Unraveling the Linux Boot Process: From Power‑On to User Login

Overall Boot Stages

Linux boot can be divided into three major stages: power‑on, BIOS/UEFI initialization, and the Linux kernel startup.

Stage 1 – Power‑On

On x86 systems the top 64 KB of the first megabyte (0xF0000‑0xFFFFF) is mapped to ROM. When the machine powers up the CPU resets CS to 0xFFFF and IP to 0x0000, so execution begins at 0xFFFF0 inside the ROM, where a JMP instruction transfers control to the BIOS initialization code.

Stage 2 – BIOS/UEFI Boot

UEFI firmware performs hardware initialization, self‑test, and loads its own drivers. It then scans for bootable devices (disk, CD, USB, etc.) according to the configured boot order, loads the appropriate UEFI driver, and finally loads a UEFI application such as a bootloader (e.g., GRUB, rEFInd) from the EFI system partition.

Stage 3 – Linux Kernel Startup

The BIOS/UEFI loads a bootloader (e.g., GRUB) which in turn loads the Linux kernel image and an initial ramdisk (initramfs). The kernel then performs low‑level initialization, creates the first process (PID 0), and starts the second process (PID 1) which runs the user‑space init system.

Master Boot Record (MBR) and Partition Tables

The BIOS discovers an operating system by reading the MBR located in the first 512 bytes of the disk. The MBR consists of a 446‑byte boot code area (the primary boot record) and a 64‑byte partition table that describes the disk’s partitions.

Extended Boot Record (EBR) and Volume Boot Record (VBR)

If the OS resides on a primary partition, the MBR’s boot code loads the VBR of that partition. If the OS is on a logical partition, the boot process follows the chain of extended partition tables until it reaches the appropriate EBR, whose VBR then loads the OS loader.

GRUB2 Overview

GRUB (GRand Unified Bootloader) is a GNU project bootloader that supports multiple operating systems and kernel parameters. Configuration is generated with grub2-mkconfig -o /boot/grub2/grub.cfg and installed via grub2-install /dev/sda .

GRUB2 Loading Sequence

BIOS loads boot.img to address 0x7c00, which then loads core.img . If booting from disk, diskboot.img loads core.img , which decompresses lzma_decompress.img , then loads kernel.img and additional modules. This is GRUB’s own kernel, not the Linux kernel. Because the 1 MiB real‑mode address space is insufficient, lzma_decompress.img switches the CPU to protected mode (real_to_prot) before loading larger components.

PID 0 and PID 1 Processes

The kernel creates the first task struct task_struct init_task = INIT_TASK(init_task) , which becomes PID 0 (the idle task). It then runs a series of initialization functions: trap_init() (interrupts), mm_init() (memory), sched_init() (scheduler), vfs_caches_init() (rootfs), and finally start_kernel() → rest_init() . rest_init() spawns PID 1 via kernel_thread(kernel_init, NULL, CLONE_FS) , a process that later starts the user‑space init system.

Ramdisk (initramfs)

Because the kernel cannot rely on drivers for every possible filesystem, it first mounts a temporary in‑memory filesystem (ramdisk) as the root. The ramdisk runs /init , which loads the appropriate storage drivers, mounts the real root filesystem, and then executes the real /sbin/init (or alternatives).

Init Systems

Different Linux distributions use different init systems: SysV (pre‑CentOS 5, /etc/inittab), Upstart (CentOS 6, /etc/init/*.conf), and systemd (CentOS 7+, unit files in /usr/lib/systemd/system and /etc/systemd/system). The init process tries to execute /sbin/init , /etc/init , /bin/init , or /bin/sh in that order.

Runlevels

/etc/fstab

During boot the system reads /etc/fstab to automatically mount listed devices. The file defines six fields: device (or UUID/label), mount point, filesystem type (or auto ), mount options, dump flag, and fsck order.

User Login

Linux supports three login methods: console (text), SSH, and graphical login. The console device is /dev/console ; virtual terminals are /dev/ttyN (switchable with Ctrl+Alt+F1‑F6); serial terminals are /dev/ttySN ; pseudo‑terminals used by SSH and graphical sessions are /dev/pts/N .

User Switching

By default the first virtual terminal (tty1) is used for login. Users can switch between the six available terminals with Ctrl+Alt+F1‑F6; on VirtualBox, Ctrl+Alt+F1 provides a graphical terminal while F2‑F6 give text consoles.