Linux is the most used open source operating system used today in personal desktops as well as in servers. In fact, most people do not know this, but Linux is a actually a kernel and the name full name of the operating system is ‘GNU/Linux’. It is open source and free, thus it gives an efficient manner for everyone to use it and modify it in any way.
You may think why you would need to understand its boot process, but if you know how Linux boots then you can really do a lot of modifications onto your system and can even troubleshoot the problems easily if you get while starting or shutting down the system. It seems to be very long, but as you will read you will think it a very small topic!
- MBR or Master Boot Record (sometimes referred as Master Boot Block) is the first sector of the HDD that tells the computer how the hard disk is partitoned and how to load the operating system in memory. The system BIOS (Basic Input/Output System – acts as a data flow between the OS and the devices like HDD/SSD, printer and so on..) checks the system and initializes the first stage bootloader on the MBR of the primary HDD or SSD.
- When the first stage boot loader gets loaded into memory, it initializes or calls the second stage bootloader that is available in the /boot partition.
- The work of the second stage bootloader is to load the kernel into memory, load the available kernel modules and mount the rootfs (root file system) as read-only file system.
- As the kernel gets loaded into the memory, it transfers all the control to a program called init (located as /sbin/init) which loads the ‘services’ in Linux (services are meant to the userspace tools or user defined applications that are set to auto start on every boot) and mounts all the partitions listed in fstab (located as /etc/fstab).
After this, the user is presented with a login screen where the user has to login with desired username and password.
When a x86 arhitecture of computer is booted, its processor checks the system memory for BIOS or Basic Input/Output System. Once the BIOS has been loaded, it checks the devices by which the system is to be booted (for instance, a bootable disk, USB flash drive, CD-ROM etc.).
After that, BIOS loads into memory the program that is in the first sector of HDD (Hard disk drive) or SSD (Solid State Drive), is called MBR or Master Boot Record or Master Boot Block. You may get amazed by listening that an MBR is only 512 bytes (not even kilobytes or megabytes), the reason is that it does only contain the machine code instructions for booting the system called a bootloader (with the partition table). Once the BIOS finds the bootloader, it passes the control of boot process to it. The default bootloader for the x86 computers’ platform is called GRUB or GRand Unified Bootloader. The GRUB is divided into two stages:
- First Stage: A 512 bytes binary machine code on the MBR.
- Second Stage: Loads the kernel and kernel modules into the memory and mounts the rootfs.
As soon as the second stage bootloader gets loaded into the memory, it presents the user with a screen to choose the operating system or kernel to be loaded furthur. If the user doesn’t select any operating system or kernel from the list, it automatically loads the default operating system after the time of period is passed (default is 30 seconds, which can be configured in file /boot/grub/grub.conf).
Once the second stage bootloader has resolved which operating system to load (boot), it tries to find out the appropiate kernel binary file in the /boot directory (for instance, /boot/vmlinuz-3.11.2).
After that, the bootloader (GRUB in our case) loads the corresponding initramfs images (inital ram file system).
initramfs: To be able to understand initramfs, you should first know about initrd (initial ramdisk) – it is a scheme for loading a temporary root file system into memory in the boot process of the Linux kernel. initrd and initramfs refer to two different methods of achieving this. Both are commonly used to make preparations before the real rootfs can be mounted. initramfs is a cpio archive (a type of archive just as tar, zip or gz) of the initial file system that gets loaded into memory during the Linux startup process. The Linux kernel mounts it as rootfs and starts the init process from it (init processes as explained in latter part). This will complete certain task before the real root file system is loaded. initramfs needs to contain all of the device drivers and tools needed to mount the real root filesystem or rootfs. (Source: Wikipedia)
Then, the kernel decompresses the cpio archive of that initramfs image from memory to /sysroot (a virtual file system based on RAM). Once the kernel and initramfs is loaded into the memory, the bootloader yeilds the control of furthur boot processes to the kernel.
When the control is passed to the kernel, it initializes and configure the devices, peripherals and hardwares on the system including the chipset, processor etc. It then search for the compressed initramfs images and decompresses it into /sysroot (RAM based virtual and temporary file system) and loads all the device drivers. After that, it initializes the virtual devices like ‘virtual machines’ or software RAID etc. if applicable, before completing the initramfs processes and freeing up all the memory the disk image occupied.
Finally, it creates a root file system, mounts it as r/o (read only – read only file system) and frees the unused memory. At this point, the kernel executes the init program (located as /sbin/init). init, as its name suggest (initialize or, initialization), configures the rest of the process for booting and to setup the environment for the user.
When the init command executes, in its very first time, it executes a script called rc.sysinit (located as /etc/rc.d/rc.sysinit). This script sets the user environment path, starts swap and does all the functions needed to initialize the system. After sysinit, it (the init script) runs the inittab script (located as /etc/inittab) to determine the runlevel to boot the computer to, and executes all the processes for that runlevel (or SysV init runlevel). The processes to execute for a particular runlevel are specified as special program scripts in the directory /etc/rc.d/rcx.d where x is the run level to boot in to. The runlevels have been explained in the latter part of this article.
The init script then sets the source function library (located as /etc/rc.d/init.d/functions) which configures the starting and/or killing or various programs and is resposible to resolve the PID (program ID) of the programs.
It then looks for the appropriate rc directory for the runlevel and stars all the background processes that are to be. The rc directories are numbered to correspond to the runlevel they represent (for instance, the directory for runlevel 5 should be /etc/rc.d/rc5.d). If we will want to boot to runlevel 5, then the init will check the /etc/rc.d/rc5.d directory for the processes that have to be started to stopped in runlevel 5. The file names im the /etc/rc.d/rc5.d directory will either start from letter K or letter S, K means the process(es) to be killed and S means the process(es) to be started. The init program always kills the process(es) first starting from the letter K and then starts starting from the letter S.
At last, the init script executes the /etc/rc.d/rc.local file for other system customization. It is mainly executed at boot time when the runlevel is changed.
In runlevel 5, the inittab runs a script called prefdm (located as /etc/X11/prefdm) The prefdm script executes the preferred X-display manager — gdm, kdm, or xdm, depending on the contents of the /etc/sysconfig/desktop file.
As soon as all of this has been finished, the user is presented with a login screen where he has to define his username and password to login to the system.
That is all! If you still have any questions or problem related to this, just drop a comment!