT-class machine equipped with only the required minimum amount of memory for a disk system. - ^ This applies when the BIOS handles a VBR, which is when it is in the first physical sector of unpartitioned media. Otherwise, the BIOS has nothing to do with the VBR. The design of VBRs is such as it is because VBRs originated solely on unpartitioned floppy disk media—the type 5150 IBM PC originally had no hard disk option—and the partitioning system using an MBR was later developed as an adaptation to put more than one volume, each beginning with its own VBR as-already-defined, onto a single fixed disk. By this design, essentially the MBR emulates the BIOS boot routine, doing the same things the BIOS would do to process this VBR and set up the initial operating environment for it just as if the BIOS had found that VBR on an unpartitioned medium.
- ^ IP is set as a result of the jump. CS may be set to 0 either by executing a far jump or by loading the register value explicitly before executing a near jump. (It is impossible for jumped-to x86 code to detect whether a near or far jump was used to reach it [unless the code that made the jump separately passes this information in some way].)
- ^ This is not part of the above mentioned proposal, but a natural consequence of pre-existing conditions.
- ^ For example, PowerQuest's Partition Table Editor (PTEDIT32.EXE), which runs under Windows operating systems, is still available here: Symantec's FTP site[dead link].
References
[edit]- ^ a b c d "Windows support for hard disks that are larger than 2 TB". 1. Microsoft. 2013-06-26. 2581408. Archived from the original on 2017-04-27. Retrieved 2013-08-28.
- ^ a b c Sedory, Daniel B. (2004). "The Mystery Bytes (or the Drive/Timestamp Bytes) of the MS-Windows 95B, 98, 98SE and Me Master Boot Record (MBR)". Master Boot Records. thestarman.pcministry.com. Archived from the original on 2017-08-24. Retrieved 2012-08-25.
- ^ Lucas, Michael (2003). Absolute OpenBSD: Unix for the practical paranoid. No Starch Press. p. 73. ISBN 9781886411999. Retrieved 2011-04-09.
Every operating system includes tools to manage MBR partitions. Unfortunately, every operating system handles MBR partitions in a slightly different manner.
- ^ Norton, Peter; Clark, Scott (2002). Peter Norton's New Inside the PC. Sams Publishing. pp. 360–361. ISBN 0-672-32289-7.
- ^ Graves, Michael W. (2004). A+ Guide To PC Hardware Maintenance and Repair. Thomson Delmar. p. 276. ISBN 1-4018-5230-0.
- ^ Andrews, Jean (2003). Upgrade and Repair with Jean Andrews. Thomson Course Technology. p. 646. ISBN 1-59200-112-2.
- ^ Boswell, William (2003). Inside Windows Server 2003. Addison-Wesley Professional. p. 13. ISBN 0-7357-1158-5.
- ^ Smith, Roderick W. (2000). The Multi-Boot Configuration Handbook. Que Publishing. pp. 260–261. ISBN 0-7897-2283-6.
- ^ Brouwer, Andries Evert (2004-04-22) [2000]. "Properties of partition tables". Partition types. Archived from the original on 2017-08-24. Retrieved 2017-08-24.
Matthias [R.] Paul writes: "[…] PTS-DOS [uses] a special fifth partition entry in front of the other four entries in the MBR and corresponding AAP-aware MBR bootstrap code. […]"
- ^ Brouwer, Andries Evert (2004-04-22) [2000]. "Properties of partition tables". Partition types. Archived from the original on 2017-08-24. Retrieved 2017-08-24.
Some OEM systems, such as AST DOS (type
(NB. NEC MS-DOS 3.30 and AST MS-DOS partition tables with eight entries are preceded with a signature14hex) and NEC DOS (type24hex) had 8 instead of 4 partition entries in their MBR sectors. (Matthias R. Paul).A55Ahexat offset 0x017C.) - ^ Sedory, Daniel B. (2007-05-18) [2003]. "Notes on the Differences in one OEM version of the DOS 3.30 MBR". Master Boot Records. Archived from the original on 2017-08-24. Retrieved 2017-08-24.
When we added partitions to this NEC table, the first one was placed at offsets 0x01EE through 0x01FD and the next entry was added just above it. So, the entries are inserted and listed backwards from that of a normal Table. Thus, looking at such a Table with a disk editor or partition listing utility, it would show the first entry in a NEC eight-entry table as being the last one (fourth entry) in a normal Partition Table.
(NB. Shows an 8-entry partition table and where its boot code differs from MS-DOS 3.30.) - ^ "Partition Table". osdev.org. 2017-03-18 [2007-03-06]. Archived from the original on 2017-08-24. Retrieved 2017-08-24.
- ^ a b c System BIOS for IBM PC/XT/AT Computers and Compatibles. Phoenix technical reference. Addison-Wesley. 1989. ISBN 0-201-51806-6.
- ^ Brouwer, Andries Evert (2013) [1995]. "List of partition identifiers for PCs". Partition types. Archived from the original on 2017-08-24. Retrieved 2017-08-24.
- ^ a b Wood, Sybil (2002). Microsoft Windows 2000 Server Operations Guide. Microsoft Press. p. 18. ISBN 978-0-73561796-4.
- ^ "An Introduction to Hard Disk Geometry". Tech Juice. 2012-12-06 [2011-08-08]. Archived from the original on 2013-02-04.
- ^ Kozierok, Charles M. (2001-04-17). "BIOS and the Hard Disk". The PC Guide. Archived from the original on 2017-06-17. Retrieved 2013-04-19.
- ^ Smith, Robert (2011-06-26). "Working Around MBR's Limitations". GPT fdisk Tutorial. Archived from the original on 2017-08-24. Retrieved 2013-04-20.
- ^ "More than 2 TiB on a MBR disk". superuser.com. 2013-03-07. Archived from the original on 2017-08-24. Retrieved 2013-10-22.
- ^ "Transition to Advanced Format 4K Sector Hard Drives". Tech Insight. Seagate Technology. 2012. Archived from the original on 2017-08-24. Retrieved 2013-04-19.
- ^ Calvert, Kelvin (2011-03-16). "WD AV-GP Large Capacity Hard Drives" (PDF). Western Digital. Retrieved 2013-04-20.
- ^ Smith, Roderick W. (2010-04-27). "Linux on 4KB-sector disks: Practical advice". DeveloperWorks. IBM. Archived from the original on 2017-08-24. Retrieved 2013-04-19.
- ^ a b "MBR (x86)". OSDev Wiki. OSDev.org. 2012-03-05. Archived from the original on 2017-08-24. Retrieved 2013-04-20.
- ^ Sedory, Daniel B. (2003-07-30). "IBM DOS 2.00 Master Boot Record". The Starman's Realm. Archived from the original on 2017-08-24. Retrieved 2011-07-22.
- ^ Singh, Amit (2009-12-25) [December 2003]. "Booting Mac OS X". Mac OS X Internals: The Book. Retrieved 2011-07-22.
- ^ de Boyne Pollard, Jonathan (2011-07-10). "The EFI boot process". Frequently Given Answers. Archived from the original on 2017-08-24. Retrieved 2011-07-22.
- ^ Domsch, Matt (2005-03-22) [2003-12-19]. "Re: RFC 2.6.0 EDD enhancements". Linux Kernel Mailing List. Archived from the original on 2017-08-24. Retrieved 2017-08-24.
- ^ "Windows may use Signature() syntax in the BOOT.INI file". KnowledgeBase. Microsoft.
- ^ McTavish (February 2014). "Vista's MBR Disk Signature". Multibooters: Dual and Multibooting with Vista. Archived from the original on 2017-08-24. Retrieved 2017-08-24.
- ^ Russinovich, Mark (2011-11-08). "Fixing Disk Signature Collisions". Mark Russinovich's Blog. Microsoft. Archived from the original on 2017-08-24. Retrieved 2013-04-19.
- ^ a b c Sakamoto, Masahiko (2010-05-13). "Why BIOS loads MBR into
0x7C00in x86?". Glamenv-Septzen.net. Archived from the original on 2017-08-24. Retrieved 2011-05-04. - ^ a b c d e f Compaq Computer Corporation; Phoenix Technologies Ltd.; Intel Corporation (1996-01-11). "BIOS Boot Specification 1.01" (PDF). 1.01. ACPICA. Archived (PDF) from the original on 2017-08-24. Retrieved 2013-04-20. [1]
- ^ a b Elliott, David F. (2009-10-12). "Why does the "standard" MBR set SI?". tgwbd.org. Archived from the original on 2017-08-24. Retrieved 2013-04-20.
- ^ a b c Compaq Computer Corporation; Phoenix Technologies Ltd.; Intel Corporation (1994-05-05). "Plug and Play BIOS Specification 1.0A" (PDF). 1.0A. Intel. Archived from the original (PDF) on 2017-08-24. Retrieved 2013-04-20.
- ^ Paul, Matthias R. (1997-10-02) [1997-09-29]. "Caldera OpenDOS 7.01/7.02 Update Alpha 3 IBMBIO.COM - README.TXT and BOOT.TXT - A short description of how OpenDOS is booted". Archived from the original on 2003-10-04. Retrieved 2009-03-29. [2]
- ^ Paul, Matthias R. (2017-08-14) [2017-08-07]. "The continuing saga of Windows 3.1 in enhanced mode on OmniBook 300". MoHPC - the Museum of HP Calculators. Archived from the original on 2018-05-01. Retrieved 2018-05-01.
[…] SYS […] /O[:nnn] Override IPL reported boot drive unit (n=0..126, 128..254). […] Preparing target disk... Choosing FAT12 CHS Boot Sector (requires IPL to report boot unit). Treating target as diskette or superfloppy medium (boot drive unit 0). Writing new Boot Sector... […]
(NB. SYS writes volume boot records rather than master boot records, but their incoming register interface is similar (with extensions) since they could both be loaded initially by the underlying system.) - ^ Elliott, Robert (2010-01-04). "EDD-4 Hybrid MBR boot code annex" (PDF). Hewlett Packard, T13 Technical Committee. e09127r3. Archived (PDF) from the original on 2017-08-24. Retrieved 2013-04-20.
- ^ "FDISK /MBR rewrites the Master Boot Record". Support. 1. Microsoft. 2011-09-23. 69013. Archived from the original on 2017-02-08. Retrieved 2013-04-19.
- ^ "sfdisk(8) – Linux man page". die.net. 2013 [2007]. Archived from the original on 2017-08-24. Retrieved 2013-04-20.
- ^ Brown, Ralf D. (2000-07-16). "Ralf Browns Interrupt List (v61 html)". Delorie Software. Retrieved 2016-11-03.
- ^ Brown, Ralf D. (2000-07-16). "B-1302: INT 13 - DISK - READ SECTOR(S) INTO MEMORY". Ralf Brown's Interrupt List (RBIL) (61 ed.). Retrieved 2016-11-03. (NB. See file INTERRUP.B inside archive "INTER61A.ZIP.)
Further reading
[edit]- Gilbert, Howard (1996-01-01) [1995]. "Partitions and Volumes". PC Lube & Tune. Archived from the original on 2016-03-03.
- Knights, Ray (2004-12-22) [2000-12-16]. "Ray's Place". MBR and Windows Boot Sectors (includes code disassembly and explanations of boot process). Archived from the original on 2017-08-24. Retrieved 2017-08-24.
- Landis, Hale (2002-05-06). "Master Boot Record". How It Works. Archived from the original on 2014-07-01.
- Sedory, Daniel B. (2015-06-25) [2007]. "MBRs (Master Boot Records)". Boot Records Revealed. Archived from the original on 2017-08-24. Retrieved 2017-08-24. [3] [4]
External links
[edit]Master boot record
View on GrokipediaIntroduction
Definition and Purpose
The Master Boot Record (MBR) is the first sector, known as sector 0, of a partitioned data storage device such as a hard disk drive or removable drive, typically consisting of 512 bytes.[6] It serves as a boot sector that contains both executable bootstrap code and a partition table, which is created when the first partition is established on the disk.[2] The primary purposes of the MBR include facilitating the bootstrapping process to load the operating system, organizing the disk into logical partitions through its embedded table, and providing a unique disk identifier via a signature for system recognition and volume management.[2] In the context of x86 PC architecture, the MBR acts as the initial entry point for the BIOS firmware to begin operating system loading on systems that do not use UEFI, where the BIOS reads the MBR into memory and executes its code to locate and start the boot process for the active partition.[7] Structurally, the MBR allocates bytes 0–445 for the executable bootstrap code, optionally bytes 440–443 for a disk signature used by Microsoft operating systems, and begins the partition table at byte 446, allowing for up to four primary partitions or extended partitioning schemes.[8] This layout ensures compatibility with legacy BIOS-based booting while defining the disk's partition layout in a compact format.[2]Historical Development
The Master Boot Record (MBR) was introduced in 1983 alongside IBM PC DOS 2.0 to enable hard disk partitioning on the IBM PC XT architecture, marking the first widespread implementation of structured disk boot sectors for personal computers.[1] This development addressed the need for organizing larger storage devices beyond simple floppy disk formats, allowing the BIOS to load executable code from the disk's first sector while supporting initial partitioning schemes.[9] Developed collaboratively by engineers at IBM and Microsoft, the MBR was shaped by the requirements of the emerging File Allocation Table (FAT) file system, which necessitated a boot mechanism capable of locating and initiating volume boot records on partitioned media.[10] A key milestone occurred with MS-DOS 3.3 in 1987, which standardized support for multiple partitions within the MBR framework, expanding from the single-partition limitation of earlier versions and facilitating more flexible disk management.[11] The MBR became a de facto standard through its integration with the BIOS interrupt 13h (INT 13h) interface, which provided low-level disk access routines without a formal specification like an RFC, relying instead on consistent implementation across IBM-compatible systems.[12] This approach ensured broad compatibility, leading to its adoption in Windows bootloaders such as NTLDR and BOOTMGR, as well as Linux's GRUB, which often installs its stage 1 code directly into the MBR for legacy BIOS booting.[7] Despite the introduction of the Unified Extensible Firmware Interface (UEFI) in 2005, which offered enhanced boot capabilities and support for the GUID Partition Table (GPT), the MBR persisted due to backward compatibility modes in UEFI firmware, such as the Compatibility Support Module (CSM), allowing continued use on legacy systems.[13] However, the MBR's foundational assumptions—512-byte sectors and 32-bit Logical Block Addressing (LBA)—imposed a 2.2 terabyte addressable limit, which became a practical constraint by the late 1990s as hard drive capacities exceeded this threshold, prompting the need for alternatives like GPT.[14]Technical Structure
Sector Layout
The Master Boot Record (MBR) occupies the first sector of a hard disk drive, corresponding to logical block address 0 (LBA 0), and is always exactly 512 bytes in length to align with the standard sector size used in PC-compatible systems.[15][16] This fixed size ensures compatibility with BIOS firmware, which loads the entire sector into memory for execution during the boot process, and any implementation must pad the content to precisely 512 bytes without slack space.[15] The sector's layout is rigidly structured into three primary components, all in little-endian byte order to match the x86 architecture's native format. Bytes 0 through 445 (446 bytes total) are reserved for the bootstrap code, a small executable program responsible for locating and loading the operating system's boot loader from an active partition.[15][16] Immediately following, bytes 446 through 509 (64 bytes total) contain the partition table, consisting of four fixed 16-byte entries that describe the disk's primary partitions.[15][16] The final two bytes, at offsets 510 and 511, form the boot signature, which must be the hexadecimal value 0xAA55 (stored as 0x55 at byte 510 and 0xAA at byte 511 in little-endian order) to indicate a valid MBR; the BIOS checks this signature before proceeding with execution.[15][16] This organization accounts for every byte in the sector, leaving no unused space. While the core MBR layout remains invariant across implementations to maintain BIOS compatibility, some systems support extended partitions by dedicating one of the four partition table entries to reference additional partition tables in subsequent sectors, allowing for more than four partitions without altering the primary sector's structure.[15]Bootstrap Code
The bootstrap code occupies the first 446 bytes of the Master Boot Record (MBR) and consists of 16-bit x86 assembly instructions designed to execute in real mode. Loaded by the BIOS into physical memory at address 0x7C00 with the DL register containing the boot drive number, this code initiates the secondary stage of the boot process by identifying and loading the appropriate volume boot record (VBR).)[17] Its core functionality involves scanning the embedded partition table—located immediately after the code at offset 0x1BE—for an entry marked as active, indicated by a bootable flag value of 0x80 in the first byte of the 16-byte partition descriptor. Upon locating a single active partition, the code calculates the logical block address (LBA) of that partition's starting sector (typically LBA 0 relative to the partition offset) and invokes BIOS interrupt 13h (function 02h for CHS addressing or 42h for extended read in later implementations) to transfer one sector of data (the VBR) into memory at 0x7C00. Execution then transfers to the loaded VBR via a far jump instruction, such asJMP 0x0000:0x7C00, chaining the boot process to the operating system's loader.)[17][18]
If no active partition is detected or multiple active flags are present, the code branches to an error routine, often displaying a message like "No bootable partition in table" using BIOS interrupt 10h for video output before entering an infinite loop or halting the CPU. The 446-byte limit enforces concise implementation, relying on efficient instructions like relative jumps, register operations, and minimal stack usage to fit within constraints while handling basic disk I/O via BIOS services.[17])
Operating system installers frequently customize this code—for instance, the Windows NT bootloader replaces it with proprietary logic to support multi-boot scenarios—while ensuring the MBR's signature bytes (0x55AA at offsets 510-511) remain intact for validation.[19][20]
The following pseudocode illustrates a simplified representation of the bootstrap logic:
; Assume code starts at 0x7C00, DS=0
mov ax, 0x7C00 >> 4 ; Set segment for ES
mov es, ax
xor bx, bx ; Offset 0 in ES
search_loop:
mov si, 0x1BE ; Start of partition table
mov cx, 4 ; Four entries
check_entry:
cmp byte [si], 0x80 ; Active flag?
jne next_entry
; Found active: compute LBA (simplified, assumes partition starts at known offset)
; For example, extract CHS from entry bytes 2-7 or use LBA if available
mov ah, 0x02 ; INT 13h read function
mov al, 1 ; Read 1 sector
mov ch, [si+2] ; Cylinder (example)
mov cl, [si+3] ; Sector/Head (example)
; ... set DH, DL appropriately
int 0x13 ; Read to ES:BX (0x7C00)
jc error ; Carry flag on error
jmp 0x7C00 ; Jump to loaded VBR
next_entry:
add si, 16 ; Next partition entry
loop check_entry
error:
; Display error (e.g., via [INT 10h](/page/INT_10H))
; Infinite loop: jmp $
halt:
hlt
jmp halt
; Assume code starts at 0x7C00, DS=0
mov ax, 0x7C00 >> 4 ; Set segment for ES
mov es, ax
xor bx, bx ; Offset 0 in ES
search_loop:
mov si, 0x1BE ; Start of partition table
mov cx, 4 ; Four entries
check_entry:
cmp byte [si], 0x80 ; Active flag?
jne next_entry
; Found active: compute LBA (simplified, assumes partition starts at known offset)
; For example, extract CHS from entry bytes 2-7 or use LBA if available
mov ah, 0x02 ; INT 13h read function
mov al, 1 ; Read 1 sector
mov ch, [si+2] ; Cylinder (example)
mov cl, [si+3] ; Sector/Head (example)
; ... set DH, DL appropriately
int 0x13 ; Read to ES:BX (0x7C00)
jc error ; Carry flag on error
jmp 0x7C00 ; Jump to loaded VBR
next_entry:
add si, 16 ; Next partition entry
loop check_entry
error:
; Display error (e.g., via [INT 10h](/page/INT_10H))
; Infinite loop: jmp $
halt:
hlt
jmp halt
Partition Table Entries
The Master Boot Record (MBR) partition table contains four primary partition entries, each exactly 16 bytes in length, allowing for up to four primary partitions on the disk.[21] These entries are located immediately following the bootstrap code in the MBR sector, starting at byte offset 446 and ending at offset 509, with a signature of 0xAA55 at bytes 510-511 to validate the table.[22] Each entry follows a fixed structure to describe a partition's attributes, location, and size:| Offset | Size (bytes) | Field Name | Description |
|---|---|---|---|
| 0 | 1 | Bootable Flag | Indicates if the partition is active/bootable: 0x00 for non-bootable, 0x80 for bootable; all other values are invalid and typically treated as 0x00. Only one entry may have the 0x80 value; if multiple are set, boot loaders may ignore all or select the first.[21][23] |
| 1 | 1 | Starting Head (CHS) | Head number (0-255) for the first sector of the partition in Cylinder-Head-Sector (CHS) addressing.[23] |
| 2 | 1 | Starting Sector/Cylinder (CHS) | Bits 0-5: Sector number (1-63); bits 6-7: High bits of starting cylinder.[23] |
| 3 | 1 | Starting Cylinder (CHS) | Low 8 bits of the starting cylinder number (0-1023). Combined with byte 2 for full cylinder value.[23] |
| 4 | 1 | Partition Type | Hexadecimal code identifying the partition's file system or purpose (e.g., 0x07 for NTFS or HPFS, 0x0B for FAT32 with CHS, 0x0C for FAT32 with LBA, 0x83 for Linux native, 0x05 for extended partition, 0x0F for extended with LBA).[24][25] |
| 5 | 1 | Ending Head (CHS) | Head number (0-255) for the last sector of the partition in CHS addressing.[23] |
| 6 | 1 | Ending Sector/Cylinder (CHS) | Bits 0-5: Sector number (1-63); bits 6-7: High bits of ending cylinder.[23] |
| 7 | 1 | Ending Cylinder (CHS) | Low 8 bits of the ending cylinder number (0-1023). Combined with byte 6 for full cylinder value.[23] |
| 8 | 4 | Starting LBA | Logical Block Address (sector number) of the partition's first sector, using little-endian format (0 to 2^32-1, limiting addressable space to about 2 TB).[23] |
| 12 | 4 | Size in Sectors | Number of sectors in the partition, little-endian (0 to 2^32-1).[23] |
Disk Signature
The disk signature is a 4-byte value located at offset 440 (0x1B8) within the 512-byte Master Boot Record (MBR) sector of a disk, within the bootstrap code area immediately preceding the partition table entries, with the boot signature bytes following the partition table at offsets 510-511.[27] This signature serves as a unique identifier for the entire disk in MBR-partitioned systems, often generated as a random value or based on a timestamp during the partitioning process.[28] Tools such as GNU fdisk typically create this value when initializing or repartitioning a disk, ensuring it is written in little-endian byte order.[29] The primary purpose of the disk signature is to provide a persistent, disk-level identifier that operating systems and applications can use to distinguish between multiple storage devices, thereby preventing accidental swaps or misconfigurations in multi-disk environments.[30] In RAID configurations, it aids in detecting cloned or duplicated disks, as identical signatures can trigger conflicts or boot failures when multiple drives with the same identifier are present.[31] Microsoft Windows specifically leverages the disk signature for assigning and maintaining consistent drive letters across reboots, integrating it into registry entries for volume management.[32] Although not directly equivalent to volume serial numbers— which are generated separately for individual partitions or volumes—the signature contributes to overall disk recognition in file system operations.[33] With only 2^32 possible values, collisions are rare in typical setups but can occur in large-scale deployments involving disk cloning or virtualization, potentially leading to identification errors that require manual regeneration of the signature.[34] In UEFI-based systems, which favor the GUID Partition Table (GPT) with its own 128-bit disk GUID, the MBR disk signature is generally ignored during boot and partitioning processes.[7] However, BIOS-compatible tools and legacy boot modes continue to rely on it for accurate disk identity verification.[35]Partitioning Scheme
Partition Types and Limits
The Master Boot Record (MBR) partitioning scheme supports up to four primary partitions on a disk, each described directly in the MBR's partition table entries.[36] Alternatively, a configuration of three primary partitions and one extended partition is permitted, where the extended partition serves as a container for additional logical partitions organized through a chain of extended boot records (EBRs).[36] This structure allows for more flexible disk organization while maintaining compatibility with the fixed four-entry limit in the MBR.[26] Addressing in the MBR relies on either legacy Cylinder-Head-Sector (CHS) coordinates or 32-bit Logical Block Addressing (LBA). The CHS method, limited to 1024 cylinders, 255 heads, and 63 sectors per track, caps the addressable disk size at approximately 8 GB (specifically 8,422,689,024 bytes).[37] In contrast, 32-bit LBA supports up to 2^32 sectors, equating to a maximum of 2.2 TB for standard 512-byte sectors (precisely 2,199,023,255,552 bytes).[14] These limits stem from the 32-bit fields in the partition table entries for starting and ending sectors.[38] To circumvent the four-partition restriction, the extended partition mechanism enables an unlimited number of logical partitions (in practice, limited by disk space) via a linked list of EBRs, each describing one logical partition and pointing to the next.[36] However, nesting is restricted to two levels: primary (or extended) partitions at the top level, with logical partitions contained only within a single extended partition—no further extended partitions can be nested inside logical ones.[37] Partition types are identified by a single-byte hexadecimal code in each partition table entry, signaling the intended format or usage to the operating system. Microsoft defines several standard types via Windows API constants, though the ecosystem has evolved more than 100 codes overall, including vendor-specific and protective types for compatibility with newer schemes like GPT.[39] The following table lists representative common types:| Hex Code | Type Description | Notes |
|---|---|---|
| 0x00 | Unused entry | No partition assigned.[39] |
| 0x01 | FAT12 | 12-bit File Allocation Table, for small volumes.[39] |
| 0x04 | FAT16 (CHS, <32 MB) | 16-bit FAT using CHS addressing.[39] |
| 0x05 | Extended (CHS) | Container for logical partitions using CHS.[39] |
| 0x06 | FAT16 | 16-bit FAT, non-CHS limited.[39] |
| 0x07 | NTFS, exFAT, or other IFS | Installable File System, commonly NTFS.[39] |
| 0x0B | FAT32 (CHS) | 32-bit FAT using CHS addressing.[39] |
| 0x0C | FAT32 (LBA) | 32-bit FAT using LBA addressing.[39] |
| 0x0E | FAT16 (LBA) | 16-bit FAT using LBA addressing.[39] |
| 0x0F | Extended (LBA) | Container for logical partitions using LBA.[39] |
| 0xEE | GPT protective | Marks MBR disk as containing a GPT table (non-MBR bootable).[40] |
| 0xEF | EFI FAT (protective) | For EFI system partitions on MBR, though with limited support.[7] |
Compatibility with File Systems
The Master Boot Record (MBR) uses partition type codes in its partition table entries to indicate the expected file system on each partition, allowing operating systems to identify and access them appropriately. For instance, the hexadecimal code 0x07 signifies an NTFS file system partition, while 0x83 denotes a Linux native file system such as ext2, ext3, or ext4.[24] These codes serve as hints rather than strict enforcers, as operating system drivers subsequently read the volume boot record (VBR) at the start of the partition to verify the actual file system type and parameters.[41] Cross-platform compatibility with MBR partitions varies by operating system and supported file systems, enabling shared access in multi-OS environments but with limitations. Windows natively recognizes and supports FAT, exFAT, and NTFS file systems on MBR partitions, making them suitable for bootable volumes and data storage in legacy BIOS setups.[4] Linux kernels support a wide range of file systems on MBR partitions marked with type 0x83, including ext2/ext3/ext4 for traditional use and Btrfs for modern features like snapshots and compression, while also mounting Windows file systems via drivers like NTFS-3G.[41] macOS supports HFS+ on MBR partitions for compatibility with older hardware, but APFS—the default since macOS High Sierra—requires a GUID Partition Table (GPT) and is not supported on MBR partitions; for cross-platform sharing, FAT32 or exFAT are recommended on MBR.[42] During booting, the active partition's file system must align with the operating system's expectations for the VBR to load successfully, as the MBR bootstrap code chains to the VBR expecting a compatible structure; mismatches, such as an NTFS partition on a Linux-only bootloader, result in boot failures like "invalid partition table" errors.[43] In hybrid setups combining MBR for BIOS compatibility with EFI/UEFI systems, the partitioning scheme ensures legacy boot support, but the file systems on individual partitions operate independently, allowing diverse formats like NTFS alongside ext4 without interference.[44] While MBR limits partitions to four primary (or extended) entries and 2 TB total disk size, these constraints do not directly affect file system compatibility within valid partitions.[4]Bootstrapping Process
BIOS to MBR Interaction
During the power-on self-test (POST) phase, the BIOS firmware scans boot devices in priority order and, upon selecting a hard disk, loads its first sector—the 512-byte Master Boot Record (MBR)—into RAM at physical address 0x7C00. The BIOS sets the DL register to the boot drive number, typically 0x80 for the primary hard disk, and performs a far jump to segment:offset 0000:7C00 to initiate execution of the MBR bootstrap code.[45] The MBR code interacts with the BIOS primarily through interrupt 13h (INT 13h) for disk input/output operations. Basic INT 13h functions employ Cylinder-Head-Sector (CHS) addressing, specifying the cylinder in CH (bits 7-6 of CL for high bits), head in DH, and sector in CL (bits 0-5); return parameters include sector count in AL and updated registers for multi-sector reads. For drives exceeding CHS limits (approximately 8 GB), INT 13h extensions—introduced in the early 1990s—support Logical Block Addressing (LBA) modes, with AH=42h for 28-bit LBA reads (up to 128 GB) and AH=42h with 48-bit extensions for larger capacities, using a data packet at DS:SI for sector addresses and buffer details.[46] Error handling in the BIOS-to-MBR interface relies on status flags from INT 13h calls. Successful operations clear the carry flag (CF=0) and set AH=00h; failures set CF=1 and place an error code in AH (e.g., 01h for invalid function, 02h for address mark not found). The MBR must test CF after each call and, on error, typically print a diagnostic message using BIOS video services (INT 10h) before invoking INT 18h to report boot failure, allowing the BIOS to attempt the next device or terminate with a "Non-system disk or disk error" message.[46] The design assumes hardware compatible with the original IBM PC architecture, particularly ATA/IDE (AT Attachment/Integrated Drive Electronics) interfaces for hard disks, where INT 13h abstracts low-level controller access. Booting from non-native media like USB requires BIOS-level emulation of an IDE hard drive, presenting the USB device as a standard block device via INT 13h to enable MBR loading without modifications to the bootstrap code.MBR to Volume Boot Record Transition
After executing its bootstrap code, the Master Boot Record (MBR) scans the partition table to identify the active partition, typically marked by the active flag in one of the four primary partition entries. It then uses BIOS interrupt INT 13h (function AH=02h) to read the first sector of this active partition—the Volume Boot Record (VBR)—into memory at physical address 0x7C00. To accommodate this, the MBR relocates its own code to another memory location, such as 0x0600, ensuring the VBR overwrites the original MBR load address without conflict. This process relies on the BIOS-provided drive geometry or logical block addressing (LBA) mode for sector access, allowing the MBR to issue the read command with parameters specifying the starting sector, number of sectors (usually one), and destination memory. Upon successful loading of the VBR, the MBR prepares the system state for transfer by setting key registers: DL holds the BIOS drive number (e.g., 0x80 for the first hard drive), while in some implementations, DS:SI points to the partition table entry containing the starting LBA of the partition to inform the VBR of its context. The MBR then performs a far jump to the VBR's entry point at 0x7C00:0x0000, passing control and effectively concluding its role in the boot chain. This interface ensures compatibility across standard PC BIOS environments, where the VBR assumes the same memory layout and drive parameters. The MBR's design supports chainloading for multi-stage bootloaders, where the MBR code acts as an initial stub to load subsequent stages from the active partition. For example, in GRUB Legacy (GRUB 0.97), stage 1 occupies the MBR and uses INT 13h to read the first block of stage 1.5 or stage 2 from a specified location on the filesystem, embedding block lists for non-contiguous data; stage 1.5 provides filesystem support to fully load stage 2, which then presents the boot menu. This staged approach allows GRUB to handle complex configurations beyond a simple VBR handoff.[47] Operating system variants leverage this transition differently while adhering to the MBR-VBR protocol. In Windows NT-based systems (e.g., Windows XP), the MBR loads the NTFS or FAT VBR of the active partition, which in turn scans the root directory to load NTLDR (NT Loader) into memory and execute it, passing drive and partition details via registers. For Linux, LILO often installs its primary stage directly into the MBR, using a map file installed in the root filesystem to load secondary stages or the kernel, bypassing a traditional VBR; alternatively, SYSLINUX places its core (ldlinux.sys) in the VBR of a FAT-formatted boot partition, with the MBR chainloading this VBR to initiate the loader menu and kernel loading process. These adaptations maintain the MBR's role as a minimal bridge to OS-specific bootstrapping.[48][49]Boot Failure Scenarios
Boot failure scenarios in the Master Boot Record (MBR) typically arise from structural issues in the sector layout, invalid partition configurations, hardware limitations, or external interference, preventing the bootstrap code from locating and loading a valid operating system. These failures often manifest during the initial BIOS-to-MBR handoff, where the loaded code at sector 0 cannot proceed to the volume boot record, resulting in error messages or system halts. Common causes include misconfigurations in the partition table and environmental factors affecting sector integrity. One prevalent issue occurs when no partition is marked as active in the MBR's partition table. The bootstrap code systematically scans the four primary partition entries, each beginning at offsets 446, 462, 478, and 494 bytes from the sector start, searching for the boot indicator byte set to 0x80, which designates the active (bootable) partition. If none of the entries have this flag set—often due to manual partitioning errors or accidental flag removal—the code cannot identify a target for loading the volume boot record and terminates the process, typically displaying a BIOS-generated error like "No bootable device" or "No active partition found." This check ensures only one intended partition initiates the boot sequence, as multiple active flags can lead to unpredictable behavior, though the absence halts execution entirely. Corruption of the MBR signature at bytes 510-511 (0x55 followed by 0xAA in little-endian order) represents another critical failure point. This two-byte marker validates the sector as a legitimate MBR, and its absence or alteration—commonly from disk errors, improper writes, or partial overwrites—prevents execution of the bootstrap code.[50] The BIOS loads the sector into memory at address 0x7C00 regardless, but upon validation failure, it refuses to jump to the code, resulting in a boot halt without further error display in basic implementations.[50] Partition table checks, as referenced in the sector layout, may also indirectly fail if the signature invalidates the entire structure, amplifying the issue. For drives exceeding 2 terabytes (approximately 2^32 sectors of 512 bytes each), logical block addressing (LBA) limitations in the MBR partition entries cause overflow errors. Each entry's starting sector and sector count fields are 32-bit unsigned integers, capping addressable space at 2 TB; attempts to define partitions beyond this threshold lead to truncated or invalid LBA values.[14] When the bootstrap code invokes legacy INT 13h BIOS interrupts for disk I/O without extensions, these misread sectors result in input/output errors, preventing proper partition location and boot sector loading.[51] Legacy BIOS environments exacerbate this, as CHS addressing further limits access to about 8 GB, but the 2 TB boundary specifically triggers LBA-related failures in MBR setups. Malware, particularly boot sector viruses, can interfere by overwriting the MBR's bootstrap code while often preserving or mimicking the 0x55AA signature to evade immediate detection. These viruses infect the MBR during execution from compromised media, relocating original code and inserting malicious payloads that execute prior to the OS loader.[52] If the overwrite corrupts the signature or disrupts code integrity, the boot process fails with validation errors, as the altered sector no longer matches expected patterns.[53] Detection typically occurs via signature mismatch during scans, though successful infections may allow booting until payload activation causes further instability.[53]Advanced Considerations
Disk Identity Usage
The MBR disk signature serves as a unique identifier for storage devices in various operating systems, facilitating efficient disk management and volume access. In Windows, the operating system relies on this 4-byte value, stored at offset 0x1B8 in the MBR, to distinguish disks and associate them with volumes; changes to the signature trigger updates to volume unique identifiers, enabling cached mappings for rapid mounting without rescanning hardware.[54] In Linux, the MBR disk signature is used to generate pseudo PARTUUIDs for MBR partitions in /dev/disk/by-partuuid, where the format is SSSSSSSS-PP (SSSSSSSS being the zero-padded 32-bit signature and PP the hexadecimal partition number), providing stable identifiers for partitions that persist across reboots independent of device enumeration order.[55] In digital forensics and disk cloning processes, the MBR disk signature plays a key role in validating image integrity. Forensic tools such as dd extract the signature from both the original disk and the cloned image for comparison; discrepancies in this value signal potential tampering, incomplete copies, or alterations during acquisition, ensuring chain-of-custody reliability. RAID configurations depend on the uniqueness of MBR disk signatures to maintain array coherence and avoid identification conflicts among member disks. Without distinct signatures, the system may misattribute volumes or fail to assemble the array properly, as Windows and other OSes use these identifiers for coordination in multi-disk environments.[33] In virtualization environments, hypervisors like VMware preserve the MBR disk signature within virtual machine disks to uphold guest OS stability. This retention prevents signature collisions during snapshotting or migration, allowing the guest to recognize and mount its volumes seamlessly without reconfiguration.[56] For security applications, certain bootloaders and integrity-checking mechanisms compare the MBR disk signature against predefined values to detect unauthorized disk modifications or substitutions, enhancing protection against boot-time attacks in controlled environments.[57]Programming and Editing Tools
Command-line tools provide essential capabilities for modifying the Master Boot Record (MBR) on Linux systems, particularly for partitioning and raw sector operations. Thefdisk utility, a dialog-driven program, enables the creation, deletion, and manipulation of MBR partition tables by interacting with the disk's sector 0 structure.[58] For raw writes to the MBR, the dd command copies data block-by-block, such as backing up or restoring the first 512 bytes (including boot code and partition table) using commands like dd if=/dev/sda of=mbr_backup.img bs=512 count=1.[59] Hex editors like HxD or Active@ Disk Editor allow direct byte-level inspection and modification of MBR contents, parsing elements such as the boot code and partition entries for precise edits.[60][61] Additionally, ms-sys installs Microsoft-compatible boot records to the MBR, replicating the functionality of Windows' fdisk /mbr command for writing boot code to hard disks or floppies.[62]
Graphical user interface (GUI) utilities simplify MBR editing for users preferring visual tools, often including features for rebuilding or repairing the boot sector. EaseUS Partition Master offers a "Rebuild MBR" function that restores corrupted MBR data without data loss, supporting operations on internal and external drives across Windows versions.[63] Similarly, MiniTool Partition Wizard provides MBR repair and rebuild tools, allowing users to fix boot failures by regenerating the MBR structure in a few clicks, even from bootable media.[64] For offline access, bootable ISO images like the Ultimate Boot CD include integrated utilities such as Parted Magic, enabling MBR partitioning and repairs without loading the host operating system.[65]
Programmatic access to the MBR typically involves low-level BIOS interrupts or higher-level libraries for safe manipulation. In assembly or C code, the INT 13h extensions (also known as Enhanced Disk Drive Services) support 32-bit Logical Block Addressing (LBA) for reading and writing beyond the 8.4 GB limit of CHS addressing, allowing direct MBR sector access via function AH=42h for extended reads.[66] For abstracted operations, the libparted library facilitates MBR partition table creation and editing through its API, handling disk geometry and ensuring compatibility with MS-DOS-style tables in applications like GParted.[67]
Best practices for MBR editing emphasize caution to prevent boot failures, starting with a full backup of the MBR using tools like dd to create a restorable image before any modifications.[68] Post-edit, verification of the 0x55AA boot signature in bytes 510-511 is crucial, as its absence can render the disk unbootable; tools like hex editors or dd with hexdump can confirm this marker, which signals the BIOS to execute the boot code.[66]
Limitations and Modern Alternatives
The Master Boot Record (MBR) partitioning scheme imposes several fundamental limitations that restrict its utility in modern computing environments. Primarily, it supports only four primary partitions per disk, a constraint that can be partially circumvented through the use of extended partitions containing logical ones, though this approach introduces significant complexity in partition management and increases the risk of configuration errors.[13][25] Additionally, due to its reliance on 32-bit addressing for disk sectors, the MBR limits addressable storage to approximately 2.2 terabytes (2 TiB), rendering it incompatible with larger contemporary hard drives without advanced translation techniques that are not universally supported.[14][25] Further compounding these issues, the MBR lacks built-in redundancy or cyclic redundancy check (CRC) mechanisms for its partition table and boot code, making it highly susceptible to corruption from single-sector failures, which can render the entire disk unbootable or inaccessible without external recovery tools.[69] This vulnerability is exacerbated by the scheme's outdated dependence on cylinder-head-sector (CHS) addressing, a geometry-based model that became obsolete in the mid-1990s as logical block addressing (LBA) emerged to handle larger drives more efficiently; modern BIOS implementations emulate CHS for backward compatibility, but this translation often leads to inconsistencies on disks exceeding 137 GB.[70] In response to these shortcomings, the GUID Partition Table (GPT), introduced as part of the Unified Extensible Firmware Interface (UEFI) specification version 2.0 in 2006, has emerged as the primary modern alternative.[71] GPT overcomes MBR's restrictions by supporting up to 128 primary partitions by default (expandable via software) and addressing theoretical disk sizes up to 8 zettabytes through 64-bit LBA, while incorporating redundant partition headers and CRC checks for enhanced integrity and recovery from corruption.[69] To maintain compatibility with legacy BIOS/MBR systems, GPT disks include a protective MBR in the first sector, which designates the entire disk as a single unknown partition type (0xEE) to deter inadvertent overwriting by older tools.[7] Hybrid MBR-GPT configurations extend this compatibility further by allowing a limited number of MBR-style partitions (up to three primary) to coexist with the full GPT layout, facilitating dual-boot setups or transitions on systems with mixed firmware support.[72] As of 2025, the shift toward GPT and UEFI is evident in major operating system requirements, with Windows 11 mandating UEFI firmware and GPT partitioning for installation to enable features like Secure Boot and full utilization of modern hardware.[73][74] Consequently, MBR persists mainly in legacy applications, such as older hardware, embedded systems, or environments requiring strict BIOS compatibility, but its adoption has declined sharply in favor of GPT's scalability and robustness.[14]References
- https://wiki.gentoo.org/wiki/Hybrid_partition_table
