Friday, April 7, 2017

Hard drive layout and boot requirements

How does software boot from hard drive ?
What are the requirements to boot any operating system from a hard drive ?
What means MBR, FAT, cluster, sector ... ?

 

MBR, the cornerstone

The Master Boot Record is a memory zone located at:
  • Logical address 0 (if the hard drive uses LBA)
  • Cylinder 0, Head 0, Sector 1 (if the hard drive uses CHS addressing. Used by old hard drives)
which contains the OS boot code (i.e. bootstrap) and a partition table.
This memory area has a size of 512 bytes.
mbr.gif
Basically, if anything happens to this memory zone, the hard drive is brain dead.
Usually, the machine will execute the bootstrap which is the 1st level bootloader that scans the partition table, finds the active partition and jumps to it where the 2nd level bootloader shall be located at address 0. Others, like embedded systems where the CPU has its own 1st level bootloader, will read directly the partition table and achieve the same task.
partitionentry.jpg
All partition have a beginning address, ending address, a size given in sectors.
By reading this table, a machine locates the active partition, and jumps to its starting address where another boot record is located. Basically, a boot record is present at the first sector of each partition.

 

Wait, a sector ? What is this ?

When speaking about hard drives, the same vocabulary is always used:
  • sector: amount of bytes (almost always 512 byte for compatibily purpose)
  • cluster: amount of sectors. This number depends on the disk format settings and can be read from boot record.
Note: When working with non-volatile memories like eMMC, another unit is sometimes uses : block. If the memory is formatted as a bootable hard drive, a block equals a sector.
The cluster is the unit used by file systems.

 

FAT

File Allocation table is one of the disk formats used by computers (old Windows mashines, boot disks for some linux machines, ...).
There are 3 types of FAT that are commonly used : FAT12, FAT16 and FAT32.
Here is an overview of the layout of a FAT disk:
fatlayout.jpg
One of the biggest difference between FAT32 and older FAT layouts is that the root directory section is now part of the data area.

 

OK about FAT layout, but where is the MBR ?

In the reserved area, the first sector of a FAT disk is ... the MBR !
Here are the settings that are registered in the boot code for a FAT12 disk:
Bytes Description
0-2 Jump to bootstrap Legacy bytes almost always equals to 0xeb 0x3C 0x90 where 0xEB is the jump instruction for x86 machine (sometimes 0xEA is used instead)
3-10 OEM Name / Version (string)
11-12 Number of bytes per sector (512,1024,2048,4096)
13 Number of sectors per cluster (1,2,4,8,16,32,64,128)
14-15 Number of reserved sectors (FAT32 -> 32, others -> 1)
16 Number of FAT copies
17-18 Number of root directory entries (0 for FAT32, 512 recommended for FAT16)
19-20 Total number of sectors in the filesystem (N/A for FAT32)
21 Media descriptor type (0xF0: Floppy disk, 0xF8: Hard disk)
22-23 Number of sectors per FAT (0 for FAT32)
24-25 Number of sectors per track
26-27 Number of heads (2 for a double sided floppy disk)
28-29 Number of hidden sectors
30-509 Bootstrap
510-511 Signature, always equal to 55h AAh (signature of the MBR)
Here are the FAT16 extensions:
Bytes Description
11-27 Identical
28-31 Number of hidden sectors
32-35 Total number of sectors in the filesystem (replaces byte 19-20 of FAT12)
36 Logical drive number
37 Reserved
38 Extended signature
39-42 Serial Number of partition
43-53 Volume label or no name (string)
54-61 File system type ("FAT32 ", "FAT16 ", "FAT ")
62-509 Bootstrap
510-511 Signature 55h AAh
Here are the FAT32 extensions:
Bytes Description
11-35 Identical
36-39 Sectors per FAT
40-41 Mirror flags (Bits 0-3: number of active FAT, Bits 4-6: reserved, Bit7; 1=single active FAT, 0=all FATs are updated at runtime)
42-43 Filesystem version
44-47 First cluster of root directory (usually 2). This is the important improvement of FAT32. Now the root directory area is not at a fixed place with a fixed size and grow.
48-49 Filesystem information sector (FSINFO) in reserved area (usually 1)
50-51 Backup boot sector location (can be 0)
52-63 Reserved
64 Logical drive number
65 Reserved
66 Extended signature
67-70 Serial number of partition
71-81 Volume label
82-89 Filesystem type ("FAT32 ")

The FAT area

A FAT is table with one entry per cluster. Each entry has a size of:
  • 12 bits for FAT12
  • 16 bits for FAT16
  • 32 bits for FAT32
Each entry specified if the cluster has data in it or if there is another cluster following it.
The first 2 entries of a FAT table are unused. The first one contains 0xFFFFFFF8 with 0xF8 the media descriptor while the other one contains the end of file marker (0xFFFFFFFF).
The FAT area is split in two :
FAT #1 FAT #2
where FAT #2 is a mirror of FAT #1.

 

FSINFO

File system information sector is located at logical sector 1 (in reserved area).
The purpose of this sector is not clear.
Offset Description Size
00h First Signature (52h 52h 61h41h) 1 Double Word
04h Unknown, Currently (Mightjust be Null) 480 Bytes
1E4h Signature of FSInfo Sector(72h 72h 41h 61h) 1 Double Word
1E8h Number of Free Clusters (Setto -1 if Unknown) 1 Double Word
1ECh Cluster Number of Clusterthat was Most Recently Allocated. 1 Double Word
1F0h Reserved 12 Bytes
1FCh Unknown or Null 2 Bytes
1FEh Boot Record Signature (55hAAh) 2 Bytes

Root directory

This area contains an entry for each file located at the root of the filesystem. Every entry has the following properties:
Offset Description Size
00h Filename 8 bytes
08h Filename extension 3 bytes
0Bh File attributes 1 byte
0Ch Reserved 10 bytes
16h Time created or last updated 2 bytes
18h Date created or last updated 2 bytes
1Ah Starting cluster for this file 2 bytes
1Ch File size in bytes 4 bytes
A subdirectory is a file with specific attributes (byte 0Bh).

0 comments:

Post a Comment