Linux Boot Process

Updated date: 2025-03-20

Boot process for Ubuntu

BIOS/UEFI Initialization

BIOS (Basic Input/Output System) or UEFI (Unified Extensible Firmware Interface) is the first software that runs when a computer is powered on.

It performs hardware initialization, such as testing the processor, memory (RAM), and other components (keyboard, disk drives, etc.), and ensures that they are working properly.

Once initialization is complete, the BIOS/UEFI looks for a bootable device (HDD, SSD, USB drive, CD/DVD, etc.).

You can see the BIOS settings as shown below

$ sudo apt install dmidecod
$ sudo dmidecode  | less
# dmidecode 3.3
Getting SMBIOS data from sysfs.
SMBIOS 3.3.0 present.
Table at 0x414DB000.

Handle 0x0000, DMI type 0, 26 bytes
BIOS Information
        Vendor: Intel Corp.
        Version: TNTGL357.0064.2022.0217.1550
        Release Date: 02/17/2022
        Address: 0xF0000
        Runtime Size: 64 kB
        ROM Size: 0 MB
        Characteristics:
                PCI is supported
                BIOS is upgradeable
                BIOS shadowing is allowed
                Boot from CD is supported
                Selectable boot is supported
                BIOS ROM is socketed
                EDD is supported
...

BIOS

BIOS uses the MBR (Master Boot Record) partitioning scheme, which is limited to 2TB of disk space and supports up to four primary partitions.
The BIOS loads the bootloader from the MBR and transfers control to the operating system loader (e.g., GRUB, Windows bootloader).
BIOS operates in legacy mode and loads the operating system in a more traditional manner, where it initializes hardware and starts the bootloader from the MBR.
BIOS has a smaller, simpler code base, typically stored in a chip with limited storage (usually around 1-2 MB).

UEFI

UEFI uses the GPT (GUID Partition Table) partitioning scheme, which supports disks larger than 2TB and allows for a large number of partitions (up to 128).
UEFI systems boot via the EFI System Partition (ESP), where boot files are stored, and the UEFI firmware directly loads the OS bootloader (no MBR required).
UEFI operates in native mode and can load operating systems directly from the EFI system partition, making it more efficient and secure.
UEFI supports secure boot, which prevents unauthorized bootloaders or malware from running during the boot process.
UEFI also supports additional features like Measured Boot, Boot Guard, and TPM (Trusted Platform Module).
UEFI is much larger and more complex, and it can be stored in flash memory with a much larger size (often in the range of 10-16 MB or more).

Bootloader (GRUB or LILO)

The bootloader is responsible for loading the operating system into memory. In most modern Linux systems, GRUB (Grand Unified Bootloader) is the bootloader used.
When the BIOS/UEFI hands control over, it passes execution to the bootloader found in the MBR (Master Boot Record) or UEFI partition.
GRUB displays a menu if there are multiple operating systems or kernels to choose from, and it waits for the user’s input (or selects a default kernel after a timeout).
The bootloader then loads the selected kernel into memory.

GRUB for Ubuntu 22.04

$ uname -r
5.15.0-105-generic
$ cd /boot/grub/x86_64-efi
// https://help.ubuntu.com/community/Grub2
$ tree
.
├── fonts
│   └── unicode.pf2
├── grub.cfg
├── grubenv
├── locale
├── unicode.pf2
└── x86_64-efi
    ├── acpi.mod
    ├── adler32.mod
    ├── affs.mod
    ├── afs.mod
    ├── afsplitter.mod
    ├── ahci.mod
    ├── all_video.mod
    ├── aout.mod
...
    ├── gptsync.mod
    ├── grub.efi

Kernel Initialization

Once GRUB has loaded the kernel, the Linux kernel takes over.
The kernel is loaded into memory and begins its initialization process:
1. Kernel Setup: Initializes the hardware and sets up data structures necessary for the system to operate.
2. Memory Management: Initializes memory management and sets up virtual memory, paging, and swap space.
3. Device Drivers: Loads device drivers needed to access the hardware, such as the disk, video, network, and input devices.
4. Filesystem Mounting: Mounts the root filesystem (usually from the root partition, typically /), which contains the core files needed for the operating system to run.

Initial RAM Disk (initrd or initramfs)

During boot, the kernel may require additional drivers or modules that aren't compiled directly into the kernel. This is where the initial RAM disk (initrd) or initramfs comes into play.
The initrd is a temporary root filesystem stored in memory, used to load necessary drivers (like filesystem drivers or disk drivers) that allow the kernel to access the real root filesystem.
Once the required modules are loaded, the initrd is no longer needed.

Systemd or Init Process

After kernel initialization, the system starts the first user-space program, which is typically systemd on modern Linux distributions (older systems may use SysVinit or Upstart).
systemd is the system and service manager that starts and manages all the other processes needed for the operating system to function.
- It reads its configuration files (like /etc/systemd/system/default.target) and starts the appropriate system target (usually multi-user or graphical).
- Systemd also manages system services (daemons) that start automatically, such as networking, login services, logging, and others.

# sudo systemctl status
● ubuntu
    State: degraded
     Jobs: 0 queued
   Failed: 1 units
    Since: Sun 2024-04-21 14:30:55 UTC; 10 months 28 days ago
   CGroup: /
           ├─user.slice 
           │ └─user-1000.slice 
           │   ├─user@1000.service …
           │   │ ├─app.slice 
           │   │ │ └─dbus.service 
           │   │ │   └─13319 /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
           │   │ └─init.scope 
           │   │   ├─1658 /lib/systemd/systemd --user
           │   │   └─1659 (sd-pam)
           │   ├─session-2.scope 
           │   │ ├─1020 /bin/login -p --
           │   │ ├─1665 -bash
           │   │ ├─1708 sudo su
           │   │ ├─1709 sudo su
           │   │ ├─1710 su
           │   │ ├─1711 bash
           │   │ ├─1720 wpa_supplicant -Bc /etc/wpa_supplicant/wpa_supplicant.conf -i wlo1
           │   │ └─1722 dhclient wlo1
           │   ├─session-7.scope 
           │   │ ├─   2174 tmux
           │   │ ├─ 501760 -bash
           │   │ ├─ 505659 -bash

Mounting Other Filesystems

The system then mounts other filesystems, such as /home, /var, /boot, and any network file systems if necessary.
This step ensures that the operating system has access to all the required files and directories needed for normal operation.

For example,

$ sudo systemctl cat boot.mount
# /run/systemd/generator/boot.mount
# Automatically generated by systemd-fstab-generator

[Unit]
Documentation=man:fstab(5) man:systemd-fstab-generator(8)
SourcePath=/etc/fstab
Before=local-fs.target
Requires=systemd-fsck@dev-disk-by\x2duuid-e80245b5\x2dd541\x2d4fcc\x2d879d\x2d9e59a437ad8f.service
After=systemd-fsck@dev-disk-by\x2duuid-e80245b5\x2dd541\x2d4fcc\x2d879d\x2d9e59a437ad8f.service
After=blockdev@dev-disk-by\x2duuid-e80245b5\x2dd541\x2d4fcc\x2d879d\x2d9e59a437ad8f.target

[Mount]
Where=/boot
What=/dev/disk/by-uuid/e80245b5-d541-4fcc-879d-9e59a437ad8f
Type=ext4

Starting User Services

After mounting the required filesystems, systemd or the init process starts background services (daemons), which may include:
- Networking services (e.g., NetworkManager).
- Time synchronization services (e.g., ntpd).
- Database services, web servers, or any other services configured to start on boot.