Linux boot is a multi-stage process, it initiates from the the moment you press the start button to the moment login screen appears.
Understanding how Linux boots up is very important in terms of effectively troubleshooting in case of system failure.Below is high level stages of a typical Linux boot process that happen behind the scenes
BIOS (Basic Input Output System)
BIOS is a software program comes pre-built in a motherboard chipset.
Performs some system integrity checks and scans for devices such as Hard Disk, CD-ROM, RAM, etc.
Searches, loads, and executes the boot loader program.
It looks for MBR (Master Boot Record) in 1st sector of the primary hard drive loader in floppy, cd-rom, or hard drive.
Once the boot loader program is detected and loaded into the memory, BIOS gives the control to it.
So, in simple terms BIOS loads and executes the MBR boot loader.
In brief this phase includes loading of the boot loader (MBR and GRUB/LILO) into memory to bring up the kernel.
MBR (Master Boot Record)
MBR is less than 512 bytes in size. This has three components:
1) primary boot loader info in 1st 446 bytes
2) partition table info in next 64 bytes
3) MBR validation check in last 2 bytes.
It is present in the first sector on the primary drive, the prime sector of the first cylinder of track is 0 and head is 0 (this whole path is generally booked for boot programs).
It contains information about GRUB (or LILO in old systems).
In simple terms, MBR loads and executes the GRUB boot loader.
GRUB (Grand Unified Bootloader)
Once GRUB is loaded into RAM, then it search for the location of Kernel.
Unlike older Linux bootloader, GRUB has the knowledge of the filesystem.It reads /boot/grub/grub.conf (/etc/grub.conf is a link to this).
GRUB displays a splash screen, incase you have multiple kernel images installed on your system. You can choose which one need to be executed,if you don’t enter anything it will load the default kernel image as specified in the grub configuration file.
Interesting thing with GRUB is that it itself have three stages. Relax I’m going to explain them too.
GRUB Stage 1
GRUB Stage 1.5
GRUB Stage 2
GRUB stage 1:
GRUB stage 1 resides in the MBR of the hard disk.
Due to extremely small size of the MBR(512 bytes), the grub stage-1(too small space to contain the instructions necessary to load a complex operating system. ) does the small job of loading grub stage-1.5.
So grub stage 1 will load grub stage 1.5 to the RAM, and pass the control to it.
GRUB Stage 1.5:
grub stage-1.5 resides in the blocks immediately after the MBR and before the first partition.
Actually the hard disk sectors are counted form 0 to the last sector, sector 0 contains the GRUB stage 1. Normally partititons do not start before sector 63 which means any partition will start after sector number 63. Hence we have sectors form 1-63 free. This space is used for storing GRUB stage 1.5. This free space between MBR and the beginning of the partitions is called as MBR GAP.It is roughly around 30kb.
Now Grub stage 1.5 is important as it contains file system driver’s to open the file system. This enables stage 1.5 to load stage 2 to load from any known location on the file system i.e. /boot/grub
GRUB Stage 2:
This is responsible for loading kernel from /boot/grub/grub.conf and any other modules needed
By reading the grub.conf file the grub stage 2 display a GUI interface i.e. splash image located at /grub/splash.xpm.gz with list of available kernels where you can manually select the kernel or else after the default timeout value the selected kernel will boot.
Below is the sample grub.conf of CentOS.
“default=0” : Tell’s the default operating system to boot, if nothing is selected within a specified timeout during boot, from the grub menu. 0 means the first entry(which in the above case is centos.) default=1 will boot the second title entry as the default operating system if nothing selected within the specified timeout during the boot.
“timeout=5” : Specifies the time in seconds to wait before the default option is selected to boot automatically by the grub.
“splashimage” : specifies the location of the grub background image to show, behind the menu list(you can put pic of your choice).
“hiddenmenu” : Will keep the menu hidden if no key is pressed during the grub boot screen(and will by default boot the default operating system without showing the menu)
“root (hd0,0)” : Specifies the boot directory is in first hard disk (hd0), first Partition(0).
“kernel” : /vmlinuz-2.6.32-431.el6.i686 ro root=/dev/mappervg_centos-lv_root rhgb quiet – Specifies the kernel location which is inside the /boot folder. This location is related to the root(hd0,0) statement. The “ro” option specifies the kernel should be opened as read only to protect it from any accidental writes from the initial RAM disk and “rhgb” enables the RedHat Graphical boot option.
“initrd” : /initrd-2.6.32-431.el6.i686.img – Initial RAM disk.
So, in simple terms GRUB just loads and executes Kernel and initrd images.
At this stage you are presented a TUI (Terminal user interface), here you can select your operating system kernal and press enter to boot it.Just like GRUB , kernel is also loaded in stages.
Kernel mounts the root file system specified in grub.conf. Kernel also load /sbin/init program and gives it the process ID 1 since this is first program executed by kernel.
initrd is used by kernel as temporary root file system until kernel is booted and the real root file system is mounted. It also contains necessary drivers compiled inside, which helps it to access the hard drive partitions, and other hardware.
Now the init start reading /etc/inittab file and set the run level.There are 7 run levels in which the linux OS runs and different run levels serves for different purpose.
You should have observed, the deualt run lvel of my system is 5.
It also runs all the boot scripts(/etc/rc.d/*,/etc/rc.boot/*)
Depending on your default init level setting, the system will execute the programs from one of the following directories.
Run level 0 – /etc/rc.d/rc0.d/
Run level 1 – /etc/rc.d/rc1.d/
Run level 2 – /etc/rc.d/rc2.d/
Run level 3 – /etc/rc.d/rc3.d/
Run level 4 – /etc/rc.d/rc4.d/
Run level 5 – /etc/rc.d/rc5.d/
Run level 6 – /etc/rc.d/rc6.d/
Please note that there are also symbolic links available for these directory under /etc directly. So, /etc/rc0.d is linked to /etc/rc.d/rc0.d.
Under the /etc/rc.d/rc*.d/ directories, you would see programs that start with S and K.
Programs starts with S are used during startup. S for startup. Programs starting with K are used during shutdown. K for kill.
There are numbers right next to S and K in the program names. Those are the sequence number in which the programs should be started or killed.
For example, S12syslog is to start the syslog deamon, which has the sequence number of 12. S80sendmail is to start the sendmail daemon, which has the sequence number of 80. So, syslog program will be started before sendmail.