web analytics

Linux Booting Process

You turn on a linux machine, a splash screen appears for a few seconds and then in a small delay you are greeted with a login page. You login and then starts working. Ever wondered what happens behind the scenes, when you turn on the machine? How does the machine boots? Continue reading.

The linux booting process happens in 6 stages.


When you power on the machine, CPU asks ROM what to do. ROM has a JUMP instruction which commands CPU to check the BIOS. BIOS stands for Basic Input/Output system. BIOS is the first thing that is loaded, and its main role is to check the hardware and performs integrity checks. Its main role is to identify the boot device as defined in the CMOS. The first device listed in the boot order will be checked and it is found to be bootable then it is selected. Once the boot device is detected, we move to next phase which is Bootloader.bios-boot-order-5137405


2) MBR

BIOS needs to identify the bootloader to boot the device. It is done with the help of MBR. MBR or Master Boot Record resides in the first 512 bytes of the bootable device or hard disk. The first 446 bytes contains information of the primary bootloader, the next 64 bytes is the partition table and the last 2 bytes is called the magic number.

Primary boot Loader – MBR is small in size and hence cannot load the kernel all by itself. It is also unaware of the file system concepts as well. It contains information regarding the primary boot loader. The job of primary boot loader is to find and load the secondary boot loader.

Partition Table – It is 64 bytes in size, with each partition taking up 16 bytes. The primary boot loader identifies the secondary boot loader by going through the partition table for an active partition. Once it is found, it is loaded to RAM and executed.

Magic Number – The last two bytes of MBR is called the magic number, and it is something like a hexadecimal 0xAA55. Once the active boot partition is found, the boot sector will start with code 55AA and thus the magic number serves as a validation check for MBR.



GRUB stands for Grand Unified Boot Loader . The job of GRUB is to load the actual kernel and initrd images.

Grub holds information on the kernels installed in your machine. While booting up, the kernels listed in the grub configuration file /boot/grub/grub.conf is displayed in the splash screen. The grub conf will have a default kernel specified, and when the splash screen is displayed, if there are no manual interventions to choose another kernel, then it will automatically load the default kernel.

There are actually three stages of GRUB.

Stage 1 – MBR loads the primary boot loader, which identifies the secondary boot loader and passes control to Stage 1.5 or Stage 2.

Stage 1.5 – This is an intermediate stage between Stage 1 and Stage 2. This is not a mandatory stage always, and it depends on the type of file systems present.

Stage 2 – This stage loads the the actual kernel as specified in grub conf. Grub resides in an active /boot partition in the hard disk.

A sample grub.conf will look as follows.

# grub.conf generated by anaconda
# Note that you do not have to rerun grub after making changes to this file
# NOTICE: You do not have a /boot partition. This means that
# all kernel and initrd paths are relative to /, eg.
# root (hd0,8)
# kernel /boot/vmlinuz-version ro root=/dev/hda9
# initrd /boot/initrd-version.img
# By default boot the second entry
# Fallback to the first entry.
fallback 0
# Boot automatically after 2 minutes
title Red Hat Linux (2.4.18-
root (hd0,8)
kernel /boot/bzImage.2.4.18- ro root=LABEL=/ hdd=ide-scsi
initrd /boot/initrd-2.4.18-19.8.0custom.img.19mar03
title Red Hat Linux (2.4.18-19.8.0custom)
root (hd0,8)
kernel /boot/vmlinuz-2.4.18-19.8.0custom ro root=LABEL=/ hdd=ide-scsi
initrd /boot/initrd-2.4.18-19.8.0custom.img

In the above conf, there are two kernels listed, starting with ‘title’. The kernels present are numbered from 0.

The default=1 in the above conf means the default kernel that should be booted is 1, which means the second kernel.
timeout=120 means the splash screen will wait 120 seconds for any human intervention to choose an alternate kernel. If nothing is done, then it will load the default kernel after 120 seconds.
splashimage specifies the location of the splash screen image to be used while booting.
root (hd0,8) configures the root partition and mounts that partition


4) Kernel

The actual kernel is loaded at this stage. The root file system as mentioned in the grub conf gets mounted at this stage. While booting up, all required drivers and executables needed to boot the kernel will be present in the initrd image. Initrd serves as a temporary root file system, till the real root file system is mounted. Once the kernel is full loaded, the initrd is unmounted and memory freed. Kernel then loads init. Init is the first program loaded by kernel and hence it has a PID 1.


5) Init

Init is the first program to be loaded by the kernel. It looks through the file /etc/inittab to find the default runlevel to choose. You would see a line as follows, which means runlevel 3 is used as the default here (in the machine I checked). In your desktop, it would mostly be runlevel 5.



6) RunLevel

There are 7 run levels, which define how the system runs, which programs are to be started etc. Following are the run levels.

0 – shut down
1 – single user mode
2 – multi user mode without networking
3 – multi user mode with networking
4 – unused
5 – graphical
6 – reboot

The programs for each run level reside at /etc/rc.d/rc*.d where * represent the run level number. Inside this folder you would see your services listed with some starting with K and some starting with S. The programs with S means that they would be automatically started when the system boots up. Programs with K will be shut down while the machine is shut down or rebooted. The numbers that you see along with these is the sequence in which the programs are started or shut down. Given below is a snippet from my VPS.

[/etc/rc.d/rc3.d]# ls -al /etc/rc.d/rc3.d/
total 8
drwxr-xr-x 2 root root 4096 Nov 30 23:15 ./
drwxr-xr-x 10 root root 4096 Nov 28 23:34 ../
lrwxrwxrwx 1 root root 16 Nov 28 03:33 K01smartd -> ../init.d/smartd*
lrwxrwxrwx 1 root root 22 Nov 28 03:33 K15htcacheclean -> ../init.d/htcacheclean*
lrwxrwxrwx 1 root root 13 Nov 28 03:33 K35nmb -> ../init.d/nmb*
lrwxrwxrwx 1 root root 13 Nov 28 03:33 K35smb -> ../init.d/smb*
lrwxrwxrwx 1 root root 20 Nov 28 03:33 K50netconsole -> ../init.d/netconsole*
lrwxrwxrwx 1 root root 15 Nov 28 03:33 K50snmpd -> ../init.d/snmpd*
lrwxrwxrwx 1 root root 13 Nov 28 03:33 S15csf -> ../init.d/csf*
lrwxrwxrwx 1 root root 13 Nov 29 11:42 S20lfd -> ../init.d/lfd*
lrwxrwxrwx 1 root root 14 Nov 29 11:43 S55sshd -> ../init.d/sshd*
lrwxrwxrwx 1 root root 16 Nov 28 03:33 S56xinetd -> ../init.d/xinetd*
lrwxrwxrwx 1 root root 15 Nov 29 11:42 S64mysql -> ../init.d/mysql*
lrwxrwxrwx 1 root root 17 Nov 29 11:43 S65dovecot -> ../init.d/dovecot*

Based on the above sequence, while your linux machine boots, you will notice the services starting as shown in the image below.


Leave a reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>