GRUB stands for GRand Unified Bootloader, which comes as default Bootloader with most of the GNU/Linux distribution (Red Hat, Ubuntu, Mandriva etc). It is used to boot multiple operating systems installed in the same computer. If you are not familiar with the concept of bootloader, let me just give a brief intro. Once a computer is powered on, its runs some basic hardware test and transfers the control to the selected boot device, mostly it will be your harddisk. However you can configure it to CD-ROM or a USB stick (only if the HW supports), many of us are familiar with this program called BIOS. In fact to modify the boot device we need to change the BIOS settings. Latest hardwares provide a "Boot Menu" hard key as well. Okay coming to the point, Actually the BIOS transfers the control to another program called Bootloader. Now the catch is how does the BIOS know where is the bootloader? Thats simple its always stored in the first 512 bytes in any boot device. The first 512 bytes of a (primary) harddisk is what we call as MBR (Master Boot Record) normally its part of C:\ for Windows users. Guess this is sufficient to get started.
Actually, The complete GRUB bootloader won't fit into 512 bytes, thus 1st part the bootloader (called as stage-1) is stored here, also contains partition table (which tells how the harddisk is split into logical partitions). The stage-2 is actually a text file containing entries which can be modified. This would be our interest here, because just by modifying this file you could boot most of OS (GNU/Linux, Windows, FreeBSD etc) installed in different partitions. Understanding entries in this file is a key in understanding GRUB. Without wasting time let us look into details:
Normally GRUB is stored in the directory: /boot/grub/, this directory contains stage1 and stage2 --> /boot/grub/menu.lst. Below image shows menu.lst file opened in (vim) editor.
An entry to boot windows is similar to this:
title Windows
root (hd0,0)
makeactive
chainloader +1
Let us decipher the commands;
'title' is just a entry to be displayed on the boot-up screen to make a choice.
'root' is an important command which sets the partition in which the OS is present, more often for windows 'rootnovefiy' command will be used instead of root, this is similar to root except it does not mount the partition.
That's fine what is that strange (hd0,0)? This is the GRUB way of naming harddisks, hd - stands for harddisk, hd0 means primary and hd1 means secondary etc. Comma followed by next digit indicates the partition on the disk, thus
(hd0,0) - means primary harddisk 1st partition (Which is normally C:\, If you use windows)
(hd0,1) - means primary harddisk 2nd partition
(hd1,1) - means secondary harddisk 2nd partition
etc, Note that the partition numbering starts from 0 and not 1. Which means (ha0,5) actually means 6th partition, which is sda6. Within GNU/Linux OS partitions are named as either hda or sda based on harddisk type, followed by a partition number. To figure out in your system you can use 'fdisk -l' command with root privileges. Output in my machine was shown below:
[root@localhost sara]# fdisk -l
Device Boot Start End Blocks Id System
/dev/sda1 1 6 48163+ de Dell Utility
/dev/sda2 7 1312 10485760 7 HPFS/NTFS
/dev/sda3 * 1312 PROBLEM 1: 14026 102127616 7 HPFS/NTFS
/dev/sda4 14027 19457 43624507+ f W95 Ext'd (LBA)
/dev/sda5 14027 16708 21543133+ 7 HPFS/NTFS
/dev/sda6 * 16709 19337 21117411 83 Linux
/dev/sda7 19338 19457 963868+ 82 Linux swap / Solaris
[root@localhost sara]#
sda6 and sda7 are GNU/Linux partitions. In this naming convention sdb means secondary harddisk. The naming convention described here is for GNU/Linux, and it varies a bit for FreeBSD. You can use 'fdisk -s' to find it out in FreeBSD.
Okay coming back to the point the third entry in the boot commands,
'makeactive' sets the boot flag of the partitions, which is required for DOS to boot, this flag would be already set however there is no harm in ensuring it.
The last command is interesting,
'chainloader +1', this says chainload the program in the next sector after boot sector. Chainloading in a technique in which the running process will be overlaid by the new process. If the word process itself is new to you then you can assume it somehow loads it. Grub uses this technique to boot windows. This explains all you need to boot windows.
PROBLEM 1:
Say you have installed Windows and GNU/Linux on the same machine and you decided to remove GNU/Linux (as though there is no good reason to this). Assume you deleted GNU/Linux partitions from Windows OS Disk Management and you have restored GNU/Linux partitions for Windows use. Now what happens if you reboot? You will have a surprise with a grub command prompt as shown below
grub>
Your nice GRUB menu would no longer be there. Now How to you boot windows? Obviously you can't boot GNU/Linux as you wiped the harddisk that contained it. Before getting into that, lets understand what has happened? The stage2 of grub is present in /boot/grub/ directory got removed as a part of deleting the GNU/Linux partitions and Grub does not know how to boot your OS now. Or the above mentioned commands are not there for GRUB's reference to boot your Windows OS which is anyway present in the harddisk. So what to do? Grub gives you a nice command prompt from which you can execute commands, if you type 'help' you can see all the commands supported by grub, just by knowing few commands you can do a lot with grub. All the commands that are required to boot windows are already known to you (don't be surprised whatever we discussed in previous section, each of them are commands to GRUB) so just use them,
grub>rootnoverify (hd0,0)
grub>makeactive
grub>chainloader +1
grub>boot
Wow! this will boot your windows without any issue (assuming its installed on C:\). So nice of GRUB, it doesn't let you down even when GNU/Linux was completely removed. The last command 'boot' is new, which means boot the OS with the specified configuration.
PROBLEM 2:
Okay coming to your next question, I don't want to do this (above procedure) every time I boot windows how can I get it back the same way it was before installing GNU/Linux?
Before answering this let us understand why do you get a grub command prompt every time you boot. This is because you would have installed GRUB in MBR and stage1 of GRUB is present there. Now the actual question boils down to how do I remove grub from MBR? this can't be done by GRUB itself. Thus you need a windows utility to do this. This is called 'fdisk', this comes as a part of Windows boot disk or CD. During our college days we use to use a 5.14" floppy for boot disk, I guess they are no more in existence now. Once you manage to get a boot CD containing FDISK program rest is simple, FDISK has a hidden option /MBR which recovers the MBR, Thus executing the below command would fix the MBR.
/>FDISK /MBR
This will re-write MBR thus there will be no traces of GRUB being present there. Thus you will get back your Windows as it was before.
Enough of windows, now Lets turn our attention to GNU/Linux. An entry to boot GNU/Linux is similar to this:
title Linux
root (hd0,5)
kernel /boot/vmlinuz root=/dev/sda6
initrd (hd0,5)/boot/initrd.img
As explained before 'title' and 'root' commands are the same. The new commands are 'kernel' and 'initrd'. Kernel command gives the Linux kernel to boot and the following are the options to kernel such as root=/dev/sda6. What does this /dev/sda6 mean? This basically gives the location of the program /sbin/init which the father of all Linux process and gets started by the kernel once its up. In your particular grub file this line might look little complex than this, however the essence is same, you might have a option to show a splash image etc.
'initrd' command is used to specify the path of the RAM disk image to start with. Actually vmlinuz and initrd.img are symbolic links to the version of the kernel used and initrd image used. The below output confirms the same.
[root@localhost boot]# ls -l
...
lrwxrwxrwx 1 root root 33 2009-02-17 06:58 vmlinuz -> vmlinuz-2.6.27.10-desktop586-1mnb
lrwxrwxrwx 1 root root 36 2009-02-17 06:59 initrd.img -> initrd-2.6.27.10-desktop586-1mnb.img
...
The Linux kernel version used in my machine is 2.6.27.10 as indicated above. Okay why a symbolic link why not the direct kernel name? Yes the kernel name can directly also be used, however this method has an advantage. Say I have updated my kernel version to a latest version, then just the symbolic link of kernel and initrd needs to be changed and no the entry in the grub. Even changing the symbolic link also will be automatically taken care for you when you update or in some distribution it makes a new entry with the new kernel version in the boot-up menu.
PROBLEM 3:
Say you have installed GNU/Linux successfully and you have just got the grub prompt not the Menu, how to boot GNU/Linux now? This might not be the case mostly however its nice way to learn GRUB, you can simulate this by typing 'c' when the grub menu is displayed. This will take you to grub command prompt.
Here we go.
Now the first question is how do I
know in which partition GNU/Linux is installed? Its easy to find out this using 'find' command
grub>find /sbib/init
(hd0,5)
grub>
This indicates that GNU/Linux is installed in (hd0,5) which sda6 of the harddisk. Now we can set the root to this partition
grub>root (hd0,5)
To set the kernel,
grub>root /boot/vmlinuz[Press TAB Key]
vmlinuz-2.6.27-desktop586-0.rc8.2mnb vmlinuz-2.6.27-0.rc8.3.1mdvcustom vmlinuz-2.6.27.10-desktop586-1mnb
[Tab key] auto-completion is a easy way to find out existing files.
Even Tab key works after
grub>root ([Press TAB key]
which displays all the possible partitions in the harddisk. These are some cool features of GRUB.
Okay we will set the kernel as vmlinuz-2.6.27.10-desktop586-1mnb,
grub>root /boot/vmlinuz-2.6.27.10-desktop586-1mnb
the above command can also be written as
grub>root (hd0,5)/boot/vmlinuz-2.6.27.10-desktop586-1mnb
in this case 'root' command is optional as we are specifying the absolute path using (hd0,5).
Similarly initrd image,
grub>root /boot/initrd[Press TAB Key]
initrd-2.6.27-0.rc8.3.1mdvcustom.img initrd-2.6.27.10-desktop586-1mnb.img initrd-2.6.27-desktop586-0.rc8.2mnb.img
Set it same as kernel version, thus initrd-2.6.27.10-desktop586-1mnb.img
grub>root (hd0,5)/boot/initrd-2.6.27.10-desktop586-1mnb.img
IMPORTANT NOTE: Here (hd0,5) is not optional, this should always to absolute path.
All set, now 'boot' command will boot GNU/Linux successfully
grub>boot
If you get something like "Kernel Panic", It might be because you have missed the initrd command.
Cool Now you are equipped with knowledge to boot different OS from GRUB prompt as well as modify stage2 of grub, menu.lst file. Try them!
There are some more interesting commands like:
save - to save the previous boot option, save default is needed in the begging to use this
hide - to hide a partition, this is there to overcome the drawback of DOS/Windows bootloader
unhide - Reverse of hide
map - to map a secondary harddisk as primary, this is there to overcome the drawback of DOS/Windows bootloader
I will leave it you to explore them. I hope this article would have made Grub easy for you to understand. If you have any queries or feedback you are most welcome.
How to fix a corrupted MBR is another interesting thing, that would require another article. Hope I will write it sometime later.
Actually, The complete GRUB bootloader won't fit into 512 bytes, thus 1st part the bootloader (called as stage-1) is stored here, also contains partition table (which tells how the harddisk is split into logical partitions). The stage-2 is actually a text file containing entries which can be modified. This would be our interest here, because just by modifying this file you could boot most of OS (GNU/Linux, Windows, FreeBSD etc) installed in different partitions. Understanding entries in this file is a key in understanding GRUB. Without wasting time let us look into details:
Normally GRUB is stored in the directory: /boot/grub/, this directory contains stage1 and stage2 --> /boot/grub/menu.lst. Below image shows menu.lst file opened in (vim) editor.
An entry to boot windows is similar to this:
title Windows
root (hd0,0)
makeactive
chainloader +1
Let us decipher the commands;
'title' is just a entry to be displayed on the boot-up screen to make a choice.
'root' is an important command which sets the partition in which the OS is present, more often for windows 'rootnovefiy' command will be used instead of root, this is similar to root except it does not mount the partition.
That's fine what is that strange (hd0,0)? This is the GRUB way of naming harddisks, hd - stands for harddisk, hd0 means primary and hd1 means secondary etc. Comma followed by next digit indicates the partition on the disk, thus
(hd0,0) - means primary harddisk 1st partition (Which is normally C:\, If you use windows)
(hd0,1) - means primary harddisk 2nd partition
(hd1,1) - means secondary harddisk 2nd partition
etc, Note that the partition numbering starts from 0 and not 1. Which means (ha0,5) actually means 6th partition, which is sda6. Within GNU/Linux OS partitions are named as either hda or sda based on harddisk type, followed by a partition number. To figure out in your system you can use 'fdisk -l' command with root privileges. Output in my machine was shown below:
[root@localhost sara]# fdisk -l
Device Boot Start End Blocks Id System
/dev/sda1 1 6 48163+ de Dell Utility
/dev/sda2 7 1312 10485760 7 HPFS/NTFS
/dev/sda3 * 1312 PROBLEM 1: 14026 102127616 7 HPFS/NTFS
/dev/sda4 14027 19457 43624507+ f W95 Ext'd (LBA)
/dev/sda5 14027 16708 21543133+ 7 HPFS/NTFS
/dev/sda6 * 16709 19337 21117411 83 Linux
/dev/sda7 19338 19457 963868+ 82 Linux swap / Solaris
[root@localhost sara]#
sda6 and sda7 are GNU/Linux partitions. In this naming convention sdb means secondary harddisk. The naming convention described here is for GNU/Linux, and it varies a bit for FreeBSD. You can use 'fdisk -s' to find it out in FreeBSD.
Okay coming back to the point the third entry in the boot commands,
'makeactive' sets the boot flag of the partitions, which is required for DOS to boot, this flag would be already set however there is no harm in ensuring it.
The last command is interesting,
'chainloader +1', this says chainload the program in the next sector after boot sector. Chainloading in a technique in which the running process will be overlaid by the new process. If the word process itself is new to you then you can assume it somehow loads it. Grub uses this technique to boot windows. This explains all you need to boot windows.
PROBLEM 1:
Say you have installed Windows and GNU/Linux on the same machine and you decided to remove GNU/Linux (as though there is no good reason to this). Assume you deleted GNU/Linux partitions from Windows OS Disk Management and you have restored GNU/Linux partitions for Windows use. Now what happens if you reboot? You will have a surprise with a grub command prompt as shown below
grub>
Your nice GRUB menu would no longer be there. Now How to you boot windows? Obviously you can't boot GNU/Linux as you wiped the harddisk that contained it. Before getting into that, lets understand what has happened? The stage2 of grub is present in /boot/grub/ directory got removed as a part of deleting the GNU/Linux partitions and Grub does not know how to boot your OS now. Or the above mentioned commands are not there for GRUB's reference to boot your Windows OS which is anyway present in the harddisk. So what to do? Grub gives you a nice command prompt from which you can execute commands, if you type 'help' you can see all the commands supported by grub, just by knowing few commands you can do a lot with grub. All the commands that are required to boot windows are already known to you (don't be surprised whatever we discussed in previous section, each of them are commands to GRUB) so just use them,
grub>rootnoverify (hd0,0)
grub>makeactive
grub>chainloader +1
grub>boot
Wow! this will boot your windows without any issue (assuming its installed on C:\). So nice of GRUB, it doesn't let you down even when GNU/Linux was completely removed. The last command 'boot' is new, which means boot the OS with the specified configuration.
PROBLEM 2:
Okay coming to your next question, I don't want to do this (above procedure) every time I boot windows how can I get it back the same way it was before installing GNU/Linux?
Before answering this let us understand why do you get a grub command prompt every time you boot. This is because you would have installed GRUB in MBR and stage1 of GRUB is present there. Now the actual question boils down to how do I remove grub from MBR? this can't be done by GRUB itself. Thus you need a windows utility to do this. This is called 'fdisk', this comes as a part of Windows boot disk or CD. During our college days we use to use a 5.14" floppy for boot disk, I guess they are no more in existence now. Once you manage to get a boot CD containing FDISK program rest is simple, FDISK has a hidden option /MBR which recovers the MBR, Thus executing the below command would fix the MBR.
/>FDISK /MBR
This will re-write MBR thus there will be no traces of GRUB being present there. Thus you will get back your Windows as it was before.
Enough of windows, now Lets turn our attention to GNU/Linux. An entry to boot GNU/Linux is similar to this:
title Linux
root (hd0,5)
kernel /boot/vmlinuz root=/dev/sda6
initrd (hd0,5)/boot/initrd.img
As explained before 'title' and 'root' commands are the same. The new commands are 'kernel' and 'initrd'. Kernel command gives the Linux kernel to boot and the following are the options to kernel such as root=/dev/sda6. What does this /dev/sda6 mean? This basically gives the location of the program /sbin/init which the father of all Linux process and gets started by the kernel once its up. In your particular grub file this line might look little complex than this, however the essence is same, you might have a option to show a splash image etc.
'initrd' command is used to specify the path of the RAM disk image to start with. Actually vmlinuz and initrd.img are symbolic links to the version of the kernel used and initrd image used. The below output confirms the same.
[root@localhost boot]# ls -l
...
lrwxrwxrwx 1 root root 33 2009-02-17 06:58 vmlinuz -> vmlinuz-2.6.27.10-desktop586-1mnb
lrwxrwxrwx 1 root root 36 2009-02-17 06:59 initrd.img -> initrd-2.6.27.10-desktop586-1mnb.img
...
The Linux kernel version used in my machine is 2.6.27.10 as indicated above. Okay why a symbolic link why not the direct kernel name? Yes the kernel name can directly also be used, however this method has an advantage. Say I have updated my kernel version to a latest version, then just the symbolic link of kernel and initrd needs to be changed and no the entry in the grub. Even changing the symbolic link also will be automatically taken care for you when you update or in some distribution it makes a new entry with the new kernel version in the boot-up menu.
PROBLEM 3:
Say you have installed GNU/Linux successfully and you have just got the grub prompt not the Menu, how to boot GNU/Linux now? This might not be the case mostly however its nice way to learn GRUB, you can simulate this by typing 'c' when the grub menu is displayed. This will take you to grub command prompt.
Here we go.
Now the first question is how do I
know in which partition GNU/Linux is installed? Its easy to find out this using 'find' command
grub>find /sbib/init
(hd0,5)
grub>
This indicates that GNU/Linux is installed in (hd0,5) which sda6 of the harddisk. Now we can set the root to this partition
grub>root (hd0,5)
To set the kernel,
grub>root /boot/vmlinuz[Press TAB Key]
vmlinuz-2.6.27-desktop586-0.rc8.2mnb vmlinuz-2.6.27-0.rc8.3.1mdvcustom vmlinuz-2.6.27.10-desktop586-1mnb
[Tab key] auto-completion is a easy way to find out existing files.
Even Tab key works after
grub>root ([Press TAB key]
which displays all the possible partitions in the harddisk. These are some cool features of GRUB.
Okay we will set the kernel as vmlinuz-2.6.27.10-desktop586-1mnb,
grub>root /boot/vmlinuz-2.6.27.10-desktop586-1mnb
the above command can also be written as
grub>root (hd0,5)/boot/vmlinuz-2.6.27.10-desktop586-1mnb
in this case 'root' command is optional as we are specifying the absolute path using (hd0,5).
Similarly initrd image,
grub>root /boot/initrd[Press TAB Key]
initrd-2.6.27-0.rc8.3.1mdvcustom.img initrd-2.6.27.10-desktop586-1mnb.img initrd-2.6.27-desktop586-0.rc8.2mnb.img
Set it same as kernel version, thus initrd-2.6.27.10-desktop586-1mnb.img
grub>root (hd0,5)/boot/initrd-2.6.27.10-desktop586-1mnb.img
IMPORTANT NOTE: Here (hd0,5) is not optional, this should always to absolute path.
All set, now 'boot' command will boot GNU/Linux successfully
grub>boot
If you get something like "Kernel Panic", It might be because you have missed the initrd command.
Cool Now you are equipped with knowledge to boot different OS from GRUB prompt as well as modify stage2 of grub, menu.lst file. Try them!
There are some more interesting commands like:
save - to save the previous boot option, save default is needed in the begging to use this
hide - to hide a partition, this is there to overcome the drawback of DOS/Windows bootloader
unhide - Reverse of hide
map - to map a secondary harddisk as primary, this is there to overcome the drawback of DOS/Windows bootloader
I will leave it you to explore them. I hope this article would have made Grub easy for you to understand. If you have any queries or feedback you are most welcome.
How to fix a corrupted MBR is another interesting thing, that would require another article. Hope I will write it sometime later.
