Tuesday, August 12, 2014

Step By Step Linux Boot Process

- Power On 

             - The system/server hardware firmware, either UEFI (Unified Extensible Firmware Interface) 
                Or BIOS (Basic Input Output System) runs Power On Self Test (POST).  

- BIOS/UEFI gets executed.

- BIOS/UEFI get executed and checks for proper connectivity of devices and then it would check for memory availability, and finally locates the boot device.

- BIOS/UEFI locates a bootable device & loads MBR/GPT (GUID Partition Table) from an active partition.

- MBR/GPT loads into memory.

 - MBR (Master Boot Record) would be 512 bytes in size and it would be located on the first sector of the Primary/Active boot device. MBR loads into the memory at this stage. Partition table is stored within MBR. This loads the boot loader.

- If boot device is larger than 2TB then GPT partitioning scheme would be used instead of MBR. At this stage, GPT details would be read into memory. For more details on GPT, visit this link http://simplylinuxfaq.blogspot.com/2017/10/main-differences-between-mbr-gpt.html

- GRUB (Grand Unified Boot loader). This loads in 4 stages (GRUB2 in case of RHEL7.x).

- First Stage Boot loader loads.

- The First Stage Boot loader is read into memory by which is the first 446 bytes of MBR. This is also called “Primary Boot Loader” OR “Stage 1 Loader”. This is a small binary code within 512 bytes of MBR capable of loading Stage 2/1.5 loader.

*In case of RHEL7, boot.img file gets loaded. This file is of size 446 bytes.

- Stage 1.5 boot loader loads into memory. 

- On some hardware platforms this intermediate loader is required. This is sometimes true when the /boot/ partition is above the 1024 cylinder head of the hard drive or when using LBA (Logical Block Addressing) mode. The Stage 1.5 boot loader is found either on the /boot/ partition or on a small part of the MBR and the /boot/ partition.

*In case of RHEL7, core.img file gets loaded. 

- Stage 2 boot loader loads into memory. 

- This is also called “Secondary Bootloader” or Stage 2 Bootloader. The secondary boot loader displays the GRUB menu and command environment. At this stage, user can interrupt the loading process and select specific kernel to boot into and pass additional parameters to the kernel. Files belongs to stage2 are stored in /boot/grub or /boot/grub2 (in case of RHEL7.x).

- The “initramfs” (Initial RAMDISK) gets loaded into memory.

- Stage 2 boot loader transfers the control to the kernel.

- The secondary boot loader reads the operating system or kernel as well as the contents of /boot/sysroot/ into memory. Once GRUB/GRUB2 determines which operating system or kernel to start, it loads it into memory and transfers control of the machine to that operating system.

- Kernel loads into memory.

When the kernel is loaded, it immediately initializes and configures the computer's memory and configures the various hardware attached to the system, including all processors, I/O subsystems, and storage devices. It then looks for the compressed initrd image in a predetermined location in memory, decompresses it, mounts it, and loads all necessary drivers. Next, it initializes virtual devices related to the file system, such as LVM (Logical Volume Manager) or software RAID (Redundant Array of Independent/Inexpensive Drives) before un-mounting the initrd disk image and freeing up all the memory the disk image once occupied.

- Root partition gets mounted read-only.

kernel then creates a root device, mounts the root partition read-only, and frees used memory.

- Kernel calls init or systemd program.

- init gets loaded into memory Or systemd (in case of RHEL7.x).

The /sbin/init program (also called init) coordinates the rest of the boot process and configures the environment for user. The same file /sbin/init is a symbolic link to /usr/lib/systemd/systemd in case of RHEL7.x. The 'init' or 'systemd' is the first process which starts in.

In RHEL6 & earlier versions...

- Init calls /etc/rc.d/rc.sysinit script.

- Sets the environment path, starts swap, checks the file systems, and executes all other steps required for system initialization.

- Init checks the default runlevel in /etc/inittab file.

- /etc/rc.d/init.d/functions gets executed.

- This defines how to start, kill, and determine the PID (Process ID) of a program.

- Init program processes all Start (s) and Kill (k) scripts depending on the run level determined.

The init program starts all of the background processes by looking in the appropriate rc directory for the runlevel specified as default in /etc/inittab. The rc directories are numbered to corresponds to the runlevel they represent.
When booting to runlevel 5, the init program looks in the /etc/rc.d/rc5.d/ directory to determine which processes to start and stop.

All of the files in /etc/rc.d/rc5.d/ are symbolic links pointing to scripts located in the /etc/rc.d/init.d/ director. Symbolic links are used in each of the rc directories so that the runlevels can be reconfigured by creating, modifying, and deleting the symbolic links without affecting the actual scripts they reference. First all “k” scripts gets executed and then all “s” scripts

- /etc/inittab script forks an /sbin/mingetty process (Upstart would be used in RHEL 6 for forking mingetty)

- Virtual Consoles gets initiated at this stage depending on run level defined. The /sbin/mingetty process opens communication pathways to tty devices, sets their modes, prints the login prompt, accepts the user's username and password, and initiates the login process. 

In run level 5 “/etc/X11/prefdm” script gets executed. Preferred display manager would gets loaded at this stage.  

- Finally init calls /etc/rc.d/rc.local script.

           In RHEL7 .....
- The systemd process checks and starts the 'default.target' which would be either 'graphical.target' or 'multi-user.target'.

- So, basically the 'default.target' is a symbolic link to either 'graphical.target' or 'multi-user target'. 

- Depending on default target set which is either /lib/systemd/system/graphical.target or /lib/systemd/system/multi-user.target those respective 'Wants' & 'Requires' directives would be started. So, the target defined in 'Requires' would be stared first. Take a look at the 'graphical.target' file:

Description=Graphical Interface
Conflicts=rescue.service rescue.target
After=multi-user.target rescue.service rescue.target display-manager.service

- So, looking at the above snap of 'graphical.target' file, the 'multi-user.target' should be started first and start graphical service, there is 'Wants' directive which says that 'display-manager.service' should be started along. Like-wise, the 'multi-user.target' file also holds 'Requires' & 'Wants' directive which are dependencies to be started first and later. 

- The 'multi-user.target' requires 'basic.target' other target as shown below:

systemd ---->   default.target ----> graphical.target ----> multi-user.target -------> sysinit.target .

- The 'sysinit.target' doesn't contain 'Requires' directive, however, got 'Wants' directive:

Wants=local-fs.target swap.target

This 'sysinit.target' starts system initialization services, such as mounting file system, enabling swaps, enable logging, start udevd to detect hardware etc. Like-wise there is 'After' directive defined as well in each targets, so as in 'sysinit.target' which is 'local-fs-pre.target' which runs and is responsible for importing network configuration from initramfs and runs file system check on root when required, remounts root file system. 

- So, this process as started, starts from end and at final end it would run either 'graphical.target' or 'multi-user.target' which would present the final login prompt to user.

- User Login Screen.

Skeleton View of Boot Process on x86 BIOS Based System

BIOS -> MBR -> GRUB (Stage 1 Boot Loader -> Stage 2 Boot Loader) -> Kernel -> Init -> Login

BIOS -> MBR -> GRUB2 (Stage 1 Boot Loader -> Stage 2 Boot Loader) -> Kernel -> Systemd -> Login (in case of RHEL7.x)

BIOS (Boot Strap)
 |____ POST (Power On Self Test) Hardware initial testing/scanning.
 |____ Stored on CMOS chip.
 |____ Locates and loads MBR (Master Boot Record)from Boot Device.

MBR -> 512 Bytes
 |____ Stored at Sector 1, Cylinder 0 and Head 0 on First Storage Device.
 |____ Contains MBR Code, Partition Table & Magic Code
 |____ First 446 Bytes contain MBR Code, next 64 bytes holds Partition Table & last 2 bytes would hold Magic Code.
 |____ Main function of MBR is locate Stage 1 Boot Loader and load it.
 |____ MBR Code would scan Partition Table and loads "Stage 1 Boot Loader" into memory from an active partition.
 |____ MBR Code = 446 Bytes
 | |
 | |____ Stage 1 Boot Loader Or Primary Boot Loader
 | |
 | |____ Loads Second Stage Boot Loader
 |____ Partition Table = 16 X 4 Partitions = 64 Bytes
  |____ Each Partition Table = Size | Start CHS | End CHS | LBA | Total Available Space 

GRUB (Grand Unified Bootloader)
Stage 1 Boot Loader
|____ Stored within 446 bytes of MBR.
|____ Scans through partition table and loads Stage 1.5 loader from an active partition.
Stage 1.5 Boot Loader
|____ Loads Stage 2 Boot Loader from /boot directory. 
|____ Contains small binary which would facilitate in loading stage 2 from boot partition. 
|____ Understands ext file systems and would be required when boot partition is above 1024 cylinders or when LBA mode is used.
Stage 2 Boot Loader Or Kernel Loader
|____ Users can pass arguments to kernel to load at this stage.
|____ Main function of Stage 2 loader is to load kernel and initrd (initramfs).
|____ Default kernel image and initrd images gets loaded.

 |____ It is a compressed image which would get uncompressed and starts loading.
 |____ Initrd (Initial RamDisk) would gets loaded.
 | |
 | |____ Temporary root file system which would load necessary storage drivers to facilitate mounting of real root file system.
 | |
 | |____ Once real root file system gets mounted, this image would gets removed from memory.
 |____ Performs various hardware initialization (CPU, memory, I/O etc.,) and mounts root file system.
 |____ Loads first user space program "init" into memory.

 |____ Init process ID is 1 and normally resists signal 9, and parent process for all other processes.
 |____ /etc/rc.d/rc.sysinit script gets executed (sets environment, starts swap, checks file system etc, required for system initialization).
 |____ /etc/rc.d/init.d/functions would run (defines how to start/stop/kill and find PID of a program).
 |____ /etc/inittab file would be consulted to find out default run level.
 |____ All "K" scripts would be killed and scripts with "S" would be started from the file /etc/rc.d/rc<Runlevel>.d/ folder.
 |____ Finally /etc/rc.d/rc.local would gets executed.

User Login.

*UEFI (Unified Extensible Firmware Interface) based systems would normally implement GPT (Guid Partition Table) partition scheme instead of MBR which supports disks of larger size (more than 2 TB). For more details about MBR v/s GPT please visit this link: http://simplylinuxfaq.blogspot.in/2017/10/main-differences-between-mbr-gpt.html

......** this may change in recent linux variants and on non-x86 platform. Instead of BIOS, there would be EFI being used in case of Itanium-based systems.

Courtesy: http://www.ibm.com/developerworks/linux/library/l-linuxboot/index.html


Anonymous said...

Thanks for the information

Anonymous said...

Thank you!! This is what i really wanted!