Boot process

How Linux typically starts up on a PC

you switch on the computer

BIOS is shown and the devices are checked.

the master boot record is executed

The BIOS will then load the first sector of the first hard disk and execute it. The first sector is part of the bootloader and loads more sectors, for the grub bootloader this looks like this:

You can look what's in your harddisk's first sector using the command

dd if=/dev/sda count=1 | hexdump -C

You can disassemble the master boot record using the command

dd if=/dev/sda count=1 > mbr.bin; objdump -D -b binary -mi386 -Maddr16,data16 mbr.bin

For me it calls int18h, then int13h, function ah=41h (check extensions).

the boot loader is executed

The boot loader is typically grub, and there is an older and smaller called lilo. The grub bootloader displaying the boot menu can look like this:

the Linux kernel is loaded

The boot loader loads the kernel using BIOS routines. There is not yet a driver loaded for the harddisk to boot from.

the initrd is loaded

The initrd is the initial RAM disk. It will be loaded by the boot loader using only BIOS routines. Those BIOS routines have a special way of addressing devices. This is why the first partition on the first disk will be called hd0,0 while the Linux routines call it /dev/sda1. Also the BIOS routines work in 16 bit mode which is why the operating system will not use them. Now initrd has the drivers the kernel needs to mount the harddisk where the kernel will start the program init on.

the Linux kernel is executed

Now the Linux kernel can start. It will execute the program init on the initial ram disk.

the init program is started

The program init on the initial ram disk will mount the harddisk and run /sbin/init there. If the init process quits, the Linux kernel panics. Init is responsible for all further services and programs that are started.

the init scripts are executed

This can be SysV init scripts or upstart or systemd. These init scripts typically start services. Services are grouped into runlevels. Find out your current runlevel with the command

runlevel

Change your runlevel, in this case to 3, with the command

init 3

E.g. in SUSE the runlevels are defines as

• 0: reboot
• 1: rescue system, single user
• 2: all services that run in (1) plus services needed for multi-user login
• 3: all services that run in (2) plus network services
• 4: undefined
• 5: all services that run in (3) plus graphical display

Some notable services are:

• alsasound

Used for the alsa sound system

• cups

Used for printing, it is the common Unix printing system

• dbus

Used to call public functions in running programs. Should be abstracted to users.

• esound

Used for enlightenment sound system

• ntp

Network Time Protocol to keep your clock in sync with the real time via the network

• autofs

To automount devices as soon as they are plugged in, e.g. USB disks and CD ROMs

• udev

The udev services have a lot of names, e.g. boot.udev under SUSE. They create the device handles in the /dev folder, e.g. when you plug in a USB disk or attach a web cam

• xdm

The x display manager shows a graphical login screen and starts a session when you log in. It keeps running during the session so when you end your session, you will be able to log in again.

• cifs

mounts all cifs network drives

• xfs

manages X fonts

• cron

Cron executes jobs in given time intervals according to /etc/crontab

• ypbind

provides information like login names, home directories and so on over the network

• powerd

Makes sure to throttle down your computer's speed if there is nothing to do, it can save power and it is configured to do so.

• network

The network service makes sure you have an IP address and your network card is active.

• sshd

Service that allows to control a computer via the network

Virtual Terminals are started

Init will also create virtual terminals. You can typically reach them by pressing CTRL_ALT_F1 or CTRL_ALT with another function key. They are text-only consoles that look like this:

Computer waits for user login

Now the boot process has finished and the computer waits for a user to log in. While waiting it will execute the cron jobs as of /etc/crontab.

user starts a shell

The user can start several shells: bash, zsh, csh, ksh, tcsh and a lot more. We will assume the user starts bash. He can either start it as a non-login-shell (by logging in graphically and clicking on the terminal symbol) or he can start it as a login shell (by logging in with a password, authorized key or by starting su - or bash - or bash -login).

For a login bash shell the following will be done:

• /bin/login will be called
• login will output last login based on /var/log/lastlog
• login will output /etc/motd, configurable in /etc/pam.d
• login will find out which shell to run for the user from the file /etc/passwd. We assume here the shell is bash.
• login will start bash and source /etc/profile.d/*.sh and .bash_profile
• bash will source /etc/bash.bashrc and .bashrc. You can use strace to find this out.

See also

• Scheduling Tasks
• http://wiki.linuxquestions.org/wiki/Boot_process
• http://unix.stackexchange.com/questions/106822/documentation-architecture-of-linux-session