LPIC-2 202.3 — Alternate Bootloaders

Exam topic 202.3 — Alternate Bootloaders. Covers the Syslinux family, PXE network boot (BIOS and UEFI), UEFI Secure Boot with shim.efi/grubx64.efi, systemd-boot, and U-Boot for embedded systems.

LILO

LILO (Linux Loader) loads in two stages. During boot it prints the letters “L”, “I”, “L”, “O” one at a time — each letter marks a completed stage. A partial sequence like LIL- or LIL? tells you exactly which stage failed.

In interactive mode (requires prompt in the config) LILO shows a menu of up to 16 entries. Without timeout=nnn (units of 0.1 s) the bootloader waits indefinitely. When the timeout expires, LILO boots the first image in the list unless default=name is set.

Configuration file: /etc/lilo.conf. After any change you must run /sbin/lilo to rewrite the MBR. The installer reads the config and writes the file map to /boot/map. LILO does not support UEFI and is largely obsolete.

# /etc/lilo.conf — example configuration
boot=/dev/hda        # device to write the bootloader to
prompt               # show selection menu
timeout=150          # wait 15 seconds (150 × 0.1 s)
lba32                # use LBA addressing
compact
vga=normal
root=/dev/hda1
read-only
menu-title=" My Computer "

# Linux kernels
image=/boot/zImage-1.5.99
    label=try
image=/boot/zImage-1.0.9
    label=1.0.9
image=/tamu/vmlinuz
    label=tamu
    initrd=initramdisk.img
    root=/dev/hdb2
    vga=ask

# Other OS
other=/dev/hda3
    label=dos
    boot-as=0x80
other=/dev/hdb1
    label=Win98
    boot-as=0x80

Exam trap: Unlike GRUB, LILO does not read lilo.conf at boot time — only the installer /sbin/lilo reads it. If you edit the file without running /sbin/lilo, the changes have no effect.

The Syslinux Family

The Syslinux project (syslinux.org) groups several bootloaders under one name. Each solves a different problem, but all use the same configuration file format.

SYSLINUX

SYSLINUX boots Linux from FAT partitions. Works only on Intel/AMD. The installer comes in three variants: syslinux for Linux, syslinux.exe for Windows, syslinux.com for DOS.

Key installer options:

MS-DOS only options:

-m    MBR: write a bootable MBR sector to the start of the disk
-a    Active: mark the partition as active (bootable)

# Install on a USB drive: bootloader + MBR + active partition
syslinux --install -m -a /dev/sdb1

ISOLINUX

ISOLINUX boots from CD/DVD. Unlike syslinux, the ISOLINUX installer does not write directly to a device — it generates an ISO image from a directory using xorriso. The directory must contain an isolinux/ folder with isolinux.bin.

# Minimum directory structure for building an ISO
my-iso/
├── isolinux/
│   ├── isolinux.bin    # the bootloader itself (required)
│   ├── isolinux.cfg    # configuration
│   └── ldlinux.c32     # module library
└── boot/
    └── vmlinuz

To boot from USB, an additional file isohdpfx.bin is required — a hybrid MBR image generated by xorriso.

EXTLINUX

EXTLINUX installs directly onto a mounted ext2/3/4 or btrfs filesystem.

extlinux --install /boot

Looks for its config at /boot/extlinux/extlinux.conf or /extlinux/extlinux.conf.

PXELINUX

PXELINUX acts as the second stage of PXE boot. The TFTP server provides pxelinux.0 together with the required library ldlinux.c32. Client configs live in /tftpboot/pxelinux.cfg/.

PXELINUX resolves the config filename using three methods (in priority order):

Method 1: DHCP options 209 and 210

Option 209 (pxelinux.config-file) sets the config filename. Option 210 (pxelinux.pathprefix) sets the path prefix on the TFTP server.

Method 2: Hardcoded in the pxelinux.0 image

The pxelinux-options utility embeds options directly into the pxelinux.0 image. Options can be before-options (DHCP takes priority) or after-options (they override DHCP).

Supported hardcoded options:

Method 3: Auto-derived from UUID, MAC, or IP

If no config is specified explicitly, PXELINUX tries filenames on the TFTP server in this order:

1. Client UUID (lowercase)
2. Client MAC address (lowercase, bytes separated by -, e.g. 01-aa-bb-cc-dd-ee-ff)
3. IP address as uppercase hex with shrinking prefix: C0A80101, C0A8010, C0A801, …, C
4. File default

Syslinux Configuration

All family members look for a config file syslinux.cfg in three locations in order: /boot/syslinux/, /syslinux/, /. ISOLINUX first checks /boot/isolinux/ and /isolinux/. EXTLINUX first checks /boot/extlinux/ and /extlinux/.

# syslinux.cfg / isolinux.cfg example
DEFAULT linux
TIMEOUT 50         # 5 seconds (units = 1/10 s)
PROMPT 1

LABEL linux
  KERNEL /boot/vmlinuz
  APPEND root=/dev/sda1 ro quiet
  INITRD /boot/initrd.img

Key config directives:

Note: By default the bootloader looks for the entry LABEL linux in the config. The DEFAULT directive overrides that label. The CONFIG directive with two paths overrides both the config file and the default directory for subsequent paths.

KERNEL file extensions:

The file type can be set explicitly using KERNEL aliases: LINUX, BOOT, BSS, PXE, FDIMAGE, COMBOOT, COM32.

SYSAPPEND takes a numeric bitmask. Each bit adds an auto-generated string to the kernel cmdline:

Tip: SYSAPPEND 3 (bits 1+2) in a PXELINUX config appends both IP parameters and the interface MAC address to the kernel cmdline simultaneously — useful for mass network installations where the kernel needs to know where it was loaded from.

PXE: Network Boot

PXE (Pre-boot Execution Environment) is an Intel specification extending BOOTP/DHCP and TFTP. It lets a machine boot without a local disk by fetching everything it needs from a network server.

PXE and BIOS

A PXE DHCP Discover contains at least five required options, three of which are PXE-specific:

Options 93, 94, and 97 identify the client as PXE-capable. Option 55 must request the range 128–135, even if the server is not required to provide them.

Boot sequence for BIOS:

1. Client sends DHCP Discover with PXE options (53, 55, 93, 94, 97)
2. DHCP server returns an IP address and bootloader filename
3. Client downloads pxelinux.0 and ldlinux.c32 via TFTP
4. pxelinux.0 requests a config file from pxelinux.cfg/
5. Kernel and initrd are downloaded via TFTP and booted

TFTP server layout:

/tftpboot/
├── pxelinux.0                 # main PXELINUX bootloader
├── ldlinux.c32                # required library
└── pxelinux.cfg/
    ├── default                # fallback config
    ├── 01-aa-bb-cc-dd-ee-ff   # config by client MAC address
    └── C0A80001               # config by IP address (hex, shrinking prefix)

Note — Proxy DHCP: If the main DHCP server does not support PXE options, a Proxy DHCP server can be run alongside it. It listens on UDP port 4011 and adds only the PXE parameters on top of the main DHCP reply, without conflicting with it.

PXE and UEFI

With UEFI, PXE boot works differently: instead of pxelinux.0 the client requests an EFI bootloader. The Client System Architecture field (option 93) tells the server the client’s architecture.

# Option 93 (Client System Architecture) values:
0  = x86 BIOS
7  = EFI BC (64-bit x86 UEFI)
9  = x86 UEFI (32-bit)

For UEFI clients the TFTP server serves uefi/shim.efi or uefi/grubx64.efi. Example ISC DHCP config differentiating BIOS and UEFI:

# /etc/dhcp/dhcpd.conf: PXE fragment
if option arch = 00:07 {
    # UEFI 64-bit
    filename "uefi/shim.efi";
} else {
    # Legacy BIOS
    filename "pxelinux.0";
}
next-server 192.168.1.10;  # TFTP server IP

UEFI and Secure Boot

UEFI (Unified Extensible Firmware Interface) replaces BIOS and stores bootloaders on a dedicated ESP (EFI System Partition) formatted as FAT. On Linux the ESP is typically mounted at /boot/efi. Bootloaders use the .efi extension.

Secure Boot requires a digital key: the UEFI firmware verifies the bootloader’s signature before running it. Major distributions — Red Hat, Ubuntu, and SUSE — have purchased such keys and work with Secure Boot out of the box. There are three ways to run Linux with Secure Boot enabled:

1. Disable Secure Boot in UEFI settings — simple, but reduces protection.
2. Purchase your own signing key and sign each image.
3. Use a signed shim from the Linux Foundation or Fedora.

If Secure Boot is preventing boot, first try disabling these firmware features:

- Quickboot / Fastboot
- Intel Smart Response Technology (ISRT)
- FastStartUp (if Windows 8 is installed)

On systems with Windows 8, UEFI settings can be reached via “Advanced startup options” directly from Windows. Some firmware supports both EFI and Legacy BIOS modes — switching to Legacy resolves the issue.

shim and grubx64.efi

Shim is a small signed bootloader shim. UEFI launches shim.efi, which in turn launches grubx64.efi. This is convenient: shim is signed by a third party, while GRUB can be updated without re-signing.

ESP (/boot/efi/)
└── EFI/
    └── uefi/
        ├── shim.efi      # signed intermediary, launched by UEFI
        └── grubx64.efi   # GRUB2 for UEFI, launched by shim

Important for the exam: UEFI launches shim.efi, and shim.efi then finds grubx64.efi in the same directory. The filenames are fixed.

systemd-boot

systemd-boot (formerly gummiboot) is built into systemd and works only with EFI systems. It can launch any EFI executable: a Linux kernel via EFISTUB, a UEFI Shell, GRUB, or the Windows Boot Manager.

Managed via the bootctl command:

# Install systemd-boot to ESP
bootctl install

# Check status
bootctl status

# Update the bootloader
bootctl update

The ESP must be mounted, preferably at /boot. Configuration is stored in /boot/loader/:

/boot/loader/
├── loader.conf           # main bootloader config
└── entries/
    ├── arch.conf         # entry for Arch Linux
    └── windows.conf      # entry for Windows

# /boot/loader/loader.conf
default  arch.conf
timeout  5
editor   no

# /boot/loader/entries/arch.conf
title   Arch Linux
linux   /vmlinuz-linux
initrd  /initramfs-linux.img
options root=/dev/sda2 rw quiet

Warning: systemd-boot cannot read configs from ext4 or other non-FAT partitions. The kernel and initrd must reside directly on the ESP or on a separate /boot partition in FAT.

U-Boot

Das U-Boot stands for Universal Boot Loader. It is an open-source primary bootloader for embedded devices, supporting a wide range of architectures: 68k, ARM, AVR32, Blackfin, MicroBlaze, MIPS, Nios, SuperH, PPC, and x86.

Key features of U-Boot:

• Loads kernels from flash memory, via network, from an SD card, or through a serial port.
• Requires explicit specification of memory addresses for copying the kernel and ramdisk — other bootloaders choose addresses automatically; U-Boot does not.
• Can be split into multiple stages if firmware size is constrained.
• Low-level commands give flexibility, but booting a kernel requires several steps instead of one.

# Load kernel via TFTP and boot
setenv ipaddr 192.168.1.100
setenv serverip 192.168.1.10
tftp 0x80000000 uImage
bootm 0x80000000

# Load from SD card
mmc dev 0
load mmc 0:1 0x80000000 /boot/uImage
bootm 0x80000000

Note for LPIC-2: For the exam it is enough to understand that U-Boot targets embedded devices, is flexible and low-level, and requires explicit memory address management. Deep knowledge of commands is not tested.

Exam Cheat Sheet

Files and Utilities

Syslinux Config File Search Paths

PXE: Key DHCP Options

SYSAPPEND Bits

Common Mistakes

Warning — frequent traps:

• Edited /etc/lilo.conf but forgot to run /sbin/lilo — changes did not apply.
• pxelinux.0 requires ldlinux.c32 next to it on the TFTP server — without it, boot fails.
• systemd-boot requires the ESP mounted at /boot, not at /boot/efi.
• isohdpfx.bin is only needed for booting an ISO from USB — not required for a regular CD.
• With Secure Boot, UEFI launches shim.efi, not grubx64.efi directly.
• Only the last APPEND directive in the config applies — previous ones are ignored.
• INITRD filename is just syntactic sugar for APPEND initrd=filename.

Practice Questions

Q1. You are setting up a PXE server for network boot. Which file does PXELINUX look for on the TFTP server first?

Answer: The file named after the client’s UUID (lowercase). PXELINUX tries names in order: UUID → MAC address → shrinking hex IP prefix → default.

Q2. Which bootloader from the Syslinux family is used to boot from a FAT partition (e.g., a USB drive)?

Answer: SYSLINUX. ISOLINUX handles CD/DVD, EXTLINUX works with ext/btrfs, PXELINUX boots over the network.

Q3. What is the main config file for ISOLINUX?

Answer: isolinux.cfg. (isolinux.bin is the bootloader binary itself; isohdpfx.bin generates the hybrid MBR for USB.)

Q4. What does shim.efi do in the UEFI Secure Boot chain?

Answer: It acts as a signed intermediary between UEFI and grubx64.efi. UEFI launches the signed shim.efi, which then launches grubx64.efi. This allows using Secure Boot without purchasing your own signing key.

Q5. How does systemd-boot differ from GRUB?

Answer: systemd-boot works exclusively with UEFI systems and can only launch EFI executables. Its config lives in /boot/loader/, and it cannot read configs from ext4 or other non-FAT partitions.

Q6. What type of devices is U-Boot designed for?

Answer: Embedded devices with diverse architectures (ARM, MIPS, PPC, x86, etc.). Its distinguishing feature is requiring explicit memory address management — other bootloaders choose addresses automatically.

Q7. You edited /etc/lilo.conf but the changes did not take effect after reboot. Why?

Answer: LILO does not read lilo.conf at boot time — only the installer /sbin/lilo reads the file and writes the result to the MBR. Without running /sbin/lilo, changes to lilo.conf have no effect.

Q8. Which command is used to manage systemd-boot?

Answer: bootctl (bootctl install, bootctl status, bootctl update). efibootmgr manages UEFI Boot Manager entries, not the bootloader itself.

Q9. Which DHCP option in a PXE Discover request tells the server the client’s architecture (BIOS or UEFI)?

Answer: Option (93) Client System Architecture. Value 0 = x86 BIOS, value 7 = EFI BC (64-bit UEFI). The DHCP server uses this field to select the correct bootloader filename.

Q10. An admin wants the kernel to automatically receive network IP parameters and the interface MAC address on the cmdline during PXE boot. Which directive should be added to the PXELINUX config?

Answer: SYSAPPEND 3 — sets bits 1 and 2 simultaneously. Bit 1 appends ip=client:bootserver:gw:netmask; bit 2 appends BOOTIF= with the MAC address of the active interface.