Unveiling the Linux Boot Process: From Power‑On to User Login

Linux boot process overview

Linux boot can be divided into three main stages.

Step 1: Power‑on

In x86 systems, the top 64 KB of the 1 MB address space (0xF0000‑0xFFFFF) is mapped to ROM. When the computer is powered on, the CPU resets CS to 0xFFFF and IP to 0x0000, so execution starts at 0xFFFF0, which lies within the ROM. A JMP instruction in the ROM jumps to the BIOS initialization code, beginning the BIOS work.

Step 2: BIOS/UEFI boot

Firmware initialization: after power‑on, the UEFI firmware performs hardware initialization, self‑test, and loads its drivers. Boot device selection: the firmware scans for bootable devices (disk, CD, USB, etc.) and chooses one according to the configured boot order. UEFI driver loading: drivers on the selected device are loaded to enable hardware interaction. UEFI application loading: the firmware loads a UEFI application such as a bootloader (e.g., GRUB, rEFInd) from the EFI system partition. The bootloader then takes control and loads the operating‑system kernel.

Step 3: Linux kernel boot

Linux boot – bootloader (MBR)

The BIOS discovers an operating system on a disk via the Master Boot Record (MBR), which occupies the first 512 bytes of the disk. The MBR consists of a 446‑byte bootloader area and a 64‑byte partition table.

Linux boot – EBR/VBR

After locating the MBR, the bootloader examines the partition table. If the OS resides on a primary partition, the bootloader loads the VBR (Volume Boot Record) of that partition. If the OS is in a logical partition, the bootloader follows the extended partition chain to find the appropriate EBR (Extended Boot Record) and transfers control to its bootloader.

Linux boot – GRUB2 overview

GNU GRUB (GRand Unified Bootloader) is a multi‑OS boot manager that lets users choose among several operating systems or kernel options at startup. Configuration file generation: grub2-mkconfig -o /boot/grub2/grub.cfg Installation command: grub2-install /dev/sda

Linux boot – GRUB2 loading

GRUB2 first loads boot.img from the disk into memory at 0x7c00. boot.img loads core.img , which in turn loads lzma_decompress.img , kernel.img , and module images. Note that this kernel is GRUB’s own kernel, not the Linux kernel. Because real mode’s 1 MB address space is insufficient, lzma_decompress.img switches the CPU to protected mode (via real_to_prot ) to allow loading larger components.

Linux boot – Process 0 and 1

Process 0 (the idle task) is created directly by the kernel using struct task_struct init_task = INIT_TASK(init_task) . It is the first entry in the process list and is not created via fork or kernel_thread . During early initialization the kernel calls trap_init() , mm_init() , sched_init() , vfs_caches_init() , and finally start_kernel() → rest_init() . rest_init() creates Process 1 by invoking kernel_thread(kernel_init, NULL, CLONE_FS) . Process 1 (the init task) is crucial for the rest of the system.

Linux boot – ramdisk

The init program resides on a filesystem, which must be on a storage device. To avoid loading many filesystem drivers into the kernel, Linux first uses a memory‑based filesystem called a ramdisk as the temporary root filesystem. The ramdisk runs /init , which loads the appropriate driver for the real storage device, mounts the real root filesystem, and then starts the real init process.

Linux boot – init introduction

Both Process 0 and Process 1 are kernel threads; the user‑visible init process has PID 1. if (ramdisk_execute_command) { ret = run_init_process(ramdisk_execute_command); /* ... */ } if (!try_to_run_init_process("/sbin/init") || !try_to_run_init_process("/etc/init") || !try_to_run_init_process("/bin/init") || !try_to_run_init_process("/bin/sh")) return 0; Different Linux distributions use different init systems: SysV (CentOS 5 and earlier, /etc/inittab), Upstart (CentOS 6, /etc/init/*.conf), and systemd (CentOS 7+, /usr/lib/systemd/system, /etc/systemd/system).

Linux boot – runlevels

Linux boot – fstab

After hardware devices are detected, Linux must mount them. The /etc/fstab file records devices and mount points for automatic mounting at boot. Fields: 1) device file/UUID/label, 2) mount point, 3) filesystem type (or auto ), 4) mount options, 5) dump flag, 6) fsck order.

Linux boot – user login

Linux supports three login methods: console (text) login, SSH login, and graphical login. The console device is /dev/console ; virtual terminals are /dev/ttyN (switch with Ctrl+Alt+F1‑F6); serial terminals are /dev/ttySN ; pseudo‑terminals are /dev/pts/N (used by SSH and graphical terminals).

Linux boot – user switching

Linux provides six virtual terminals (tty1‑tty6). The first terminal (tty1) is the default login console; the others can be accessed with Ctrl+Alt+F2‑F6. In a VirtualBox VM, Ctrl+Alt+F1 switches to the graphical console, while Ctrl+Alt+F2‑F6 switch to text consoles.

Linux boot process mind map